@traffic-twin/sdk 0.0.0-stage → 0.1.0

package/dist/cjs/fleet/client.js

@@ -0,0 +1,216 @@
+"use strict";
+// Fleet API client (api/fleet-api.v1.openapi.yaml): enrollment with a `tte_` token and CA
+// pin, then mTLS calls for heartbeat, policy and certificate renewal.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FleetClient = exports.FleetError = exports.TOKEN_RE = void 0;
+exports.tokenPin = tokenPin;
+exports.fetchPinnedRoot = fetchPinnedRoot;
+exports.enroll = enroll;
+exports.mtlsAgent = mtlsAgent;
+const node_https_1 = __importDefault(require("node:https"));
+const node_tls_1 = __importDefault(require("node:tls"));
+const node_crypto_1 = require("node:crypto");
+const asn1_js_1 = require("./asn1.js");
+const http_js_1 = require("./http.js");
+const common_js_1 = require("../capture/common.js");
+exports.TOKEN_RE = /^tte_[A-Za-z0-9_-]{32,128}\.([A-Za-z0-9_-]{43})$/;
+class FleetError extends Error {
+    code;
+    status;
+    constructor(code, status) {
+        super(code);
+        this.code = code;
+        this.status = status;
+        this.name = 'FleetError';
+    }
+}
+exports.FleetError = FleetError;
+/** Extracts the CA pin from an enrollment token. */
+function tokenPin(token) {
+    const m = exports.TOKEN_RE.exec(token);
+    return m ? m[1] : null;
+}
+/**
+ * Opens a TLS connection without trusting anything, walks the chain the server presents
+ * to its top (the root, which tt-core must include) and checks it against the pin.
+ * Returns the root as PEM, to be used as the only trust anchor for the real request.
+ */
+function fetchPinnedRoot(url, pin, timeoutMs = 10_000) {
+    return new Promise((resolve, reject) => {
+        const host = url.hostname.replace(/^\[|\]$/g, '');
+        const sock = node_tls_1.default.connect({
+            host,
+            port: Number(url.port || 443),
+            servername: /^[0-9.]+$|:/.test(host) ? undefined : host,
+            rejectUnauthorized: false,
+        });
+        const fail = (code) => {
+            sock.destroy();
+            reject(new FleetError(code));
+        };
+        sock.setTimeout(timeoutMs, () => fail('enroll_tls_timeout'));
+        sock.once('error', () => fail('enroll_tls_error'));
+        sock.once('secureConnect', () => {
+            try {
+                let c = sock.getPeerCertificate(true);
+                if (!c || !c.raw)
+                    return fail('enroll_no_peer_cert');
+                for (let i = 0; i < 16; i++) {
+                    const up = c.issuerCertificate;
+                    if (!up || up === c || up.fingerprint256 === c.fingerprint256 || !up.raw)
+                        break;
+                    c = up;
+                }
+                const root = new node_crypto_1.X509Certificate(c.raw);
+                if (!root.ca || root.issuer !== root.subject)
+                    return fail('enroll_root_missing');
+                if ((0, asn1_js_1.pinOf)(c.raw) !== pin)
+                    return fail('enroll_pin_mismatch');
+                sock.end();
+                resolve((0, asn1_js_1.pem)('CERTIFICATE', c.raw));
+            }
+            catch {
+                fail('enroll_pin_check');
+            }
+        });
+    });
+}
+function isHttpsUrl(v) {
+    try {
+        return typeof v === 'string' && new URL(v).protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+/** Enrolls with a token. Returns the enrollment and the private key PEM (generated locally when useCsr). */
+async function enroll(o) {
+    const pin = tokenPin(o.token);
+    if (!pin)
+        throw new FleetError('enroll_token_malformed');
+    const base = new URL(o.enrollUrl);
+    if (base.protocol !== 'https:')
+        throw new FleetError('enroll_url_not_https');
+    const rootPem = await fetchPinnedRoot(base, pin, o.timeoutMs);
+    const agent = new node_https_1.default.Agent({ ca: rootPem, keepAlive: false });
+    common_js_1.internalAgents.add(agent);
+    let keyPem = '';
+    const body = { token: o.token, source: o.source };
+    if (o.useCsr) {
+        const g = (0, asn1_js_1.generateCsr)(o.source.service_name);
+        keyPem = g.keyPem;
+        body.csr = g.csrPem;
+    }
+    const url = new URL('/fleet/v1/enroll', base).toString();
+    let res;
+    try {
+        res = await (0, http_js_1.request)({ method: 'POST', url, agent, headers: { 'content-type': 'application/json' }, body: JSON.stringify(body), timeoutMs: o.timeoutMs });
+    }
+    catch {
+        throw new FleetError('enroll_network');
+    }
+    finally {
+        agent.destroy();
+    }
+    if (res.status !== 201 && res.status !== 200)
+        throw new FleetError('enroll_http_' + res.status, res.status);
+    const j = (0, http_js_1.parseJsonBody)(res);
+    if (!j || typeof j !== 'object')
+        throw new FleetError('enroll_bad_response');
+    if (!o.useCsr) {
+        if (typeof j.client_key !== 'string')
+            throw new FleetError('enroll_no_key');
+        keyPem = j.client_key;
+    }
+    const keys = Array.isArray(j.policy_signing_keys) ? j.policy_signing_keys : [];
+    const enrollment = {
+        source_id: String(j.source_id ?? ''),
+        group: String(j.group ?? ''),
+        service_name: String(j.service_name ?? ''),
+        client_cert: String(j.client_cert ?? ''),
+        ca_chain: String(j.ca_chain ?? ''),
+        not_after: typeof j.not_after === 'string' ? j.not_after : undefined,
+        policy_signing_keys: keys
+            .filter((k) => typeof k?.kid === 'string' && /^[A-Za-z0-9._-]{1,64}$/.test(k.kid) && k.alg === 'Ed25519' &&
+            typeof k.public_key === 'string' && /^[A-Za-z0-9_-]{43}$/.test(k.public_key))
+            .map((k) => ({ kid: k.kid, alg: 'Ed25519', public_key: k.public_key })),
+        intake_url: String(j.intake_url ?? ''),
+        fleet_url: String(j.fleet_url ?? ''),
+        policy_max_age_s: typeof j.policy_max_age_s === 'number' ? j.policy_max_age_s : 86400,
+        heartbeat_interval_s: typeof j.heartbeat_interval_s === 'number' ? j.heartbeat_interval_s : 30,
+        policy_poll_interval_s: typeof j.policy_poll_interval_s === 'number' ? j.policy_poll_interval_s : 60,
+        enroll_url: o.enrollUrl,
+        pin,
+    };
+    if (!/^src-[0-9A-Za-z]{1,32}$/.test(enrollment.source_id))
+        throw new FleetError('enroll_bad_source_id');
+    if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(enrollment.group))
+        throw new FleetError('enroll_bad_group');
+    if (!/^[a-z0-9][a-z0-9._-]{0,62}$/.test(enrollment.service_name))
+        throw new FleetError('enroll_bad_service_name');
+    if ((0, asn1_js_1.pemBlocks)(enrollment.client_cert, 'CERTIFICATE').length === 0)
+        throw new FleetError('enroll_bad_cert');
+    if (!(0, asn1_js_1.pemBlocks)(enrollment.ca_chain, 'CERTIFICATE').some((d) => (0, asn1_js_1.pinOf)(d) === pin))
+        throw new FleetError('enroll_chain_without_pinned_root');
+    if (enrollment.policy_signing_keys.length === 0)
+        throw new FleetError('enroll_no_signing_keys');
+    if (!isHttpsUrl(enrollment.intake_url) || !isHttpsUrl(enrollment.fleet_url))
+        throw new FleetError('enroll_bad_urls');
+    return { enrollment, keyPem };
+}
+/** mTLS agent for the intake and Fleet calls. Trust anchors: the CA chain received over the pinned channel. */
+function mtlsAgent(e, keyPem) {
+    const a = new node_https_1.default.Agent({ cert: e.client_cert, key: keyPem, ca: e.ca_chain, keepAlive: true, maxSockets: 2 });
+    common_js_1.internalAgents.add(a);
+    return a;
+}
+class FleetClient {
+    e;
+    agent;
+    constructor(e, agent) {
+        this.e = e;
+        this.agent = agent;
+    }
+    setAgent(agent) {
+        this.agent = agent;
+    }
+    url(path) {
+        return new URL(path, this.e.fleet_url).toString();
+    }
+    async heartbeat(body) {
+        const r = await (0, http_js_1.request)({ method: 'POST', url: this.url('/fleet/v1/heartbeat'), agent: this.agent, headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
+        return { status: r.status, json: r.status === 200 ? (0, http_js_1.parseJsonBody)(r) : undefined };
+    }
+    async getPolicy(etag) {
+        const headers = {};
+        if (etag)
+            headers['if-none-match'] = etag;
+        const r = await (0, http_js_1.request)({ method: 'GET', url: this.url('/fleet/v1/policy'), agent: this.agent, headers, maxResponseBytes: 8 << 20 });
+        const et = r.headers.etag;
+        return { status: r.status, body: r.status === 200 ? r.body : undefined, etag: typeof et === 'string' ? et : undefined };
+    }
+    async renew(useCsr, commonName) {
+        let keyPem;
+        const body = {};
+        if (useCsr) {
+            const g = (0, asn1_js_1.generateCsr)(commonName);
+            keyPem = g.keyPem;
+            body.csr = g.csrPem;
+        }
+        const r = await (0, http_js_1.request)({ method: 'POST', url: this.url('/fleet/v1/renew'), agent: this.agent, headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
+        if (r.status !== 200)
+            return null;
+        const j = (0, http_js_1.parseJsonBody)(r);
+        if (!j || typeof j.client_cert !== 'string')
+            return null;
+        if (!useCsr)
+            keyPem = typeof j.client_key === 'string' ? j.client_key : undefined;
+        if (!keyPem)
+            return null;
+        return { cert: j.client_cert, keyPem, notAfter: typeof j.not_after === 'string' ? j.not_after : undefined };
+    }
+}
+exports.FleetClient = FleetClient;

package/dist/cjs/fleet/http.d.ts

@@ -0,0 +1,17 @@
+import https from 'node:https';
+export interface HttpResult {
+    status: number;
+    headers: Record<string, string | string[] | undefined>;
+    body: Buffer;
+}
+export interface HttpOptions {
+    method: 'GET' | 'POST';
+    url: string;
+    agent: https.Agent;
+    headers?: Record<string, string>;
+    body?: string | Buffer;
+    timeoutMs?: number;
+    maxResponseBytes?: number;
+}
+export declare function request(o: HttpOptions): Promise<HttpResult>;
+export declare function parseJsonBody(r: HttpResult): unknown;

package/dist/cjs/fleet/http.js

@@ -0,0 +1,80 @@
+"use strict";
+// Minimal HTTPS client used by the exporter and the Fleet client. Requests made here are
+// marked internal so the capture hooks never see them.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.request = request;
+exports.parseJsonBody = parseJsonBody;
+const node_https_1 = __importDefault(require("node:https"));
+const common_js_1 = require("../capture/common.js");
+function request(o) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const done = (err, res) => {
+            if (settled)
+                return;
+            settled = true;
+            if (err)
+                reject(err);
+            else
+                resolve(res);
+        };
+        const u = new URL(o.url);
+        if (u.protocol !== 'https:') {
+            done(new Error('https_required'));
+            return;
+        }
+        const body = o.body === undefined ? undefined : Buffer.isBuffer(o.body) ? o.body : Buffer.from(o.body, 'utf8');
+        const headers = { ...(o.headers ?? {}) };
+        if (body)
+            headers['content-length'] = String(body.length);
+        const max = o.maxResponseBytes ?? 1 << 20;
+        const req = (0, common_js_1.runInternal)(() => node_https_1.default.request({
+            method: o.method,
+            hostname: u.hostname.replace(/^\[|\]$/g, ''),
+            port: u.port || 443,
+            path: u.pathname + u.search,
+            agent: o.agent,
+            headers,
+            servername: /^[0-9.]+$|:/.test(u.hostname) ? undefined : u.hostname,
+        }, (res) => {
+            const chunks = [];
+            let n = 0;
+            const tooBig = () => {
+                // Over the cap: hang up now instead of reading what the peer decides to send.
+                const e = Object.assign(new Error('response_too_large'), { code: 'RESPONSE_TOO_LARGE' });
+                done(e);
+                req.destroy(e);
+            };
+            const declared = Number(res.headers['content-length']);
+            if (Number.isFinite(declared) && declared > max) {
+                tooBig();
+                return;
+            }
+            res.on('data', (c) => {
+                n += c.length;
+                if (n > max) {
+                    chunks.length = 0;
+                    tooBig();
+                    return;
+                }
+                chunks.push(c);
+            });
+            res.on('end', () => done(null, { status: res.statusCode ?? 0, headers: res.headers, body: Buffer.concat(chunks) }));
+            res.on('error', (e) => done(e));
+        }));
+        req.setTimeout(o.timeoutMs ?? 10_000, () => req.destroy(Object.assign(new Error('timeout'), { code: 'ETIMEDOUT' })));
+        req.on('error', (e) => done(e));
+        req.end(body);
+    });
+}
+function parseJsonBody(r) {
+    try {
+        return JSON.parse(r.body.toString('utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/cjs/fleet/store.d.ts

@@ -0,0 +1,18 @@
+export declare function defaultStateDir(enrollUrl: string, serviceName: string): string;
+export declare class StateStore {
+    readonly dir: string;
+    /** Called with the file name when a state file or the directory is not trusted (reported, never the content). */
+    onUntrusted: ((what: string) => void) | undefined;
+    constructor(dir: string);
+    /**
+     * The directory must be ours. If it is ours but open to others (a pre-existing 0755
+     * directory) it is tightened to 0700; anything else is refused. Files are checked one by one.
+     */
+    private dirTrusted;
+    private ensure;
+    readText(name: string): string | null;
+    readJson<T>(name: string): T | null;
+    writeText(name: string, text: string): void;
+    writeJson(name: string, v: unknown): void;
+    remove(name: string): void;
+}

package/dist/cjs/fleet/store.js

@@ -0,0 +1,115 @@
+"use strict";
+// Local state of the source: enrollment (certificate, CA chain, pinned keys), private key,
+// signed policy cache, kill switch. Directory 0700, files 0600, atomic replace.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StateStore = void 0;
+exports.defaultStateDir = defaultStateDir;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_crypto_1 = require("node:crypto");
+function defaultStateDir(enrollUrl, serviceName) {
+    const id = (0, node_crypto_1.createHash)('sha256').update(enrollUrl + '\0' + serviceName).digest('hex').slice(0, 16);
+    return (0, node_path_1.join)((0, node_os_1.homedir)(), '.traffic-twin', id);
+}
+function statExists(p) {
+    try {
+        (0, node_fs_1.statSync)(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const POSIX = process.platform !== 'win32';
+const myUid = typeof process.getuid === 'function' ? process.getuid() : -1;
+class StateStore {
+    dir;
+    /** Called with the file name when a state file or the directory is not trusted (reported, never the content). */
+    onUntrusted;
+    constructor(dir) {
+        this.dir = dir;
+    }
+    /**
+     * The directory must be ours. If it is ours but open to others (a pre-existing 0755
+     * directory) it is tightened to 0700; anything else is refused. Files are checked one by one.
+     */
+    dirTrusted() {
+        if (!POSIX)
+            return true;
+        try {
+            const st = (0, node_fs_1.statSync)(this.dir);
+            if (!st.isDirectory())
+                return false;
+            if (myUid >= 0 && st.uid !== myUid)
+                return false;
+            if ((st.mode & 0o077) !== 0) {
+                (0, node_fs_1.chmodSync)(this.dir, 0o700);
+                if (((0, node_fs_1.statSync)(this.dir).mode & 0o077) !== 0)
+                    return false;
+            }
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    ensure() {
+        (0, node_fs_1.mkdirSync)(this.dir, { recursive: true, mode: 0o700 });
+        if (!this.dirTrusted()) {
+            this.onUntrusted?.('dir');
+            throw new Error('state_dir_untrusted');
+        }
+    }
+    readText(name) {
+        let fd = -1;
+        try {
+            if (!this.dirTrusted()) {
+                if (statExists(this.dir))
+                    this.onUntrusted?.('dir');
+                return null;
+            }
+            // O_NOFOLLOW: a symlink planted in place of a state file is not followed; the checks
+            // run on the opened descriptor, so they apply to the bytes that are then read.
+            fd = (0, node_fs_1.openSync)((0, node_path_1.join)(this.dir, name), node_fs_1.constants.O_RDONLY | (POSIX ? node_fs_1.constants.O_NOFOLLOW : 0));
+            const st = (0, node_fs_1.fstatSync)(fd);
+            if (POSIX && (!st.isFile() || (myUid >= 0 && st.uid !== myUid) || (st.mode & 0o077) !== 0)) {
+                this.onUntrusted?.(name);
+                return null;
+            }
+            return (0, node_fs_1.readFileSync)(fd, 'utf8');
+        }
+        catch {
+            return null;
+        }
+        finally {
+            if (fd >= 0)
+                (0, node_fs_1.closeSync)(fd);
+        }
+    }
+    readJson(name) {
+        const t = this.readText(name);
+        if (t === null)
+            return null;
+        try {
+            return JSON.parse(t);
+        }
+        catch {
+            return null;
+        }
+    }
+    writeText(name, text) {
+        this.ensure();
+        const tmp = (0, node_path_1.join)(this.dir, '.' + name + '.' + process.pid + '.tmp');
+        (0, node_fs_1.writeFileSync)(tmp, text, { mode: 0o600 });
+        (0, node_fs_1.chmodSync)(tmp, 0o600);
+        (0, node_fs_1.renameSync)(tmp, (0, node_path_1.join)(this.dir, name));
+    }
+    writeJson(name, v) {
+        this.writeText(name, JSON.stringify(v));
+    }
+    remove(name) {
+        (0, node_fs_1.rmSync)((0, node_path_1.join)(this.dir, name), { force: true });
+    }
+}
+exports.StateStore = StateStore;

package/dist/cjs/index.d.ts

@@ -0,0 +1,14 @@
+import { Agent, optionsFromEnv, type AgentOptions, type SourceState } from './agent.js';
+export type { AgentOptions, SourceState };
+export { Agent, optionsFromEnv };
+export { SDK_VERSION } from './version.js';
+export { Sanitizer, type Exchange, type Result, type Decision } from './sanitizer/sanitizer.js';
+export { Policy, Refused, parseKeyRing, selectKey, verifyEnvelope, validateBodySchema } from './sanitizer/policy.js';
+export { runVector, parseVector, vectorExchange, type VectorResult } from './sanitizer/vectors.js';
+export { parseJson, writeCanonical, canonicalNumber } from './sanitizer/json.js';
+/** Starts the agent once per process (later calls return the same one). Never throws. */
+export declare function start(options?: AgentOptions): Promise<Agent>;
+/** The running agent, if any. */
+export declare function current(): Agent | undefined;
+/** Stops capture and timers; the process keeps working untouched. */
+export declare function stop(): Promise<void>;

package/dist/cjs/index.js

@@ -0,0 +1,69 @@
+"use strict";
+// Public API of @traffic-twin/sdk.
+//
+//   import { start } from '@traffic-twin/sdk';
+//   await start({ enrollUrl, enrollToken, serviceName, hmacKeyFile });
+//
+// or zero-config: node --import @traffic-twin/sdk/register app.js
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalNumber = exports.writeCanonical = exports.parseJson = exports.vectorExchange = exports.parseVector = exports.runVector = exports.validateBodySchema = exports.verifyEnvelope = exports.selectKey = exports.parseKeyRing = exports.Refused = exports.Policy = exports.Sanitizer = exports.SDK_VERSION = exports.optionsFromEnv = exports.Agent = void 0;
+exports.start = start;
+exports.current = current;
+exports.stop = stop;
+const agent_js_1 = require("./agent.js");
+Object.defineProperty(exports, "Agent", { enumerable: true, get: function () { return agent_js_1.Agent; } });
+Object.defineProperty(exports, "optionsFromEnv", { enumerable: true, get: function () { return agent_js_1.optionsFromEnv; } });
+var version_js_1 = require("./version.js");
+Object.defineProperty(exports, "SDK_VERSION", { enumerable: true, get: function () { return version_js_1.SDK_VERSION; } });
+// Sanitizer and conformance test function (sanitizer.md 16).
+var sanitizer_js_1 = require("./sanitizer/sanitizer.js");
+Object.defineProperty(exports, "Sanitizer", { enumerable: true, get: function () { return sanitizer_js_1.Sanitizer; } });
+var policy_js_1 = require("./sanitizer/policy.js");
+Object.defineProperty(exports, "Policy", { enumerable: true, get: function () { return policy_js_1.Policy; } });
+Object.defineProperty(exports, "Refused", { enumerable: true, get: function () { return policy_js_1.Refused; } });
+Object.defineProperty(exports, "parseKeyRing", { enumerable: true, get: function () { return policy_js_1.parseKeyRing; } });
+Object.defineProperty(exports, "selectKey", { enumerable: true, get: function () { return policy_js_1.selectKey; } });
+Object.defineProperty(exports, "verifyEnvelope", { enumerable: true, get: function () { return policy_js_1.verifyEnvelope; } });
+Object.defineProperty(exports, "validateBodySchema", { enumerable: true, get: function () { return policy_js_1.validateBodySchema; } });
+var vectors_js_1 = require("./sanitizer/vectors.js");
+Object.defineProperty(exports, "runVector", { enumerable: true, get: function () { return vectors_js_1.runVector; } });
+Object.defineProperty(exports, "parseVector", { enumerable: true, get: function () { return vectors_js_1.parseVector; } });
+Object.defineProperty(exports, "vectorExchange", { enumerable: true, get: function () { return vectors_js_1.vectorExchange; } });
+var json_js_1 = require("./sanitizer/json.js");
+Object.defineProperty(exports, "parseJson", { enumerable: true, get: function () { return json_js_1.parseJson; } });
+Object.defineProperty(exports, "writeCanonical", { enumerable: true, get: function () { return json_js_1.writeCanonical; } });
+Object.defineProperty(exports, "canonicalNumber", { enumerable: true, get: function () { return json_js_1.canonicalNumber; } });
+// One agent per process, shared by the ESM and CommonJS builds.
+const KEY = Symbol.for('traffic-twin.sdk.agent');
+/** Starts the agent once per process (later calls return the same one). Never throws. */
+function start(options = {}) {
+    const g = globalThis;
+    const existing = g[KEY];
+    if (existing)
+        return existing.ready.then(() => existing.agent);
+    const merged = { ...(0, agent_js_1.optionsFromEnv)(), ...stripUndefined(options) };
+    const agent = new agent_js_1.Agent(merged);
+    const ready = agent.start();
+    g[KEY] = { agent, ready };
+    return ready.then(() => agent);
+}
+/** The running agent, if any. */
+function current() {
+    return globalThis[KEY]?.agent;
+}
+/** Stops capture and timers; the process keeps working untouched. */
+async function stop() {
+    const g = globalThis;
+    const e = g[KEY];
+    if (!e)
+        return;
+    delete g[KEY];
+    await e.agent.stop();
+}
+function stripUndefined(o) {
+    const out = {};
+    for (const k of Object.keys(o))
+        if (o[k] !== undefined)
+            out[k] = o[k];
+    return out;
+}

package/dist/cjs/log.d.ts

@@ -0,0 +1,4 @@
+export declare function setDebug(on: boolean): void;
+export declare function debug(code: string, detail?: string | number): void;
+/** A line that is always written (configuration problems that stop the capture). Codes and fixed text only. */
+export declare function warn(text: string): void;

package/dist/cjs/log.js

@@ -0,0 +1,30 @@
+"use strict";
+// Diagnostic log. Only error codes and counts are ever written, never payload values
+// (threat model M14). Off unless TT_DEBUG is set.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setDebug = setDebug;
+exports.debug = debug;
+exports.warn = warn;
+let enabled = /^(1|true|yes|debug)$/i.test(process.env.TT_DEBUG ?? '');
+function setDebug(on) {
+    enabled = on;
+}
+function debug(code, detail) {
+    if (!enabled)
+        return;
+    try {
+        process.stderr.write('[traffic-twin] ' + code + (detail !== undefined ? ' ' + String(detail) : '') + '\n');
+    }
+    catch {
+        // ignore
+    }
+}
+/** A line that is always written (configuration problems that stop the capture). Codes and fixed text only. */
+function warn(text) {
+    try {
+        process.stderr.write('[traffic-twin] ' + text + '\n');
+    }
+    catch {
+        // ignore
+    }
+}

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/dist/cjs/register.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cjs/register.js

@@ -0,0 +1,18 @@
+"use strict";
+// Zero-config entry point:
+//
+//   TT_ENROLL_URL=https://tt-core.internal:4318 TT_ENROLL_TOKEN=tte_... TT_HMAC_KEY_FILE=/run/tt/key \
+//     node --import @traffic-twin/sdk/register app.js
+//
+// (or `node --require @traffic-twin/sdk/register app.js` for CommonJS apps).
+// Hooks are installed synchronously before the app loads; enrollment, heartbeat and policy
+// fetch run in the background and never delay or break the app. TT_DISABLED=1 turns it off.
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_worker_threads_1 = require("node:worker_threads");
+const index_js_1 = require("./index.js");
+const ownWorker = !node_worker_threads_1.isMainThread && node_worker_threads_1.workerData?.ttSanitizer === true;
+if (!ownWorker && !/^(1|true|yes)$/i.test(process.env.TT_DISABLED ?? '')) {
+    (0, index_js_1.start)().catch(() => {
+        // never surface SDK failures to the app
+    });
+}

package/dist/cjs/sanitizer/bodies.d.ts

@@ -0,0 +1,55 @@
+/** 22.4: document class on the decoded length. */
+export declare function docClass(n: number): string;
+/** 22.4 point 3: kind of a document from its bytes, or null. */
+export declare function magicKind(b: Buffer): string | null;
+/** 22.4: 'drop:doc:<kind>:<class>' if the string is the base64 of a document, else null. */
+export declare function base64Doc(str: string): string | null;
+/**
+ * Parameters of a normalized content-type value: lowercase name -> value, first occurrence
+ * wins. Split on ';', each piece trimmed and split on the first '='; a value starting with '"'
+ * must end with '"' (length >= 2) and loses both quotes, no escapes. Not UTF-8: no parameters.
+ */
+export declare function mediaParams(value: Buffer | null | undefined): Map<string, string>;
+export declare class InvalidMultipart extends Error {
+}
+export interface MultipartPart {
+    name: string;
+    isFile: boolean;
+    content: Buffer;
+    ct: string | null;
+}
+/** 22.3 points 1-5: the parts of a multipart body. Throws InvalidMultipart. */
+export declare function parseMultipart(data: Buffer, boundary: string | undefined): MultipartPart[];
+/** 22.3: drop:file:<kind>:<class> of a file part. */
+export declare function fileToken(content: Buffer, ct: string | null): string;
+export declare const NS_XML = "http://www.w3.org/XML/1998/namespace";
+export declare const SOAP11 = "http://schemas.xmlsoap.org/soap/envelope/";
+export declare const SOAP12 = "http://www.w3.org/2003/05/soap-envelope";
+export declare const XML_MAX_NESTING = 256;
+export declare class InvalidXml extends Error {
+}
+export interface XmlElem {
+    local: string;
+    ns: string;
+    /** (local name, value) without namespace declarations. */
+    attrs: Array<[string, string]>;
+    children: XmlElem[];
+    text: string[];
+}
+/** 22.2 points 1-6 -> root element. Throws InvalidXml for anything outside the accepted subset. */
+export declare function parseXml(input: Buffer): XmlElem;
+/** Tree value of an element (22.2 point 7): a string, or an object as ordered members. */
+export type XmlValue = string | XmlObj | XmlValue[];
+export interface XmlObj {
+    members: Array<[string, XmlValue]>;
+}
+export declare function xmlValue(el: XmlElem): XmlValue;
+/** 22.2 point 9: 'ns:' + pattern of a namespace URI. */
+export declare function nsPattern(uri: string): string;
+/** 22.2 points 9-10: xmlns entries [(path, token)] in document order (no limit) and fmt. */
+export declare function xmlNamespaces(root: XmlElem, literal: (k: string) => boolean, maxDepth: number): {
+    entries: Array<[string, string]>;
+    fmt: string;
+};
+/** 22.2 point 11: the operation name of a SOAPAction value, or null when empty. */
+export declare function soapActionName(raw: string, literal: (k: string) => boolean): string | null;