@ratelkey/burrow-sdk 0.1.0

package/dist/esm/Transport.js

@@ -0,0 +1,195 @@
+import { request as httpRequest } from "node:http";
+import { connect as netConnect, isIP } from "node:net";
+import { join } from "node:path";
+import { connect as tlsConnect } from "node:tls";
+import { BurrowAuthException, BurrowCertificateException, BurrowException, BurrowForbiddenException, BurrowNotFoundException, BurrowServerException, BurrowTransportException, } from "./Errors.js";
+import { fingerprintsEqual, PinStore, publicKeyPin } from "./Tls.js";
+const TIMEOUT_MS = 15_000;
+/**
+ * Performs signed machine-plane GETs against one Burrow, applying the configured {@link TlsMode}. Burrows
+ * serve HTTPS self-signed by default, so `TlsMode.Pinned` pins the certificate trust-on-first-use and
+ * refuses a changed one. Maps the Burrow's HTTP status + `{"error": …}` body to the typed
+ * {@link BurrowException}s, and surfaces the Burrow's own rejection reason verbatim.
+ *
+ * The TLS handshake is completed and the pin checked BEFORE the HTTP request is handed the socket, so a
+ * mismatched certificate never sees the signed `Ratel-*` headers. That ordering is the whole point of
+ * pinning, and it is why this dials the socket itself rather than letting the HTTP agent do it.
+ */
+export class Transport {
+    tls;
+    base;
+    pins;
+    /** The fingerprint currently enforced. Null in trust-on-first-use mode until the first pin is learned. */
+    pinned;
+    constructor(burrowUrl, tls, 
+    /** This Burrow's identity directory — where its pinned key lives, beside the key that signs for it. */
+    identityDir) {
+        this.tls = tls;
+        this.base = burrowUrl.replace(/\/+$/, "");
+        this.pins = new PinStore(identityDir);
+        this.pinned = tls.kind === "pinnedTo" ? tls.fingerprint : tls.kind === "pinned" ? this.pins.read() : null;
+    }
+    /** Signed GET, returning the response body on 2xx; throws a typed {@link BurrowException} otherwise. */
+    async get(path, headers) {
+        const url = this.resolve(path);
+        const conn = await this.connect(url);
+        let status;
+        let body;
+        try {
+            ({ status, body } = await exchange(conn.socket, url, headers));
+        }
+        catch (e) {
+            throw new BurrowTransportException(`reaching burrow ${this.base}: ${messageOf(e)}`, { cause: e });
+        }
+        finally {
+            conn.socket.destroy();
+        }
+        if (status < 200 || status > 299)
+            throw this.errorFor(status, body);
+        this.commitPinIfNew(conn.fingerprint);
+        return body;
+    }
+    resolve(path) {
+        let url;
+        try {
+            url = new URL(this.base + path);
+        }
+        catch (e) {
+            throw new BurrowTransportException(`invalid burrow URL '${this.base}${path}': ${messageOf(e)}`, { cause: e });
+        }
+        if (url.protocol !== "https:" && url.protocol !== "http:") {
+            throw new BurrowTransportException(`burrow URL '${this.base}' is not http(s)`);
+        }
+        return url;
+    }
+    /** Dial the Burrow and, for the pinned modes, verify its certificate before anything is written. */
+    connect(url) {
+        const host = url.hostname;
+        const port = url.port.length > 0 ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
+        // Pinning is authoritative for a self-signed Burrow, so the CA chain and hostname checks are waived —
+        // the certificate is reached by IP or a self-signed domain that no SAN or CA would match. SystemTrust
+        // keeps the full standard verification and needs no pin check of its own.
+        const pinning = this.tls.kind !== "systemTrust";
+        const socket = url.protocol === "http:"
+            ? netConnect({ host, port })
+            : tlsConnect({
+                host,
+                port,
+                // SNI carries a hostname; an IP literal is not a legal server name.
+                ...(isIP(host) === 0 ? { servername: host } : {}),
+                rejectUnauthorized: !pinning,
+            });
+        return new Promise((resolve, reject) => {
+            const finish = (settle) => {
+                socket.removeListener("error", onError);
+                socket.removeListener("timeout", onTimeout);
+                socket.removeListener("secureConnect", onSecure);
+                socket.removeListener("connect", onPlain);
+                socket.setTimeout(0);
+                // Hold a no-op error listener so a fault between here and the HTTP client taking the socket over is
+                // never an unhandled 'error' event, which would take the process down.
+                socket.on("error", ignore);
+                settle();
+            };
+            const onError = (e) => finish(() => reject(new BurrowTransportException(`reaching burrow ${this.base}: ${e.message}`, { cause: e })));
+            const onTimeout = () => {
+                socket.destroy();
+                finish(() => reject(new BurrowTransportException(`reaching burrow ${this.base}: timed out after ${TIMEOUT_MS}ms`)));
+            };
+            const onPlain = () => finish(() => resolve({ socket, fingerprint: null }));
+            const onSecure = () => {
+                if (!pinning) {
+                    finish(() => resolve({ socket, fingerprint: null }));
+                    return;
+                }
+                const der = socket.getPeerCertificate().raw;
+                if (der === undefined || der.length === 0) {
+                    socket.destroy();
+                    finish(() => reject(new BurrowCertificateException("Burrow presented no certificate")));
+                    return;
+                }
+                const seen = publicKeyPin(der);
+                const pin = this.pinned;
+                if (pin !== null && !fingerprintsEqual(seen, pin)) {
+                    socket.destroy();
+                    finish(() => reject(new BurrowCertificateException(`Burrow key does not match the pinned one (pinned=${pin}, got=${seen})`)));
+                    return;
+                }
+                finish(() => resolve({ socket, fingerprint: seen }));
+            };
+            socket.setTimeout(TIMEOUT_MS);
+            socket.once("timeout", onTimeout);
+            socket.once("error", onError);
+            if (url.protocol === "https:")
+                socket.once("secureConnect", onSecure);
+            else
+                socket.once("connect", onPlain);
+        });
+    }
+    commitPinIfNew(fingerprint) {
+        if (fingerprint === null)
+            return;
+        if (this.tls.kind !== "pinned")
+            return; // only TOFU persists; PinnedTo is caller-fixed, never learned
+        if (this.pinned !== null)
+            return;
+        this.pins.write(fingerprint);
+        this.pinned = fingerprint; // enforce on subsequent requests within this process too
+    }
+    errorFor(status, body) {
+        let reason = "";
+        try {
+            const parsed = JSON.parse(body);
+            if (parsed !== null && typeof parsed === "object") {
+                const e = parsed.error;
+                if (typeof e === "string")
+                    reason = e;
+            }
+        }
+        catch {
+            // Not JSON — fall back to the raw body below.
+        }
+        if (reason.trim().length === 0)
+            reason = body.trim().length > 0 ? body.trim() : "(no message)";
+        switch (status) {
+            case 401:
+                return new BurrowAuthException(reason);
+            case 403:
+                return new BurrowForbiddenException(reason);
+            case 404:
+                return new BurrowNotFoundException(reason);
+            default:
+                return new BurrowServerException(status, reason);
+        }
+    }
+}
+/** Write the GET over an already-connected (and, for HTTPS, already-verified) socket and read the response. */
+function exchange(socket, url, headers) {
+    return new Promise((resolve, reject) => {
+        const req = httpRequest({
+            method: "GET",
+            // No agent, and createConnection hands back the socket we already dialled — host/port here only shape
+            // the request line, nothing is dialled again.
+            createConnection: () => socket,
+            host: url.hostname,
+            path: url.pathname + url.search,
+            headers: { ...headers, Accept: "application/json", Host: url.host },
+        });
+        req.setTimeout(TIMEOUT_MS, () => req.destroy(new Error(`timed out after ${TIMEOUT_MS}ms`)));
+        req.on("error", reject);
+        req.on("response", (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("error", reject);
+            res.on("end", () => resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString("utf8") }));
+        });
+        req.end();
+    });
+}
+function ignore() {
+    // Deliberately empty: see the note in Transport.connect.
+}
+function messageOf(e) {
+    return e instanceof Error ? e.message : String(e);
+}
+//# sourceMappingURL=Transport.js.map

package/dist/esm/Transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Transport.js","sourceRoot":"","sources":["../../src/Transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,IAAI,EAAe,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAkB,MAAM,UAAU,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAgB,MAAM,UAAU,CAAC;AAEnF,MAAM,UAAU,GAAG,MAAM,CAAC;AAQ1B;;;;;;;;;GASG;AACH,MAAM,OAAO,SAAS;IAQD;IAPF,IAAI,CAAS;IACb,IAAI,CAAW;IAChC,0GAA0G;IAClG,MAAM,CAAgB;IAE9B,YACE,SAAiB,EACA,GAAY;IAC7B,uGAAuG;IACvG,WAA0B;QAFT,QAAG,GAAH,GAAG,CAAS;QAI7B,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,OAA+B;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,MAAc,CAAC;QACnB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,wBAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QAED,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,EAC3D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC1D,MAAM,IAAI,wBAAwB,CAAC,eAAe,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oGAAoG;IAC5F,OAAO,CAAC,GAAQ;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,sGAAsG;QACtG,sGAAsG;QACtG,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC;QAEhD,MAAM,MAAM,GACV,GAAG,CAAC,QAAQ,KAAK,OAAO;YACtB,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC,CAAC,UAAU,CAAC;gBACT,IAAI;gBACJ,IAAI;gBACJ,oEAAoE;gBACpE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,kBAAkB,EAAE,CAAC,OAAO;aAC7B,CAAC,CAAC;QAET,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAQ,EAAE;gBAC1C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,CAAC,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;gBACjD,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC1C,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACrB,oGAAoG;gBACpG,uEAAuE;gBACvE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC3B,MAAM,EAAE,CAAC;YACX,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,CAAC,CAAQ,EAAQ,EAAE,CACjC,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,wBAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CACjG,CAAC;YAEJ,MAAM,SAAS,GAAG,GAAS,EAAE;gBAC3B,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,wBAAwB,CAAC,mBAAmB,IAAI,CAAC,IAAI,qBAAqB,UAAU,IAAI,CAAC,CAAC,CACtG,CAAC;YACJ,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAEjF,MAAM,QAAQ,GAAG,GAAS,EAAE;gBAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBACrD,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAI,MAAoB,CAAC,kBAAkB,EAAE,CAAC,GAAyB,CAAC;gBACjF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,0BAA0B,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC;oBACxF,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;gBACxB,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;oBAClD,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CACJ,IAAI,0BAA0B,CAC5B,oDAAoD,GAAG,SAAS,IAAI,GAAG,CACxE,CACF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC;YAEF,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;;gBACjE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,WAA0B;QAC/C,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,8DAA8D;QACtG,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,yDAAyD;IACtF,CAAC;IAEO,QAAQ,CAAC,MAAc,EAAE,IAAY;QAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClD,MAAM,CAAC,GAAI,MAA8B,CAAC,KAAK,CAAC;gBAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;QAC/F,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,GAAG;gBACN,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACzC,KAAK,GAAG;gBACN,OAAO,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC9C,KAAK,GAAG;gBACN,OAAO,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC7C;gBACE,OAAO,IAAI,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF;AAED,+GAA+G;AAC/G,SAAS,QAAQ,CACf,MAAc,EACd,GAAQ,EACR,OAA+B;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,WAAW,CAAC;YACtB,MAAM,EAAE,KAAK;YACb,sGAAsG;YACtG,8CAA8C;YAC9C,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM;YAC9B,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;YAC/B,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SACpE,CAAC,CAAC;QAEH,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mBAAmB,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,GAAoB,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CACjB,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CACvF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM;IACb,yDAAyD;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/esm/index.d.ts

@@ -0,0 +1,9 @@
+export { Burrow, DEFAULT_CLIENT_TAG, SDK_VERSION } from "./Burrow.js";
+export type { BurrowFactory, BurrowOptions, ConnectOptions } from "./Burrow.js";
+export type { BurrowClient } from "./BurrowClient.js";
+export { ProjectAccess, Secret, SecretCoordinate } from "./Model.js";
+export type { SecretField } from "./Model.js";
+export { Identities, MachineIdentity } from "./Identity.js";
+export { TlsMode } from "./Tls.js";
+export { BurrowAuthException, BurrowCertificateException, BurrowException, BurrowForbiddenException, BurrowIdentityException, BurrowNotFoundException, BurrowServerException, BurrowTransportException, FieldNotFoundException, SecretShapeException, } from "./Errors.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChF,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,aAAa,CAAC"}

package/dist/esm/index.js

@@ -0,0 +1,6 @@
+export { Burrow, DEFAULT_CLIENT_TAG, SDK_VERSION } from "./Burrow.js";
+export { ProjectAccess, Secret, SecretCoordinate } from "./Model.js";
+export { Identities, MachineIdentity } from "./Identity.js";
+export { TlsMode } from "./Tls.js";
+export { BurrowAuthException, BurrowCertificateException, BurrowException, BurrowForbiddenException, BurrowIdentityException, BurrowNotFoundException, BurrowServerException, BurrowTransportException, FieldNotFoundException, SecretShapeException, } from "./Errors.js";
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGtE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,aAAa,CAAC"}

package/dist/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/package.json

@@ -0,0 +1 @@
+{"name":"@ratelkey/burrow-sdk","version":"0.1.0","description":"Read secrets from a self-hosted RatelKey Burrow with a machine identity.","type":"module","engines":{"node":">=18.17"},"main":"./dist/cjs/index.js","module":"./dist/esm/index.js","types":"./dist/esm/index.d.ts","exports":{".":{"types":"./dist/esm/index.d.ts","import":"./dist/esm/index.js","require":"./dist/cjs/index.js"},"./package.json":"./package.json"},"files":["dist","README.md"],"scripts":{"build":"node scripts/build.mjs","typecheck":"tsc -p tsconfig.json --noEmit","prepublishOnly":"npm run build"},"devDependencies":{"@types/node":"^22.10.0","typescript":"^5.7.0"},"keywords":["ratelkey","burrow","secrets","sdk"]}