@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.3

package/dist/doctor/egress/classify-host.js

@@ -0,0 +1,210 @@
+"use strict";
+// =============================================================================
+// Host classification for the egress inventory (issue #773, PP-13.2)
+// =============================================================================
+//
+// PURE: no DNS lookup, no socket, no `fetch`. A name is judged by its shape
+// alone, because the doctor must be safe to run anywhere at any time, and in an
+// air-gapped network every lookup of a public name simply hangs.
+//
+// The rules are conservative in one direction only: a name we cannot place is
+// `public` (it is reachable only if the internet is), and a string we cannot
+// even parse is `unknown`, which the `network.egress` check grades as public
+// for an air-gapped install (fail closed).
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hostnameOf = hostnameOf;
+exports.classifyHost = classifyHost;
+exports.scopeOfHosts = scopeOfHosts;
+exports.egressDependency = egressDependency;
+const egress_types_1 = require("./egress.types");
+/** Suffixes that only resolve inside a private network (RFC 6762, RFC 8375, Kubernetes, common LAN conventions). */
+const PRIVATE_SUFFIXES = ['.internal', '.local', '.lan', '.home.arpa', '.svc', '.cluster.local', '.localhost'];
+const HOSTNAME_LABEL = /^[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?$/;
+function isIpv4(host) {
+    const parts = host.split('.');
+    return parts.length === 4 && parts.every((p) => /^\d{1,3}$/.test(p) && Number(p) <= 255);
+}
+function isPrivateIpv4(host) {
+    const [a, b] = host.split('.').map(Number);
+    return (a === 10 ||
+        a === 127 ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 168) ||
+        (a === 169 && b === 254));
+}
+/** Expands `::`-compressed IPv6 into 8 hextets, or `null` when it is not IPv6. */
+function ipv6Hextets(host) {
+    if (!host.includes(':') || !/^[0-9a-f:.]+$/.test(host))
+        return null;
+    const halves = host.split('::');
+    if (halves.length > 2)
+        return null;
+    const parse = (part) => {
+        if (part === '')
+            return [];
+        const out = [];
+        for (const piece of part.split(':')) {
+            if (!/^[0-9a-f]{1,4}$/.test(piece))
+                return null;
+            out.push(parseInt(piece, 16));
+        }
+        return out;
+    };
+    const head = parse(halves[0] ?? '');
+    const tail = halves.length === 2 ? parse(halves[1] ?? '') : [];
+    if (!head || !tail)
+        return null;
+    if (halves.length === 1)
+        return head.length === 8 ? head : null;
+    const missing = 8 - head.length - tail.length;
+    if (missing < 1)
+        return null;
+    return [...head, ...new Array(missing).fill(0), ...tail];
+}
+function isPrivateIpv6(hextets) {
+    const first = hextets[0] ?? 0;
+    const loopback = hextets.slice(0, 7).every((h) => h === 0) && hextets[7] === 1;
+    return loopback || (first & 0xfe00) === 0xfc00 || (first & 0xffc0) === 0xfe80;
+}
+/**
+ * Reduces a URL, a `host:port` string or a bare name to its lower-case
+ * hostname: no scheme, userinfo, port, path, query or fragment, and no IPv6
+ * brackets. Returns `null` for an empty or unparsable value. Pure.
+ *
+ * @param value - `https://user:pw@api.openai.com:443/v1?x=1`, `minio:9000`, `[::1]`, `smtp.corp.internal`.
+ * @returns `api.openai.com`, `minio`, `::1`, `smtp.corp.internal`; or `null`.
+ *
+ * @example
+ * ```ts
+ * hostnameOf('http://ollama:11434/v1'); // 'ollama'
+ * ```
+ *
+ * @stability experimental
+ */
+function hostnameOf(value) {
+    if (typeof value !== 'string')
+        return null;
+    let rest = value.trim().toLowerCase();
+    if (rest === '')
+        return null;
+    const scheme = /^[a-z][a-z0-9+.-]*:\/\//.exec(rest);
+    if (scheme)
+        rest = rest.slice(scheme[0].length);
+    else if (rest.startsWith('//'))
+        rest = rest.slice(2);
+    rest = rest.split(/[/?#]/, 1)[0] ?? '';
+    const at = rest.lastIndexOf('@');
+    if (at >= 0)
+        rest = rest.slice(at + 1);
+    let host;
+    if (rest.startsWith('[')) {
+        const close = rest.indexOf(']');
+        if (close < 0)
+            return null;
+        host = rest.slice(1, close);
+        if (!ipv6Hextets(host))
+            return null;
+        return host;
+    }
+    // A bare IPv6 literal (more than one colon, no brackets) has no port to strip.
+    if ((rest.match(/:/g) ?? []).length > 1)
+        return ipv6Hextets(rest) ? rest : null;
+    host = rest.split(':', 1)[0] ?? '';
+    if (host.endsWith('.'))
+        host = host.slice(0, -1);
+    if (host === '' || host.length > 253)
+        return null;
+    if (!host.split('.').every((label) => HOSTNAME_LABEL.test(label)))
+        return null;
+    return host;
+}
+/**
+ * Where `host` lives, judged by its shape alone. No DNS lookup, no network I/O.
+ *
+ * Private: `localhost`; single-label names (Docker service names such as
+ * `minio`, `greptimedb`, `ollama`); IPv4 in 10/8, 172.16/12, 192.168/16, 127/8,
+ * 169.254/16; IPv6 `::1`, `fc00::/7`, `fe80::/10`; names ending in `.internal`,
+ * `.local`, `.lan`, `.home.arpa`, `.svc`, `.cluster.local` (or `.localhost`).
+ * Everything else is public. Empty or unparsable is `unknown`. A port, scheme,
+ * path or brackets are stripped first ({@link hostnameOf}).
+ *
+ * @param host - a hostname, `host:port`, IP literal or URL.
+ * @returns the scope.
+ *
+ * @example
+ * ```ts
+ * classifyHost('minio:9000');                   // 'private'
+ * classifyHost('contoso.openai.azure.com');     // 'public'
+ * classifyHost('');                             // 'unknown'
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+function classifyHost(host) {
+    const name = hostnameOf(host);
+    if (name === null)
+        return 'unknown';
+    const v6 = ipv6Hextets(name);
+    if (v6)
+        return isPrivateIpv6(v6) ? 'private' : 'public';
+    if (isIpv4(name))
+        return isPrivateIpv4(name) ? 'private' : 'public';
+    if (/^[\d.]+$/.test(name))
+        return 'unknown';
+    if (name === 'localhost' || !name.includes('.'))
+        return 'private';
+    if (PRIVATE_SUFFIXES.some((suffix) => name.endsWith(suffix)))
+        return 'private';
+    return 'public';
+}
+const SCOPE_RANK = { private: 0, unknown: 1, public: 2 };
+/**
+ * The worst scope over `hosts` (`public`, then `unknown`, then `private`); `unknown`
+ * when there is no host at all. Pure.
+ *
+ * @param hosts - hostnames (or anything {@link classifyHost} accepts).
+ * @returns the scope the dependency is graded on.
+ *
+ * @stability experimental
+ */
+function scopeOfHosts(hosts) {
+    if (hosts.length === 0)
+        return 'unknown';
+    return hosts
+        .map((host) => classifyHost(host))
+        .reduce((worst, scope) => (SCOPE_RANK[scope] > SCOPE_RANK[worst] ? scope : worst), 'private');
+}
+/**
+ * Builds an {@link EgressDependency} from a contributor's input: every entry of
+ * `hosts` is reduced to its hostname ({@link hostnameOf}; empty and unparsable
+ * ones are dropped), de-duplicated in order, capped at {@link EGRESS_MAX_HOSTS},
+ * and `scope` is computed with {@link scopeOfHosts}. This is the one way a
+ * contributor should build an entry: it guarantees no URL path, query, port or
+ * userinfo leaves `describe()`.
+ *
+ * @param input - the dependency, with raw `hosts`.
+ * @returns the normalised dependency.
+ *
+ * @example
+ * ```ts
+ * egressDependency({ id: 'email.smtp', capability: 'Email (SMTP)', direction: 'server',
+ *   enabled: true, required: false, hosts: ['smtp.corp.internal'], degradation: 'No email is sent' });
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+function egressDependency(input) {
+    const hosts = [];
+    for (const raw of input.hosts) {
+        const host = hostnameOf(raw);
+        if (host !== null && !hosts.includes(host))
+            hosts.push(host);
+        if (hosts.length >= egress_types_1.EGRESS_MAX_HOSTS)
+            break;
+    }
+    return { ...input, hosts, scope: scopeOfHosts(hosts) };
+}
+//# sourceMappingURL=classify-host.js.map

package/dist/doctor/egress/classify-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify-host.js","sourceRoot":"","sources":["../../../src/doctor/egress/classify-host.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,qEAAqE;AACrE,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,iEAAiE;AACjE,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,2CAA2C;AAC3C,gFAAgF;;AAsEhF,gCA8BC;AAyBD,oCAYC;AAaD,oCAKC;AAsBD,4CAQC;AAvLD,iDAAkD;AAGlD,oHAAoH;AACpH,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;AAE/G,MAAM,cAAc,GAAG,2CAA2C,CAAC;AAEnE,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAqC,CAAC;IAC/E,OAAO,CACL,CAAC,KAAK,EAAE;QACR,CAAC,KAAK,GAAG;QACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAmB,EAAE;QAC9C,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9C,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,OAAiB;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/E,OAAO,QAAQ,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,UAAU,CAAC,KAAgC;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,MAAM;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;SAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAErD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAEvC,IAAI,IAAY,CAAC;IACjB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhF,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,YAAY,CAAC,IAA+B;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEpC,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,EAAE;QAAE,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxD,IAAI,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5C,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAA0C,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAEhG;;;;;;;;GAQG;AACH,SAAgB,YAAY,CAAC,KAAwB;IACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;SACjC,MAAM,CAAc,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;AAC/G,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,gBAAgB,CAAC,KAA4B;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,MAAM,IAAI,+BAAgB;YAAE,MAAM;IAC9C,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AACzD,CAAC"}

package/dist/doctor/egress/egress.registry.d.ts

@@ -0,0 +1,34 @@
+import { OnApplicationBootstrap } from '@nestjs/common';
+import type { EgressContributor } from './egress.types';
+/**
+ * The modules that describe the deployment's outbound dependencies. The
+ * `network.egress` doctor check reads every contributor; a support bundle may
+ * read the same inventory.
+ *
+ * @stability experimental
+ */
+export declare class EgressRegistry implements OnApplicationBootstrap {
+    private readonly contributors;
+    /**
+     * Adds `contributor`. Call it from the contributor's own `onModuleInit`.
+     *
+     * @param contributor - its `id` must be unique across the application.
+     * @throws RegistryError `DUPLICATE_ID` when another contributor already uses
+     *   its id, `FROZEN` after the application has bootstrapped.
+     *
+     * @example
+     * ```ts
+     * onModuleInit(): void {
+     *   this.egress.register(this);
+     * }
+     * ```
+     *
+     * @extensionPoint registry
+     */
+    register(contributor: EgressContributor): void;
+    /** Every registered contributor, in registration order (a copy). */
+    list(): EgressContributor[];
+    /** Refuses further registrations once every module's `onModuleInit` has run. */
+    onApplicationBootstrap(): void;
+}
+//# sourceMappingURL=egress.registry.d.ts.map

package/dist/doctor/egress/egress.registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.registry.d.ts","sourceRoot":"","sources":["../../../src/doctor/egress/egress.registry.ts"],"names":[],"mappings":"AAaA,OAAO,EAAc,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAGpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD;;;;;;GAMG;AACH,qBACa,cAAe,YAAW,sBAAsB;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAM1B;IAEH;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI;IAI9C,oEAAoE;IACpE,IAAI,IAAI,iBAAiB,EAAE;IAI3B,gFAAgF;IAChF,sBAAsB,IAAI,IAAI;CAG/B"}

package/dist/doctor/egress/egress.registry.js

@@ -0,0 +1,70 @@
+"use strict";
+// =============================================================================
+// Egress dependency registry (issue #773, PP-13.2)
+// =============================================================================
+//
+// The one place that knows which modules describe outbound dependencies. It
+// mirrors `DoctorCheckRegistry` exactly, for the same reasons (read that
+// file's header): explicit self-registration from each contributor's own
+// `onModuleInit`, duplicate ids throw, frozen in `onApplicationBootstrap`.
+//
+// Provided (globally) by `DoctorModule.forRoot()`, so a feature module
+// contributes by providing its contributor, without importing the Doctor.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EgressRegistry = void 0;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../core/index");
+/**
+ * The modules that describe the deployment's outbound dependencies. The
+ * `network.egress` doctor check reads every contributor; a support bundle may
+ * read the same inventory.
+ *
+ * @stability experimental
+ */
+let EgressRegistry = class EgressRegistry {
+    contributors = new index_1.Registry({
+        name: 'egress-contributors',
+        idOf: (contributor) => contributor.id,
+        describeDuplicate: (existing, incoming) => `Duplicate egress contributor id "${incoming.id}": ${existing.constructor.name} and ` +
+            `${incoming.constructor.name} both register it. Contributor ids must be unique.`,
+    });
+    /**
+     * Adds `contributor`. Call it from the contributor's own `onModuleInit`.
+     *
+     * @param contributor - its `id` must be unique across the application.
+     * @throws RegistryError `DUPLICATE_ID` when another contributor already uses
+     *   its id, `FROZEN` after the application has bootstrapped.
+     *
+     * @example
+     * ```ts
+     * onModuleInit(): void {
+     *   this.egress.register(this);
+     * }
+     * ```
+     *
+     * @extensionPoint registry
+     */
+    register(contributor) {
+        this.contributors.register(contributor);
+    }
+    /** Every registered contributor, in registration order (a copy). */
+    list() {
+        return this.contributors.list();
+    }
+    /** Refuses further registrations once every module's `onModuleInit` has run. */
+    onApplicationBootstrap() {
+        this.contributors.freeze();
+    }
+};
+exports.EgressRegistry = EgressRegistry;
+exports.EgressRegistry = EgressRegistry = __decorate([
+    (0, common_1.Injectable)()
+], EgressRegistry);
+//# sourceMappingURL=egress.registry.js.map

package/dist/doctor/egress/egress.registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.registry.js","sourceRoot":"","sources":["../../../src/doctor/egress/egress.registry.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,mDAAmD;AACnD,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,gFAAgF;;;;;;;;;AAEhF,2CAAoE;AAEpE,4CAA4C;AAG5C;;;;;;GAMG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IACR,YAAY,GAAG,IAAI,gBAAQ,CAAoB;QAC9D,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE;QACrC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACxC,oCAAoC,QAAQ,CAAC,EAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO;YACrF,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,oDAAoD;KACnF,CAAC,CAAC;IAEH;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAA8B;QACrC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAED,oEAAoE;IACpE,IAAI;QACF,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,gFAAgF;IAChF,sBAAsB;QACpB,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;IAC7B,CAAC;CACF,CAAA;AAtCY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;GACA,cAAc,CAsC1B"}

package/dist/doctor/egress/egress.types.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Where a host lives, as far as configuration can tell without a DNS lookup.
+ *
+ * - `public`: reachable only over the internet (`api.openai.com`).
+ * - `private`: on the deployment's own network (`localhost`, `minio`,
+ *   `10.0.0.5`, `smtp.corp.internal`).
+ * - `unknown`: no host, or one that could not be parsed. Graded as `public`
+ *   for an air-gapped deployment (fail closed).
+ *
+ * @stability experimental
+ */
+export type EgressScope = 'public' | 'private' | 'unknown';
+/**
+ * Which side opens the connection: the API process, the user's browser
+ * (a CDN bundle, a provider's realtime endpoint), or both (presigned object
+ * storage URLs).
+ *
+ * @stability experimental
+ */
+export type EgressDirection = 'server' | 'browser' | 'both';
+/**
+ * Every value `DEPLOYMENT_NETWORK` accepts, in documentation order.
+ *
+ * @stability experimental
+ */
+export declare const DEPLOYMENT_NETWORKS: readonly ["online", "air-gapped"];
+/**
+ * Whether the deployment has internet egress: `online` (the default) or
+ * `air-gapped`. A deployment-level fact the app reads from `DEPLOYMENT_NETWORK`.
+ *
+ * @stability experimental
+ */
+export type DeploymentNetwork = (typeof DEPLOYMENT_NETWORKS)[number];
+/**
+ * The most hosts one dependency reports; the rest are dropped (a push service
+ * fleet can be long, and the report is a summary, not a firewall rule set).
+ *
+ * @stability experimental
+ */
+export declare const EGRESS_MAX_HOSTS = 20;
+/**
+ * One outbound dependency of the running deployment: what an
+ * {@link EgressContributor} returns. Build it with `egressDependency()`, which
+ * reduces hosts to hostnames and computes `scope`.
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export interface EgressDependency {
+    /** Stable, dotted, unique in the inventory: `auth.google`, `ai.provider.openai`, `storage.s3`. */
+    id: string;
+    /** Human label: "Google sign-in", "AI provider: OpenAI". */
+    capability: string;
+    /** Which side opens the connection. */
+    direction: EgressDirection;
+    /** Configured AND switched on right now. A disabled dependency is listed but never graded. */
+    enabled: boolean;
+    /** Hostnames only (no scheme, userinfo, port, path or query); de-duplicated, at most {@link EGRESS_MAX_HOSTS}. */
+    hosts: string[];
+    /** The worst scope over `hosts` (`public`, then `unknown`, then `private`); `unknown` when there is no host. */
+    scope: EgressScope;
+    /** The deployment cannot do its core job without it (the only sign-in provider). */
+    required: boolean;
+    /** One line: what stops working without egress. */
+    degradation: string;
+    /** The web route that configures it, e.g. `/admin/settings/ai`. */
+    settingsPath?: string;
+    /** A count behind the dependency (push subscriptions, say). Counts only, never values. */
+    count?: number;
+}
+/**
+ * What a contributor passes to {@link egressDependency}: an
+ * {@link EgressDependency} without `scope`, whose `hosts` may still be URLs or
+ * `host:port` strings. The helper reduces them to hostnames and computes the scope.
+ *
+ * @stability experimental
+ */
+export type EgressDependencyInput = Omit<EgressDependency, 'scope' | 'hosts'> & {
+    /** URLs, `host:port` strings or bare hostnames; empty and unparsable entries are dropped. */
+    hosts: readonly (string | null | undefined)[];
+};
+/**
+ * A module's description of its outbound dependencies. An `@Injectable()` in
+ * the module that owns the capability, which injects `EgressRegistry` and calls
+ * `register(this)` from its `onModuleInit`.
+ *
+ * `describe()` is READ-ONLY (the doctor's rule 3): settings and configuration
+ * reads only, no network I/O, no write, no job, no model call. It returns no
+ * secret material: hostnames only (rule 4). It may throw; the `network.egress`
+ * check turns a throw into one `unknown` entry under the contributor's id.
+ *
+ * @example
+ * ```ts
+ * @Injectable()
+ * export class DocsEgressContributor implements EgressContributor, OnModuleInit {
+ *   readonly id = 'docs';
+ *   constructor(private readonly egress: EgressRegistry) {}
+ *   onModuleInit(): void { this.egress.register(this); }
+ *   async describe(): Promise<EgressDependency[]> {
+ *     return [egressDependency({ id: 'docs.scalar-cdn', capability: 'API reference (Scalar CDN)',
+ *       direction: 'browser', enabled: true, required: false, hosts: ['https://cdn.jsdelivr.net'],
+ *       degradation: '/api/docs renders without its bundle' })];
+ *   }
+ * }
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export interface EgressContributor {
+    /** Unique across the application: `auth`, `ai.providers`, `docs`. */
+    readonly id: string;
+    /** Read-only, no network I/O, hostnames only. */
+    describe(): Promise<EgressDependency[]>;
+}
+/**
+ * Where the `network.egress` check reads `DEPLOYMENT_NETWORK` from: anything
+ * with a `network` property. The app binds it to its own parsed value under
+ * {@link DEPLOYMENT_NETWORK_SOURCE}; unbound, the check assumes `online`.
+ *
+ * @stability experimental
+ */
+export interface DeploymentNetworkSource {
+    /** The parsed `DEPLOYMENT_NETWORK`. */
+    readonly network: DeploymentNetwork;
+}
+/**
+ * The injection token of the app's {@link DeploymentNetworkSource}. Bind it
+ * once, globally (`{ provide: DEPLOYMENT_NETWORK_SOURCE, useExisting: <the app's service> }`).
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+export declare const DEPLOYMENT_NETWORK_SOURCE: unique symbol;
+//# sourceMappingURL=egress.types.d.ts.map

package/dist/doctor/egress/egress.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.types.d.ts","sourceRoot":"","sources":["../../../src/doctor/egress/egress.types.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,mCAAoC,CAAC;AAErE;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kGAAkG;IAClG,EAAE,EAAE,MAAM,CAAC;IACX,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,SAAS,EAAE,eAAe,CAAC;IAC3B,8FAA8F;IAC9F,OAAO,EAAE,OAAO,CAAC;IACjB,kHAAkH;IAClH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gHAAgH;IAChH,KAAK,EAAE,WAAW,CAAC;IACnB,oFAAoF;IACpF,QAAQ,EAAE,OAAO,CAAC;IAClB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG;IAC9E,6FAA6F;IAC7F,KAAK,EAAE,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC;CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,QAAQ,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CACzC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,OAAO,MAA4C,CAAC"}

package/dist/doctor/egress/egress.types.js

@@ -0,0 +1,42 @@
+"use strict";
+// =============================================================================
+// Outbound dependencies: the egress inventory's contract (issue #773, PP-13.2)
+// =============================================================================
+//
+// Every capability that talks to a host outside the deployment (Google
+// sign-in, an AI provider, a push service, an SMTP relay, an object store,
+// GreptimeDB, the API docs CDN) describes that dependency here, through an
+// `EgressContributor` its OWNING module registers with `EgressRegistry`. The
+// `network.egress` doctor check reads the whole inventory and, when the
+// deployment declares `DEPLOYMENT_NETWORK=air-gapped`, grades it.
+//
+// THE DOCTOR'S READ-ONLY RULE BINDS EVERY CONTRIBUTOR (doctor-check.interface.ts,
+// rules 3 and 4): `describe()` reads settings and configuration only. No test
+// service, no write, no job, no model call, no network I/O (no DNS lookup, no
+// connect). It returns HOSTNAMES ONLY: never a URL, a path, a query, userinfo,
+// a key, a region-scoped credential or a fingerprint.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPLOYMENT_NETWORK_SOURCE = exports.EGRESS_MAX_HOSTS = exports.DEPLOYMENT_NETWORKS = void 0;
+/**
+ * Every value `DEPLOYMENT_NETWORK` accepts, in documentation order.
+ *
+ * @stability experimental
+ */
+exports.DEPLOYMENT_NETWORKS = ['online', 'air-gapped'];
+/**
+ * The most hosts one dependency reports; the rest are dropped (a push service
+ * fleet can be long, and the report is a summary, not a firewall rule set).
+ *
+ * @stability experimental
+ */
+exports.EGRESS_MAX_HOSTS = 20;
+/**
+ * The injection token of the app's {@link DeploymentNetworkSource}. Bind it
+ * once, globally (`{ provide: DEPLOYMENT_NETWORK_SOURCE, useExisting: <the app's service> }`).
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.DEPLOYMENT_NETWORK_SOURCE = Symbol('DEPLOYMENT_NETWORK_SOURCE');
+//# sourceMappingURL=egress.types.js.map

package/dist/doctor/egress/egress.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.types.js","sourceRoot":"","sources":["../../../src/doctor/egress/egress.types.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AACxE,kEAAkE;AAClE,EAAE;AACF,kFAAkF;AAClF,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,sDAAsD;AACtD,gFAAgF;;;AAwBhF;;;;GAIG;AACU,QAAA,mBAAmB,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAU,CAAC;AAUrE;;;;;GAKG;AACU,QAAA,gBAAgB,GAAG,EAAE,CAAC;AA4FnC;;;;;;GAMG;AACU,QAAA,yBAAyB,GAAkB,MAAM,CAAC,2BAA2B,CAAC,CAAC"}

package/dist/doctor/egress/index.d.ts

@@ -0,0 +1,6 @@
+export { DEPLOYMENT_NETWORKS, DEPLOYMENT_NETWORK_SOURCE, EGRESS_MAX_HOSTS } from './egress.types';
+export type { DeploymentNetwork, DeploymentNetworkSource, EgressContributor, EgressDependency, EgressDependencyInput, EgressDirection, EgressScope, } from './egress.types';
+export { EgressRegistry } from './egress.registry';
+export { classifyHost, egressDependency, hostnameOf, scopeOfHosts } from './classify-host';
+export { AIR_GAPPED_RUNBOOK, NETWORK_EGRESS_CHECK_ID, NetworkEgressDoctorCheck, describeEgress, gradeEgress, } from './network-egress.doctor-check';
+//# sourceMappingURL=index.d.ts.map

package/dist/doctor/egress/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/doctor/egress/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClG,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,EACd,WAAW,GACZ,MAAM,+BAA+B,CAAC"}

package/dist/doctor/egress/index.js

@@ -0,0 +1,23 @@
+"use strict";
+// The egress inventory (issue #773, PP-13.2): part of the doctor slice,
+// re-exported from `../index.ts`. Explicit named exports only.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gradeEgress = exports.describeEgress = exports.NetworkEgressDoctorCheck = exports.NETWORK_EGRESS_CHECK_ID = exports.AIR_GAPPED_RUNBOOK = exports.scopeOfHosts = exports.hostnameOf = exports.egressDependency = exports.classifyHost = exports.EgressRegistry = exports.EGRESS_MAX_HOSTS = exports.DEPLOYMENT_NETWORK_SOURCE = exports.DEPLOYMENT_NETWORKS = void 0;
+var egress_types_1 = require("./egress.types");
+Object.defineProperty(exports, "DEPLOYMENT_NETWORKS", { enumerable: true, get: function () { return egress_types_1.DEPLOYMENT_NETWORKS; } });
+Object.defineProperty(exports, "DEPLOYMENT_NETWORK_SOURCE", { enumerable: true, get: function () { return egress_types_1.DEPLOYMENT_NETWORK_SOURCE; } });
+Object.defineProperty(exports, "EGRESS_MAX_HOSTS", { enumerable: true, get: function () { return egress_types_1.EGRESS_MAX_HOSTS; } });
+var egress_registry_1 = require("./egress.registry");
+Object.defineProperty(exports, "EgressRegistry", { enumerable: true, get: function () { return egress_registry_1.EgressRegistry; } });
+var classify_host_1 = require("./classify-host");
+Object.defineProperty(exports, "classifyHost", { enumerable: true, get: function () { return classify_host_1.classifyHost; } });
+Object.defineProperty(exports, "egressDependency", { enumerable: true, get: function () { return classify_host_1.egressDependency; } });
+Object.defineProperty(exports, "hostnameOf", { enumerable: true, get: function () { return classify_host_1.hostnameOf; } });
+Object.defineProperty(exports, "scopeOfHosts", { enumerable: true, get: function () { return classify_host_1.scopeOfHosts; } });
+var network_egress_doctor_check_1 = require("./network-egress.doctor-check");
+Object.defineProperty(exports, "AIR_GAPPED_RUNBOOK", { enumerable: true, get: function () { return network_egress_doctor_check_1.AIR_GAPPED_RUNBOOK; } });
+Object.defineProperty(exports, "NETWORK_EGRESS_CHECK_ID", { enumerable: true, get: function () { return network_egress_doctor_check_1.NETWORK_EGRESS_CHECK_ID; } });
+Object.defineProperty(exports, "NetworkEgressDoctorCheck", { enumerable: true, get: function () { return network_egress_doctor_check_1.NetworkEgressDoctorCheck; } });
+Object.defineProperty(exports, "describeEgress", { enumerable: true, get: function () { return network_egress_doctor_check_1.describeEgress; } });
+Object.defineProperty(exports, "gradeEgress", { enumerable: true, get: function () { return network_egress_doctor_check_1.gradeEgress; } });
+//# sourceMappingURL=index.js.map

package/dist/doctor/egress/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/doctor/egress/index.ts"],"names":[],"mappings":";AAAA,wEAAwE;AACxE,+DAA+D;;;AAE/D,+CAAkG;AAAzF,mHAAA,mBAAmB,OAAA;AAAE,yHAAA,yBAAyB,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AAUzE,qDAAmD;AAA1C,iHAAA,cAAc,OAAA;AACvB,iDAA2F;AAAlF,6GAAA,YAAY,OAAA;AAAE,iHAAA,gBAAgB,OAAA;AAAE,2GAAA,UAAU,OAAA;AAAE,6GAAA,YAAY,OAAA;AACjE,6EAMuC;AALrC,iIAAA,kBAAkB,OAAA;AAClB,sIAAA,uBAAuB,OAAA;AACvB,uIAAA,wBAAwB,OAAA;AACxB,6HAAA,cAAc,OAAA;AACd,0HAAA,WAAW,OAAA"}

package/dist/doctor/egress/network-egress.doctor-check.d.ts

@@ -0,0 +1,78 @@
+import { OnModuleInit } from '@nestjs/common';
+import type { DoctorCheck, DoctorCheckOutcome } from '../doctor-check.interface';
+import { DoctorCheckRegistry } from '../doctor-check.registry';
+import { EgressRegistry } from './egress.registry';
+import type { DeploymentNetwork, DeploymentNetworkSource, EgressDependency } from './egress.types';
+/**
+ * The runbook every `warn`/`fail` remedy of `network.egress` names: one section
+ * per dependency id, with what breaks offline and how to make it internal.
+ *
+ * @stability experimental
+ */
+export declare const AIR_GAPPED_RUNBOOK = "docs/runbooks/air-gapped.md";
+/**
+ * The id of the check: `network.egress`.
+ *
+ * @stability experimental
+ */
+export declare const NETWORK_EGRESS_CHECK_ID = "network.egress";
+/**
+ * Runs every contributor of `registry` in parallel and concatenates their
+ * dependencies, in registration order. A contributor that throws (or returns
+ * something that is not an array) becomes ONE entry under its own id, scope
+ * `unknown`, enabled, so an air-gapped grading fails closed. Never throws.
+ *
+ * @param registry - the app's egress registry.
+ * @param onError - told the contributor id and message of each throw (for a log line).
+ * @returns the whole inventory.
+ *
+ * @stability experimental
+ */
+export declare function describeEgress(registry: Pick<EgressRegistry, 'list'>, onError?: (contributorId: string, message: string) => void): Promise<EgressDependency[]>;
+/**
+ * Pure: grades an inventory for a deployment network. Only ENABLED
+ * dependencies count; `unknown` counts as public.
+ *
+ * | network | finding | status |
+ * |---|---|---|
+ * | `online` | anything | `pass` (an inventory) |
+ * | `air-gapped` | every enabled dependency private | `pass` |
+ * | `air-gapped` | only optional dependencies public | `warn` |
+ * | `air-gapped` | a required dependency public | `fail` |
+ *
+ * `data` holds scalars only: `network`, `enabled`, `public`, `private`,
+ * `unknown`, `required_public` and `public_ids` (comma-joined, at most 500 characters).
+ *
+ * @param deps - the inventory ({@link describeEgress}).
+ * @param network - the deployment's declared network.
+ * @returns the check's outcome.
+ *
+ * @stability experimental
+ */
+export declare function gradeEgress(deps: readonly EgressDependency[], network: DeploymentNetwork): DoctorCheckOutcome;
+/**
+ * `network` / `network.egress`: the deployment's outbound dependencies, graded
+ * for air-gap readiness when the app's {@link DeploymentNetworkSource} says
+ * `air-gapped` (`online` when none is bound). Provided by `DoctorModule.forRoot()`;
+ * the inventory comes from the app's `EgressContributor`s.
+ *
+ * @stability experimental
+ */
+export declare class NetworkEgressDoctorCheck implements DoctorCheck, OnModuleInit {
+    private readonly registry;
+    private readonly egress;
+    private readonly source?;
+    readonly id = "network.egress";
+    readonly category = "network";
+    readonly label = "Outbound dependencies (air-gap readiness)";
+    readonly timeoutMs = 5000;
+    private readonly logger;
+    constructor(registry: DoctorCheckRegistry, egress: EgressRegistry, source?: DeploymentNetworkSource | undefined);
+    /** Registers the check with the Doctor once the app's module initialises. */
+    onModuleInit(): void;
+    /** The declared network: the bound source's, or `online`. */
+    get network(): DeploymentNetwork;
+    /** Read-only: every contributor's `describe()`, then {@link gradeEgress}. Never throws. */
+    run(): Promise<DoctorCheckOutcome>;
+}
+//# sourceMappingURL=network-egress.doctor-check.d.ts.map

package/dist/doctor/egress/network-egress.doctor-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-egress.doctor-check.d.ts","sourceRoot":"","sources":["../../../src/doctor/egress/network-egress.doctor-check.ts"],"names":[],"mappings":"AAsBA,OAAO,EAA8B,YAAY,EAAY,MAAM,gBAAgB,CAAC;AAEpF,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAmB,MAAM,2BAA2B,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEnG;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,gCAAgC,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AASxD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,EACtC,OAAO,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACzD,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAyB7B;AAeD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,gBAAgB,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,kBAAkB,CA0D7G;AAED;;;;;;;GAOG;AACH,qBACa,wBAAyB,YAAW,WAAW,EAAE,YAAY;IAStE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACwB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAVzE,QAAQ,CAAC,EAAE,oBAA2B;IACtC,QAAQ,CAAC,QAAQ,aAAa;IAC9B,QAAQ,CAAC,KAAK,+CAA+C;IAC7D,QAAQ,CAAC,SAAS,QAAS;IAE3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;gBAGjD,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,cAAc,EACyB,MAAM,CAAC,EAAE,uBAAuB,YAAA;IAGlG,6EAA6E;IAC7E,YAAY,IAAI,IAAI;IAIpB,6DAA6D;IAC7D,IAAI,OAAO,IAAI,iBAAiB,CAE/B;IAED,2FAA2F;IACrF,GAAG,IAAI,OAAO,CAAC,kBAAkB,CAAC;CAMzC"}