infracensus-collector 1.6.21 → 1.6.23

package/LICENSE

@@ -1,23 +1,23 @@
-InfraCensus Collector
-Copyright (c) 2026 Zentrosoft. All rights reserved.
-
-This software is proprietary. It is published to the npm registry so that
-licensed InfraCensus tenants can install and update the collector with
-standard tooling; publication is not a grant of rights.
-
-You may install and run this software only to connect infrastructure you
-control to an InfraCensus deployment you are licensed to use. You may not
-copy (except as required to install and run it), modify, translate, reverse
-engineer, decompile, disassemble, sublicense, sell, lease, or redistribute
-this software, in whole or in part, except as permitted by applicable law
-notwithstanding this restriction, or with prior written permission.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
-DEALINGS IN THE SOFTWARE.
-
-Contact: info@infracensus.com
+InfraCensus Collector
+Copyright (c) 2026 Zentrosoft. All rights reserved.
+
+This software is proprietary. It is published to the npm registry so that
+licensed InfraCensus tenants can install and update the collector with
+standard tooling; publication is not a grant of rights.
+
+You may install and run this software only to connect infrastructure you
+control to an InfraCensus deployment you are licensed to use. You may not
+copy (except as required to install and run it), modify, translate, reverse
+engineer, decompile, disassemble, sublicense, sell, lease, or redistribute
+this software, in whole or in part, except as permitted by applicable law
+notwithstanding this restriction, or with prior written permission.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
+Contact: info@infracensus.com

package/dist/a10-index.js

@@ -1,14 +1,14 @@
 import {
   AxapiClient,
   buildLoadBalancerInventory
-} from "./chunk-NH4RDH3P.js";
+} from "./chunk-2CKQ2AXQ.js";
 import {
   requireEntitlementToScan
-} from "./chunk-4UOTVQ2D.js";
+} from "./chunk-QQ67FRXQ.js";
 import {
   ROUTES
-} from "./chunk-2XRLDUAC.js";
-import "./chunk-CW3YCPEC.js";
+} from "./chunk-ALPMCXOV.js";
+import "./chunk-XSHYWQAH.js";
 
 // src/a10-index.ts
 var LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 };

package/dist/azure-index.js

@@ -2,19 +2,20 @@ import {
   ArmClient,
   buildAzureInventory,
   listAccessibleSubscriptions
-} from "./chunk-32BYFAKO.js";
+} from "./chunk-XLB7GCCC.js";
+import "./chunk-X46NKIFT.js";
 import {
   pushAzureInventory
-} from "./chunk-YWOXCYLX.js";
-import "./chunk-FNCTUV2L.js";
+} from "./chunk-S6QIVL5K.js";
+import "./chunk-Q6MEI374.js";
 import {
   loadAzureConfig
-} from "./chunk-FQNQEK35.js";
+} from "./chunk-MAEF22DU.js";
 import {
   requireEntitlementToScan
-} from "./chunk-4UOTVQ2D.js";
-import "./chunk-2XRLDUAC.js";
-import "./chunk-CW3YCPEC.js";
+} from "./chunk-QQ67FRXQ.js";
+import "./chunk-ALPMCXOV.js";
+import "./chunk-XSHYWQAH.js";
 
 // src/azure-index.ts
 var LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 };

package/dist/azure-index.js.map

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../src/azure-index.ts"],
   "sourcesContent": ["/**\r\n * Azure Cloud Posture (CSPM) collector CLI entry point.\r\n *\r\n *   pnpm azure-scan       inventory every subscription the configured ARM\r\n *                         service principal can see (or the AZURE_SUBSCRIPTIONS\r\n *                         allow-list, if set) and push each to /ingest/azure\r\n *   pnpm azure-scan:dry   inventory and print a summary WITHOUT pushing\r\n *   tsx src/azure-index.ts --dry-run   (equivalent to azure-scan:dry)\r\n *\r\n * ONE service principal (ARM app registration, OAuth2 client-credentials) that\r\n * may see MANY subscriptions \u2014 unlike identity-index.ts's \"one Graph app\r\n * registration = one cloud org\", this loops {@link listAccessibleSubscriptions}\r\n * and builds + pushes ONE AzureInventory PER subscription, each versioned\r\n * independently on the control plane by subscriptionId. A gather that 403s on a\r\n * missing role/unregistered resource provider degrades that ONE signal\r\n * gracefully within a single subscription's build (see azure/plugin.ts); only a\r\n * failure to acquire a token or list subscriptions at all fails the whole run.\r\n *\r\n * Ctrl-C (SIGINT) triggers a cooperative AbortSignal so in-flight requests stop.\r\n */\r\nimport { loadAzureConfig } from \"./config.js\";\r\nimport { pushAzureInventory } from \"./core/push.js\";\r\nimport { ArmClient } from \"./azure/arm.js\";\r\nimport { buildAzureInventory, listAccessibleSubscriptions, type AzureStamp } from \"./azure/plugin.js\";\r\nimport type { Logger } from \"./core/runner.js\";\r\nimport type { AzureInventory } from \"@netdoc/collector-contract\";\r\nimport { requireEntitlementToScan } from \"./entitlement/index.js\";\r\n\r\nconst LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 } as const;\r\n\r\nfunction makeLogger(minLevel: keyof typeof LEVEL_RANK = \"info\"): Logger {\r\n  const min = LEVEL_RANK[minLevel];\r\n  return (level, msg, meta) => {\r\n    if (LEVEL_RANK[level] < min) return;\r\n    const line = `${new Date().toISOString()} ${level.toUpperCase().padEnd(5)} ${msg}`;\r\n    const out = level === \"error\" ? console.error : level === \"warn\" ? console.warn : console.log;\r\n    if (meta !== undefined) out(line, meta);\r\n    else out(line);\r\n  };\r\n}\r\n\r\nfunction errMsg(err: unknown): string {\r\n  return err instanceof Error ? err.message : String(err);\r\n}\r\n\r\nfunction printSummary(inv: AzureInventory, log: Logger): void {\r\n  log(\"info\", \"=== DRY RUN \u2014 AzureInventory NOT pushed ===\");\r\n  log(\"info\", `subscription     : ${inv.subscription.name} (${inv.subscriptionId})`);\r\n  log(\"info\", `tenant           : ${inv.tenantId}`);\r\n  log(\"info\", `directory tenant : ${inv.tenantDirId}`);\r\n  log(\"info\", `capturedAt       : ${inv.capturedAt}`);\r\n  log(\"info\", `state            : ${inv.subscription.state}`);\r\n  log(\r\n    \"info\",\r\n    `management group : ${inv.subscription.managementGroupName ?? inv.subscription.managementGroupId ?? \"not observed\"}`,\r\n  );\r\n  log(\"info\", `resources        : ${inv.resources.length}`);\r\n  // `hasRiskyInbound` is true when SOME inbound Allow rule names an any-source\r\n  // prefix; it says nothing about which port that rule opens, so an NSG fronting\r\n  // a public web server (443 from the internet, exactly as intended) sets it.\r\n  // Reporting that count as \"risky\" told the operator about an exposure this\r\n  // payload cannot substantiate \u2014 the per-port verdict belongs to the control\r\n  // plane's audit engine, which reads the rules shipped alongside the flag.\r\n  const internetFacingNsgs = inv.network.filter((n) => n.kind === \"nsg\" && n.hasRiskyInbound).length;\r\n  log(\"info\", `network entities : ${inv.network.length} (${internetFacingNsgs} NSG(s) with any-source inbound)`);\r\n  log(\"info\", `rbac assignments : ${inv.rbac.length} (${inv.rbac.filter((r) => r.isPrivileged).length} privileged)`);\r\n  if (inv.defender) {\r\n    log(\r\n      \"info\",\r\n      `defender         : secureScore=${inv.defender.secureScore ?? \"?\"} ` +\r\n        `${Object.keys(inv.defender.planCoverage).length} plan(s), ${inv.defender.recommendations.length} recommendation(s)`,\r\n    );\r\n  } else {\r\n    log(\"info\", \"defender         : not observed (missing Microsoft.Security role/RP registration?)\");\r\n  }\r\n  const nonCompliant = inv.policy.filter((p) => p.complianceState === \"NonCompliant\").length;\r\n  log(\"info\", `policy           : ${inv.policy.length} assignment(s) (${nonCompliant} non-compliant)`);\r\n}\r\n\r\nasync function main(): Promise<void> {\r\n  const argv = process.argv.slice(2);\r\n  const dryRun = argv.includes(\"--dry-run\");\r\n  const debug = argv.includes(\"--debug\") || process.env.LOG_LEVEL === \"debug\";\r\n  const log = makeLogger(debug ? \"debug\" : \"info\");\r\n\r\n  const config = loadAzureConfig();\r\n\r\n  // \u2500\u2500 PAID-LICENCE GATE \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\r\n  //\r\n  // BEFORE the client is built and before a credential leaves this process.\r\n  // `core/planRefusal.ts` named this exact path as the one its own refusal\r\n  // handling could not save: \"a refusal is learned at PUSH \u2014 which for a\r\n  // one-shot `netdoc-collector scan azure` is after the collector has already\r\n  // logged into the customer's Azure subscriptions and read their whole inventory\". Asking\r\n  // first is what closes it.\r\n  //\r\n  // `--dry-run` IS GATED TOO, deliberately. A dry run still authenticates to\r\n  // the customer's appliance and reads their estate; it merely declines to\r\n  // upload it. The connection is the thing an unentitled tenant must not make.\r\n  await requireEntitlementToScan(config, log, \"the one-shot Azure Cloud Posture scan\");\r\n\r\n\r\n  const controller = new AbortController();\r\n  const onSigint = (): void => {\r\n    log(\"warn\", \"SIGINT received \u2014 shutting down\u2026\");\r\n    controller.abort();\r\n  };\r\n  process.on(\"SIGINT\", onSigint);\r\n\r\n  log(\"info\", `Azure Cloud Posture (CSPM) collector starting (dryRun=${dryRun}) \u2014 ARM tenant ${config.azureTenantId}`);\r\n\r\n  try {\r\n    const client = new ArmClient(\r\n      {\r\n        tenantId: config.azureTenantId,\r\n        clientId: config.azureClientId,\r\n        clientSecret: config.azureClientSecret,\r\n        signal: controller.signal,\r\n      },\r\n      log,\r\n    );\r\n\r\n    const subs = await listAccessibleSubscriptions(client, config.azureSubscriptions);\r\n    log(\r\n      \"info\",\r\n      `found ${subs.length} accessible subscription(s): ${subs.map((s) => `${s.displayName} (${s.subscriptionId})`).join(\", \")}`,\r\n    );\r\n\r\n    for (const sub of subs) {\r\n      const stamp: AzureStamp = {\r\n        collectorId: config.collectorId,\r\n        tenantId: config.tenantId,\r\n        siteId: config.siteId,\r\n        tenantDirId: config.azureTenantId,\r\n      };\r\n      const inventory = await buildAzureInventory(client, sub, stamp, log);\r\n\r\n      if (dryRun) {\r\n        printSummary(inventory, log);\r\n        continue;\r\n      }\r\n\r\n      log(\"info\", `pushing Azure inventory for subscription ${sub.subscriptionId} to ${config.controlPlaneUrl}`);\r\n      const result = await pushAzureInventory(\r\n        inventory,\r\n        { controlPlaneUrl: config.controlPlaneUrl, apiKey: config.apiKey },\r\n        log,\r\n        controller.signal,\r\n      );\r\n      log(\"info\", `=== PUSH OK (subscription ${sub.subscriptionId}) ===`);\r\n      if (result.snapshotId) log(\"info\", `snapshotId  : ${result.snapshotId}`);\r\n      if (result.version !== undefined) log(\"info\", `version     : ${result.version}`);\r\n    }\r\n  } finally {\r\n    process.off(\"SIGINT\", onSigint);\r\n  }\r\n}\r\n\r\nmain().catch((err) => {\r\n  console.error(`${new Date().toISOString()} ERROR ${errMsg(err)}`);\r\n  process.exitCode = 1;\r\n});\r\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;AA4BA,IAAM,aAAa,EAAE,OAAO,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,GAAG;AAE9D,SAAS,WAAW,WAAoC,QAAgB;AACtE,QAAM,MAAM,WAAW,QAAQ;AAC/B,SAAO,CAAC,OAAO,KAAK,SAAS;AAC3B,QAAI,WAAW,KAAK,IAAI,IAAK;AAC7B,UAAM,OAAO,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG;AAChF,UAAM,MAAM,UAAU,UAAU,QAAQ,QAAQ,UAAU,SAAS,QAAQ,OAAO,QAAQ;AAC1F,QAAI,SAAS,OAAW,KAAI,MAAM,IAAI;AAAA,QACjC,KAAI,IAAI;AAAA,EACf;AACF;AAEA,SAAS,OAAO,KAAsB;AACpC,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;AAEA,SAAS,aAAa,KAAqB,KAAmB;AAC5D,MAAI,QAAQ,kDAA6C;AACzD,MAAI,QAAQ,sBAAsB,IAAI,aAAa,IAAI,KAAK,IAAI,cAAc,GAAG;AACjF,MAAI,QAAQ,sBAAsB,IAAI,QAAQ,EAAE;AAChD,MAAI,QAAQ,sBAAsB,IAAI,WAAW,EAAE;AACnD,MAAI,QAAQ,sBAAsB,IAAI,UAAU,EAAE;AAClD,MAAI,QAAQ,sBAAsB,IAAI,aAAa,KAAK,EAAE;AAC1D;AAAA,IACE;AAAA,IACA,sBAAsB,IAAI,aAAa,uBAAuB,IAAI,aAAa,qBAAqB,cAAc;AAAA,EACpH;AACA,MAAI,QAAQ,sBAAsB,IAAI,UAAU,MAAM,EAAE;AAOxD,QAAM,qBAAqB,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,eAAe,EAAE;AAC5F,MAAI,QAAQ,sBAAsB,IAAI,QAAQ,MAAM,KAAK,kBAAkB,kCAAkC;AAC7G,MAAI,QAAQ,sBAAsB,IAAI,KAAK,MAAM,KAAK,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc;AACjH,MAAI,IAAI,UAAU;AAChB;AAAA,MACE;AAAA,MACA,kCAAkC,IAAI,SAAS,eAAe,GAAG,IAC5D,OAAO,KAAK,IAAI,SAAS,YAAY,EAAE,MAAM,aAAa,IAAI,SAAS,gBAAgB,MAAM;AAAA,IACpG;AAAA,EACF,OAAO;AACL,QAAI,QAAQ,oFAAoF;AAAA,EAClG;AACA,QAAM,eAAe,IAAI,OAAO,OAAO,CAAC,MAAM,EAAE,oBAAoB,cAAc,EAAE;AACpF,MAAI,QAAQ,sBAAsB,IAAI,OAAO,MAAM,mBAAmB,YAAY,iBAAiB;AACrG;AAEA,eAAe,OAAsB;AACnC,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,QAAM,SAAS,KAAK,SAAS,WAAW;AACxC,QAAM,QAAQ,KAAK,SAAS,SAAS,KAAK,QAAQ,IAAI,cAAc;AACpE,QAAM,MAAM,WAAW,QAAQ,UAAU,MAAM;AAE/C,QAAM,SAAS,gBAAgB;AAc/B,QAAM,yBAAyB,QAAQ,KAAK,uCAAuC;AAGnF,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,WAAW,MAAY;AAC3B,QAAI,QAAQ,4CAAkC;AAC9C,eAAW,MAAM;AAAA,EACnB;AACA,UAAQ,GAAG,UAAU,QAAQ;AAE7B,MAAI,QAAQ,yDAAyD,MAAM,uBAAkB,OAAO,aAAa,EAAE;AAEnH,MAAI;AACF,UAAM,SAAS,IAAI;AAAA,MACjB;AAAA,QACE,UAAU,OAAO;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,cAAc,OAAO;AAAA,QACrB,QAAQ,WAAW;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,4BAA4B,QAAQ,OAAO,kBAAkB;AAChF;AAAA,MACE;AAAA,MACA,SAAS,KAAK,MAAM,gCAAgC,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,KAAK,EAAE,cAAc,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,IAC1H;AAEA,eAAW,OAAO,MAAM;AACtB,YAAM,QAAoB;AAAA,QACxB,aAAa,OAAO;AAAA,QACpB,UAAU,OAAO;AAAA,QACjB,QAAQ,OAAO;AAAA,QACf,aAAa,OAAO;AAAA,MACtB;AACA,YAAM,YAAY,MAAM,oBAAoB,QAAQ,KAAK,OAAO,GAAG;AAEnE,UAAI,QAAQ;AACV,qBAAa,WAAW,GAAG;AAC3B;AAAA,MACF;AAEA,UAAI,QAAQ,4CAA4C,IAAI,cAAc,OAAO,OAAO,eAAe,EAAE;AACzG,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,EAAE,iBAAiB,OAAO,iBAAiB,QAAQ,OAAO,OAAO;AAAA,QACjE;AAAA,QACA,WAAW;AAAA,MACb;AACA,UAAI,QAAQ,6BAA6B,IAAI,cAAc,OAAO;AAClE,UAAI,OAAO,WAAY,KAAI,QAAQ,iBAAiB,OAAO,UAAU,EAAE;AACvE,UAAI,OAAO,YAAY,OAAW,KAAI,QAAQ,iBAAiB,OAAO,OAAO,EAAE;AAAA,IACjF;AAAA,EACF,UAAE;AACA,YAAQ,IAAI,UAAU,QAAQ;AAAA,EAChC;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ,MAAM,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,UAAU,OAAO,GAAG,CAAC,EAAE;AAChE,UAAQ,WAAW;AACrB,CAAC;",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AA4BA,IAAM,aAAa,EAAE,OAAO,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,GAAG;AAE9D,SAAS,WAAW,WAAoC,QAAgB;AACtE,QAAM,MAAM,WAAW,QAAQ;AAC/B,SAAO,CAAC,OAAO,KAAK,SAAS;AAC3B,QAAI,WAAW,KAAK,IAAI,IAAK;AAC7B,UAAM,OAAO,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG;AAChF,UAAM,MAAM,UAAU,UAAU,QAAQ,QAAQ,UAAU,SAAS,QAAQ,OAAO,QAAQ;AAC1F,QAAI,SAAS,OAAW,KAAI,MAAM,IAAI;AAAA,QACjC,KAAI,IAAI;AAAA,EACf;AACF;AAEA,SAAS,OAAO,KAAsB;AACpC,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;AAEA,SAAS,aAAa,KAAqB,KAAmB;AAC5D,MAAI,QAAQ,kDAA6C;AACzD,MAAI,QAAQ,sBAAsB,IAAI,aAAa,IAAI,KAAK,IAAI,cAAc,GAAG;AACjF,MAAI,QAAQ,sBAAsB,IAAI,QAAQ,EAAE;AAChD,MAAI,QAAQ,sBAAsB,IAAI,WAAW,EAAE;AACnD,MAAI,QAAQ,sBAAsB,IAAI,UAAU,EAAE;AAClD,MAAI,QAAQ,sBAAsB,IAAI,aAAa,KAAK,EAAE;AAC1D;AAAA,IACE;AAAA,IACA,sBAAsB,IAAI,aAAa,uBAAuB,IAAI,aAAa,qBAAqB,cAAc;AAAA,EACpH;AACA,MAAI,QAAQ,sBAAsB,IAAI,UAAU,MAAM,EAAE;AAOxD,QAAM,qBAAqB,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,eAAe,EAAE;AAC5F,MAAI,QAAQ,sBAAsB,IAAI,QAAQ,MAAM,KAAK,kBAAkB,kCAAkC;AAC7G,MAAI,QAAQ,sBAAsB,IAAI,KAAK,MAAM,KAAK,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc;AACjH,MAAI,IAAI,UAAU;AAChB;AAAA,MACE;AAAA,MACA,kCAAkC,IAAI,SAAS,eAAe,GAAG,IAC5D,OAAO,KAAK,IAAI,SAAS,YAAY,EAAE,MAAM,aAAa,IAAI,SAAS,gBAAgB,MAAM;AAAA,IACpG;AAAA,EACF,OAAO;AACL,QAAI,QAAQ,oFAAoF;AAAA,EAClG;AACA,QAAM,eAAe,IAAI,OAAO,OAAO,CAAC,MAAM,EAAE,oBAAoB,cAAc,EAAE;AACpF,MAAI,QAAQ,sBAAsB,IAAI,OAAO,MAAM,mBAAmB,YAAY,iBAAiB;AACrG;AAEA,eAAe,OAAsB;AACnC,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,QAAM,SAAS,KAAK,SAAS,WAAW;AACxC,QAAM,QAAQ,KAAK,SAAS,SAAS,KAAK,QAAQ,IAAI,cAAc;AACpE,QAAM,MAAM,WAAW,QAAQ,UAAU,MAAM;AAE/C,QAAM,SAAS,gBAAgB;AAc/B,QAAM,yBAAyB,QAAQ,KAAK,uCAAuC;AAGnF,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,WAAW,MAAY;AAC3B,QAAI,QAAQ,4CAAkC;AAC9C,eAAW,MAAM;AAAA,EACnB;AACA,UAAQ,GAAG,UAAU,QAAQ;AAE7B,MAAI,QAAQ,yDAAyD,MAAM,uBAAkB,OAAO,aAAa,EAAE;AAEnH,MAAI;AACF,UAAM,SAAS,IAAI;AAAA,MACjB;AAAA,QACE,UAAU,OAAO;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,cAAc,OAAO;AAAA,QACrB,QAAQ,WAAW;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,4BAA4B,QAAQ,OAAO,kBAAkB;AAChF;AAAA,MACE;AAAA,MACA,SAAS,KAAK,MAAM,gCAAgC,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,KAAK,EAAE,cAAc,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,IAC1H;AAEA,eAAW,OAAO,MAAM;AACtB,YAAM,QAAoB;AAAA,QACxB,aAAa,OAAO;AAAA,QACpB,UAAU,OAAO;AAAA,QACjB,QAAQ,OAAO;AAAA,QACf,aAAa,OAAO;AAAA,MACtB;AACA,YAAM,YAAY,MAAM,oBAAoB,QAAQ,KAAK,OAAO,GAAG;AAEnE,UAAI,QAAQ;AACV,qBAAa,WAAW,GAAG;AAC3B;AAAA,MACF;AAEA,UAAI,QAAQ,4CAA4C,IAAI,cAAc,OAAO,OAAO,eAAe,EAAE;AACzG,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,EAAE,iBAAiB,OAAO,iBAAiB,QAAQ,OAAO,OAAO;AAAA,QACjE;AAAA,QACA,WAAW;AAAA,MACb;AACA,UAAI,QAAQ,6BAA6B,IAAI,cAAc,OAAO;AAClE,UAAI,OAAO,WAAY,KAAI,QAAQ,iBAAiB,OAAO,UAAU,EAAE;AACvE,UAAI,OAAO,YAAY,OAAW,KAAI,QAAQ,iBAAiB,OAAO,OAAO,EAAE;AAAA,IACjF;AAAA,EACF,UAAE;AACA,YAAQ,IAAI,UAAU,QAAQ;AAAA,EAChC;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ,MAAM,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,UAAU,OAAO,GAAG,CAAC,EAAE;AAChE,UAAQ,WAAW;AACrB,CAAC;",
   "names": []
 }

package/dist/{chunk-SSKRKLNM.js → chunk-25TNYVF5.js}

@@ -1,6 +1,6 @@
 import {
   insecureDispatcher
-} from "./chunk-4RUBV5WB.js";
+} from "./chunk-7ESBA5C5.js";
 import {
   DialPlanEntry,
   UnityVoicemail,
@@ -13,10 +13,23 @@ import {
   VoiceRegion,
   VoiceSystem,
   WebexCalling
-} from "./chunk-2XRLDUAC.js";
+} from "./chunk-ALPMCXOV.js";
 
 // src/voice/axl.ts
 import { XMLParser } from "fast-xml-parser";
+var AXL_REQUEST_TIMEOUT_MS = 12e4;
+var RISPORT_REQUEST_TIMEOUT_MS = 6e4;
+function requestSignal(signal, timeoutMs) {
+  const timeout = AbortSignal.timeout(timeoutMs);
+  return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
+function macFromCucmDeviceName(name) {
+  if (!name) return void 0;
+  const m = /^(?:SEP|ATA|AN|VGC)([0-9A-F]{12})$/i.exec(name.trim());
+  if (!m) return void 0;
+  const hex = m[1].toUpperCase();
+  return hex.match(/.{2}/g).join(":");
+}
 var noopLog = () => {
 };
 function xml(v) {
@@ -33,6 +46,11 @@ function buildListRequest(spec) {
 function errMsg(err) {
   return err instanceof Error ? err.message : String(err);
 }
+function isSchemaRejection(err) {
+  return /cvc-complex-type|cvc-|unmarshall?ing error|invalid content was found|not expected|returnedTags/i.test(
+    errMsg(err)
+  );
+}
 function bodySnippet(text) {
   const flat = text.replace(/\s+/g, " ").trim();
   return flat.length > 120 ? `${flat.slice(0, 120)}\u2026` : flat;
@@ -124,25 +142,52 @@ var AxlClient = class {
     const ret = asRecord(pick(firstResponse(body), "return"));
     return asStr(ret.componentVersion) ?? asStr(pick(ret.componentVersion, "version"));
   }
-  /** listPhone — every registered/provisioned phone + soft-client device. */
+  /**
+   * listPhone — every registered/provisioned phone + soft-client device.
+   *
+   * ── TWO TAG SETS (2026-09-15) ───────────────────────────────────────────────
+   *
+   * `ownerUserName` and `loadInformation` (the configured firmware load) are
+   * both returned by `listPhone` and both have had a home in the contract
+   * (`VoiceEndpoint.ownerUser` / `.firmware`) since it was written — they were
+   * simply never asked for, so every phone the portal shows has no owner and no
+   * firmware. They are asked for now. But a returnedTag the cluster's schema
+   * does not know fails the WHOLE request with a schema fault — and listPhone is
+   * the one call that gives the estate its phones — so a schema rejection is
+   * retried once with the original six tags, and the retreat is logged, rather
+   * than letting two optional columns cost the endpoint list.
+   */
   async listPhones() {
-    const body = await this.call(
-      buildListRequest({
-        op: "listPhone",
-        tags: ["name", "description", "product", "protocol", "devicePoolName", "callingSearchSpaceName"]
-      })
-    );
+    const baseTags = ["name", "description", "product", "protocol", "devicePoolName", "callingSearchSpaceName"];
+    const extraTags = ["ownerUserName", "loadInformation"];
+    let body;
+    try {
+      body = await this.call(buildListRequest({ op: "listPhone", tags: [...baseTags, ...extraTags] }));
+    } catch (err) {
+      if (!isSchemaRejection(err)) throw err;
+      this.log(
+        "warn",
+        `listPhone: this cluster's AXL schema rejected the ${extraTags.join("/")} tags (${errMsg(err)}); retrying without them \u2014 phones in this snapshot carry no owner or firmware`
+      );
+      body = await this.call(buildListRequest({ op: "listPhone", tags: baseTags }));
+    }
     const ret = asRecord(pick(firstResponse(body), "return"));
     return toArray(ret.phone).map((raw) => {
       const p = asRecord(raw);
+      const name = asStr(p.name);
+      const firmware = asStr(p.loadInformation);
+      const macAddress = macFromCucmDeviceName(name);
       return {
         uuid: asStr(p["@_uuid"]),
-        name: asStr(p.name),
+        name,
         description: asStr(p.description),
         model: asStr(p.product),
         protocol: asStr(p.protocol),
         devicePoolName: asStr(p.devicePoolName),
-        callingSearchSpaceName: asStr(p.callingSearchSpaceName)
+        callingSearchSpaceName: asStr(p.callingSearchSpaceName),
+        ...asStr(p.ownerUserName) ? { ownerUserName: asStr(p.ownerUserName) } : {},
+        ...firmware ? { firmware } : {},
+        ...macAddress ? { macAddress } : {}
       };
     });
   }
@@ -943,7 +988,9 @@ var AxlClient = class {
           Authorization: this.authHeader
         },
         body: envelope,
-        ...this.signal ? { signal: this.signal } : {}
+        // Bounded: a hung RIS service is the best-effort field staying "unknown",
+        // not the whole build waiting on it. See RISPORT_REQUEST_TIMEOUT_MS.
+        signal: requestSignal(this.signal, RISPORT_REQUEST_TIMEOUT_MS)
       });
       const text = await res.text();
       if (!res.ok) throw new Error(`RisPort70 request failed: HTTP ${res.status}`);
@@ -960,8 +1007,14 @@ var AxlClient = class {
           if (!name) continue;
           const statusRaw = (asStr(dev.Status) ?? "").toLowerCase();
           const status = statusRaw.includes("unregistered") ? "unregistered" : statusRaw.includes("registered") ? "registered" : "unknown";
-          const ipAddress = asStr(pick(asRecord(dev.IPAddress), "IP"));
-          out.set(name, { status, ...ipAddress ? { ipAddress } : {} });
+          const ipItems = toArray(asRecord(dev.IPAddress).item);
+          const ipAddress = asStr(pick(ipItems[0], "IP")) ?? asStr(pick(asRecord(dev.IPAddress), "IP"));
+          const firmware = asStr(dev.ActiveLoadID);
+          out.set(name, {
+            status,
+            ...ipAddress ? { ipAddress } : {},
+            ...firmware ? { firmware } : {}
+          });
         }
       }
     } catch (err) {
@@ -974,17 +1027,28 @@ var AxlClient = class {
   async call(innerXml) {
     if (this.signal?.aborted) throw new Error("AXL request aborted");
     const envelope = `<?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://www.cisco.com/AXL/API/${xml(this.version)}"><soapenv:Body>${innerXml}</soapenv:Body></soapenv:Envelope>`;
-    const res = await fetch(this.base, {
-      ...this.tlsInit,
-      method: "POST",
-      headers: {
-        "Content-Type": "text/xml; charset=utf-8",
-        SOAPAction: `CUCM:DB ver=${this.version}`,
-        Authorization: this.authHeader
-      },
-      body: envelope,
-      ...this.signal ? { signal: this.signal } : {}
-    });
+    let res;
+    try {
+      res = await fetch(this.base, {
+        ...this.tlsInit,
+        method: "POST",
+        headers: {
+          "Content-Type": "text/xml; charset=utf-8",
+          SOAPAction: `CUCM:DB ver=${this.version}`,
+          Authorization: this.authHeader
+        },
+        body: envelope,
+        // Job cancellation OR the per-request ceiling — see AXL_REQUEST_TIMEOUT_MS.
+        signal: requestSignal(this.signal, AXL_REQUEST_TIMEOUT_MS)
+      });
+    } catch (err) {
+      if (err instanceof Error && err.name === "TimeoutError") {
+        throw new Error(
+          `AXL at ${this.base} did not answer within ${Math.round(AXL_REQUEST_TIMEOUT_MS / 1e3)}s \u2014 the connection opened but no reply came back, so the node is reachable and something behind port 8443 is hung or the request is being dropped in flight (a stateful firewall, a CUCM mid-upgrade, a stopped Cisco AXL Web Service)`
+        );
+      }
+      throw err;
+    }
     const text = await res.text();
     if (res.status === 401) {
       throw new Error(
@@ -1028,6 +1092,7 @@ var AxlClient = class {
 // src/voice/cupi.ts
 var noopLog2 = () => {
 };
+var CUPI_REQUEST_TIMEOUT_MS = 3e4;
 function errMsg2(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -1093,12 +1158,23 @@ var CupiClient = class {
   // --- transport -------------------------------------------------------------
   async get(path) {
     if (this.signal?.aborted) throw new Error("CUPI request aborted");
-    const res = await fetch(`${this.base}${path}`, {
-      ...this.tlsInit,
-      method: "GET",
-      headers: { Accept: "application/json", Authorization: this.authHeader },
-      ...this.signal ? { signal: this.signal } : {}
-    });
+    const timeout = AbortSignal.timeout(CUPI_REQUEST_TIMEOUT_MS);
+    let res;
+    try {
+      res = await fetch(`${this.base}${path}`, {
+        ...this.tlsInit,
+        method: "GET",
+        headers: { Accept: "application/json", Authorization: this.authHeader },
+        signal: this.signal ? AbortSignal.any([this.signal, timeout]) : timeout
+      });
+    } catch (err) {
+      if (err instanceof Error && err.name === "TimeoutError") {
+        throw new Error(
+          `CUPI GET ${path} at ${this.base} did not answer within ${Math.round(CUPI_REQUEST_TIMEOUT_MS / 1e3)}s \u2014 the connection opened but no reply came back (Unity Connection hung, or the request dropped in flight)`
+        );
+      }
+      throw err;
+    }
     const text = await res.text();
     if (!res.ok) {
       throw new Error(`CUPI GET ${path} failed: HTTP ${res.status}: ${text.slice(0, 300)}`);
@@ -1116,6 +1192,7 @@ var CupiClient = class {
 var noopLog3 = () => {
 };
 var BASE = "https://webexapis.com/v1/";
+var WEBEX_REQUEST_TIMEOUT_MS = 3e4;
 function errMsg3(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -1224,11 +1301,22 @@ var WebexClient = class {
   }
   async getPage(url) {
     if (this.signal?.aborted) throw new Error("Webex request aborted");
-    const res = await fetch(url, {
-      method: "GET",
-      headers: { Accept: "application/json", Authorization: `Bearer ${this.token}` },
-      ...this.signal ? { signal: this.signal } : {}
-    });
+    const timeout = AbortSignal.timeout(WEBEX_REQUEST_TIMEOUT_MS);
+    let res;
+    try {
+      res = await fetch(url, {
+        method: "GET",
+        headers: { Accept: "application/json", Authorization: `Bearer ${this.token}` },
+        signal: this.signal ? AbortSignal.any([this.signal, timeout]) : timeout
+      });
+    } catch (err) {
+      if (err instanceof Error && err.name === "TimeoutError") {
+        throw new Error(
+          `Webex GET ${url} did not answer within ${Math.round(WEBEX_REQUEST_TIMEOUT_MS / 1e3)}s \u2014 the connection opened but no reply came back (a Webex outage, or an egress proxy holding the request)`
+        );
+      }
+      throw err;
+    }
     const text = await res.text();
     if (!res.ok) {
       throw new Error(`Webex GET ${url} failed: HTTP ${res.status}: ${text.slice(0, 300)}`);
@@ -1678,9 +1766,14 @@ async function buildCucmInventory(client, host, stamp, log = noopLog4) {
       callingSearchSpace: p.callingSearchSpaceName ?? null,
       registrationStatus: reg?.status ?? "unknown",
       ownerUser: p.ownerUserName ?? null,
+      // Derived from the device name by listPhones (2026-09-15) — the join key
+      // the plane's voice_endpoints MAC index exists for; it was always null.
       macAddress: p.macAddress ?? null,
       ipAddress: reg?.ipAddress ?? p.ipAddress ?? null,
-      firmware: p.firmware ?? null
+      // The load the phone is RUNNING (RisPort ActiveLoadID) over the load it is
+      // CONFIGURED for (listPhone loadInformation, blank when the device pool's
+      // default applies) — the first is what an upgrade audit needs.
+      firmware: reg?.firmware ?? p.firmware ?? null
     });
   });
   const dialPlan = [
@@ -1951,4 +2044,4 @@ export {
   buildUnityInventory,
   buildWebexInventory
 };
-//# sourceMappingURL=chunk-SSKRKLNM.js.map
+//# sourceMappingURL=chunk-25TNYVF5.js.map