infracensus-collector 1.6.49 → 1.6.50

package/dist/a10-index.js

@@ -4,11 +4,11 @@ import {
 } from "./chunk-EFV5GUNE.js";
 import {
   requireEntitlementToScan
-} from "./chunk-6353EHLX.js";
+} from "./chunk-KUEOHURR.js";
+import "./chunk-OQ6SPCYH.js";
 import {
   ROUTES
-} from "./chunk-4AXMNCP5.js";
-import "./chunk-CW3YCPEC.js";
+} from "./chunk-4GWOGLPA.js";
 
 // src/a10-index.ts
 var LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 };

package/dist/{archive-JL3PBIFB.js → archive-VPL7477A.js}

@@ -2,12 +2,12 @@ import {
   extensionKind,
   extractOpenXml,
   extractPlainText
-} from "./chunk-5GC7E57R.js";
+} from "./chunk-BBCSA255.js";
 import {
   checkEntryPath,
   checkEntrySize
 } from "./chunk-Q6I7N4PU.js";
-import "./chunk-4AXMNCP5.js";
+import "./chunk-4GWOGLPA.js";
 
 // src/sensitiveData/archive.ts
 import { unzipSync } from "fflate";
@@ -68,4 +68,4 @@ function extractArchive(bytes) {
 export {
   extractArchive
 };
-//# sourceMappingURL=archive-JL3PBIFB.js.map
+//# sourceMappingURL=archive-VPL7477A.js.map

package/dist/azure-index.js

@@ -2,20 +2,19 @@ import {
   ArmClient,
   buildAzureInventory,
   listAccessibleSubscriptions
-} from "./chunk-P3D7GCYX.js";
+} from "./chunk-RZDCYDRQ.js";
 import "./chunk-JGHHEJI5.js";
 import {
   pushAzureInventory
-} from "./chunk-GWLM5SN4.js";
-import "./chunk-E7ULEHSY.js";
-import {
-  loadAzureConfig
-} from "./chunk-TKAFSRRY.js";
+} from "./chunk-2AK6XGNY.js";
+import "./chunk-GXEWMGUU.js";
 import {
   requireEntitlementToScan
-} from "./chunk-6353EHLX.js";
-import "./chunk-4AXMNCP5.js";
-import "./chunk-CW3YCPEC.js";
+} from "./chunk-KUEOHURR.js";
+import {
+  loadAzureConfig
+} from "./chunk-OQ6SPCYH.js";
+import "./chunk-4GWOGLPA.js";
 
 // src/azure-index.ts
 var LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 };

package/dist/azure-index.js.map

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../src/azure-index.ts"],
   "sourcesContent": ["/**\r\n * Azure Cloud Posture (CSPM) collector CLI entry point.\r\n *\r\n *   pnpm azure-scan       inventory every subscription the configured ARM\r\n *                         service principal can see (or the AZURE_SUBSCRIPTIONS\r\n *                         allow-list, if set) and push each to /ingest/azure\r\n *   pnpm azure-scan:dry   inventory and print a summary WITHOUT pushing\r\n *   tsx src/azure-index.ts --dry-run   (equivalent to azure-scan:dry)\r\n *\r\n * ONE service principal (ARM app registration, OAuth2 client-credentials) that\r\n * may see MANY subscriptions \u2014 unlike identity-index.ts's \"one Graph app\r\n * registration = one cloud org\", this loops {@link listAccessibleSubscriptions}\r\n * and builds + pushes ONE AzureInventory PER subscription, each versioned\r\n * independently on the control plane by subscriptionId. A gather that 403s on a\r\n * missing role/unregistered resource provider degrades that ONE signal\r\n * gracefully within a single subscription's build (see azure/plugin.ts); only a\r\n * failure to acquire a token or list subscriptions at all fails the whole run.\r\n *\r\n * Ctrl-C (SIGINT) triggers a cooperative AbortSignal so in-flight requests stop.\r\n */\r\nimport { loadAzureConfig } from \"./config.js\";\r\nimport { pushAzureInventory } from \"./core/push.js\";\r\nimport { ArmClient } from \"./azure/arm.js\";\r\nimport { buildAzureInventory, listAccessibleSubscriptions, type AzureStamp } from \"./azure/plugin.js\";\r\nimport type { Logger } from \"./core/runner.js\";\r\nimport type { AzureInventory } from \"@netdoc/collector-contract\";\r\nimport { requireEntitlementToScan } from \"./entitlement/index.js\";\r\n\r\nconst LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 } as const;\r\n\r\nfunction makeLogger(minLevel: keyof typeof LEVEL_RANK = \"info\"): Logger {\r\n  const min = LEVEL_RANK[minLevel];\r\n  return (level, msg, meta) => {\r\n    if (LEVEL_RANK[level] < min) return;\r\n    const line = `${new Date().toISOString()} ${level.toUpperCase().padEnd(5)} ${msg}`;\r\n    const out = level === \"error\" ? console.error : level === \"warn\" ? console.warn : console.log;\r\n    if (meta !== undefined) out(line, meta);\r\n    else out(line);\r\n  };\r\n}\r\n\r\nfunction errMsg(err: unknown): string {\r\n  return err instanceof Error ? err.message : String(err);\r\n}\r\n\r\nfunction printSummary(inv: AzureInventory, log: Logger): void {\r\n  log(\"info\", \"=== DRY RUN \u2014 AzureInventory NOT pushed ===\");\r\n  log(\"info\", `subscription     : ${inv.subscription.name} (${inv.subscriptionId})`);\r\n  log(\"info\", `tenant           : ${inv.tenantId}`);\r\n  log(\"info\", `directory tenant : ${inv.tenantDirId}`);\r\n  log(\"info\", `capturedAt       : ${inv.capturedAt}`);\r\n  log(\"info\", `state            : ${inv.subscription.state}`);\r\n  log(\r\n    \"info\",\r\n    `management group : ${inv.subscription.managementGroupName ?? inv.subscription.managementGroupId ?? \"not observed\"}`,\r\n  );\r\n  log(\"info\", `resources        : ${inv.resources.length}`);\r\n  // `hasRiskyInbound` is true when SOME inbound Allow rule names an any-source\r\n  // prefix; it says nothing about which port that rule opens, so an NSG fronting\r\n  // a public web server (443 from the internet, exactly as intended) sets it.\r\n  // Reporting that count as \"risky\" told the operator about an exposure this\r\n  // payload cannot substantiate \u2014 the per-port verdict belongs to the control\r\n  // plane's audit engine, which reads the rules shipped alongside the flag.\r\n  const internetFacingNsgs = inv.network.filter((n) => n.kind === \"nsg\" && n.hasRiskyInbound).length;\r\n  log(\"info\", `network entities : ${inv.network.length} (${internetFacingNsgs} NSG(s) with any-source inbound)`);\r\n  log(\"info\", `rbac assignments : ${inv.rbac.length} (${inv.rbac.filter((r) => r.isPrivileged).length} privileged)`);\r\n  if (inv.defender) {\r\n    log(\r\n      \"info\",\r\n      `defender         : secureScore=${inv.defender.secureScore ?? \"?\"} ` +\r\n        `${Object.keys(inv.defender.planCoverage).length} plan(s), ${inv.defender.recommendations.length} recommendation(s)`,\r\n    );\r\n  } else {\r\n    log(\"info\", \"defender         : not observed (missing Microsoft.Security role/RP registration?)\");\r\n  }\r\n  const nonCompliant = inv.policy.filter((p) => p.complianceState === \"NonCompliant\").length;\r\n  log(\"info\", `policy           : ${inv.policy.length} assignment(s) (${nonCompliant} non-compliant)`);\r\n}\r\n\r\nasync function main(): Promise<void> {\r\n  const argv = process.argv.slice(2);\r\n  const dryRun = argv.includes(\"--dry-run\");\r\n  const debug = argv.includes(\"--debug\") || process.env.LOG_LEVEL === \"debug\";\r\n  const log = makeLogger(debug ? \"debug\" : \"info\");\r\n\r\n  const config = loadAzureConfig();\r\n\r\n  // \u2500\u2500 PAID-LICENCE GATE \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\r\n  //\r\n  // BEFORE the client is built and before a credential leaves this process.\r\n  // `core/planRefusal.ts` named this exact path as the one its own refusal\r\n  // handling could not save: \"a refusal is learned at PUSH \u2014 which for a\r\n  // one-shot `netdoc-collector scan azure` is after the collector has already\r\n  // logged into the customer's Azure subscriptions and read their whole inventory\". Asking\r\n  // first is what closes it.\r\n  //\r\n  // `--dry-run` IS GATED TOO, deliberately. A dry run still authenticates to\r\n  // the customer's appliance and reads their estate; it merely declines to\r\n  // upload it. The connection is the thing an unentitled tenant must not make.\r\n  await requireEntitlementToScan(config, log, \"the one-shot Azure Cloud Posture scan\");\r\n\r\n\r\n  const controller = new AbortController();\r\n  const onSigint = (): void => {\r\n    log(\"warn\", \"SIGINT received \u2014 shutting down\u2026\");\r\n    controller.abort();\r\n  };\r\n  process.on(\"SIGINT\", onSigint);\r\n\r\n  log(\"info\", `Azure Cloud Posture (CSPM) collector starting (dryRun=${dryRun}) \u2014 ARM tenant ${config.azureTenantId}`);\r\n\r\n  try {\r\n    const client = new ArmClient(\r\n      {\r\n        tenantId: config.azureTenantId,\r\n        clientId: config.azureClientId,\r\n        clientSecret: config.azureClientSecret,\r\n        signal: controller.signal,\r\n      },\r\n      log,\r\n    );\r\n\r\n    const subs = await listAccessibleSubscriptions(client, config.azureSubscriptions);\r\n    log(\r\n      \"info\",\r\n      `found ${subs.length} accessible subscription(s): ${subs.map((s) => `${s.displayName} (${s.subscriptionId})`).join(\", \")}`,\r\n    );\r\n\r\n    for (const sub of subs) {\r\n      const stamp: AzureStamp = {\r\n        collectorId: config.collectorId,\r\n        tenantId: config.tenantId,\r\n        siteId: config.siteId,\r\n        tenantDirId: config.azureTenantId,\r\n      };\r\n      const inventory = await buildAzureInventory(client, sub, stamp, log);\r\n\r\n      if (dryRun) {\r\n        printSummary(inventory, log);\r\n        continue;\r\n      }\r\n\r\n      log(\"info\", `pushing Azure inventory for subscription ${sub.subscriptionId} to ${config.controlPlaneUrl}`);\r\n      const result = await pushAzureInventory(\r\n        inventory,\r\n        { controlPlaneUrl: config.controlPlaneUrl, apiKey: config.apiKey },\r\n        log,\r\n        controller.signal,\r\n      );\r\n      log(\"info\", `=== PUSH OK (subscription ${sub.subscriptionId}) ===`);\r\n      if (result.snapshotId) log(\"info\", `snapshotId  : ${result.snapshotId}`);\r\n      if (result.version !== undefined) log(\"info\", `version     : ${result.version}`);\r\n    }\r\n  } finally {\r\n    process.off(\"SIGINT\", onSigint);\r\n  }\r\n}\r\n\r\nmain().catch((err) => {\r\n  console.error(`${new Date().toISOString()} ERROR ${errMsg(err)}`);\r\n  process.exitCode = 1;\r\n});\r\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;AA4BA,IAAM,aAAa,EAAE,OAAO,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,GAAG;AAE9D,SAAS,WAAW,WAAoC,QAAgB;AACtE,QAAM,MAAM,WAAW,QAAQ;AAC/B,SAAO,CAAC,OAAO,KAAK,SAAS;AAC3B,QAAI,WAAW,KAAK,IAAI,IAAK;AAC7B,UAAM,OAAO,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG;AAChF,UAAM,MAAM,UAAU,UAAU,QAAQ,QAAQ,UAAU,SAAS,QAAQ,OAAO,QAAQ;AAC1F,QAAI,SAAS,OAAW,KAAI,MAAM,IAAI;AAAA,QACjC,KAAI,IAAI;AAAA,EACf;AACF;AAEA,SAAS,OAAO,KAAsB;AACpC,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;AAEA,SAAS,aAAa,KAAqB,KAAmB;AAC5D,MAAI,QAAQ,kDAA6C;AACzD,MAAI,QAAQ,sBAAsB,IAAI,aAAa,IAAI,KAAK,IAAI,cAAc,GAAG;AACjF,MAAI,QAAQ,sBAAsB,IAAI,QAAQ,EAAE;AAChD,MAAI,QAAQ,sBAAsB,IAAI,WAAW,EAAE;AACnD,MAAI,QAAQ,sBAAsB,IAAI,UAAU,EAAE;AAClD,MAAI,QAAQ,sBAAsB,IAAI,aAAa,KAAK,EAAE;AAC1D;AAAA,IACE;AAAA,IACA,sBAAsB,IAAI,aAAa,uBAAuB,IAAI,aAAa,qBAAqB,cAAc;AAAA,EACpH;AACA,MAAI,QAAQ,sBAAsB,IAAI,UAAU,MAAM,EAAE;AAOxD,QAAM,qBAAqB,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,eAAe,EAAE;AAC5F,MAAI,QAAQ,sBAAsB,IAAI,QAAQ,MAAM,KAAK,kBAAkB,kCAAkC;AAC7G,MAAI,QAAQ,sBAAsB,IAAI,KAAK,MAAM,KAAK,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc;AACjH,MAAI,IAAI,UAAU;AAChB;AAAA,MACE;AAAA,MACA,kCAAkC,IAAI,SAAS,eAAe,GAAG,IAC5D,OAAO,KAAK,IAAI,SAAS,YAAY,EAAE,MAAM,aAAa,IAAI,SAAS,gBAAgB,MAAM;AAAA,IACpG;AAAA,EACF,OAAO;AACL,QAAI,QAAQ,oFAAoF;AAAA,EAClG;AACA,QAAM,eAAe,IAAI,OAAO,OAAO,CAAC,MAAM,EAAE,oBAAoB,cAAc,EAAE;AACpF,MAAI,QAAQ,sBAAsB,IAAI,OAAO,MAAM,mBAAmB,YAAY,iBAAiB;AACrG;AAEA,eAAe,OAAsB;AACnC,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,QAAM,SAAS,KAAK,SAAS,WAAW;AACxC,QAAM,QAAQ,KAAK,SAAS,SAAS,KAAK,QAAQ,IAAI,cAAc;AACpE,QAAM,MAAM,WAAW,QAAQ,UAAU,MAAM;AAE/C,QAAM,SAAS,gBAAgB;AAc/B,QAAM,yBAAyB,QAAQ,KAAK,uCAAuC;AAGnF,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,WAAW,MAAY;AAC3B,QAAI,QAAQ,4CAAkC;AAC9C,eAAW,MAAM;AAAA,EACnB;AACA,UAAQ,GAAG,UAAU,QAAQ;AAE7B,MAAI,QAAQ,yDAAyD,MAAM,uBAAkB,OAAO,aAAa,EAAE;AAEnH,MAAI;AACF,UAAM,SAAS,IAAI;AAAA,MACjB;AAAA,QACE,UAAU,OAAO;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,cAAc,OAAO;AAAA,QACrB,QAAQ,WAAW;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,4BAA4B,QAAQ,OAAO,kBAAkB;AAChF;AAAA,MACE;AAAA,MACA,SAAS,KAAK,MAAM,gCAAgC,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,KAAK,EAAE,cAAc,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,IAC1H;AAEA,eAAW,OAAO,MAAM;AACtB,YAAM,QAAoB;AAAA,QACxB,aAAa,OAAO;AAAA,QACpB,UAAU,OAAO;AAAA,QACjB,QAAQ,OAAO;AAAA,QACf,aAAa,OAAO;AAAA,MACtB;AACA,YAAM,YAAY,MAAM,oBAAoB,QAAQ,KAAK,OAAO,GAAG;AAEnE,UAAI,QAAQ;AACV,qBAAa,WAAW,GAAG;AAC3B;AAAA,MACF;AAEA,UAAI,QAAQ,4CAA4C,IAAI,cAAc,OAAO,OAAO,eAAe,EAAE;AACzG,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,EAAE,iBAAiB,OAAO,iBAAiB,QAAQ,OAAO,OAAO;AAAA,QACjE;AAAA,QACA,WAAW;AAAA,MACb;AACA,UAAI,QAAQ,6BAA6B,IAAI,cAAc,OAAO;AAClE,UAAI,OAAO,WAAY,KAAI,QAAQ,iBAAiB,OAAO,UAAU,EAAE;AACvE,UAAI,OAAO,YAAY,OAAW,KAAI,QAAQ,iBAAiB,OAAO,OAAO,EAAE;AAAA,IACjF;AAAA,EACF,UAAE;AACA,YAAQ,IAAI,UAAU,QAAQ;AAAA,EAChC;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ,MAAM,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,UAAU,OAAO,GAAG,CAAC,EAAE;AAChE,UAAQ,WAAW;AACrB,CAAC;",
+  "mappings": ";;;;;;;;;;;;;;;;;;;AA4BA,IAAM,aAAa,EAAE,OAAO,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,GAAG;AAE9D,SAAS,WAAW,WAAoC,QAAgB;AACtE,QAAM,MAAM,WAAW,QAAQ;AAC/B,SAAO,CAAC,OAAO,KAAK,SAAS;AAC3B,QAAI,WAAW,KAAK,IAAI,IAAK;AAC7B,UAAM,OAAO,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG;AAChF,UAAM,MAAM,UAAU,UAAU,QAAQ,QAAQ,UAAU,SAAS,QAAQ,OAAO,QAAQ;AAC1F,QAAI,SAAS,OAAW,KAAI,MAAM,IAAI;AAAA,QACjC,KAAI,IAAI;AAAA,EACf;AACF;AAEA,SAAS,OAAO,KAAsB;AACpC,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;AAEA,SAAS,aAAa,KAAqB,KAAmB;AAC5D,MAAI,QAAQ,kDAA6C;AACzD,MAAI,QAAQ,sBAAsB,IAAI,aAAa,IAAI,KAAK,IAAI,cAAc,GAAG;AACjF,MAAI,QAAQ,sBAAsB,IAAI,QAAQ,EAAE;AAChD,MAAI,QAAQ,sBAAsB,IAAI,WAAW,EAAE;AACnD,MAAI,QAAQ,sBAAsB,IAAI,UAAU,EAAE;AAClD,MAAI,QAAQ,sBAAsB,IAAI,aAAa,KAAK,EAAE;AAC1D;AAAA,IACE;AAAA,IACA,sBAAsB,IAAI,aAAa,uBAAuB,IAAI,aAAa,qBAAqB,cAAc;AAAA,EACpH;AACA,MAAI,QAAQ,sBAAsB,IAAI,UAAU,MAAM,EAAE;AAOxD,QAAM,qBAAqB,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,eAAe,EAAE;AAC5F,MAAI,QAAQ,sBAAsB,IAAI,QAAQ,MAAM,KAAK,kBAAkB,kCAAkC;AAC7G,MAAI,QAAQ,sBAAsB,IAAI,KAAK,MAAM,KAAK,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc;AACjH,MAAI,IAAI,UAAU;AAChB;AAAA,MACE;AAAA,MACA,kCAAkC,IAAI,SAAS,eAAe,GAAG,IAC5D,OAAO,KAAK,IAAI,SAAS,YAAY,EAAE,MAAM,aAAa,IAAI,SAAS,gBAAgB,MAAM;AAAA,IACpG;AAAA,EACF,OAAO;AACL,QAAI,QAAQ,oFAAoF;AAAA,EAClG;AACA,QAAM,eAAe,IAAI,OAAO,OAAO,CAAC,MAAM,EAAE,oBAAoB,cAAc,EAAE;AACpF,MAAI,QAAQ,sBAAsB,IAAI,OAAO,MAAM,mBAAmB,YAAY,iBAAiB;AACrG;AAEA,eAAe,OAAsB;AACnC,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,QAAM,SAAS,KAAK,SAAS,WAAW;AACxC,QAAM,QAAQ,KAAK,SAAS,SAAS,KAAK,QAAQ,IAAI,cAAc;AACpE,QAAM,MAAM,WAAW,QAAQ,UAAU,MAAM;AAE/C,QAAM,SAAS,gBAAgB;AAc/B,QAAM,yBAAyB,QAAQ,KAAK,uCAAuC;AAGnF,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,WAAW,MAAY;AAC3B,QAAI,QAAQ,4CAAkC;AAC9C,eAAW,MAAM;AAAA,EACnB;AACA,UAAQ,GAAG,UAAU,QAAQ;AAE7B,MAAI,QAAQ,yDAAyD,MAAM,uBAAkB,OAAO,aAAa,EAAE;AAEnH,MAAI;AACF,UAAM,SAAS,IAAI;AAAA,MACjB;AAAA,QACE,UAAU,OAAO;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,cAAc,OAAO;AAAA,QACrB,QAAQ,WAAW;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,4BAA4B,QAAQ,OAAO,kBAAkB;AAChF;AAAA,MACE;AAAA,MACA,SAAS,KAAK,MAAM,gCAAgC,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,KAAK,EAAE,cAAc,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,IAC1H;AAEA,eAAW,OAAO,MAAM;AACtB,YAAM,QAAoB;AAAA,QACxB,aAAa,OAAO;AAAA,QACpB,UAAU,OAAO;AAAA,QACjB,QAAQ,OAAO;AAAA,QACf,aAAa,OAAO;AAAA,MACtB;AACA,YAAM,YAAY,MAAM,oBAAoB,QAAQ,KAAK,OAAO,GAAG;AAEnE,UAAI,QAAQ;AACV,qBAAa,WAAW,GAAG;AAC3B;AAAA,MACF;AAEA,UAAI,QAAQ,4CAA4C,IAAI,cAAc,OAAO,OAAO,eAAe,EAAE;AACzG,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,EAAE,iBAAiB,OAAO,iBAAiB,QAAQ,OAAO,OAAO;AAAA,QACjE;AAAA,QACA,WAAW;AAAA,MACb;AACA,UAAI,QAAQ,6BAA6B,IAAI,cAAc,OAAO;AAClE,UAAI,OAAO,WAAY,KAAI,QAAQ,iBAAiB,OAAO,UAAU,EAAE;AACvE,UAAI,OAAO,YAAY,OAAW,KAAI,QAAQ,iBAAiB,OAAO,OAAO,EAAE;AAAA,IACjF;AAAA,EACF,UAAE;AACA,YAAQ,IAAI,UAAU,QAAQ;AAAA,EAChC;AACF;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ,MAAM,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,UAAU,OAAO,GAAG,CAAC,EAAE;AAChE,UAAQ,WAAW;AACrB,CAAC;",
   "names": []
 }

package/dist/{chunk-QW4IV7RU.js → chunk-25IVLIWJ.js}

@@ -5,13 +5,13 @@ function isServiceVerb(word) {
 }
 async function runService(verb) {
   if (process.platform === "win32") {
-    const win = await import("./windows-2P76ECNN.js");
+    const win = await import("./windows-ZNTFTTMK.js");
     if (verb === "install") return win.windowsInstall();
     if (verb === "uninstall") return win.windowsUninstall();
     return win.windowsStatus();
   }
   if (process.platform === "linux") {
-    const linux = await import("./linux-7OIQNB4O.js");
+    const linux = await import("./linux-3CBJ43HB.js");
     if (verb === "install") return linux.linuxInstall();
     if (verb === "uninstall") return linux.linuxUninstall();
     return linux.linuxStatus();
@@ -25,4 +25,4 @@ export {
   isServiceVerb,
   runService
 };
-//# sourceMappingURL=chunk-QW4IV7RU.js.map
+//# sourceMappingURL=chunk-25IVLIWJ.js.map

package/dist/{chunk-GWLM5SN4.js → chunk-2AK6XGNY.js}

@@ -1,7 +1,7 @@
 import {
   isPlanRefusal,
   planRefusalFrom
-} from "./chunk-E7ULEHSY.js";
+} from "./chunk-GXEWMGUU.js";
 import {
   COLLECTOR_AUTH_HEADER,
   IngestResult,
@@ -10,7 +10,7 @@ import {
   SnapshotUploadCloseResult,
   SnapshotUploadOpenResult,
   collectorBearer
-} from "./chunk-6353EHLX.js";
+} from "./chunk-KUEOHURR.js";
 import {
   ApiError,
   CertReportResult,
@@ -19,7 +19,7 @@ import {
   SddRunBatchResult,
   SddRunCloseResult,
   SddRunOpenResult
-} from "./chunk-4AXMNCP5.js";
+} from "./chunk-4GWOGLPA.js";
 
 // src/core/snapshotChunks.ts
 var CHUNK_THRESHOLD_BYTES = 1048576;
@@ -552,4 +552,4 @@ export {
   pushSddBatch,
   pushSddRunClose
 };
-//# sourceMappingURL=chunk-GWLM5SN4.js.map
+//# sourceMappingURL=chunk-2AK6XGNY.js.map

package/dist/{chunk-33SGYN2R.js → chunk-36R3CWBW.js}

@@ -16,7 +16,7 @@ import {
   IdentityIngestBody,
   M365Licensing,
   M365Workload
-} from "./chunk-4AXMNCP5.js";
+} from "./chunk-4GWOGLPA.js";
 
 // src/identity/graph.ts
 var noopLog = () => {
@@ -1136,4 +1136,4 @@ export {
   GraphClient,
   buildIdentityInventory
 };
-//# sourceMappingURL=chunk-33SGYN2R.js.map
+//# sourceMappingURL=chunk-36R3CWBW.js.map

package/dist/{chunk-4AXMNCP5.js → chunk-4GWOGLPA.js}

@@ -2398,6 +2398,10 @@ var ROUTES = {
   // ?siteId=&id= (&version=N optional)
   deviceOverride: `${API_BASE}/inventory/device/override`,
   // POST upsert | DELETE ?deviceId= (WRITE)
+  // Manual upstream parent per device (0229) — what dependency-aware alert
+  // suppression walks before LLDP/CDP-inferred parents.
+  deviceParent: `${API_BASE}/inventory/device/parent`,
+  // GET ?siteId= -> DeviceParentsResponse | PUT SetDeviceParentBody | DELETE ?deviceId= (WRITE)
   deviceClassRules: `${API_BASE}/inventory/class-rules`,
   // GET list | POST upsert | DELETE ?id= (ADMIN)
   snapshots: `${API_BASE}/inventory/snapshots`,
@@ -2462,6 +2466,23 @@ var ROUTES = {
   // POST RevokeCollectorBody (session ADMIN) — 0139 tombstone: key dead, row and history kept
   collectorUiAuth: `${API_BASE}/collector/ui-auth`,
   // POST CollectorUiAuthBody (collector key) — the localhost UI's login, verified against an ACTIVE account of the key's own tenant
+  // Collector self-update (0226). The collector asks which build this plane
+  // ships with and whether it may update itself; the portal flips the switch.
+  // POST like every other collector config pull (collectorMonitorTargets,
+  // collectorSites) — the key rides the Bearer header, never a query string.
+  collectorUpdatePolicy: `${API_BASE}/collector/update-policy`,
+  // POST (collector key) -> CollectorUpdatePolicy
+  collectorSelfUpdate: `${API_BASE}/collectors/self-update`,
+  // PUT SetCollectorSelfUpdateBody (session ADMIN) -> SetCollectorSelfUpdateResult
+  // Portal schedule editor (0227). Edits are QUEUED here and delivered on the
+  // jobs/next poll (`ClaimedJobResponse.scheduleEdits`); the collector applies
+  // them with its local console's own code and acknowledges on its status
+  // report (`CollectorReportedState.scheduleEditAcks`). The plane never owns a
+  // schedule — it only carries a request to the host that does.
+  collectorSchedules: `${API_BASE}/collectors/schedules`,
+  // GET ?collectorId= (session ADMIN) -> CollectorSchedulesResponse
+  collectorScheduleEdits: `${API_BASE}/collectors/schedule-edits`,
+  // POST SubmitScheduleEditBody (session ADMIN) -> SubmitScheduleEditResult
   // `credentialSets: ${API_BASE}/credential-sets` stood here until 2026-09-01.
   // Credentials live on the collector host now, encrypted under an OS-native
   // key; there is no route to store one here and there must never be another.
@@ -2704,6 +2725,9 @@ var ROUTES = {
   // POST ?siteId= (session, WRITE)
   topologyInferredReview: `${API_BASE}/topology/inferred/review`,
   // POST ?siteId= {id,state} (session, WRITE)
+  // Pinned diagram layouts (0228): per (site, view), shared by the tenant.
+  diagramLayout: `${API_BASE}/topology/layout`,
+  // GET ?siteId=&viewKey= -> DiagramLayoutResponse | PUT PutDiagramLayoutBody | DELETE ?siteId=&viewKey= (WRITE)
   // The Assistant's seven routes (`/assistant/chat`, `/capabilities`, `/search`,
   // `/conversations`, `/conversation`, `/usage`) stood here until 2026-10-02,
   // when the module was retired. See RETIRED_MODULE_KEYS in entitlement.ts.
@@ -2739,6 +2763,9 @@ var ROUTES = {
   // broken feature that never fires.
   metricBaselines: `${API_BASE}/metrics/baselines`,
   // GET ?siteId=[&interface=] (session, READ)
+  // The rows `metrics/alerting.ts` evaluates (metric_thresholds, 0100).
+  metricThresholds: `${API_BASE}/metrics/thresholds`,
+  // GET [?siteId=] -> MetricThresholdsResponse | POST CreateMetricThresholdBody | PUT UpdateMetricThresholdBody | DELETE ?id= (WRITE)
   alertWindows: `${API_BASE}/alert-windows`,
   // GET [?siteId=] (READ) | POST (WRITE) | DELETE ?id= (WRITE)
   // Logical (L3) network view + path trace (spec §5).
@@ -3095,8 +3122,47 @@ var ROUTES = {
   // GET ?planId= (session, CONFIG) — the full plan incl. commands
   advisorPlanReview: `${API_BASE}/advisor/plan/review`,
   // POST {planId,reviewState,notes?} (session, CONFIG)
-  advisorPlanExport: `${API_BASE}/advisor/plan/export`
+  advisorPlanExport: `${API_BASE}/advisor/plan/export`,
   // GET ?planId= (session, CONFIG) — MOP as Markdown
+  // ── Source of Truth (docs/design/source-of-truth.md, 2026-10-07) ─────────────
+  // No new module key: every route below rides an existing gate.
+  // F1 Approved Baseline — config-management (M_CONFIG_MGMT). No route here returns config text.
+  baseline: `${API_BASE}/baseline`,
+  // GET ?siteId= (session, READ, M_CONFIG_MGMT) — active snapshot + config baselines and deviation counts by status/severity
+  baselineSnapshot: `${API_BASE}/baseline/snapshot`,
+  // POST BaselineSnapshotBody (session, ADMIN, M_CONFIG_MGMT full) — approve a snapshot as the site's baseline
+  baselineConfig: `${API_BASE}/baseline/config`,
+  // POST BaselineConfigBody (session, ADMIN, M_CONFIG_MGMT full) — approve a device's config revision
+  baselineClear: `${API_BASE}/baseline/clear`,
+  // DELETE ?siteId=&kind=&deviceId= (session, ADMIN, M_CONFIG_MGMT full) — deactivate a baseline (row kept)
+  baselineRebaseline: `${API_BASE}/baseline/rebaseline`,
+  // POST BaselineRebaselineBody (session, ADMIN, M_CONFIG_MGMT full) — re-point at the newest snapshot, close accepted items
+  baselineDeviations: `${API_BASE}/baseline/deviations`,
+  // GET ?siteId=&status=&severity=&category= (session, READ, M_CONFIG_MGMT) — the deviation queue
+  baselineDeviationAction: `${API_BASE}/baseline/deviations/action`,
+  // POST BaselineDeviationActionBody (session, WRITE, M_CONFIG_MGMT full) — acknowledge / accept / reopen
+  // F2 NetBox — documentation (M_DOCUMENTATION); writes at "full". Cloud-direct + CSV fallback.
+  netboxSettings: `${API_BASE}/integrations/netbox`,
+  // GET (session, READ) token masked | PUT NetboxSettingsBody | DELETE (session, ADMIN, documentation full)
+  netboxTest: `${API_BASE}/integrations/netbox/test`,
+  // POST (session, ADMIN, documentation full) — GET /api/status/ on the saved NetBox, 8 s timeout
+  netboxPreview: `${API_BASE}/integrations/netbox/preview`,
+  // POST NetboxPreviewBody (session, ADMIN, documentation full) — dry run: create/update/unchanged per object type
+  netboxPush: `${API_BASE}/integrations/netbox/push`,
+  // POST NetboxPushBody (session, ADMIN, documentation full) — bounded push; repeat while a cursor is returned
+  netboxImport: `${API_BASE}/integrations/netbox/import`,
+  // POST NetboxImportBody (session, ADMIN, documentation full) — NetBox sites/prefixes → sites/site_networks
+  netboxRuns: `${API_BASE}/integrations/netbox/runs`,
+  // GET (session, READ, M_DOCUMENTATION) — preview/push/import run log
+  netboxCsv: `${API_BASE}/integrations/netbox/csv`,
+  // GET ?siteId=&object= (session, READ, M_DOCUMENTATION) — NetBox bulk-import CSV (text/csv)
+  // F3 Lifecycle data — lifecycle (M_LIFECYCLE).
+  lifecycleEoxRefresh: `${API_BASE}/lifecycle/eox-refresh`,
+  // POST LifecycleEoxRefreshBody (session, ADMIN, M_LIFECYCLE) — Cisco EoX by this tenant's own PIDs, ≤20 per call, cached
+  // F4a Azure network diagram — network-diagrams (M_DIAGRAMS). Tenant-wide like /azure.
+  azureNetworkDiagram: `${API_BASE}/azure/network-diagram`
+  // GET ?subscriptionId= (session, READ, M_DIAGRAMS) — subscriptions/VNets/subnets/NSGs/gateways + edges, capped
+  // ── end Source of Truth ──────────────────────────────────────────────────────
 };
 var PLANE_ENVIRONMENTS = ["stage", "production"];
 var PlaneEnvironment = z18.enum(PLANE_ENVIRONMENTS);
@@ -4018,12 +4084,79 @@ var CollectorInstance = z18.object({
   sealingKey: SealingPublicKey.nullable().optional()
 });
 var ClaimedJob = ScanJob.nullable();
+var EditableScanSchedule = z18.object({
+  name: z18.string().min(1).max(200),
+  enabled: z18.boolean().default(true),
+  siteId: z18.string().min(1),
+  domain: ScanDomain.default("network"),
+  targets: z18.array(z18.string().min(1)).max(500).default([]),
+  domainTarget: DomainScanTarget.optional(),
+  localCredentialSetId: z18.string().min(1).max(200).optional(),
+  timing: ScheduleTiming
+}).strict().refine(
+  (s) => s.domain !== "network" || s.targets.length > 0,
+  "a network scan schedule needs at least one target"
+);
+var ScheduleEditOp = z18.enum(["create", "update", "delete", "setEnabled"]);
+function scheduleEditIssue(e) {
+  const hasId = typeof e.scheduleId === "string" && e.scheduleId.length > 0;
+  switch (e.op) {
+    case "create":
+      if (hasId) return "a create carries no scheduleId; the collector assigns one";
+      return e.schedule === void 0 ? "a create needs the schedule" : null;
+    case "update":
+      if (!hasId) return "an update needs the scheduleId";
+      return e.schedule === void 0 ? "an update needs the whole schedule" : null;
+    case "delete":
+      return hasId ? null : "a delete needs the scheduleId";
+    case "setEnabled":
+      if (!hasId) return "setEnabled needs the scheduleId";
+      return e.enabled === void 0 ? "setEnabled needs enabled" : null;
+  }
+}
+var scheduleEditFields = {
+  op: ScheduleEditOp,
+  /** The collector's own schedule id. Absent on a create. */
+  scheduleId: z18.string().min(1).max(200).optional(),
+  /** The full definition, on create and update. */
+  schedule: EditableScanSchedule.optional(),
+  /** The new state, on setEnabled. */
+  enabled: z18.boolean().optional()
+};
+var ScheduleEditFields = z18.object({
+  /** Plane-side id (collector_schedule_edits.id); what the ack names. */
+  id: z18.string().min(1).max(200),
+  ...scheduleEditFields,
+  createdAt: z18.string(),
+  /** Who asked — the portal user's email, for the collector's local log. */
+  createdBy: z18.string().max(320)
+});
+var ScheduleEdit = ScheduleEditFields.superRefine((e, ctx) => {
+  const issue = scheduleEditIssue(e);
+  if (issue) ctx.addIssue({ code: z18.ZodIssueCode.custom, message: issue });
+});
+var ScheduleEditAck = z18.object({
+  id: z18.string().min(1).max(200),
+  outcome: z18.enum(["applied", "rejected"]),
+  /** On an applied create, the id the collector minted. */
+  scheduleId: z18.string().min(1).max(200).optional(),
+  /** The local validation message on a rejection — never a credential. */
+  error: z18.string().max(500).nullable().default(null)
+}).strict();
 var ClaimedJobResponse = z18.object({
   job: ClaimedJob,
   /** In-app restart signal (migration 0093): when present and NEWER than the
    * daemon's own start time, the collector re-execs. Rides on the existing poll
    * so no extra endpoint is needed. Null/absent = no restart pending. */
-  restartRequestedAt: z18.string().datetime().nullable().default(null)
+  restartRequestedAt: z18.string().datetime().nullable().default(null),
+  /**
+   * Pending portal schedule edits for this collector, oldest first (0227).
+   * Absent means none (read it as `?? []`): optional so a plane that predates
+   * it still parses and the plane's existing responses need not change, and
+   * `.catch(undefined)` so an edit this build cannot read (a future op) costs
+   * the edits, never the job claimed on the same poll.
+   */
+  scheduleEdits: z18.array(ScheduleEdit).max(50).optional().catch(void 0)
 });
 var ScanJobStatusBody = z18.object({
   jobId: z18.string().min(1),
@@ -4128,7 +4261,21 @@ var ReportedSchedule = z18.object({
   /** Next fire time, jitter already applied. Null when disabled or frozen out. */
   nextRunAt: z18.string().nullable(),
   lastRunAt: z18.string().nullable(),
-  lastStatus: ReportedRunStatus
+  lastStatus: ReportedRunStatus,
+  /** Editor fields (0227) — absent from a collector before the portal editor. */
+  targets: z18.array(z18.string().min(1)).max(500).optional(),
+  domainTarget: DomainScanTarget.optional(),
+  localCredentialSetId: z18.string().min(1).max(200).optional(),
+  /** The whole timing block: windows, blackouts, jitter, policies. */
+  timing: ScheduleTiming.optional()
+}).strict();
+var SelfUpdateOutcome = z18.enum(["updated", "failed", "skipped-disabled", "skipped-busy"]);
+var CollectorSelfUpdateAttempt = z18.object({
+  at: z18.string(),
+  fromVersion: z18.string().min(1).max(40),
+  toVersion: z18.string().min(1).max(40),
+  outcome: SelfUpdateOutcome,
+  reason: z18.string().max(500).nullable().default(null)
 }).strict();
 var CollectorReportedState = z18.object({
   /** When the collector built this report (its own clock). */
@@ -4210,7 +4357,17 @@ var CollectorReportedState = z18.object({
    * "ignore disabled, ignore null, take the minimum" — three chances to get a
    * different answer from the collector that actually owns the timers.
    */
-  nextRunAt: z18.string().nullable()
+  nextRunAt: z18.string().nullable(),
+  /**
+   * The collector's most recent self-update attempt (0226), or null when it
+   * has never tried. Optional so a report from an older collector parses.
+   */
+  lastSelfUpdate: CollectorSelfUpdateAttempt.nullable().optional(),
+  /**
+   * What became of each portal schedule edit delivered on the poll (0227).
+   * Absent or empty when there is nothing to acknowledge.
+   */
+  scheduleEditAcks: z18.array(ScheduleEditAck).max(100).optional()
 }).strict();
 var CollectorStatusReportResult = z18.object({ ok: z18.literal(true) });
 var CollectorEntitlementResult = z18.object({
@@ -4386,7 +4543,14 @@ var Collector = z18.object({
    *
    * Defaulted so a control plane that predates the field still parses.
    */
-  instances: z18.array(CollectorInstance).default([])
+  instances: z18.array(CollectorInstance).default([]),
+  /**
+   * collectors.self_update_enabled (0226). Absent reads as TRUE — the column's
+   * own default — so a plane that predates the field still parses.
+   */
+  selfUpdateEnabled: z18.boolean().optional(),
+  /** collectors.last_self_update (0226): the last attempt it reported, or null. */
+  lastSelfUpdate: CollectorSelfUpdateAttempt.nullable().optional()
 });
 var CollectorInstall = z18.object({
   downloadUrl: z18.string().nullable().default(null),
@@ -7172,6 +7336,7 @@ var MonitorTargetsResponse = z18.object({
   /** Suggested seconds between probe sweeps (the collector may clamp). */
   intervalMs: z18.number().int().positive()
 });
+var ProbeMethod = z18.enum(["icmp", "tcp"]);
 var MonitorResult = z18.object({
   deviceId: z18.string(),
   siteId: z18.string(),
@@ -7179,7 +7344,15 @@ var MonitorResult = z18.object({
   up: z18.boolean(),
   /** Round-trip of the successful TCP connect, ms; null when down/unknown. */
   latencyMs: z18.number().nonnegative().nullable(),
-  checkedAt: z18.string().datetime()
+  checkedAt: z18.string().datetime(),
+  /**
+   * How the probe that decided `up` was made (ICMP echo first, TCP connect as
+   * the fallback where ICMP is filtered or unavailable to the process). Absent
+   * from a collector before ICMP probing, which only ever used TCP.
+   */
+  method: ProbeMethod.optional(),
+  /** Round-trip of that probe, ms; null when down. Absent from older collectors. */
+  rttMs: z18.number().nonnegative().nullable().optional()
 });
 var MonitorReportBody = z18.object({
   results: z18.array(MonitorResult)
@@ -7195,7 +7368,9 @@ var LiveMonitorDevice = z18.object({
   ip: z18.string(),
   status: LiveStatus,
   latencyMs: z18.number().nonnegative().nullable(),
-  checkedAt: z18.string().datetime()
+  checkedAt: z18.string().datetime(),
+  /** The last probe's method; null/absent when unknown (an older collector or plane). */
+  method: ProbeMethod.nullable().optional()
 });
 var LiveMonitorResponse = z18.object({
   generatedAt: z18.string().datetime(),
@@ -7261,7 +7436,14 @@ var Alert = z18.object({
   message: z18.string(),
   /** How many channels accepted delivery (2xx). */
   delivered: z18.number().int().nonnegative(),
-  createdAt: z18.string()
+  createdAt: z18.string(),
+  /**
+   * Dependency-aware suppression (0229): the upstream device whose outage
+   * explains this one. Set on a `device_down` recorded while its parent was
+   * also down — kept in the feed for the record, not sent to any channel.
+   * Null or absent for every other alert, and from a plane before 0229.
+   */
+  suppressedByDeviceId: z18.string().nullable().optional()
 });
 var AlertsResponse = z18.object({ alerts: z18.array(Alert) });
 var AuditEntry = z18.object({
@@ -7361,6 +7543,7 @@ var CreateReportScheduleResult = z18.object({ ok: z18.literal(true), id: z18.str
 var RunReportScheduleBody = z18.object({ id: z18.string() });
 var RunReportScheduleResult = z18.object({ ok: z18.boolean(), detail: z18.string() });
 var AssetCategory = z18.enum(["server", "network", "appliance", "other"]);
+var LifecycleAssetSource = z18.enum(["manual", "derived", "cisco-eox", "endoflife.date"]);
 var IsoDate = z18.string().regex(/^\d{4}-\d{2}-\d{2}$/, "date must be YYYY-MM-DD");
 var LifecycleAsset = z18.object({
   id: z18.string(),
@@ -7378,10 +7561,15 @@ var LifecycleAsset = z18.object({
   endOfSale: z18.string().nullable(),
   endOfLife: z18.string().nullable(),
   endOfSupport: z18.string().nullable(),
-  source: z18.enum(["manual", "derived"]),
+  /** Widened 2026-10-07 (Source of Truth F3). An unknown value from a newer
+   * plane reads as "derived" rather than failing the whole list. */
+  source: LifecycleAssetSource.catch("derived"),
   notes: z18.string().nullable(),
   createdAt: z18.string(),
-  updatedAt: z18.string()
+  updatedAt: z18.string(),
+  /** ISO date the hardware warranty ends — separate from `supportEnd` (a
+   * support contract). Null = not recorded; absent on an older plane. */
+  warrantyEnd: z18.string().nullable().default(null)
 });
 var LifecycleAssetsResponse = z18.object({ assets: z18.array(LifecycleAsset) });
 var CreateLifecycleAssetBody = z18.object({
@@ -7400,7 +7588,9 @@ var CreateLifecycleAssetBody = z18.object({
   endOfSale: IsoDate.nullish(),
   endOfLife: IsoDate.nullish(),
   endOfSupport: IsoDate.nullish(),
-  notes: z18.string().max(2e3).nullish()
+  notes: z18.string().max(2e3).nullish(),
+  /** Hardware warranty end (Source of Truth F3) — separate from supportEnd. */
+  warrantyEnd: IsoDate.nullish()
 });
 var CreateLifecycleAssetResult = z18.object({ ok: z18.literal(true), id: z18.string() });
 var ImportLifecycleAssetsBody = z18.object({
@@ -7419,7 +7609,9 @@ var LifecycleEventType = z18.enum([
   "end_of_life",
   "end_of_support",
   "krbtgt_rotation",
-  "contract_renewal"
+  "contract_renewal",
+  /** Hardware warranty end (asset_lifecycle.warranty_end) — Source of Truth F3. */
+  "warranty_end"
 ]);
 var LifecycleEvent = z18.object({
   id: z18.string(),
@@ -7561,7 +7753,13 @@ var RetrackCertificateResult = z18.object({ ok: z18.literal(true) });
 var DeriveLifecycleResult = z18.object({
   ok: z18.literal(true),
   created: z18.number().int().nonnegative(),
-  matched: z18.number().int().nonnegative()
+  matched: z18.number().int().nonnegative(),
+  /** Of `matched`, how many came from the tenant's Cisco EoX cache (F3). */
+  eoxMatched: z18.number().int().nonnegative().default(0),
+  /** OS end-of-support rows written from the KB's endoflife.date entries (F3). */
+  osRows: z18.number().int().nonnegative().default(0),
+  /** Curated rows with an EoX answer left for the next pass (per-pass upgrade cap). */
+  upgradesRemaining: z18.number().int().nonnegative().default(0)
 });
 var EolLookupResponse = z18.object({
   match: z18.object({
@@ -7569,7 +7767,13 @@ var EolLookupResponse = z18.object({
     family: z18.string(),
     endOfSale: z18.string().nullable(),
     endOfLife: z18.string().nullable(),
-    endOfSupport: z18.string().nullable()
+    endOfSupport: z18.string().nullable(),
+    /** Source label — a vendor bulletin name or "vendor EoL page" (F3). */
+    source: z18.string().nullable().default(null),
+    /** Curated dates are approximate; a Cisco EoX hit is not. */
+    approximate: z18.boolean().default(true),
+    /** Which table answered: the curated reference or the tenant's EoX cache. */
+    origin: z18.enum(["curated", "cisco-eox"]).default("curated")
   }).nullable()
 });
 var CertChangeKind = z18.enum(["new", "rotated", "reissued", "unchanged"]);
@@ -12724,10 +12928,15 @@ export {
   DomainScanTarget,
   CredentialSetKind,
   isIpv4Target,
+  scheduleEditIssue,
+  scheduleEditFields,
+  ScheduleEditFields,
   ClaimedJobResponse,
   ScanJobStatusResult,
   VaultProtection,
   ReportedRunStatus,
+  ReportedSchedule,
+  CollectorSelfUpdateAttempt,
   CollectorEntitlementResult,
   CollectorIdentityResult,
   CollectorSitesResult,
@@ -12798,4 +13007,4 @@ export {
   SddRunCloseResult,
   ApiError
 };
-//# sourceMappingURL=chunk-4AXMNCP5.js.map
+//# sourceMappingURL=chunk-4GWOGLPA.js.map