PQC Agent

Outbound HTTPS agent locked to the framework's PQC group preference. The framework's posture is "all outbound TLS is PQC-only"; this primitive defines what that means at the agent level — TLSv1.3 minimum, ecdhCurve taken from the framework's live outbound posture (b.network.tls.outboundPosture(), which follows b.network.tls.preferredGroups.set(...)), keep-alive on.

b.pqcAgent.agent is a process-wide default agent, lazy-built on first access; b.pqcAgent.create(opts) builds a fresh agent with custom pool / timeout opts (ecdhCurve and minVersion cannot be weakened); b.pqcAgent.reload() tears down the default agent so the next access rebuilds against current TLS posture.

lib/http-client.js's transport cache uses pqcAgent.create() under the hood, so the framework's bundled HTTP client and any operator- direct https.request calls converge on the same agent posture.

b.pqcAgent.create(opts?) #

{
  keepAlive?:           boolean,
  keepAliveMsecs?:      number,
  maxSockets?:          number,
  maxFreeSockets?:      number,
  scheduling?:          string,
  ecdhCurve?:           string,   // colon-separated group names; must subset C.TLS_GROUP_PREFERENCE. The TLS `groups` list tracks this value exactly (mirrored from one resolved string), so a narrowed/reordered ecdhCurve is the negotiated key-share order.
  allowOperatorGroups?: boolean,  // default false; opt in to operator-supplied groups outside the framework PQC preference
}

Build a fresh https.Agent locked to the framework PQC hybrid group preference (TLSv1.3 minimum, ecdhCurve taken from the live posture, so a later b.network.tls.preferredGroups.set(...) is reflected by agents built after it). Operator-supplied values for ecdhCurve may NARROW the framework default (drop a group) but cannot widen it unless opts.allowOperatorGroups: true is set; minVersion is fixed at TLSv1.3 and cannot be weakened.

var agent = b.pqcAgent.create({ maxSockets: 200 });
var req = https.request("https://api.example.com/v1/x", { agent: agent });
req.end();

b.pqcAgent.createHttp(opts?) #

{
  keepAlive?:      boolean,
  keepAliveMsecs?: number,
  maxSockets?:     number,
  maxFreeSockets?: number,
  scheduling?:     string,
}

Build a cleartext http.Agent with the same pool defaults as b.pqcAgent.create — no TLS posture to enforce. Exists so the framework's HTTP client's h1 transport for cleartext origins (h2c fixtures, internal services on a private network) shares the same pool tuning as the encrypted path.

var agent = b.pqcAgent.createHttp({ maxSockets: 100 });
var req = http.request("http://internal.svc/health", { agent: agent });
req.end();

b.pqcAgent.reload() #

Tear down the lazily-built default agent and reset to null so the next b.pqcAgent.agent access rebuilds against current TLS posture + network-tls applyToContext output.

Long-running daemons that rotate the framework's TLS posture (via b.network.tls config refresh, certificate-pinset reload, or a C.TLS_GROUP_PREFERENCE update behind a feature flag) need a way to re-source the outbound https.Agent without forking a new process. reload() calls .destroy() on the existing default agent — Node closes idle keep-alive sockets and lets in-flight sockets complete naturally — then nulls the cache so the next agent access builds fresh. Agents handed out via explicit b.pqcAgent.create() are unaffected; only the framework's lazy default is recycled.

Returns { destroyed: boolean } — destroyed: true when an agent was actually torn down, false when no default had been built (no callers yet asked for it).

// operator's daemon picked up a refreshed TLS-pinset config:
b.network.tls.reload();
var res = b.pqcAgent.reload();
logger.info("pqc-agent reloaded", res);

Last updated 2026-08-08T16:39:49.652Z by seeder.