@pulse-si/core 0.0.0-stage → 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Charles Désiré Bally
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,69 @@
-# Temporary Holding Version
+# @pulse-si/core
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Le cœur commun de [`@pulse-si/nest`](https://www.npmjs.com/package/@pulse-si/nest) et [`@pulse-si/next`](https://www.npmjs.com/package/@pulse-si/next). Tu n'as normalement pas à l'installer toi-même : c'est lui qui parle à l'API [Pulse](https://pulse-app.si), et cette page sert surtout à qui veut savoir exactement ce qui sort de son app.
+
+## Ce qu'il fait
+
+```
+                 ┌──────────────────────────── pulse-core ───────────────────────────┐
+ tes clients ──▶ │ detect   reconnaît Prisma, TypeORM, Mongoose, Redis, BullMQ, crons │
+ (Prisma…)       │ probes   SELECT 1 / PING, 5 s au plus, erreurs nettoyées           │
+                 │ selection  PULSE_SEND, PULSE_INCLUDE, PULSE_EXCLUDE                │
+ stdout/stderr ▶ │ logs     recopie, niveau, contexte, secrets masqués                │
+                 │ seal     HPKE (RFC 9180) si PULSE_PUBLIC_KEY                       │──▶ api.pulse-app.si
+                 │ reporter rythme dicté par l'API, accéléré en direct                │    (HTTPS seulement)
+                 └────────────────────────────────────────────────────────────────────┘
+```
+
+- **Aucune dépendance** : la bibliothèque standard de Node 18 et plus (`fetch`, `crypto`), rien d'autre à auditer.
+- **Ne lève jamais** : une panne de Pulse ne doit pas faire tomber l'app surveillée.
+- **Rien de métier** : l'état des dépendances, les passages des tâches, les versions, et les journaux si tu les envoies.
+
+## Ce qui part, mot pour mot
+
+Un rapport, toutes les 30 secondes en Pro (le rythme vient de l'API) :
+
+```json
+{
+  "packageName": "pulse-nest",
+  "packageVersion": "0.1.0",
+  "framework": "nestjs",
+  "frameworkVersion": "11.2.7",
+  "appVersion": "2.3.0",
+  "deployedAt": "2026-10-20T08:00:00.000Z",
+  "checks": [{ "name": "PostgreSQL", "kind": "database", "ok": true, "latencyMs": 4 }],
+  "crons": [{ "name": "relance-abonnements", "schedule": "0 * * * *", "lastRunOk": false, "error": "ETIMEDOUT" }]
+}
+```
+
+Un lot de journaux, toutes les 10 secondes (chaque seconde quand quelqu'un regarde) :
+
+```json
+{ "entries": [{ "at": "2026-10-20T12:12:56.000Z", "level": "ERROR", "context": "PaymentsService", "message": "Paiement refusé token=***" }] }
+```
+
+En mode sécurisé, chacun devient `{ "sealed": { "v": 1, "kid", "enc", "ct" }, "clear": { … } }` où `clear` ne contient que ce que tu as choisi de laisser lisible.
+
+## Nettoyage
+
+Avant de partir, chaque message passe par le même filtre :
+
+| Ce qui est trouvé | Ce qui part |
+|---|---|
+| `postgres://user:motdepasse@db:5432/app` | `postgres://***@db:5432/app` |
+| `password=…`, `secret=…`, `token=…`, `key=…` | `password=***` |
+| `Bearer eyJhbGciOi…`, `Basic dXNlcjpw…` | `Bearer ***` |
+| `pk_live_…`, `pk_agent_…` | `pk_live_***` |
+| paramètres d'URL dans une erreur | retirés |
+
+Les erreurs sont coupées à 300 caractères, les lignes de journal à 4 000.
+
+## Chiffrement
+
+- HPKE en mode de base (RFC 9180) : `DHKEM(X25519, HKDF-SHA256)`, `HKDF-SHA256`, `AES-256-GCM`, la suite que CryptoKit sait ouvrir sur iPhone et Mac.
+- `info` = `pulse/v1`, données authentifiées = `pulse/<report|logs>/<empreinte>` : un rapport ne peut pas passer pour un lot de journaux.
+- Une clé éphémère neuve par message. Vérifié contre les vecteurs officiels de la RFC (annexe A.1) et contre une implémentation indépendante.
+
+## Licence
+
+MIT

package/dist/config.d.ts

@@ -0,0 +1,19 @@
+import { type Selection } from './selection';
+import { type ClearField, type PulseLogger, type PulseOptions } from './types';
+export declare const DEFAULT_ENDPOINT = "https://api.pulse-app.si";
+export type PulseConfig = {
+    key: string;
+    endpoint: string;
+    appVersion?: string;
+    secure: {
+        publicKey: Buffer;
+        clear: readonly ClearField[];
+    } | null;
+    logs: boolean;
+    selection: Selection;
+    logger: PulseLogger;
+    fetch: typeof fetch;
+};
+export declare const defaultLogger: PulseLogger;
+export declare function isValidKey(key: string): boolean;
+export declare function resolveConfig(options: PulseOptions, env?: NodeJS.ProcessEnv): PulseConfig | null;

package/dist/config.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultLogger = exports.DEFAULT_ENDPOINT = void 0;
+exports.isValidKey = isValidKey;
+exports.resolveConfig = resolveConfig;
+const pinned_fetch_1 = require("./pinned-fetch");
+const seal_1 = require("./seal");
+const selection_1 = require("./selection");
+const types_1 = require("./types");
+exports.DEFAULT_ENDPOINT = 'https://api.pulse-app.si';
+const KEY_PATTERN = /^pk_(live|test)_[A-Za-z0-9_-]{20,}$/;
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+const DEFAULT_CLEAR = ['status'];
+exports.defaultLogger = {
+    warn: (message) => process.emitWarning(message, 'Pulse'),
+    error: (message) => process.emitWarning(message, 'Pulse'),
+};
+function isValidKey(key) {
+    return KEY_PATTERN.test(key);
+}
+function safeEndpoint(raw) {
+    try {
+        const url = new URL(raw);
+        if (url.protocol === 'https:' || LOCAL_HOSTS.has(url.hostname))
+            return url.origin;
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+function resolveConfig(options, env = process.env) {
+    const logger = options.logger ?? exports.defaultLogger;
+    if (options.disabled ?? env.PULSE_DISABLED === 'true')
+        return null;
+    const key = (options.key ?? env.PULSE_KEY ?? '').trim();
+    if (!key) {
+        logger.warn('PULSE_KEY absente : Pulse ne surveille pas cette app.');
+        return null;
+    }
+    if (!isValidKey(key)) {
+        logger.error('PULSE_KEY mal formée : elle commence par pk_live_ ou pk_test_.');
+        return null;
+    }
+    const endpoint = safeEndpoint(options.endpoint ?? env.PULSE_ENDPOINT ?? exports.DEFAULT_ENDPOINT);
+    if (!endpoint) {
+        logger.error('PULSE_ENDPOINT doit être en https.');
+        return null;
+    }
+    const rawPublicKey = options.publicKey ?? env.PULSE_PUBLIC_KEY;
+    const publicKey = rawPublicKey ? (0, seal_1.parsePublicKey)(rawPublicKey) : null;
+    if (rawPublicKey && !publicKey) {
+        logger.error('PULSE_PUBLIC_KEY mal formée : copie-la depuis l’app Pulse, elle commence par pulse_pub_.');
+        return null;
+    }
+    const rawFingerprint = options.relayFingerprint ?? env.PULSE_RELAY_FINGERPRINT;
+    const fingerprint = rawFingerprint ? (0, pinned_fetch_1.normalizeFingerprint)(rawFingerprint) : null;
+    if (rawFingerprint && !fingerprint) {
+        logger.error('PULSE_RELAY_FINGERPRINT mal formée : copie l’empreinte SHA-256 affichée par ton relais.');
+        return null;
+    }
+    const selection = (0, selection_1.resolveSelection)(options, env);
+    return {
+        key,
+        endpoint,
+        appVersion: options.appVersion ?? env.PULSE_APP_VERSION ?? env.npm_package_version,
+        secure: publicKey ? { publicKey, clear: clearFields(options.clear, env.PULSE_CLEAR) } : null,
+        logs: selection.send.includes('logs'),
+        selection,
+        logger,
+        fetch: options.fetch ?? (fingerprint ? (0, pinned_fetch_1.pinnedFetch)(fingerprint) : globalThis.fetch),
+    };
+}
+function clearFields(option, raw) {
+    if (option)
+        return option;
+    if (raw === undefined)
+        return DEFAULT_CLEAR;
+    const wanted = raw.split(',').map((field) => field.trim());
+    return types_1.CLEAR_FIELDS.filter((field) => wanted.includes(field));
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AA2BA,gCAEC;AAaD,sCA+CC;AAzFD,iDAAmE;AACnE,iCAAwC;AACxC,2CAA+D;AAC/D,mCAA6F;AAEhF,QAAA,gBAAgB,GAAG,0BAA0B,CAAC;AAC3D,MAAM,WAAW,GAAG,qCAAqC,CAAC;AAC1D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAaxE,MAAM,aAAa,GAA0B,CAAC,QAAQ,CAAC,CAAC;AAE3C,QAAA,aAAa,GAAgB;IACxC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;IACxD,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;CAC1D,CAAC;AAEF,SAAgB,UAAU,CAAC,GAAW;IACpC,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAGD,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,aAAa,CAC3B,OAAqB,EACrB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,qBAAa,CAAC;IAC/C,IAAI,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,cAAc,IAAI,wBAAgB,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,gBAAgB,CAAC;IAC/D,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,IAAA,qBAAc,EAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,IAAI,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,CACV,0FAA0F,CAC3F,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC,uBAAuB,CAAC;IAC/E,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,IAAA,mCAAoB,EAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,IAAI,cAAc,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CACV,yFAAyF,CAC1F,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,4BAAgB,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO;QACL,GAAG;QACH,QAAQ;QACR,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,mBAAmB;QAClF,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5F,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrC,SAAS;QACT,MAAM;QACN,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,0BAAW,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;KACpF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAyC,EAAE,GAAuB;IACrF,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,oBAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/detect.d.ts

@@ -0,0 +1,3 @@
+import type { CronSnapshot, Probe } from './types';
+export declare function detectProbes(instances: unknown[]): Probe[];
+export declare function cronSnapshots(jobs: Map<string, unknown>): CronSnapshot[];

package/dist/detect.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectProbes = detectProbes;
+exports.cronSnapshots = cronSnapshots;
+const ENGINE_NAMES = {
+    postgresql: 'PostgreSQL',
+    postgres: 'PostgreSQL',
+    mysql: 'MySQL',
+    mariadb: 'MariaDB',
+    sqlserver: 'SQL Server',
+    mssql: 'SQL Server',
+    sqlite: 'SQLite',
+    'better-sqlite3': 'SQLite',
+    mongodb: 'MongoDB',
+    cockroachdb: 'CockroachDB',
+};
+const isFunction = (value) => typeof value === 'function';
+const engineName = (raw) => typeof raw === 'string' ? (ENGINE_NAMES[raw.toLowerCase()] ?? raw) : 'Base de données';
+const call = (instance, method, ...args) => Promise.resolve(instance[method].apply(instance, args));
+function prismaProvider(instance) {
+    const config = (instance._engineConfig ?? {});
+    return (instance._activeProvider ?? config.activeProvider);
+}
+const DETECTORS = [
+    (instance) => {
+        if (!isFunction(instance.$queryRawUnsafe) || !isFunction(instance.$connect))
+            return null;
+        const provider = prismaProvider(instance);
+        const mongo = provider === 'mongodb';
+        return {
+            label: engineName(provider),
+            kind: 'database',
+            engine: provider ?? 'prisma',
+            run: () => mongo
+                ? call(instance, '$runCommandRaw', { ping: 1 })
+                : call(instance, '$queryRawUnsafe', 'SELECT 1'),
+        };
+    },
+    (instance) => {
+        if (!isFunction(instance.query) || typeof instance.isInitialized !== 'boolean')
+            return null;
+        const type = instance.options?.type;
+        return {
+            label: engineName(type),
+            kind: 'database',
+            engine: typeof type === 'string' ? type : 'typeorm',
+            run: () => call(instance, 'query', 'SELECT 1'),
+        };
+    },
+    (instance) => {
+        const db = instance.db;
+        if (typeof instance.readyState !== 'number' || !db || !isFunction(db.admin))
+            return null;
+        return {
+            label: 'MongoDB',
+            kind: 'database',
+            engine: 'mongodb',
+            run: () => call(call(db, 'admin'), 'ping'),
+        };
+    },
+    (instance) => {
+        const isIoredis = typeof instance.status === 'string' && isFunction(instance.ping) && 'options' in instance;
+        const isNodeRedis = typeof instance.isOpen === 'boolean' && isFunction(instance.ping);
+        if (!isIoredis && !isNodeRedis)
+            return null;
+        return { label: 'Redis', kind: 'redis', engine: 'redis', run: () => call(instance, 'ping') };
+    },
+    (instance) => {
+        if (typeof instance.name !== 'string' ||
+            !isFunction(instance.getJobCounts) ||
+            !isFunction(instance.add))
+            return null;
+        return {
+            label: `File ${instance.name}`,
+            kind: 'queue',
+            engine: 'bullmq',
+            run: () => call(instance, 'getJobCounts', 'waiting'),
+        };
+    },
+];
+function detectProbes(instances) {
+    const seen = new Set();
+    const probes = [];
+    const names = new Map();
+    for (const instance of instances) {
+        if (!instance || typeof instance !== 'object' || seen.has(instance))
+            continue;
+        seen.add(instance);
+        for (const detect of DETECTORS) {
+            let found = null;
+            try {
+                found = detect(instance);
+            }
+            catch {
+                found = null;
+            }
+            if (!found)
+                continue;
+            const count = (names.get(found.label) ?? 0) + 1;
+            names.set(found.label, count);
+            const { label, ...probe } = found;
+            probes.push({ ...probe, name: count > 1 ? `${label} (${count})` : label });
+            break;
+        }
+    }
+    return probes;
+}
+const toDate = (value) => {
+    if (value instanceof Date)
+        return value;
+    if (value && typeof value === 'object' && isFunction(value.toJSDate)) {
+        return value.toJSDate();
+    }
+    return undefined;
+};
+function cronSnapshots(jobs) {
+    return [...jobs].map(([name, raw]) => {
+        const job = raw;
+        const source = job.cronTime?.source;
+        return {
+            name,
+            schedule: typeof source === 'string' ? source : undefined,
+            lastRunAt: toDate(job.lastDate?.()),
+            nextRunAt: toDate(job.nextDate?.()),
+        };
+    });
+}
+//# sourceMappingURL=detect.js.map

package/dist/detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":";;AA2FA,oCAuBC;AAgBD,sCAWC;AAxID,MAAM,YAAY,GAA2B;IAC3C,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,YAAY;IACtB,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,YAAY;IACvB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,QAAQ;IAChB,gBAAgB,EAAE,QAAQ;IAC1B,OAAO,EAAE,SAAS;IAClB,WAAW,EAAE,aAAa;CAC3B,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAc,EAA4C,EAAE,CAC9E,OAAO,KAAK,KAAK,UAAU,CAAC;AAE9B,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,EAAE,CAClC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;AAEzF,MAAM,IAAI,GAAG,CAAC,QAAmB,EAAE,MAAc,EAAE,GAAG,IAAe,EAAE,EAAE,CACvE,OAAO,CAAC,OAAO,CAAE,QAAQ,CAAC,MAAM,CAAkC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AAE5F,SAAS,cAAc,CAAC,QAAmB;IACzC,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAc,CAAC;IAC3D,OAAO,CAAC,QAAQ,CAAC,eAAe,IAAI,MAAM,CAAC,cAAc,CAAuB,CAAC;AACnF,CAAC;AAGD,MAAM,SAAS,GAAe;IAC5B,CAAC,QAAQ,EAAE,EAAE;QACX,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACzF,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS,CAAC;QACrC,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC;YAC3B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,QAAQ,IAAI,QAAQ;YAC5B,GAAG,EAAE,GAAG,EAAE,CACR,KAAK;gBACH,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/C,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE,UAAU,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,CAAC,QAAQ,EAAE,EAAE;QACX,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,QAAQ,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5F,MAAM,IAAI,GAAI,QAAQ,CAAC,OAAiC,EAAE,IAAI,CAAC;QAC/D,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC;YACvB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACnD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC;SAC/C,CAAC;IACJ,CAAC;IACD,CAAC,QAAQ,EAAE,EAAE;QACX,MAAM,EAAE,GAAG,QAAQ,CAAC,EAA2B,CAAC;QAChD,IAAI,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzF,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAyB,EAAE,MAAM,CAAC;SACnE,CAAC;IACJ,CAAC;IACD,CAAC,QAAQ,EAAE,EAAE;QACX,MAAM,SAAS,GACb,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,IAAI,QAAQ,CAAC;QAC5F,MAAM,WAAW,GAAG,OAAO,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;IAC/F,CAAC;IACD,CAAC,QAAQ,EAAE,EAAE;QACX,IACE,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;YAClC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YAEzB,OAAO,IAAI,CAAC;QACd,OAAO;YACL,KAAK,EAAE,QAAQ,QAAQ,CAAC,IAAI,EAAE;YAC9B,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,CAAC;SACrD,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,SAAgB,YAAY,CAAC,SAAoB;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC9E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnB,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,KAAK,GAAyB,IAAI,CAAC;YACvC,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,CAAC,QAAqB,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAChD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC9B,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3E,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAoB,EAAE;IAClD,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAE,KAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpF,OAAQ,KAAkC,CAAC,QAAQ,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,SAAgB,aAAa,CAAC,IAA0B;IACtD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;QACnC,MAAM,GAAG,GAAG,GAAkB,CAAC;QAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC;QACpC,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACzD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;SACpC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/hpke.d.ts

@@ -0,0 +1,25 @@
+import { type KeyObject } from 'node:crypto';
+export declare const AEADS: {
+    readonly 'aes-128-gcm': {
+        readonly id: 1;
+        readonly keyBytes: 16;
+    };
+    readonly 'aes-256-gcm': {
+        readonly id: 2;
+        readonly keyBytes: 32;
+    };
+};
+export type Aead = keyof typeof AEADS;
+export type Sealed = {
+    enc: Buffer;
+    ct: Buffer;
+};
+export declare function privateKeyFromRaw(raw: Buffer): KeyObject;
+export declare function publicKeyFromRaw(raw: Buffer): KeyObject;
+export declare function rawPublicKey(key: KeyObject): Buffer;
+export declare function generateKeyPair(): {
+    privateKey: Buffer;
+    publicKey: Buffer;
+};
+export declare function seal(recipientPublicKey: Buffer, info: Buffer, aad: Buffer, plaintext: Buffer, aead?: Aead, ephemeral?: KeyObject): Sealed;
+export declare function open(recipientPrivateKey: Buffer, info: Buffer, aad: Buffer, sealed: Sealed, aead?: Aead): Buffer;

package/dist/hpke.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AEADS = void 0;
+exports.privateKeyFromRaw = privateKeyFromRaw;
+exports.publicKeyFromRaw = publicKeyFromRaw;
+exports.rawPublicKey = rawPublicKey;
+exports.generateKeyPair = generateKeyPair;
+exports.seal = seal;
+exports.open = open;
+const node_crypto_1 = require("node:crypto");
+const HASH_BYTES = 32;
+const NONCE_BYTES = 12;
+const TAG_BYTES = 16;
+const KEM_ID = 0x0020;
+const KDF_ID = 0x0001;
+const PKCS8_X25519_PREFIX = Buffer.from('302e020100300506032b656e04220420', 'hex');
+const SPKI_X25519_PREFIX = Buffer.from('302a300506032b656e032100', 'hex');
+exports.AEADS = {
+    'aes-128-gcm': { id: 0x0001, keyBytes: 16 },
+    'aes-256-gcm': { id: 0x0002, keyBytes: 32 },
+};
+function i2osp(value, bytes) {
+    const out = Buffer.alloc(bytes);
+    out.writeUIntBE(value, 0, bytes);
+    return out;
+}
+function extract(salt, ikm) {
+    return (0, node_crypto_1.createHmac)('sha256', salt.length ? salt : Buffer.alloc(HASH_BYTES))
+        .update(ikm)
+        .digest();
+}
+function expand(prk, info, length) {
+    const blocks = [];
+    let previous = Buffer.alloc(0);
+    for (let counter = 1; Buffer.concat(blocks).length < length; counter += 1) {
+        previous = (0, node_crypto_1.createHmac)('sha256', prk)
+            .update(Buffer.concat([previous, info, i2osp(counter, 1)]))
+            .digest();
+        blocks.push(previous);
+    }
+    return Buffer.concat(blocks).subarray(0, length);
+}
+function labeled(suiteId) {
+    const prefix = (label) => Buffer.concat([Buffer.from('HPKE-v1'), suiteId, Buffer.from(label)]);
+    return {
+        extract: (salt, label, ikm) => extract(salt, Buffer.concat([prefix(label), ikm])),
+        expand: (prk, label, info, length) => expand(prk, Buffer.concat([i2osp(length, 2), prefix(label), info]), length),
+    };
+}
+const KEM = labeled(Buffer.concat([Buffer.from('KEM'), i2osp(KEM_ID, 2)]));
+function privateKeyFromRaw(raw) {
+    return (0, node_crypto_1.createPrivateKey)({
+        key: Buffer.concat([PKCS8_X25519_PREFIX, raw]),
+        format: 'der',
+        type: 'pkcs8',
+    });
+}
+function publicKeyFromRaw(raw) {
+    return (0, node_crypto_1.createPublicKey)({
+        key: Buffer.concat([SPKI_X25519_PREFIX, raw]),
+        format: 'der',
+        type: 'spki',
+    });
+}
+function rawPublicKey(key) {
+    return key.export({ format: 'der', type: 'spki' }).subarray(SPKI_X25519_PREFIX.length);
+}
+function generateKeyPair() {
+    const pair = (0, node_crypto_1.generateKeyPairSync)('x25519');
+    return {
+        privateKey: pair.privateKey
+            .export({ format: 'der', type: 'pkcs8' })
+            .subarray(PKCS8_X25519_PREFIX.length),
+        publicKey: rawPublicKey(pair.publicKey),
+    };
+}
+function sharedSecret(dh, enc, recipient) {
+    const prk = KEM.extract(Buffer.alloc(0), 'eae_prk', dh);
+    return KEM.expand(prk, 'shared_secret', Buffer.concat([enc, recipient]), HASH_BYTES);
+}
+function keySchedule(shared, info, aead) {
+    const suite = labeled(Buffer.concat([
+        Buffer.from('HPKE'),
+        i2osp(KEM_ID, 2),
+        i2osp(KDF_ID, 2),
+        i2osp(exports.AEADS[aead].id, 2),
+    ]));
+    const empty = Buffer.alloc(0);
+    const context = Buffer.concat([
+        i2osp(0, 1),
+        suite.extract(empty, 'psk_id_hash', empty),
+        suite.extract(empty, 'info_hash', info),
+    ]);
+    const secret = suite.extract(shared, 'secret', empty);
+    return {
+        key: suite.expand(secret, 'key', context, exports.AEADS[aead].keyBytes),
+        nonce: suite.expand(secret, 'base_nonce', context, NONCE_BYTES),
+    };
+}
+function seal(recipientPublicKey, info, aad, plaintext, aead = 'aes-256-gcm', ephemeral = (0, node_crypto_1.generateKeyPairSync)('x25519').privateKey) {
+    const enc = rawPublicKey((0, node_crypto_1.createPublicKey)(ephemeral));
+    const dh = (0, node_crypto_1.diffieHellman)({
+        privateKey: ephemeral,
+        publicKey: publicKeyFromRaw(recipientPublicKey),
+    });
+    const { key, nonce } = keySchedule(sharedSecret(dh, enc, recipientPublicKey), info, aead);
+    const cipher = (0, node_crypto_1.createCipheriv)(aead, key, nonce).setAAD(aad);
+    const ct = Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()]);
+    return { enc, ct };
+}
+function open(recipientPrivateKey, info, aad, sealed, aead = 'aes-256-gcm') {
+    const privateKey = privateKeyFromRaw(recipientPrivateKey);
+    const recipient = rawPublicKey((0, node_crypto_1.createPublicKey)(privateKey));
+    const dh = (0, node_crypto_1.diffieHellman)({ privateKey, publicKey: publicKeyFromRaw(sealed.enc) });
+    const { key, nonce } = keySchedule(sharedSecret(dh, sealed.enc, recipient), info, aead);
+    const decipher = (0, node_crypto_1.createDecipheriv)(aead, key, nonce).setAAD(aad);
+    decipher.setAuthTag(sealed.ct.subarray(sealed.ct.length - TAG_BYTES));
+    return Buffer.concat([
+        decipher.update(sealed.ct.subarray(0, sealed.ct.length - TAG_BYTES)),
+        decipher.final(),
+    ]);
+}
+//# sourceMappingURL=hpke.js.map

package/dist/hpke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hpke.js","sourceRoot":"","sources":["../src/hpke.ts"],"names":[],"mappings":";;;AAgEA,8CAMC;AAED,4CAMC;AAED,oCAEC;AAED,0CAQC;AA8BD,oBAiBC;AAED,oBAiBC;AA9JD,6CASqB;AAErB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,MAAM,GAAG,MAAM,CAAC;AACtB,MAAM,MAAM,GAAG,MAAM,CAAC;AACtB,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AACnF,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE7D,QAAA,KAAK,GAAG;IACnB,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;IAC3C,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;CACnC,CAAC;AAKX,SAAS,KAAK,CAAC,KAAa,EAAE,KAAa;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW;IACxC,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;SACvE,MAAM,CAAC,GAAG,CAAC;SACX,MAAM,EAAE,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,GAAW,EAAE,IAAY,EAAE,MAAc;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC1E,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,GAAG,CAAC;aACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;aAC1D,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO;QACL,OAAO,EAAE,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW,EAAE,EAAE,CACpD,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,MAAM,EAAE,CAAC,GAAW,EAAE,KAAa,EAAE,IAAY,EAAE,MAAc,EAAE,EAAE,CACnE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3E,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,OAAO,IAAA,8BAAgB,EAAC;QACtB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,OAAO,IAAA,6BAAe,EAAC;QACrB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,YAAY,CAAC,GAAc;IACzC,OAAO,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACzF,CAAC;AAED,SAAgB,eAAe;IAC7B,MAAM,IAAI,GAAG,IAAA,iCAAmB,EAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;aACxB,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;aACxC,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC;QACvC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,EAAU,EAAE,GAAW,EAAE,SAAiB;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,IAAU;IAC3D,MAAM,KAAK,GAAG,OAAO,CACnB,MAAM,CAAC,MAAM,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAChB,KAAK,CAAC,aAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACzB,CAAC,CACH,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACX,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC;QAC1C,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,aAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QAC/D,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,CAAC;KAChE,CAAC;AACJ,CAAC;AAGD,SAAgB,IAAI,CAClB,kBAA0B,EAC1B,IAAY,EACZ,GAAW,EACX,SAAiB,EACjB,OAAa,aAAa,EAC1B,YAAuB,IAAA,iCAAmB,EAAC,QAAQ,CAAC,CAAC,UAAU;IAE/D,MAAM,GAAG,GAAG,YAAY,CAAC,IAAA,6BAAe,EAAC,SAAS,CAAC,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,IAAA,2BAAa,EAAC;QACvB,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,gBAAgB,CAAC,kBAAkB,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1F,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AACrB,CAAC;AAED,SAAgB,IAAI,CAClB,mBAA2B,EAC3B,IAAY,EACZ,GAAW,EACX,MAAc,EACd,OAAa,aAAa;IAE1B,MAAM,UAAU,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAA,6BAAe,EAAC,UAAU,CAAC,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,IAAA,2BAAa,EAAC,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QACpE,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { DEFAULT_ENDPOINT, isValidKey, resolveConfig } from './config';
+export { cronSnapshots, detectProbes } from './detect';
+export { httpProbe, runProbe } from './probes';
+export { PulseReporter } from './reporter';
+export { sanitizeError } from './sanitize';
+export * from './types';
+export { installedVersion, ownVersion } from './versions';
+export { generateKeyPair } from './hpke';
+export { formatPublicKey, keyId, openJson, parsePublicKey, sealJson, type SealedEnvelope, } from './seal';
+export { LOG_LEVELS, parseLogLine, type LogEntry, type LogLevel } from './logs';
+export { isSelected } from './selection';
+export { normalizeFingerprint } from './pinned-fetch';

package/dist/index.js

@@ -0,0 +1,51 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeFingerprint = exports.isSelected = exports.parseLogLine = exports.LOG_LEVELS = exports.sealJson = exports.parsePublicKey = exports.openJson = exports.keyId = exports.formatPublicKey = exports.generateKeyPair = exports.ownVersion = exports.installedVersion = exports.sanitizeError = exports.PulseReporter = exports.runProbe = exports.httpProbe = exports.detectProbes = exports.cronSnapshots = exports.resolveConfig = exports.isValidKey = exports.DEFAULT_ENDPOINT = void 0;
+var config_1 = require("./config");
+Object.defineProperty(exports, "DEFAULT_ENDPOINT", { enumerable: true, get: function () { return config_1.DEFAULT_ENDPOINT; } });
+Object.defineProperty(exports, "isValidKey", { enumerable: true, get: function () { return config_1.isValidKey; } });
+Object.defineProperty(exports, "resolveConfig", { enumerable: true, get: function () { return config_1.resolveConfig; } });
+var detect_1 = require("./detect");
+Object.defineProperty(exports, "cronSnapshots", { enumerable: true, get: function () { return detect_1.cronSnapshots; } });
+Object.defineProperty(exports, "detectProbes", { enumerable: true, get: function () { return detect_1.detectProbes; } });
+var probes_1 = require("./probes");
+Object.defineProperty(exports, "httpProbe", { enumerable: true, get: function () { return probes_1.httpProbe; } });
+Object.defineProperty(exports, "runProbe", { enumerable: true, get: function () { return probes_1.runProbe; } });
+var reporter_1 = require("./reporter");
+Object.defineProperty(exports, "PulseReporter", { enumerable: true, get: function () { return reporter_1.PulseReporter; } });
+var sanitize_1 = require("./sanitize");
+Object.defineProperty(exports, "sanitizeError", { enumerable: true, get: function () { return sanitize_1.sanitizeError; } });
+__exportStar(require("./types"), exports);
+var versions_1 = require("./versions");
+Object.defineProperty(exports, "installedVersion", { enumerable: true, get: function () { return versions_1.installedVersion; } });
+Object.defineProperty(exports, "ownVersion", { enumerable: true, get: function () { return versions_1.ownVersion; } });
+var hpke_1 = require("./hpke");
+Object.defineProperty(exports, "generateKeyPair", { enumerable: true, get: function () { return hpke_1.generateKeyPair; } });
+var seal_1 = require("./seal");
+Object.defineProperty(exports, "formatPublicKey", { enumerable: true, get: function () { return seal_1.formatPublicKey; } });
+Object.defineProperty(exports, "keyId", { enumerable: true, get: function () { return seal_1.keyId; } });
+Object.defineProperty(exports, "openJson", { enumerable: true, get: function () { return seal_1.openJson; } });
+Object.defineProperty(exports, "parsePublicKey", { enumerable: true, get: function () { return seal_1.parsePublicKey; } });
+Object.defineProperty(exports, "sealJson", { enumerable: true, get: function () { return seal_1.sealJson; } });
+var logs_1 = require("./logs");
+Object.defineProperty(exports, "LOG_LEVELS", { enumerable: true, get: function () { return logs_1.LOG_LEVELS; } });
+Object.defineProperty(exports, "parseLogLine", { enumerable: true, get: function () { return logs_1.parseLogLine; } });
+var selection_1 = require("./selection");
+Object.defineProperty(exports, "isSelected", { enumerable: true, get: function () { return selection_1.isSelected; } });
+var pinned_fetch_1 = require("./pinned-fetch");
+Object.defineProperty(exports, "normalizeFingerprint", { enumerable: true, get: function () { return pinned_fetch_1.normalizeFingerprint; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,mCAAuE;AAA9D,0GAAA,gBAAgB,OAAA;AAAE,oGAAA,UAAU,OAAA;AAAE,uGAAA,aAAa,OAAA;AACpD,mCAAuD;AAA9C,uGAAA,aAAa,OAAA;AAAE,sGAAA,YAAY,OAAA;AACpC,mCAA+C;AAAtC,mGAAA,SAAS,OAAA;AAAE,kGAAA,QAAQ,OAAA;AAC5B,uCAA2C;AAAlC,yGAAA,aAAa,OAAA;AACtB,uCAA2C;AAAlC,yGAAA,aAAa,OAAA;AACtB,0CAAwB;AACxB,uCAA0D;AAAjD,4GAAA,gBAAgB,OAAA;AAAE,sGAAA,UAAU,OAAA;AACrC,+BAAyC;AAAhC,uGAAA,eAAe,OAAA;AACxB,+BAOgB;AANd,uGAAA,eAAe,OAAA;AACf,6FAAA,KAAK,OAAA;AACL,gGAAA,QAAQ,OAAA;AACR,sGAAA,cAAc,OAAA;AACd,gGAAA,QAAQ,OAAA;AAGV,+BAAgF;AAAvE,kGAAA,UAAU,OAAA;AAAE,oGAAA,YAAY,OAAA;AACjC,yCAAyC;AAAhC,uGAAA,UAAU,OAAA;AACnB,+CAAsD;AAA7C,oHAAA,oBAAoB,OAAA"}

package/dist/log-shipper.d.ts

@@ -0,0 +1,25 @@
+import type { PulseConfig } from './config';
+import { LogCollector } from './logs';
+export type ServerState = {
+    logs: boolean;
+    live: boolean;
+};
+export declare class LogShipper {
+    private readonly config;
+    private readonly userAgent;
+    private readonly onState;
+    private readonly warn;
+    readonly collector: LogCollector;
+    private restore?;
+    private timer?;
+    private stopped;
+    private state;
+    private accepted;
+    constructor(config: PulseConfig, userAgent: string, onState: (state: ServerState) => void, warn: (message: string) => void);
+    start(): void;
+    stop(): void;
+    update(state: ServerState): void;
+    flush(): Promise<number>;
+    private release;
+    private schedule;
+}