@antseed/cli 0.1.141 → 0.1.142

package/dist/system-proxy/ca-manager.js

@@ -1,15 +1,35 @@
 import 'reflect-metadata';
 import * as x509 from '@peculiar/x509';
-import { webcrypto } from 'node:crypto';
+import { webcrypto, X509Certificate, randomUUID } from 'node:crypto';
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { execSync, execFileSync } from 'node:child_process';
-import { homedir } from 'node:os';
+import { homedir, tmpdir } from 'node:os';
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 x509.cryptoProvider.set(webcrypto);
 const KEY_ALG = { name: 'ECDSA', namedCurve: 'P-256' };
 const SIGN_ALG = { name: 'ECDSA', hash: 'SHA-256' };
+/** Subject/issuer common name of the generated CA — must match `generate()`. */
+const CA_COMMON_NAME = 'AntSeed Local CA';
+/** Normalize a certificate fingerprint to bare uppercase hex for comparison. */
+function normalizeFingerprint(value) {
+    return value.replace(/[^0-9a-fA-F]/g, '').toUpperCase();
+}
+/**
+ * Classify trust from the current CA fingerprint and the fingerprints of every
+ * AntSeed CA the OS currently trusts. Pure so it can be unit-tested without a
+ * real keychain.
+ */
+export function classifyCATrust(currentFingerprint, installedFingerprints) {
+    const current = normalizeFingerprint(currentFingerprint);
+    const installed = installedFingerprints.map(normalizeFingerprint).filter((fp) => fp.length > 0);
+    if (current && installed.includes(current))
+        return 'trusted';
+    if (installed.length > 0)
+        return 'stale';
+    return 'absent';
+}
 function pemEncode(label, der) {
     const b64 = Buffer.from(der).toString('base64');
     const lines = b64.match(/.{1,64}/g) ?? [];
@@ -18,8 +38,35 @@ function pemEncode(label, der) {
 function shellQuote(value) {
     return `'${value.replace(/'/g, "'\\''")}'`;
 }
-function errorMessage(err) {
-    return err instanceof Error ? err.message : String(err);
+/** Escape a value for interpolation inside a single-quoted PowerShell string. */
+function psQuote(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+/** Failure output of a spawned command WITHOUT the command line itself —
+    exec errors embed the entire shell invocation in `message`, which reads
+    like something went deeply wrong when shown to a user. */
+function commandErrorDetail(err) {
+    if (err instanceof Error) {
+        const stderr = err.stderr?.toString().trim();
+        if (stderr)
+            return stderr;
+        const message = err.message.trim();
+        return message.startsWith('Command failed:') ? 'command failed' : message;
+    }
+    return String(err);
+}
+/**
+ * Classify a failed privileged trust-store command into a calm, one-phrase
+ * reason for the UI, keeping the raw output separate for logs. The common
+ * case is the user dismissing the macOS administrator password prompt or the
+ * Windows UAC prompt.
+ */
+export function describeTrustInstallFailure(err) {
+    const detail = commandErrorDetail(err);
+    if (/user canceled|canceled by the user/i.test(detail) || detail.includes('-128')) {
+        return { reason: 'the administrator prompt was cancelled', detail };
+    }
+    return { reason: 'the system-level install failed', detail };
 }
 export class CAManager {
     dir;
@@ -39,6 +86,87 @@ export class CAManager {
         ]);
         return { certPem, privateKeyPem };
     }
+    /** SHA-1 fingerprint of the current ca.crt (bare uppercase hex), or null. */
+    fingerprint() {
+        if (!existsSync(this.certPath))
+            return null;
+        try {
+            const cert = new X509Certificate(readFileSync(this.certPath));
+            return normalizeFingerprint(cert.fingerprint);
+        }
+        catch {
+            return null;
+        }
+    }
+    /** macOS keychains that may hold a trusted copy of the CA. */
+    macKeychainPaths() {
+        return [
+            join(homedir(), 'Library', 'Keychains', 'login.keychain-db'),
+            '/Library/Keychains/System.keychain',
+        ];
+    }
+    /** SHA-1 fingerprints of every AntSeed CA the OS trust store currently holds. */
+    listInstalledFingerprints() {
+        const platform = process.platform;
+        if (platform === 'darwin') {
+            const hashes = [];
+            for (const keychain of this.macKeychainPaths()) {
+                try {
+                    const out = execFileSync('security', ['find-certificate', '-a', '-c', CA_COMMON_NAME, '-Z', keychain], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+                    for (const match of out.matchAll(/SHA-1 hash:\s*([0-9A-Fa-f]+)/g)) {
+                        hashes.push(match[1]);
+                    }
+                }
+                catch {
+                    // Keychain absent or no matching certificate — nothing to add.
+                }
+            }
+            return hashes;
+        }
+        if (platform === 'win32') {
+            try {
+                const out = execFileSync('certutil', ['-store', 'Root', CA_COMMON_NAME], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+                return [...out.matchAll(/Cert Hash\(sha1\):\s*([0-9A-Fa-f ]+)/g)].map((m) => m[1]);
+            }
+            catch {
+                return [];
+            }
+        }
+        // Linux: the CA is installed as a single file; compare its fingerprint.
+        try {
+            const installed = new X509Certificate(readFileSync('/usr/local/share/ca-certificates/antseed-ca.crt'));
+            return [normalizeFingerprint(installed.fingerprint)];
+        }
+        catch {
+            return [];
+        }
+    }
+    /** Whether the OS already trusts this exact CA. */
+    trustState() {
+        const current = this.fingerprint();
+        if (!current)
+            return 'absent';
+        return classifyCATrust(current, this.listInstalledFingerprints());
+    }
+    /**
+     * SHA-1 hashes of AntSeed CAs in one macOS keychain whose fingerprint differs
+     * from the current ca.crt. These are the certs that cause
+     * CERT_SIGNATURE_FAILURE: trusted under the same subject name, but the proxy
+     * now signs leaves with a different key.
+     */
+    staleMacHashes(keychain, current) {
+        let out = '';
+        try {
+            out = execFileSync('security', ['find-certificate', '-a', '-c', CA_COMMON_NAME, '-Z', keychain], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+        }
+        catch {
+            return [];
+        }
+        const stale = [...out.matchAll(/SHA-1 hash:\s*([0-9A-Fa-f]+)/g)]
+            .map((m) => normalizeFingerprint(m[1]))
+            .filter((fp) => fp && fp !== current);
+        return [...new Set(stale)];
+    }
     async generate() {
         await mkdir(this.dir, { recursive: true });
         const keyPair = await webcrypto.subtle.generateKey(KEY_ALG, true, ['sign', 'verify']);
@@ -65,42 +193,10 @@ export class CAManager {
     async installToSystemKeychain() {
         const platform = process.platform;
         if (platform === 'darwin') {
-            const systemCommand = `security add-trusted-cert -d -r trustRoot -p ssl -k ${shellQuote('/Library/Keychains/System.keychain')} ${shellQuote(this.certPath)}`;
-            try {
-                execSync(systemCommand, { stdio: 'pipe' });
-                return { target: 'system-keychain' };
-            }
-            catch (systemErr) {
-                try {
-                    execSync(`osascript -e ${shellQuote(`do shell script ${JSON.stringify(systemCommand)} with administrator privileges`)}`, { stdio: 'pipe' });
-                    return { target: 'system-keychain' };
-                }
-                catch (adminErr) {
-                    const keychainPath = join(homedir(), 'Library', 'Keychains', 'login.keychain-db');
-                    try {
-                        execSync(`security add-trusted-cert -d -r trustRoot -p ssl -k ${shellQuote(keychainPath)} ${shellQuote(this.certPath)}`, { stdio: 'pipe' });
-                        return {
-                            target: 'login-keychain',
-                            warning: [
-                                'CA certificate was trusted in the login keychain only.',
-                                'Some GUI apps may require System keychain trust and a restart.',
-                                `System keychain install failed: ${errorMessage(adminErr)}`,
-                            ].join(' '),
-                        };
-                    }
-                    catch (loginErr) {
-                        throw new Error([
-                            `System keychain install failed: ${errorMessage(systemErr)}`,
-                            `Admin install failed: ${errorMessage(adminErr)}`,
-                            `Login keychain install failed: ${errorMessage(loginErr)}`,
-                        ].join(' '));
-                    }
-                }
-            }
+            return this.installMacOS();
         }
         else if (platform === 'win32') {
-            execFileSync('certutil', ['-addstore', '-f', 'Root', this.certPath], { stdio: 'pipe' });
-            return { target: 'windows-root' };
+            return this.installWindows();
         }
         else {
             execFileSync('sudo', ['cp', this.certPath, '/usr/local/share/ca-certificates/antseed-ca.crt'], { stdio: 'pipe' });
@@ -108,5 +204,128 @@ export class CAManager {
             return { target: 'linux-system' };
         }
     }
+    /**
+     * macOS install, designed around ONE password prompt total. Every privileged
+     * `security` invocation can raise its own auth dialog, so all admin-domain
+     * work — purging stale System-keychain copies AND trusting the current cert
+     * (`add-trusted-cert -d` writes admin trust settings even "unelevated") —
+     * runs as a single elevated shell script. Stale login-keychain certs are
+     * deleted silently without `-t`: once the cert is gone its trust settings
+     * can't match anything, and `-t` would raise a trust-settings dialog.
+     */
+    installMacOS() {
+        const current = this.fingerprint() ?? '';
+        const loginKeychain = join(homedir(), 'Library', 'Keychains', 'login.keychain-db');
+        const systemKeychain = '/Library/Keychains/System.keychain';
+        for (const hash of this.staleMacHashes(loginKeychain, current)) {
+            try {
+                execFileSync('security', ['delete-certificate', '-Z', hash, loginKeychain], { stdio: 'pipe' });
+            }
+            catch {
+                // Best-effort; a leftover cert without System-keychain trust is inert
+                // once the elevated purge below removes the trusted copy.
+            }
+        }
+        const adminScript = [
+            ...this.staleMacHashes(systemKeychain, current).map((hash) => `security delete-certificate -Z ${hash} ${shellQuote(systemKeychain)} || true`),
+            `security add-trusted-cert -d -r trustRoot -p ssl -k ${shellQuote(systemKeychain)} ${shellQuote(this.certPath)}`,
+        ].join(' ; ');
+        try {
+            if (typeof process.getuid === 'function' && process.getuid() === 0) {
+                execSync(adminScript, { stdio: 'pipe' });
+            }
+            else {
+                execSync(`osascript -e ${shellQuote(`do shell script ${JSON.stringify(adminScript)} with administrator privileges`)}`, { stdio: 'pipe' });
+            }
+            return { target: 'system-keychain' };
+        }
+        catch (adminErr) {
+            // Likely a cancelled admin prompt. Fall back to the user trust domain:
+            // no -d, so this touches only the login keychain and at most raises one
+            // login-password trust-settings dialog.
+            const adminFailure = describeTrustInstallFailure(adminErr);
+            try {
+                execFileSync('security', ['add-trusted-cert', '-r', 'trustRoot', '-p', 'ssl', '-k', loginKeychain, this.certPath], { stdio: 'pipe' });
+                return {
+                    target: 'login-keychain',
+                    warning: [
+                        `The certificate is trusted for your user account, but system-wide trust was skipped because ${adminFailure.reason}.`,
+                        'If a connected app can\'t reach AntSeed, connect it again and approve the administrator prompt.',
+                    ].join(' '),
+                    detail: adminFailure.detail,
+                };
+            }
+            catch (loginErr) {
+                const loginFailure = describeTrustInstallFailure(loginErr);
+                throw new Error(`The certificate could not be trusted automatically because ${adminFailure.reason}. `
+                    + `Trust it manually by opening ${this.certPath} in Keychain Access, or connect again and approve the prompt. `
+                    + `(${adminFailure.detail}; ${loginFailure.detail})`);
+            }
+        }
+    }
+    /**
+     * `certutil -addstore Root` always targets the Local Machine store, which
+     * requires administrator rights — Node can't request elevation directly,
+     * so both the stale-cert purge and the add run as ONE elevated `cmd.exe`
+     * (one UAC prompt) via PowerShell's `Start-Process -Verb RunAs`.
+     */
+    installWindows() {
+        const current = this.fingerprint();
+        const staleHashes = [...new Set(this.listInstalledFingerprints().map(normalizeFingerprint))]
+            .filter((hash) => hash && hash !== current);
+        const commands = [
+            ...staleHashes.map((hash) => `certutil -delstore -f Root ${hash}`),
+            `certutil -addstore -f Root "${this.certPath}"`,
+        ];
+        try {
+            this.runElevatedCertutil(commands);
+            return { target: 'windows-root' };
+        }
+        catch (err) {
+            const failure = describeTrustInstallFailure(err);
+            throw new Error(`The certificate could not be trusted automatically because ${failure.reason}. `
+                + `Trust it manually: open ${this.certPath}, click "Install Certificate", choose "Local Machine", `
+                + 'and place it in "Trusted Root Certification Authorities". '
+                + `(${failure.detail})`);
+        }
+    }
+    /**
+     * Runs `commands` inside one elevated `cmd.exe`, redirecting its combined
+     * stdout+stderr to a temp file — an elevated child's stdio can't be piped
+     * back to this process directly, and `certutil` writes its real errors
+     * (e.g. "Access is denied") to stdout, which a plain `execFileSync` never
+     * surfaces.
+     */
+    runElevatedCertutil(commands) {
+        const outFile = join(tmpdir(), `antseed-ca-install-${randomUUID()}.log`);
+        const innerCmd = `${commands.join(' & ')} > "${outFile}" 2>&1`;
+        const psCommand = [
+            `$p = Start-Process -FilePath cmd.exe -ArgumentList '/d','/c',${psQuote(innerCmd)} -Verb RunAs -Wait -PassThru -WindowStyle Hidden`,
+            'exit $p.ExitCode',
+        ].join('; ');
+        let execErr = null;
+        try {
+            execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', psCommand], { stdio: 'pipe' });
+        }
+        catch (err) {
+            execErr = err;
+        }
+        let fileOutput = '';
+        try {
+            fileOutput = readFileSync(outFile, 'utf8').trim();
+        }
+        catch {
+            // Elevation itself may have failed before certutil ever ran.
+        }
+        finally {
+            try {
+                unlinkSync(outFile);
+            }
+            catch { /* best-effort cleanup */ }
+        }
+        if (execErr) {
+            throw new Error(fileOutput || commandErrorDetail(execErr));
+        }
+    }
 }
 //# sourceMappingURL=ca-manager.js.map

package/dist/system-proxy/ca-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ca-manager.js","sourceRoot":"","sources":["../../src/system-proxy/ca-manager.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAA;AACzB,OAAO,KAAK,IAAI,MAAM,gBAAgB,CAAA;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEjC,8DAA8D;AAC9D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAgB,CAAC,CAAA;AAEzC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAA;AAC/D,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAW,CAAA;AAY5D,SAAS,SAAS,CAAC,KAAa,EAAE,GAAgB;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;IACzC,OAAO,cAAc,KAAK,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAA;AAClF,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAA;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,OAAO,SAAS;IACH,GAAG,CAAQ;IAE5B,YAAY,OAAe;QACzB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;IAC1C,CAAC;IAED,IAAY,QAAQ,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA,CAAC,CAAC;IAClE,IAAY,OAAO,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA,CAAC,CAAC;IAEjE,IAAI,YAAY,KAAa,OAAO,IAAI,CAAC,QAAQ,CAAA,CAAC,CAAC;IAEnD,KAAK,CAAC,MAAM;QACV,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;SAC/B,CAAC,CAAA;QACF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAE1C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QAErF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAAC;YAChE,YAAY,EAAE,IAAI;YAClB,IAAI,EAAE,gCAAgC;YACtC,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,QAAQ,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAC/D,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,OAAO;YACb,UAAU,EAAE;gBACV,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;gBACzD,IAAI,IAAI,CAAC,kBAAkB,CACzB,IAAI,CAAC,aAAa,CAAC,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAC3D,IAAI,CACL;gBACD,MAAM,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;aACnE;SACF,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAC5E,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;QAEtD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAC/C,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAE/E,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,uBAAuB;QAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QACjC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,aAAa,GAAG,uDAAuD,UAAU,CAAC,oCAAoC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAA;YAC5J,IAAI,CAAC;gBACH,QAAQ,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;gBAC1C,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;YACtC,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,QAAQ,CACN,gBAAgB,UAAU,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,gCAAgC,CAAC,EAAE,EAC9G,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;oBACD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;gBACtC,CAAC;gBAAC,OAAO,QAAQ,EAAE,CAAC;oBAClB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAA;oBACjF,IAAI,CAAC;wBACH,QAAQ,CACN,uDAAuD,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAC9G,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;wBACD,OAAO;4BACL,MAAM,EAAE,gBAAgB;4BACxB,OAAO,EAAE;gCACP,wDAAwD;gCACxD,gEAAgE;gCAChE,mCAAmC,YAAY,CAAC,QAAQ,CAAC,EAAE;6BAC5D,CAAC,IAAI,CAAC,GAAG,CAAC;yBACZ,CAAA;oBACH,CAAC;oBAAC,OAAO,QAAQ,EAAE,CAAC;wBAClB,MAAM,IAAI,KAAK,CAAC;4BACd,mCAAmC,YAAY,CAAC,SAAS,CAAC,EAAE;4BAC5D,yBAAyB,YAAY,CAAC,QAAQ,CAAC,EAAE;4BACjD,kCAAkC,YAAY,CAAC,QAAQ,CAAC,EAAE;yBAC3D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,YAAY,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YACvF,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,iDAAiD,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YACjH,YAAY,CAAC,MAAM,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YACnE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;QACnC,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"ca-manager.js","sourceRoot":"","sources":["../../src/system-proxy/ca-manager.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAA;AACzB,OAAO,KAAK,IAAI,MAAM,gBAAgB,CAAA;AACtC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAEzC,8DAA8D;AAC9D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAgB,CAAC,CAAA;AAEzC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAA;AAC/D,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAW,CAAA;AAE5D,gFAAgF;AAChF,MAAM,cAAc,GAAG,kBAAkB,CAAA;AAwBzC,gFAAgF;AAChF,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,kBAA0B,EAAE,qBAAwC;IAClG,MAAM,OAAO,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAA;IACxD,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/F,IAAI,OAAO,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAA;IACxC,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAgB;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;IACzC,OAAO,cAAc,KAAK,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAA;AAClF,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAA;AAC5C,CAAC;AAED,iFAAiF;AACjF,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAA;AACzC,CAAC;AAED;;6DAE6D;AAC7D,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAI,GAA4C,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAA;QACtF,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QAClC,OAAO,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAA;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,qCAAqC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,MAAM,EAAE,wCAAwC,EAAE,MAAM,EAAE,CAAA;IACrE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,iCAAiC,EAAE,MAAM,EAAE,CAAA;AAC9D,CAAC;AAED,MAAM,OAAO,SAAS;IACH,GAAG,CAAQ;IAE5B,YAAY,OAAe;QACzB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;IAC1C,CAAC;IAED,IAAY,QAAQ,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA,CAAC,CAAC;IAClE,IAAY,OAAO,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA,CAAC,CAAC;IAEjE,IAAI,YAAY,KAAa,OAAO,IAAI,CAAC,QAAQ,CAAA,CAAC,CAAC;IAEnD,KAAK,CAAC,MAAM;QACV,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;SAC/B,CAAC,CAAA;QACF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;IACnC,CAAC;IAED,6EAA6E;IAC7E,WAAW;QACT,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC7D,OAAO,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,8DAA8D;IACtD,gBAAgB;QACtB,OAAO;YACL,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC;YAC5D,oCAAoC;SACrC,CAAA;IACH,CAAC;IAED,iFAAiF;IACzE,yBAAyB;QAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QACjC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,YAAY,CACtB,UAAU,EACV,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,CAAC,EAChE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAC1D,CAAA;oBACD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;wBAClE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAA;oBACxB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,+DAA+D;gBACjE,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAA;gBACnI,OAAO,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;YACrF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,iDAAiD,CAAC,CAAC,CAAA;YACtG,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,UAAU;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAClC,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAA;QAC7B,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,yBAAyB,EAAE,CAAC,CAAA;IACnE,CAAC;IAED;;;;;OAKG;IACK,cAAc,CAAC,QAAgB,EAAE,OAAe;QACtD,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAChB,UAAU,EACV,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,CAAC,EAChE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAC1D,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC;aAC7D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;aACvC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO,CAAC,CAAA;QACvC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5B,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAE1C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QAErF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAAC;YAChE,YAAY,EAAE,IAAI;YAClB,IAAI,EAAE,gCAAgC;YACtC,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,QAAQ,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAC/D,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,OAAO;YACb,UAAU,EAAE;gBACV,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;gBACzD,IAAI,IAAI,CAAC,kBAAkB,CACzB,IAAI,CAAC,aAAa,CAAC,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAC3D,IAAI,CACL;gBACD,MAAM,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;aACnE;SACF,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAC5E,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;QAEtD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAC/C,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAE/E,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,uBAAuB;QAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QACjC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,YAAY,EAAE,CAAA;QAC5B,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,cAAc,EAAE,CAAA;QAC9B,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,iDAAiD,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YACjH,YAAY,CAAC,MAAM,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YACnE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;QACnC,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;QACxC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAA;QAClF,MAAM,cAAc,GAAG,oCAAoC,CAAA;QAE3D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC;gBACH,YAAY,CAAC,UAAU,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YAChG,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,0DAA0D;YAC5D,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG;YAClB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,GAAG,CACjD,CAAC,IAAI,EAAE,EAAE,CAAC,kCAAkC,IAAI,IAAI,UAAU,CAAC,cAAc,CAAC,UAAU,CACzF;YACD,uDAAuD,UAAU,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;SACjH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACb,IAAI,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBACnE,QAAQ,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YAC1C,CAAC;iBAAM,CAAC;gBACN,QAAQ,CACN,gBAAgB,UAAU,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,gCAAgC,CAAC,EAAE,EAC5G,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;YACH,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;QACtC,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAClB,uEAAuE;YACvE,wEAAwE;YACxE,wCAAwC;YACxC,MAAM,YAAY,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAA;YAC1D,IAAI,CAAC;gBACH,YAAY,CACV,UAAU,EACV,CAAC,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,EACxF,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;gBACD,OAAO;oBACL,MAAM,EAAE,gBAAgB;oBACxB,OAAO,EAAE;wBACP,+FAA+F,YAAY,CAAC,MAAM,GAAG;wBACrH,iGAAiG;qBAClG,CAAC,IAAI,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,YAAY,CAAC,MAAM;iBAC5B,CAAA;YACH,CAAC;YAAC,OAAO,QAAQ,EAAE,CAAC;gBAClB,MAAM,YAAY,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAA;gBAC1D,MAAM,IAAI,KAAK,CACb,8DAA8D,YAAY,CAAC,MAAM,IAAI;sBACnF,gCAAgC,IAAI,CAAC,QAAQ,gEAAgE;sBAC7G,IAAI,YAAY,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,GAAG,CACrD,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,cAAc;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAClC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;aACzF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI,KAAK,OAAO,CAAC,CAAA;QAE7C,MAAM,QAAQ,GAAG;YACf,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,8BAA8B,IAAI,EAAE,CAAC;YAClE,+BAA+B,IAAI,CAAC,QAAQ,GAAG;SAChD,CAAA;QACD,IAAI,CAAC;YACH,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;YAClC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAA;YAChD,MAAM,IAAI,KAAK,CACb,8DAA8D,OAAO,CAAC,MAAM,IAAI;kBAC9E,2BAA2B,IAAI,CAAC,QAAQ,yDAAyD;kBACjG,4DAA4D;kBAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CACxB,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CAAC,QAAkB;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,UAAU,EAAE,MAAM,CAAC,CAAA;QACxE,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,OAAO,QAAQ,CAAA;QAC9D,MAAM,SAAS,GAAG;YAChB,gEAAgE,OAAO,CAAC,QAAQ,CAAC,kDAAkD;YACnI,kBAAkB;SACnB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,IAAI,OAAO,GAAY,IAAI,CAAA;QAC3B,IAAI,CAAC;YACH,YAAY,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAC7G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAA;QACf,CAAC;QAED,IAAI,UAAU,GAAG,EAAE,CAAA;QACnB,IAAI,CAAC;YACH,UAAU,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;CACF"}

package/dist/system-proxy/ca-manager.test.js

@@ -3,7 +3,7 @@ import { mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
-import { CAManager } from './ca-manager.js';
+import { CAManager, classifyCATrust, describeTrustInstallFailure } from './ca-manager.js';
 test('CAManager.exists() returns false before generation', async () => {
     const tmpDir = await mkdtemp(join(tmpdir(), 'antseed-ca-test-'));
     try {
@@ -45,6 +45,55 @@ test('CAManager.certFilePath points into the system-proxy subdirectory', () => {
     assert.ok(mgr.certFilePath.includes('system-proxy'), 'cert path should be under system-proxy/');
     assert.ok(mgr.certFilePath.endsWith('.crt'), 'cert file should have .crt extension');
 });
+test('classifyCATrust: trusted when the current fingerprint is installed', () => {
+    assert.equal(classifyCATrust('AA:BB:CC', ['aabbcc']), 'trusted');
+    assert.equal(classifyCATrust('aabbcc', ['AA BB CC', '112233']), 'trusted');
+});
+test('classifyCATrust: stale when an AntSeed CA is trusted with a different fingerprint', () => {
+    // The CERT_SIGNATURE_FAILURE case: an old CA is trusted, current one is not.
+    assert.equal(classifyCATrust('AABBCC', ['DDEEFF']), 'stale');
+});
+test('classifyCATrust: absent when nothing is trusted', () => {
+    assert.equal(classifyCATrust('AABBCC', []), 'absent');
+});
+test('classifyCATrust: absent when the current fingerprint is empty', () => {
+    // No ca.crt yet → nothing to match, treated as absent regardless of installs.
+    assert.equal(classifyCATrust('', []), 'absent');
+    assert.equal(classifyCATrust('', ['AABBCC']), 'stale');
+});
+test('describeTrustInstallFailure classifies a cancelled admin prompt', () => {
+    const err = Object.assign(new Error("Command failed: osascript -e 'do shell script \"security add-trusted-cert ...\"'"), { stderr: Buffer.from('execution error: User canceled. (-128)\n') });
+    const failure = describeTrustInstallFailure(err);
+    assert.equal(failure.reason, 'the administrator prompt was cancelled');
+    assert.equal(failure.detail, 'execution error: User canceled. (-128)');
+});
+test('describeTrustInstallFailure never leaks the command line into the detail', () => {
+    const err = new Error("Command failed: osascript -e 'do shell script \"security delete-certificate -Z AABB /Library/Keychains/System.keychain\"'");
+    const failure = describeTrustInstallFailure(err);
+    assert.equal(failure.reason, 'the system-level install failed');
+    assert.equal(failure.detail, 'command failed');
+});
+test('describeTrustInstallFailure keeps concise stderr as the detail', () => {
+    const err = Object.assign(new Error('Command failed: security add-trusted-cert ...'), {
+        stderr: 'SecTrustSettingsSetTrustSettings: The authorization was denied since no user interaction was possible.',
+    });
+    const failure = describeTrustInstallFailure(err);
+    assert.equal(failure.reason, 'the system-level install failed');
+    assert.equal(failure.detail, 'SecTrustSettingsSetTrustSettings: The authorization was denied since no user interaction was possible.');
+});
+test('CAManager.fingerprint() returns null before generation and hex after', async () => {
+    const tmpDir = await mkdtemp(join(tmpdir(), 'antseed-ca-test-'));
+    try {
+        const mgr = new CAManager(tmpDir);
+        assert.equal(mgr.fingerprint(), null);
+        await mgr.generate();
+        const fp = mgr.fingerprint();
+        assert.ok(fp && /^[0-9A-F]+$/.test(fp), 'fingerprint should be bare uppercase hex');
+    }
+    finally {
+        await rm(tmpDir, { recursive: true, force: true });
+    }
+});
 test('CAManager.generate() is idempotent — second call overwrites cleanly', async () => {
     const tmpDir = await mkdtemp(join(tmpdir(), 'antseed-ca-test-'));
     try {

package/dist/system-proxy/ca-manager.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"ca-manager.test.js","sourceRoot":"","sources":["../../src/system-proxy/ca-manager.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,IAAI,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;IACpE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAA;IACzC,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAA;QACjC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,oBAAoB,CAAC,CAAA;QAC3E,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC,CAAA;QACtF,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;IAC1E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,CAAA;IAC7D,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,gBAAgB,CAAC,CAAA;IAC3C,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,yCAAyC,CAAC,CAAA;IAC/F,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,sCAAsC,CAAC,CAAA;AACtF,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACrF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAA;QACnC,4EAA4E;QAC5E,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAA;QACvD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAA;QAC7D,wCAAwC;QACxC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAChD,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAC,CAAA"}
+{"version":3,"file":"ca-manager.test.js","sourceRoot":"","sources":["../../src/system-proxy/ca-manager.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAA;AAEzF,IAAI,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;IACpE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAA;IACzC,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAA;QACjC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,oBAAoB,CAAC,CAAA;QAC3E,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC,CAAA;QACtF,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;IAC1E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,CAAA;IAC7D,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,gBAAgB,CAAC,CAAA;IAC3C,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,yCAAyC,CAAC,CAAA;IAC/F,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,sCAAsC,CAAC,CAAA;AACtF,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAC9E,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IAChE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;AAC5E,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,mFAAmF,EAAE,GAAG,EAAE;IAC7F,6EAA6E;IAC7E,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;AAC9D,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC3D,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;AACvD,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,8EAA8E;IAC9E,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC/C,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;AACxD,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CACvB,IAAI,KAAK,CAAC,kFAAkF,CAAC,EAC7F,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,EAAE,CACpE,CAAA;IACD,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAA;IAChD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,wCAAwC,CAAC,CAAA;IACtE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,wCAAwC,CAAC,CAAA;AACxE,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2HAA2H,CAAC,CAAA;IAClJ,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAA;IAChD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAA;IAC/D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;AAChD,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+CAA+C,CAAC,EAAE;QACpF,MAAM,EAAE,wGAAwG;KACjH,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAA;IAChD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAA;IAC/D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,wGAAwG,CAAC,CAAA;AACxI,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;IACtF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAA;QACrC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAA;QACpB,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QAC5B,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,0CAA0C,CAAC,CAAA;IACrF,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACrF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAA;QACnC,4EAA4E;QAC5E,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAA;QACvD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAA;QAC7D,wCAAwC;QACxC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAChD,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAC,CAAA"}

package/dist/system-proxy/profiles.d.ts

@@ -1,4 +1,4 @@
-import type { SystemProxyForwardRule, SystemProxyProfile } from './types.js';
+import type { SystemProxyForwardRule, SystemProxyProfile, SystemProxySource } from './types.js';
 export declare function loadSystemProxyProfiles(env?: NodeJS.ProcessEnv): readonly SystemProxyProfile[];
 export declare const CONFIGURED_PROFILES: readonly SystemProxyProfile[];
 export declare function findProfile(name: string): SystemProxyProfile | undefined;
@@ -9,5 +9,6 @@ export declare function partitionProfiles(profileNames: string[]): {
 };
 export declare function resolveProxiedDomains(profileNames: string[]): Set<string>;
 export declare function resolveProxiedPathPrefixes(profileNames: string[]): Map<string, Set<string>>;
+export declare function resolveSystemProxySources(profileNames: string[]): Map<string, Map<string, SystemProxySource>>;
 export declare function resolveSystemProxyForwardRules(profileNames: string[]): Map<string, SystemProxyForwardRule>;
 //# sourceMappingURL=profiles.d.ts.map

package/dist/system-proxy/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/system-proxy/profiles.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA0B,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAKpG,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,kBAAkB,EAAE,CAY3G;AAED,eAAO,MAAM,mBAAmB,EAAE,SAAS,kBAAkB,EAA8B,CAAA;AAiF3F,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAExE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAQpG;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAUzE;AAED,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAc3F;AAED,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAU1G"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/system-proxy/profiles.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA0B,sBAAsB,EAAE,kBAAkB,EAA8B,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAWnJ,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,kBAAkB,EAAE,CAY3G;AAED,eAAO,MAAM,mBAAmB,EAAE,SAAS,kBAAkB,EAA8B,CAAA;AA8G3F,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAExE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAQpG;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAUzE;AAED,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAc3F;AAED,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAe7G;AAED,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAU1G"}

package/dist/system-proxy/profiles.js

@@ -1,6 +1,12 @@
 import { readFileSync } from 'node:fs';
 const PROFILES_JSON_ENV = 'ANTSEED_SYSTEM_PROXY_PROFILES_JSON';
 const PROFILES_FILE_ENV = 'ANTSEED_SYSTEM_PROXY_PROFILES_FILE';
+const APP_ACTIONS = new Set([
+    'none',
+    'open-url',
+    'open-tool',
+    'restart-app',
+]);
 export function loadSystemProxyProfiles(env = process.env) {
     const raw = env[PROFILES_JSON_ENV]?.trim()
         || (env[PROFILES_FILE_ENV]?.trim()
@@ -27,6 +33,7 @@ function normalizeProfile(value, index) {
     const pathPrefixes = stringArray(raw['pathPrefixes']);
     const forward = normalizeForward(raw['forward'], name);
     const configPatch = normalizeConfigPatch(raw['configPatch'], name);
+    const metadata = normalizeMetadata(raw['metadata'], name);
     return {
         name,
         displayName,
@@ -35,6 +42,7 @@ function normalizeProfile(value, index) {
         pathPrefixes,
         ...(forward ? { forward } : {}),
         ...(configPatch ? { configPatch } : {}),
+        ...(metadata ? { metadata } : {}),
     };
 }
 function normalizeForward(value, profileName) {
@@ -63,14 +71,40 @@ function normalizeConfigPatch(value, profileName) {
     }
     const raw = value;
     return {
+        ...raw,
         configPath: requiredString(raw, 'configPath', profileName),
         providerKey: requiredString(raw, 'providerKey', profileName),
-        npm: requiredString(raw, 'npm', profileName),
-        providerName: requiredString(raw, 'providerName', profileName),
-        baseURL: requiredString(raw, 'baseURL', profileName),
-        modelFormat: 'peer-routed',
     };
 }
+function normalizeMetadata(value, profileName) {
+    if (value === undefined)
+        return undefined;
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`metadata for ${profileName} must be an object`);
+    }
+    const raw = value;
+    const icon = optionalString(raw, 'icon');
+    const displayLabel = optionalString(raw, 'displayLabel');
+    const methodLabel = optionalString(raw, 'methodLabel');
+    const appActionValue = raw['appAction'];
+    const appAction = isAppAction(appActionValue) ? appActionValue : undefined;
+    const openUrl = optionalString(raw, 'openUrl');
+    const toolName = optionalString(raw, 'toolName');
+    const restartAppName = optionalString(raw, 'restartAppName');
+    const metadata = {
+        ...(icon ? { icon } : {}),
+        ...(displayLabel ? { displayLabel } : {}),
+        ...(methodLabel ? { methodLabel } : {}),
+        ...(appAction ? { appAction } : {}),
+        ...(openUrl ? { openUrl } : {}),
+        ...(toolName ? { toolName } : {}),
+        ...(restartAppName ? { restartAppName } : {}),
+    };
+    return Object.keys(metadata).length > 0 ? metadata : undefined;
+}
+function isAppAction(value) {
+    return typeof value === 'string' && APP_ACTIONS.has(value);
+}
 function requiredString(raw, key, context) {
     const value = raw[key];
     if (typeof value !== 'string' || value.trim().length === 0) {
@@ -135,6 +169,23 @@ export function resolveProxiedPathPrefixes(profileNames) {
     }
     return prefixesByDomain;
 }
+export function resolveSystemProxySources(profileNames) {
+    const sourcesByDomain = new Map();
+    for (const name of profileNames) {
+        const profile = findProfile(name);
+        if (!profile || profile.kind === 'config-patch')
+            continue;
+        const source = profile.forward?.source ?? profile.name;
+        for (const domain of profile.domains) {
+            const sources = sourcesByDomain.get(domain) ?? new Map();
+            for (const prefix of profile.pathPrefixes) {
+                sources.set(prefix, source);
+            }
+            sourcesByDomain.set(domain, sources);
+        }
+    }
+    return sourcesByDomain;
+}
 export function resolveSystemProxyForwardRules(profileNames) {
     const rulesByDomain = new Map();
     for (const name of profileNames) {

package/dist/system-proxy/profiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/system-proxy/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAGtC,MAAM,iBAAiB,GAAG,oCAAoC,CAAA;AAC9D,MAAM,iBAAiB,GAAG,oCAAoC,CAAA;AAE9D,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE;WACrC,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE;YAChC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAE,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC;YACtD,CAAC,CAAC,EAAE,CAAC,CAAA;IACT,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAA;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,iBAAiB,MAAM,iBAAiB,uCAAuC,CAAC,CAAA;IACrG,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;AACzE,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAkC,uBAAuB,EAAE,CAAA;AAE3F,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,oBAAoB,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAA;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAC/C,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAA;IAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAA;IACtE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;IAC3C,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;IACtD,MAAM,WAAW,GAAG,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAA;IAElE,OAAO;QACL,IAAI;QACJ,WAAW;QACX,IAAI;QACJ,OAAO;QACP,YAAY;QACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,WAAmB;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,eAAe,WAAW,oBAAoB,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAA;IAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAA;IAC3D,OAAO;QACL,MAAM;QACN,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,aAAa,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAsC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnK,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAuC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAmC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClJ,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,WAAmB;IAC/D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,mBAAmB,WAAW,oBAAoB,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAA;IAC5C,OAAO;QACL,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,WAAW,CAAC;QAC1D,WAAW,EAAE,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,WAAW,CAAC;QAC5D,GAAG,EAAE,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC;QAC5C,YAAY,EAAE,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,WAAW,CAAC;QAC9D,OAAO,EAAE,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC;QACpD,WAAW,EAAE,aAAa;KAC3B,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,GAAW,EAAE,OAAwB;IACzF,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,yBAAyB,GAAG,EAAE,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,GAAW;IAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;IACtB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACxF,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACpC,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;SAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,cAAc,CAAA;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,YAAsB;IACtD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,oBAAoB,CAAC,IAAI,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;YACjD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;AAC/B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,YAAsB;IAC1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;YAAE,SAAQ;QACzD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,YAAsB;IAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAA;IACvD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;YAAE,SAAQ;QACzD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAA;YAClE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC1C,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACtB,CAAC;YACD,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,YAAsB;IACnE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkC,CAAA;IAC/D,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;YAAE,SAAQ;QAClE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAA;AACtB,CAAC"}
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/system-proxy/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAGtC,MAAM,iBAAiB,GAAG,oCAAoC,CAAA;AAC9D,MAAM,iBAAiB,GAAG,oCAAoC,CAAA;AAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAuD;IAChF,MAAM;IACN,UAAU;IACV,WAAW;IACX,aAAa;CACd,CAAC,CAAA;AAEF,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE;WACrC,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE;YAChC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAE,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC;YACtD,CAAC,CAAC,EAAE,CAAC,CAAA;IACT,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAA;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,iBAAiB,MAAM,iBAAiB,uCAAuC,CAAC,CAAA;IACrG,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;AACzE,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAkC,uBAAuB,EAAE,CAAA;AAE3F,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,oBAAoB,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAA;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAC/C,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAA;IAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAA;IACtE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;IAC3C,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;IACtD,MAAM,WAAW,GAAG,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAA;IAEzD,OAAO;QACL,IAAI;QACJ,WAAW;QACX,IAAI;QACJ,OAAO;QACP,YAAY;QACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,WAAmB;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,eAAe,WAAW,oBAAoB,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAA;IAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAA;IAC3D,OAAO;QACL,MAAM;QACN,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,aAAa,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAsC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnK,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAuC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAmC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClJ,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,WAAmB;IAC/D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,mBAAmB,WAAW,oBAAoB,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAA;IAC5C,OAAO;QACL,GAAG,GAAG;QACN,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,WAAW,CAAC;QAC1D,WAAW,EAAE,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,WAAW,CAAC;KAC7D,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,WAAmB;IAC5D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,oBAAoB,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAA;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IACxD,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IACtD,MAAM,cAAc,GAAG,GAAG,CAAC,WAAW,CAAC,CAAA;IACvC,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC9C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAChD,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAA+B;QAC3C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAA;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AAChE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,KAA6D,CAAC,CAAA;AACpH,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,GAAW,EAAE,OAAwB;IACzF,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,yBAAyB,GAAG,EAAE,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,GAAW;IAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;IACtB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACxF,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACpC,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;SAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,cAAc,CAAA;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,YAAsB;IACtD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,oBAAoB,CAAC,IAAI,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;YACjD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;AAC/B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,YAAsB;IAC1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;YAAE,SAAQ;QACzD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,YAAsB;IAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAA;IACvD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;YAAE,SAAQ;QACzD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAA;YAClE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC1C,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACtB,CAAC;YACD,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,YAAsB;IAC9D,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0C,CAAA;IACzE,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;YAAE,SAAQ;QACzD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAA;QACtD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAA6B,CAAA;YACnF,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAC7B,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAA;AACxB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,YAAsB;IACnE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkC,CAAA;IAC/D,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;YAAE,SAAQ;QAClE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAA;AACtB,CAAC"}