@trillboards/edge-sdk 0.2.20 → 0.2.24

package/dist/enterpriseTrust.js

@@ -0,0 +1,615 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRUST_CACHE_TTL_MS = void 0;
+exports.extractPemBlocks = extractPemBlocks;
+exports.readWindowsTrustAnchors = readWindowsTrustAnchors;
+exports.parseDeniedTrustSubjects = parseDeniedTrustSubjects;
+exports.readMacTrustAnchors = readMacTrustAnchors;
+exports.readLinuxTrustAnchors = readLinuxTrustAnchors;
+exports.readNodeExtraCaCerts = readNodeExtraCaCerts;
+exports.readPlatformTrustAnchors = readPlatformTrustAnchors;
+exports.resolveTrustAnchors = resolveTrustAnchors;
+exports.invalidateTrustAnchorCache = invalidateTrustAnchorCache;
+exports.peekTrustAnchorCache = peekTrustAnchorCache;
+exports.buildCaBundle = buildCaBundle;
+exports.describeTrustAnchors = describeTrustAnchors;
+exports.trustStoreInstallHint = trustStoreInstallHint;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const tls = __importStar(require("tls"));
+const child_process_1 = require("child_process");
+/**
+ * enterpriseTrust — read the MACHINE's trust decision, and add it to ours.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * Retail and restaurant chains run TLS-inspecting proxies: every outbound
+ * HTTPS connection is terminated by an appliance which re-signs it with a
+ * private enterprise root. That root is installed on the machine, so every
+ * browser on it works. Node does NOT read the platform trust store — it ships
+ * its own Mozilla-derived list and consults nothing else — so the connector was
+ * the one thing on the machine that could not talk to us.
+ *
+ * The failure had the worst possible shape. On a fresh install `uv` died first
+ * and the installer aborted blaming local AI; on the REPAIR path (where uv and
+ * litert-lm are already present, `setup-litertlm.ps1`'s `Test-LitertLmCli`
+ * short-circuit) the install COMPLETED and the connector then silently could
+ * not reach the API — a background process, no window, on a machine the
+ * customer believes is working.
+ *
+ * WHAT THIS IS NOT
+ * ----------------
+ * It is not a way to skip verification. There is no `rejectUnauthorized:false`
+ * here or anywhere in this tree and there must never be one — a connector that
+ * accepts any certificate is strictly worse than one that cannot connect,
+ * because it fails silently and in the customer's favour-looking direction.
+ * What we do is ADD the roots the machine's owner has already chosen to trust.
+ * Node's bundled list is always kept as the base (see `buildCaBundle`), so this
+ * can only ever widen trust to what this machine already trusts, never narrow
+ * it and never bypass it.
+ *
+ * RUNTIME RESOLUTION, NOT AN INSTALL-TIME EXPORT
+ * ----------------------------------------------
+ * The other design on the table was to export the machine roots to a .pem at
+ * install time and point `NODE_EXTRA_CA_CERTS` at it from the launcher. That is
+ * cheaper and it is wrong, for a reason specific to this product:
+ *
+ *   - The normal order of operations is domain-join, then install, then IT
+ *     ROTATES the inspection root (annually, or the day the appliance is
+ *     replaced). An exported bundle is a snapshot: at the next rotation the
+ *     connector breaks again with the exact same silent symptom.
+ *   - Nothing would re-export it. There is no auto-update on Windows
+ *     (cctv-connector-windows-gtm-readiness.md §5 — `install-update.ps1` is the
+ *     installer's own in-place upgrade path and nothing polls), so a stale
+ *     bundle would sit on the machine until the customer manually re-downloaded
+ *     2.6 GB.
+ *   - `NODE_EXTRA_CA_CERTS` is read ONCE at process start, so even a correct
+ *     file cannot be picked up without a restart.
+ *
+ * So we read the store at runtime, cache it for `TRUST_CACHE_TTL_MS`, and
+ * invalidate eagerly the moment a certificate-verification failure is
+ * classified (`invalidateTrustAnchorCache`, called from the transport). A root
+ * installed by IT while the connector is running is therefore picked up on the
+ * next cadence tick without a restart, which is the behaviour an operator on
+ * the phone with IT actually needs.
+ *
+ * `NODE_EXTRA_CA_CERTS` is still honoured — see `readNodeExtraCaCerts`. That
+ * matters more than it looks: passing `ca:` to a request REPLACES Node's
+ * resolved CA set, which silently disables `NODE_EXTRA_CA_CERTS` for that
+ * request. An admin who had already worked around this bug with that variable
+ * would have had their workaround broken by the fix. We read it ourselves.
+ */
+/** How long a trust-store read is reused before being taken again. */
+exports.TRUST_CACHE_TTL_MS = 30 * 60 * 1000;
+/** Hard ceiling on the bytes we accept from a store reader, per source. */
+const MAX_STORE_BYTES = 8 * 1024 * 1024;
+/** Wall-clock budget for a store-reading subprocess. */
+const STORE_READ_TIMEOUT_MS = 15000;
+const PEM_BLOCK_RE = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+function defaultExec(cmd, args) {
+    return (0, child_process_1.spawnSync)(cmd, args, {
+        encoding: 'utf-8',
+        timeout: STORE_READ_TIMEOUT_MS,
+        maxBuffer: MAX_STORE_BYTES,
+        windowsHide: true,
+    });
+}
+function defaultReadFile(p) {
+    return fs.readFileSync(p, 'utf-8');
+}
+/**
+ * Pull the PEM blocks out of arbitrary text.
+ *
+ * Deliberately a scan and not a parse: `security find-certificate -p` and
+ * `/etc/ssl/certs/ca-certificates.crt` both interleave human-readable headers
+ * between blocks, and OpenSSL is happy to be handed the blocks alone.
+ */
+function extractPemBlocks(text) {
+    if (!text)
+        return [];
+    const matches = text.match(PEM_BLOCK_RE);
+    if (!matches)
+        return [];
+    // Normalise line endings so the same certificate read through PowerShell
+    // (CRLF) and through a file (LF) dedupes against itself.
+    return matches.map((m) => m.replace(/\r\n/g, '\n').trim());
+}
+/**
+ * Windows: read the two stores an enterprise inspection root is deployed into.
+ *
+ * `LocalMachine\Root` is where a GPO-pushed "Trusted Root Certification
+ * Authorities" entry lands; `CurrentUser\Root` is where a per-user deployment
+ * lands (and is the only one writable without elevation, which the connector's
+ * per-user install means we cannot assume we have).
+ *
+ * Deliberately ONLY the `Root` stores, not `CA`/`AuthRoot`. Windows itself
+ * requires a chain to terminate at a `Root` entry, and OpenSSL treats every
+ * entry of `ca:` as a trust ANCHOR — so feeding it the intermediate store would
+ * make each intermediate independently trusted, which is a wider trust
+ * statement than the machine actually makes. Intermediates come off the wire
+ * from the inspecting proxy, as they do for every browser on the same box.
+ *
+ * `-Command` and not `-File`: execution policy governs script FILES, so a
+ * machine under a GPO `AllSigned` (the estate this whole change targets — see
+ * cctv-connector-windows-gtm-readiness.md §1) still runs this. That is the one
+ * property that makes reading the store possible on exactly the machines that
+ * need it.
+ */
+/** `[storeName, storeLocation]` pairs, as the .NET `X509Store` constructor takes them. */
+const WINDOWS_TRUST_STORES = [
+    ['Root', 'LocalMachine'],
+    ['Root', 'CurrentUser'],
+];
+/**
+ * The script that dumps the Root stores.
+ *
+ * Two deliberate choices, both made after the first version returned ZERO
+ * certificates on a real `windows-latest` host and reported nothing about why:
+ *
+ * 1. **`X509Store` directly, not the `Cert:` provider.** The provider is a
+ *    PowerShell module; the .NET class is the API underneath it and depends on
+ *    nothing being loaded.
+ * 2. **One raw base64 line per certificate, PEM armour added in Node.** The
+ *    first version asked PowerShell to emit whole PEM blocks, which needs the
+ *    `Base64FormattingOptions.InsertLineBreaks` overload — a string-to-enum
+ *    coercion inside a `-Command` string, i.e. exactly the kind of thing that
+ *    fails quietly. Node can wrap 64-character lines with no ambiguity at all.
+ *
+ * Errors are printed as `#ERR <store> <message>` rather than suppressed. A
+ * blanket `$ErrorActionPreference='SilentlyContinue'` is what turned the first
+ * failure into a silent empty result, and a store reader that cannot say why it
+ * read nothing is the same defect class this whole change exists to fix.
+ */
+function windowsTrustScript() {
+    // Single line, ASCII only: it crosses CreateProcess as one argv entry.
+    const NS = 'System.Security.Cryptography.X509Certificates';
+    return [
+        `foreach($p in @(${WINDOWS_TRUST_STORES.map(([n, l]) => `@('${n}','${l}')`).join(',')})){`,
+        'try{',
+        // Every enum is CAST, never coerced from a string. The first version of this
+        // reader leaned on one such coercion and returned zero certificates with no
+        // error at all on a real host; a cast either resolves or throws into the
+        // catch below, which is the whole difference.
+        `$st=New-Object ${NS}.X509Store $p[0],([${NS}.StoreLocation]$p[1]);`,
+        `$st.Open([${NS}.OpenFlags]::ReadOnly);`,
+        'foreach($c in $st.Certificates){Write-Output ([Convert]::ToBase64String($c.RawData))}',
+        '$st.Close()',
+        '}catch{',
+        "Write-Output ('#ERR ' + $p[1] + '\\' + $p[0] + ' ' + $_.Exception.Message)",
+        '}}',
+    ].join('');
+}
+/** Wrap one raw base64 DER blob into a PEM block, 64 characters per line. */
+function base64ToPem(base64) {
+    const body = base64.replace(/\s+/g, '').match(/.{1,64}/g)?.join('\n') ?? '';
+    return `-----BEGIN CERTIFICATE-----\n${body}\n-----END CERTIFICATE-----`;
+}
+function readWindowsTrustAnchors(opts = {}) {
+    const exec = opts.exec ?? defaultExec;
+    const warnings = [];
+    const result = exec('powershell.exe', [
+        '-NoProfile',
+        '-NonInteractive',
+        '-ExecutionPolicy',
+        'Bypass',
+        '-Command',
+        windowsTrustScript(),
+    ]);
+    if (result.error) {
+        warnings.push(`Windows trust store: powershell.exe failed (${result.error.message})`);
+        return { certs: [], sources: [], warnings };
+    }
+    if (result.status !== 0) {
+        const stderr = (result.stderr || '').trim().slice(0, 200);
+        warnings.push(`Windows trust store: powershell.exe exited ${result.status}${stderr ? ` — ${stderr}` : ''}`);
+        return { certs: [], sources: [], warnings };
+    }
+    const certs = [];
+    for (const line of (result.stdout || '').split(/\r?\n/)) {
+        const value = line.trim();
+        if (!value)
+            continue;
+        if (value.startsWith('#ERR ')) {
+            warnings.push(`Windows trust store: ${value.slice(5)}`);
+            continue;
+        }
+        // Anything else is one certificate's DER, base64-encoded on a single line.
+        if (!/^[A-Za-z0-9+/=]+$/.test(value))
+            continue;
+        certs.push(base64ToPem(value));
+    }
+    if (certs.length === 0 && warnings.length === 0) {
+        // Never a bare "returned nothing": the first version of this reader did
+        // exactly that on a real host and the message said nothing usable.
+        const stderr = (result.stderr || '').trim().slice(0, 300);
+        warnings.push('Windows trust store: powershell.exe exited 0 but printed no certificate and no error' +
+            `${stderr ? ` — stderr: ${stderr}` : ' (stderr was empty)'}`);
+    }
+    // One aggregate source line: the script reads both Root stores in one pass and
+    // a per-store split would need a second subprocess for no operator value.
+    const label = WINDOWS_TRUST_STORES.map(([n, l]) => `Cert:\\${l}\\${n}`).join(' + ');
+    return {
+        certs,
+        sources: certs.length > 0 ? [{ name: label, count: certs.length }] : [],
+        warnings,
+    };
+}
+/**
+ * macOS: the admin-installed System keychain plus the Apple root keychain.
+ *
+ * An MDM- or admin-installed enterprise root lands in `/Library/Keychains/System.keychain`.
+ * The Apple root keychain is included so a chain that happens to terminate at an
+ * Apple-distributed root the Mozilla list omits still validates.
+ */
+const MAC_KEYCHAINS = [
+    '/Library/Keychains/System.keychain',
+    '/System/Library/Keychains/SystemRootCertificates.keychain',
+];
+/**
+ * Subjects the admin has explicitly set to "Never Trust" in the admin domain.
+ *
+ * `security find-certificate` lists what is STORED in a keychain, not what is
+ * TRUSTED — a certificate the admin has explicitly denied is still returned by
+ * it. Promoting one of those to a trust anchor would invert the machine
+ * owner's decision, which is the exact opposite of what this module exists to
+ * honour. `dump-trust-settings -d` is the admin-domain override list; each
+ * entry names a certificate and its result type.
+ *
+ * Parsed loosely on purpose: an unreadable or absent settings list must mean
+ * "no explicit overrides", never "drop everything". Exported for the fixture
+ * tests, which drive it with the real command's output shape.
+ */
+function parseDeniedTrustSubjects(dump) {
+    const denied = new Set();
+    let current = null;
+    for (const line of (dump || '').split(/\r?\n/)) {
+        const cert = line.match(/^Cert\s+\d+\s*:\s*(.+?)\s*$/);
+        if (cert) {
+            current = cert[1];
+            continue;
+        }
+        if (/kSecTrustSettingsResultDeny/.test(line) && current)
+            denied.add(current);
+    }
+    return denied;
+}
+function readMacTrustAnchors(opts = {}) {
+    const exec = opts.exec ?? defaultExec;
+    const certs = [];
+    const sources = [];
+    const warnings = [];
+    // Admin-domain overrides first, so a denied root is dropped rather than
+    // promoted. A failure here is non-fatal: the anchors are still filtered to
+    // CA certificates by `readPlatformTrustAnchors`.
+    let denied = new Set();
+    const dump = exec('/usr/bin/security', ['dump-trust-settings', '-d']);
+    if (!dump.error && typeof dump.stdout === 'string') {
+        denied = parseDeniedTrustSubjects(dump.stdout);
+    }
+    for (const keychain of MAC_KEYCHAINS) {
+        const result = exec('/usr/bin/security', ['find-certificate', '-a', '-p', keychain]);
+        if (result.error) {
+            warnings.push(`macOS keychain ${keychain}: ${result.error.message}`);
+            continue;
+        }
+        if (result.status !== 0) {
+            warnings.push(`macOS keychain ${keychain}: security exited ${result.status}`);
+            continue;
+        }
+        const found = extractPemBlocks(result.stdout || '');
+        const kept = denied.size === 0 ? found : found.filter((pem) => !isDeniedSubject(pem, denied));
+        if (kept.length < found.length) {
+            warnings.push(`macOS keychain ${keychain}: skipped ${found.length - kept.length} certificate(s) ` +
+                'the admin has set to Never Trust');
+        }
+        if (kept.length > 0) {
+            certs.push(...kept);
+            sources.push({ name: keychain, count: kept.length });
+        }
+    }
+    return { certs, sources, warnings };
+}
+/** Does this PEM's subject appear in the admin's deny list? */
+function isDeniedSubject(pem, denied) {
+    const summary = summarizeCertificate(pem);
+    if (!summary)
+        return false;
+    for (const name of denied) {
+        if (summary.commonName === name || summary.subject.includes(name))
+            return true;
+    }
+    return false;
+}
+/**
+ * Parse a PEM far enough to answer "is this a CA, and what is its subject".
+ *
+ * Returns null when the certificate cannot be parsed at all, which is treated
+ * as "not admissible as an anchor" — an unparseable blob is not something to
+ * hand OpenSSL as a root.
+ */
+function summarizeCertificate(pem) {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const { X509Certificate } = require('crypto');
+        const cert = new X509Certificate(pem);
+        const subject = String(cert.subject || '');
+        const cn = subject.match(/^CN=(.+)$/m)?.[1]?.trim();
+        return { ca: cert.ca === true, subject, ...(cn ? { commonName: cn } : {}) };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * An anchor must be a CA. Applied to every platform, not only macOS.
+ *
+ * A keychain or a certificate store holds whatever has been PUT there, which on
+ * macOS includes end-entity certificates a user once saved. Passing one of
+ * those in `ca:` makes it a trust ANCHOR — it would then validate for its own
+ * name with no issuer above it, which is a trust elevation nobody asked for.
+ * Filtering on `basicConstraints CA:TRUE` is a no-op on a Windows `Root` store
+ * and on a distro CA bundle (both hold only CAs) and closes the macOS case.
+ */
+function keepOnlyCertificateAuthorities(certs) {
+    const kept = [];
+    let dropped = 0;
+    for (const pem of certs) {
+        const summary = summarizeCertificate(pem);
+        if (summary?.ca)
+            kept.push(pem);
+        else
+            dropped++;
+    }
+    return { kept, dropped };
+}
+/**
+ * Linux: the distro CA bundle, which Node also does not read.
+ *
+ * `SSL_CERT_FILE`/`SSL_CERT_DIR` are honoured first because they are the
+ * documented override on this platform and are what a container image or a
+ * hardened host sets. First existing bundle wins — they are copies of one
+ * another on any distro that ships more than one path.
+ */
+const LINUX_CA_BUNDLES = [
+    '/etc/ssl/certs/ca-certificates.crt', // Debian, Ubuntu, Alpine
+    '/etc/pki/tls/certs/ca-bundle.crt', // RHEL, Fedora, Amazon Linux
+    '/etc/ssl/ca-bundle.pem', // SUSE
+    '/etc/ssl/cert.pem', // Alpine, some BSD-ish layouts
+];
+function readLinuxTrustAnchors(opts = {}) {
+    const readFile = opts.readFile ?? defaultReadFile;
+    const env = opts.env ?? process.env;
+    const certs = [];
+    const sources = [];
+    const warnings = [];
+    const explicit = env.SSL_CERT_FILE;
+    const candidates = explicit ? [explicit, ...LINUX_CA_BUNDLES] : LINUX_CA_BUNDLES;
+    for (const candidate of candidates) {
+        let text;
+        try {
+            text = readFile(candidate);
+        }
+        catch {
+            continue;
+        }
+        const found = extractPemBlocks(text);
+        if (found.length > 0) {
+            certs.push(...found);
+            sources.push({ name: candidate, count: found.length });
+            break; // first readable bundle wins; the rest are copies
+        }
+    }
+    const certDir = env.SSL_CERT_DIR;
+    if (certDir) {
+        for (const dir of certDir.split(path.delimiter).filter(Boolean)) {
+            let entries = [];
+            try {
+                entries = fs.readdirSync(dir);
+            }
+            catch {
+                warnings.push(`SSL_CERT_DIR ${dir}: not readable`);
+                continue;
+            }
+            let dirCount = 0;
+            for (const entry of entries) {
+                if (!/\.(pem|crt|cer)$/i.test(entry))
+                    continue;
+                try {
+                    const found = extractPemBlocks(readFile(path.join(dir, entry)));
+                    certs.push(...found);
+                    dirCount += found.length;
+                }
+                catch {
+                    /* one unreadable file must not lose the rest of the directory */
+                }
+            }
+            if (dirCount > 0)
+                sources.push({ name: dir, count: dirCount });
+        }
+    }
+    if (certs.length === 0) {
+        warnings.push(`Linux trust store: none of ${LINUX_CA_BUNDLES.join(', ')} was readable`);
+    }
+    return { certs, sources, warnings };
+}
+/**
+ * `NODE_EXTRA_CA_CERTS`, read EXPLICITLY.
+ *
+ * Node applies this variable to the default secure context. Passing `ca:` on a
+ * request replaces that context's CA set, so wiring an agent with `ca:` and
+ * nothing else would have silently disabled an admin's existing workaround for
+ * this very bug. We therefore read it ourselves and merge it in.
+ */
+function readNodeExtraCaCerts(opts = {}) {
+    const env = opts.env ?? process.env;
+    const readFile = opts.readFile ?? defaultReadFile;
+    const target = env.NODE_EXTRA_CA_CERTS;
+    if (!target)
+        return { certs: [], sources: [], warnings: [] };
+    try {
+        const found = extractPemBlocks(readFile(target));
+        if (found.length === 0) {
+            return {
+                certs: [],
+                sources: [],
+                warnings: [`NODE_EXTRA_CA_CERTS=${target}: no PEM certificate found in it`],
+            };
+        }
+        return { certs: found, sources: [{ name: `NODE_EXTRA_CA_CERTS (${target})`, count: found.length }], warnings: [] };
+    }
+    catch (err) {
+        return {
+            certs: [],
+            sources: [],
+            warnings: [`NODE_EXTRA_CA_CERTS=${target}: not readable (${err.message})`],
+        };
+    }
+}
+/** Read every store this platform has. Uncached — see `resolveTrustAnchors`. */
+function readPlatformTrustAnchors(opts = {}) {
+    const platform = opts.platform ?? process.platform;
+    let native;
+    if (platform === 'win32')
+        native = readWindowsTrustAnchors(opts);
+    else if (platform === 'darwin')
+        native = readMacTrustAnchors(opts);
+    else
+        native = readLinuxTrustAnchors(opts);
+    const extra = readNodeExtraCaCerts(opts);
+    const seen = new Set();
+    const deduped = [];
+    for (const pem of [...native.certs, ...extra.certs]) {
+        if (seen.has(pem))
+            continue;
+        seen.add(pem);
+        deduped.push(pem);
+    }
+    // An anchor must be a CA — see keepOnlyCertificateAuthorities. Applied AFTER
+    // the merge so it covers NODE_EXTRA_CA_CERTS too: an admin who points that at
+    // a leaf has made a mistake, and turning it into a root is not the fix.
+    const { kept, dropped } = keepOnlyCertificateAuthorities(deduped);
+    const warnings = [...native.warnings, ...extra.warnings];
+    if (dropped > 0) {
+        warnings.push(`skipped ${dropped} certificate(s) that are not certificate authorities — ` +
+            'a trust anchor must carry basicConstraints CA:TRUE');
+    }
+    return {
+        certs: kept,
+        sources: [...native.sources, ...extra.sources],
+        warnings,
+        resolvedAtMs: Date.now(),
+        platform,
+    };
+}
+let cached = null;
+/**
+ * The cached read. Callers on the request path use this; it costs one
+ * subprocess per TTL, not one per request.
+ *
+ * The cache holds ONE snapshot with no key, which is valid exactly while the
+ * platform and environment are process-wide constants — true in production, and
+ * NOT true when a caller injects them. An injected `platform`/`exec`/`readFile`/
+ * `env` therefore bypasses the cache in both directions: it neither reads a
+ * snapshot taken under a different environment nor publishes its own for
+ * someone else to read. (Same rule, same reason, as `resolveProxyCached`.)
+ */
+function resolveTrustAnchors(opts = {}) {
+    const injected = Boolean(opts.platform || opts.exec || opts.readFile || opts.env);
+    if (injected)
+        return readPlatformTrustAnchors(opts);
+    const now = Date.now();
+    if (cached && now - cached.resolvedAtMs < exports.TRUST_CACHE_TTL_MS)
+        return cached;
+    cached = readPlatformTrustAnchors(opts);
+    return cached;
+}
+/**
+ * Drop the cache so the next resolve re-reads the store.
+ *
+ * Called when a certificate-verification failure is classified: the single most
+ * likely explanation for one is that IT has just deployed (or is about to
+ * deploy) the inspection root, and re-reading is how the connector recovers
+ * without the restart nobody is there to perform.
+ */
+function invalidateTrustAnchorCache() {
+    cached = null;
+}
+/** For tests: the snapshot currently held, without taking a new one. */
+function peekTrustAnchorCache() {
+    return cached;
+}
+/**
+ * The `ca` value to hand to TLS: Node's bundled roots FIRST, then the machine's.
+ *
+ * Including `tls.rootCertificates` is the load-bearing half. `ca:` REPLACES the
+ * default set rather than extending it, so passing only the machine anchors
+ * would have made a connector on a normal network stop trusting the public web
+ * PKI — turning a corporate-network bug into a fleet-wide outage. Returns
+ * `undefined` when there is nothing to add, so the default context is used
+ * untouched on the overwhelming majority of hosts.
+ */
+function buildCaBundle(anchors) {
+    if (anchors.certs.length === 0)
+        return undefined;
+    return [...tls.rootCertificates, ...anchors.certs];
+}
+/** One operator-facing line describing what was resolved. */
+function describeTrustAnchors(anchors) {
+    if (anchors.certs.length === 0) {
+        const why = anchors.warnings.length > 0 ? ` (${anchors.warnings[0]})` : '';
+        return `trust: Node bundled roots only — no platform trust store read${why}`;
+    }
+    const stores = anchors.sources.map((s) => `${s.name} x${s.count}`).join(', ');
+    return `trust: Node bundled roots + ${anchors.certs.length} from ${stores}`;
+}
+/** Platform-appropriate instruction for getting a root INTO the store. */
+function trustStoreInstallHint(platform = process.platform) {
+    if (platform === 'win32') {
+        return ('Ask IT to install the inspection root into this machine\'s ' +
+            '"Trusted Root Certification Authorities" store (Local Machine or Current User). ' +
+            'The connector re-reads that store automatically; no reinstall is needed.');
+    }
+    if (platform === 'darwin') {
+        return ('Ask IT to install the inspection root into the System keychain ' +
+            `(/Library/Keychains/System.keychain) on ${os.hostname()}. ` +
+            'The connector re-reads it automatically; no reinstall is needed.');
+    }
+    return ('Install the inspection root into the system CA bundle ' +
+        '(e.g. /usr/local/share/ca-certificates + update-ca-certificates), or point ' +
+        'NODE_EXTRA_CA_CERTS at a PEM file containing it.');
+}
+//# sourceMappingURL=enterpriseTrust.js.map

package/dist/enterpriseTrust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterpriseTrust.js","sourceRoot":"","sources":["../src/enterpriseTrust.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsIA,4CAOC;AA2ED,0DA2DC;AA4BD,4DAYC;AAED,kDA4CC;AAoED,sDA6DC;AAUD,oDA2BC;AAGD,4DAqCC;AAeD,kDAQC;AAUD,gEAEC;AAGD,oDAEC;AAYD,sCAGC;AAGD,oDAOC;AAGD,sDAoBC;AA/oBD,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,yCAA2B;AAC3B,iDAAiE;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,sEAAsE;AACzD,QAAA,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD,2EAA2E;AAC3E,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,wDAAwD;AACxD,MAAM,qBAAqB,GAAG,KAAM,CAAC;AAErC,MAAM,YAAY,GAAG,+DAA+D,CAAC;AAqCrF,SAAS,WAAW,CAAC,GAAW,EAAE,IAAc;IAC9C,OAAO,IAAA,yBAAS,EAAC,GAAG,EAAE,IAAI,EAAE;QAC1B,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,qBAAqB;QAC9B,SAAS,EAAE,eAAe;QAC1B,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,yEAAyE;IACzE,yDAAyD;IACzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,0FAA0F;AAC1F,MAAM,oBAAoB,GAA4C;IACpE,CAAC,MAAM,EAAE,cAAc,CAAC;IACxB,CAAC,MAAM,EAAE,aAAa,CAAC;CACxB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,kBAAkB;IACzB,uEAAuE;IACvE,MAAM,EAAE,GAAG,+CAA+C,CAAC;IAC3D,OAAO;QACL,mBAAmB,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;QAC1F,MAAM;QACN,6EAA6E;QAC7E,4EAA4E;QAC5E,yEAAyE;QACzE,8CAA8C;QAC9C,kBAAkB,EAAE,sBAAsB,EAAE,wBAAwB;QACpE,aAAa,EAAE,yBAAyB;QACxC,uFAAuF;QACvF,aAAa;QACb,SAAS;QACT,4EAA4E;QAC5E,IAAI;KACL,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5E,OAAO,gCAAgC,IAAI,6BAA6B,CAAC;AAC3E,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAA+B,EAAE;IAKvE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE;QACpC,YAAY;QACZ,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ;QACR,UAAU;QACV,kBAAkB,EAAE;KACrB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,+CAA+C,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;QACtF,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1D,QAAQ,CAAC,IAAI,CACX,8CAA8C,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7F,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAC/C,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1D,QAAQ,CAAC,IAAI,CACX,sFAAsF;YACpF,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAC/D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpF,OAAO;QACL,KAAK;QACL,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QACvE,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,aAAa,GAAG;IACpB,oCAAoC;IACpC,2DAA2D;CAC5D,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,SAAgB,wBAAwB,CAAC,IAAY;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACvD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,mBAAmB,CAAC,OAA+B,EAAE;IAKnE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,wEAAwE;IACxE,2EAA2E;IAC3E,iDAAiD;IACjD,IAAI,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,kBAAkB,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,kBAAkB,QAAQ,qBAAqB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9F,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,kBAAkB,QAAQ,aAAa,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,kBAAkB;gBACjF,kCAAkC,CACrC,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED,+DAA+D;AAC/D,SAAS,eAAe,CAAC,GAAW,EAAE,MAAmB;IACvD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,QAAQ,CAA4B,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,8BAA8B,CAAC,KAAe;IACrD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,OAAO,EAAE,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YAC3B,OAAO,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG;IACvB,oCAAoC,EAAE,yBAAyB;IAC/D,kCAAkC,EAAE,6BAA6B;IACjE,wBAAwB,EAAE,OAAO;IACjC,mBAAmB,EAAE,+BAA+B;CACrD,CAAC;AAEF,SAAgB,qBAAqB,CAAC,OAA+B,EAAE;IAKrE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,CAAC;IACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAEjF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACvD,MAAM,CAAC,kDAAkD;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC;IACjC,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAChE,IAAI,OAAO,GAAa,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,CAAC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAAC;gBACnD,SAAS;YACX,CAAC;YACD,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAC/C,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;oBAChE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;oBACrB,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,iEAAiE;gBACnE,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,8BAA8B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CACzE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAAC,OAA+B,EAAE;IAKpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,KAAK,EAAE,EAAE;gBACT,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE,CAAC,uBAAuB,MAAM,kCAAkC,CAAC;aAC5E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,MAAM,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACrH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,CAAC,uBAAuB,MAAM,mBAAoB,GAAa,CAAC,OAAO,GAAG,CAAC;SACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAgB,wBAAwB,CAAC,OAA+B,EAAE;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,IAAI,MAA6E,CAAC;IAElF,IAAI,QAAQ,KAAK,OAAO;QAAE,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;SAC5D,IAAI,QAAQ,KAAK,QAAQ;QAAE,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;;QAC9D,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAEzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CACX,WAAW,OAAO,yDAAyD;YACzE,oDAAoD,CACvD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9C,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;QACxB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,IAAI,MAAM,GAAiC,IAAI,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,SAAgB,mBAAmB,CAAC,OAA+B,EAAE;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,IAAI,QAAQ;QAAE,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAEpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,YAAY,GAAG,0BAAkB;QAAE,OAAO,MAAM,CAAC;IAC5E,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,0BAA0B;IACxC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC;AAED,wEAAwE;AACxE,SAAgB,oBAAoB;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,aAAa,CAAC,OAA8B;IAC1D,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,CAAC,GAAG,GAAG,CAAC,gBAAgB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AAED,6DAA6D;AAC7D,SAAgB,oBAAoB,CAAC,OAA8B;IACjE,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,gEAAgE,GAAG,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,OAAO,+BAA+B,OAAO,CAAC,KAAK,CAAC,MAAM,SAAS,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED,0EAA0E;AAC1E,SAAgB,qBAAqB,CAAC,WAA4B,OAAO,CAAC,QAAQ;IAChF,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,CACL,6DAA6D;YAC7D,kFAAkF;YAClF,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,CACL,iEAAiE;YACjE,2CAA2C,EAAE,CAAC,QAAQ,EAAE,IAAI;YAC5D,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,CACL,wDAAwD;QACxD,6EAA6E;QAC7E,kDAAkD,CACnD,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -6,6 +6,16 @@ export type { CommandContext, DeviceCommand, CommandResult } from './CommandRout
 export { runInit } from './init';
 export { runDiagnose } from './diagnose';
 export type { DiagnosticReport } from './diagnose';
+export { installEnterpriseNetworking, describeNetworkPosture, getEnterpriseAgent, diagnoseTransportError, resetEnterpriseNetworkCaches, EnterpriseHttpsAgent, } from './enterpriseNetwork';
+export type { NetworkPosture, EnterpriseNetworkOptions } from './enterpriseNetwork';
+export { TransportFailure, classifyTransportError, formatTransportFailure, isTrustFailure, } from './transportFailure';
+export type { TransportFailureClass } from './transportFailure';
+export { resolveTrustAnchors, describeTrustAnchors } from './enterpriseTrust';
+export type { TrustAnchorResolution } from './enterpriseTrust';
+export { resolveProxyForUrl, describeProxy } from './enterpriseProxy';
+export type { ProxyResolution } from './enterpriseProxy';
+export { probeLocalNetworkAccess, decideLocalNetworkVerdict, LOCAL_NETWORK_DENIED_SUGGESTION, LOCAL_NETWORK_DENIED_SUMMARY, } from './localNetworkAccess';
+export type { LocalNetworkVerdict, LocalNetworkProbeResult, LocalNetworkProbeEvidence, LocalNetworkProbeOptions, } from './localNetworkAccess';
 export { AudienceAnalyzeClient, defaultHttpPoster } from './AudienceAnalyzeClient';
 export type { AudienceAnalyzeClientOptions, AudienceAnalyzeRequest, AudienceAnalyzeResponse, CameraHealthFailureClass, CameraHealthReport, CameraHealthState, FrameDimensions, HttpPoster, } from './AudienceAnalyzeClient';
 export { CloudSensingManager, buildSensingLoops, buildTiledCameras, classifyRtspFailureClass, resolveFeeds, } from './CloudSensingManager';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGnD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACnF,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,UAAU,GACX,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,YAAY,GACb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,oCAAoC,GACrC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAChF,YAAY,EACV,0BAA0B,EAC1B,eAAe,EACf,YAAY,GACb,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,YAAY,EACV,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACpF,YAAY,EACV,YAAY,EACZ,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,SAAS,EACT,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EACV,4BAA4B,EAC5B,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrE,YAAY,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D,YAAY,EACV,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,aAAa,EACb,aAAa,GACd,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAKnD,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,YAAY,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACtE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACnF,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,UAAU,GACX,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,YAAY,GACb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,oCAAoC,GACrC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAChF,YAAY,EACV,0BAA0B,EAC1B,eAAe,EACf,YAAY,GACb,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,YAAY,EACV,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACpF,YAAY,EACV,YAAY,EACZ,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,SAAS,EACT,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EACV,4BAA4B,EAC5B,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrE,YAAY,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D,YAAY,EACV,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,aAAa,EACb,aAAa,GACd,MAAM,wBAAwB,CAAC"}