@ratelkey/burrow-sdk 0.1.0 → 0.2.1

package/README.md

@@ -2,20 +2,10 @@
 
 Read secrets from a self-hosted [RatelKey](https://ratelkey.com) Burrow with a machine identity.
 
-This is the Node.js SDK. It lives under `tools/SDKs/<language>/`, one directory per language; each SDK is a
-standalone, independently-published artifact that speaks the same signed machine data-plane protocol. Its API
-mirrors the Kotlin/JVM SDK one-for-one, so a Burrow reads the same way in either language.
-
-## What it does
-
-A machine authenticates to a Burrow with a per-request **Ed25519 signature** — no session, no long-lived
-bearer token. The private key is generated on the machine during bootstrap and never leaves it. This SDK
-signs each read the same way the `ratel` CLI does, so a machine bootstrapped once works with both.
-
 - Single and structured secrets, and individual fields of a structured secret.
-- The machine's own access map (which projects/environments it can read).
-- Trust-on-first-use certificate pinning for the default self-signed Burrow (shared pin store with the CLI),
-  or standard CA trust for a Burrow on a real domain.
+- The machine's own access map (`listProjects`, `listSecrets`).
+- Certificate pinning, or standard CA trust (`TlsMode`).
+- An OIDC token instead of a key (`Burrow.oidc`).
 
 ## Requirements
 
@@ -24,9 +14,8 @@ signs each read the same way the `ratel` CLI does, so a machine bootstrapped onc
 
 ## Bootstrap a machine
 
-From the Burrow dashboard, open **Machines → Add machine** and run the one-line install on the target host.
-It generates the keypair locally, registers the public key, and writes the identity to
-`~/.burrow/burrows/<slug>/identity.json`. Grant the machine access to the projects/environments it needs.
+From the Burrow dashboard, **Machines → Add machine**, and run the install it gives you on the target host.
+The identity lands at `~/.burrow/burrows/<slug>/identity.json`.
 
 ## Quick start
 
@@ -49,8 +38,6 @@ const [user, pass] = db.getFields("username", "password");    // in order — de
 for (const p of await burrow.listProjects()) console.log(`${p.project}: ${p.categories}`);
 ```
 
-Resolving the identity and loading its key are synchronous; only the reads themselves are async.
-
 Point it at a specific identity by selector or path:
 
 ```ts
@@ -70,21 +57,20 @@ const burrow = Burrow.connect({
 });
 ```
 
-## Certificate trust
+## OIDC
+
+```ts
+const burrow = Burrow.oidc({
+  burrowUrl: "https://burrow.example.com",
+  fingerprint: process.env.BURROW_FINGERPRINT, // omit for a publicly-trusted certificate
+});
 
-Burrows serve HTTPS self-signed by default, so the SDK pins the Burrow's **public key** rather than
-disabling verification. The key, not the certificate: a Burrow that adds a custom domain or renews its
-certificate is still the same Burrow, and pinning the certificate would refuse it.
+const apiKey = (await burrow.getSecret("payments/prod/API_KEY")).value;
+```
 
-- `TlsMode.Pinned` (default) — trust-on-first-use; pins on first contact, refuses a changed key. Kept beside
-  that Burrow's identity at `~/.burrow/burrows/<slug>/known_cert`, shared with the CLI.
-- `TlsMode.PinnedTo("aa:bb:…")` — pin to a known fingerprint (the SHA-256 the Burrow shows in its network
-  settings). No first-use trust.
-- `TlsMode.SystemTrust` — standard CA + hostname verification, for a Burrow on a custom domain or Let's
-  Encrypt.
+`audience` defaults to `burrowUrl`. GitHub Actions currently requires `permissions: id-token: write`.
 
-The handshake completes and the pin is checked before the HTTP request is written, so a mismatched
-certificate never sees the signed request.
+## Certificate trust
 
 ```ts
 import { Burrow, TlsMode } from "@ratelkey/burrow-sdk";
@@ -92,6 +78,11 @@ import { Burrow, TlsMode } from "@ratelkey/burrow-sdk";
 const burrow = Burrow(null, { tls: TlsMode.SystemTrust });
 ```
 
+- `TlsMode.Pinned` (default) — trust-on-first-use, stored at `~/.burrow/burrows/<slug>/known_cert`.
+- `TlsMode.PinnedTo("aa:bb:…")` — a fixed fingerprint (from the Burrow's network settings).
+- `TlsMode.SystemTrust` — CA + hostname verification, for a Burrow on a custom domain or Let's Encrypt.
+- `TlsMode.Insecure` — no verification; accepts any certificate. Opt-in only, for a network you already trust. Shortcut: `Burrow().insecureTls(true)`.
+
 ## Errors
 
 Every failure is a `BurrowException`: `BurrowAuthException` (401), `BurrowForbiddenException` (403, no grant),

package/dist/cjs/Auth.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcAuthorizer = exports.SignedAuthorizer = void 0;
+const Oidc_js_1 = require("./Oidc.js");
+const Signer_js_1 = require("./Signer.js");
+/** Signs each request with the machine's Ed25519 key. */
+class SignedAuthorizer {
+    machineId;
+    key;
+    clientTag;
+    now;
+    constructor(machineId, key, clientTag, now = Date.now) {
+        this.machineId = machineId;
+        this.key = key;
+        this.clientTag = clientTag;
+        this.now = now;
+    }
+    authorize(action, resource) {
+        return Promise.resolve(Signer_js_1.MachineSigner.sign(this.machineId, this.key, action, resource, this.clientTag, this.now()));
+    }
+}
+exports.SignedAuthorizer = SignedAuthorizer;
+/** Mints a provider OIDC token per request and sends it as a bearer. No key; the Burrow identifies the machine
+ *  from the token's claims. */
+class OidcAuthorizer {
+    audience;
+    clientTag;
+    machineId = "";
+    constructor(audience, clientTag) {
+        this.audience = audience;
+        this.clientTag = clientTag;
+    }
+    async authorize() {
+        const token = await (0, Oidc_js_1.mintOidcToken)(this.audience);
+        return { Authorization: `Bearer ${token}`, "Ratel-Client": this.clientTag };
+    }
+}
+exports.OidcAuthorizer = OidcAuthorizer;
+//# sourceMappingURL=Auth.js.map

package/dist/cjs/Auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth.js","sourceRoot":"","sources":["../../src/Auth.ts"],"names":[],"mappings":";;;AACA,uCAA0C;AAC1C,2CAA4C;AAc5C,yDAAyD;AACzD,MAAa,gBAAgB;IAEhB;IACQ;IACA;IACA;IAJnB,YACW,SAAiB,EACT,GAAc,EACd,SAAiB,EACjB,MAAoB,IAAI,CAAC,GAAG;QAHpC,cAAS,GAAT,SAAS,CAAQ;QACT,QAAG,GAAH,GAAG,CAAW;QACd,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,SAAS,CAAC,MAAc,EAAE,QAAkB;QAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,yBAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrH,CAAC;CACF;AAXD,4CAWC;AAED;+BAC+B;AAC/B,MAAa,cAAc;IAGI;IAAmC;IAFvD,SAAS,GAAG,EAAE,CAAC;IAExB,YAA6B,QAAgB,EAAmB,SAAiB;QAApD,aAAQ,GAAR,QAAQ,CAAQ;QAAmB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAErF,KAAK,CAAC,SAAS;QACb,MAAM,KAAK,GAAG,MAAM,IAAA,uBAAa,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9E,CAAC;CACF;AATD,wCASC"}

package/dist/cjs/Burrow.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Burrow = exports.DEFAULT_CLIENT_TAG = exports.SDK_VERSION = void 0;
+const Auth_js_1 = require("./Auth.js");
 const BurrowClient_js_1 = require("./BurrowClient.js");
 const Identity_js_1 = require("./Identity.js");
 const Tls_js_1 = require("./Tls.js");
@@ -16,7 +17,8 @@ exports.DEFAULT_CLIENT_TAG = `ratel-sdk-node/${exports.SDK_VERSION}`;
  */
 function open(target, options = {}) {
     const id = Identity_js_1.Identities.select(target);
-    return new BurrowClient_js_1.DefaultBurrowClient(id.burrowUrl, id.machineId, id.loadPrivateKey(), options.clientTag ?? exports.DEFAULT_CLIENT_TAG, options.tls ?? Tls_js_1.TlsMode.Pinned, id.directory);
+    const clientTag = options.clientTag ?? exports.DEFAULT_CLIENT_TAG;
+    return new BurrowClient_js_1.DefaultBurrowClient(id.burrowUrl, new Auth_js_1.SignedAuthorizer(id.machineId, id.loadPrivateKey(), clientTag), options.tls ?? Tls_js_1.TlsMode.Pinned, id.directory);
 }
 /**
  * Connect with an explicit identity — for an app that manages its own key material rather than reading the
@@ -24,7 +26,21 @@ function open(target, options = {}) {
  */
 function connect(options) {
     const key = (0, Identity_js_1.parseEd25519PrivateKey)(options.privateKeyPem, "provided PEM");
-    return new BurrowClient_js_1.DefaultBurrowClient(options.burrowUrl, options.machineId, key, options.clientTag ?? exports.DEFAULT_CLIENT_TAG, options.tls ?? Tls_js_1.TlsMode.Pinned, options.pinStoreDir ?? null);
+    const clientTag = options.clientTag ?? exports.DEFAULT_CLIENT_TAG;
+    return new BurrowClient_js_1.DefaultBurrowClient(options.burrowUrl, new Auth_js_1.SignedAuthorizer(options.machineId, key, clientTag), options.tls ?? Tls_js_1.TlsMode.Pinned, options.pinStoreDir ?? null);
 }
-exports.Burrow = Object.assign(open, { DEFAULT_CLIENT_TAG: exports.DEFAULT_CLIENT_TAG, connect });
+/**
+ * Connect with OIDC — for a CI workflow (GitHub Actions today) that reads secrets with no key. Each call
+ * mints a fresh provider token for {@link OidcConnectOptions.audience} and sends it as a bearer; the Burrow
+ * verifies it against the machine's trust policy. There is no key and nothing written to disk.
+ *
+ * TLS defaults to {@link OidcConnectOptions.fingerprint} when given (pin the burrow's public key, from its
+ * Network settings) and otherwise to system trust — trust-on-first-use is useless on an ephemeral runner.
+ */
+function oidc(options) {
+    const clientTag = options.clientTag ?? exports.DEFAULT_CLIENT_TAG;
+    const tls = options.tls ?? (options.fingerprint ? Tls_js_1.TlsMode.PinnedTo(options.fingerprint) : Tls_js_1.TlsMode.SystemTrust);
+    return new BurrowClient_js_1.DefaultBurrowClient(options.burrowUrl, new Auth_js_1.OidcAuthorizer(options.audience ?? options.burrowUrl, clientTag), tls, null);
+}
+exports.Burrow = Object.assign(open, { DEFAULT_CLIENT_TAG: exports.DEFAULT_CLIENT_TAG, connect, oidc });
 //# sourceMappingURL=Burrow.js.map

package/dist/cjs/Burrow.js.map

@@ -1 +1 @@
-{"version":3,"file":"Burrow.js","sourceRoot":"","sources":["../../src/Burrow.ts"],"names":[],"mappings":";;;AAAA,uDAA2E;AAC3E,+CAAmE;AACnE,qCAAmC;AAEnC,2FAA2F;AAC9E,QAAA,WAAW,GAAG,OAAO,CAAC;AAEnC,4GAA4G;AAC/F,QAAA,kBAAkB,GAAG,kBAAkB,mBAAW,EAAE,CAAC;AA2BlE;;;;;GAKG;AACH,SAAS,IAAI,CAAC,MAAsB,EAAE,UAAyB,EAAE;IAC/D,MAAM,EAAE,GAAG,wBAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,IAAI,qCAAmB,CAC5B,EAAE,CAAC,SAAS,EACZ,EAAE,CAAC,SAAS,EACZ,EAAE,CAAC,cAAc,EAAE,EACnB,OAAO,CAAC,SAAS,IAAI,0BAAkB,EACvC,OAAO,CAAC,GAAG,IAAI,gBAAO,CAAC,MAAM,EAC7B,EAAE,CAAC,SAAS,CACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,OAAuB;IACtC,MAAM,GAAG,GAAG,IAAA,oCAAsB,EAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1E,OAAO,IAAI,qCAAmB,CAC5B,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,SAAS,EACjB,GAAG,EACH,OAAO,CAAC,SAAS,IAAI,0BAAkB,EACvC,OAAO,CAAC,GAAG,IAAI,gBAAO,CAAC,MAAM,EAC7B,OAAO,CAAC,WAAW,IAAI,IAAI,CAC5B,CAAC;AACJ,CAAC;AAiCY,QAAA,MAAM,GAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAlB,0BAAkB,EAAE,OAAO,EAAE,CAAC,CAAC"}
+{"version":3,"file":"Burrow.js","sourceRoot":"","sources":["../../src/Burrow.ts"],"names":[],"mappings":";;;AAAA,uCAA6D;AAC7D,uDAA2E;AAC3E,+CAAmE;AACnE,qCAAmC;AAEnC,2FAA2F;AAC9E,QAAA,WAAW,GAAG,OAAO,CAAC;AAEnC,4GAA4G;AAC/F,QAAA,kBAAkB,GAAG,kBAAkB,mBAAW,EAAE,CAAC;AAuClE;;;;;GAKG;AACH,SAAS,IAAI,CAAC,MAAsB,EAAE,UAAyB,EAAE;IAC/D,MAAM,EAAE,GAAG,wBAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,0BAAkB,CAAC;IAC1D,OAAO,IAAI,qCAAmB,CAC5B,EAAE,CAAC,SAAS,EACZ,IAAI,0BAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,SAAS,CAAC,EAClE,OAAO,CAAC,GAAG,IAAI,gBAAO,CAAC,MAAM,EAC7B,EAAE,CAAC,SAAS,CACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,OAAuB;IACtC,MAAM,GAAG,GAAG,IAAA,oCAAsB,EAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,0BAAkB,CAAC;IAC1D,OAAO,IAAI,qCAAmB,CAC5B,OAAO,CAAC,SAAS,EACjB,IAAI,0BAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EACvD,OAAO,CAAC,GAAG,IAAI,gBAAO,CAAC,MAAM,EAC7B,OAAO,CAAC,WAAW,IAAI,IAAI,CAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,IAAI,CAAC,OAA2B;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,0BAAkB,CAAC;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAO,CAAC,WAAW,CAAC,CAAC;IAC/G,OAAO,IAAI,qCAAmB,CAC5B,OAAO,CAAC,SAAS,EACjB,IAAI,wBAAc,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EACpE,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC;AAoCY,QAAA,MAAM,GAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAlB,0BAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/dist/cjs/BurrowClient.js

@@ -3,26 +3,34 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DefaultBurrowClient = void 0;
 const Errors_js_1 = require("./Errors.js");
 const Model_js_1 = require("./Model.js");
-const Signer_js_1 = require("./Signer.js");
+const Tls_js_1 = require("./Tls.js");
 const Transport_js_1 = require("./Transport.js");
-/** The default {@link BurrowClient}: signs each request and talks to the Burrow over the pinned transport. */
+/** The default {@link BurrowClient}: authenticates each request via its {@link Authorizer} and talks to the
+ *  Burrow over the pinned transport. */
 class DefaultBurrowClient {
     burrowUrl;
-    machineId;
-    key;
-    clientTag;
-    now;
+    authorizer;
     transport;
-    constructor(burrowUrl, machineId, key, clientTag, tls, 
+    machineId;
+    /** The trust mode the client was created with, so `insecureTls(false)` can restore it. */
+    tls;
+    pinStoreDir;
+    constructor(burrowUrl, authorizer, tls, 
     /** Where this Burrow's pinned key is kept — its identity directory. Null for a caller that has none. */
-    pinStoreDir, now = Date.now) {
+    pinStoreDir) {
         this.burrowUrl = burrowUrl;
-        this.machineId = machineId;
-        this.key = key;
-        this.clientTag = clientTag;
-        this.now = now;
+        this.authorizer = authorizer;
+        this.machineId = authorizer.machineId;
+        this.tls = tls;
+        this.pinStoreDir = pinStoreDir;
         this.transport = new Transport_js_1.Transport(burrowUrl, tls, pinStoreDir);
     }
+    insecureTls(enabled = true) {
+        // Rebuild the transport rather than mutate it; no request has gone out yet (the transport dials lazily),
+        // so this is free before the first read. `false` reverts to the mode the client was constructed with.
+        this.transport = new Transport_js_1.Transport(this.burrowUrl, enabled ? Tls_js_1.TlsMode.Insecure : this.tls, this.pinStoreDir);
+        return this;
+    }
     async getSecret(coordinate) {
         const c = Model_js_1.SecretCoordinate.parse(coordinate);
         if (c.project.length === 0 || c.environment.length === 0 || c.name.length === 0) {
@@ -51,8 +59,8 @@ class DefaultBurrowClient {
             return new Model_js_1.ProjectAccess(typeof o["project"] === "string" ? o["project"] : "", Array.isArray(categories) ? categories.filter((c) => typeof c === "string") : []);
         });
     }
-    signedGet(action, resource, path) {
-        const headers = Signer_js_1.MachineSigner.sign(this.machineId, this.key, action, resource, this.clientTag, this.now());
+    async signedGet(action, resource, path) {
+        const headers = await this.authorizer.authorize(action, resource);
         return this.transport.get(path, headers);
     }
 }

package/dist/cjs/BurrowClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"BurrowClient.js","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":";;;AACA,2CAAuD;AACvD,yCAAuF;AACvF,2CAA4C;AAE5C,iDAA2C;AA2B3C,8GAA8G;AAC9G,MAAa,mBAAmB;IAInB;IACA;IACQ;IACA;IAIA;IAVF,SAAS,CAAY;IAEtC,YACW,SAAiB,EACjB,SAAiB,EACT,GAAc,EACd,SAAiB,EAClC,GAAY;IACZ,wGAAwG;IACxG,WAA0B,EACT,MAAoB,IAAI,CAAC,GAAG;QAPpC,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAQ;QACT,QAAG,GAAH,GAAG,CAAW;QACd,cAAS,GAAT,SAAS,CAAQ;QAIjB,QAAG,GAAH,GAAG,CAAyB;QAE7C,IAAI,CAAC,SAAS,GAAG,IAAI,wBAAS,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,CAAC,GAAG,2BAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,SAAS,CAAC,8DAA8D,UAAU,GAAG,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAC/B,aAAa,EACb,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAClC,uBAAuB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;YACnC,OAAO,IAAI,wBAAa,CACtB,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,QAAkB,EAAE,IAAY;QAChE,MAAM,OAAO,GAAG,yBAAa,CAAC,IAAI,CAChC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,GAAG,EACR,MAAM,EACN,QAAQ,EACR,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AA/DD,kDA+DC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;YACjD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,iBAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,iBAAM,CAAC,MAAM,CAClB,IAAI,EACJ,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAClD,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,oCAAwB,CAChC,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EACzE,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,oCAAwB,CAAC,kDAAkD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,oBAAoB,CAAC"}
+{"version":3,"file":"BurrowClient.js","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":";;;AACA,2CAAuD;AACvD,yCAAuF;AACvF,qCAAmC;AACnC,iDAA2C;AAqC3C;wCACwC;AACxC,MAAa,mBAAmB;IAQnB;IACQ;IARX,SAAS,CAAY;IACpB,SAAS,CAAS;IAC3B,0FAA0F;IACzE,GAAG,CAAU;IACb,WAAW,CAAgB;IAE5C,YACW,SAAiB,EACT,UAAsB,EACvC,GAAY;IACZ,wGAAwG;IACxG,WAA0B;QAJjB,cAAS,GAAT,SAAS,CAAQ;QACT,eAAU,GAAV,UAAU,CAAY;QAKvC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,wBAAS,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,WAAW,CAAC,OAAO,GAAG,IAAI;QACxB,yGAAyG;QACzG,sGAAsG;QACtG,IAAI,CAAC,SAAS,GAAG,IAAI,wBAAS,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,CAAC,GAAG,2BAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,SAAS,CAAC,8DAA8D,UAAU,GAAG,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAC/B,aAAa,EACb,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAClC,uBAAuB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;YACnC,OAAO,IAAI,wBAAa,CACtB,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,QAAkB,EAAE,IAAY;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAnED,kDAmEC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;YACjD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,iBAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,iBAAM,CAAC,MAAM,CAClB,IAAI,EACJ,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAClD,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,oCAAwB,CAChC,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EACzE,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,oCAAwB,CAAC,kDAAkD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,oBAAoB,CAAC"}

package/dist/cjs/Oidc.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oidcProviderDetected = oidcProviderDetected;
+exports.mintOidcToken = mintOidcToken;
+const Errors_js_1 = require("./Errors.js");
+/**
+ * Mints a provider OIDC token for the machine data plane — the CI path, where the client holds no key and
+ * proves itself with a short-lived token its provider signs. GitHub Actions is the provider today.
+ *
+ * The token's audience must be the value the Burrow's trust policy requires; the Burrow verifies the token's
+ * signature against the provider's keys and matches its claims (repository, workflow, environment) to that
+ * policy. Nothing here is a secret at rest: the token lives for minutes and is minted per request.
+ */
+/** Whether this process can mint an OIDC token right now (GitHub Actions with `id-token: write`). */
+function oidcProviderDetected() {
+    return ((process.env["ACTIONS_ID_TOKEN_REQUEST_URL"]?.length ?? 0) > 0 &&
+        (process.env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"]?.length ?? 0) > 0);
+}
+/** Request a token for `audience` from the detected provider. Throws if no provider is available. */
+async function mintOidcToken(audience) {
+    const requestUrl = process.env["ACTIONS_ID_TOKEN_REQUEST_URL"];
+    const requestToken = process.env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"];
+    if (!requestUrl || !requestToken) {
+        throw new Errors_js_1.BurrowAuthException("no OIDC provider detected. In GitHub Actions the workflow needs 'permissions: id-token: write' " +
+            "(which sets ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN)");
+    }
+    const url = new URL(requestUrl);
+    if (audience.length > 0)
+        url.searchParams.set("audience", audience);
+    let response;
+    try {
+        // GitHub's token service, publicly trusted — ordinary TLS verification applies.
+        response = await fetch(url, {
+            headers: { Authorization: `Bearer ${requestToken}`, Accept: "application/json" },
+        });
+    }
+    catch (e) {
+        throw new Errors_js_1.BurrowAuthException(`requesting an OIDC token from the provider: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
+    }
+    if (!response.ok) {
+        throw new Errors_js_1.BurrowAuthException(`the OIDC token request failed (HTTP ${response.status})`);
+    }
+    const body = (await response.json().catch(() => ({})));
+    if (typeof body.value !== "string" || body.value.length === 0) {
+        throw new Errors_js_1.BurrowAuthException("the OIDC provider returned no token");
+    }
+    return body.value;
+}
+//# sourceMappingURL=Oidc.js.map

package/dist/cjs/Oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Oidc.js","sourceRoot":"","sources":["../../src/Oidc.ts"],"names":[],"mappings":";;AAYA,oDAKC;AAGD,sCA6BC;AAjDD,2CAAkD;AAElD;;;;;;;GAOG;AAEH,qGAAqG;AACrG,SAAgB,oBAAoB;IAClC,OAAO,CACL,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC9D,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,qGAAqG;AAC9F,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,IAAI,+BAAmB,CAC3B,iGAAiG;YAC/F,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEpE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,gFAAgF;QAChF,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACjF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,+BAAmB,CAAC,+CAA+C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3I,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,+BAAmB,CAAC,uCAAuC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAwB,CAAC;IAC9E,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,+BAAmB,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC"}

package/dist/cjs/Tls.js

@@ -6,11 +6,13 @@ exports.fingerprintsEqual = fingerprintsEqual;
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
-/** The three trust modes, as values: `TlsMode.Pinned`, `TlsMode.PinnedTo("aa:bb:…")`, `TlsMode.SystemTrust`. */
+/** The trust modes, as values: `TlsMode.Pinned`, `TlsMode.PinnedTo("aa:bb:…")`, `TlsMode.SystemTrust`, `TlsMode.Insecure`. */
 exports.TlsMode = {
     Pinned: { kind: "pinned" },
     PinnedTo: (fingerprint) => ({ kind: "pinnedTo", fingerprint }),
     SystemTrust: { kind: "systemTrust" },
+    /** No verification — accept any certificate. Opt-in only; defeats MITM protection. */
+    Insecure: { kind: "insecure" },
 };
 /**
  * SHA-256 of a certificate's PUBLIC KEY (its SubjectPublicKeyInfo) as lowercase colon-separated hex — the

package/dist/cjs/Tls.js.map

@@ -1 +1 @@
-{"version":3,"file":"Tls.js","sourceRoot":"","sources":["../../src/Tls.ts"],"names":[],"mappings":";;;AA+CA,oCAIC;AAGD,8CAIC;AA1DD,6CAA0D;AAC1D,qCAA6E;AAC7E,yCAA0C;AAyB1C,gHAAgH;AACnG,QAAA,OAAO,GAAG;IACrB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAa;IACrC,QAAQ,EAAE,CAAC,WAAmB,EAAW,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAC/E,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAa;CACvC,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,SAAgB,YAAY,CAAC,GAAe;IAC1C,MAAM,IAAI,GAAG,IAAI,6BAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACrG,MAAM,GAAG,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,SAAgB,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjF,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAa,QAAQ;IACF,IAAI,CAAgB;IAErC,YAAY,GAAkB;QAC5B,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAW;QACf,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO;QAC/B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO;QAChC,gGAAgG;QAChG,IAAI,CAAC;YACH,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;YAC/B,IAAA,uBAAa,EAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;YAC/B,IAAA,oBAAU,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;CACF;AA7BD,4BA6BC"}
+{"version":3,"file":"Tls.js","sourceRoot":"","sources":["../../src/Tls.ts"],"names":[],"mappings":";;;AAwDA,oCAIC;AAGD,8CAIC;AAnED,6CAA0D;AAC1D,qCAA6E;AAC7E,yCAA0C;AAgC1C,8HAA8H;AACjH,QAAA,OAAO,GAAG;IACrB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAa;IACrC,QAAQ,EAAE,CAAC,WAAmB,EAAW,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAC/E,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAa;IAC/C,sFAAsF;IACtF,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAa;CACjC,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,SAAgB,YAAY,CAAC,GAAe;IAC1C,MAAM,IAAI,GAAG,IAAI,6BAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACrG,MAAM,GAAG,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,SAAgB,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjF,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAa,QAAQ;IACF,IAAI,CAAgB;IAErC,YAAY,GAAkB;QAC5B,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAW;QACf,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO;QAC/B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO;QAChC,gGAAgG;QAChG,IAAI,CAAC;YACH,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;YAC/B,IAAA,uBAAa,EAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;YAC/B,IAAA,oBAAU,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;CACF;AA7BD,4BA6BC"}

package/dist/cjs/Transport.js

@@ -68,10 +68,11 @@ class Transport {
     connect(url) {
         const host = url.hostname;
         const port = url.port.length > 0 ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
-        // Pinning is authoritative for a self-signed Burrow, so the CA chain and hostname checks are waived —
-        // the certificate is reached by IP or a self-signed domain that no SAN or CA would match. SystemTrust
-        // keeps the full standard verification and needs no pin check of its own.
-        const pinning = this.tls.kind !== "systemTrust";
+        // SystemTrust does full CA + hostname verification; the pinned modes waive that and verify by public-key
+        // pin instead (the cert is reached by IP or a self-signed domain no CA would match); Insecure does neither
+        // and accepts any certificate. Only the pinned modes run the pin check in onSecure below.
+        const verifying = this.tls.kind === "systemTrust";
+        const pinning = this.tls.kind === "pinned" || this.tls.kind === "pinnedTo";
         const socket = url.protocol === "http:"
             ? (0, node_net_1.connect)({ host, port })
             : (0, node_tls_1.connect)({
@@ -79,7 +80,7 @@ class Transport {
                 port,
                 // SNI carries a hostname; an IP literal is not a legal server name.
                 ...((0, node_net_1.isIP)(host) === 0 ? { servername: host } : {}),
-                rejectUnauthorized: !pinning,
+                rejectUnauthorized: verifying,
             });
         return new Promise((resolve, reject) => {
             const finish = (settle) => {

package/dist/cjs/Transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"Transport.js","sourceRoot":"","sources":["../../src/Transport.ts"],"names":[],"mappings":";;;AAAA,yCAAyE;AACzE,uCAAoE;AAEpE,uCAAiE;AACjE,2CAQqB;AACrB,qCAAmF;AAEnF,MAAM,UAAU,GAAG,MAAM,CAAC;AAQ1B;;;;;;;;;GASG;AACH,MAAa,SAAS;IAQD;IAPF,IAAI,CAAS;IACb,IAAI,CAAW;IAChC,0GAA0G;IAClG,MAAM,CAAgB;IAE9B,YACE,SAAiB,EACA,GAAY;IAC7B,uGAAuG;IACvG,WAA0B;QAFT,QAAG,GAAH,GAAG,CAAS;QAI7B,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,iBAAQ,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,OAA+B;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,MAAc,CAAC;QACnB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,oCAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QAED,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,oCAAwB,CAChC,uBAAuB,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,EAC3D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC1D,MAAM,IAAI,oCAAwB,CAAC,eAAe,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oGAAoG;IAC5F,OAAO,CAAC,GAAQ;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,sGAAsG;QACtG,sGAAsG;QACtG,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC;QAEhD,MAAM,MAAM,GACV,GAAG,CAAC,QAAQ,KAAK,OAAO;YACtB,CAAC,CAAC,IAAA,kBAAU,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC,CAAC,IAAA,kBAAU,EAAC;gBACT,IAAI;gBACJ,IAAI;gBACJ,oEAAoE;gBACpE,GAAG,CAAC,IAAA,eAAI,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,kBAAkB,EAAE,CAAC,OAAO;aAC7B,CAAC,CAAC;QAET,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAQ,EAAE;gBAC1C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,CAAC,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;gBACjD,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC1C,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACrB,oGAAoG;gBACpG,uEAAuE;gBACvE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC3B,MAAM,EAAE,CAAC;YACX,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,CAAC,CAAQ,EAAQ,EAAE,CACjC,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,oCAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CACjG,CAAC;YAEJ,MAAM,SAAS,GAAG,GAAS,EAAE;gBAC3B,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,oCAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,qBAAqB,UAAU,IAAI,CAAC,CAAC,CACtG,CAAC;YACJ,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAEjF,MAAM,QAAQ,GAAG,GAAS,EAAE;gBAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBACrD,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAI,MAAoB,CAAC,kBAAkB,EAAE,CAAC,GAAyB,CAAC;gBACjF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,sCAA0B,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC;oBACxF,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,IAAA,qBAAY,EAAC,GAAG,CAAC,CAAC;gBAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;gBACxB,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,IAAA,0BAAiB,EAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;oBAClD,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CACJ,IAAI,sCAA0B,CAC5B,oDAAoD,GAAG,SAAS,IAAI,GAAG,CACxE,CACF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC;YAEF,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;;gBACjE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,WAA0B;QAC/C,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,8DAA8D;QACtG,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,yDAAyD;IACtF,CAAC;IAEO,QAAQ,CAAC,MAAc,EAAE,IAAY;QAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClD,MAAM,CAAC,GAAI,MAA8B,CAAC,KAAK,CAAC;gBAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;QAC/F,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,GAAG;gBACN,OAAO,IAAI,+BAAmB,CAAC,MAAM,CAAC,CAAC;YACzC,KAAK,GAAG;gBACN,OAAO,IAAI,oCAAwB,CAAC,MAAM,CAAC,CAAC;YAC9C,KAAK,GAAG;gBACN,OAAO,IAAI,mCAAuB,CAAC,MAAM,CAAC,CAAC;YAC7C;gBACE,OAAO,IAAI,iCAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF;AAtKD,8BAsKC;AAED,+GAA+G;AAC/G,SAAS,QAAQ,CACf,MAAc,EACd,GAAQ,EACR,OAA+B;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAA,mBAAW,EAAC;YACtB,MAAM,EAAE,KAAK;YACb,sGAAsG;YACtG,8CAA8C;YAC9C,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM;YAC9B,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;YAC/B,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SACpE,CAAC,CAAC;QAEH,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mBAAmB,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,GAAoB,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CACjB,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CACvF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM;IACb,yDAAyD;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"Transport.js","sourceRoot":"","sources":["../../src/Transport.ts"],"names":[],"mappings":";;;AAAA,yCAAyE;AACzE,uCAAoE;AAEpE,uCAAiE;AACjE,2CAQqB;AACrB,qCAAmF;AAEnF,MAAM,UAAU,GAAG,MAAM,CAAC;AAQ1B;;;;;;;;;GASG;AACH,MAAa,SAAS;IAQD;IAPF,IAAI,CAAS;IACb,IAAI,CAAW;IAChC,0GAA0G;IAClG,MAAM,CAAgB;IAE9B,YACE,SAAiB,EACA,GAAY;IAC7B,uGAAuG;IACvG,WAA0B;QAFT,QAAG,GAAH,GAAG,CAAS;QAI7B,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,iBAAQ,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,OAA+B;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,MAAc,CAAC;QACnB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,oCAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QAED,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,oCAAwB,CAChC,uBAAuB,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,EAC3D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC1D,MAAM,IAAI,oCAAwB,CAAC,eAAe,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oGAAoG;IAC5F,OAAO,CAAC,GAAQ;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,yGAAyG;QACzG,2GAA2G;QAC3G,0FAA0F;QAC1F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC;QAE3E,MAAM,MAAM,GACV,GAAG,CAAC,QAAQ,KAAK,OAAO;YACtB,CAAC,CAAC,IAAA,kBAAU,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC,CAAC,IAAA,kBAAU,EAAC;gBACT,IAAI;gBACJ,IAAI;gBACJ,oEAAoE;gBACpE,GAAG,CAAC,IAAA,eAAI,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,kBAAkB,EAAE,SAAS;aAC9B,CAAC,CAAC;QAET,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAQ,EAAE;gBAC1C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,CAAC,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;gBACjD,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC1C,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACrB,oGAAoG;gBACpG,uEAAuE;gBACvE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC3B,MAAM,EAAE,CAAC;YACX,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,CAAC,CAAQ,EAAQ,EAAE,CACjC,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,oCAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CACjG,CAAC;YAEJ,MAAM,SAAS,GAAG,GAAS,EAAE;gBAC3B,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,oCAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,qBAAqB,UAAU,IAAI,CAAC,CAAC,CACtG,CAAC;YACJ,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAEjF,MAAM,QAAQ,GAAG,GAAS,EAAE;gBAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBACrD,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAI,MAAoB,CAAC,kBAAkB,EAAE,CAAC,GAAyB,CAAC;gBACjF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,sCAA0B,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC;oBACxF,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,IAAA,qBAAY,EAAC,GAAG,CAAC,CAAC;gBAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;gBACxB,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,IAAA,0BAAiB,EAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;oBAClD,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CACJ,IAAI,sCAA0B,CAC5B,oDAAoD,GAAG,SAAS,IAAI,GAAG,CACxE,CACF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC;YAEF,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;;gBACjE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,WAA0B;QAC/C,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,8DAA8D;QACtG,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,yDAAyD;IACtF,CAAC;IAEO,QAAQ,CAAC,MAAc,EAAE,IAAY;QAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClD,MAAM,CAAC,GAAI,MAA8B,CAAC,KAAK,CAAC;gBAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;QAC/F,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,GAAG;gBACN,OAAO,IAAI,+BAAmB,CAAC,MAAM,CAAC,CAAC;YACzC,KAAK,GAAG;gBACN,OAAO,IAAI,oCAAwB,CAAC,MAAM,CAAC,CAAC;YAC9C,KAAK,GAAG;gBACN,OAAO,IAAI,mCAAuB,CAAC,MAAM,CAAC,CAAC;YAC7C;gBACE,OAAO,IAAI,iCAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF;AAvKD,8BAuKC;AAED,+GAA+G;AAC/G,SAAS,QAAQ,CACf,MAAc,EACd,GAAQ,EACR,OAA+B;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAA,mBAAW,EAAC;YACtB,MAAM,EAAE,KAAK;YACb,sGAAsG;YACtG,8CAA8C;YAC9C,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM;YAC9B,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;YAC/B,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SACpE,CAAC,CAAC;QAEH,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mBAAmB,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,GAAoB,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CACjB,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CACvF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM;IACb,yDAAyD;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/esm/Auth.d.ts

@@ -0,0 +1,31 @@
+import type { KeyObject } from "node:crypto";
+/**
+ * Produces the auth headers for one machine-plane request. Two implementations: {@link SignedAuthorizer} (an
+ * Ed25519 key signs each request) and {@link OidcAuthorizer} (a provider-minted bearer token). The client
+ * doesn't care which — it awaits `authorize` and hands the headers to the transport.
+ */
+export interface Authorizer {
+    /** The machine id, when known client-side. Empty for OIDC, where the Burrow resolves it from the token. */
+    readonly machineId: string;
+    /** Headers for the request. `resource` is the signed operation's coordinates (Ed25519 only). */
+    authorize(action: string, resource: string[]): Promise<Record<string, string>>;
+}
+/** Signs each request with the machine's Ed25519 key. */
+export declare class SignedAuthorizer implements Authorizer {
+    readonly machineId: string;
+    private readonly key;
+    private readonly clientTag;
+    private readonly now;
+    constructor(machineId: string, key: KeyObject, clientTag: string, now?: () => number);
+    authorize(action: string, resource: string[]): Promise<Record<string, string>>;
+}
+/** Mints a provider OIDC token per request and sends it as a bearer. No key; the Burrow identifies the machine
+ *  from the token's claims. */
+export declare class OidcAuthorizer implements Authorizer {
+    private readonly audience;
+    private readonly clientTag;
+    readonly machineId = "";
+    constructor(audience: string, clientTag: string);
+    authorize(): Promise<Record<string, string>>;
+}
+//# sourceMappingURL=Auth.d.ts.map

package/dist/esm/Auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth.d.ts","sourceRoot":"","sources":["../../src/Auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI7C;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,2GAA2G;IAC3G,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gGAAgG;IAChG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChF;AAED,yDAAyD;AACzD,qBAAa,gBAAiB,YAAW,UAAU;IAE/C,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHX,SAAS,EAAE,MAAM,EACT,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAG/E;AAED;+BAC+B;AAC/B,qBAAa,cAAe,YAAW,UAAU;IAGnC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;IAFzE,QAAQ,CAAC,SAAS,MAAM;gBAEK,QAAQ,EAAE,MAAM,EAAmB,SAAS,EAAE,MAAM;IAE3E,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAInD"}

package/dist/esm/Auth.js

@@ -0,0 +1,34 @@
+import { mintOidcToken } from "./Oidc.js";
+import { MachineSigner } from "./Signer.js";
+/** Signs each request with the machine's Ed25519 key. */
+export class SignedAuthorizer {
+    machineId;
+    key;
+    clientTag;
+    now;
+    constructor(machineId, key, clientTag, now = Date.now) {
+        this.machineId = machineId;
+        this.key = key;
+        this.clientTag = clientTag;
+        this.now = now;
+    }
+    authorize(action, resource) {
+        return Promise.resolve(MachineSigner.sign(this.machineId, this.key, action, resource, this.clientTag, this.now()));
+    }
+}
+/** Mints a provider OIDC token per request and sends it as a bearer. No key; the Burrow identifies the machine
+ *  from the token's claims. */
+export class OidcAuthorizer {
+    audience;
+    clientTag;
+    machineId = "";
+    constructor(audience, clientTag) {
+        this.audience = audience;
+        this.clientTag = clientTag;
+    }
+    async authorize() {
+        const token = await mintOidcToken(this.audience);
+        return { Authorization: `Bearer ${token}`, "Ratel-Client": this.clientTag };
+    }
+}
+//# sourceMappingURL=Auth.js.map

package/dist/esm/Auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth.js","sourceRoot":"","sources":["../../src/Auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAc5C,yDAAyD;AACzD,MAAM,OAAO,gBAAgB;IAEhB;IACQ;IACA;IACA;IAJnB,YACW,SAAiB,EACT,GAAc,EACd,SAAiB,EACjB,MAAoB,IAAI,CAAC,GAAG;QAHpC,cAAS,GAAT,SAAS,CAAQ;QACT,QAAG,GAAH,GAAG,CAAW;QACd,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,SAAS,CAAC,MAAc,EAAE,QAAkB;QAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrH,CAAC;CACF;AAED;+BAC+B;AAC/B,MAAM,OAAO,cAAc;IAGI;IAAmC;IAFvD,SAAS,GAAG,EAAE,CAAC;IAExB,YAA6B,QAAgB,EAAmB,SAAiB;QAApD,aAAQ,GAAR,QAAQ,CAAQ;QAAmB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAErF,KAAK,CAAC,SAAS;QACb,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9E,CAAC;CACF"}

package/dist/esm/Burrow.d.ts

@@ -27,6 +27,17 @@ export interface ConnectOptions extends BurrowOptions {
      */
     pinStoreDir?: string;
 }
+/** Options for {@link Burrow.oidc} — a CI workflow reading secrets with no key. */
+export interface OidcConnectOptions extends BurrowOptions {
+    burrowUrl: string;
+    /** The token audience the Burrow requires. Defaults to `burrowUrl`. */
+    audience?: string;
+    /**
+     * The Burrow's public-key fingerprint to pin (from its Network settings). Omit when the Burrow serves a
+     * publicly-trusted certificate. Ignored when `tls` is set explicitly.
+     */
+    fingerprint?: string;
+}
 /**
  * Entry point for reading secrets from a Burrow with a machine identity.
  *
@@ -54,6 +65,8 @@ export interface BurrowFactory {
     readonly DEFAULT_CLIENT_TAG: string;
     /** Connect with an explicit identity rather than one discovered under `~/.burrow`. */
     connect(options: ConnectOptions): BurrowClient;
+    /** Connect with OIDC — a CI workflow reading secrets with no key (GitHub Actions today). */
+    oidc(options: OidcConnectOptions): BurrowClient;
 }
 export declare const Burrow: BurrowFactory;
 //# sourceMappingURL=Burrow.d.ts.map

package/dist/esm/Burrow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Burrow.d.ts","sourceRoot":"","sources":["../../src/Burrow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAuB,MAAM,mBAAmB,CAAC;AAE3E,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,2FAA2F;AAC3F,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,4GAA4G;AAC5G,eAAO,MAAM,kBAAkB,yBAAkC,CAAC;AAElE,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,oGAAoG;IACpG,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+FAA+F;AAC/F,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAoCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,aAAa;IAC5B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IAEhE,4GAA4G;IAC5G,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAEpC,sFAAsF;IACtF,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,YAAY,CAAC;CAChD;AAED,eAAO,MAAM,MAAM,EAAE,aAAoE,CAAC"}
+{"version":3,"file":"Burrow.d.ts","sourceRoot":"","sources":["../../src/Burrow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,YAAY,EAAuB,MAAM,mBAAmB,CAAC;AAE3E,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,2FAA2F;AAC3F,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,4GAA4G;AAC5G,eAAO,MAAM,kBAAkB,yBAAkC,CAAC;AAElE,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,oGAAoG;IACpG,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+FAA+F;AAC/F,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mFAAmF;AACnF,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAqDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,aAAa;IAC5B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IAEhE,4GAA4G;IAC5G,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAEpC,sFAAsF;IACtF,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,YAAY,CAAC;IAE/C,4FAA4F;IAC5F,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,YAAY,CAAC;CACjD;AAED,eAAO,MAAM,MAAM,EAAE,aAA0E,CAAC"}

package/dist/esm/Burrow.js

@@ -1,3 +1,4 @@
+import { OidcAuthorizer, SignedAuthorizer } from "./Auth.js";
 import { DefaultBurrowClient } from "./BurrowClient.js";
 import { Identities, parseEd25519PrivateKey } from "./Identity.js";
 import { TlsMode } from "./Tls.js";
@@ -13,7 +14,8 @@ export const DEFAULT_CLIENT_TAG = `ratel-sdk-node/${SDK_VERSION}`;
  */
 function open(target, options = {}) {
     const id = Identities.select(target);
-    return new DefaultBurrowClient(id.burrowUrl, id.machineId, id.loadPrivateKey(), options.clientTag ?? DEFAULT_CLIENT_TAG, options.tls ?? TlsMode.Pinned, id.directory);
+    const clientTag = options.clientTag ?? DEFAULT_CLIENT_TAG;
+    return new DefaultBurrowClient(id.burrowUrl, new SignedAuthorizer(id.machineId, id.loadPrivateKey(), clientTag), options.tls ?? TlsMode.Pinned, id.directory);
 }
 /**
  * Connect with an explicit identity — for an app that manages its own key material rather than reading the
@@ -21,7 +23,21 @@ function open(target, options = {}) {
  */
 function connect(options) {
     const key = parseEd25519PrivateKey(options.privateKeyPem, "provided PEM");
-    return new DefaultBurrowClient(options.burrowUrl, options.machineId, key, options.clientTag ?? DEFAULT_CLIENT_TAG, options.tls ?? TlsMode.Pinned, options.pinStoreDir ?? null);
+    const clientTag = options.clientTag ?? DEFAULT_CLIENT_TAG;
+    return new DefaultBurrowClient(options.burrowUrl, new SignedAuthorizer(options.machineId, key, clientTag), options.tls ?? TlsMode.Pinned, options.pinStoreDir ?? null);
 }
-export const Burrow = Object.assign(open, { DEFAULT_CLIENT_TAG, connect });
+/**
+ * Connect with OIDC — for a CI workflow (GitHub Actions today) that reads secrets with no key. Each call
+ * mints a fresh provider token for {@link OidcConnectOptions.audience} and sends it as a bearer; the Burrow
+ * verifies it against the machine's trust policy. There is no key and nothing written to disk.
+ *
+ * TLS defaults to {@link OidcConnectOptions.fingerprint} when given (pin the burrow's public key, from its
+ * Network settings) and otherwise to system trust — trust-on-first-use is useless on an ephemeral runner.
+ */
+function oidc(options) {
+    const clientTag = options.clientTag ?? DEFAULT_CLIENT_TAG;
+    const tls = options.tls ?? (options.fingerprint ? TlsMode.PinnedTo(options.fingerprint) : TlsMode.SystemTrust);
+    return new DefaultBurrowClient(options.burrowUrl, new OidcAuthorizer(options.audience ?? options.burrowUrl, clientTag), tls, null);
+}
+export const Burrow = Object.assign(open, { DEFAULT_CLIENT_TAG, connect, oidc });
 //# sourceMappingURL=Burrow.js.map

package/dist/esm/Burrow.js.map

@@ -1 +1 @@
-{"version":3,"file":"Burrow.js","sourceRoot":"","sources":["../../src/Burrow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAEnC,4GAA4G;AAC5G,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,WAAW,EAAE,CAAC;AA2BlE;;;;;GAKG;AACH,SAAS,IAAI,CAAC,MAAsB,EAAE,UAAyB,EAAE;IAC/D,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,IAAI,mBAAmB,CAC5B,EAAE,CAAC,SAAS,EACZ,EAAE,CAAC,SAAS,EACZ,EAAE,CAAC,cAAc,EAAE,EACnB,OAAO,CAAC,SAAS,IAAI,kBAAkB,EACvC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,EAC7B,EAAE,CAAC,SAAS,CACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,OAAuB;IACtC,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1E,OAAO,IAAI,mBAAmB,CAC5B,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,SAAS,EACjB,GAAG,EACH,OAAO,CAAC,SAAS,IAAI,kBAAkB,EACvC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,EAC7B,OAAO,CAAC,WAAW,IAAI,IAAI,CAC5B,CAAC;AACJ,CAAC;AAiCD,MAAM,CAAC,MAAM,MAAM,GAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC"}
+{"version":3,"file":"Burrow.js","sourceRoot":"","sources":["../../src/Burrow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAqB,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAEnC,4GAA4G;AAC5G,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,WAAW,EAAE,CAAC;AAuClE;;;;;GAKG;AACH,SAAS,IAAI,CAAC,MAAsB,EAAE,UAAyB,EAAE;IAC/D,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,OAAO,IAAI,mBAAmB,CAC5B,EAAE,CAAC,SAAS,EACZ,IAAI,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,SAAS,CAAC,EAClE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,EAC7B,EAAE,CAAC,SAAS,CACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,OAAuB;IACtC,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,OAAO,IAAI,mBAAmB,CAC5B,OAAO,CAAC,SAAS,EACjB,IAAI,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EACvD,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,EAC7B,OAAO,CAAC,WAAW,IAAI,IAAI,CAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,IAAI,CAAC,OAA2B;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/G,OAAO,IAAI,mBAAmB,CAC5B,OAAO,CAAC,SAAS,EACjB,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EACpE,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC;AAoCD,MAAM,CAAC,MAAM,MAAM,GAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/dist/esm/BurrowClient.d.ts

@@ -1,14 +1,15 @@
-import type { KeyObject } from "node:crypto";
+import type { Authorizer } from "./Auth.js";
 import { ProjectAccess, Secret, SecretCoordinate } from "./Model.js";
-import type { TlsMode } from "./Tls.js";
+import { TlsMode } from "./Tls.js";
 /**
- * Reads secrets from a Burrow as a machine identity. Every call is independently Ed25519-signed — there is
- * no session and no long-lived bearer token. Instances are reusable; construct one via `Burrow`.
+ * Reads secrets from a Burrow as a machine identity. Every call is independently authenticated — either an
+ * Ed25519 signature or a freshly-minted OIDC token — with no session held. Instances are reusable; construct
+ * one via `Burrow`.
  */
 export interface BurrowClient {
     /** The Burrow this client reads from. */
     readonly burrowUrl: string;
-    /** The machine identity this client acts as. */
+    /** The machine identity this client acts as. Empty when authenticating by OIDC (the Burrow resolves it). */
     readonly machineId: string;
     /**
      * Read a secret by its `project/env/NAME` coordinate, whole, in one signed call. Project the result
@@ -20,18 +21,29 @@ export interface BurrowClient {
     listSecrets(): Promise<SecretCoordinate[]>;
     /** Every project this machine can read, and the environment categories it holds in each. */
     listProjects(): Promise<ProjectAccess[]>;
+    /**
+     * Turn TLS verification off (or back on) for this client, returning it for chaining —
+     * `Burrow().insecureTls(true)`. With it on, any certificate the Burrow presents is accepted: no CA,
+     * hostname, or pin check. Opt-in only; it defeats MITM protection, so use it solely on a transport you
+     * already trust (a private network, or a deliberate decision to accept the risk on a public IP). Passing
+     * `false` restores the trust mode the client was created with.
+     */
+    insecureTls(enabled?: boolean): this;
 }
-/** The default {@link BurrowClient}: signs each request and talks to the Burrow over the pinned transport. */
+/** The default {@link BurrowClient}: authenticates each request via its {@link Authorizer} and talks to the
+ *  Burrow over the pinned transport. */
 export declare class DefaultBurrowClient implements BurrowClient {
     readonly burrowUrl: string;
+    private readonly authorizer;
+    private transport;
     readonly machineId: string;
-    private readonly key;
-    private readonly clientTag;
-    private readonly now;
-    private readonly transport;
-    constructor(burrowUrl: string, machineId: string, key: KeyObject, clientTag: string, tls: TlsMode, 
+    /** The trust mode the client was created with, so `insecureTls(false)` can restore it. */
+    private readonly tls;
+    private readonly pinStoreDir;
+    constructor(burrowUrl: string, authorizer: Authorizer, tls: TlsMode, 
     /** Where this Burrow's pinned key is kept — its identity directory. Null for a caller that has none. */
-    pinStoreDir: string | null, now?: () => number);
+    pinStoreDir: string | null);
+    insecureTls(enabled?: boolean): this;
     getSecret(coordinate: string): Promise<Secret>;
     listSecrets(): Promise<SecretCoordinate[]>;
     listProjects(): Promise<ProjectAccess[]>;

package/dist/esm/BurrowClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BurrowClient.d.ts","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEvF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAGxC;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/C,2EAA2E;IAC3E,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE3C,4FAA4F;IAC5F,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAC1C;AAED,8GAA8G;AAC9G,qBAAa,mBAAoB,YAAW,YAAY;IAIpD,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAI1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAVtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAG3B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACT,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,EAClC,GAAG,EAAE,OAAO;IACZ,wGAAwG;IACxG,WAAW,EAAE,MAAM,GAAG,IAAI,EACT,GAAG,GAAE,MAAM,MAAiB;IAKzC,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa9C,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAQ1C,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAe9C,OAAO,CAAC,SAAS;CAWlB"}
+{"version":3,"file":"BurrowClient.d.ts","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAGnC;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,4GAA4G;IAC5G,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/C,2EAA2E;IAC3E,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE3C,4FAA4F;IAC5F,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAEzC;;;;;;OAMG;IACH,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACtC;AAED;wCACwC;AACxC,qBAAa,mBAAoB,YAAW,YAAY;IAQpD,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAR7B,OAAO,CAAC,SAAS,CAAY;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAU;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgB;gBAGjC,SAAS,EAAE,MAAM,EACT,UAAU,EAAE,UAAU,EACvC,GAAG,EAAE,OAAO;IACZ,wGAAwG;IACxG,WAAW,EAAE,MAAM,GAAG,IAAI;IAQ5B,WAAW,CAAC,OAAO,UAAO,GAAG,IAAI;IAO3B,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa9C,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAQ1C,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAehC,SAAS;CAIxB"}

package/dist/esm/BurrowClient.js

@@ -1,25 +1,33 @@
 import { BurrowTransportException } from "./Errors.js";
 import { ProjectAccess, Secret, SecretCoordinate } from "./Model.js";
-import { MachineSigner } from "./Signer.js";
+import { TlsMode } from "./Tls.js";
 import { Transport } from "./Transport.js";
-/** The default {@link BurrowClient}: signs each request and talks to the Burrow over the pinned transport. */
+/** The default {@link BurrowClient}: authenticates each request via its {@link Authorizer} and talks to the
+ *  Burrow over the pinned transport. */
 export class DefaultBurrowClient {
     burrowUrl;
-    machineId;
-    key;
-    clientTag;
-    now;
+    authorizer;
     transport;
-    constructor(burrowUrl, machineId, key, clientTag, tls, 
+    machineId;
+    /** The trust mode the client was created with, so `insecureTls(false)` can restore it. */
+    tls;
+    pinStoreDir;
+    constructor(burrowUrl, authorizer, tls, 
     /** Where this Burrow's pinned key is kept — its identity directory. Null for a caller that has none. */
-    pinStoreDir, now = Date.now) {
+    pinStoreDir) {
         this.burrowUrl = burrowUrl;
-        this.machineId = machineId;
-        this.key = key;
-        this.clientTag = clientTag;
-        this.now = now;
+        this.authorizer = authorizer;
+        this.machineId = authorizer.machineId;
+        this.tls = tls;
+        this.pinStoreDir = pinStoreDir;
         this.transport = new Transport(burrowUrl, tls, pinStoreDir);
     }
+    insecureTls(enabled = true) {
+        // Rebuild the transport rather than mutate it; no request has gone out yet (the transport dials lazily),
+        // so this is free before the first read. `false` reverts to the mode the client was constructed with.
+        this.transport = new Transport(this.burrowUrl, enabled ? TlsMode.Insecure : this.tls, this.pinStoreDir);
+        return this;
+    }
     async getSecret(coordinate) {
         const c = SecretCoordinate.parse(coordinate);
         if (c.project.length === 0 || c.environment.length === 0 || c.name.length === 0) {
@@ -48,8 +56,8 @@ export class DefaultBurrowClient {
             return new ProjectAccess(typeof o["project"] === "string" ? o["project"] : "", Array.isArray(categories) ? categories.filter((c) => typeof c === "string") : []);
         });
     }
-    signedGet(action, resource, path) {
-        const headers = MachineSigner.sign(this.machineId, this.key, action, resource, this.clientTag, this.now());
+    async signedGet(action, resource, path) {
+        const headers = await this.authorizer.authorize(action, resource);
         return this.transport.get(path, headers);
     }
 }

package/dist/esm/BurrowClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"BurrowClient.js","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AA2B3C,8GAA8G;AAC9G,MAAM,OAAO,mBAAmB;IAInB;IACA;IACQ;IACA;IAIA;IAVF,SAAS,CAAY;IAEtC,YACW,SAAiB,EACjB,SAAiB,EACT,GAAc,EACd,SAAiB,EAClC,GAAY;IACZ,wGAAwG;IACxG,WAA0B,EACT,MAAoB,IAAI,CAAC,GAAG;QAPpC,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAQ;QACT,QAAG,GAAH,GAAG,CAAW;QACd,cAAS,GAAT,SAAS,CAAQ;QAIjB,QAAG,GAAH,GAAG,CAAyB;QAE7C,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,SAAS,CAAC,8DAA8D,UAAU,GAAG,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAC/B,aAAa,EACb,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAClC,uBAAuB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;YACnC,OAAO,IAAI,aAAa,CACtB,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,QAAkB,EAAE,IAAY;QAChE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAChC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,GAAG,EACR,MAAM,EACN,QAAQ,EACR,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;YACjD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI,EACJ,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAClD,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,wBAAwB,CAChC,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EACzE,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,wBAAwB,CAAC,kDAAkD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,oBAAoB,CAAC"}
+{"version":3,"file":"BurrowClient.js","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAqC3C;wCACwC;AACxC,MAAM,OAAO,mBAAmB;IAQnB;IACQ;IARX,SAAS,CAAY;IACpB,SAAS,CAAS;IAC3B,0FAA0F;IACzE,GAAG,CAAU;IACb,WAAW,CAAgB;IAE5C,YACW,SAAiB,EACT,UAAsB,EACvC,GAAY;IACZ,wGAAwG;IACxG,WAA0B;QAJjB,cAAS,GAAT,SAAS,CAAQ;QACT,eAAU,GAAV,UAAU,CAAY;QAKvC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,WAAW,CAAC,OAAO,GAAG,IAAI;QACxB,yGAAyG;QACzG,sGAAsG;QACtG,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,SAAS,CAAC,8DAA8D,UAAU,GAAG,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAC/B,aAAa,EACb,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAClC,uBAAuB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;YACnC,OAAO,IAAI,aAAa,CACtB,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,QAAkB,EAAE,IAAY;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;YACjD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI,EACJ,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAClD,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,wBAAwB,CAChC,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EACzE,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,wBAAwB,CAAC,kDAAkD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,oBAAoB,CAAC"}

package/dist/esm/Oidc.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Mints a provider OIDC token for the machine data plane — the CI path, where the client holds no key and
+ * proves itself with a short-lived token its provider signs. GitHub Actions is the provider today.
+ *
+ * The token's audience must be the value the Burrow's trust policy requires; the Burrow verifies the token's
+ * signature against the provider's keys and matches its claims (repository, workflow, environment) to that
+ * policy. Nothing here is a secret at rest: the token lives for minutes and is minted per request.
+ */
+/** Whether this process can mint an OIDC token right now (GitHub Actions with `id-token: write`). */
+export declare function oidcProviderDetected(): boolean;
+/** Request a token for `audience` from the detected provider. Throws if no provider is available. */
+export declare function mintOidcToken(audience: string): Promise<string>;
+//# sourceMappingURL=Oidc.d.ts.map

package/dist/esm/Oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Oidc.d.ts","sourceRoot":"","sources":["../../src/Oidc.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH,qGAAqG;AACrG,wBAAgB,oBAAoB,IAAI,OAAO,CAK9C;AAED,qGAAqG;AACrG,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BrE"}

package/dist/esm/Oidc.js

@@ -0,0 +1,45 @@
+import { BurrowAuthException } from "./Errors.js";
+/**
+ * Mints a provider OIDC token for the machine data plane — the CI path, where the client holds no key and
+ * proves itself with a short-lived token its provider signs. GitHub Actions is the provider today.
+ *
+ * The token's audience must be the value the Burrow's trust policy requires; the Burrow verifies the token's
+ * signature against the provider's keys and matches its claims (repository, workflow, environment) to that
+ * policy. Nothing here is a secret at rest: the token lives for minutes and is minted per request.
+ */
+/** Whether this process can mint an OIDC token right now (GitHub Actions with `id-token: write`). */
+export function oidcProviderDetected() {
+    return ((process.env["ACTIONS_ID_TOKEN_REQUEST_URL"]?.length ?? 0) > 0 &&
+        (process.env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"]?.length ?? 0) > 0);
+}
+/** Request a token for `audience` from the detected provider. Throws if no provider is available. */
+export async function mintOidcToken(audience) {
+    const requestUrl = process.env["ACTIONS_ID_TOKEN_REQUEST_URL"];
+    const requestToken = process.env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"];
+    if (!requestUrl || !requestToken) {
+        throw new BurrowAuthException("no OIDC provider detected. In GitHub Actions the workflow needs 'permissions: id-token: write' " +
+            "(which sets ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN)");
+    }
+    const url = new URL(requestUrl);
+    if (audience.length > 0)
+        url.searchParams.set("audience", audience);
+    let response;
+    try {
+        // GitHub's token service, publicly trusted — ordinary TLS verification applies.
+        response = await fetch(url, {
+            headers: { Authorization: `Bearer ${requestToken}`, Accept: "application/json" },
+        });
+    }
+    catch (e) {
+        throw new BurrowAuthException(`requesting an OIDC token from the provider: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
+    }
+    if (!response.ok) {
+        throw new BurrowAuthException(`the OIDC token request failed (HTTP ${response.status})`);
+    }
+    const body = (await response.json().catch(() => ({})));
+    if (typeof body.value !== "string" || body.value.length === 0) {
+        throw new BurrowAuthException("the OIDC provider returned no token");
+    }
+    return body.value;
+}
+//# sourceMappingURL=Oidc.js.map

package/dist/esm/Oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Oidc.js","sourceRoot":"","sources":["../../src/Oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;GAOG;AAEH,qGAAqG;AACrG,MAAM,UAAU,oBAAoB;IAClC,OAAO,CACL,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC9D,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,IAAI,mBAAmB,CAC3B,iGAAiG;YAC/F,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEpE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,gFAAgF;QAChF,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACjF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,+CAA+C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3I,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,mBAAmB,CAAC,uCAAuC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAwB,CAAC;IAC9E,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC"}

package/dist/esm/Tls.d.ts

@@ -26,12 +26,23 @@ export type TlsMode =
  */
  | {
     readonly kind: "systemTrust";
+}
+/**
+ * No verification at all: accept whatever certificate the Burrow presents — no CA check, no hostname check,
+ * no pin. Opt-in ONLY, and never a default: it defeats MITM protection, so an active on-path attacker can
+ * read or alter the traffic. Use it solely on a transport you already trust by other means (a private
+ * network you control, or a deliberate operator decision to accept the risk on a public IP).
+ */
+ | {
+    readonly kind: "insecure";
 };
-/** The three trust modes, as values: `TlsMode.Pinned`, `TlsMode.PinnedTo("aa:bb:…")`, `TlsMode.SystemTrust`. */
+/** The trust modes, as values: `TlsMode.Pinned`, `TlsMode.PinnedTo("aa:bb:…")`, `TlsMode.SystemTrust`, `TlsMode.Insecure`. */
 export declare const TlsMode: {
     readonly Pinned: TlsMode;
     readonly PinnedTo: (fingerprint: string) => TlsMode;
     readonly SystemTrust: TlsMode;
+    /** No verification — accept any certificate. Opt-in only; defeats MITM protection. */
+    readonly Insecure: TlsMode;
 };
 /**
  * SHA-256 of a certificate's PUBLIC KEY (its SubjectPublicKeyInfo) as lowercase colon-separated hex — the

package/dist/esm/Tls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Tls.d.ts","sourceRoot":"","sources":["../../src/Tls.ts"],"names":[],"mappings":"AAIA,qEAAqE;AACrE,MAAM,MAAM,OAAO;AACjB;;;;;;;GAOG;AACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE;AAC7B;;;;GAIG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AAC7D;;;GAGG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAErC,gHAAgH;AAChH,eAAO,MAAM,OAAO;qBACY,OAAO;qCACb,MAAM,KAAG,OAAO;0BACA,OAAO;CACvC,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAIpD;AAED,4FAA4F;AAC5F,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAI/D;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgB;gBAEzB,GAAG,EAAE,MAAM,GAAG,IAAI;IAI9B,IAAI,IAAI,MAAM,GAAG,IAAI;IASrB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAazB"}
+{"version":3,"file":"Tls.d.ts","sourceRoot":"","sources":["../../src/Tls.ts"],"names":[],"mappings":"AAIA,qEAAqE;AACrE,MAAM,MAAM,OAAO;AACjB;;;;;;;GAOG;AACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE;AAC7B;;;;GAIG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AAC7D;;;GAGG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE;AAClC;;;;;GAKG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAElC,8HAA8H;AAC9H,eAAO,MAAM,OAAO;qBACY,OAAO;qCACb,MAAM,KAAG,OAAO;0BACA,OAAO;IAC/C,sFAAsF;uBACpD,OAAO;CACjC,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAIpD;AAED,4FAA4F;AAC5F,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAI/D;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgB;gBAEzB,GAAG,EAAE,MAAM,GAAG,IAAI;IAI9B,IAAI,IAAI,MAAM,GAAG,IAAI;IASrB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAazB"}

package/dist/esm/Tls.js

@@ -1,11 +1,13 @@
 import { createHash, X509Certificate } from "node:crypto";
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-/** The three trust modes, as values: `TlsMode.Pinned`, `TlsMode.PinnedTo("aa:bb:…")`, `TlsMode.SystemTrust`. */
+/** The trust modes, as values: `TlsMode.Pinned`, `TlsMode.PinnedTo("aa:bb:…")`, `TlsMode.SystemTrust`, `TlsMode.Insecure`. */
 export const TlsMode = {
     Pinned: { kind: "pinned" },
     PinnedTo: (fingerprint) => ({ kind: "pinnedTo", fingerprint }),
     SystemTrust: { kind: "systemTrust" },
+    /** No verification — accept any certificate. Opt-in only; defeats MITM protection. */
+    Insecure: { kind: "insecure" },
 };
 /**
  * SHA-256 of a certificate's PUBLIC KEY (its SubjectPublicKeyInfo) as lowercase colon-separated hex — the

package/dist/esm/Tls.js.map

@@ -1 +1 @@
-{"version":3,"file":"Tls.js","sourceRoot":"","sources":["../../src/Tls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAyB1C,gHAAgH;AAChH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAa;IACrC,QAAQ,EAAE,CAAC,WAAmB,EAAW,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAC/E,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAa;CACvC,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,GAAe;IAC1C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACrG,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjF,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,QAAQ;IACF,IAAI,CAAgB;IAErC,YAAY,GAAkB;QAC5B,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAW;QACf,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO;QAC/B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO;QAChC,gGAAgG;QAChG,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;YAC/B,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;YAC/B,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"Tls.js","sourceRoot":"","sources":["../../src/Tls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAgC1C,8HAA8H;AAC9H,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAa;IACrC,QAAQ,EAAE,CAAC,WAAmB,EAAW,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAC/E,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAa;IAC/C,sFAAsF;IACtF,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAa;CACjC,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,GAAe;IAC1C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACrG,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjF,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,QAAQ;IACF,IAAI,CAAgB;IAErC,YAAY,GAAkB;QAC5B,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAW;QACf,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO;QAC/B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO;QAChC,gGAAgG;QAChG,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;YAC/B,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;YAC/B,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;CACF"}

package/dist/esm/Transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Transport.d.ts","sourceRoot":"","sources":["../../src/Transport.ts"],"names":[],"mappings":"AAaA,OAAO,EAA6C,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAUnF;;;;;;;;;GASG;AACH,qBAAa,SAAS;IAQlB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAW;IAChC,0GAA0G;IAC1G,OAAO,CAAC,MAAM,CAAgB;gBAG5B,SAAS,EAAE,MAAM,EACA,GAAG,EAAE,OAAO;IAC7B,uGAAuG;IACvG,WAAW,EAAE,MAAM,GAAG,IAAI;IAO5B,wGAAwG;IAClG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBzE,OAAO,CAAC,OAAO;IAgBf,oGAAoG;IACpG,OAAO,CAAC,OAAO;IAiFf,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,QAAQ;CAuBjB"}
+{"version":3,"file":"Transport.d.ts","sourceRoot":"","sources":["../../src/Transport.ts"],"names":[],"mappings":"AAaA,OAAO,EAA6C,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAUnF;;;;;;;;;GASG;AACH,qBAAa,SAAS;IAQlB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAW;IAChC,0GAA0G;IAC1G,OAAO,CAAC,MAAM,CAAgB;gBAG5B,SAAS,EAAE,MAAM,EACA,GAAG,EAAE,OAAO;IAC7B,uGAAuG;IACvG,WAAW,EAAE,MAAM,GAAG,IAAI;IAO5B,wGAAwG;IAClG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBzE,OAAO,CAAC,OAAO;IAgBf,oGAAoG;IACpG,OAAO,CAAC,OAAO;IAkFf,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,QAAQ;CAuBjB"}

package/dist/esm/Transport.js

@@ -66,10 +66,11 @@ export class Transport {
     connect(url) {
         const host = url.hostname;
         const port = url.port.length > 0 ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
-        // Pinning is authoritative for a self-signed Burrow, so the CA chain and hostname checks are waived —
-        // the certificate is reached by IP or a self-signed domain that no SAN or CA would match. SystemTrust
-        // keeps the full standard verification and needs no pin check of its own.
-        const pinning = this.tls.kind !== "systemTrust";
+        // SystemTrust does full CA + hostname verification; the pinned modes waive that and verify by public-key
+        // pin instead (the cert is reached by IP or a self-signed domain no CA would match); Insecure does neither
+        // and accepts any certificate. Only the pinned modes run the pin check in onSecure below.
+        const verifying = this.tls.kind === "systemTrust";
+        const pinning = this.tls.kind === "pinned" || this.tls.kind === "pinnedTo";
         const socket = url.protocol === "http:"
             ? netConnect({ host, port })
             : tlsConnect({
@@ -77,7 +78,7 @@ export class Transport {
                 port,
                 // SNI carries a hostname; an IP literal is not a legal server name.
                 ...(isIP(host) === 0 ? { servername: host } : {}),
-                rejectUnauthorized: !pinning,
+                rejectUnauthorized: verifying,
             });
         return new Promise((resolve, reject) => {
             const finish = (settle) => {

package/dist/esm/Transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"Transport.js","sourceRoot":"","sources":["../../src/Transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,IAAI,EAAe,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAkB,MAAM,UAAU,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAgB,MAAM,UAAU,CAAC;AAEnF,MAAM,UAAU,GAAG,MAAM,CAAC;AAQ1B;;;;;;;;;GASG;AACH,MAAM,OAAO,SAAS;IAQD;IAPF,IAAI,CAAS;IACb,IAAI,CAAW;IAChC,0GAA0G;IAClG,MAAM,CAAgB;IAE9B,YACE,SAAiB,EACA,GAAY;IAC7B,uGAAuG;IACvG,WAA0B;QAFT,QAAG,GAAH,GAAG,CAAS;QAI7B,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,OAA+B;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,MAAc,CAAC;QACnB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,wBAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QAED,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,EAC3D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC1D,MAAM,IAAI,wBAAwB,CAAC,eAAe,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oGAAoG;IAC5F,OAAO,CAAC,GAAQ;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,sGAAsG;QACtG,sGAAsG;QACtG,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC;QAEhD,MAAM,MAAM,GACV,GAAG,CAAC,QAAQ,KAAK,OAAO;YACtB,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC,CAAC,UAAU,CAAC;gBACT,IAAI;gBACJ,IAAI;gBACJ,oEAAoE;gBACpE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,kBAAkB,EAAE,CAAC,OAAO;aAC7B,CAAC,CAAC;QAET,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAQ,EAAE;gBAC1C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,CAAC,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;gBACjD,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC1C,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACrB,oGAAoG;gBACpG,uEAAuE;gBACvE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC3B,MAAM,EAAE,CAAC;YACX,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,CAAC,CAAQ,EAAQ,EAAE,CACjC,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,wBAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CACjG,CAAC;YAEJ,MAAM,SAAS,GAAG,GAAS,EAAE;gBAC3B,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,wBAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,qBAAqB,UAAU,IAAI,CAAC,CAAC,CACtG,CAAC;YACJ,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAEjF,MAAM,QAAQ,GAAG,GAAS,EAAE;gBAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBACrD,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAI,MAAoB,CAAC,kBAAkB,EAAE,CAAC,GAAyB,CAAC;gBACjF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,0BAA0B,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC;oBACxF,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;gBACxB,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;oBAClD,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CACJ,IAAI,0BAA0B,CAC5B,oDAAoD,GAAG,SAAS,IAAI,GAAG,CACxE,CACF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC;YAEF,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;;gBACjE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,WAA0B;QAC/C,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,8DAA8D;QACtG,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,yDAAyD;IACtF,CAAC;IAEO,QAAQ,CAAC,MAAc,EAAE,IAAY;QAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClD,MAAM,CAAC,GAAI,MAA8B,CAAC,KAAK,CAAC;gBAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;QAC/F,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,GAAG;gBACN,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACzC,KAAK,GAAG;gBACN,OAAO,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC9C,KAAK,GAAG;gBACN,OAAO,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC7C;gBACE,OAAO,IAAI,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF;AAED,+GAA+G;AAC/G,SAAS,QAAQ,CACf,MAAc,EACd,GAAQ,EACR,OAA+B;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,WAAW,CAAC;YACtB,MAAM,EAAE,KAAK;YACb,sGAAsG;YACtG,8CAA8C;YAC9C,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM;YAC9B,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;YAC/B,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SACpE,CAAC,CAAC;QAEH,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mBAAmB,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,GAAoB,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CACjB,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CACvF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM;IACb,yDAAyD;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"Transport.js","sourceRoot":"","sources":["../../src/Transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,IAAI,EAAe,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAkB,MAAM,UAAU,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAgB,MAAM,UAAU,CAAC;AAEnF,MAAM,UAAU,GAAG,MAAM,CAAC;AAQ1B;;;;;;;;;GASG;AACH,MAAM,OAAO,SAAS;IAQD;IAPF,IAAI,CAAS;IACb,IAAI,CAAW;IAChC,0GAA0G;IAClG,MAAM,CAAgB;IAE9B,YACE,SAAiB,EACA,GAAY;IAC7B,uGAAuG;IACvG,WAA0B;QAFT,QAAG,GAAH,GAAG,CAAS;QAI7B,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,OAA+B;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,MAAc,CAAC;QACnB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,wBAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QAED,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,EAC3D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC1D,MAAM,IAAI,wBAAwB,CAAC,eAAe,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oGAAoG;IAC5F,OAAO,CAAC,GAAQ;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,yGAAyG;QACzG,2GAA2G;QAC3G,0FAA0F;QAC1F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC;QAE3E,MAAM,MAAM,GACV,GAAG,CAAC,QAAQ,KAAK,OAAO;YACtB,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC,CAAC,UAAU,CAAC;gBACT,IAAI;gBACJ,IAAI;gBACJ,oEAAoE;gBACpE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,kBAAkB,EAAE,SAAS;aAC9B,CAAC,CAAC;QAET,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAQ,EAAE;gBAC1C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,CAAC,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;gBACjD,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC1C,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACrB,oGAAoG;gBACpG,uEAAuE;gBACvE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC3B,MAAM,EAAE,CAAC;YACX,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,CAAC,CAAQ,EAAQ,EAAE,CACjC,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,wBAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CACjG,CAAC;YAEJ,MAAM,SAAS,GAAG,GAAS,EAAE;gBAC3B,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,wBAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,qBAAqB,UAAU,IAAI,CAAC,CAAC,CACtG,CAAC;YACJ,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAEjF,MAAM,QAAQ,GAAG,GAAS,EAAE;gBAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBACrD,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAI,MAAoB,CAAC,kBAAkB,EAAE,CAAC,GAAyB,CAAC;gBACjF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,0BAA0B,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC;oBACxF,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;gBACxB,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;oBAClD,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CACJ,IAAI,0BAA0B,CAC5B,oDAAoD,GAAG,SAAS,IAAI,GAAG,CACxE,CACF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC;YAEF,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;;gBACjE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,WAA0B;QAC/C,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,8DAA8D;QACtG,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,yDAAyD;IACtF,CAAC;IAEO,QAAQ,CAAC,MAAc,EAAE,IAAY;QAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClD,MAAM,CAAC,GAAI,MAA8B,CAAC,KAAK,CAAC;gBAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;QAC/F,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,GAAG;gBACN,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACzC,KAAK,GAAG;gBACN,OAAO,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC9C,KAAK,GAAG;gBACN,OAAO,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC7C;gBACE,OAAO,IAAI,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF;AAED,+GAA+G;AAC/G,SAAS,QAAQ,CACf,MAAc,EACd,GAAQ,EACR,OAA+B;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,WAAW,CAAC;YACtB,MAAM,EAAE,KAAK;YACb,sGAAsG;YACtG,8CAA8C;YAC9C,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM;YAC9B,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;YAC/B,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SACpE,CAAC,CAAC;QAEH,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mBAAmB,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,GAAoB,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CACjB,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CACvF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM;IACb,yDAAyD;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/esm/index.d.ts

@@ -1,5 +1,5 @@
 export { Burrow, DEFAULT_CLIENT_TAG, SDK_VERSION } from "./Burrow.js";
-export type { BurrowFactory, BurrowOptions, ConnectOptions } from "./Burrow.js";
+export type { BurrowFactory, BurrowOptions, ConnectOptions, OidcConnectOptions } from "./Burrow.js";
 export type { BurrowClient } from "./BurrowClient.js";
 export { ProjectAccess, Secret, SecretCoordinate } from "./Model.js";
 export type { SecretField } from "./Model.js";

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChF,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpG,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,aAAa,CAAC"}

package/package.json

@@ -1 +1 @@
-{"name":"@ratelkey/burrow-sdk","version":"0.1.0","description":"Read secrets from a self-hosted RatelKey Burrow with a machine identity.","type":"module","engines":{"node":">=18.17"},"main":"./dist/cjs/index.js","module":"./dist/esm/index.js","types":"./dist/esm/index.d.ts","exports":{".":{"types":"./dist/esm/index.d.ts","import":"./dist/esm/index.js","require":"./dist/cjs/index.js"},"./package.json":"./package.json"},"files":["dist","README.md"],"scripts":{"build":"node scripts/build.mjs","typecheck":"tsc -p tsconfig.json --noEmit","prepublishOnly":"npm run build"},"devDependencies":{"@types/node":"^22.10.0","typescript":"^5.7.0"},"keywords":["ratelkey","burrow","secrets","sdk"]}
+{"name":"@ratelkey/burrow-sdk","version":"0.2.1","description":"Read secrets from a self-hosted RatelKey Burrow with a machine identity.","type":"module","engines":{"node":">=18.17"},"main":"./dist/cjs/index.js","module":"./dist/esm/index.js","types":"./dist/esm/index.d.ts","exports":{".":{"types":"./dist/esm/index.d.ts","import":"./dist/esm/index.js","require":"./dist/cjs/index.js"},"./package.json":"./package.json"},"files":["dist","README.md"],"scripts":{"build":"node scripts/build.mjs","typecheck":"tsc -p tsconfig.json --noEmit","prepublishOnly":"npm run build"},"devDependencies":{"@types/node":"^22.10.0","typescript":"^5.7.0"},"keywords":["ratelkey","burrow","secrets","sdk"]}