galileo-generated 0.2.7 → 0.2.9

package/dist/commonjs/tests/hooks/cert-management.test.js

@@ -0,0 +1,794 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const cert_management_js_1 = require("../../hooks/cert-management.js");
+const galileo_config_js_1 = require("../../lib/galileo-config.js");
+const http_js_1 = require("../../lib/http.js");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const os_1 = require("os");
+// Mock runtime detection - default to Node.js environment
+const { mockIsNodeLike, mockIsBrowserLike } = vitest_1.vi.hoisted(() => ({
+    mockIsNodeLike: vitest_1.vi.fn(() => true),
+    mockIsBrowserLike: vitest_1.vi.fn(() => false),
+}));
+vitest_1.vi.mock('../../lib/runtime.js', () => ({
+    isNodeLike: mockIsNodeLike,
+    isBrowserLike: mockIsBrowserLike,
+    isDeno: vitest_1.vi.fn(() => false),
+}));
+const ENV_KEYS = [
+    'GALILEO_API_KEY',
+    'GALILEO_CA_CERT_PATH',
+    'SSL_CERT_FILE',
+    'NODE_EXTRA_CA_CERTS',
+    'GALILEO_CLIENT_CERT_PATH',
+    'GALILEO_CLIENT_KEY_PATH',
+    'GALILEO_REJECT_UNAUTHORIZED',
+    'NODE_TLS_REJECT_UNAUTHORIZED',
+];
+function clearEnv() {
+    for (const key of ENV_KEYS) {
+        delete process.env[key];
+    }
+}
+(0, vitest_1.describe)('CertManagementHook', () => {
+    let tmpDir;
+    let caCertPath;
+    let clientCertPath;
+    let clientKeyPath;
+    (0, vitest_1.beforeEach)(() => {
+        // Create temporary directory and test certificate files
+        tmpDir = (0, path_1.join)((0, os_1.tmpdir)(), `galileo-cert-test-${Date.now()}`);
+        (0, fs_1.mkdirSync)(tmpDir, { recursive: true });
+        caCertPath = (0, path_1.join)(tmpDir, 'ca.pem');
+        clientCertPath = (0, path_1.join)(tmpDir, 'client.pem');
+        clientKeyPath = (0, path_1.join)(tmpDir, 'key.pem');
+        (0, fs_1.writeFileSync)(caCertPath, '-----BEGIN CERTIFICATE-----\nMOCK_CA_CERT\n-----END CERTIFICATE-----');
+        (0, fs_1.writeFileSync)(clientCertPath, '-----BEGIN CERTIFICATE-----\nMOCK_CLIENT_CERT\n-----END CERTIFICATE-----');
+        (0, fs_1.writeFileSync)(clientKeyPath, '-----BEGIN PRIVATE KEY-----\nMOCK_PRIVATE_KEY\n-----END PRIVATE KEY-----');
+        // Default to Node.js environment
+        mockIsNodeLike.mockReturnValue(true);
+        mockIsBrowserLike.mockReturnValue(false);
+    });
+    (0, vitest_1.afterEach)(() => {
+        vitest_1.vi.clearAllMocks();
+        clearEnv();
+        galileo_config_js_1.GalileoConfig.reset();
+        // Clean up temporary directory
+        if (tmpDir) {
+            (0, fs_1.rmSync)(tmpDir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.describe)('sdkInit', () => {
+        (0, vitest_1.test)('test sdkInit returns httpClient when CA cert configured', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeDefined();
+            (0, vitest_1.expect)(result.httpClient).not.toBe(opts.httpClient);
+        });
+        (0, vitest_1.test)('test sdkInit returns httpClient when CA cert content configured', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertContent: '-----BEGIN CERTIFICATE-----\nMOCK_CONTENT\n-----END CERTIFICATE-----',
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeDefined();
+        });
+        (0, vitest_1.test)('test sdkInit returns httpClient with client certificates', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+                clientCertPath,
+                clientKeyPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeDefined();
+        });
+        (0, vitest_1.test)('test sdkInit returns original opts when no cert configured', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            (0, vitest_1.expect)(result).toBe(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeUndefined();
+        });
+        (0, vitest_1.test)('test sdkInit augments existing httpClient instead of replacing it', async () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const mockFetcher = vitest_1.vi.fn().mockResolvedValue(new Response());
+            const existingClient = new http_js_1.HTTPClient({ fetcher: mockFetcher });
+            const opts = {
+                serverURL: 'https://api.example.com',
+                httpClient: existingClient,
+            };
+            const result = hook.sdkInit(opts);
+            (0, vitest_1.expect)(result.serverURL).toBe(opts.serverURL);
+            (0, vitest_1.expect)(result.httpClient).toBeDefined();
+            // Most important: the same httpClient instance is returned, not a new one
+            (0, vitest_1.expect)(result.httpClient).toBe(existingClient);
+            // Verify that the TLS hook was added by making a request
+            const req = new Request('https://api.example.com/test', { method: 'GET' });
+            await result.httpClient?.request(req);
+            // The custom fetcher should have been called
+            (0, vitest_1.expect)(mockFetcher).toHaveBeenCalledTimes(1);
+            const callArgs = mockFetcher.mock.calls[0];
+            (0, vitest_1.expect)(callArgs).toBeDefined();
+            if (!callArgs)
+                throw new Error('unreachable');
+            const [calledReq] = callArgs;
+            // Verify dispatcher was injected into the request
+            (0, vitest_1.expect)(calledReq).toBeInstanceOf(Request);
+            (0, vitest_1.expect)(calledReq.url).toBe('https://api.example.com/test');
+        });
+        (0, vitest_1.test)('test sdkInit skips cert loading in browser environment', () => {
+            mockIsNodeLike.mockReturnValue(false);
+            mockIsBrowserLike.mockReturnValue(true);
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            (0, vitest_1.expect)(result).toBe(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeUndefined();
+        });
+        (0, vitest_1.test)('test sdkInit returns original opts when CA cert file missing', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath: '/nonexistent/ca.pem',
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            // When cert file is missing, no httpClient should be configured
+            (0, vitest_1.expect)(result).toBe(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeUndefined();
+        });
+        (0, vitest_1.test)('test sdkInit returns original opts when client key file missing', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+                clientCertPath,
+                clientKeyPath: '/nonexistent/key.pem',
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            (0, vitest_1.expect)(result).toBe(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeUndefined();
+        });
+        (0, vitest_1.test)('test sdkInit returns original opts when only client cert configured', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+                clientCertPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            // When only client cert is provided (missing key), should return original opts
+            (0, vitest_1.expect)(result).toBe(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeUndefined();
+        });
+        (0, vitest_1.test)('test sdkInit returns original opts when only client key configured', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+                clientKeyPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            // When only client key is provided (missing cert), should return original opts
+            (0, vitest_1.expect)(result).toBe(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeUndefined();
+        });
+        (0, vitest_1.test)('test sdkInit returns original opts when client cert file missing', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+                clientCertPath: '/nonexistent/cert.pem',
+                clientKeyPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            (0, vitest_1.expect)(result).toBe(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeUndefined();
+        });
+    });
+    (0, vitest_1.describe)('environment variable priority', () => {
+        (0, vitest_1.test)('test GALILEO_CA_CERT_PATH from env is used', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            process.env['GALILEO_API_KEY'] = 'env-key';
+            process.env['GALILEO_CA_CERT_PATH'] = caCertPath;
+            const config = galileo_config_js_1.GalileoConfig.get({});
+            const cert = config.getCertConfig();
+            (0, vitest_1.expect)(cert).not.toBeNull();
+            if (!cert)
+                throw new Error("unreachable");
+            (0, vitest_1.expect)(cert.caCertPath).toBe(caCertPath);
+        });
+        (0, vitest_1.test)('test only GALILEO_CA_CERT_PATH is supported for CA cert from env', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            process.env['GALILEO_API_KEY'] = 'env-key';
+            process.env['SSL_CERT_FILE'] = caCertPath;
+            const config = galileo_config_js_1.GalileoConfig.get({});
+            const cert = config.getCertConfig();
+            (0, vitest_1.expect)(cert).toBeNull();
+        });
+        (0, vitest_1.test)('test only GALILEO_CA_CERT_PATH is supported not NODE_EXTRA_CA_CERTS', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            process.env['GALILEO_API_KEY'] = 'env-key';
+            process.env['NODE_EXTRA_CA_CERTS'] = caCertPath;
+            const config = galileo_config_js_1.GalileoConfig.get({});
+            const cert = config.getCertConfig();
+            (0, vitest_1.expect)(cert).toBeNull();
+        });
+    });
+    (0, vitest_1.describe)('client certificate environment variables', () => {
+        (0, vitest_1.test)('test GALILEO_CLIENT_CERT_PATH and GALILEO_CLIENT_KEY_PATH from env', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            process.env['GALILEO_API_KEY'] = 'env-key';
+            process.env['GALILEO_CA_CERT_PATH'] = caCertPath;
+            process.env['GALILEO_CLIENT_CERT_PATH'] = clientCertPath;
+            process.env['GALILEO_CLIENT_KEY_PATH'] = clientKeyPath;
+            const config = galileo_config_js_1.GalileoConfig.get({});
+            const cert = config.getCertConfig();
+            (0, vitest_1.expect)(cert).not.toBeNull();
+            if (!cert)
+                throw new Error("unreachable");
+            (0, vitest_1.expect)(cert.clientCertPath).toBe(clientCertPath);
+            (0, vitest_1.expect)(cert.clientKeyPath).toBe(clientKeyPath);
+        });
+    });
+    (0, vitest_1.describe)('rejectUnauthorized configuration', () => {
+        (0, vitest_1.test)('test GALILEO_REJECT_UNAUTHORIZED takes priority over NODE_TLS_REJECT_UNAUTHORIZED', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            process.env['GALILEO_API_KEY'] = 'env-key';
+            process.env['GALILEO_CA_CERT_PATH'] = caCertPath;
+            process.env['GALILEO_REJECT_UNAUTHORIZED'] = 'false';
+            process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '1';
+            const config = galileo_config_js_1.GalileoConfig.get({});
+            const cert = config.getCertConfig();
+            (0, vitest_1.expect)(cert).not.toBeNull();
+            if (!cert)
+                throw new Error("unreachable");
+            (0, vitest_1.expect)(cert.rejectUnauthorized).toBe(false);
+        });
+        (0, vitest_1.test)('test NODE_TLS_REJECT_UNAUTHORIZED used when GALILEO_REJECT_UNAUTHORIZED absent', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            process.env['GALILEO_API_KEY'] = 'env-key';
+            process.env['GALILEO_CA_CERT_PATH'] = caCertPath;
+            process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0';
+            const config = galileo_config_js_1.GalileoConfig.get({});
+            const cert = config.getCertConfig();
+            (0, vitest_1.expect)(cert).not.toBeNull();
+            if (!cert)
+                throw new Error("unreachable");
+            (0, vitest_1.expect)(cert.rejectUnauthorized).toBe(false);
+        });
+        (0, vitest_1.test)('test rejectUnauthorized defaults to true when no env vars set', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            const config = galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const cert = config.getCertConfig();
+            (0, vitest_1.expect)(cert).not.toBeNull();
+            if (!cert)
+                throw new Error("unreachable");
+            // rejectUnauthorized is undefined in config, defaults to true in hook
+            (0, vitest_1.expect)(cert.rejectUnauthorized).toBeUndefined();
+        });
+        (0, vitest_1.test)('test sdkInit configures agent with custom CA cert even when rejectUnauthorized is true', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+                rejectUnauthorized: true,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            // Custom CA cert should be configured regardless of rejectUnauthorized value
+            // rejectUnauthorized=true means strict validation with custom CA; this is a valid configuration
+            (0, vitest_1.expect)(result.httpClient).toBeDefined();
+            (0, vitest_1.expect)(result.httpClient).not.toBe(opts.httpClient);
+        });
+        (0, vitest_1.test)('test rejectUnauthorized false is passed to connectOptions', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+                rejectUnauthorized: false,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeDefined();
+            (0, vitest_1.expect)(result.httpClient).not.toBe(opts.httpClient);
+        });
+    });
+    (0, vitest_1.describe)('CertAgent availability', () => {
+        (0, vitest_1.test)('test sdkInit returns original opts when CertAgent is unavailable', () => {
+            // Mock isNodeLike to return true but simulate missing undici by not being in Node-like environment for Agent
+            // This tests the guard at line 53: if (!isNodeLike() || !CertAgent)
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            // Simulate CertAgent being undefined by mocking the module reload scenario
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            // This test verifies that even with valid config, if CertAgent is not available,
+            // the hook gracefully returns original opts
+            // Note: In real scenario, CertAgent would be undefined if undici import fails
+            const result = hook.sdkInit(opts);
+            // If undici is available (which it should be in test environment), httpClient should be created
+            // If undici is not available, result should be opts
+            (0, vitest_1.expect)(result).toBeDefined();
+            (0, vitest_1.expect)(result.serverURL).toBe(opts.serverURL);
+        });
+    });
+    (0, vitest_1.describe)('integration - certificate mechanism', () => {
+        (0, vitest_1.test)('test TLS hook is added via beforeRequest hook', async () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const mockFetcher = vitest_1.vi.fn().mockResolvedValue(new Response('OK'));
+            const httpClient = new http_js_1.HTTPClient({ fetcher: mockFetcher });
+            const opts = { httpClient };
+            const result = hook.sdkInit(opts);
+            (0, vitest_1.expect)(result.httpClient).toBe(httpClient);
+            // Make a GET request (no body) through the augmented client
+            const request = new Request('https://api.example.com/test', {
+                method: 'GET',
+                headers: { 'Content-Type': 'application/json' },
+            });
+            const response = await result.httpClient?.request(request);
+            // Verify the custom fetcher was called
+            (0, vitest_1.expect)(mockFetcher).toHaveBeenCalledTimes(1);
+            const callArgs = mockFetcher.mock.calls[0];
+            (0, vitest_1.expect)(callArgs).toBeDefined();
+            if (!callArgs)
+                throw new Error('unreachable');
+            const [calledReq] = callArgs;
+            // Verify the request properties are preserved
+            (0, vitest_1.expect)(calledReq).toBeInstanceOf(Request);
+            (0, vitest_1.expect)(calledReq.url).toBe('https://api.example.com/test');
+            (0, vitest_1.expect)(calledReq.method).toBe('GET');
+            (0, vitest_1.expect)(calledReq.headers.get('Content-Type')).toBe('application/json');
+            // Verify response was returned
+            (0, vitest_1.expect)(response?.status).toBe(200);
+        });
+        (0, vitest_1.test)('test httpClient uses undici dispatcher with certificates', async () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            // Use a custom fetcher that captures what it receives
+            let receivedRequest = null;
+            const testFetcher = vitest_1.vi.fn(async (input, _init) => {
+                if (input instanceof Request) {
+                    receivedRequest = input;
+                }
+                return new Response(JSON.stringify({ success: true }), {
+                    status: 200,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            });
+            const httpClient = new http_js_1.HTTPClient({ fetcher: testFetcher });
+            const opts = { httpClient };
+            const result = hook.sdkInit(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeDefined();
+            // Make a request using the httpClient
+            const request = new Request('https://api.example.com/test', {
+                method: 'GET',
+                headers: { 'Content-Type': 'application/json' },
+            });
+            await result.httpClient?.request(request);
+            // Verify the custom fetcher was called
+            (0, vitest_1.expect)(testFetcher).toHaveBeenCalledTimes(1);
+            (0, vitest_1.expect)(receivedRequest).toBeDefined();
+            // The hook should have transformed the request
+            if (!receivedRequest)
+                throw new Error('unreachable');
+            (0, vitest_1.expect)(receivedRequest).toBeInstanceOf(Request);
+            (0, vitest_1.expect)(receivedRequest.url).toBe('https://api.example.com/test');
+        });
+        (0, vitest_1.test)('test httpClient with certificates can make successful requests', async () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+                rejectUnauthorized: false, // For testing purposes
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeDefined();
+            // Mock successful response
+            const mockResponse = new Response(JSON.stringify({ data: 'test' }), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+            const fetchSpy = vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(mockResponse);
+            // Make a GET request (no body)
+            const request = new Request('https://api.example.com/endpoint', {
+                method: 'GET',
+                headers: { 'Content-Type': 'application/json' },
+            });
+            const response = await result.httpClient?.request(request);
+            // Verify request succeeded
+            (0, vitest_1.expect)(response).toBeDefined();
+            (0, vitest_1.expect)(response?.status).toBe(200);
+            (0, vitest_1.expect)(fetchSpy).toHaveBeenCalled();
+            fetchSpy.mockRestore();
+        });
+        (0, vitest_1.test)('test httpClient created with mTLS configuration without CA cert', async () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                clientCertPath,
+                clientKeyPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const mockFetcher = vitest_1.vi.fn().mockResolvedValue(new Response(JSON.stringify({ success: true }), { status: 200 }));
+            const httpClient = new http_js_1.HTTPClient({ fetcher: mockFetcher });
+            const opts = { httpClient };
+            const result = hook.sdkInit(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeDefined();
+            // With augmentation approach, same instance is returned
+            (0, vitest_1.expect)(result.httpClient).toBe(opts.httpClient);
+            // Verify the httpClient can make requests with the configured certificates
+            const request = new Request('https://api.example.com/test', {
+                method: 'GET',
+            });
+            await result.httpClient?.request(request);
+            (0, vitest_1.expect)(mockFetcher).toHaveBeenCalledTimes(1);
+            const callArgs = mockFetcher.mock.calls[0];
+            (0, vitest_1.expect)(callArgs).toBeDefined();
+            if (!callArgs)
+                throw new Error('unreachable');
+            const [calledReq] = callArgs;
+            (0, vitest_1.expect)(calledReq).toBeInstanceOf(Request);
+            (0, vitest_1.expect)(calledReq.url).toBe('https://api.example.com/test');
+        });
+        (0, vitest_1.test)('test sdkInit returns original opts when no meaningful TLS customization', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                rejectUnauthorized: true,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            // When only rejectUnauthorized=true is set (no CA/client certs), hasCertCustomization is false
+            // because hasCertCustomization requires CA, cert, key, or rejectUnauthorized === false (line 118)
+            (0, vitest_1.expect)(result).toBe(opts);
+            (0, vitest_1.expect)(result.httpClient).toBeUndefined();
+        });
+        (0, vitest_1.test)('test sdkInit configures mTLS with client certs even when rejectUnauthorized is true', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                clientCertPath,
+                clientKeyPath,
+                rejectUnauthorized: true,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { serverURL: 'https://api.example.com' };
+            const result = hook.sdkInit(opts);
+            // mTLS client certs should be configured regardless of rejectUnauthorized value
+            // rejectUnauthorized and custom certs are orthogonal concerns
+            (0, vitest_1.expect)(result.httpClient).toBeDefined();
+        });
+    });
+    (0, vitest_1.describe)('user hook preservation', () => {
+        (0, vitest_1.test)('test user-registered hooks are preserved when TLS is configured', async () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            let userHookCalled = false;
+            const mockFetcher = vitest_1.vi.fn().mockResolvedValue(new Response('OK'));
+            const userClient = new http_js_1.HTTPClient({ fetcher: mockFetcher });
+            userClient.addHook('beforeRequest', (req) => {
+                userHookCalled = true;
+                // User hook can modify headers
+                const newReq = new Request(req.url, {
+                    method: req.method,
+                    headers: req.headers,
+                    body: req.body,
+                });
+                newReq.headers.set('X-Custom-Header', 'user-value');
+                return newReq;
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { httpClient: userClient };
+            const result = hook.sdkInit(opts);
+            const request = new Request('https://api.example.com/test', {
+                method: 'GET',
+            });
+            await result.httpClient?.request(request);
+            // Verify user hook was called
+            (0, vitest_1.expect)(userHookCalled).toBe(true);
+            // Verify the custom fetcher was called
+            (0, vitest_1.expect)(mockFetcher).toHaveBeenCalledTimes(1);
+            const callArgs = mockFetcher.mock.calls[0];
+            (0, vitest_1.expect)(callArgs).toBeDefined();
+            if (!callArgs)
+                throw new Error('unreachable');
+            const [calledReq] = callArgs;
+            // Verify user's header was preserved in the final request
+            (0, vitest_1.expect)(calledReq).toBeInstanceOf(Request);
+            (0, vitest_1.expect)(calledReq.headers.get('X-Custom-Header')).toBe('user-value');
+        });
+        (0, vitest_1.test)('test TLS hook runs after user hooks', async () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const callOrder = [];
+            const userClient = new http_js_1.HTTPClient();
+            userClient.addHook('beforeRequest', (req) => {
+                callOrder.push('user-hook');
+                return req;
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { httpClient: userClient };
+            const result = hook.sdkInit(opts);
+            // Mock fetch to capture when it's called
+            const fetchSpy = vitest_1.vi.spyOn(globalThis, 'fetch').mockImplementation(async () => {
+                callOrder.push('fetch');
+                return new Response('OK');
+            });
+            const request = new Request('https://api.example.com/test', {
+                method: 'GET',
+            });
+            await result.httpClient?.request(request);
+            // User hook should run before fetch (and before TLS hook which is closest to fetch)
+            (0, vitest_1.expect)(callOrder).toEqual(['user-hook', 'fetch']);
+            fetchSpy.mockRestore();
+        });
+        (0, vitest_1.test)('test multiple user hooks are all executed with TLS', async () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const mockFetcher = vitest_1.vi.fn().mockResolvedValue(new Response('OK'));
+            const userClient = new http_js_1.HTTPClient({ fetcher: mockFetcher });
+            const calls = [];
+            userClient.addHook('beforeRequest', (req) => {
+                calls.push('hook1');
+                return req;
+            });
+            userClient.addHook('beforeRequest', (req) => {
+                calls.push('hook2');
+                return req;
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = { httpClient: userClient };
+            const result = hook.sdkInit(opts);
+            const request = new Request('https://api.example.com/test', {
+                method: 'GET',
+            });
+            await result.httpClient?.request(request);
+            // Both user hooks should be called
+            (0, vitest_1.expect)(calls).toContain('hook1');
+            (0, vitest_1.expect)(calls).toContain('hook2');
+            // And the fetcher should be called with a request
+            (0, vitest_1.expect)(mockFetcher).toHaveBeenCalled();
+            const callArgs = mockFetcher.mock.calls[0];
+            (0, vitest_1.expect)(callArgs).toBeDefined();
+            if (!callArgs)
+                throw new Error('unreachable');
+            const [calledReq] = callArgs;
+            (0, vitest_1.expect)(calledReq).toBeInstanceOf(Request);
+        });
+    });
+    (0, vitest_1.describe)('request body handling', () => {
+        (0, vitest_1.test)('test TLS hook preserves request headers and url', async () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const opts = {};
+            const result = hook.sdkInit(opts);
+            const fetchSpy = vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response('OK'));
+            const request = new Request('https://api.example.com/test', {
+                method: 'GET',
+                headers: { 'X-Custom': 'value', 'Content-Type': 'application/json' },
+            });
+            await result.httpClient?.request(request);
+            (0, vitest_1.expect)(fetchSpy).toHaveBeenCalledTimes(1);
+            const callArgs = fetchSpy.mock.calls[0];
+            (0, vitest_1.expect)(callArgs).toBeDefined();
+            if (!callArgs)
+                throw new Error('unreachable');
+            const [calledReq] = callArgs;
+            (0, vitest_1.expect)(calledReq.url).toBe('https://api.example.com/test');
+            (0, vitest_1.expect)(calledReq.headers.get('X-Custom')).toBe('value');
+            (0, vitest_1.expect)(calledReq.headers.get('Content-Type')).toBe('application/json');
+            fetchSpy.mockRestore();
+        });
+    });
+    (0, vitest_1.describe)('runtime version detection and warnings', () => {
+        (0, vitest_1.test)('test version detection correctly identifies supported Node.js versions', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            // Access the private method via type casting for testing
+            const hookAny = hook;
+            // Test various version strings
+            (0, vitest_1.expect)(hookAny.isNodeVersionSupported('20.18.0')).toBe(false); // Minor < 18
+            (0, vitest_1.expect)(hookAny.isNodeVersionSupported('20.18.1')).toBe(true); // Exact minimum
+            (0, vitest_1.expect)(hookAny.isNodeVersionSupported('20.19.0')).toBe(true); // Minor > 18
+            (0, vitest_1.expect)(hookAny.isNodeVersionSupported('21.0.0')).toBe(true); // Major > 20
+            (0, vitest_1.expect)(hookAny.isNodeVersionSupported('22.5.0')).toBe(true); // Much newer
+            (0, vitest_1.expect)(hookAny.isNodeVersionSupported('19.10.0')).toBe(false); // Too old
+        });
+        (0, vitest_1.test)('test version string parsing handles various formats', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const hookAny = hook;
+            // Test edge cases
+            (0, vitest_1.expect)(hookAny.isNodeVersionSupported('20')).toBe(false); // No minor version (defaults to 0)
+            (0, vitest_1.expect)(hookAny.isNodeVersionSupported('20.18')).toBe(false); // No patch version (defaults to 0, which is < 1)
+            (0, vitest_1.expect)(hookAny.isNodeVersionSupported('20.19')).toBe(true); // Minor > 18
+            // Note: parseInt('invalid') returns NaN, but parts[0] would be NaN which !== undefined
+            // so the check major === undefined won't catch it. It would return false.
+            // For truly invalid versions, they'd fail the >= check anyway
+            (0, vitest_1.expect)(hookAny.isNodeVersionSupported('')).toBe(true); // Empty string → optimistic
+        });
+        (0, vitest_1.test)('test Node.js version extraction from process.versions', () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const hookAny = hook;
+            // Get the actual Node version
+            const version = hookAny.getNodeVersion();
+            // Verify we got a version string (or null in non-Node environments)
+            if (version !== null) {
+                (0, vitest_1.expect)(typeof version).toBe('string');
+                (0, vitest_1.expect)(version.length).toBeGreaterThan(0);
+            }
+        });
+    });
+    (0, vitest_1.describe)('dispatcher integration', () => {
+        (0, vitest_1.test)('test dispatcher is passed correctly through the request chain', async () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const mockFetcher = vitest_1.vi.fn().mockResolvedValue(new Response('OK'));
+            const httpClient = new http_js_1.HTTPClient({ fetcher: mockFetcher });
+            const opts = { httpClient };
+            const result = hook.sdkInit(opts);
+            const request = new Request('https://api.example.com/test', {
+                method: 'GET',
+            });
+            await result.httpClient?.request(request);
+            (0, vitest_1.expect)(mockFetcher).toHaveBeenCalledTimes(1);
+            const callArgs = mockFetcher.mock.calls[0];
+            (0, vitest_1.expect)(callArgs).toBeDefined();
+            if (!callArgs)
+                throw new Error('unreachable');
+            const [calledReq] = callArgs;
+            // Dispatcher should be attached to the request object
+            // (In a real Node.js environment with undici, this would be used by fetch)
+            (0, vitest_1.expect)(calledReq).toBeInstanceOf(Request);
+            // Verify it's a proper Request with all properties
+            (0, vitest_1.expect)(calledReq.url).toBeDefined();
+            (0, vitest_1.expect)(calledReq.method).toBeDefined();
+            (0, vitest_1.expect)(calledReq.headers).toBeDefined();
+        });
+        (0, vitest_1.test)('test TLS hook creates new Request instances', async () => {
+            galileo_config_js_1.GalileoConfig.reset();
+            galileo_config_js_1.GalileoConfig.get({
+                apiKey: 'test-key',
+                apiUrl: 'https://api.example.com',
+                caCertPath,
+            });
+            const hook = new cert_management_js_1.CertManagementHook();
+            const mockFetcher = vitest_1.vi.fn().mockResolvedValue(new Response('OK'));
+            const httpClient = new http_js_1.HTTPClient({ fetcher: mockFetcher });
+            const opts = { httpClient };
+            const result = hook.sdkInit(opts);
+            const originalRequest = new Request('https://api.example.com/test', {
+                method: 'GET',
+            });
+            await result.httpClient?.request(originalRequest);
+            (0, vitest_1.expect)(mockFetcher).toHaveBeenCalledTimes(1);
+            const callArgs = mockFetcher.mock.calls[0];
+            (0, vitest_1.expect)(callArgs).toBeDefined();
+            if (!callArgs)
+                throw new Error('unreachable');
+            const [calledReq] = callArgs;
+            // The request passed to the fetcher should be a new instance
+            // (Request objects are immutable, so the hook creates a new one)
+            (0, vitest_1.expect)(calledReq).not.toBe(originalRequest);
+        });
+    });
+});
+//# sourceMappingURL=cert-management.test.js.map