infracensus-collector 1.6.21 → 1.6.22

package/dist/a10-index.js

@@ -4,10 +4,10 @@ import {
 } from "./chunk-NH4RDH3P.js";
 import {
   requireEntitlementToScan
-} from "./chunk-4UOTVQ2D.js";
+} from "./chunk-H3F3FWT4.js";
 import {
   ROUTES
-} from "./chunk-2XRLDUAC.js";
+} from "./chunk-X25FV5BG.js";
 import "./chunk-CW3YCPEC.js";
 
 // src/a10-index.ts

package/dist/azure-index.js

@@ -2,18 +2,18 @@ import {
   ArmClient,
   buildAzureInventory,
   listAccessibleSubscriptions
-} from "./chunk-32BYFAKO.js";
+} from "./chunk-DA2A44PO.js";
 import {
   pushAzureInventory
-} from "./chunk-YWOXCYLX.js";
-import "./chunk-FNCTUV2L.js";
+} from "./chunk-NMBANWS2.js";
+import "./chunk-5H3CC4JW.js";
 import {
   loadAzureConfig
-} from "./chunk-FQNQEK35.js";
+} from "./chunk-ER3GVMGW.js";
 import {
   requireEntitlementToScan
-} from "./chunk-4UOTVQ2D.js";
-import "./chunk-2XRLDUAC.js";
+} from "./chunk-H3F3FWT4.js";
+import "./chunk-X25FV5BG.js";
 import "./chunk-CW3YCPEC.js";
 
 // src/azure-index.ts

package/dist/{chunk-MP6JAAFY.js → chunk-4IEMV6WZ.js}

@@ -1,14 +1,14 @@
 import {
   VaultError,
   openVault
-} from "./chunk-SSELCAMT.js";
+} from "./chunk-UQAZFFNX.js";
 import {
   configFilePath,
   vaultSettings
-} from "./chunk-FQNQEK35.js";
+} from "./chunk-ER3GVMGW.js";
 import {
   VaultProtection
-} from "./chunk-2XRLDUAC.js";
+} from "./chunk-X25FV5BG.js";
 
 // src/vault/collectorKey.ts
 import { readFileSync, writeFileSync, renameSync, existsSync } from "node:fs";
@@ -129,4 +129,4 @@ export {
   migrateCollectorApiKey,
   plaintextKeyWarning
 };
-//# sourceMappingURL=chunk-MP6JAAFY.js.map
+//# sourceMappingURL=chunk-4IEMV6WZ.js.map

package/dist/{chunk-WPRMFIPU.js → chunk-4ZWKLK4J.js}

@@ -13,7 +13,7 @@ import {
   IdentityIngestBody,
   M365Licensing,
   M365Workload
-} from "./chunk-2XRLDUAC.js";
+} from "./chunk-X25FV5BG.js";
 
 // src/identity/graph.ts
 var noopLog = () => {
@@ -1123,4 +1123,4 @@ export {
   GraphClient,
   buildIdentityInventory
 };
-//# sourceMappingURL=chunk-WPRMFIPU.js.map
+//# sourceMappingURL=chunk-4ZWKLK4J.js.map

package/dist/{chunk-FNCTUV2L.js → chunk-5H3CC4JW.js}

@@ -1,7 +1,7 @@
 import {
   ApiError,
   moduleForScanDomain
-} from "./chunk-2XRLDUAC.js";
+} from "./chunk-X25FV5BG.js";
 
 // src/core/planRefusal.ts
 var PLAN_REFUSAL_CODES = [
@@ -112,4 +112,4 @@ export {
   asPlanRefusal,
   createRefusalLatch
 };
-//# sourceMappingURL=chunk-FNCTUV2L.js.map
+//# sourceMappingURL=chunk-5H3CC4JW.js.map

package/dist/{chunk-FJ22GRKW.js → chunk-6LOVKE5Y.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-4ARXQ6VD.js";
 import {
   HypervIngestBody
-} from "./chunk-2XRLDUAC.js";
+} from "./chunk-X25FV5BG.js";
 
 // src/hyperv/scan.ts
 import { spawn } from "node:child_process";
@@ -538,4 +538,4 @@ export {
   scanHypervTargets,
   buildHypervInventory
 };
-//# sourceMappingURL=chunk-FJ22GRKW.js.map
+//# sourceMappingURL=chunk-6LOVKE5Y.js.map

package/dist/{chunk-HGADZRD3.js → chunk-ALFPZRSX.js}

@@ -3,17 +3,17 @@ import {
   collectorVersion,
   findModule,
   restartNeededNotice
-} from "./chunk-DI6WLXKR.js";
+} from "./chunk-ZFG4BMUQ.js";
 import {
   redactLocal
 } from "./chunk-DIS3S4SY.js";
 import {
   configFilePath
-} from "./chunk-FQNQEK35.js";
+} from "./chunk-ER3GVMGW.js";
 import {
   collectorEntitlementStatus,
   collectorOwnsModule
-} from "./chunk-4UOTVQ2D.js";
+} from "./chunk-H3F3FWT4.js";
 import {
   PKG_ROOT
 } from "./chunk-CW3YCPEC.js";
@@ -312,4 +312,4 @@ export {
   condenseLogTail,
   buildUiStatus
 };
-//# sourceMappingURL=chunk-HGADZRD3.js.map
+//# sourceMappingURL=chunk-ALFPZRSX.js.map

package/dist/{chunk-SSKRKLNM.js → chunk-CN4SKR2W.js}

@@ -13,7 +13,7 @@ import {
   VoiceRegion,
   VoiceSystem,
   WebexCalling
-} from "./chunk-2XRLDUAC.js";
+} from "./chunk-X25FV5BG.js";
 
 // src/voice/axl.ts
 import { XMLParser } from "fast-xml-parser";
@@ -1951,4 +1951,4 @@ export {
   buildUnityInventory,
   buildWebexInventory
 };
-//# sourceMappingURL=chunk-SSKRKLNM.js.map
+//# sourceMappingURL=chunk-CN4SKR2W.js.map

package/dist/{chunk-32BYFAKO.js → chunk-DA2A44PO.js}

@@ -8,7 +8,7 @@ import {
   AzureRbacAssignment,
   AzureResource,
   AzureSubscription
-} from "./chunk-2XRLDUAC.js";
+} from "./chunk-X25FV5BG.js";
 
 // src/azure/arm.ts
 var noopLog = () => {
@@ -848,4 +848,4 @@ export {
   listAccessibleSubscriptions,
   buildAzureInventory
 };
-//# sourceMappingURL=chunk-32BYFAKO.js.map
+//# sourceMappingURL=chunk-DA2A44PO.js.map

package/dist/{chunk-FQNQEK35.js → chunk-ER3GVMGW.js}

@@ -1,6 +1,6 @@
 import {
   VaultProtection
-} from "./chunk-2XRLDUAC.js";
+} from "./chunk-X25FV5BG.js";
 import {
   PKG_ROOT
 } from "./chunk-CW3YCPEC.js";
@@ -820,4 +820,4 @@ export {
   loadSensitiveDataConfig,
   loadAzureConfig
 };
-//# sourceMappingURL=chunk-FQNQEK35.js.map
+//# sourceMappingURL=chunk-ER3GVMGW.js.map

package/dist/{chunk-HDNYHF57.js → chunk-FFCFK3H6.js}

@@ -1,18 +1,18 @@
 import {
   planRefusalFrom
-} from "./chunk-FNCTUV2L.js";
+} from "./chunk-5H3CC4JW.js";
 import {
   COLLECTOR_AUTH_HEADER,
   collectorBearer,
   noteEntitlementRefusalFromPlane
-} from "./chunk-4UOTVQ2D.js";
+} from "./chunk-H3F3FWT4.js";
 import {
   ApiError,
   ClaimedJobResponse,
   CollectorSddHostsResult,
   ROUTES,
   ScanJobStatusResult
-} from "./chunk-2XRLDUAC.js";
+} from "./chunk-X25FV5BG.js";
 import {
   PKG_ROOT
 } from "./chunk-CW3YCPEC.js";
@@ -387,4 +387,4 @@ export {
   claimNextJob,
   reportStatus
 };
-//# sourceMappingURL=chunk-HDNYHF57.js.map
+//# sourceMappingURL=chunk-FFCFK3H6.js.map

package/dist/{chunk-4UOTVQ2D.js → chunk-H3F3FWT4.js}

@@ -1,23 +1,211 @@
 import {
   ApiError,
   CollectorEntitlementResult,
-  DiscoverySnapshot,
+  Device,
+  DeviceNeighbor,
+  Id,
+  IpAddress,
+  IsoTimestamp,
+  NetworkInterface,
+  NetworkLink,
   ROUTES
-} from "./chunk-2XRLDUAC.js";
+} from "./chunk-X25FV5BG.js";
 import {
   PKG_ROOT
 } from "./chunk-CW3YCPEC.js";
 
 // ../../packages/collector-contract/src/ingest.ts
+import { z as z3 } from "zod";
+
+// ../../packages/canonical-model/src/operational.ts
 import { z } from "zod";
+var StpInstance = z.object({
+  /** VLAN id (PVST/RPVST) or MST instance id, as reported (e.g. "10", "MST0"). */
+  instance: z.string(),
+  /** The STP mode this instance runs — used to flag a mixed PVST/RPVST/MST estate. */
+  protocol: z.enum(["pvst", "rapid-pvst", "mst", "unknown"]).default("unknown"),
+  /** This bridge is the root for the instance ("This bridge is the root"). */
+  isRoot: z.boolean().default(false),
+  /** Root bridge id (priority + MAC) as reported, for cross-VLAN root-consistency. */
+  rootId: z.string().optional(),
+  /** Ports in BLK/blocking for this instance (a high count hints at an L2 loop / suboptimal topology). */
+  blockingPorts: z.number().int().nonnegative().default(0)
+});
+var StpState = z.object({
+  instances: z.array(StpInstance).default([]),
+  /** `spanning-tree loopguard default` present (from config, folded in for convenience). */
+  loopguardDefault: z.boolean().optional(),
+  /** Any interface has root guard enabled. */
+  rootguardAny: z.boolean().optional()
+});
+var BgpPeer = z.object({
+  peer: z.string(),
+  remoteAs: z.string().optional(),
+  /** "Established" when up; otherwise the FSM state (Idle / Active / Connect / OpenSent …). */
+  state: z.string(),
+  up: z.boolean(),
+  /** Prefixes received (PfxRcd), when the summary reports it. */
+  prefixes: z.number().int().nonnegative().optional(),
+  /** Up/Down time as reported (e.g. "3w2d", "00:00:12"). */
+  uptime: z.string().optional()
+});
+var OspfNeighbor = z.object({
+  neighbor: z.string(),
+  /** FULL / 2WAY / EXSTART / EXCHANGE / LOADING / INIT / DOWN … (adjacency FSM). */
+  state: z.string(),
+  /** Adjacency is fully formed (FULL, or 2WAY on a broadcast network with a DR/BDR). */
+  full: z.boolean(),
+  iface: z.string().optional()
+});
+var NtpSyncState = z.object({
+  /** An NTP source is configured / associated. */
+  configured: z.boolean().default(false),
+  /** The clock is actually SYNCHRONIZED to a source (not just configured). */
+  synchronized: z.boolean().default(false),
+  stratum: z.number().int().optional(),
+  /** The synced peer address, when reported. */
+  source: z.string().optional()
+});
+var PortChannelMember = z.object({
+  name: z.string(),
+  up: z.boolean(),
+  /** Member flag/state as reported (e.g. "P" bundled, "s" suspended, "D" down). */
+  status: z.string().optional()
+});
+var PortChannel = z.object({
+  id: z.string(),
+  /** LACP / PAgP / "-" (static). */
+  protocol: z.string().optional(),
+  /** The bundle itself is up (at least one member forwarding). */
+  up: z.boolean(),
+  members: z.array(PortChannelMember).default([])
+});
+var Vpc = z.object({
+  id: z.string(),
+  up: z.boolean(),
+  /** vPC consistency-check passed, when reported. */
+  consistent: z.boolean().optional()
+});
+var VpcState = z.object({
+  domainId: z.string().optional(),
+  /** vPC peer-link is up. */
+  peerLinkUp: z.boolean(),
+  /** vPC peer-keepalive is up. */
+  keepaliveUp: z.boolean(),
+  /** This peer's vPC role (primary / secondary / none), when reported. */
+  role: z.string().optional(),
+  vpcs: z.array(Vpc).default([])
+});
+var FhrpGroup = z.object({
+  protocol: z.enum(["hsrp", "vrrp", "glbp", "unknown"]).default("unknown"),
+  group: z.string(),
+  iface: z.string().optional(),
+  /** Active / Standby / Init / Listen / Speak (HSRP), Master / Backup (VRRP), etc. */
+  state: z.string(),
+  /** This box owns the virtual IP right now (HSRP Active, VRRP Master, GLBP Active). */
+  active: z.boolean(),
+  priority: z.number().int().optional(),
+  virtualIp: z.string().optional()
+});
+var IfStatus = z.object({
+  name: z.string(),
+  /** connected / notconnect / disabled / err-disabled / down / … (as reported). */
+  status: z.string(),
+  errDisabled: z.boolean().default(false),
+  /** Access VLAN or "trunk"/"routed", when reported. */
+  vlan: z.string().optional()
+});
+var PowerSupply = z.object({
+  id: z.string(),
+  ok: z.boolean(),
+  status: z.string().optional()
+});
+var OperationalStackMember = z.object({
+  id: z.string(),
+  /** master / member / standby, when reported. */
+  role: z.string().optional(),
+  model: z.string().optional(),
+  version: z.string().optional(),
+  /** Ready / provisioned / version-mismatch / …, when reported. */
+  state: z.string().optional()
+});
+var Environment = z.object({
+  powerSupplies: z.array(PowerSupply).default([]),
+  stackMembers: z.array(OperationalStackMember).default([])
+});
+var DeviceOperational = z.object({
+  deviceId: Id,
+  stp: StpState.optional(),
+  bgpPeers: z.array(BgpPeer).default([]),
+  ospfNeighbors: z.array(OspfNeighbor).default([]),
+  ntp: NtpSyncState.optional(),
+  portChannels: z.array(PortChannel).default([]),
+  vpc: VpcState.optional(),
+  fhrp: z.array(FhrpGroup).default([]),
+  interfaces: z.array(IfStatus).default([]),
+  environment: Environment.optional()
+});
+
+// ../../packages/canonical-model/src/snapshot.ts
+import { z as z2 } from "zod";
+var ConfigCapture = z2.object({
+  deviceId: Id,
+  /** e.g. "running-config". */
+  kind: z2.string().default("running-config"),
+  text: z2.string()
+});
+var DiscoverySnapshot = z2.object({
+  /** Schema version of the snapshot envelope itself. */
+  schemaVersion: z2.literal(1),
+  /** Stable id of the collector instance that produced this snapshot. */
+  collectorId: Id,
+  tenantId: Id,
+  orgId: Id,
+  siteId: Id,
+  /** When the scan completed, set by the collector. */
+  capturedAt: IsoTimestamp,
+  devices: z2.array(Device),
+  interfaces: z2.array(NetworkInterface),
+  ipAddresses: z2.array(IpAddress),
+  links: z2.array(NetworkLink),
+  /**
+   * Raw CDP/LLDP neighbor facts (ADR-006 Phase 2), additive to `links` — kept
+   * even when the neighbor's remote end isn't itself a device in this scan, so
+   * the control plane can resolve it against OTHER sites at read time.
+   * `.default([])` keeps snapshots from not-yet-upgraded collectors valid.
+   */
+  neighbors: z2.array(DeviceNeighbor).default([]),
+  /** Per-device config text captured this run (may be empty). */
+  configs: z2.array(ConfigCapture).default([]),
+  /**
+   * Per-device OPERATIONAL state parsed from `show`-command output this run (STP
+   * root/blocking, BGP/OSPF adjacency state, NTP sync, port-channel/vPC/FHRP
+   * health, interface status, power/stack) — the runtime facts a running-config
+   * can't show, consumed by the operational rules engine. `.default([])` keeps
+   * snapshots from not-yet-upgraded collectors valid (they simply send none).
+   */
+  operational: z2.array(DeviceOperational).default([])
+});
+var SnapshotHeader = z2.object({
+  id: Id,
+  tenantId: Id,
+  siteId: Id,
+  collectorId: Id,
+  version: z2.number().int().positive(),
+  capturedAt: IsoTimestamp,
+  receivedAt: IsoTimestamp,
+  deviceCount: z2.number().int().nonnegative()
+});
+
+// ../../packages/collector-contract/src/ingest.ts
 var IngestBody = DiscoverySnapshot;
 var COLLECTOR_AUTH_HEADER = "Authorization";
 var collectorBearer = (apiKey) => `Bearer ${apiKey}`;
-var IngestResult = z.object({
-  ok: z.literal(true),
-  snapshotId: z.string(),
-  version: z.number().int().positive(),
-  deviceCount: z.number().int().nonnegative()
+var IngestResult = z3.object({
+  ok: z3.literal(true),
+  snapshotId: z3.string(),
+  version: z3.number().int().positive(),
+  deviceCount: z3.number().int().nonnegative()
 });
 
 // src/entitlement/verdict.ts
@@ -171,21 +359,21 @@ function describeTransportFailure(err) {
 // src/entitlement/cache.ts
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
 function entitlementCachePath() {
   return process.env.COLLECTOR_ENTITLEMENT_CACHE_FILE ?? join(PKG_ROOT, "collector-entitlement.json");
 }
-var CachedVerdictFile = z2.object({
-  version: z2.literal(1),
-  verdict: z2.union([
-    z2.object({
-      allowed: z2.literal(true),
-      confirmedAtLocal: z2.string(),
-      confirmedAt: z2.string(),
-      licenceExpiresAt: z2.string(),
-      tier: z2.string().nullable(),
-      tenantId: z2.string(),
-      collectorId: z2.string(),
+var CachedVerdictFile = z4.object({
+  version: z4.literal(1),
+  verdict: z4.union([
+    z4.object({
+      allowed: z4.literal(true),
+      confirmedAtLocal: z4.string(),
+      confirmedAt: z4.string(),
+      licenceExpiresAt: z4.string(),
+      tier: z4.string().nullable(),
+      tenantId: z4.string(),
+      collectorId: z4.string(),
       // The owned-module list, so a restart can SHOW which scans were last
       // permitted. Required for the same reason the rest of the shape is: a file
       // written by an older build that lacks it fails to parse and reads as an
@@ -193,15 +381,15 @@ var CachedVerdictFile = z2.object({
       // check rewrites it. Nothing starts work on a cached list either way: the
       // synchronous per-module backstop, like the paid-collector one, refuses
       // until THIS process has re-confirmed.
-      modules: z2.array(z2.string())
+      modules: z4.array(z4.string())
     }),
-    z2.object({
-      allowed: z2.literal(false),
-      reason: z2.enum(["not_paid", "deactivated", "unconfirmed"]),
-      checkedAtLocal: z2.string(),
-      message: z2.string(),
-      planeMessage: z2.string().nullable(),
-      httpStatus: z2.number().nullable()
+    z4.object({
+      allowed: z4.literal(false),
+      reason: z4.enum(["not_paid", "deactivated", "unconfirmed"]),
+      checkedAtLocal: z4.string(),
+      message: z4.string(),
+      planeMessage: z4.string().nullable(),
+      httpStatus: z4.number().nullable()
     })
   ])
 });
@@ -479,6 +667,7 @@ function assertEntitlementConfirmed(config, log, attempted) {
 }
 
 export {
+  ConfigCapture,
   IngestBody,
   COLLECTOR_AUTH_HEADER,
   collectorBearer,
@@ -494,4 +683,4 @@ export {
   requireEntitlementToScan,
   assertEntitlementConfirmed
 };
-//# sourceMappingURL=chunk-4UOTVQ2D.js.map
+//# sourceMappingURL=chunk-H3F3FWT4.js.map