@camstack/system 1.2.115 → 1.2.116

package/dist/{retired-settings-keys-OfhqQio4.js → retired-settings-keys-BVAxT5XL.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-iAwSA2_f.js");
+const require_dist = require("./dist-Cri60Jd0.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-Dz5-7gjt.mjs → retired-settings-keys-SrxMH3OT.mjs}

@@ -1,4 +1,4 @@
-import { kt as asJsonObject } from "./dist-Drb54SZD.mjs";
+import { kt as asJsonObject } from "./dist-BpzbLPel.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/tls/cert-manager.d.ts

@@ -24,6 +24,12 @@ export interface EnsureTlsResult {
     /** ISO timestamp at which the leaf stops being valid. */
     readonly validTo: string;
     readonly sans: readonly string[];
+    /**
+     * Set when a reissue was needed and FAILED, and the previous material is
+     * still being served. Never null-and-degraded silently: this is the line
+     * that says the certificate is not what the rule wants it to be.
+     */
+    readonly reissueError: string | null;
 }
 export interface CertOptions {
     /** Common Name for the leaf (default: 'camstack.local') */
@@ -70,6 +76,11 @@ export interface CertOptions {
  * address change the hub will ever see.
  */
 export declare function ensureTlsCert(dataDir: string, options?: CertOptions): Promise<EnsureTlsResult>;
+/**
+ * Operator "Regenerate": issue a new leaf under the existing local CA.
+ * Never rotates the root — trust granted to `camstack-ca.crt` survives.
+ */
+export declare function reissueTlsLeaf(dataDir: string, options?: CertOptions): Promise<EnsureTlsResult>;
 /**
  * Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
  * options. `certPath` is a full chain, so the listener presents the local

package/dist/tls/index.d.ts

@@ -1,3 +1,5 @@
 export { CA_VALIDITY_DAYS, type CertEvaluationInput, LEAF_RENEWAL_WINDOW_DAYS, SERVER_AUTH_OID, } from './cert-evaluation.js';
-export { type CertIdentity, type CertOptions, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair, } from './cert-manager.js';
+export { type CertIdentity, type CertOptions, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair, } from './cert-manager.js';
 export { CA_COMMON_NAME } from './cert-openssl.js';
+export { validateUploadedTls, type UploadedTlsValidation } from './uploaded-cert.js';
+export { type TlsAccessStatus, readTlsAccessStatus, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans, } from './tls-status.js';

package/dist/tls/tls-status.d.ts

@@ -0,0 +1,16 @@
+export type TlsMode = 'generated' | 'uploaded' | 'disabled';
+export interface TlsAccessStatus {
+    readonly mode: TlsMode;
+    readonly leafFingerprintSha256: string | null;
+    readonly caFingerprintSha256: string | null;
+    readonly validTo: string | null;
+    readonly sans: readonly string[];
+    readonly caCertPem: string | null;
+    readonly reissueError: string | null;
+    readonly restartRequired: boolean;
+}
+export declare function readTlsMode(dataDir: string): TlsMode;
+export declare function writeTlsMode(dataDir: string, mode: TlsMode): void;
+export declare function readExtraSans(dataDir: string): readonly string[];
+export declare function writeExtraSans(dataDir: string, sans: readonly string[]): void;
+export declare function readTlsAccessStatus(dataDir: string, restartRequired?: boolean): TlsAccessStatus;

package/dist/tls/uploaded-cert.d.ts

@@ -0,0 +1,14 @@
+export type UploadedTlsValidation = {
+    readonly ok: true;
+    readonly fingerprintSha256: string;
+    readonly validTo: string;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * Operator-supplied material must parse, match its key, and carry
+ * `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
+ * to keep generating.
+ */
+export declare function validateUploadedTls(certPem: string, keyPem: string): UploadedTlsValidation;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.115",
+  "version": "1.2.116",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",