@camstack/system 1.2.274 → 1.2.276

package/dist/tls/cert-issue.d.ts

@@ -0,0 +1,31 @@
+import { webcrypto as WebCrypto } from 'node:crypto';
+import { X509Certificate as PeculiarCertificate } from '@peculiar/x509';
+import { CertIdentity } from './cert-identity.js';
+/** Subject of the local root. Distinct from the leaf's CN by construction. */
+export declare const CA_COMMON_NAME = "CamStack Local CA";
+/** A PEM-encoded certificate and the PKCS#8 PEM of its private key. */
+export interface CertMaterial {
+    readonly certPem: string;
+    readonly keyPem: string;
+}
+/** An issuing root: its PEM, and the live key handle needed to sign with it. */
+export interface CaSigner {
+    readonly certPem: string;
+    readonly keyPem: string;
+    readonly cert: PeculiarCertificate;
+    readonly privateKey: WebCrypto.CryptoKey;
+}
+/**
+ * A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
+ * else, and **no EKU** — Apple rejects an anchor asserting
+ * `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
+ */
+export declare function generateCa(now: Date): Promise<CaSigner>;
+/** Re-open a root already on disk so a leaf can be issued under it. */
+export declare function loadCa(certPem: string, keyPem: string): Promise<CaSigner>;
+/**
+ * A server leaf signed by the local root: `CA:FALSE`, and
+ * `extendedKeyUsage=serverAuth` — not `anyExtendedKeyUsage`, which
+ * Apple's `testAppTrustRoot_AnyEKU_AfterJul2019` asserts must fail.
+ */
+export declare function issueLeaf(ca: CaSigner, identity: CertIdentity, commonName: string, validDays: number, now: Date): Promise<CertMaterial>;

package/dist/tls/cert-manager.d.ts

@@ -1,5 +1,5 @@
 import { CertRegenerationReason, evaluateExistingCert, MAX_LEAF_VALIDITY_DAYS } from './cert-evaluation.js';
-import { CertIdentity, collectCertIdentity } from './cert-identity.js';
+import { CertIdentity, HostFacts, collectCertIdentity } from './cert-identity.js';
 export interface TlsCertPair {
     readonly cert: Buffer;
     readonly key: Buffer;
@@ -38,6 +38,12 @@ export interface CertOptions {
     readonly validDays?: number;
     /** Additional SANs (DNS names or IPs). Required coverage by definition. */
     readonly extraSans?: readonly string[];
+    /**
+     * The machine being certified. Defaults to the real one; injected by the
+     * spec so the regeneration rule can be stated without reference to
+     * whichever box happens to run it (D551).
+     */
+    readonly hostFacts?: HostFacts;
 }
 /**
  * Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
@@ -87,5 +93,5 @@ export declare function reissueTlsLeaf(dataDir: string, options?: CertOptions):
  * root alongside the leaf.
  */
 export declare function loadTlsCert(certPath: string, keyPath: string): TlsCertPair;
-export type { CertIdentity, CertRegenerationReason };
+export type { CertIdentity, CertRegenerationReason, HostFacts };
 export { collectCertIdentity, evaluateExistingCert, MAX_LEAF_VALIDITY_DAYS };

package/dist/tls/index.d.ts

@@ -1,5 +1,5 @@
 export { CA_VALIDITY_DAYS, type CertEvaluationInput, LEAF_RENEWAL_WINDOW_DAYS, SERVER_AUTH_OID, } from './cert-evaluation.js';
-export { type CertIdentity, type CertOptions, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair, } from './cert-manager.js';
-export { CA_COMMON_NAME } from './cert-openssl.js';
+export { type CertIdentity, type CertOptions, type HostFacts, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair, } from './cert-manager.js';
+export { CA_COMMON_NAME } from './cert-issue.js';
 export { validateUploadedTls, type UploadedTlsValidation } from './uploaded-cert.js';
 export { type TlsAccessStatus, readTlsAccessStatus, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans, } from './tls-status.js';