infracensus-collector 1.3.0 → 1.4.1

package/dist/a10-index.js

@@ -4,10 +4,10 @@ import {
 } from "./chunk-MN4JODQW.js";
 import {
   requireEntitlementToScan
-} from "./chunk-ZTA7536B.js";
+} from "./chunk-UV737N5S.js";
 import {
   ROUTES
-} from "./chunk-RCSMKY5W.js";
+} from "./chunk-F5DB2SXP.js";
 import "./chunk-CW3YCPEC.js";
 
 // src/a10-index.ts

package/dist/azure-index.js

@@ -2,18 +2,18 @@ import {
   ArmClient,
   buildAzureInventory,
   listAccessibleSubscriptions
-} from "./chunk-JYSJ52ZS.js";
+} from "./chunk-CZST5VMO.js";
 import {
   pushAzureInventory
-} from "./chunk-JB7TTPKL.js";
-import "./chunk-6GUY42OX.js";
+} from "./chunk-QITZIOFD.js";
+import "./chunk-CBNDR2GQ.js";
 import {
   loadAzureConfig
-} from "./chunk-GD4YRP6B.js";
+} from "./chunk-CQYV43KA.js";
 import {
   requireEntitlementToScan
-} from "./chunk-ZTA7536B.js";
-import "./chunk-RCSMKY5W.js";
+} from "./chunk-UV737N5S.js";
+import "./chunk-F5DB2SXP.js";
 import "./chunk-CW3YCPEC.js";
 
 // src/azure-index.ts

package/dist/{chunk-UQJQKUAU.js → chunk-5ULN62DY.js}

@@ -1,6 +1,6 @@
 import {
   HypervIngestBody
-} from "./chunk-RCSMKY5W.js";
+} from "./chunk-F5DB2SXP.js";
 
 // src/hyperv/scan.ts
 import { spawn } from "node:child_process";
@@ -455,4 +455,4 @@ export {
   scanHypervTargets,
   buildHypervInventory
 };
-//# sourceMappingURL=chunk-UQJQKUAU.js.map
+//# sourceMappingURL=chunk-5ULN62DY.js.map

package/dist/{chunk-QNHCMF7Z.js → chunk-62F6ZKS6.js}

@@ -13,7 +13,7 @@ import {
   VoiceRegion,
   VoiceSystem,
   WebexCalling
-} from "./chunk-RCSMKY5W.js";
+} from "./chunk-F5DB2SXP.js";
 
 // src/voice/axl.ts
 import { XMLParser } from "fast-xml-parser";
@@ -1940,4 +1940,4 @@ export {
   buildUnityInventory,
   buildWebexInventory
 };
-//# sourceMappingURL=chunk-QNHCMF7Z.js.map
+//# sourceMappingURL=chunk-62F6ZKS6.js.map

package/dist/{chunk-XAV5QW4Y.js → chunk-7T2LVP6E.js}

@@ -4,16 +4,15 @@ import {
 import {
   configFilePath,
   vaultSettings
-} from "./chunk-GD4YRP6B.js";
+} from "./chunk-CQYV43KA.js";
 import {
-  LocalCredentialSet,
-  LocalVaultContents,
-  LocalVaultEnvelope,
+  CredentialSetKind,
+  DomainCredentialSecret,
+  SshCredential,
   VaultProtection,
-  localSecretSatisfiesKind,
-  redactCredentialSet,
-  viewCredentialSet
-} from "./chunk-RCSMKY5W.js";
+  WindowsCredential,
+  domainSecretSatisfiesKind
+} from "./chunk-F5DB2SXP.js";
 import {
   PKG_ROOT
 } from "./chunk-CW3YCPEC.js";
@@ -23,6 +22,252 @@ import { readFileSync, writeFileSync, renameSync, existsSync as existsSync2 } fr
 import { dirname as dirname2, join } from "node:path";
 import { randomBytes as randomBytes4 } from "node:crypto";
 
+// ../../packages/collector-contract/src/localVault.ts
+import { z } from "zod";
+var NetworkCredentialSecret = z.object({
+  /** SNMP read communities, tried in order. Each one IS a password. */
+  snmpCommunities: z.array(z.string()).max(50).default([]),
+  sshCredentials: z.array(SshCredential).max(50).default([]),
+  windowsCredentials: z.array(WindowsCredential).max(50).default([])
+}).strict();
+var LocalCredentialSecret = z.object({
+  /** Populated when kind === "network". */
+  network: NetworkCredentialSecret.optional(),
+  /** Populated for every other kind. Shape and rules unchanged from the plane. */
+  domain: DomainCredentialSecret.optional()
+}).strict();
+var CREDENTIAL_KIND_SHAPE = {
+  network: "network",
+  vcenter: "host",
+  hyperv: "host",
+  sql: "host",
+  loadbalancer: "host",
+  storage: "host",
+  firewall: "host",
+  cucm: "host",
+  unity: "host",
+  wlc: "host",
+  nac: "host",
+  smb: "host",
+  webex: "token",
+  graph: "tenant-app",
+  azure: "tenant-app"
+};
+function localSecretSatisfiesKind(kind, secret) {
+  if (CREDENTIAL_KIND_SHAPE[kind] === "network") {
+    const n = secret.network;
+    if (n === void 0) return false;
+    return n.snmpCommunities.length > 0 || n.sshCredentials.length > 0 || n.windowsCredentials.length > 0;
+  }
+  return domainSecretSatisfiesKind(kind, secret.domain ?? {});
+}
+var LocalCredentialSet = z.object({
+  /**
+   * Host-local id. Not a tenant id, not a plane id — it means something only
+   * inside this collector, which is what makes it safe to report upward and to
+   * name in `CreateScanJobBody.localCredentialSetId`.
+   */
+  id: z.string().min(1).max(200),
+  name: z.string().min(1).max(200),
+  /** Immutable after creation. Changing a kind changes which fields of the
+   * secret are meaningful, so it is a delete and a create, not an edit. */
+  kind: CredentialSetKind,
+  secret: LocalCredentialSecret,
+  createdAt: z.string(),
+  updatedAt: z.string(),
+  /** Last time a scan used it; null if never. Written by the collector. */
+  lastUsedAt: z.string().nullable().default(null)
+}).strict();
+var LocalVaultKdf = z.object({
+  algorithm: z.literal("scrypt"),
+  /** Base64. Per-vault, never shared, never derived from the hostname. */
+  salt: z.string().min(1),
+  /** CPU/memory cost. 2^15 at the time of writing. */
+  n: z.number().int().positive(),
+  r: z.number().int().positive(),
+  p: z.number().int().positive()
+}).strict();
+var LocalVaultEnvelope = z.object({
+  version: z.literal(1),
+  protection: VaultProtection,
+  /** Base64 DEK sealed by the OS keystore. Null only for `file-fallback`. */
+  wrappedKey: z.string().min(1).nullable(),
+  /** Present only for `file-fallback`. Null otherwise. */
+  kdf: LocalVaultKdf.nullable(),
+  /** Base64 AES-GCM nonce. Fresh on every write — never reused with one key. */
+  nonce: z.string().min(1),
+  /** Base64 AES-GCM ciphertext of a `LocalVaultContents`, tag included. */
+  ciphertext: z.string().min(1),
+  updatedAt: z.string()
+}).strict().refine(
+  (v) => v.protection === "file-fallback" ? v.kdf !== null : v.wrappedKey !== null,
+  "an OS-keystore vault must carry a wrapped key; a file-fallback vault must carry its KDF parameters"
+);
+var LocalVaultContents = z.object({
+  version: z.literal(1),
+  sets: z.array(LocalCredentialSet).max(500),
+  /**
+   * THE COLLECTOR'S OWN KEY, WHICH IS NOT A CREDENTIAL SET.
+   *
+   * ── WHY IT IS HERE AND NOT IN `sets` ────────────────────────────────────
+   *
+   * It is the wrong shape and it would be in the wrong places. A
+   * `LocalCredentialSet` has a `CredentialSetKind`, and every kind is
+   * something a SCAN logs into — so a key that lives in `sets` appears in the
+   * localhost UI's credential list, in the report the control plane reads, and
+   * in `matchForScan`, where a network sweep could resolve to it. None of
+   * those are true of the collector's enrolment key, and each would have to be
+   * special-cased back out.
+   *
+   * ── WHY IT IS IN THE VAULT AT ALL ───────────────────────────────────────
+   *
+   * Because it was in `collector.config.json` in plaintext. The file is
+   * icacls'd to SYSTEM and Administrators and that is a real protection, but
+   * an ACL travels with a filesystem and not with a file: a backup, a copied
+   * folder, a support bundle, or a share that was set up in a hurry all carry
+   * the bytes somewhere the ACL is not. Sealed here it is bound to the OS
+   * keystore of the account and machine that wrote it, so the same copy is
+   * inert everywhere else.
+   *
+   * OPTIONAL, and it stays optional. A collector whose key is still in the
+   * config file works exactly as it did — the plaintext is a supported
+   * fallback, not a deprecated one, because the alternative is a host that
+   * cannot authenticate at all if its keystore is having a bad day.
+   */
+  collectorApiKey: z.string().min(1).optional()
+}).strict();
+var LocalCredentialSetView = z.object({
+  id: z.string(),
+  name: z.string(),
+  kind: CredentialSetKind,
+  /** Does it carry what its kind needs? Drives the UI's "incomplete" badge. */
+  usable: z.boolean(),
+  /** How many SNMP communities are stored. NEVER the community strings — an
+   * SNMP v2c community is the whole credential, not a username. */
+  snmpCommunityCount: z.number().int().nonnegative(),
+  /** Usernames only, in the order they are tried. Never a password. */
+  usernames: z.array(z.string()),
+  /** Endpoint metadata for the domain kinds. */
+  host: z.string().nullable(),
+  port: z.number().int().positive().nullable(),
+  insecure: z.boolean().nullable(),
+  vendor: z.string().nullable(),
+  /** The app registration id for graph/azure — public by design, unlike its
+   * secret. Null for every other kind. */
+  clientId: z.string().nullable(),
+  /** Whether a bearer token is stored. Never the token. */
+  hasToken: z.boolean(),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+  lastUsedAt: z.string().nullable()
+}).strict();
+var LocalCredentialSetsResponse = z.object({ credentialSets: z.array(LocalCredentialSetView) }).strict();
+function usernamesOf(set) {
+  const shape = CREDENTIAL_KIND_SHAPE[set.kind];
+  switch (shape) {
+    case "network": {
+      const n = set.secret.network;
+      if (n === void 0) return [];
+      return [
+        ...n.sshCredentials.map((c) => c.username),
+        ...n.windowsCredentials.map((c) => c.username)
+      ];
+    }
+    case "host":
+      return (set.secret.domain?.credentials ?? []).map((c) => c.username);
+    case "token":
+      return [];
+    case "tenant-app":
+      return set.secret.domain?.clientId ? [set.secret.domain.clientId] : [];
+    default: {
+      const unreachable = shape;
+      return unreachable;
+    }
+  }
+}
+function loginCountOf(set) {
+  const shape = CREDENTIAL_KIND_SHAPE[set.kind];
+  switch (shape) {
+    case "network": {
+      const n = set.secret.network;
+      if (n === void 0) return 0;
+      return n.sshCredentials.length + n.windowsCredentials.length;
+    }
+    case "host":
+      return set.secret.domain?.credentials?.length ?? 0;
+    case "token":
+      return set.secret.domain?.token ? 1 : 0;
+    case "tenant-app":
+      return set.secret.domain?.clientId && set.secret.domain?.clientSecret ? 1 : 0;
+    default: {
+      const unreachable = shape;
+      return unreachable;
+    }
+  }
+}
+function viewCredentialSet(set) {
+  const d = set.secret.domain;
+  const isTenantApp = CREDENTIAL_KIND_SHAPE[set.kind] === "tenant-app";
+  return {
+    id: set.id,
+    name: set.name,
+    kind: set.kind,
+    usable: localSecretSatisfiesKind(set.kind, set.secret),
+    snmpCommunityCount: set.secret.network?.snmpCommunities.length ?? 0,
+    usernames: usernamesOf(set),
+    host: d?.host ?? null,
+    port: d?.port ?? null,
+    insecure: d?.insecure ?? null,
+    vendor: d?.vendor ?? null,
+    clientId: isTenantApp ? d?.clientId ?? null : null,
+    hasToken: Boolean(d?.token),
+    createdAt: set.createdAt,
+    updatedAt: set.updatedAt,
+    lastUsedAt: set.lastUsedAt
+  };
+}
+function redactCredentialSet(set) {
+  return {
+    id: set.id,
+    name: set.name,
+    kind: set.kind,
+    usable: localSecretSatisfiesKind(set.kind, set.secret),
+    snmpCommunityCount: set.secret.network?.snmpCommunities.length ?? 0,
+    loginCount: loginCountOf(set),
+    createdAt: set.createdAt,
+    updatedAt: set.updatedAt,
+    lastUsedAt: set.lastUsedAt
+  };
+}
+var CreateLocalCredentialSetBody = z.object({
+  name: z.string().min(1).max(200),
+  kind: CredentialSetKind.default("network"),
+  secret: LocalCredentialSecret
+}).strict().refine(
+  (b) => localSecretSatisfiesKind(b.kind, b.secret),
+  "the credential set does not carry the material its kind requires: the network kind needs at least one community or login; host kinds need credentials; webex needs a token; graph and azure need a clientId and clientSecret"
+).refine(
+  (b) => CREDENTIAL_KIND_SHAPE[b.kind] === "network" === (b.secret.network !== void 0),
+  "a network credential set carries `secret.network`; every other kind carries `secret.domain`"
+);
+var UpdateLocalCredentialSetBody = z.object({
+  id: z.string().min(1).max(200),
+  name: z.string().min(1).max(200).optional(),
+  secret: LocalCredentialSecret.optional()
+}).strict();
+var EphemeralCredentialSet = z.object({
+  kind: CredentialSetKind,
+  secret: LocalCredentialSecret
+}).strict().refine(
+  (b) => localSecretSatisfiesKind(b.kind, b.secret),
+  "the credentials entered for this run do not carry the material their kind requires"
+).refine(
+  (b) => CREDENTIAL_KIND_SHAPE[b.kind] === "network" === (b.secret.network !== void 0),
+  "network credentials carry `secret.network`; every other kind carries `secret.domain`"
+);
+var LocalCredentialSetMutationResult = z.object({ ok: z.literal(true), credentialSet: LocalCredentialSetView }).strict();
+var DOMAIN_CREDENTIAL_KINDS = Object.keys(CREDENTIAL_KIND_SHAPE).filter((k) => CREDENTIAL_KIND_SHAPE[k] !== "network");
+
 // src/vault/store.ts
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
@@ -899,6 +1144,9 @@ async function primeCollectorApiKey(opts = {}) {
     void err;
     return "absent";
   }
+  if (settings.apiKeyInFile) {
+    return "config-file";
+  }
   if (existsSync2(settings.vaultPath)) {
     const sealed = await readSealedKey(settings, opts);
     if (sealed.opened && sealed.key !== null) {
@@ -913,7 +1161,7 @@ async function primeCollectorApiKey(opts = {}) {
       return "unreadable";
     }
   }
-  return settings.apiKeyInFile ? "config-file" : "absent";
+  return "absent";
 }
 async function readSealedKey(settings, opts) {
   const open = opts.open ?? openVault;
@@ -937,14 +1185,14 @@ async function migrateCollectorApiKey(vault, opts = {}) {
   const plaintext = settings.apiKeyInFile;
   if (!plaintext) return { message: null, migrated: false };
   const existing = await vault.readCollectorApiKey();
+  if (existing !== null && existing === plaintext) {
+    return finishByRemovingPlaintext(env, log);
+  }
   if (existing !== null) {
-    if (existing === plaintext) {
-      return finishByRemovingPlaintext(env, log);
-    }
-    return {
-      message: `this collector holds a sealed key AND a different plaintext one in ${configFilePath(env)}. Neither was changed: only you can say which is current. Remove the wrong one.`,
-      migrated: false
-    };
+    log?.(
+      "info",
+      "collector key: a newly enrolled key replaces the one sealed in the vault"
+    );
   }
   try {
     await vault.writeCollectorApiKey(plaintext);
@@ -1003,6 +1251,11 @@ function collectorVersion() {
 }
 
 export {
+  CREDENTIAL_KIND_SHAPE,
+  localSecretSatisfiesKind,
+  CreateLocalCredentialSetBody,
+  UpdateLocalCredentialSetBody,
+  EphemeralCredentialSet,
   VaultError,
   openVault,
   primeCollectorApiKey,
@@ -1010,4 +1263,4 @@ export {
   plaintextKeyWarning,
   collectorVersion
 };
-//# sourceMappingURL=chunk-XAV5QW4Y.js.map
+//# sourceMappingURL=chunk-7T2LVP6E.js.map