@trillboards/edge-sdk 0.2.21 → 0.2.24

package/dist/enterpriseProxy.js

@@ -0,0 +1,406 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeProxyUrl = normalizeProxyUrl;
+exports.pickWinInetProxy = pickWinInetProxy;
+exports.findBypassRule = findBypassRule;
+exports.parseRegQuery = parseRegQuery;
+exports.parseNetshWinhttp = parseNetshWinhttp;
+exports.parseScutilProxy = parseScutilProxy;
+exports.resolveProxyForUrl = resolveProxyForUrl;
+exports.describeProxy = describeProxy;
+exports.redactProxyUrl = redactProxyUrl;
+const child_process_1 = require("child_process");
+/**
+ * enterpriseProxy — find the proxy the MACHINE is already configured to use.
+ *
+ * The connector's HTTP client is raw `node:https`, and unlike `curl`, `node:https`
+ * does NOT honour proxy environment variables implicitly: a proxy requires an
+ * explicit agent. Before this module nothing anywhere in the SDK read
+ * `HTTPS_PROXY`, `HTTP_PROXY` or `NO_PROXY`, and no `agent:` was ever passed —
+ * so on a site where direct egress is blocked and a proxy is mandatory, every
+ * call went direct and every call failed.
+ *
+ * NO NEW CONFIG KEY. This deliberately reads the platform's ACTUAL
+ * configuration rather than inventing a `proxyUrl` setting:
+ *
+ *   - a new key would have to be set per install, by the person who least knows
+ *     the value, on a machine whose browsers already have it;
+ *   - the connector runs on a customer's PC and must resolve its proxy BEFORE
+ *     its first network call, so a server-side tunable (`runtime_config`) could
+ *     not be fetched in time to be useful — the fetch is the thing being fixed;
+ *   - `HTTPS_PROXY`/`NO_PROXY` is what an IT admin already scripts, and on
+ *     Windows the GPO-managed WinINET/WinHTTP settings are what the estate
+ *     actually carries.
+ *
+ * Resolution order, first hit wins:
+ *   1. environment  — `HTTPS_PROXY`/`HTTP_PROXY`/`ALL_PROXY` (+ lowercase)
+ *   2. Windows      — WinINET (HKCU Internet Settings), then WinHTTP
+ *      macOS        — `scutil --proxy`
+ *      Linux        — environment only; there is no other system-wide source
+ *
+ * PAC / auto-config is DETECTED AND REPORTED, never silently ignored. Evaluating
+ * a PAC file means running the site's JavaScript with `dnsResolve`/`myIpAddress`
+ * host functions; we do not do that, and the honest outcome is to name the PAC
+ * URL in the failure so the operator can ask IT for the literal proxy — not to
+ * report "no proxy configured" on a machine that plainly has one.
+ */
+/** Wall-clock budget for a proxy-reading subprocess. */
+const PROXY_READ_TIMEOUT_MS = 10000;
+function defaultExec(cmd, args) {
+    return (0, child_process_1.spawnSync)(cmd, args, {
+        encoding: 'utf-8',
+        timeout: PROXY_READ_TIMEOUT_MS,
+        maxBuffer: 1024 * 1024,
+        windowsHide: true,
+    });
+}
+/**
+ * Normalise whatever the platform gave us into an absolute proxy URL.
+ *
+ * WinINET stores `proxy:8080`, or a scheme-keyed list
+ * `http=p1:80;https=p2:8080`; `scutil` gives host and port separately; the
+ * environment usually has a full URL but is frequently set to a bare host:port.
+ * Returns null for anything that cannot be made into a URL, so a malformed
+ * setting degrades to DIRECT rather than to a crash on the request path.
+ */
+function normalizeProxyUrl(raw) {
+    if (!raw)
+        return null;
+    const value = raw.trim();
+    if (!value)
+        return null;
+    const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(value) ? value : `http://${value}`;
+    try {
+        const url = new URL(withScheme);
+        if (!url.hostname)
+            return null;
+        // socks is a real thing an admin may set and one we cannot tunnel through
+        // without a SOCKS implementation; treat it as unsupported-but-named rather
+        // than pretend it is an HTTP proxy.
+        if (!/^https?:$/.test(url.protocol) && !/^socks/i.test(url.protocol))
+            return null;
+        return formatProxyUrl(url);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Render a proxy URL with its port ALWAYS explicit.
+ *
+ * `URL.toString()` drops a default port, so `http://p:80` comes back as
+ * `http://p` — harmless to reparse and actively confusing in the one line an
+ * operator reads to check what their proxy is. Rendering the port every time
+ * makes the log line and the customer's IT ticket agree.
+ */
+function formatProxyUrl(url) {
+    const port = url.port || (url.protocol === 'https:' ? '443' : '80');
+    const credentials = url.username ? `${url.username}${url.password ? `:${url.password}` : ''}@` : '';
+    return `${url.protocol}//${credentials}${url.hostname}:${port}`;
+}
+/** Pick the `https=` (or `http=`) entry out of a WinINET scheme-keyed list. */
+function pickWinInetProxy(proxyServer, targetProtocol) {
+    if (!proxyServer)
+        return null;
+    if (!proxyServer.includes('='))
+        return normalizeProxyUrl(proxyServer);
+    const wanted = targetProtocol === 'https:' ? 'https' : 'http';
+    const parts = proxyServer.split(';').map((p) => p.trim()).filter(Boolean);
+    const map = new Map();
+    for (const part of parts) {
+        const eq = part.indexOf('=');
+        if (eq <= 0)
+            continue;
+        map.set(part.slice(0, eq).trim().toLowerCase(), part.slice(eq + 1).trim());
+    }
+    // Fall back to the http entry: an appliance that lists only `http=` almost
+    // always accepts CONNECT on the same port, and a wrong-but-named proxy fails
+    // LOUDLY as `proxy_rejected`, which is a far better answer than going direct
+    // on a network where direct egress is blocked and hanging.
+    return normalizeProxyUrl(map.get(wanted) ?? map.get('http') ?? null);
+}
+/**
+ * Does a bypass list exempt this host?
+ *
+ * Accepts both the POSIX `NO_PROXY` vocabulary and the Windows `ProxyOverride`
+ * vocabulary, because the same function serves both:
+ *   `*`            — everything
+ *   `<local>`      — Windows: any hostname with no dot in it
+ *   `.corp.local`  — that suffix
+ *   `corp.local`   — that host and its subdomains
+ *   `*.corp.local` — same, wildcard spelling
+ *   `10.0.0.7`     — that literal address
+ *   `host:8080`    — that host, only on that port
+ *
+ * Returns the matching entry (so the caller can SAY which rule applied) or null.
+ */
+function findBypassRule(host, port, bypassList) {
+    if (!host)
+        return null;
+    const target = host.toLowerCase().replace(/^\[|\]$/g, '');
+    // Loopback and link-local ALWAYS bypass, whatever the list says. The connector
+    // talks to `127.0.0.1:9379` (the local litert-lm server) on the same global
+    // agent as the cloud; routing that through a corporate proxy would break local
+    // inference on exactly the machines this change exists to support.
+    if (target === 'localhost' ||
+        target === '::1' ||
+        /^127\./.test(target) ||
+        /^169\.254\./.test(target) ||
+        /^fe80:/i.test(target)) {
+        return 'loopback/link-local (always direct)';
+    }
+    if (!bypassList)
+        return null;
+    for (const rawEntry of bypassList.split(/[,;]/)) {
+        const entry = rawEntry.trim().toLowerCase();
+        if (!entry)
+            continue;
+        if (entry === '*')
+            return rawEntry.trim();
+        if (entry === '<local>') {
+            if (!target.includes('.'))
+                return rawEntry.trim();
+            continue;
+        }
+        let pattern = entry;
+        let entryPort;
+        const colon = pattern.lastIndexOf(':');
+        // Only treat a trailing `:digits` as a port; an IPv6 literal has many colons.
+        if (colon > 0 && /^\d+$/.test(pattern.slice(colon + 1))) {
+            entryPort = pattern.slice(colon + 1);
+            pattern = pattern.slice(0, colon);
+        }
+        if (entryPort && String(port ?? '') !== entryPort)
+            continue;
+        if (pattern.startsWith('*.'))
+            pattern = pattern.slice(1); // `*.x` -> `.x`
+        if (pattern.startsWith('.')) {
+            if (target.endsWith(pattern) || target === pattern.slice(1))
+                return rawEntry.trim();
+            continue;
+        }
+        if (target === pattern || target.endsWith(`.${pattern}`))
+            return rawEntry.trim();
+    }
+    return null;
+}
+function envProxy(env, protocol) {
+    // Uppercase first, then lowercase — both spellings are in the wild, and
+    // `http_proxy` (lowercase) is the one convention says is authoritative for
+    // plain HTTP because of a historical CGI header-injection hazard.
+    const names = protocol === 'https:'
+        ? ['HTTPS_PROXY', 'https_proxy', 'ALL_PROXY', 'all_proxy']
+        : ['HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy'];
+    for (const name of names) {
+        const url = normalizeProxyUrl(env[name]);
+        if (url)
+            return { url, name };
+    }
+    return { url: null };
+}
+const WININET_KEY = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings';
+/** Parse `reg.exe query` output into a name -> value map. */
+function parseRegQuery(stdout) {
+    const out = {};
+    for (const line of (stdout || '').split(/\r?\n/)) {
+        // `    ProxyServer    REG_SZ    proxy.corp:8080`
+        const m = line.match(/^\s{2,}(\S+)\s+(REG_[A-Z_]+)\s+(.*)$/);
+        if (!m)
+            continue;
+        out[m[1]] = m[3].trim();
+    }
+    return out;
+}
+/** Parse `netsh winhttp show proxy` output. */
+function parseNetshWinhttp(stdout) {
+    const text = stdout || '';
+    if (/direct access/i.test(text))
+        return { server: null, bypass: null };
+    const server = text.match(/Proxy Server\(s\)\s*:\s*(.+)/i)?.[1]?.trim() || null;
+    const bypass = text.match(/Bypass List\s*:\s*(.+)/i)?.[1]?.trim() || null;
+    return { server: server && server !== '(none)' ? server : null, bypass };
+}
+/** Parse `scutil --proxy` output into a flat map (arrays are joined with `,`). */
+function parseScutilProxy(stdout) {
+    const out = {};
+    const exceptions = [];
+    let inExceptions = false;
+    for (const line of (stdout || '').split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (/^ExceptionsList\s*:\s*<array>/.test(trimmed)) {
+            inExceptions = true;
+            continue;
+        }
+        if (inExceptions) {
+            if (trimmed === '}') {
+                inExceptions = false;
+                continue;
+            }
+            const item = trimmed.match(/^\d+\s*:\s*(.+)$/);
+            if (item)
+                exceptions.push(item[1].trim());
+            continue;
+        }
+        const m = trimmed.match(/^([A-Za-z0-9]+)\s*:\s*(.+)$/);
+        if (m)
+            out[m[1]] = m[2].trim();
+    }
+    if (exceptions.length > 0)
+        out.ExceptionsList = exceptions.join(',');
+    return out;
+}
+function windowsProxy(opts, protocol) {
+    const exec = opts.exec ?? defaultExec;
+    const warnings = [];
+    let autoConfigUrl;
+    // WinINET first: it is per-user, it is what browsers use, and it is what a GPO
+    // "Configure proxy settings" policy writes.
+    const reg = exec('reg.exe', ['query', WININET_KEY]);
+    if (reg.error) {
+        warnings.push(`WinINET proxy: reg.exe failed (${reg.error.message})`);
+    }
+    else if (reg.status === 0) {
+        const values = parseRegQuery(reg.stdout || '');
+        const auto = values.AutoConfigURL;
+        if (auto)
+            autoConfigUrl = auto;
+        const enabled = values.ProxyEnable && /^0x0*[1-9a-f]/i.test(values.ProxyEnable);
+        if (enabled && values.ProxyServer) {
+            const url = pickWinInetProxy(values.ProxyServer, protocol);
+            if (url) {
+                return { url, source: 'wininet', bypass: values.ProxyOverride || null, autoConfigUrl, warnings };
+            }
+            warnings.push(`WinINET proxy: could not parse ProxyServer="${values.ProxyServer}"`);
+        }
+    }
+    // WinHTTP: the machine-wide store, used by services and by anything that never
+    // logs a user in. On this product the connector runs as an interactive user,
+    // so this is the fallback rather than the primary.
+    const netsh = exec('netsh.exe', ['winhttp', 'show', 'proxy']);
+    if (netsh.error) {
+        warnings.push(`WinHTTP proxy: netsh failed (${netsh.error.message})`);
+    }
+    else if (netsh.status === 0) {
+        const parsed = parseNetshWinhttp(netsh.stdout || '');
+        const url = parsed.server ? pickWinInetProxy(parsed.server, protocol) : null;
+        if (url)
+            return { url, source: 'winhttp', bypass: parsed.bypass, autoConfigUrl, warnings };
+    }
+    return { url: null, source: 'none', bypass: null, autoConfigUrl, warnings };
+}
+function macProxy(opts, protocol) {
+    const exec = opts.exec ?? defaultExec;
+    const warnings = [];
+    const result = exec('/usr/sbin/scutil', ['--proxy']);
+    if (result.error) {
+        warnings.push(`macOS proxy: scutil failed (${result.error.message})`);
+        return { url: null, source: 'none', bypass: null, warnings };
+    }
+    if (result.status !== 0) {
+        warnings.push(`macOS proxy: scutil exited ${result.status}`);
+        return { url: null, source: 'none', bypass: null, warnings };
+    }
+    const values = parseScutilProxy(result.stdout || '');
+    const autoConfigUrl = values.ProxyAutoConfigEnable === '1' ? values.ProxyAutoConfigURLString : undefined;
+    const prefix = protocol === 'https:' ? 'HTTPS' : 'HTTP';
+    const enabled = values[`${prefix}Enable`] === '1';
+    const host = values[`${prefix}Proxy`];
+    const port = values[`${prefix}Port`];
+    if (enabled && host) {
+        return {
+            url: normalizeProxyUrl(port ? `${host}:${port}` : host),
+            source: 'macos-scutil',
+            bypass: values.ExceptionsList || null,
+            autoConfigUrl,
+            warnings,
+        };
+    }
+    return { url: null, source: 'none', bypass: null, autoConfigUrl, warnings };
+}
+/**
+ * The whole decision for one target URL: which proxy (if any), or why not.
+ *
+ * Pure with respect to its options, so the platform branches are all testable
+ * off their native platform — which is the only way the Windows path gets any
+ * coverage at all from a Linux CI lane.
+ */
+function resolveProxyForUrl(targetUrl, opts = {}) {
+    const env = opts.env ?? process.env;
+    const platform = opts.platform ?? process.platform;
+    const warnings = [];
+    let target;
+    try {
+        target = new URL(targetUrl);
+    }
+    catch {
+        return { proxyUrl: null, source: 'none', warnings: [`unparseable target URL: ${targetUrl}`] };
+    }
+    const port = target.port ? Number(target.port) : target.protocol === 'https:' ? 443 : 80;
+    // NO_PROXY is checked FIRST and against the environment regardless of where
+    // the proxy itself came from: an admin who exports NO_PROXY means it.
+    const noProxy = env.NO_PROXY ?? env.no_proxy;
+    const envBypass = findBypassRule(target.hostname, port, noProxy);
+    const fromEnv = envProxy(env, target.protocol);
+    if (fromEnv.url) {
+        if (envBypass) {
+            return { proxyUrl: null, source: 'env', bypassedBy: envBypass, warnings };
+        }
+        return { proxyUrl: fromEnv.url, source: 'env', warnings };
+    }
+    let platformResult;
+    if (platform === 'win32')
+        platformResult = windowsProxy(opts, target.protocol);
+    else if (platform === 'darwin')
+        platformResult = macProxy(opts, target.protocol);
+    else
+        platformResult = { url: null, source: 'none', bypass: null, warnings: [] };
+    warnings.push(...platformResult.warnings);
+    // The loopback rule must hold even when nothing at all is configured, so run
+    // the bypass check on the platform list (or an empty one) either way.
+    const bypass = envBypass ?? findBypassRule(target.hostname, port, platformResult.bypass);
+    if (platformResult.url && !bypass) {
+        return {
+            proxyUrl: platformResult.url,
+            source: platformResult.source,
+            autoConfigUrl: platformResult.autoConfigUrl,
+            warnings,
+        };
+    }
+    return {
+        proxyUrl: null,
+        source: platformResult.url ? platformResult.source : 'none',
+        ...(bypass ? { bypassedBy: bypass } : {}),
+        ...(platformResult.autoConfigUrl ? { autoConfigUrl: platformResult.autoConfigUrl } : {}),
+        warnings,
+    };
+}
+/** One operator-facing line describing the proxy decision. */
+function describeProxy(resolution) {
+    if (resolution.proxyUrl) {
+        return `proxy: ${redactProxyUrl(resolution.proxyUrl)} (from ${resolution.source})`;
+    }
+    if (resolution.bypassedBy) {
+        return `proxy: direct — bypass rule "${resolution.bypassedBy}"`;
+    }
+    if (resolution.autoConfigUrl) {
+        return (`proxy: NOT USED — this machine is configured by an auto-config (PAC) script ` +
+            `at ${resolution.autoConfigUrl}, which this build cannot evaluate. ` +
+            `Set HTTPS_PROXY to the literal proxy that PAC file returns.`);
+    }
+    return 'proxy: direct (none configured)';
+}
+/** Strip proxy credentials before anything is logged. */
+function redactProxyUrl(proxyUrl) {
+    try {
+        const url = new URL(proxyUrl);
+        if (url.username || url.password) {
+            url.username = '***';
+            url.password = '';
+        }
+        return formatProxyUrl(url);
+    }
+    catch {
+        return proxyUrl;
+    }
+}
+//# sourceMappingURL=enterpriseProxy.js.map

package/dist/enterpriseProxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterpriseProxy.js","sourceRoot":"","sources":["../src/enterpriseProxy.ts"],"names":[],"mappings":";;AAmFA,8CAgBC;AAiBD,4CAgBC;AAiBD,wCAgDC;AAoBD,sCASC;AAGD,8CAMC;AAGD,4CAwBC;AAqFD,gDAqDC;AAGD,sCAeC;AAGD,wCAWC;AAhbD,iDAAiE;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,wDAAwD;AACxD,MAAM,qBAAqB,GAAG,KAAM,CAAC;AA2BrC,SAAS,WAAW,CAAC,GAAW,EAAE,IAAc;IAC9C,OAAO,IAAA,yBAAS,EAAC,GAAG,EAAE,IAAI,EAAE;QAC1B,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,qBAAqB;QAC9B,SAAS,EAAE,IAAI,GAAG,IAAI;QACtB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,GAA8B;IAC9D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/B,0EAA0E;QAC1E,2EAA2E;QAC3E,oCAAoC;QACpC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAClF,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,GAAQ;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACpG,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,GAAG,GAAG,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,+EAA+E;AAC/E,SAAgB,gBAAgB,CAAC,WAAmB,EAAE,cAAsB;IAC1E,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,2DAA2D;IAC3D,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,cAAc,CAC5B,IAAY,EACZ,IAAwB,EACxB,UAAqC;IAErC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAE1D,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,mEAAmE;IACnE,IACE,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,KAAK;QAChB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QACrB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAC1B,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EACtB,CAAC;QACD,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAA6B,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,8EAA8E;QAC9E,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACrC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,SAAS,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,SAAS;YAAE,SAAS;QAC5D,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB;QAC1E,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpF,SAAS;QACX,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,GAAsB,EAAE,QAAgB;IACxD,wEAAwE;IACxE,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,KAAK,GACT,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC;QAC1D,CAAC,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,GAAG;YAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,WAAW,GAAG,uEAAuE,CAAC;AAE5F,6DAA6D;AAC7D,SAAgB,aAAa,CAAC,MAAc;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,iDAAiD;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,MAAc;IAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED,kFAAkF;AAClF,SAAgB,gBAAgB,CAAC,MAAc;IAC7C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;gBACpB,YAAY,GAAG,KAAK,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC/C,IAAI,IAAI;gBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACvD,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CACnB,IAAsB,EACtB,QAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,aAAiC,CAAC;IAEtC,+EAA+E;IAC/E,4CAA4C;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IACpD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,kCAAkC,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC;QAClC,IAAI,IAAI;YAAE,aAAa,GAAG,IAAI,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChF,IAAI,OAAO,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;YACnG,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,+CAA+C,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,mDAAmD;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,gCAAgC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,IAAI,GAAG;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;IAC7F,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CACf,IAAsB,EACtB,QAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,+BAA+B,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;QACtE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,8BAA8B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,aAAa,GACjB,MAAM,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,MAAM,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,KAAK,GAAG,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC;IACrC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;YACrC,aAAa;YACb,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,SAAiB,EAAE,OAAyB,EAAE;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,2BAA2B,SAAS,EAAE,CAAC,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzF,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC;IAC7C,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,cAA+C,CAAC;IACpD,IAAI,QAAQ,KAAK,OAAO;QAAE,cAAc,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;SAC1E,IAAI,QAAQ,KAAK,QAAQ;QAAE,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;;QAC5E,cAAc,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEhF,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE1C,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,MAAM,GAAG,SAAS,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IAEzF,IAAI,cAAc,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,OAAO;YACL,QAAQ,EAAE,cAAc,CAAC,GAAG;YAC5B,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,aAAa,EAAE,cAAc,CAAC,aAAa;YAC3C,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC3D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,SAAgB,aAAa,CAAC,UAA2B;IACvD,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,UAAU,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,UAAU,CAAC,MAAM,GAAG,CAAC;IACrF,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,gCAAgC,UAAU,CAAC,UAAU,GAAG,CAAC;IAClE,CAAC;IACD,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;QAC7B,OAAO,CACL,8EAA8E;YAC9E,MAAM,UAAU,CAAC,aAAa,sCAAsC;YACpE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,iCAAiC,CAAC;AAC3C,CAAC;AAED,yDAAyD;AACzD,SAAgB,cAAc,CAAC,QAAgB;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;YACrB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/enterpriseTrust.d.ts

@@ -0,0 +1,188 @@
+import { type SpawnSyncReturns } from 'child_process';
+/**
+ * enterpriseTrust — read the MACHINE's trust decision, and add it to ours.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * Retail and restaurant chains run TLS-inspecting proxies: every outbound
+ * HTTPS connection is terminated by an appliance which re-signs it with a
+ * private enterprise root. That root is installed on the machine, so every
+ * browser on it works. Node does NOT read the platform trust store — it ships
+ * its own Mozilla-derived list and consults nothing else — so the connector was
+ * the one thing on the machine that could not talk to us.
+ *
+ * The failure had the worst possible shape. On a fresh install `uv` died first
+ * and the installer aborted blaming local AI; on the REPAIR path (where uv and
+ * litert-lm are already present, `setup-litertlm.ps1`'s `Test-LitertLmCli`
+ * short-circuit) the install COMPLETED and the connector then silently could
+ * not reach the API — a background process, no window, on a machine the
+ * customer believes is working.
+ *
+ * WHAT THIS IS NOT
+ * ----------------
+ * It is not a way to skip verification. There is no `rejectUnauthorized:false`
+ * here or anywhere in this tree and there must never be one — a connector that
+ * accepts any certificate is strictly worse than one that cannot connect,
+ * because it fails silently and in the customer's favour-looking direction.
+ * What we do is ADD the roots the machine's owner has already chosen to trust.
+ * Node's bundled list is always kept as the base (see `buildCaBundle`), so this
+ * can only ever widen trust to what this machine already trusts, never narrow
+ * it and never bypass it.
+ *
+ * RUNTIME RESOLUTION, NOT AN INSTALL-TIME EXPORT
+ * ----------------------------------------------
+ * The other design on the table was to export the machine roots to a .pem at
+ * install time and point `NODE_EXTRA_CA_CERTS` at it from the launcher. That is
+ * cheaper and it is wrong, for a reason specific to this product:
+ *
+ *   - The normal order of operations is domain-join, then install, then IT
+ *     ROTATES the inspection root (annually, or the day the appliance is
+ *     replaced). An exported bundle is a snapshot: at the next rotation the
+ *     connector breaks again with the exact same silent symptom.
+ *   - Nothing would re-export it. There is no auto-update on Windows
+ *     (cctv-connector-windows-gtm-readiness.md §5 — `install-update.ps1` is the
+ *     installer's own in-place upgrade path and nothing polls), so a stale
+ *     bundle would sit on the machine until the customer manually re-downloaded
+ *     2.6 GB.
+ *   - `NODE_EXTRA_CA_CERTS` is read ONCE at process start, so even a correct
+ *     file cannot be picked up without a restart.
+ *
+ * So we read the store at runtime, cache it for `TRUST_CACHE_TTL_MS`, and
+ * invalidate eagerly the moment a certificate-verification failure is
+ * classified (`invalidateTrustAnchorCache`, called from the transport). A root
+ * installed by IT while the connector is running is therefore picked up on the
+ * next cadence tick without a restart, which is the behaviour an operator on
+ * the phone with IT actually needs.
+ *
+ * `NODE_EXTRA_CA_CERTS` is still honoured — see `readNodeExtraCaCerts`. That
+ * matters more than it looks: passing `ca:` to a request REPLACES Node's
+ * resolved CA set, which silently disables `NODE_EXTRA_CA_CERTS` for that
+ * request. An admin who had already worked around this bug with that variable
+ * would have had their workaround broken by the fix. We read it ourselves.
+ */
+/** How long a trust-store read is reused before being taken again. */
+export declare const TRUST_CACHE_TTL_MS: number;
+export interface TrustAnchorSource {
+    /** Operator-facing name of the store, e.g. `LocalMachine\Root`. */
+    name: string;
+    /** How many distinct PEM certificates came from it. */
+    count: number;
+}
+export interface TrustAnchorResolution {
+    /** PEM blocks to ADD to Node's bundled roots. Deduplicated. */
+    certs: string[];
+    /** Which stores contributed, in read order. */
+    sources: TrustAnchorSource[];
+    /**
+     * Non-fatal problems. A warning here means "one store could not be read", not
+     * "trust is broken" — the others still contributed and Node's bundled roots
+     * are always present.
+     */
+    warnings: string[];
+    /** Epoch ms this snapshot was taken. It is a snapshot; see the file header. */
+    resolvedAtMs: number;
+    /** The platform whose stores were read (`process.platform` at read time). */
+    platform: NodeJS.Platform;
+}
+/** Injectable seams so the readers are testable off their native platform. */
+export interface TrustAnchorReadOptions {
+    platform?: NodeJS.Platform;
+    /** Replaces the subprocess runner (Windows/macOS store readers). */
+    exec?: (cmd: string, args: string[]) => SpawnSyncReturns<string>;
+    /** Replaces file reads (Linux bundles, NODE_EXTRA_CA_CERTS). */
+    readFile?: (p: string) => string;
+    /** Replaces the environment lookup (NODE_EXTRA_CA_CERTS, SSL_CERT_FILE). */
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * Pull the PEM blocks out of arbitrary text.
+ *
+ * Deliberately a scan and not a parse: `security find-certificate -p` and
+ * `/etc/ssl/certs/ca-certificates.crt` both interleave human-readable headers
+ * between blocks, and OpenSSL is happy to be handed the blocks alone.
+ */
+export declare function extractPemBlocks(text: string): string[];
+export declare function readWindowsTrustAnchors(opts?: TrustAnchorReadOptions): {
+    certs: string[];
+    sources: TrustAnchorSource[];
+    warnings: string[];
+};
+/**
+ * Subjects the admin has explicitly set to "Never Trust" in the admin domain.
+ *
+ * `security find-certificate` lists what is STORED in a keychain, not what is
+ * TRUSTED — a certificate the admin has explicitly denied is still returned by
+ * it. Promoting one of those to a trust anchor would invert the machine
+ * owner's decision, which is the exact opposite of what this module exists to
+ * honour. `dump-trust-settings -d` is the admin-domain override list; each
+ * entry names a certificate and its result type.
+ *
+ * Parsed loosely on purpose: an unreadable or absent settings list must mean
+ * "no explicit overrides", never "drop everything". Exported for the fixture
+ * tests, which drive it with the real command's output shape.
+ */
+export declare function parseDeniedTrustSubjects(dump: string): Set<string>;
+export declare function readMacTrustAnchors(opts?: TrustAnchorReadOptions): {
+    certs: string[];
+    sources: TrustAnchorSource[];
+    warnings: string[];
+};
+export declare function readLinuxTrustAnchors(opts?: TrustAnchorReadOptions): {
+    certs: string[];
+    sources: TrustAnchorSource[];
+    warnings: string[];
+};
+/**
+ * `NODE_EXTRA_CA_CERTS`, read EXPLICITLY.
+ *
+ * Node applies this variable to the default secure context. Passing `ca:` on a
+ * request replaces that context's CA set, so wiring an agent with `ca:` and
+ * nothing else would have silently disabled an admin's existing workaround for
+ * this very bug. We therefore read it ourselves and merge it in.
+ */
+export declare function readNodeExtraCaCerts(opts?: TrustAnchorReadOptions): {
+    certs: string[];
+    sources: TrustAnchorSource[];
+    warnings: string[];
+};
+/** Read every store this platform has. Uncached — see `resolveTrustAnchors`. */
+export declare function readPlatformTrustAnchors(opts?: TrustAnchorReadOptions): TrustAnchorResolution;
+/**
+ * The cached read. Callers on the request path use this; it costs one
+ * subprocess per TTL, not one per request.
+ *
+ * The cache holds ONE snapshot with no key, which is valid exactly while the
+ * platform and environment are process-wide constants — true in production, and
+ * NOT true when a caller injects them. An injected `platform`/`exec`/`readFile`/
+ * `env` therefore bypasses the cache in both directions: it neither reads a
+ * snapshot taken under a different environment nor publishes its own for
+ * someone else to read. (Same rule, same reason, as `resolveProxyCached`.)
+ */
+export declare function resolveTrustAnchors(opts?: TrustAnchorReadOptions): TrustAnchorResolution;
+/**
+ * Drop the cache so the next resolve re-reads the store.
+ *
+ * Called when a certificate-verification failure is classified: the single most
+ * likely explanation for one is that IT has just deployed (or is about to
+ * deploy) the inspection root, and re-reading is how the connector recovers
+ * without the restart nobody is there to perform.
+ */
+export declare function invalidateTrustAnchorCache(): void;
+/** For tests: the snapshot currently held, without taking a new one. */
+export declare function peekTrustAnchorCache(): TrustAnchorResolution | null;
+/**
+ * The `ca` value to hand to TLS: Node's bundled roots FIRST, then the machine's.
+ *
+ * Including `tls.rootCertificates` is the load-bearing half. `ca:` REPLACES the
+ * default set rather than extending it, so passing only the machine anchors
+ * would have made a connector on a normal network stop trusting the public web
+ * PKI — turning a corporate-network bug into a fleet-wide outage. Returns
+ * `undefined` when there is nothing to add, so the default context is used
+ * untouched on the overwhelming majority of hosts.
+ */
+export declare function buildCaBundle(anchors: TrustAnchorResolution): string[] | undefined;
+/** One operator-facing line describing what was resolved. */
+export declare function describeTrustAnchors(anchors: TrustAnchorResolution): string;
+/** Platform-appropriate instruction for getting a root INTO the store. */
+export declare function trustStoreInstallHint(platform?: NodeJS.Platform): string;
+//# sourceMappingURL=enterpriseTrust.d.ts.map

package/dist/enterpriseTrust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterpriseTrust.d.ts","sourceRoot":"","sources":["../src/enterpriseTrust.ts"],"names":[],"mappings":"AAIA,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AAUjD,MAAM,WAAW,iBAAiB;IAChC,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,+CAA+C;IAC/C,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC3B;AAED,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,oEAAoE;IACpE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACjE,gEAAgE;IAChE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACjC,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAeD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAOvD;AA2ED,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,sBAA2B,GAAG;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAuDA;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAYlE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,sBAA2B,GAAG;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAwCA;AAoED,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,sBAA2B,GAAG;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAyDA;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,sBAA2B,GAAG;IACvE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAuBA;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,sBAA2B,GAAG,qBAAqB,CAqCjG;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,sBAA2B,GAAG,qBAAqB,CAQ5F;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED,wEAAwE;AACxE,wBAAgB,oBAAoB,IAAI,qBAAqB,GAAG,IAAI,CAEnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,GAAG,SAAS,CAGlF;AAED,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAO3E;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,MAAM,CAoB1F"}