cloudops-cli 0.1.0

package/dist/commands/runbook.js

@@ -0,0 +1,265 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runbookListCommand = runbookListCommand;
+exports.runbookShowCommand = runbookShowCommand;
+exports.runbookExecuteCommand = runbookExecuteCommand;
+const chalk_1 = __importDefault(require("chalk"));
+const cli_table3_1 = __importDefault(require("cli-table3"));
+const api_client_1 = require("../api/api-client");
+/**
+ * List all available runbooks
+ */
+async function runbookListCommand(_options) {
+    console.log(chalk_1.default.bold.blue(`\n📚 Fetching runbooks...\n`));
+    try {
+        const apiClient = (0, api_client_1.createAPIClient)();
+        const runbooks = await apiClient.get('/api/v1/runbooks');
+        if (runbooks.length === 0) {
+            console.log(chalk_1.default.yellow('No runbooks found'));
+            console.log(chalk_1.default.gray('  Contact your administrator to create runbooks.'));
+            console.log();
+            return;
+        }
+        console.log(chalk_1.default.green(`✓ Found ${runbooks.length} runbook(s)\n`));
+        // Display runbooks in a table
+        const table = new cli_table3_1.default({
+            head: [
+                chalk_1.default.bold('Name'),
+                chalk_1.default.bold('Description'),
+                chalk_1.default.bold('Steps'),
+                chalk_1.default.bold('Approval Required'),
+                chalk_1.default.bold('Created By'),
+            ],
+            colWidths: [25, 35, 8, 18, 20],
+            wordWrap: true,
+        });
+        runbooks.forEach((runbook) => {
+            table.push([
+                chalk_1.default.cyan(runbook.name),
+                runbook.description || chalk_1.default.gray('No description'),
+                runbook.steps.length.toString(),
+                runbook.approval_required ? chalk_1.default.yellow('YES') : chalk_1.default.green('NO'),
+                runbook.created_by,
+            ]);
+        });
+        console.log(table.toString());
+        console.log();
+        // Show next steps
+        console.log(chalk_1.default.bold('Next Steps:'));
+        console.log(chalk_1.default.gray('  • View runbook details: cloudops runbook show <name>'));
+        console.log(chalk_1.default.gray('  • Execute runbook: cloudops runbook execute <name> --params KEY=VALUE'));
+        console.log();
+    }
+    catch (error) {
+        handleAPIError(error, 'list runbooks');
+    }
+}
+/**
+ * Show details of a specific runbook
+ */
+async function runbookShowCommand(name, _options) {
+    if (!name || name.trim().length === 0) {
+        console.error(chalk_1.default.red('Error: Runbook name is required'));
+        process.exit(1);
+    }
+    console.log(chalk_1.default.bold.blue(`\n📖 Fetching runbook details...\n`));
+    try {
+        const apiClient = (0, api_client_1.createAPIClient)();
+        const runbook = await apiClient.get(`/api/v1/runbooks/${encodeURIComponent(name)}`);
+        console.log(chalk_1.default.green('✓ Runbook found\n'));
+        // Display runbook metadata
+        const metadataTable = new cli_table3_1.default({
+            colWidths: [25, 55],
+            wordWrap: true,
+        });
+        metadataTable.push([chalk_1.default.bold('Runbook ID'), chalk_1.default.cyan(runbook.runbook_id)], [chalk_1.default.bold('Name'), runbook.name], [chalk_1.default.bold('Description'), runbook.description || chalk_1.default.gray('No description')], [chalk_1.default.bold('Total Steps'), runbook.steps.length.toString()], [chalk_1.default.bold('Approval Required'), runbook.approval_required ? chalk_1.default.yellow('YES') : chalk_1.default.green('NO')], [chalk_1.default.bold('Created By'), runbook.created_by], [chalk_1.default.bold('Created At'), new Date(runbook.created_at).toLocaleString()], [chalk_1.default.bold('Updated At'), new Date(runbook.updated_at).toLocaleString()]);
+        console.log(metadataTable.toString());
+        console.log();
+        // Display parameters if any
+        if (runbook.parameters && runbook.parameters.length > 0) {
+            console.log(chalk_1.default.bold('Parameters:\n'));
+            const paramTable = new cli_table3_1.default({
+                head: [
+                    chalk_1.default.bold('Name'),
+                    chalk_1.default.bold('Type'),
+                    chalk_1.default.bold('Required'),
+                    chalk_1.default.bold('Default'),
+                    chalk_1.default.bold('Description'),
+                ],
+                colWidths: [15, 10, 10, 15, 30],
+                wordWrap: true,
+            });
+            runbook.parameters.forEach((param) => {
+                paramTable.push([
+                    chalk_1.default.cyan(param.name),
+                    param.type,
+                    param.required ? chalk_1.default.yellow('YES') : chalk_1.default.gray('NO'),
+                    param.default !== undefined ? String(param.default) : chalk_1.default.gray('None'),
+                    param.description,
+                ]);
+            });
+            console.log(paramTable.toString());
+            console.log();
+        }
+        // Display steps
+        if (runbook.steps.length > 0) {
+            console.log(chalk_1.default.bold('Steps:\n'));
+            runbook.steps.forEach((step) => {
+                console.log(chalk_1.default.bold(`Step ${step.step_number}: `) + chalk_1.default.cyan(step.action));
+                console.log(chalk_1.default.gray(`  ${step.description}`));
+                if (step.parameters && Object.keys(step.parameters).length > 0) {
+                    console.log(chalk_1.default.gray('  Parameters:'));
+                    Object.entries(step.parameters).forEach(([key, value]) => {
+                        console.log(chalk_1.default.gray(`    ${key}: ${value}`));
+                    });
+                }
+                if (step.verification) {
+                    console.log(chalk_1.default.gray(`  Verification: ${step.verification}`));
+                }
+                if (step.step_number < runbook.steps.length) {
+                    console.log();
+                }
+            });
+            console.log();
+        }
+        // Show execution command
+        console.log(chalk_1.default.bold('Execute:'));
+        if (runbook.parameters && runbook.parameters.length > 0) {
+            const requiredParams = runbook.parameters
+                .filter((p) => p.required)
+                .map((p) => `${p.name}=<value>`)
+                .join(' ');
+            console.log(chalk_1.default.gray(`  cloudops runbook execute ${name} --params ${requiredParams}`));
+        }
+        else {
+            console.log(chalk_1.default.gray(`  cloudops runbook execute ${name}`));
+        }
+        console.log();
+    }
+    catch (error) {
+        handleAPIError(error, 'fetch runbook details');
+    }
+}
+/**
+ * Execute a runbook
+ */
+async function runbookExecuteCommand(name, options) {
+    if (!name || name.trim().length === 0) {
+        console.error(chalk_1.default.red('Error: Runbook name is required'));
+        process.exit(1);
+    }
+    console.log(chalk_1.default.bold.blue(`\n⚙️  Executing runbook...\n`));
+    try {
+        // Parse parameters from --params options
+        const parameters = {};
+        if (options.params && options.params.length > 0) {
+            options.params.forEach((param) => {
+                const [key, value] = param.split('=');
+                if (!key || value === undefined) {
+                    console.error(chalk_1.default.red(`Error: Invalid parameter format: ${param}`));
+                    console.error(chalk_1.default.gray('  Expected format: KEY=VALUE'));
+                    process.exit(1);
+                }
+                // Try to parse as number or boolean
+                if (value === 'true') {
+                    parameters[key] = true;
+                }
+                else if (value === 'false') {
+                    parameters[key] = false;
+                }
+                else if (!isNaN(Number(value))) {
+                    parameters[key] = Number(value);
+                }
+                else {
+                    parameters[key] = value;
+                }
+            });
+        }
+        // Build request body
+        const requestBody = {
+            runbook_name: name,
+            parameters: Object.keys(parameters).length > 0 ? parameters : undefined,
+        };
+        // Call execute endpoint
+        const apiClient = (0, api_client_1.createAPIClient)();
+        const response = await apiClient.post(`/api/v1/runbooks/${encodeURIComponent(name)}/execute`, requestBody);
+        // Display execution result
+        console.log(chalk_1.default.green('✓ Runbook execution initiated\n'));
+        const resultTable = new cli_table3_1.default({
+            colWidths: [25, 55],
+            wordWrap: true,
+        });
+        resultTable.push([chalk_1.default.bold('Execution ID'), chalk_1.default.cyan(response.execution_id)], [chalk_1.default.bold('Status'), formatExecutionStatus(response.status)], [chalk_1.default.bold('Started At'), new Date(response.started_at).toLocaleString()]);
+        console.log(resultTable.toString());
+        console.log();
+        // Show next steps based on status
+        if (response.status === 'pending_approval') {
+            console.log(chalk_1.default.bold('Next Steps:'));
+            console.log(chalk_1.default.yellow('  ⏳ Waiting for approval from designated approvers'));
+            console.log(chalk_1.default.gray('  • The runbook requires approval before execution'));
+            console.log(chalk_1.default.gray('  • Approvers will be notified via configured channels'));
+            console.log();
+        }
+        else if (response.status === 'executing') {
+            console.log(chalk_1.default.bold('Next Steps:'));
+            console.log(chalk_1.default.blue('  🔄 Runbook is executing...'));
+            console.log(chalk_1.default.gray('  • Monitor execution progress in your control plane'));
+            console.log();
+        }
+        else if (response.status === 'completed') {
+            console.log(chalk_1.default.green('  ✓ Runbook execution completed successfully'));
+            console.log();
+        }
+        else if (response.status === 'failed') {
+            console.log(chalk_1.default.red('  ✗ Runbook execution failed'));
+            console.log(chalk_1.default.gray('  • Check audit logs for details'));
+            console.log();
+        }
+    }
+    catch (error) {
+        handleAPIError(error, 'execute runbook');
+    }
+}
+/**
+ * Format execution status with color
+ */
+function formatExecutionStatus(status) {
+    const statusColors = {
+        pending_approval: chalk_1.default.yellow,
+        executing: chalk_1.default.blue,
+        completed: chalk_1.default.green,
+        failed: chalk_1.default.red,
+    };
+    const colorFn = statusColors[status] || chalk_1.default.white;
+    return colorFn(status.replace(/_/g, ' ').toUpperCase());
+}
+/**
+ * Handle API errors consistently
+ */
+function handleAPIError(error, action) {
+    if (error instanceof api_client_1.APIError) {
+        console.error(chalk_1.default.red(`\n✗ Failed to ${action}:`));
+        console.error(chalk_1.default.red(`  ${error.message}`));
+        if (error.statusCode === 401) {
+            console.error(chalk_1.default.yellow('\nAuthentication required. Please run: cloudops init'));
+        }
+        else if (error.statusCode === 403) {
+            console.error(chalk_1.default.yellow('\nAccess denied. Check your permissions.'));
+        }
+        else if (error.statusCode === 404) {
+            console.error(chalk_1.default.yellow('\nRunbook not found. Check the runbook name.'));
+        }
+        else if (error.details) {
+            console.error(chalk_1.default.gray('\nDetails:'), error.details);
+        }
+    }
+    else {
+        console.error(chalk_1.default.red(`\n✗ Unexpected error:`));
+        console.error(chalk_1.default.red(`  ${error instanceof Error ? error.message : 'Unknown error'}`));
+    }
+    process.exit(1);
+}
+//# sourceMappingURL=runbook.js.map

package/dist/commands/runbook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runbook.js","sourceRoot":"","sources":["../../src/commands/runbook.ts"],"names":[],"mappings":";;;;;AAoBA,gDAkDC;AAKD,gDA+GC;AAKD,sDAyFC;AAxRD,kDAA0B;AAC1B,4DAA+B;AAC/B,kDAA8D;AAe9D;;GAEG;AACI,KAAK,UAAU,kBAAkB,CAAC,QAAwB;IAC/D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAA,4BAAe,GAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAY,kBAAkB,CAAC,CAAC;QAEpE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,WAAW,QAAQ,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC;QAEpE,8BAA8B;QAC9B,MAAM,KAAK,GAAG,IAAI,oBAAK,CAAC;YACtB,IAAI,EAAE;gBACJ,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC;gBAClB,eAAK,CAAC,IAAI,CAAC,aAAa,CAAC;gBACzB,eAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBACnB,eAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC;gBAC/B,eAAK,CAAC,IAAI,CAAC,YAAY,CAAC;aACzB;YACD,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;YAC9B,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3B,KAAK,CAAC,IAAI,CAAC;gBACT,eAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBACxB,OAAO,CAAC,WAAW,IAAI,eAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBACnD,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC/B,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,KAAK,CAAC,IAAI,CAAC;gBACnE,OAAO,CAAC,UAAU;aACnB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,kBAAkB;QAClB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,QAAwB;IAExB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAEnE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAA,4BAAe,GAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,CAAU,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE7F,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAE9C,2BAA2B;QAC3B,MAAM,aAAa,GAAG,IAAI,oBAAK,CAAC;YAC9B,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;YACnB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,aAAa,CAAC,IAAI,CAChB,CAAC,eAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,eAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAC1D,CAAC,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAClC,CAAC,eAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,WAAW,IAAI,eAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAChF,CAAC,eAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAC5D,CAAC,eAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EACtG,CAAC,eAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,EAC9C,CAAC,eAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,cAAc,EAAE,CAAC,EACzE,CAAC,eAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,cAAc,EAAE,CAAC,CAC1E,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,4BAA4B;QAC5B,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;YAEzC,MAAM,UAAU,GAAG,IAAI,oBAAK,CAAC;gBAC3B,IAAI,EAAE;oBACJ,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC;oBAClB,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC;oBAClB,eAAK,CAAC,IAAI,CAAC,UAAU,CAAC;oBACtB,eAAK,CAAC,IAAI,CAAC,SAAS,CAAC;oBACrB,eAAK,CAAC,IAAI,CAAC,aAAa,CAAC;iBAC1B;gBACD,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;gBAC/B,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YAEH,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBACnC,UAAU,CAAC,IAAI,CAAC;oBACd,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;oBACtB,KAAK,CAAC,IAAI;oBACV,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC;oBACvD,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC;oBACxE,KAAK,CAAC,WAAW;iBAClB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,gBAAgB;QAChB,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAEpC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC7B,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChF,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBAEjD,IAAI,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC/D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;wBACvD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC;oBAClD,CAAC,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;oBACtB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;gBAClE,CAAC;gBAED,IAAI,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC5C,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,yBAAyB;QACzB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU;iBACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;iBACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC;iBAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,IAAI,CAAC,8BAA8B,IAAI,aAAa,cAAc,EAAE,CAAC,CAC5E,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,OAAuB;IAEvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAE7D,IAAI,CAAC;QACH,yCAAyC;QACzC,MAAM,UAAU,GAA8C,EAAE,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC/B,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBAChC,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,oCAAoC,KAAK,EAAE,CAAC,CAAC,CAAC;oBACtE,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC;oBAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBAED,oCAAoC;gBACpC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;oBACrB,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;gBACzB,CAAC;qBAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;oBAC7B,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC1B,CAAC;qBAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjC,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClC,CAAC;qBAAM,CAAC;oBACN,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC1B,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,qBAAqB;QACrB,MAAM,WAAW,GAA0B;YACzC,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SACxE,CAAC;QAEF,wBAAwB;QACxB,MAAM,SAAS,GAAG,IAAA,4BAAe,GAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,UAAU,EACtD,WAAW,CACZ,CAAC;QAEF,2BAA2B;QAC3B,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,IAAI,oBAAK,CAAC;YAC5B,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;YACnB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,WAAW,CAAC,IAAI,CACd,CAAC,eAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,eAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAC/D,CAAC,eAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAC9D,CAAC,eAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,cAAc,EAAE,CAAC,CAC3E,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,kCAAkC;QAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC,CAAC;YAClF,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,CAAC;YAChF,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC,CAAC;YACzE,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,YAAY,GAA6C;QAC7D,gBAAgB,EAAE,eAAK,CAAC,MAAM;QAC9B,SAAS,EAAE,eAAK,CAAC,IAAI;QACrB,SAAS,EAAE,eAAK,CAAC,KAAK;QACtB,MAAM,EAAE,eAAK,CAAC,GAAG;KAClB,CAAC;IAEF,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,eAAK,CAAC,KAAK,CAAC;IACpD,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,MAAc;IACpD,IAAI,KAAK,YAAY,qBAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,iBAAiB,MAAM,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAE/C,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;QACtF,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,0CAA0C,CAAC,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,8CAA8C,CAAC,CAAC,CAAC;QAC9E,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/config/__mocks__/config-handler.d.ts

@@ -0,0 +1,11 @@
+import { CLIConfig } from '@cloudops/shared';
+export declare class ConfigHandler {
+    private configPath;
+    constructor(configPath?: string);
+    readConfig(): CLIConfig;
+    writeConfig(_config: CLIConfig): void;
+    configExists(): boolean;
+    getConfigPath(): string;
+}
+export declare function getDefaultConfigHandler(): ConfigHandler;
+//# sourceMappingURL=config-handler.d.ts.map

package/dist/config/__mocks__/config-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-handler.d.ts","sourceRoot":"","sources":["../../../src/config/__mocks__/config-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAS;gBAEf,UAAU,CAAC,EAAE,MAAM;IAI/B,UAAU,IAAI,SAAS;IAUvB,WAAW,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI;IAErC,YAAY,IAAI,OAAO;IAIvB,aAAa,IAAI,MAAM;CAGxB;AAED,wBAAgB,uBAAuB,IAAI,aAAa,CAEvD"}

package/dist/config/__mocks__/config-handler.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigHandler = void 0;
+exports.getDefaultConfigHandler = getDefaultConfigHandler;
+class ConfigHandler {
+    configPath;
+    constructor(configPath) {
+        this.configPath = configPath || '~/.cloudops/config.yaml';
+    }
+    readConfig() {
+        return {
+            tenant_id: 'mock-tenant',
+            control_plane_url: 'https://mock-api.com',
+            auth: {
+                method: 'sso',
+            },
+        };
+    }
+    writeConfig(_config) { }
+    configExists() {
+        return true;
+    }
+    getConfigPath() {
+        return this.configPath;
+    }
+}
+exports.ConfigHandler = ConfigHandler;
+function getDefaultConfigHandler() {
+    return new ConfigHandler();
+}
+//# sourceMappingURL=config-handler.js.map

package/dist/config/__mocks__/config-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-handler.js","sourceRoot":"","sources":["../../../src/config/__mocks__/config-handler.ts"],"names":[],"mappings":";;;AA8BA,0DAEC;AA9BD,MAAa,aAAa;IAChB,UAAU,CAAS;IAE3B,YAAY,UAAmB;QAC7B,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI,yBAAyB,CAAC;IAC5D,CAAC;IAED,UAAU;QACR,OAAO;YACL,SAAS,EAAE,aAAa;YACxB,iBAAiB,EAAE,sBAAsB;YACzC,IAAI,EAAE;gBACJ,MAAM,EAAE,KAAK;aACd;SACF,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,OAAkB,IAAS,CAAC;IAExC,YAAY;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF;AA1BD,sCA0BC;AAED,SAAgB,uBAAuB;IACrC,OAAO,IAAI,aAAa,EAAE,CAAC;AAC7B,CAAC"}

package/dist/config/certificate-pinning.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Certificate Pinning Configuration for CloudOps CLI
+ *
+ * Implements certificate pinning to prevent man-in-the-middle attacks
+ * when communicating with the control plane API.
+ */
+import https from 'https';
+/**
+ * Certificate pin configuration
+ */
+export interface CertificatePin {
+    hostname: string;
+    fingerprints: string[];
+}
+/**
+ * Load certificate pins from configuration file
+ *
+ * Pins are stored in ~/.cloudops/certificate-pins.json
+ */
+export declare function loadCertificatePins(): CertificatePin[];
+/**
+ * Save certificate pins to configuration file
+ */
+export declare function saveCertificatePins(pins: CertificatePin[]): void;
+/**
+ * Get certificate pins for a hostname
+ */
+export declare function getPinsForHostname(hostname: string): string[];
+/**
+ * Add certificate pin for a hostname
+ */
+export declare function addCertificatePin(hostname: string, fingerprint: string): void;
+/**
+ * Remove certificate pin for a hostname
+ */
+export declare function removeCertificatePin(hostname: string, fingerprint?: string): void;
+/**
+ * Create HTTPS agent with certificate pinning
+ *
+ * This agent validates the server certificate against pinned fingerprints.
+ */
+export declare function createPinnedHttpsAgent(hostname: string): https.Agent;
+/**
+ * Fetch and display server certificate fingerprint
+ *
+ * Useful for initial setup and certificate rotation.
+ */
+export declare function fetchCertificateFingerprint(hostname: string, port?: number): Promise<string>;
+/**
+ * Validate certificate pinning configuration
+ *
+ * Checks that pins are properly formatted and not expired.
+ */
+export declare function validateCertificatePins(pins: CertificatePin[]): {
+    isValid: boolean;
+    errors: string[];
+};
+/**
+ * Check if certificate pinning is enabled for a hostname
+ */
+export declare function isCertificatePinningEnabled(hostname: string): boolean;
+/**
+ * Disable certificate pinning for a hostname
+ *
+ * This should only be used in development/testing environments.
+ */
+export declare function disableCertificatePinning(hostname: string): void;
+//# sourceMappingURL=certificate-pinning.d.ts.map

package/dist/config/certificate-pinning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate-pinning.d.ts","sourceRoot":"","sources":["../../src/config/certificate-pinning.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAM1B;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAoBD;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,EAAE,CAetD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,IAAI,CAUhE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAI7D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAgB7E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAuBjF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,CAAC,KAAK,CA8CpE;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,MAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBvG;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG;IAC/D,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CA6BA;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGrE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMhE"}

package/dist/config/certificate-pinning.js

@@ -0,0 +1,249 @@
+"use strict";
+/**
+ * Certificate Pinning Configuration for CloudOps CLI
+ *
+ * Implements certificate pinning to prevent man-in-the-middle attacks
+ * when communicating with the control plane API.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadCertificatePins = loadCertificatePins;
+exports.saveCertificatePins = saveCertificatePins;
+exports.getPinsForHostname = getPinsForHostname;
+exports.addCertificatePin = addCertificatePin;
+exports.removeCertificatePin = removeCertificatePin;
+exports.createPinnedHttpsAgent = createPinnedHttpsAgent;
+exports.fetchCertificateFingerprint = fetchCertificateFingerprint;
+exports.validateCertificatePins = validateCertificatePins;
+exports.isCertificatePinningEnabled = isCertificatePinningEnabled;
+exports.disableCertificatePinning = disableCertificatePinning;
+const https_1 = __importDefault(require("https"));
+const tls_1 = __importDefault(require("tls"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+/**
+ * Default certificate pins for CloudOps control plane
+ *
+ * In production, these should be updated with actual certificate fingerprints.
+ * Pins should be rotated before certificate expiration.
+ */
+const DEFAULT_PINS = [
+    {
+        hostname: 'api.cloudops.example.com',
+        fingerprints: [
+        // Primary certificate fingerprint
+        // 'AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99',
+        // Backup certificate fingerprint (for rotation)
+        // 'BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA',
+        ],
+    },
+];
+/**
+ * Load certificate pins from configuration file
+ *
+ * Pins are stored in ~/.cloudops/certificate-pins.json
+ */
+function loadCertificatePins() {
+    const configDir = path_1.default.join(os_1.default.homedir(), '.cloudops');
+    const pinsFile = path_1.default.join(configDir, 'certificate-pins.json');
+    try {
+        if (fs_1.default.existsSync(pinsFile)) {
+            const content = fs_1.default.readFileSync(pinsFile, 'utf-8');
+            const pins = JSON.parse(content);
+            return pins;
+        }
+    }
+    catch (error) {
+        console.warn('Failed to load certificate pins, using defaults:', error);
+    }
+    return DEFAULT_PINS;
+}
+/**
+ * Save certificate pins to configuration file
+ */
+function saveCertificatePins(pins) {
+    const configDir = path_1.default.join(os_1.default.homedir(), '.cloudops');
+    const pinsFile = path_1.default.join(configDir, 'certificate-pins.json');
+    // Ensure config directory exists
+    if (!fs_1.default.existsSync(configDir)) {
+        fs_1.default.mkdirSync(configDir, { recursive: true, mode: 0o700 });
+    }
+    fs_1.default.writeFileSync(pinsFile, JSON.stringify(pins, null, 2), { mode: 0o600 });
+}
+/**
+ * Get certificate pins for a hostname
+ */
+function getPinsForHostname(hostname) {
+    const pins = loadCertificatePins();
+    const pin = pins.find(p => p.hostname === hostname);
+    return pin?.fingerprints || [];
+}
+/**
+ * Add certificate pin for a hostname
+ */
+function addCertificatePin(hostname, fingerprint) {
+    const pins = loadCertificatePins();
+    const existingPin = pins.find(p => p.hostname === hostname);
+    if (existingPin) {
+        if (!existingPin.fingerprints.includes(fingerprint)) {
+            existingPin.fingerprints.push(fingerprint);
+        }
+    }
+    else {
+        pins.push({
+            hostname,
+            fingerprints: [fingerprint],
+        });
+    }
+    saveCertificatePins(pins);
+}
+/**
+ * Remove certificate pin for a hostname
+ */
+function removeCertificatePin(hostname, fingerprint) {
+    const pins = loadCertificatePins();
+    if (fingerprint) {
+        // Remove specific fingerprint
+        const pin = pins.find(p => p.hostname === hostname);
+        if (pin) {
+            pin.fingerprints = pin.fingerprints.filter(fp => fp !== fingerprint);
+            if (pin.fingerprints.length === 0) {
+                // Remove entire pin if no fingerprints left
+                const index = pins.indexOf(pin);
+                pins.splice(index, 1);
+            }
+        }
+    }
+    else {
+        // Remove all pins for hostname
+        const index = pins.findIndex(p => p.hostname === hostname);
+        if (index !== -1) {
+            pins.splice(index, 1);
+        }
+    }
+    saveCertificatePins(pins);
+}
+/**
+ * Create HTTPS agent with certificate pinning
+ *
+ * This agent validates the server certificate against pinned fingerprints.
+ */
+function createPinnedHttpsAgent(hostname) {
+    const pins = getPinsForHostname(hostname);
+    // If no pins configured, use standard secure agent
+    if (pins.length === 0) {
+        return new https_1.default.Agent({
+            minVersion: 'TLSv1.3',
+            maxVersion: 'TLSv1.3',
+            rejectUnauthorized: true,
+        });
+    }
+    // Create agent with certificate pinning
+    return new https_1.default.Agent({
+        minVersion: 'TLSv1.3',
+        maxVersion: 'TLSv1.3',
+        rejectUnauthorized: true,
+        checkServerIdentity: (host, cert) => {
+            // Verify hostname first
+            const hostnameError = tls_1.default.checkServerIdentity(host, cert);
+            if (hostnameError) {
+                return hostnameError;
+            }
+            // Verify certificate fingerprint
+            const fingerprint = cert.fingerprint256;
+            if (!fingerprint) {
+                return new Error('Certificate does not have SHA-256 fingerprint');
+            }
+            // Normalize fingerprint format
+            const normalizedFingerprint = fingerprint.replace(/:/g, '').toLowerCase();
+            const normalizedPins = pins.map(fp => fp.replace(/:/g, '').toLowerCase());
+            if (!normalizedPins.includes(normalizedFingerprint)) {
+                return new Error(`Certificate pinning failed: Server certificate fingerprint ${fingerprint} ` +
+                    `does not match any pinned certificates for ${hostname}. ` +
+                    `This could indicate a man-in-the-middle attack or certificate rotation. ` +
+                    `Please verify the server certificate and update pins if needed.`);
+            }
+            return undefined; // Certificate is valid
+        },
+    });
+}
+/**
+ * Fetch and display server certificate fingerprint
+ *
+ * Useful for initial setup and certificate rotation.
+ */
+async function fetchCertificateFingerprint(hostname, port = 443) {
+    return new Promise((resolve, reject) => {
+        const options = {
+            host: hostname,
+            port,
+            method: 'GET',
+            rejectUnauthorized: true,
+        };
+        const req = https_1.default.request(options, (res) => {
+            const cert = res.socket.getPeerCertificate();
+            if (cert && cert.fingerprint256) {
+                resolve(cert.fingerprint256);
+            }
+            else {
+                reject(new Error('Could not retrieve certificate fingerprint'));
+            }
+            res.resume(); // Consume response
+        });
+        req.on('error', reject);
+        req.end();
+    });
+}
+/**
+ * Validate certificate pinning configuration
+ *
+ * Checks that pins are properly formatted and not expired.
+ */
+function validateCertificatePins(pins) {
+    const errors = [];
+    for (const pin of pins) {
+        // Validate hostname
+        if (!pin.hostname || typeof pin.hostname !== 'string') {
+            errors.push('Invalid hostname in certificate pin');
+            continue;
+        }
+        // Validate fingerprints
+        if (!Array.isArray(pin.fingerprints) || pin.fingerprints.length === 0) {
+            errors.push(`No fingerprints configured for ${pin.hostname}`);
+            continue;
+        }
+        // Validate fingerprint format (SHA-256 is 64 hex chars with optional colons)
+        for (const fp of pin.fingerprints) {
+            const normalized = fp.replace(/:/g, '');
+            if (!/^[a-fA-F0-9]{64}$/.test(normalized)) {
+                errors.push(`Invalid fingerprint format for ${pin.hostname}: ${fp}`);
+            }
+        }
+    }
+    return {
+        isValid: errors.length === 0,
+        errors,
+    };
+}
+/**
+ * Check if certificate pinning is enabled for a hostname
+ */
+function isCertificatePinningEnabled(hostname) {
+    const pins = getPinsForHostname(hostname);
+    return pins.length > 0;
+}
+/**
+ * Disable certificate pinning for a hostname
+ *
+ * This should only be used in development/testing environments.
+ */
+function disableCertificatePinning(hostname) {
+    if (process.env.NODE_ENV === 'production') {
+        throw new Error('Cannot disable certificate pinning in production');
+    }
+    removeCertificatePin(hostname);
+}
+//# sourceMappingURL=certificate-pinning.js.map