@phigon/observer 8.2.0 → 8.3.0

package/dist/src/pair.js

@@ -1,25 +1,141 @@
 import { arch, hostname, platform } from "node:os";
-import { FileCredentialStore, } from "./credential-store.js";
-import { loadOrCreateInstallationID } from "./installation.js";
+import { FileCredentialStore, credentialFileName, } from "./credential-store.js";
+import { retirePairingState } from "./event-spool.js";
+import { installationFileName, loadOrCreateInstallationID } from "./installation.js";
+import { InstanceLock } from "./instance-lock.js";
 export const OBSERVER_CONSENT_POLICY_VERSION = "observer-policy-v1";
 export async function pairMachine(options) {
     const code = options.code.trim();
     if (code.length === 0) {
         throw new Error("Pairing code is required.");
     }
-    const installationID = await loadOrCreateInstallationID(options.config.dataDirectory);
     if (options.config.observabilityProfile === "full" &&
         options.consentProfile !== "full") {
         throw new Error("The configured full observability profile requires full-content consent.");
     }
     const endpoint = new URL("/v1/pairing/exchange", options.config.controlPlaneUrl);
     const fetcher = options.fetcher ?? fetch;
+    const connected = await connectMachine({
+        config: options.config,
+        endpoint,
+        fetcher,
+        ...(options.credentialStore === undefined ? {} : { credentialStore: options.credentialStore }),
+        exchange: (installationID, existingCredential) => exchangePairing(fetcher, endpoint, {
+            code,
+            installation_id: installationID,
+            display_name: options.displayName?.trim() || hostname(),
+            hostname: hostname(),
+            operating_system: normalizedOperatingSystem(),
+            architecture: arch(),
+            consent: {
+                granted: true,
+                profile: options.consentProfile,
+                policy_version: OBSERVER_CONSENT_POLICY_VERSION,
+            },
+            ...(existingCredential === undefined ? {} : { existing_credential: existingCredential }),
+        }),
+        evidence: (_paired, at) => ({
+            consentProfile: options.consentProfile,
+            consentPolicyVersion: OBSERVER_CONSENT_POLICY_VERSION,
+            consentedAt: at,
+            consentSource: "owner",
+        }),
+    });
+    return connected.result;
+}
+/**
+ * Connects this computer with a code, keeping its machine when the server
+ * still accepts its stored key: pairing again, or enrolling, renews consent
+ * and keeps the same machine, so its queued activity stays deliverable.
+ * When the server no longer accepts the key, the computer connects as a
+ * new machine and its old queue moves aside.
+ */
+export async function connectMachine(options) {
+    const dataDirectory = options.config.dataDirectory;
+    const installationID = await loadOrCreateInstallationID(dataDirectory);
     const credentialStore = options.credentialStore ??
-        new FileCredentialStore(options.config.dataDirectory);
+        new FileCredentialStore(dataDirectory);
     const previous = await credentialStore.load();
-    if (previous !== null && previous.controlPlaneOrigin !== endpoint.origin) {
+    if (previous !== null && previous.controlPlaneOrigin !== options.endpoint.origin) {
         throw new Error("The stored machine belongs to a different control plane. Use a separate data directory to pair another workspace.");
     }
+    let paired;
+    if (previous !== null) {
+        const renewal = await options.exchange(installationID, previous.credential);
+        if ("paired" in renewal) {
+            paired = renewal.paired;
+        }
+        else if (!renewal.credentialRejected) {
+            throw renewal.error;
+        }
+        else if (await credentialStillAccepted(options.fetcher, options.config.controlPlaneUrl, previous.credential)) {
+            // The exchange also refuses a key that is valid in another workspace.
+            throw new Error("This computer is paired with another workspace on this server. Use a separate data directory to pair another workspace.");
+        }
+    }
+    let lock;
+    try {
+        if (paired === undefined || !sameMachine(previous, paired)) {
+            // A new machine. Its queue, stream cursor and credential start empty;
+            // the observer must not be using the old ones while they move.
+            lock = await InstanceLock.acquire(dataDirectory);
+            // The old credential goes with its queue: it is the only key that can
+            // decrypt it. Once it is gone, a retry after a lost response pairs
+            // without it, and the server answers with the same new machine.
+            //
+            // A key the server no longer accepts also retires its installation ID:
+            // a server can still hold that ID for the deleted machine, and the
+            // built-in SQLite server refuses to pair it again. A new ID pairs
+            // cleanly everywhere.
+            const replacing = paired === undefined && previous !== null;
+            retirePairingState(dataDirectory, previous?.machineId, [
+                credentialFileName,
+                ...(replacing ? [installationFileName] : []),
+            ]);
+            if (paired === undefined) {
+                const freshInstallationID = replacing
+                    ? await loadOrCreateInstallationID(dataDirectory)
+                    : installationID;
+                const fresh = await options.exchange(freshInstallationID);
+                if (!("paired" in fresh))
+                    throw fresh.error;
+                paired = fresh.paired;
+            }
+        }
+        const pairedAt = new Date().toISOString();
+        await credentialStore.save({
+            machineId: paired.machine.id,
+            tenantId: paired.machine.tenant_id,
+            credential: paired.credential,
+            controlPlaneOrigin: options.config.controlPlaneUrl.origin,
+            grpcOrigin: options.config.grpcUrl.origin,
+            createdAt: pairedAt,
+            ...options.evidence(paired, pairedAt),
+        });
+    }
+    finally {
+        await lock?.release();
+    }
+    const replaced = previous !== null && previous.machineId !== paired.machine.id;
+    return Object.freeze({
+        paired,
+        result: Object.freeze({
+            machineId: paired.machine.id,
+            displayName: paired.machine.display_name,
+            state: paired.machine.state,
+            controlPlaneOrigin: options.config.controlPlaneUrl.origin,
+            credentialStored: true,
+            ...(replaced ? { replacedMachineId: previous.machineId } : {}),
+        }),
+    });
+}
+function sameMachine(previous, paired) {
+    return previous !== null &&
+        previous.machineId === paired.machine.id &&
+        previous.tenantId === paired.machine.tenant_id &&
+        previous.credential === paired.credential;
+}
+async function exchangePairing(fetcher, endpoint, body) {
     let response;
     try {
         response = await fetcher(endpoint, {
@@ -28,20 +144,7 @@ export async function pairMachine(options) {
                 "Content-Type": "application/json",
                 Accept: "application/json",
             },
-            body: JSON.stringify({
-                code,
-                ...(previous === null ? {} : { existing_credential: previous.credential }),
-                installation_id: installationID,
-                display_name: options.displayName?.trim() || hostname(),
-                hostname: hostname(),
-                operating_system: normalizedOperatingSystem(),
-                architecture: arch(),
-                consent: {
-                    granted: true,
-                    profile: options.consentProfile,
-                    policy_version: OBSERVER_CONSENT_POLICY_VERSION,
-                },
-            }),
+            body: JSON.stringify(body),
             redirect: "error",
             signal: AbortSignal.timeout(10_000),
         });
@@ -53,7 +156,11 @@ export async function pairMachine(options) {
         throw new Error(`Could not reach ${endpoint.origin}. Check your internet connection and try again.`);
     }
     if (!response.ok) {
-        throw new Error(await pairingFailureMessage(response));
+        const failure = await apiError(response);
+        return {
+            error: new Error(failure.message ?? `Pairing failed with HTTP ${response.status}.`),
+            credentialRejected: credentialRejected(response.status, failure),
+        };
     }
     let value;
     try {
@@ -64,67 +171,98 @@ export async function pairMachine(options) {
         // print fragments. The server supports retries for this installation.
         throw new Error("The pairing response was incomplete or invalid. Retry with the same code before it expires; keep the existing data directory.");
     }
-    const paired = parsePairingResponse(value);
-    const pairedAt = new Date().toISOString();
-    await credentialStore.save({
-        machineId: paired.machine.id,
-        tenantId: paired.machine.tenant_id,
-        credential: paired.credential,
-        controlPlaneOrigin: options.config.controlPlaneUrl.origin,
-        grpcOrigin: options.config.grpcUrl.origin,
-        createdAt: pairedAt,
-        consentProfile: options.consentProfile,
-        consentPolicyVersion: OBSERVER_CONSENT_POLICY_VERSION,
-        consentedAt: pairedAt,
-    });
-    return Object.freeze({
-        machineId: paired.machine.id,
-        displayName: paired.machine.display_name,
-        state: paired.machine.state,
-        controlPlaneOrigin: options.config.controlPlaneUrl.origin,
-        credentialStored: true,
-    });
-}
-function parsePairingResponse(value) {
-    if (typeof value !== "object" ||
-        value === null ||
-        !("credential" in value) ||
-        typeof value.credential !== "string" ||
-        !value.credential.startsWith("phg_m_") ||
-        !("machine" in value) ||
-        typeof value.machine !== "object" ||
-        value.machine === null ||
-        !("id" in value.machine) ||
-        typeof value.machine.id !== "string" ||
-        !("tenant_id" in value.machine) ||
-        typeof value.machine.tenant_id !== "string" ||
-        !("display_name" in value.machine) ||
-        typeof value.machine.display_name !== "string" ||
-        !("state" in value.machine) ||
-        typeof value.machine.state !== "string") {
+    if (!isConnectedMachine(value)) {
         throw new Error("Control plane returned an invalid pairing response.");
     }
-    return value;
+    return { paired: value };
+}
+/**
+ * Whether a failed exchange refused the stored key. The server answers a
+ * key it no longer accepts with HTTP 400 and "machine credential is
+ * invalid".
+ */
+export function credentialRejected(status, failure) {
+    return failure.code === "invalid_credential" ||
+        (status === 400 &&
+            /^machine credential is (?:invalid|revoked)\b/iu.test(failure.message ?? ""));
+}
+/**
+ * Whether a server still accepts a stored key. Only a key the server
+ * itself calls invalid or revoked, because an administrator removed the
+ * computer or revoked the key, may be set aside for a new pairing.
+ */
+async function credentialStillAccepted(fetcher, controlPlaneUrl, credential) {
+    const endpoint = new URL("/v1/machine/heartbeat", controlPlaneUrl);
+    let response;
+    try {
+        response = await fetcher(endpoint, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${credential}`,
+                Accept: "application/json",
+            },
+            redirect: "error",
+            signal: AbortSignal.timeout(10_000),
+        });
+    }
+    catch {
+        throw new Error(`Could not reach ${endpoint.origin} to check this computer's earlier pairing. Check your internet connection and try again.`);
+    }
+    if (response.ok) {
+        await response.body?.cancel();
+        return true;
+    }
+    if (response.status === 401 &&
+        (await apiError(response)).code === "invalid_credential") {
+        return false;
+    }
+    throw new Error(`Could not check this computer's earlier pairing (HTTP ${response.status}). Try again.`);
+}
+/** A response with a machine and a machine credential. */
+export function isConnectedMachine(value) {
+    return typeof value === "object" &&
+        value !== null &&
+        "credential" in value &&
+        typeof value.credential === "string" &&
+        value.credential.startsWith("phg_m_") &&
+        "machine" in value &&
+        typeof value.machine === "object" &&
+        value.machine !== null &&
+        "id" in value.machine &&
+        typeof value.machine.id === "string" &&
+        "tenant_id" in value.machine &&
+        typeof value.machine.tenant_id === "string" &&
+        "display_name" in value.machine &&
+        typeof value.machine.display_name === "string" &&
+        "state" in value.machine &&
+        typeof value.machine.state === "string";
 }
-async function pairingFailureMessage(response) {
+/** The `{ error: { code, message } }` body of a failed control-plane call. */
+export async function apiError(response) {
     try {
         const value = await response.json();
         if (typeof value === "object" &&
             value !== null &&
             "error" in value &&
             typeof value.error === "object" &&
-            value.error !== null &&
-            "message" in value.error &&
-            typeof value.error.message === "string") {
-            return value.error.message;
+            value.error !== null) {
+            const error = value.error;
+            return {
+                ...("code" in error && typeof error.code === "string"
+                    ? { code: error.code }
+                    : {}),
+                ...("message" in error && typeof error.message === "string"
+                    ? { message: error.message }
+                    : {}),
+            };
         }
     }
     catch {
         // The status code still provides an actionable, non-sensitive failure.
     }
-    return `Pairing failed with HTTP ${response.status}.`;
+    return {};
 }
-function normalizedOperatingSystem() {
+export function normalizedOperatingSystem() {
     const value = platform();
     if (value === "darwin")
         return "macos";

package/dist/src/pair.js.map

@@ -1 +1 @@
-{"version":3,"file":"pair.js","sourceRoot":"","sources":["../../src/pair.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EACL,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAgCpE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAoB;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,0BAA0B,CACrD,OAAO,CAAC,MAAM,CAAC,aAAa,CAC7B,CAAC;IACF,IACE,OAAO,CAAC,MAAM,CAAC,oBAAoB,KAAK,MAAM;QAC9C,OAAO,CAAC,cAAc,KAAK,MAAM,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,sBAAsB,EACtB,OAAO,CAAC,MAAM,CAAC,eAAe,CAC/B,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe;QAC7C,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,kBAAkB,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,mHAAmH,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI;gBACJ,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAC1E,eAAe,EAAE,cAAc;gBAC/B,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE;gBACvD,QAAQ,EAAE,QAAQ,EAAE;gBACpB,gBAAgB,EAAE,yBAAyB,EAAE;gBAC7C,YAAY,EAAE,IAAI,EAAE;gBACpB,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,OAAO,CAAC,cAAc;oBAC/B,cAAc,EAAE,+BAA+B;iBAChD;aACF,CAAC;YACF,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,CAAC,MAAM,cAAc,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,MAAM,iDAAiD,CACpF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,IAAI,KAAK,CAAC,+HAA+H,CAAC,CAAC;IACnJ,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,eAAe,CAAC,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;QAC5B,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;QAClC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM;QACzD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;QACzC,SAAS,EAAE,QAAQ;QACnB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,oBAAoB,EAAE,+BAA+B;QACrD,WAAW,EAAE,QAAQ;KACtB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;QAC5B,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;QACxC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;QAC3B,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM;QACzD,gBAAgB,EAAE,IAAI;KACvB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC;QACxB,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;QACtC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QACrB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,KAAK,IAAI;QACtB,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,QAAQ;QACpC,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ;QAC3C,CAAC,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,CAAC;QAClC,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,KAAK,QAAQ;QAC9C,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAwB,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,QAAkB;IACrD,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7C,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,OAAO,IAAI,KAAK;YAChB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,KAAK,CAAC,KAAK,KAAK,IAAI;YACpB,SAAS,IAAI,KAAK,CAAC,KAAK;YACxB,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,EACvC,CAAC;YACD,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;IACD,OAAO,4BAA4B,QAAQ,CAAC,MAAM,GAAG,CAAC;AACxD,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACvC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"pair.js","sourceRoot":"","sources":["../../src/pair.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GAGnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AA0DpE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAoB;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IACE,OAAO,CAAC,MAAM,CAAC,oBAAoB,KAAK,MAAM;QAC9C,OAAO,CAAC,cAAc,KAAK,MAAM,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,sBAAsB,EACtB,OAAO,CAAC,MAAM,CAAC,eAAe,CAC/B,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAmB;QACvD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ;QACR,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QAC9F,QAAQ,EAAE,CAAC,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE;YACnF,IAAI;YACJ,eAAe,EAAE,cAAc;YAC/B,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE;YACvD,QAAQ,EAAE,QAAQ,EAAE;YACpB,gBAAgB,EAAE,yBAAyB,EAAE;YAC7C,YAAY,EAAE,IAAI,EAAE;YACpB,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,OAAO,CAAC,cAAc;gBAC/B,cAAc,EAAE,+BAA+B;aAChD;YACD,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;SACzF,CAAC;QACF,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,oBAAoB,EAAE,+BAA+B;YACrD,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,OAAO;SACvB,CAAC;KACH,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,MAAM,CAAC;AAC1B,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA0B;IAE1B,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;IACnD,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC,aAAa,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe;QAC7C,IAAI,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,kBAAkB,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,mHAAmH,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,MAAqB,CAAC;IAC1B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC1B,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACvC,MAAM,OAAO,CAAC,KAAK,CAAC;QACtB,CAAC;aAAM,IACL,MAAM,uBAAuB,CAC3B,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,MAAM,CAAC,eAAe,EAC9B,QAAQ,CAAC,UAAU,CACpB,EACD,CAAC;YACD,sEAAsE;YACtE,MAAM,IAAI,KAAK,CAAC,yHAAyH,CAAC,CAAC;QAC7I,CAAC;IACH,CAAC;IAED,IAAI,IAA8B,CAAC;IACnC,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3D,sEAAsE;YACtE,+DAA+D;YAC/D,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACjD,sEAAsE;YACtE,mEAAmE;YACnE,gEAAgE;YAChE,EAAE;YACF,uEAAuE;YACvE,mEAAmE;YACnE,kEAAkE;YAClE,sBAAsB;YACtB,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC;YAC5D,kBAAkB,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACrD,kBAAkB;gBAClB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAC,CAAC;YACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,mBAAmB,GAAG,SAAS;oBACnC,CAAC,CAAC,MAAM,0BAA0B,CAAC,aAAa,CAAC;oBACjD,CAAC,CAAC,cAAc,CAAC;gBACnB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;gBAC1D,IAAI,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC,KAAK,CAAC;gBAC5C,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YACxB,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,eAAe,CAAC,IAAI,CAAC;YACzB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;YAC5B,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YAClC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM;YACzD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;YACzC,SAAS,EAAE,QAAQ;YACnB,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,EAAE,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;YAC5B,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;YACxC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;YAC3B,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM;YACzD,gBAAgB,EAAE,IAAI;YACtB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAClB,QAAwC,EACxC,MAAwB;IAExB,OAAO,QAAQ,KAAK,IAAI;QACtB,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,CAAC,EAAE;QACxC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,SAAS;QAC9C,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAqB,EACrB,QAAa,EACb,IAAuC;IAEvC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,CAAC,MAAM,cAAc,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,MAAM,iDAAiD,CACpF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO;YACL,KAAK,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,4BAA4B,QAAQ,CAAC,MAAM,GAAG,CAAC;YACnF,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,IAAI,KAAK,CAAC,+HAA+H,CAAC,CAAC;IACnJ,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,OAAsD;IAEtD,OAAO,OAAO,CAAC,IAAI,KAAK,oBAAoB;QAC1C,CAAC,MAAM,KAAK,GAAG;YACb,gDAAgD,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB,CACpC,OAAqB,EACrB,eAAoB,EACpB,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,uBAAuB,EAAE,eAAe,CAAC,CAAC;IACnE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,UAAU,EAAE;gBACrC,MAAM,EAAE,kBAAkB;aAC3B;YACD,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,MAAM,0FAA0F,CAC7H,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,EACxD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CACb,yDAAyD,QAAQ,CAAC,MAAM,eAAe,CACxF,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,KAAK,KAAK,IAAI;QACd,YAAY,IAAI,KAAK;QACrB,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;QACrC,SAAS,IAAI,KAAK;QAClB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,KAAK,IAAI;QACtB,IAAI,IAAI,KAAK,CAAC,OAAO;QACrB,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,QAAQ;QACpC,WAAW,IAAI,KAAK,CAAC,OAAO;QAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ;QAC3C,cAAc,IAAI,KAAK,CAAC,OAAO;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,KAAK,QAAQ;QAC9C,OAAO,IAAI,KAAK,CAAC,OAAO;QACxB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7C,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,OAAO,IAAI,KAAK;YAChB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,KAAK,CAAC,KAAK,KAAK,IAAI,EACpB,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC1B,OAAO;gBACL,GAAG,CAAC,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;oBACnD,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;oBACtB,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,SAAS,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;oBACzD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;oBAC5B,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACvC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/private-directory.d.ts

@@ -1,3 +1,9 @@
+/**
+ * The current account's SID from whoami. A name built from USERDOMAIN and
+ * USERNAME does not resolve for every account: services that run as
+ * LocalSystem or a virtual account see names icacls cannot look up.
+ */
+export declare function currentUserSID(): string | undefined;
 /** Restrict an existing directory to its owner on every platform. */
 export declare function makeDirectoryPrivate(path: string): Promise<void>;
 export declare function makeDirectoryPrivateSync(path: string): void;

package/dist/src/private-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private-directory.d.ts","sourceRoot":"","sources":["../../src/private-directory.ts"],"names":[],"mappings":"AA4BA,qEAAqE;AACrE,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGtE;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG3D"}
+{"version":3,"file":"private-directory.d.ts","sourceRoot":"","sources":["../../src/private-directory.ts"],"names":[],"mappings":"AAaA;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,GAAG,SAAS,CAkBnD;AAuBD,qEAAqE;AACrE,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGtE;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG3D"}

package/dist/src/private-directory.js

@@ -1,16 +1,47 @@
 import { execFileSync } from "node:child_process";
 import { chmodSync } from "node:fs";
 import { chmod } from "node:fs/promises";
-import { resolve } from "node:path";
+import { join, resolve } from "node:path";
 // chmod only changes the read-only flag on Windows, so the credential store and
 // event spool would otherwise rely on the profile folder's default ACL. Owner
 // and SYSTEM keep access; files created inside inherit the restriction.
 const restricted = new Set();
+// The account this process runs as, by security identifier: null when
+// Windows would not say.
+let processUserSID;
+/**
+ * The current account's SID from whoami. A name built from USERDOMAIN and
+ * USERNAME does not resolve for every account: services that run as
+ * LocalSystem or a virtual account see names icacls cannot look up.
+ */
+export function currentUserSID() {
+    if (processUserSID === undefined) {
+        processUserSID = null;
+        try {
+            // By full path: Git for Windows puts another whoami on PATH.
+            const whoami = join(process.env["SystemRoot"] ?? "C:\\Windows", "System32", "whoami.exe");
+            const output = execFileSync(whoami, ["/user", "/fo", "csv", "/nh"], {
+                encoding: "utf8",
+                windowsHide: true,
+                stdio: ["ignore", "pipe", "ignore"],
+                timeout: 15_000,
+            });
+            processUserSID = /"(S-1-[0-9]+(?:-[0-9]+){1,15})"\s*$/u.exec(output.trim())?.[1] ?? null;
+        }
+        catch {
+            // Fall back to the account name below.
+        }
+    }
+    return processUserSID ?? undefined;
+}
 function restrictWindowsDirectory(path) {
     const key = resolve(path).toLowerCase();
     if (restricted.has(key))
         return;
-    const owner = `${process.env["USERDOMAIN"] ?? ""}\\${process.env["USERNAME"] ?? ""}`;
+    const sid = currentUserSID();
+    const owner = sid === undefined
+        ? `${process.env["USERDOMAIN"] ?? ""}\\${process.env["USERNAME"] ?? ""}`
+        : `*${sid}`;
     try {
         execFileSync("icacls", [resolve(path), "/inheritance:r", "/grant:r", `${owner}:(OI)(CI)F`, "/grant:r", "*S-1-5-18:(OI)(CI)F"], { windowsHide: true, stdio: "ignore", timeout: 15_000 });
     }

package/dist/src/private-directory.js.map

@@ -1 +1 @@
-{"version":3,"file":"private-directory.js","sourceRoot":"","sources":["../../src/private-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,gFAAgF;AAChF,8EAA8E;AAC9E,wEAAwE;AACxE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;AAErC,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAChC,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,IAAI,CAAC;QACH,YAAY,CACV,QAAQ,EACR,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,KAAK,YAAY,EAAE,UAAU,EAAE,qBAAqB,CAAC,EACtG,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CACxD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,IAAI,KAAK,CAAC,0HAA0H,CAAC,CAAC;IAC9I,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC"}
+{"version":3,"file":"private-directory.js","sourceRoot":"","sources":["../../src/private-directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,gFAAgF;AAChF,8EAA8E;AAC9E,wEAAwE;AACxE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;AACrC,sEAAsE;AACtE,yBAAyB;AACzB,IAAI,cAAyC,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,cAAc,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,6DAA6D;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,aAAa,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YAC1F,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE;gBAClE,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,IAAI;gBACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,cAAc,GAAG,sCAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC3F,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,cAAc,IAAI,SAAS,CAAC;AACrC,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAChC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,GAAG,KAAK,SAAS;QAC7B,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE;QACxE,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,YAAY,CACV,QAAQ,EACR,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,KAAK,YAAY,EAAE,UAAU,EAAE,qBAAqB,CAAC,EACtG,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CACxD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,IAAI,KAAK,CAAC,0HAA0H,CAAC,CAAC;IAC9I,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC"}

package/dist/src/proxy.d.ts

@@ -0,0 +1,68 @@
+import type { Socket } from "node:net";
+/**
+ * Corporate proxies. The observer's HTTPS calls (pairing, removal, update
+ * checks, Guardian and the doctor probe) use `fetch`, which ignores
+ * HTTPS_PROXY unless Node.js is told to read it, and the telemetry stream
+ * uses @grpc/grpc-js, which reads only the lowercase names. This module
+ * points both at the same proxy, using what Node.js offers natively.
+ *
+ * HTTPS goes through the proxy as a CONNECT tunnel, and TLS is negotiated
+ * with the server itself inside it, so the usual certificate checks,
+ * including an authority pinned for a company's own server, still apply.
+ */
+export type ProxySettings = Readonly<{
+    https?: URL;
+    http?: URL;
+    /** NO_PROXY as written: comma- or space-separated host names. */
+    noProxy: string;
+}>;
+/** Reads HTTPS_PROXY, HTTP_PROXY and NO_PROXY (either case) from `environment`. */
+export declare function proxySettings(environment: NodeJS.ProcessEnv): ProxySettings;
+/**
+ * The proxy `target` goes through, or undefined to connect directly. It
+ * follows Node.js: an entry matches its host and every host under it
+ * (`example.com`, `.example.com` and `*.example.com` all cover
+ * `a.example.com`), `*` matches everything, and `host:port` only that port.
+ */
+export declare function proxyForUrl(target: URL, settings: ProxySettings): URL | undefined;
+/**
+ * NO_PROXY in the form @grpc/grpc-js reads, which matches plain host name
+ * endings only: `*.example.com` and `.example.com` become `example.com`, and
+ * an entry for another port is left out because the stream cannot check
+ * ports.
+ */
+export declare function grpcNoProxy(noProxy: string, streamPort: number): string;
+/** Whether NO_PROXY turns the proxy off for every host, which grpc-js cannot express. */
+export declare function noProxyForAll(environment: NodeJS.ProcessEnv): boolean;
+type SetGlobalProxy = (environment: NodeJS.ProcessEnv) => () => void;
+export type ProxySetup = Readonly<{
+    /** Puts back the global agents and the variables changed for the stream. */
+    restore: () => void;
+    /** A plain sentence to show when part of the setup could not be applied. */
+    notice?: string;
+}>;
+export type ProxySetupOptions = Readonly<{
+    /** `http.setGlobalProxyFromEnv`, Node.js 24.14 and newer. */
+    setGlobalProxyFromEnv?: SetGlobalProxy | undefined;
+    /** The environment @grpc/grpc-js reads: process.env. */
+    processEnvironment?: NodeJS.ProcessEnv;
+    /** Whether Node.js already applied the proxy variables when it started. */
+    startedWithEnvProxy?: boolean;
+    nodeVersion?: string;
+    /** The telemetry endpoint, to keep NO_PROXY port entries for it. */
+    streamUrl?: URL;
+}>;
+/**
+ * Sends `fetch` (and `http`/`https` requests) through the proxy that
+ * `environment` names, and gives the telemetry stream the same proxy and
+ * NO_PROXY list. Does nothing when no proxy is set.
+ */
+export declare function useProxyFromEnvironment(environment: NodeJS.ProcessEnv, options?: ProxySetupOptions): ProxySetup;
+/**
+ * Opens a CONNECT tunnel through `proxy` to `host:port`, for a raw TLS
+ * connection that `fetch` does not cover. Messages name the proxy by host
+ * only, never with its credentials.
+ */
+export declare function connectThroughProxy(proxy: URL, host: string, port: number, timeoutMs?: number): Promise<Socket>;
+export {};
+//# sourceMappingURL=proxy.d.ts.map

package/dist/src/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/proxy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;IACnC,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAuCH,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,aAAa,CAQ3E;AAaD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,GAAG,GAAG,GAAG,SAAS,CAYjF;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAKvE;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAGrE;AAED,KAAK,cAAc,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,IAAI,CAAC;AAErE,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;IAChC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,6DAA6D;IAC7D,qBAAqB,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACnD,wDAAwD;IACxD,kBAAkB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACvC,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,SAAS,CAAC,EAAE,GAAG,CAAC;CACjB,CAAC,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,OAAO,GAAE,iBAAsB,GAC9B,UAAU,CA0DZ;AAOD;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,GAAG,EACV,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,CAAC,CAoCjB"}