@trillboards/edge-sdk 0.2.21 → 0.2.25

package/dist/enterpriseNetwork.js

@@ -0,0 +1,568 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnterpriseHttpsAgent = void 0;
+exports.resolveProxyCached = resolveProxyCached;
+exports.resetEnterpriseNetworkCaches = resetEnterpriseNetworkCaches;
+exports.refreshTrustAnchorsAfterFailure = refreshTrustAnchorsAfterFailure;
+exports.connectThroughProxy = connectThroughProxy;
+exports.createEnterpriseAgent = createEnterpriseAgent;
+exports.getEnterpriseAgent = getEnterpriseAgent;
+exports.describeNetworkPosture = describeNetworkPosture;
+exports.installEnterpriseNetworking = installEnterpriseNetworking;
+exports.uninstallEnterpriseNetworking = uninstallEnterpriseNetworking;
+exports.diagnoseTransportError = diagnoseTransportError;
+exports.applyHttpProxy = applyHttpProxy;
+const https = __importStar(require("https"));
+const net = __importStar(require("net"));
+const tls = __importStar(require("tls"));
+const enterpriseTrust_1 = require("./enterpriseTrust");
+const enterpriseProxy_1 = require("./enterpriseProxy");
+const transportFailure_1 = require("./transportFailure");
+/**
+ * enterpriseNetwork — one agent that carries the machine's trust and the
+ * machine's proxy, installed once, used by everything.
+ *
+ * The connector had THREE TLS stacks and only one of them (the installer's
+ * Schannel calls) could see an enterprise root. This closes the Node one. The
+ * uv one is closed in `deploy/windows/setup-litertlm.ps1` and
+ * `deploy/macos/scripts/setup-litertlm.sh` by exporting `UV_SYSTEM_CERTS` /
+ * `UV_NATIVE_TLS` and the resolved proxy into uv's environment — uv has its own
+ * platform-verifier and does NOT auto-discover a Windows proxy, so both halves
+ * have to be handed to it explicitly.
+ *
+ * `installEnterpriseNetworking()` replaces `https.globalAgent`. That is a
+ * deliberate process-wide install and not a shortcut: eight modules across
+ * three packages construct `node:https` requests directly (`AudienceAnalyzeClient`,
+ * `cli`, `autoSense`, `diagnose`, `mcp-server`, `LiteRtVlmProvider`,
+ * `edge-core/ModelManager`, `edge-federated/FederatedModelClient`), several of
+ * them with the bare `https.get(url, cb)` form that takes no options at all.
+ * Threading an agent through every one of them would have left whichever site
+ * was missed failing exactly as before, silently — and the model OTA
+ * (`ModelManager`) is in a different package, so it could not have been reached
+ * any other way. One install covers every https call the process makes.
+ *
+ * Loopback is never proxied (see `findBypassRule`), so the local litert-lm
+ * server on `127.0.0.1:9379` is untouched.
+ */
+/**
+ * How long a per-host proxy decision is reused.
+ *
+ * Long, and deliberately: on Windows and macOS a resolution costs a SYNCHRONOUS
+ * subprocess (`reg.exe`/`netsh.exe`, `scutil`) taken inside `createConnection`,
+ * which blocks the event loop — and on a 32-camera connector the event loop is
+ * the capture scheduler for every other feed. The answer is a per-machine
+ * constant that changes on the timescale of an IT ticket, `installEnterpriseNetworking`
+ * warms it for the API host at startup, and every feed shares that one host, so
+ * the steady-state cost is one resolution per interval for the whole process.
+ * Matches `TRUST_CACHE_TTL_MS` so the two do not drift.
+ */
+const PROXY_CACHE_TTL_MS = 30 * 60 * 1000;
+/** Minimum spacing between forced trust-store re-reads after a trust failure. */
+const TRUST_REFRESH_MIN_INTERVAL_MS = 60 * 1000;
+const proxyCache = new Map();
+/**
+ * Cached `resolveProxyForUrl`. The cache exists because resolving costs a
+ * subprocess on Windows and macOS and the answer is a per-machine constant that
+ * changes on the timescale of an IT ticket, not a request.
+ *
+ * The cache is keyed on the TARGET only, so it is valid exactly while the
+ * environment is a process-wide constant — which it is in production and is
+ * NOT when a caller injects one. An injected `env`/`platform`/`exec` therefore
+ * bypasses the cache in both directions: it neither reads a decision taken
+ * under a different environment nor publishes its own for someone else to
+ * read. Without that, two agents built with different proxies in the same
+ * process silently share the first one's answer.
+ */
+function resolveProxyCached(targetUrl, opts = {}) {
+    const injected = Boolean(opts.env || opts.platform || opts.exec);
+    if (injected)
+        return (0, enterpriseProxy_1.resolveProxyForUrl)(targetUrl, opts);
+    let key;
+    try {
+        const url = new URL(targetUrl);
+        key = `${url.protocol}//${url.host}`;
+    }
+    catch {
+        key = targetUrl;
+    }
+    const now = Date.now();
+    const hit = proxyCache.get(key);
+    if (hit && now - hit.atMs < PROXY_CACHE_TTL_MS)
+        return hit.resolution;
+    const resolution = (0, enterpriseProxy_1.resolveProxyForUrl)(targetUrl, opts);
+    proxyCache.set(key, { resolution, atMs: now });
+    return resolution;
+}
+/** Drop every cached network decision. Used by tests and by `diagnose`. */
+function resetEnterpriseNetworkCaches() {
+    proxyCache.clear();
+    (0, enterpriseTrust_1.invalidateTrustAnchorCache)();
+    lastTrustRefreshAtMs = 0;
+}
+let lastTrustRefreshAtMs = 0;
+/**
+ * Re-read the trust store after a certificate failure, at most once a minute.
+ *
+ * The point of the whole runtime-resolution design: an operator on the phone
+ * with IT gets the root installed, and the connector picks it up on the next
+ * cadence tick instead of needing a restart nobody is present to perform.
+ * Returns whether a re-read was actually armed, so the caller can say so.
+ */
+function refreshTrustAnchorsAfterFailure(now = Date.now()) {
+    if (now - lastTrustRefreshAtMs < TRUST_REFRESH_MIN_INTERVAL_MS)
+        return false;
+    lastTrustRefreshAtMs = now;
+    (0, enterpriseTrust_1.invalidateTrustAnchorCache)();
+    // DROPPING THE CACHE IS NOT ENOUGH, and this is the half that makes the whole
+    // runtime-resolution design real rather than merely described.
+    //
+    // The agent's `ca` was baked into its options when it was constructed. An
+    // invalidated cache only changes what the NEXT `resolveTrustAnchors()` call
+    // returns — and on the request path nothing calls it again, because the agent
+    // is a process-wide singleton. So the newly-installed root would have been
+    // read, correctly, into a value nobody consults, and the connector would have
+    // gone on refusing until a restart: exactly the behaviour the install-time
+    // export was rejected for. The agent has to be rebuilt.
+    //
+    // The old agent's pooled sockets are dropped with it. That is correct here:
+    // every one of them is either idle or already failing verification, and a
+    // keep-alive socket established under the OLD trust decision must not carry
+    // the next request anyway.
+    if (installedAgent) {
+        const previous = installedAgent;
+        installedAgent = createEnterpriseAgent((0, enterpriseTrust_1.resolveTrustAnchors)(), {});
+        setGlobalHttpsAgent(installedAgent);
+        previous.destroy();
+    }
+    return true;
+}
+/**
+ * An `https.Agent` that decides, per connection, whether to tunnel.
+ *
+ * Per-connection and not per-agent because `NO_PROXY` is a per-host rule: one
+ * process talks to `api.trillboards.com` (proxied) and `127.0.0.1:9379` (never
+ * proxied), and a single agent has to get both right.
+ */
+class EnterpriseHttpsAgent extends https.Agent {
+    constructor(options, netOptions = {}) {
+        super(options);
+        this.netOptions = netOptions;
+    }
+    createConnection(options, cb) {
+        const opts = options;
+        const host = String(opts.host ?? opts.servername ?? '');
+        const port = Number(opts.port ?? 443);
+        const targetUrl = `https://${host}:${port}`;
+        let decision;
+        try {
+            decision = resolveProxyCached(targetUrl, this.netOptions);
+        }
+        catch {
+            decision = { proxyUrl: null, source: 'none', warnings: [] };
+        }
+        if (!decision.proxyUrl) {
+            // Stock path, untouched — including TLS session resumption, which the
+            // base class does bookkeeping for and a hand-rolled tls.connect loses.
+            return https.Agent.prototype.createConnection.call(this, options, cb);
+        }
+        connectThroughProxy({
+            target: { host, port, servername: String(opts.servername ?? host) },
+            proxyUrl: decision.proxyUrl,
+            proxySource: decision.source,
+            tlsOptions: tunnelTlsOptions({ ...this.options, ...opts }),
+            callback: (err, socket) => {
+                // `createSocket` only invokes the callback when we return nothing, so a
+                // missing callback here would be a Node contract change, not a case to
+                // handle silently.
+                cb(err, socket);
+            },
+        });
+        return undefined;
+    }
+}
+exports.EnterpriseHttpsAgent = EnterpriseHttpsAgent;
+/**
+ * The TLS options that survive into the tunnel.
+ *
+ * A CONNECT tunnel hands `tls.connect` an already-open socket, so every
+ * connection-addressing key on the agent's merged options is at best ignored
+ * and at worst wrong there — `path` in particular would be read as a Unix
+ * socket path. Keeping an explicit allowlist means a future agent option cannot
+ * silently change tunnel behaviour, and it keeps the set of things that could
+ * possibly weaken verification down to the ones named here.
+ */
+function tunnelTlsOptions(merged) {
+    const allowed = [
+        'ca',
+        'cert',
+        'key',
+        'passphrase',
+        'pfx',
+        'ciphers',
+        'minVersion',
+        'maxVersion',
+        'ALPNProtocols',
+        'secureProtocol',
+        'secureOptions',
+        'sessionTimeout',
+        'checkServerIdentity',
+    ];
+    const out = {};
+    for (const key of allowed) {
+        if (merged[key] !== undefined)
+            out[key] = merged[key];
+    }
+    return out;
+}
+/**
+ * Wall-clock budget for TCP-connect + the `CONNECT` reply.
+ *
+ * Load-bearing, not defensive. A request's `timeout:` is applied by
+ * `http.ClientRequest` only once a socket has been ASSIGNED to it, so nothing
+ * bounds the window this function owns: a proxy address that blackholes packets
+ * (a decommissioned appliance, a firewall dropping rather than refusing) would
+ * hang inside `createConnection` until the OS TCP timeout — about 75 s on Linux,
+ * far past the client's own 30 s budget — and a tick that never settles takes
+ * that feed down until the process restarts. That is the exact shape of the
+ * already-documented `defaultHttpPoster` hang in
+ * docs/runbooks/cctv-connector-runtime-edge-cases.md §6.6, and it must not be
+ * reintroduced by the fix for a different problem.
+ */
+const PROXY_CONNECT_TIMEOUT_MS = 20000;
+/**
+ * Open a CONNECT tunnel and start TLS inside it.
+ *
+ * Hand-rolled because the SDK ships with no third-party HTTP dependency at all
+ * (`package.json` has jpeg-js/jsqr/pngjs and nothing network-facing) and is
+ * bundled into a self-contained tree; adding `proxy-agent` would pull a
+ * dependency graph into a signed customer artifact for ~90 lines of protocol.
+ *
+ * `rejectUnauthorized` is never touched here. The tunnel changes WHO carries
+ * the bytes; it does not change who we are willing to believe at the other end.
+ */
+function connectThroughProxy(args) {
+    const { target, proxyUrl, proxySource, tlsOptions, callback } = args;
+    const connectTimeoutMs = args.connectTimeoutMs ?? PROXY_CONNECT_TIMEOUT_MS;
+    const ctx = {
+        url: `https://${target.host}:${target.port}`,
+        proxyUrl,
+        proxySource,
+    };
+    let proxy;
+    try {
+        proxy = new URL(proxyUrl);
+    }
+    catch {
+        callback((0, transportFailure_1.classifyTransportError)(new Error(`unparseable proxy URL: ${(0, enterpriseProxy_1.redactProxyUrl)(proxyUrl)}`), ctx));
+        return;
+    }
+    if (/^socks/i.test(proxy.protocol)) {
+        callback(new transportFailure_1.TransportFailure({
+            failureClass: 'proxy_rejected',
+            code: 'PROXY_SOCKS_UNSUPPORTED',
+            url: ctx.url,
+            proxyUrl,
+            summary: `This machine is configured to use a SOCKS proxy (${(0, enterpriseProxy_1.redactProxyUrl)(proxyUrl)}), which the connector cannot use.`,
+            action: 'Ask IT for an HTTP CONNECT proxy for this machine and set HTTPS_PROXY to it, or ' +
+                'exempt api.trillboards.com from the SOCKS policy.',
+        }));
+        return;
+    }
+    const proxyPort = Number(proxy.port) || (proxy.protocol === 'https:' ? 443 : 80);
+    const authority = `${target.host}:${target.port}`;
+    const lines = [`CONNECT ${authority} HTTP/1.1`, `Host: ${authority}`];
+    if (proxy.username) {
+        const credentials = Buffer.from(`${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password || '')}`, 'utf-8').toString('base64');
+        lines.push(`Proxy-Authorization: Basic ${credentials}`);
+    }
+    lines.push('Proxy-Connection: keep-alive', '', '');
+    // The proxy hop itself may be TLS (an "HTTPS proxy"); when it is, it is
+    // verified with the same CA bundle. A proxy we cannot verify is still a
+    // certificate failure and still reported as one.
+    const outer = proxy.protocol === 'https:'
+        ? tls.connect({
+            host: proxy.hostname,
+            port: proxyPort,
+            servername: proxy.hostname,
+            ca: tlsOptions.ca,
+        })
+        : net.connect({ host: proxy.hostname, port: proxyPort });
+    let settled = false;
+    // `unref()` so a pending tunnel can never be the only thing holding the
+    // process open — the connector is a long-running background service and a
+    // stray handle at shutdown is indistinguishable from a wedge.
+    const deadline = setTimeout(() => {
+        fail(Object.assign(new Error(`the proxy did not answer CONNECT within ${connectTimeoutMs} ms ` +
+            '(it accepted the connection, or the packets are being dropped)'), { code: 'ETIMEDOUT' }));
+    }, connectTimeoutMs);
+    if (typeof deadline.unref === 'function')
+        deadline.unref();
+    const fail = (err) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(deadline);
+        outer.destroy();
+        callback(err instanceof transportFailure_1.TransportFailure ? err : (0, transportFailure_1.classifyTransportError)(err, ctx));
+    };
+    // Named so they can be removed individually once the tunnel is up. A blanket
+    // removeAllListeners() there would also take whatever `net`/`tls` has attached.
+    const onEarlyClose = () => {
+        if (settled)
+            return;
+        fail(Object.assign(new Error('the proxy closed the connection before answering CONNECT'), {
+            code: 'ECONNRESET',
+        }));
+    };
+    outer.once('error', fail);
+    outer.once('close', onEarlyClose);
+    const onReady = () => {
+        outer.write(lines.join('\r\n'));
+    };
+    if (proxy.protocol === 'https:')
+        outer.once('secureConnect', onReady);
+    else
+        outer.once('connect', onReady);
+    let head = Buffer.alloc(0);
+    const onData = (chunk) => {
+        head = Buffer.concat([head, chunk]);
+        const end = head.indexOf('\r\n\r\n');
+        if (end === -1) {
+            // A proxy that answers with an unbounded body instead of a status line
+            // must not be able to grow this buffer without limit.
+            if (head.length > 64 * 1024) {
+                fail(new Error('the proxy sent an oversized reply to CONNECT'));
+            }
+            return;
+        }
+        outer.removeListener('data', onData);
+        const statusLine = head.slice(0, head.indexOf('\r\n')).toString('latin1');
+        const match = statusLine.match(/^HTTP\/1\.[01] (\d{3})\s*(.*)$/);
+        const status = match ? Number(match[1]) : 0;
+        if (!match || status < 200 || status > 299) {
+            settled = true;
+            clearTimeout(deadline);
+            outer.destroy();
+            callback((0, transportFailure_1.proxyRejection)(status, match ? match[2] : statusLine.slice(0, 80), ctx));
+            return;
+        }
+        const residue = head.slice(end + 4);
+        if (residue.length > 0) {
+            // The server must wait for our ClientHello. Bytes here mean it is not
+            // speaking the tunnel protocol, and feeding them to TLS would produce an
+            // unreadable handshake error instead of this sentence.
+            fail(new Error('the proxy sent data before the tunnel was established'));
+            return;
+        }
+        settled = true;
+        clearTimeout(deadline);
+        outer.removeListener('error', fail);
+        outer.removeListener('close', onEarlyClose);
+        const secured = tls.connect({
+            ...tlsOptions,
+            socket: outer,
+            servername: target.servername || target.host,
+            // Explicitly restated, not inherited by accident: this is the line the
+            // whole change would be worthless without. A handshake failure inside the
+            // tunnel surfaces on the request and is classified there, by
+            // `diagnoseTransportError`, which re-reads the same cached proxy decision
+            // and so still says "via the proxy X".
+            rejectUnauthorized: true,
+        });
+        // The raw socket keeps its own error channel after the wrap, and an `error`
+        // with no listener is a process-level throw — on a connector that runs 24/7
+        // in a background process, that is an outage. Forward it into the TLS socket
+        // so it reaches the request and gets classified like any other failure.
+        outer.on('error', (err) => secured.destroy(err));
+        callback(null, secured);
+    };
+    outer.on('data', onData);
+}
+// ---------------------------------------------------------------------------
+// Install + posture
+// ---------------------------------------------------------------------------
+let installedAgent = null;
+/**
+ * Build (without installing) the agent for a set of resolved anchors.
+ * Exposed so a test can hold one without touching process globals.
+ */
+function createEnterpriseAgent(anchors, netOptions = {}, base = {}) {
+    const ca = (0, enterpriseTrust_1.buildCaBundle)(anchors);
+    return new EnterpriseHttpsAgent({
+        // Inherit whatever Node's own defaults currently are (keepAlive,
+        // scheduling, timeout) instead of restating them and drifting from them.
+        ...currentGlobalHttpsAgent().options,
+        ...base,
+        ...(ca ? { ca } : {}),
+    }, netOptions);
+}
+/**
+ * The process-wide agent. Built on first use and reused forever after — an
+ * agent owns a socket pool, so returning a fresh one per call would defeat
+ * keep-alive and leak a pool per request.
+ */
+function getEnterpriseAgent(netOptions = {}) {
+    if (!installedAgent) {
+        installedAgent = createEnterpriseAgent((0, enterpriseTrust_1.resolveTrustAnchors)(netOptions), netOptions);
+    }
+    return installedAgent;
+}
+/** What the connector resolved, for a startup line and for `diagnose`. */
+function describeNetworkPosture(apiBaseUrl, netOptions = {}) {
+    const trust = (0, enterpriseTrust_1.resolveTrustAnchors)(netOptions);
+    const proxy = resolveProxyCached(apiBaseUrl, netOptions);
+    const lines = [(0, enterpriseTrust_1.describeTrustAnchors)(trust), (0, enterpriseProxy_1.describeProxy)(proxy)];
+    for (const warning of [...trust.warnings, ...proxy.warnings])
+        lines.push(`note: ${warning}`);
+    return { trust, proxy, lines };
+}
+/**
+ * Install the enterprise agent as `https.globalAgent` and report what it found.
+ *
+ * Idempotent. Returns the posture so the caller can print it — printing is the
+ * caller's job because the CLI, the supervisor and `diagnose` each have their
+ * own output channel.
+ */
+function installEnterpriseNetworking(apiBaseUrl, netOptions = {}) {
+    const posture = describeNetworkPosture(apiBaseUrl, netOptions);
+    if (!installedAgent) {
+        installedAgent = createEnterpriseAgent(posture.trust, netOptions);
+    }
+    setGlobalHttpsAgent(installedAgent);
+    return posture;
+}
+/** Undo the install. Tests only — production installs once and never removes it. */
+function uninstallEnterpriseNetworking(original) {
+    installedAgent = null;
+    if (original)
+        setGlobalHttpsAgent(original);
+}
+/**
+ * `https.globalAgent` is typed readonly by @types/node but is a plain writable
+ * property on the real module object at runtime (verified on the bundled Node
+ * 22). Replacing it is the only way to reach the `https.get(url, cb)` call sites
+ * that take no options at all.
+ *
+ * THE `require` IS LOAD-BEARING, do not "tidy" it into the `import * as https`
+ * binding above. `import * as` compiles to TypeScript's `__importStar` namespace
+ * wrapper, whose properties are GETTERS — assigning through it throws
+ * `Cannot set property globalAgent of #<Object> which has only a getter`. That
+ * throw is caught by the CLI's installer, which logs a warning and carries on,
+ * so the whole process-wide install silently became a no-op in the COMPILED
+ * build while every test kept passing (the tests build their agent directly).
+ * It was found by running `dist/cli.js diagnose` and reading the first line.
+ */
+function setGlobalHttpsAgent(agent) {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const httpsModule = require('https');
+    httpsModule.globalAgent = agent;
+}
+/** The live `https.globalAgent`, read through the same real module object. */
+function currentGlobalHttpsAgent() {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    return require('https').globalAgent;
+}
+/**
+ * The one place a caught transport error becomes a diagnosis.
+ *
+ * Also arms a trust-store re-read when the failure was a trust failure, so the
+ * recovery path described in `enterpriseTrust` actually fires.
+ */
+function diagnoseTransportError(err, targetUrl) {
+    const proxy = (() => {
+        try {
+            return resolveProxyCached(targetUrl);
+        }
+        catch {
+            return { proxyUrl: null, source: 'none', warnings: [] };
+        }
+    })();
+    const failure = (0, transportFailure_1.classifyTransportError)(err, {
+        url: targetUrl,
+        proxyUrl: proxy.proxyUrl,
+        proxySource: proxy.source,
+        autoConfigUrl: proxy.autoConfigUrl,
+    });
+    if ((0, transportFailure_1.isTrustFailure)(failure.failureClass))
+        refreshTrustAnchorsAfterFailure();
+    return failure;
+}
+/**
+ * Rewrite request options so a PLAIN-HTTP target goes through the proxy.
+ *
+ * http through a forward proxy is absolute-form, not a tunnel: connect to the
+ * proxy and put the whole URL in the request line. Returns the options
+ * unchanged when no proxy applies. `https` never comes through here — it goes
+ * through the agent above.
+ */
+function applyHttpProxy(url, options, netOptions = {}) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return { options, proxyUrl: null };
+    }
+    if (parsed.protocol !== 'http:')
+        return { options, proxyUrl: null };
+    const decision = resolveProxyCached(url, netOptions);
+    if (!decision.proxyUrl)
+        return { options, proxyUrl: null };
+    let proxy;
+    try {
+        proxy = new URL(decision.proxyUrl);
+    }
+    catch {
+        return { options, proxyUrl: null };
+    }
+    const headers = { ...options.headers };
+    if (proxy.username) {
+        headers['Proxy-Authorization'] = `Basic ${Buffer.from(`${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password || '')}`, 'utf-8').toString('base64')}`;
+    }
+    return {
+        options: {
+            ...options,
+            protocol: 'http:',
+            host: proxy.hostname,
+            hostname: proxy.hostname,
+            port: Number(proxy.port) || 80,
+            path: parsed.toString(),
+            headers,
+        },
+        proxyUrl: decision.proxyUrl,
+    };
+}
+//# sourceMappingURL=enterpriseNetwork.js.map

package/dist/enterpriseNetwork.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterpriseNetwork.js","sourceRoot":"","sources":["../src/enterpriseNetwork.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyGA,gDAiBC;AAGD,oEAIC;AAYD,0EA2BC;AAqJD,kDAkKC;AAYD,sDAgBC;AAOD,gDAKC;AAGD,wDASC;AASD,kEAUC;AAGD,sEAGC;AAmCD,wDAgBC;AAUD,wCAwCC;AAhpBD,6CAA+B;AAC/B,yCAA2B;AAC3B,yCAA2B;AAG3B,uDAO2B;AAC3B,uDAM2B;AAC3B,yDAK4B;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,iFAAiF;AACjF,MAAM,6BAA6B,GAAG,EAAE,GAAG,IAAI,CAAC;AAoBhD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,SAAgB,kBAAkB,CAAC,SAAiB,EAAE,OAAiC,EAAE;IACvF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,QAAQ;QAAE,OAAO,IAAA,oCAAkB,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAEzD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,GAAG,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,GAAG,kBAAkB;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC;IACtE,MAAM,UAAU,GAAG,IAAA,oCAAkB,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACvD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,2EAA2E;AAC3E,SAAgB,4BAA4B;IAC1C,UAAU,CAAC,KAAK,EAAE,CAAC;IACnB,IAAA,4CAA0B,GAAE,CAAC;IAC7B,oBAAoB,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,IAAI,oBAAoB,GAAG,CAAC,CAAC;AAE7B;;;;;;;GAOG;AACH,SAAgB,+BAA+B,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;IACtE,IAAI,GAAG,GAAG,oBAAoB,GAAG,6BAA6B;QAAE,OAAO,KAAK,CAAC;IAC7E,oBAAoB,GAAG,GAAG,CAAC;IAC3B,IAAA,4CAA0B,GAAE,CAAC;IAE7B,8EAA8E;IAC9E,+DAA+D;IAC/D,EAAE;IACF,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,wDAAwD;IACxD,EAAE;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,2BAA2B;IAC3B,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,cAAc,CAAC;QAChC,cAAc,GAAG,qBAAqB,CAAC,IAAA,qCAAmB,GAAE,EAAE,EAAE,CAAC,CAAC;QAClE,mBAAmB,CAAC,cAAc,CAAC,CAAC;QACpC,QAAQ,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAsBD;;;;;;GAMG;AACH,MAAa,oBAAqB,SAAQ,KAAK,CAAC,KAAK;IAGnD,YAAY,OAA2B,EAAE,aAAuC,EAAE;QAChF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,gBAAgB,CACd,OAA+B,EAC/B,EAAyB;QAEzB,MAAM,IAAI,GAAG,OAAoC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC;QAC5C,IAAI,QAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,QAAQ,GAAG,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvB,sEAAsE;YACtE,uEAAuE;YACvE,OACE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,gBAIvB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;QAED,mBAAmB,CAAC;YAClB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE;YACnE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,WAAW,EAAE,QAAQ,CAAC,MAAM;YAC5B,UAAU,EAAE,gBAAgB,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;YAC1D,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;gBACxB,wEAAwE;gBACxE,uEAAuE;gBACvE,mBAAmB;gBAClB,EAA2B,CAAC,GAAG,EAAE,MAA2B,CAAC,CAAC;YACjE,CAAC;SACF,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAhDD,oDAgDC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,MAA+B;IACvD,MAAM,OAAO,GAAG;QACd,IAAI;QACJ,MAAM;QACN,KAAK;QACL,YAAY;QACZ,KAAK;QACL,SAAS;QACT,YAAY;QACZ,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,eAAe;QACf,gBAAgB;QAChB,qBAAqB;KACb,CAAC;IACX,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAA4B,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,wBAAwB,GAAG,KAAM,CAAC;AAYxC;;;;;;;;;;GAUG;AACH,SAAgB,mBAAmB,CAAC,IAAsB;IACxD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACrE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,wBAAwB,CAAC;IAC3E,MAAM,GAAG,GAAG;QACV,GAAG,EAAE,WAAW,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;QAC5C,QAAQ;QACR,WAAW;KACZ,CAAC;IAEF,IAAI,KAAU,CAAC;IACf,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CACN,IAAA,yCAAsB,EAAC,IAAI,KAAK,CAAC,0BAA0B,IAAA,gCAAc,EAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAC7F,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,QAAQ,CACN,IAAI,mCAAgB,CAAC;YACnB,YAAY,EAAE,gBAAgB;YAC9B,IAAI,EAAE,yBAAyB;YAC/B,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,QAAQ;YACR,OAAO,EAAE,oDAAoD,IAAA,gCAAc,EAAC,QAAQ,CAAC,oCAAoC;YACzH,MAAM,EACJ,kFAAkF;gBAClF,mDAAmD;SACtD,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,CAAC,WAAW,SAAS,WAAW,EAAE,SAAS,SAAS,EAAE,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,EACnF,OAAO,CACR,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,8BAA8B,WAAW,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAEnD,wEAAwE;IACxE,wEAAwE;IACxE,iDAAiD;IACjD,MAAM,KAAK,GACT,KAAK,CAAC,QAAQ,KAAK,QAAQ;QACzB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACV,IAAI,EAAE,KAAK,CAAC,QAAQ;YACpB,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,KAAK,CAAC,QAAQ;YAC1B,EAAE,EAAE,UAAU,CAAC,EAAE;SAClB,CAAC;QACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAE7D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,wEAAwE;IACxE,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;QAC/B,IAAI,CACF,MAAM,CAAC,MAAM,CACX,IAAI,KAAK,CACP,2CAA2C,gBAAgB,MAAM;YAC/D,gEAAgE,CACnE,EACD,EAAE,IAAI,EAAE,WAAW,EAAE,CACtB,CACF,CAAC;IACJ,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACrB,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,UAAU;QAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE3D,MAAM,IAAI,GAAG,CAAC,GAAY,EAAQ,EAAE;QAClC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvB,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,QAAQ,CAAC,GAAG,YAAY,mCAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,yCAAsB,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC;IAEF,6EAA6E;IAC7E,gFAAgF;IAChF,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,CACF,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0DAA0D,CAAC,EAAE;YACnF,IAAI,EAAE,YAAY;SACnB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAElC,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;;QACjE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAEpC,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;QACrC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,uEAAuE;YACvE,sDAAsD;YACtD,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAErC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YAC3C,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,KAAK,CAAC,OAAO,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAA,iCAAc,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,sEAAsE;YACtE,yEAAyE;YACzE,uDAAuD;YACvD,IAAI,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,OAAO,GAAG,IAAI,CAAC;QACf,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvB,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAE5C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC1B,GAAG,UAAU;YACb,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI;YAC5C,uEAAuE;YACvE,0EAA0E;YAC1E,6DAA6D;YAC7D,0EAA0E;YAC1E,uCAAuC;YACvC,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,IAAI,cAAc,GAAgC,IAAI,CAAC;AAEvD;;;GAGG;AACH,SAAgB,qBAAqB,CACnC,OAA8B,EAC9B,aAAuC,EAAE,EACzC,OAA2B,EAAE;IAE7B,MAAM,EAAE,GAAG,IAAA,+BAAa,EAAC,OAAO,CAAC,CAAC;IAClC,OAAO,IAAI,oBAAoB,CAC7B;QACE,iEAAiE;QACjE,yEAAyE;QACzE,GAAI,uBAAuB,EAAE,CAAC,OAA8B;QAC5D,GAAG,IAAI;QACP,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtB,EACD,UAAU,CACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,aAAuC,EAAE;IAC1E,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,qBAAqB,CAAC,IAAA,qCAAmB,EAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,0EAA0E;AAC1E,SAAgB,sBAAsB,CACpC,UAAkB,EAClB,aAAuC,EAAE;IAEzC,MAAM,KAAK,GAAG,IAAA,qCAAmB,EAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,CAAC,IAAA,sCAAoB,EAAC,KAAK,CAAC,EAAE,IAAA,+BAAa,EAAC,KAAK,CAAC,CAAC,CAAC;IAClE,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;IAC7F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,2BAA2B,CACzC,UAAkB,EAClB,aAAuC,EAAE;IAEzC,MAAM,OAAO,GAAG,sBAAsB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACpE,CAAC;IACD,mBAAmB,CAAC,cAAc,CAAC,CAAC;IACpC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oFAAoF;AACpF,SAAgB,6BAA6B,CAAC,QAAsB;IAClE,cAAc,GAAG,IAAI,CAAC;IACtB,IAAI,QAAQ;QAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,mBAAmB,CAAC,KAAkB;IAC7C,8DAA8D;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAiC,CAAC;IACrE,WAAW,CAAC,WAAW,GAAG,KAAK,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,SAAS,uBAAuB;IAC9B,8DAA8D;IAC9D,OAAQ,OAAO,CAAC,OAAO,CAAkC,CAAC,WAAW,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,GAAY,EAAE,SAAiB;IACpE,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE;QAClB,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAqB,CAAC;QAC7E,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,OAAO,GAAG,IAAA,yCAAsB,EAAC,GAAG,EAAE;QAC1C,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,CAAC;IACH,IAAI,IAAA,iCAAc,EAAC,OAAO,CAAC,YAAY,CAAC;QAAE,+BAA+B,EAAE,CAAC;IAC5E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAC5B,GAAW,EACX,OAA4B,EAC5B,aAAuC,EAAE;IAEzC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAE3D,IAAI,KAAU,CAAC;IACf,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAA2B,EAAE,GAAI,OAAO,CAAC,OAAkC,EAAE,CAAC;IAC3F,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,CAAC,qBAAqB,CAAC,GAAG,SAAS,MAAM,CAAC,IAAI,CACnD,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,EACnF,OAAO,CACR,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,OAAO;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,KAAK,CAAC,QAAQ;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YAC9B,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;YACvB,OAAO;SACR;QACD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC;AACJ,CAAC"}

package/dist/enterpriseProxy.d.ts

@@ -0,0 +1,73 @@
+import { type SpawnSyncReturns } from 'child_process';
+export type ProxySource = 'env' | 'wininet' | 'winhttp' | 'macos-scutil' | 'none';
+export interface ProxyResolution {
+    /** Absolute proxy URL (`http://host:port`), or null for a direct connection. */
+    proxyUrl: string | null;
+    /** Where the answer came from. `none` means no configuration was found. */
+    source: ProxySource;
+    /** The bypass rule that matched, when the target is excluded from the proxy. */
+    bypassedBy?: string;
+    /**
+     * A PAC / auto-config URL the platform names and this build cannot evaluate.
+     * Present ⇒ the machine HAS a proxy policy we could not follow, which is a
+     * very different statement from "no proxy", and the failure text says so.
+     */
+    autoConfigUrl?: string;
+    /** Non-fatal problems reading a source. */
+    warnings: string[];
+}
+export interface ProxyReadOptions {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    exec?: (cmd: string, args: string[]) => SpawnSyncReturns<string>;
+}
+/**
+ * Normalise whatever the platform gave us into an absolute proxy URL.
+ *
+ * WinINET stores `proxy:8080`, or a scheme-keyed list
+ * `http=p1:80;https=p2:8080`; `scutil` gives host and port separately; the
+ * environment usually has a full URL but is frequently set to a bare host:port.
+ * Returns null for anything that cannot be made into a URL, so a malformed
+ * setting degrades to DIRECT rather than to a crash on the request path.
+ */
+export declare function normalizeProxyUrl(raw: string | undefined | null): string | null;
+/** Pick the `https=` (or `http=`) entry out of a WinINET scheme-keyed list. */
+export declare function pickWinInetProxy(proxyServer: string, targetProtocol: string): string | null;
+/**
+ * Does a bypass list exempt this host?
+ *
+ * Accepts both the POSIX `NO_PROXY` vocabulary and the Windows `ProxyOverride`
+ * vocabulary, because the same function serves both:
+ *   `*`            — everything
+ *   `<local>`      — Windows: any hostname with no dot in it
+ *   `.corp.local`  — that suffix
+ *   `corp.local`   — that host and its subdomains
+ *   `*.corp.local` — same, wildcard spelling
+ *   `10.0.0.7`     — that literal address
+ *   `host:8080`    — that host, only on that port
+ *
+ * Returns the matching entry (so the caller can SAY which rule applied) or null.
+ */
+export declare function findBypassRule(host: string, port: number | undefined, bypassList: string | undefined | null): string | null;
+/** Parse `reg.exe query` output into a name -> value map. */
+export declare function parseRegQuery(stdout: string): Record<string, string>;
+/** Parse `netsh winhttp show proxy` output. */
+export declare function parseNetshWinhttp(stdout: string): {
+    server: string | null;
+    bypass: string | null;
+};
+/** Parse `scutil --proxy` output into a flat map (arrays are joined with `,`). */
+export declare function parseScutilProxy(stdout: string): Record<string, string>;
+/**
+ * The whole decision for one target URL: which proxy (if any), or why not.
+ *
+ * Pure with respect to its options, so the platform branches are all testable
+ * off their native platform — which is the only way the Windows path gets any
+ * coverage at all from a Linux CI lane.
+ */
+export declare function resolveProxyForUrl(targetUrl: string, opts?: ProxyReadOptions): ProxyResolution;
+/** One operator-facing line describing the proxy decision. */
+export declare function describeProxy(resolution: ProxyResolution): string;
+/** Strip proxy credentials before anything is logged. */
+export declare function redactProxyUrl(proxyUrl: string): string;
+//# sourceMappingURL=enterpriseProxy.d.ts.map

package/dist/enterpriseProxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterpriseProxy.d.ts","sourceRoot":"","sources":["../src/enterpriseProxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAwCjE,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,GAAG,MAAM,CAAC;AAElF,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2EAA2E;IAC3E,MAAM,EAAE,WAAW,CAAC;IACpB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,gBAAgB,CAAC,MAAM,CAAC,CAAC;CAClE;AAWD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAgB/E;AAgBD,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB3F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACpC,MAAM,GAAG,IAAI,CA4Cf;AAmBD,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASpE;AAED,+CAA+C;AAC/C,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAMlG;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwBvE;AA8ED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,eAAe,CAqDlG;AAED,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,UAAU,EAAE,eAAe,GAAG,MAAM,CAejE;AAED,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAWvD"}