@naylence/advanced-security 0.3.7-test.114 → 0.3.7-test.115

package/dist/esm/naylence/fame/security/cert/default-certificate-manager.js

@@ -0,0 +1,815 @@
+import { SigningMaterial } from "@naylence/core";
+import { AuthInjectionStrategyFactory, getLogger, SigningConfigClass, } from "@naylence/runtime";
+import { CAServiceClient, } from "./ca-service-client.js";
+import { CertificateRequestError } from "./ca-types.js";
+import { GRANT_PURPOSE_CA_SIGN } from "./grants.js";
+import { validateJwkX5cCertificate } from "./util.js";
+import { createEd25519CsrFromPem } from "./node-ed25519-csr.js";
+import { TrustStoreProviderFactory } from "./trust-store/trust-store-provider-factory.js";
+const logger = getLogger("naylence.fame.security.cert.default_certificate_manager");
+const CONNECTION_GRANTS_CAMEL = "connectionGrants";
+const CONNECTION_GRANTS_SNAKE = "connection_grants";
+export class DefaultCertificateManager {
+    constructor(options = {}) {
+        this.priority = 1500;
+        this.node = null;
+        this.pendingWelcomeFrame = null;
+        this.signing = normalizeSigningConfig(options.signing ?? null);
+        this.securitySettings = options.securitySettings ?? null;
+        this.caServiceUrl = options.caServiceUrl ?? null;
+        this.cryptoProviderOverride =
+            options.cryptoProvider ?? options.crypto_provider ?? null;
+        this.certificateMaterialResolver = normalizeCertificateMaterialResolver(options.certificateMaterial ?? null);
+        this.trustStorePemResolver = normalizeTrustStorePemResolver(options.trustStorePem ?? null);
+        this.certificatePersistenceHook =
+            normalizeCertificatePersistenceHook(options.persistCertificateMaterial ?? null);
+    }
+    setSigning(signing) {
+        this.signing = normalizeSigningConfig(signing);
+    }
+    setSecuritySettings(securitySettings) {
+        this.securitySettings = securitySettings ?? null;
+    }
+    async onNodeStarted(node) {
+        this.node = node;
+        this.prepareProviderContext(node);
+        const requiresCertificate = this.requiresCertificates();
+        if (requiresCertificate) {
+            logger.debug("node_certificate_required_on_start", {
+                node_id: node.id,
+                physical_path: node.physicalPath,
+                has_parent: node.hasParent,
+            });
+            const fallbackWelcome = {
+                security_settings: this.securitySettings ?? undefined,
+                system_id: node.id,
+                assigned_path: node.physicalPath,
+                accepted_logicals: Array.from(node.acceptedLogicals),
+            };
+            const welcomeFrame = this.pendingWelcomeFrame ?? fallbackWelcome;
+            const success = await this.ensureCertificate(welcomeFrame, this.caServiceUrl ? { caServiceUrl: this.caServiceUrl } : undefined);
+            if (!success) {
+                logger.warning("node_certificate_unavailable_on_start", {
+                    node_id: node.id,
+                    physical_path: node.physicalPath,
+                    message: "Certificate provisioning was requested but did not complete",
+                });
+            }
+        }
+        else {
+            this.pendingWelcomeFrame = null;
+        }
+    }
+    async onWelcome(welcomeFrame) {
+        const requiresCertificate = this.requiresCertificates(welcomeFrame);
+        if (!requiresCertificate) {
+            logger.debug("welcome_does_not_require_certificate", {
+                system_id: welcomeFrame.systemId ?? null,
+            });
+            this.pendingWelcomeFrame = null;
+            return;
+        }
+        const success = await this.ensureCertificate(welcomeFrame, this.caServiceUrl ? { caServiceUrl: this.caServiceUrl } : undefined);
+        if (success) {
+            return;
+        }
+        if (!this.node) {
+            logger.debug("certificate_provisioning_deferred_until_node_start", {
+                system_id: welcomeFrame.systemId ?? null,
+                assigned_path: welcomeFrame.assignedPath ?? null,
+            });
+            return;
+        }
+        const nodeId = welcomeFrame.systemId ?? "unknown";
+        logger.warning("certificate_provisioning_not_completed", {
+            node_id: nodeId,
+            assigned_path: welcomeFrame.assignedPath ?? null,
+            message: "Continuing without a provisioned certificate (development mode)",
+        });
+    }
+    async ensureCertificate(welcomeFrame, options) {
+        const requiresCertificate = this.requiresCertificates(welcomeFrame);
+        if (!requiresCertificate) {
+            this.pendingWelcomeFrame = null;
+            return true;
+        }
+        this.pendingWelcomeFrame = welcomeFrame;
+        const cryptoProvider = this.resolveCryptoProvider();
+        if (!cryptoProvider) {
+            if (!this.node) {
+                logger.debug("crypto_provider_pending_node_start", {
+                    system_id: welcomeFrame.systemId ?? null,
+                    assigned_path: welcomeFrame.assignedPath ?? null,
+                });
+            }
+            else {
+                logger.error("crypto_provider_unavailable_for_certificate", {
+                    system_id: welcomeFrame.systemId ?? null,
+                    assigned_path: welcomeFrame.assignedPath ?? null,
+                });
+            }
+            return false;
+        }
+        const nodeId = readFrameString(welcomeFrame, "systemId", "system_id") ??
+            (typeof cryptoProvider.signatureKeyId === "string"
+                ? cryptoProvider.signatureKeyId
+                : null);
+        if (await this.ensureExistingCertificateIsTrusted(cryptoProvider, nodeId)) {
+            this.pendingWelcomeFrame = null;
+            return true;
+        }
+        this.prepareProviderForWelcome(cryptoProvider, welcomeFrame);
+        const connectionGrants = readFrameValue(welcomeFrame, CONNECTION_GRANTS_CAMEL, CONNECTION_GRANTS_SNAKE);
+        const caSignGrant = this.getCaSignGrant(connectionGrants);
+        if (!caSignGrant) {
+            logger.warning("welcome_frame_missing_ca_sign_grant", {
+                system_id: nodeId,
+                grant_count: Array.isArray(connectionGrants)
+                    ? connectionGrants.length
+                    : 0,
+            });
+        }
+        let material = null;
+        if (caSignGrant) {
+            material = await this.requestCertificateFromCa(cryptoProvider, welcomeFrame, caSignGrant, options);
+            if (!material) {
+                logger.warning("ca_certificate_request_failed_falling_back_to_env", {
+                    system_id: nodeId,
+                    ca_service_url: options?.caServiceUrl ?? this.caServiceUrl ?? caSignGrant.url,
+                });
+            }
+        }
+        if (!material) {
+            material = await this.resolveCertificateMaterialFromInjectedSources(cryptoProvider, nodeId);
+        }
+        if (!material) {
+            logger.debug("attempting_certificate_resolution_from_environment", {
+                system_id: nodeId,
+            });
+            material = await resolveCertificateMaterialFromEnvironment();
+        }
+        if (!material) {
+            logger.warning("certificate_material_not_found", {
+                system_id: nodeId,
+                assigned_path: readFrameString(welcomeFrame, "assignedPath", "assigned_path"),
+                ca_service_url: options?.caServiceUrl ?? this.caServiceUrl,
+            });
+            return false;
+        }
+        const stored = await this.storeCertificateMaterial(cryptoProvider, material, nodeId);
+        if (!stored) {
+            logger.warning("certificate_storage_not_supported", {
+                system_id: nodeId,
+            });
+            return false;
+        }
+        const validated = await this.validateProviderCertificate(cryptoProvider, nodeId);
+        if (!validated) {
+            return false;
+        }
+        logger.debug("certificate_material_applied", {
+            system_id: nodeId,
+            has_chain: Boolean(material.certificateChainPem),
+        });
+        this.pendingWelcomeFrame = null;
+        return true;
+    }
+    requiresCertificates(welcomeFrame) {
+        const frameMaterial = welcomeFrame?.securitySettings?.signing_material ?? null;
+        if (frameMaterial === SigningMaterial.X509_CHAIN) {
+            return true;
+        }
+        if (this.securitySettings?.signing_material === SigningMaterial.X509_CHAIN) {
+            return true;
+        }
+        if (this.signing.signingMaterial === SigningMaterial.X509_CHAIN) {
+            return true;
+        }
+        return false;
+    }
+    prepareProviderContext(node) {
+        const provider = this.resolveCryptoProvider();
+        if (!provider) {
+            return;
+        }
+        const awareProvider = provider;
+        if (typeof awareProvider.setNodeContextFromNodeLike === "function") {
+            awareProvider.setNodeContextFromNodeLike(node);
+            return;
+        }
+        if (typeof awareProvider.setNodeContext === "function") {
+            awareProvider.setNodeContext(node.id, node.physicalPath, Array.from(node.acceptedLogicals), null);
+        }
+    }
+    prepareProviderForWelcome(provider, welcomeFrame) {
+        const logicals = Array.isArray(welcomeFrame.acceptedLogicals)
+            ? welcomeFrame.acceptedLogicals.filter((value) => typeof value === "string")
+            : [];
+        if (typeof provider.prepareForAttach === "function" &&
+            typeof welcomeFrame.systemId === "string") {
+            provider.prepareForAttach(welcomeFrame.systemId, typeof welcomeFrame.assignedPath === "string"
+                ? welcomeFrame.assignedPath
+                : undefined, logicals);
+        }
+    }
+    resolveCryptoProvider() {
+        // First check if we have a crypto provider override
+        if (this.cryptoProviderOverride) {
+            return this.cryptoProviderOverride;
+        }
+        // Otherwise, try to get from the node
+        const candidate = this.node?.cryptoProvider ?? null;
+        if (!candidate) {
+            return null;
+        }
+        return candidate;
+    }
+    async ensureExistingCertificateIsTrusted(provider, nodeId) {
+        if (!providerHasCertificate(provider)) {
+            return false;
+        }
+        const validated = await this.validateProviderCertificate(provider, nodeId);
+        if (!validated) {
+            logger.error("existing_certificate_validation_failed", {
+                node_id: nodeId,
+            });
+            return false;
+        }
+        logger.debug("existing_certificate_validated", {
+            node_id: nodeId,
+        });
+        return true;
+    }
+    async resolveCertificateMaterialFromInjectedSources(provider, nodeId) {
+        const providerMaterial = await this.resolveCertificateMaterialFromProvider(provider, nodeId);
+        if (providerMaterial) {
+            logger.debug("certificate_material_resolved_from_provider", {
+                system_id: nodeId,
+            });
+            return providerMaterial;
+        }
+        if (this.certificateMaterialResolver) {
+            try {
+                const material = await this.certificateMaterialResolver();
+                if (material) {
+                    logger.debug("certificate_material_resolved_from_options", {
+                        system_id: nodeId,
+                    });
+                    return material;
+                }
+            }
+            catch (error) {
+                logger.debug("certificate_material_option_resolution_failed", {
+                    system_id: nodeId,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        return null;
+    }
+    async resolveCertificateMaterialFromProvider(provider, nodeId) {
+        if (typeof provider.resolveCertificateMaterial !== "function") {
+            return null;
+        }
+        try {
+            const material = await provider.resolveCertificateMaterial();
+            return normalizeCertificateMaterial(material ?? null);
+        }
+        catch (error) {
+            logger.debug("provider_certificate_material_resolution_failed", {
+                system_id: nodeId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return null;
+        }
+    }
+    getCaSignGrant(connectionGrants) {
+        if (!Array.isArray(connectionGrants)) {
+            return null;
+        }
+        for (const candidate of connectionGrants) {
+            if (!candidate || typeof candidate !== "object") {
+                continue;
+            }
+            const grantRecord = candidate;
+            const purpose = readRecordString(grantRecord, "purpose");
+            if (purpose !== GRANT_PURPOSE_CA_SIGN) {
+                continue;
+            }
+            const url = readRecordString(grantRecord, "url", "baseUrl", "base_url");
+            if (!url) {
+                logger.warning("ca_sign_grant_missing_url", {
+                    grant_keys: Object.keys(grantRecord),
+                });
+                continue;
+            }
+            const authConfig = readGrantAuthConfig(grantRecord);
+            return {
+                url,
+                ...(authConfig ? { auth: authConfig } : {}),
+            };
+        }
+        return null;
+    }
+    async requestCertificateFromCa(provider, welcomeFrame, grant, options) {
+        const nodeId = readFrameString(welcomeFrame, "systemId", "system_id") ??
+            (typeof provider.signatureKeyId === "string"
+                ? provider.signatureKeyId
+                : null);
+        if (!nodeId) {
+            logger.warning("certificate_request_missing_node_id");
+            return null;
+        }
+        const physicalPath = readFrameString(welcomeFrame, "assignedPath", "assigned_path");
+        if (!physicalPath) {
+            logger.warning("certificate_request_missing_physical_path", {
+                node_id: nodeId,
+            });
+            return null;
+        }
+        const logicals = Array.isArray(welcomeFrame.acceptedLogicals)
+            ? welcomeFrame.acceptedLogicals.filter((value) => typeof value === "string")
+            : [];
+        const csrPem = await this.buildCertificateSigningRequest(provider, nodeId, physicalPath, logicals);
+        if (!csrPem) {
+            return null;
+        }
+        const caServiceUrl = options?.caServiceUrl ?? this.caServiceUrl ?? grant.url;
+        if (!caServiceUrl) {
+            logger.error("ca_service_url_unavailable", {
+                node_id: nodeId,
+            });
+            return null;
+        }
+        const connectionGrant = {
+            url: caServiceUrl,
+        };
+        let authStrategy = null;
+        try {
+            authStrategy = await this.createAuthStrategyForGrant(grant);
+        }
+        catch (error) {
+            logger.error("ca_sign_auth_strategy_creation_failed", {
+                node_id: nodeId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return null;
+        }
+        const client = new CAServiceClient(connectionGrant);
+        try {
+            if (authStrategy) {
+                await authStrategy.apply(client);
+            }
+            const [certificatePem, certificateChainPem] = await client.requestCertificate(csrPem, nodeId, physicalPath, logicals);
+            logger.debug("certificate_received_from_ca_service", {
+                node_id: nodeId,
+                has_chain: Boolean(certificateChainPem),
+                ca_service_url: caServiceUrl,
+            });
+            return {
+                certificatePem,
+                certificateChainPem: certificateChainPem ?? null,
+            };
+        }
+        catch (error) {
+            if (error instanceof CertificateRequestError) {
+                logger.error("certificate_request_failed", {
+                    node_id: nodeId,
+                    error: error.message,
+                });
+            }
+            else {
+                logger.error("certificate_request_unhandled_error", {
+                    node_id: nodeId,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+            return null;
+        }
+        finally {
+            if (authStrategy) {
+                try {
+                    await authStrategy.cleanup();
+                }
+                catch (cleanupError) {
+                    logger.debug("auth_strategy_cleanup_failed", {
+                        error: cleanupError instanceof Error
+                            ? cleanupError.message
+                            : String(cleanupError),
+                    });
+                }
+            }
+        }
+    }
+    async createAuthStrategyForGrant(grant) {
+        const authConfig = grant.auth ?? null;
+        if (!authConfig) {
+            return null;
+        }
+        const normalizedConfig = normalizeAuthConfig(authConfig);
+        if (!normalizedConfig) {
+            return null;
+        }
+        return AuthInjectionStrategyFactory.createAuthInjectionStrategy(normalizedConfig);
+    }
+    async validateProviderCertificate(provider, nodeId) {
+        const { pem: trustStorePem, reason } = await this.resolveTrustStorePemValue(provider, nodeId);
+        if (!trustStorePem) {
+            logger.error("trust_anchor_validation_failed", {
+                node_id: nodeId,
+                reason: reason ?? "trust_store_unavailable",
+            });
+            return false;
+        }
+        if (typeof provider.nodeJwk !== "function") {
+            logger.error("trust_anchor_validation_failed", {
+                node_id: nodeId,
+                reason: "crypto_provider_lacks_node_jwk",
+            });
+            return false;
+        }
+        let jwk;
+        try {
+            jwk = provider.nodeJwk() ?? null;
+        }
+        catch (error) {
+            logger.error("trust_anchor_validation_failed", {
+                node_id: nodeId,
+                reason: "node_jwk_retrieval_failed",
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return false;
+        }
+        if (!jwk) {
+            logger.error("trust_anchor_validation_failed", {
+                node_id: nodeId,
+                reason: "node_jwk_missing",
+            });
+            return false;
+        }
+        const x5c = jwk.x5c;
+        if (!Array.isArray(x5c) ||
+            x5c.length === 0 ||
+            x5c.some((entry) => typeof entry !== "string")) {
+            logger.error("trust_anchor_validation_failed", {
+                node_id: nodeId,
+                reason: "invalid_certificate_chain",
+            });
+            return false;
+        }
+        try {
+            const result = validateJwkX5cCertificate({
+                jwk,
+                trustStorePem,
+                enforceNameConstraints: true,
+                strict: false,
+            });
+            if (!result.isValid) {
+                logger.error("trust_anchor_validation_failed", {
+                    node_id: nodeId,
+                    reason: result.error ?? "validation_failed",
+                });
+                return false;
+            }
+            logger.debug("certificate_chain_validation_successful", {
+                node_id: nodeId,
+            });
+            return true;
+        }
+        catch (error) {
+            logger.error("trust_anchor_validation_failed", {
+                node_id: nodeId,
+                reason: "validation_error",
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return false;
+        }
+    }
+    async resolveTrustStorePemValue(provider, nodeId) {
+        const providerPem = await this.resolveTrustStorePemFromProvider(provider, nodeId);
+        if (providerPem) {
+            logger.debug("trust_store_resolved_from_provider", {
+                node_id: nodeId,
+            });
+            return { pem: providerPem };
+        }
+        if (this.trustStorePemResolver) {
+            try {
+                const pem = await this.trustStorePemResolver();
+                const normalized = normalizePemOrNull(pem);
+                if (normalized) {
+                    logger.debug("trust_store_resolved_from_options", {
+                        node_id: nodeId,
+                    });
+                    return { pem: normalized };
+                }
+            }
+            catch (error) {
+                logger.debug("trust_store_option_resolution_failed", {
+                    node_id: nodeId,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        const envPem = await resolveTrustStorePemFromEnvironment();
+        return {
+            pem: envPem,
+            reason: envPem ? undefined : "trust_store_provider_unconfigured",
+        };
+    }
+    async resolveTrustStorePemFromProvider(provider, nodeId) {
+        if (typeof provider.resolveTrustStorePem !== "function") {
+            return null;
+        }
+        try {
+            const pem = await provider.resolveTrustStorePem();
+            return normalizePemOrNull(pem);
+        }
+        catch (error) {
+            logger.debug("provider_trust_store_resolution_failed", {
+                node_id: nodeId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return null;
+        }
+    }
+    async storeCertificateMaterial(provider, material, nodeId) {
+        let stored = false;
+        if (typeof provider.storeSignedCertificate === "function") {
+            try {
+                await provider.storeSignedCertificate(material.certificatePem, material.certificateChainPem);
+                stored = true;
+            }
+            catch (error) {
+                logger.warning("failed_to_store_certificate", {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        const persistenceHooks = [];
+        if (typeof provider.persistSignedCertificate === "function") {
+            persistenceHooks.push((hookMaterial, context) => provider.persistSignedCertificate(hookMaterial, context));
+        }
+        if (this.certificatePersistenceHook) {
+            persistenceHooks.push(this.certificatePersistenceHook);
+        }
+        for (const hook of persistenceHooks) {
+            try {
+                await hook(material, { nodeId });
+                stored = true;
+            }
+            catch (error) {
+                logger.debug("certificate_persistence_hook_failed", {
+                    node_id: nodeId,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        return stored;
+    }
+    async buildCertificateSigningRequest(provider, nodeId, physicalPath, logicals) {
+        const trimmedPath = physicalPath.trim();
+        if (!trimmedPath) {
+            logger.warning("certificate_request_missing_physical_path", {
+                node_id: nodeId,
+            });
+            return null;
+        }
+        const pemSource = provider;
+        const privateKeyPem = pemSource.signingPrivatePem?.trim() ?? "";
+        const publicKeyPem = pemSource.signingPublicPem?.trim() ?? "";
+        if (!privateKeyPem || !publicKeyPem) {
+            logger.error("crypto_provider_missing_signing_material", {
+                node_id: nodeId,
+                has_private: Boolean(privateKeyPem),
+                has_public: Boolean(publicKeyPem),
+            });
+            return null;
+        }
+        const sanitizedLogicals = logicals.filter((value) => typeof value === "string" && value.trim().length > 0);
+        try {
+            const { csrPem } = await createEd25519CsrFromPem({
+                privateKeyPem,
+                publicKeyPem,
+                commonName: nodeId,
+                logicals: sanitizedLogicals,
+            });
+            return csrPem;
+        }
+        catch (error) {
+            logger.error("csr_generation_failed", {
+                node_id: nodeId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return null;
+        }
+    }
+}
+function normalizeSigningConfig(value) {
+    if (value instanceof SigningConfigClass) {
+        return value;
+    }
+    if (value && typeof value === "object") {
+        return new SigningConfigClass(value);
+    }
+    return new SigningConfigClass();
+}
+function normalizeCertificateMaterial(material) {
+    if (!material) {
+        return null;
+    }
+    const certificatePem = normalizePemOrNull(material.certificatePem);
+    if (!certificatePem) {
+        return null;
+    }
+    const certificateChainPem = normalizePemOrNull(material.certificateChainPem ?? null);
+    return {
+        certificatePem,
+        certificateChainPem,
+    };
+}
+function normalizeCertificateMaterialResolver(source) {
+    if (!source) {
+        return null;
+    }
+    if (typeof source === "function") {
+        return async () => normalizeCertificateMaterial(await source());
+    }
+    const normalized = normalizeCertificateMaterial(source);
+    return normalized ? async () => normalized : null;
+}
+function normalizeTrustStorePemResolver(source) {
+    if (!source) {
+        return null;
+    }
+    if (typeof source === "function") {
+        return async () => normalizePemOrNull(await source());
+    }
+    const normalized = normalizePemOrNull(source);
+    return normalized ? async () => normalized : null;
+}
+function normalizeCertificatePersistenceHook(hook) {
+    if (!hook) {
+        return null;
+    }
+    return async (material, context) => {
+        await hook(material, context);
+    };
+}
+async function resolveCertificateMaterialFromEnvironment() {
+    const certificatePem = await resolvePemFromEnvironment("FAME_NODE_CERT_PEM", "FAME_NODE_CERT_FILE");
+    if (!certificatePem) {
+        return null;
+    }
+    const certificateChainPem = await resolvePemFromEnvironment("FAME_NODE_CERT_CHAIN_PEM", "FAME_NODE_CERT_CHAIN_FILE");
+    return {
+        certificatePem,
+        certificateChainPem,
+    };
+}
+async function resolvePemFromEnvironment(envVar, fileVar) {
+    if (!hasProcessEnv()) {
+        return null;
+    }
+    const inlineValue = process.env?.[envVar];
+    const inline = normalizePemOrNull(inlineValue ?? null);
+    if (inline) {
+        return inline;
+    }
+    const filePath = process.env?.[fileVar];
+    if (!filePath || filePath.trim().length === 0) {
+        return null;
+    }
+    if (!isNodeProcess()) {
+        logger.debug("pem_file_unavailable_in_browser", {
+            env_var: fileVar,
+        });
+        return null;
+    }
+    try {
+        const fs = await import("node:fs/promises");
+        const content = await fs.readFile(filePath, "utf8");
+        return normalizePemOrNull(content);
+    }
+    catch (error) {
+        logger.warning("failed_to_read_certificate_file", {
+            file: filePath,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+    }
+}
+function normalizePem(value) {
+    return value.replace(/\r/g, "").trim();
+}
+function normalizePemOrNull(value) {
+    if (!value) {
+        return null;
+    }
+    const normalized = normalizePem(value);
+    return normalized.length > 0 ? normalized : null;
+}
+function hasProcessEnv() {
+    return typeof process !== "undefined" && !!process?.env;
+}
+function isNodeProcess() {
+    return (typeof process !== "undefined" &&
+        typeof process.versions === "object" &&
+        typeof process.versions?.node === "string");
+}
+function providerHasCertificate(provider) {
+    if (typeof provider.hasCertificate === "function") {
+        try {
+            return Boolean(provider.hasCertificate());
+        }
+        catch (error) {
+            logger.debug("has_certificate_check_failed", {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    if (typeof provider.nodeCertificatePem === "function") {
+        try {
+            return Boolean(provider.nodeCertificatePem());
+        }
+        catch (error) {
+            logger.debug("node_certificate_check_failed", {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return false;
+}
+function readFrameValue(frame, ...keys) {
+    const record = frame;
+    for (const key of keys) {
+        if (Object.prototype.hasOwnProperty.call(record, key)) {
+            const value = record[key];
+            if (value !== undefined && value !== null) {
+                return value;
+            }
+        }
+    }
+    return null;
+}
+function readFrameString(frame, ...keys) {
+    const value = readFrameValue(frame, ...keys);
+    if (typeof value === "string" && value.length > 0) {
+        return value;
+    }
+    return null;
+}
+function readRecordString(source, ...keys) {
+    for (const key of keys) {
+        const value = source[key];
+        if (typeof value === "string" && value.length > 0) {
+            return value;
+        }
+    }
+    return null;
+}
+function readGrantAuthConfig(source) {
+    const candidate = source.auth ??
+        source.authConfig ??
+        source.auth_config ??
+        source.authentication ??
+        source.authenticationConfig ??
+        source.authentication_config ??
+        null;
+    if (!candidate || typeof candidate !== "object") {
+        return null;
+    }
+    return candidate;
+}
+function normalizeAuthConfig(candidate) {
+    if (!candidate || typeof candidate !== "object") {
+        return null;
+    }
+    const normalized = candidate;
+    if (!normalized.type || typeof normalized.type !== "string") {
+        logger.warning("auth_strategy_missing_type", {
+            provided_keys: Object.keys(candidate),
+        });
+        return null;
+    }
+    return normalized;
+}
+async function resolveTrustStorePemFromEnvironment() {
+    try {
+        const provider = await TrustStoreProviderFactory.createTrustStoreProvider();
+        if (typeof provider.initialize === "function") {
+            await provider.initialize();
+        }
+        const pem = await provider.getTrustStorePem();
+        return normalizePemOrNull(pem);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        logger.debug("trust_store_provider_resolution_failed", {
+            error: message,
+        });
+        return null;
+    }
+}
+export default DefaultCertificateManager;
+//# sourceMappingURL=default-certificate-manager.js.map