mycomesh-consumer 0.1.52 → 0.1.53

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mycomesh-consumer",
-  "version": "0.1.52",
+  "version": "0.1.53",
   "description": "Native Node.js MycoMesh Consumer and OpenAI-compatible request CLI.",
   "repository": {
     "type": "git",

package/src/consumer.mjs

@@ -1,6 +1,7 @@
 import { spawn as defaultSpawn } from "node:child_process";
 import { existsSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { request as httpsRequest } from "node:https";
+import { rootCertificates } from "node:tls";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import * as readline from "node:readline/promises";
@@ -313,7 +314,11 @@ async function consumerDoctor({ parsed, env, stdout, fetch: injectedFetch, json
     add("local_process", running ? "ready" : "blocked", running ? "Consumer process is running" : "Consumer pid file is stale", { pid, running });
   }
 
-  const fetchImpl = injectedFetch || ((url, options) => consumerDoctorFetch(url, options, parsed));
+  const doctorFetchConfig = {
+    ...parsed,
+    caFile: parsed.caFile || network?.tls_ca_file,
+  };
+  const fetchImpl = injectedFetch || ((url, options) => consumerDoctorFetch(url, options, doctorFetchConfig));
   const health = [];
   if (validRelays.length && typeof fetchImpl === "function") {
     await Promise.all(validRelays.map(async (relay) => {
@@ -349,18 +354,19 @@ async function consumerDoctor({ parsed, env, stdout, fetch: injectedFetch, json
   return report.status === "blocked" ? 1 : 0;
 }
 
-function consumerDoctorFetch(url, options = {}, parsed) {
+export function consumerDoctorFetch(url, options = {}, parsed, requestImpl = httpsRequest) {
   const target = new URL(url);
   if (target.protocol !== "https:" || !parsed.caFile) return globalThis.fetch(url, options);
-  const ca = readFileSync(resolve(parsed.caFile));
+  const ca = readFileSync(resolve(parsed.caFile)).toString("utf8");
   return new Promise((resolvePromise, reject) => {
-    const request = httpsRequest({
+    const request = requestImpl({
       protocol: target.protocol,
       hostname: target.hostname,
       port: target.port || 443,
       path: `${target.pathname}${target.search}`,
       method: options.method || "GET",
-      ca,
+      // A private manifest CA supplements, rather than replaces, public trust.
+      ca: [...rootCertificates, ca],
       rejectUnauthorized: true,
     }, (response) => {
       response.resume();

package/src/release.mjs

@@ -1,7 +1,7 @@
 // Package versions are kept in one runtime module so every executable reports
 // the same version as the package metadata that ships it.
-export const CONSUMER_RELEASE_VERSION = "0.1.52";
-export const PROVIDER_RELEASE_VERSION = "0.1.38";
+export const CONSUMER_RELEASE_VERSION = "0.1.53";
+export const PROVIDER_RELEASE_VERSION = "0.1.39";
 
 // Provider release pins are intentionally unbound in the source tree. The
 // release candidate builder injects the commit and immutable OCI digest into a