mycomesh-consumer 0.5.0 → 0.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mycomesh-consumer",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "MycoMesh V11 Consumer: a custodied deposit, relay-blind encrypted requests to any Provider, and a local OpenAI-compatible endpoint.",
   "repository": {
     "type": "git",

package/src/consumer.mjs

@@ -160,11 +160,17 @@ export class Consumer {
   /** Manifest Relays first, then directory Relays whose /health proves the announced signer. */
   async relays() {
     if (this.relayCache && Date.now() - this.relayCache.at < RELAY_CACHE_MS) return this.relayCache.relays;
-    const relays = [...this.network.relays];
+    const relays = this.network.relays.map((relay) => ({ ...relay }));
     const known = new Set(relays.map((relay) => relay.signer.toLowerCase()));
     try {
       for (const relay of await directoryRelays(this.network)) {
-        if (known.has(relay.signer)) continue;
+        if (known.has(relay.signer)) {
+          // A manifest Relay that pinned its certificate on-chain is checked by the pin, not the CA.
+          const listed = relays.find((entry) => entry.signer.toLowerCase() === relay.signer);
+          listed.pin = relay.pin || listed.pin;
+          listed.owner = relay.owner;
+          continue;
+        }
         try {
           const { status, body } = await this.fetchJson(`${relay.url}/health`, { ca: this.network.tls_ca, pin: relay.pin, timeoutMs: 5_000 });
           if (status === 200 && String(body.relay_signer).toLowerCase() === relay.signer

package/src/tlspin.mjs

@@ -1,36 +1,34 @@
-// TLS without certificate authorities: a Relay pins its self-signed certificate on-chain
+// TLS without certificate authorities: a Relay pins its certificate on-chain
 // (https://IP:PORT#sha256=<hex> in the RelayDirectoryV11); mirrors mycomesh/tlspin.py.
+// The handshake completes, the fingerprint is compared, and only then does HTTP write a byte,
+// whether the certificate is self-signed or issued by some CA.
 import { createHash } from "node:crypto";
 import { connect } from "node:tls";
 
 const PIN_PREFIX = "#sha256=";
-const trusted = new Map(); // pin -> PEM of the certificate that matched it
 
 export function splitPin(endpoint) {
   const index = String(endpoint).indexOf(PIN_PREFIX);
   return index < 0 ? [String(endpoint), null] : [endpoint.slice(0, index), endpoint.slice(index + PIN_PREFIX.length).toLowerCase()];
 }
 
-/**
- * Fetch the Relay's certificate once, check it against the pin, and return
- * TLS options that trust exactly that certificate (no CA, no host name).
- */
-export async function pinnedOptions(url, pin) {
-  if (!trusted.has(pin)) {
-    const target = new URL(url);
-    const pem = await new Promise((resolve, reject) => {
-      const socket = connect({ host: target.hostname, port: Number(target.port || 443), rejectUnauthorized: false }, () => {
-        const der = socket.getPeerCertificate(true).raw;
-        socket.end();
+/** Request options whose connection is handed to HTTP only after the certificate matches the pin. */
+export function pinnedOptions(url, pin) {
+  const target = new URL(url);
+  return {
+    createConnection: (_options, ready) => {
+      const socket = connect({ host: target.hostname, port: Number(target.port || 443), rejectUnauthorized: false });
+      socket.once("secureConnect", () => {
+        const der = socket.getPeerCertificate(false)?.raw;
         if (!der || createHash("sha256").update(der).digest("hex") !== pin) {
-          return reject(new Error(`Relay ${target.host} certificate does not match its on-chain pin`));
+          const error = new Error(`Relay ${target.host} certificate does not match its on-chain pin`);
+          socket.destroy(error);
+          return ready(error);
         }
-        resolve(`-----BEGIN CERTIFICATE-----\n${der.toString("base64").match(/.{1,64}/g).join("\n")}\n-----END CERTIFICATE-----\n`);
+        return ready(null, socket);
       });
-      socket.setTimeout(10_000, () => socket.destroy(new Error("TLS handshake timed out")));
-      socket.on("error", reject);
-    });
-    trusted.set(pin, pem);
-  }
-  return { ca: [trusted.get(pin)], checkServerIdentity: () => undefined };
+      socket.once("error", (error) => ready(error));
+      return undefined;
+    },
+  };
 }