@camstack/system 1.2.356 → 1.2.358

package/dist/{tls-DTlVWwAI.mjs → tls-CJHogwTl.mjs}

@@ -1,9 +1,9 @@
 import { r as __exportAll, t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
 import { X509Certificate, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
-import { chmod, writeFile } from "node:fs/promises";
+import { chmod, mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import * as os from "node:os";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
 //#region src/http/lan-http-bind.ts
@@ -11861,45 +11861,6 @@ function loadTlsCert(certPath, keyPath) {
 	};
 }
 //#endregion
-//#region src/tls/uploaded-cert.ts
-/**
-* Operator-supplied material must parse, match its key, and carry
-* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
-* to keep generating.
-*/
-function validateUploadedTls(certPem, keyPem) {
-	let leaf;
-	try {
-		leaf = new X509Certificate(certPem);
-	} catch {
-		return {
-			ok: false,
-			error: "Certificate PEM could not be parsed."
-		};
-	}
-	try {
-		if (!leaf.checkPrivateKey(createPrivateKey(keyPem))) return {
-			ok: false,
-			error: "Private key does not match the certificate."
-		};
-	} catch {
-		return {
-			ok: false,
-			error: "Private key PEM could not be parsed."
-		};
-	}
-	const eku = leaf.keyUsage;
-	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
-		ok: false,
-		error: "Certificate is missing extendedKeyUsage = serverAuth."
-	};
-	return {
-		ok: true,
-		fingerprintSha256: leaf.fingerprint256,
-		validTo: new Date(leaf.validTo).toISOString()
-	};
-}
-//#endregion
 //#region src/tls/tls-status.ts
 function tlsDir(dataDir) {
 	return join(dataDir, "tls");
@@ -11932,10 +11893,51 @@ function writeExtraSans(dataDir, sans) {
 	mkdirSync(tlsDir(dataDir), { recursive: true });
 	writeFileSync(join(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}\n`, "utf-8");
 }
-function readTlsAccessStatus(dataDir, restartRequired = false) {
+/** Where an upload's own CA is kept — never over the local CA's `camstack-ca.crt`. */
+var UPLOADED_CA_FILE = "uploaded-ca.crt";
+/** Every certificate in a PEM bundle, in order. */
+function splitPemCertificates(pem) {
+	const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
+	return blocks === null ? [] : blocks.map((block) => `${block}\n`);
+}
+/**
+* The certificate that signed `leaf`, from the upload itself: the CA the
+* operator supplied, else the rest of the uploaded chain. `null` when the
+* upload did not include it — and then nothing may stand in for it: the
+* local CA did not sign an uploaded leaf, so handing it out as "the CA" would
+* tell a client to trust a root that verifies nothing it is served.
+*/
+function uploadedIssuer(dir, leaf, chainPem) {
+	const caPath = join(dir, UPLOADED_CA_FILE);
+	const candidates = [...existsSync(caPath) ? splitPemCertificates(readFileSync(caPath, "utf-8")) : [], ...splitPemCertificates(chainPem).slice(1)];
+	for (const pem of candidates) try {
+		const cert = new X509Certificate(pem);
+		if (leaf.checkIssued(cert) && leaf.verify(cert.publicKey)) return {
+			pem,
+			cert
+		};
+	} catch {}
+	return null;
+}
+function generatedIssuer(dir) {
+	const caPath = join(dir, "camstack-ca.crt");
+	if (!existsSync(caPath)) return null;
+	const pem = readFileSync(caPath, "utf-8");
+	return {
+		pem,
+		cert: new X509Certificate(pem)
+	};
+}
+/**
+* What the node's certificate is, and whether the listener serves it.
+* `servedLeafFingerprint` is the leaf the HTTPS listener presents right now
+* (`servedHttpsLeafFingerprint()`), or `null` when unknown; a restart is
+* required exactly when the listener serves a different leaf than the one
+* on disk — a measured fact, not a flag a mutation remembered to set.
+*/
+function readTlsAccessStatus(dataDir, servedLeafFingerprint) {
 	const dir = tlsDir(dataDir);
 	const certPath = join(dir, "camstack.crt");
-	const caPath = join(dir, "camstack-ca.crt");
 	const mode = readTlsMode(dataDir);
 	if (!existsSync(certPath)) return {
 		mode: "disabled",
@@ -11943,24 +11945,24 @@ function readTlsAccessStatus(dataDir, restartRequired = false) {
 		caFingerprintSha256: null,
 		validTo: null,
 		sans: [],
-		caCertPem: existsSync(caPath) ? readFileSync(caPath, "utf-8") : null,
+		caCertPem: (mode === "uploaded" ? null : generatedIssuer(dir))?.pem ?? null,
 		reissueError: null,
-		restartRequired
+		restartRequired: false
 	};
 	try {
-		const leaf = new X509Certificate(readFileSync(certPath));
-		const caPem = existsSync(caPath) ? readFileSync(caPath, "utf-8") : null;
-		const ca = caPem !== null ? new X509Certificate(caPem) : null;
+		const chainPem = readFileSync(certPath, "utf-8");
+		const leaf = new X509Certificate(chainPem);
+		const ca = mode === "uploaded" ? uploadedIssuer(dir, leaf, chainPem) : generatedIssuer(dir);
 		const san = leaf.subjectAltName ?? "";
 		return {
 			mode,
 			leafFingerprintSha256: leaf.fingerprint256,
-			caFingerprintSha256: ca?.fingerprint256 ?? null,
+			caFingerprintSha256: ca?.cert.fingerprint256 ?? null,
 			validTo: new Date(leaf.validTo).toISOString(),
 			sans: san === "" ? [] : san.split(", "),
-			caCertPem: caPem,
+			caCertPem: ca?.pem ?? null,
 			reissueError: null,
-			restartRequired
+			restartRequired: servedLeafFingerprint !== null && servedLeafFingerprint !== leaf.fingerprint256
 		};
 	} catch {
 		return {
@@ -11971,9 +11973,200 @@ function readTlsAccessStatus(dataDir, restartRequired = false) {
 			sans: [],
 			caCertPem: null,
 			reissueError: "Certificate on disk could not be parsed.",
-			restartRequired
+			restartRequired: false
 		};
 	}
 }
 //#endregion
-export { registerLanHttpHandler as C, readLanHttpState as S, DEFAULT_LAN_HTTP_PORT as _, writeTlsMode as a, bindPendingLanHttp as b, loadTlsCert as c, collectCertIdentity as d, CA_VALIDITY_DAYS as f, evaluateExistingCert as g, SERVER_AUTH_OID as h, writeExtraSans as i, reissueTlsLeaf as l, MAX_LEAF_VALIDITY_DAYS as m, readTlsAccessStatus as n, validateUploadedTls as o, LEAF_RENEWAL_WINDOW_DAYS as p, readTlsMode as r, ensureTlsCert as s, readExtraSans as t, CA_COMMON_NAME as u, allFamiliesListenHost as v, closeLanHttp as x, applyLanHttp as y };
+//#region src/tls/boot-tls.ts
+/**
+* Decide what the listener serves at boot. The admin UI (Network → Local
+* access) is the only way to set a certificate (D726): it either leaves the
+* hub on its generated local-CA leaf (D227) or uploads one, recorded by the
+* `tls/mode` marker. An uploaded certificate is served verbatim — running it
+* through `ensureTlsCert` would replace it on the first restart, because a
+* leaf the local root did not issue is one of that rule's reissue triggers.
+*/
+async function prepareBootTls(dataDir, options) {
+	const certPath = join(dataDir, "tls", "camstack.crt");
+	const keyPath = join(dataDir, "tls", "camstack.key");
+	const marked = readTlsMode(dataDir);
+	if (marked === "uploaded" && existsSync(certPath) && existsSync(keyPath)) return {
+		mode: "uploaded",
+		pair: loadTlsCert(certPath, keyPath),
+		ensured: void 0,
+		uploadedMissing: false
+	};
+	const uploadedMissing = marked === "uploaded";
+	if (uploadedMissing) writeTlsMode(dataDir, "generated");
+	const ensured = await ensureTlsCert(dataDir, options);
+	return {
+		mode: "generated",
+		pair: loadTlsCert(ensured.certPath, ensured.keyPath),
+		ensured,
+		uploadedMissing
+	};
+}
+//#endregion
+//#region src/tls/https-listener.ts
+var SLOT_KEY = Symbol.for("camstack.tls.https-listener");
+var EMPTY_SLOT = {
+	reload: null,
+	servedLeafFingerprint: null
+};
+function isSlot(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("reload" in value) || !("servedLeafFingerprint" in value)) return false;
+	const reload = value.reload;
+	const served = value.servedLeafFingerprint;
+	return (reload === null || typeof reload === "function") && (served === null || typeof served === "string");
+}
+function readSlot() {
+	const current = Reflect.get(globalThis, SLOT_KEY);
+	return isSlot(current) ? current : EMPTY_SLOT;
+}
+function writeSlot(next) {
+	Reflect.set(globalThis, SLOT_KEY, next);
+}
+/** SHA-256 fingerprint of the first certificate (the leaf) in a PEM chain. */
+function leafFingerprintOf(chain) {
+	return new X509Certificate(chain).fingerprint256;
+}
+/**
+* Called once by the server after its HTTPS listener is up, with the pair it
+* was started on. From here on a certificate action swaps the served
+* certificate in place (`setSecureContext`) — new handshakes get the new
+* leaf, open connections keep theirs, nothing restarts.
+*/
+function registerHttpsListener(server, pair) {
+	writeSlot({
+		reload: (next) => server.setSecureContext({
+			cert: next.cert,
+			key: next.key
+		}),
+		servedLeafFingerprint: leafFingerprintOf(pair.cert)
+	});
+}
+/** Forget the listener — on shutdown, and between specs. */
+function clearHttpsListener() {
+	writeSlot(EMPTY_SLOT);
+}
+/**
+* The leaf the HTTPS listener serves now, or `null` when this process has no
+* registered listener (TLS off, or a process that does not own one) — in
+* which case nobody can say, and `null` is the honest answer.
+*/
+function servedHttpsLeafFingerprint() {
+	return readSlot().servedLeafFingerprint;
+}
+/** Serve `pair` from now on. Never throws: the outcome says what happened. */
+function reloadHttpsListener(pair) {
+	const slot = readSlot();
+	if (slot.reload === null) return { kind: "no-listener" };
+	try {
+		const servedLeafFingerprint = leafFingerprintOf(pair.cert);
+		slot.reload(pair);
+		writeSlot({
+			reload: slot.reload,
+			servedLeafFingerprint
+		});
+		return {
+			kind: "reloaded",
+			servedLeafFingerprint
+		};
+	} catch (err) {
+		return {
+			kind: "failed",
+			error: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+//#endregion
+//#region src/tls/uploaded-cert.ts
+/**
+* Operator-supplied material must parse, match its key, and carry
+* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
+* to keep generating.
+*/
+function validateUploadedTls(certPem, keyPem) {
+	let leaf;
+	try {
+		leaf = new X509Certificate(certPem);
+	} catch {
+		return {
+			ok: false,
+			error: "Certificate PEM could not be parsed."
+		};
+	}
+	try {
+		if (!leaf.checkPrivateKey(createPrivateKey(keyPem))) return {
+			ok: false,
+			error: "Private key does not match the certificate."
+		};
+	} catch {
+		return {
+			ok: false,
+			error: "Private key PEM could not be parsed."
+		};
+	}
+	const eku = leaf.keyUsage;
+	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
+		ok: false,
+		error: "Certificate is missing extendedKeyUsage = serverAuth."
+	};
+	return {
+		ok: true,
+		fingerprintSha256: leaf.fingerprint256,
+		validTo: new Date(leaf.validTo).toISOString()
+	};
+}
+//#endregion
+//#region src/tls/tls-actions.ts
+function withNewline(pem) {
+	return pem.endsWith("\n") ? pem : `${pem}\n`;
+}
+/**
+* Store an operator's certificate. The leaf (or chain) and key replace the
+* served pair; a CA, when given, goes to its own file. The local CA
+* (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
+* and it is what "Revert to generated" and every device that trusts it
+* still need.
+*/
+async function storeUploadedCertificate(dataDir, input) {
+	const valid = validateUploadedTls(input.certPem, input.keyPem);
+	if (!valid.ok) throw new Error(valid.error);
+	const dir = join(dataDir, "tls");
+	await mkdir(dir, { recursive: true });
+	await writeFile(join(dir, "camstack.crt"), withNewline(input.certPem));
+	await writeFile(join(dir, "camstack.key"), withNewline(input.keyPem), { mode: 384 });
+	const caPath = join(dir, UPLOADED_CA_FILE);
+	if (input.caPem !== void 0 && input.caPem.trim() !== "") await writeFile(caPath, withNewline(input.caPem));
+	else rmSync(caPath, { force: true });
+	writeTlsMode(dataDir, "uploaded");
+}
+/** Issue a new generated leaf under the local CA. Refused while an upload is served. */
+async function regenerateCertificate(dataDir, options) {
+	if (readTlsMode(dataDir) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
+	await reissueTlsLeaf(dataDir, options);
+}
+/** Drop the upload and serve the generated local-CA leaf again (D227). */
+async function revertToGeneratedCertificate(dataDir, options) {
+	writeTlsMode(dataDir, "generated");
+	rmSync(join(dataDir, "tls", UPLOADED_CA_FILE), { force: true });
+	await ensureTlsCert(dataDir, options);
+}
+/**
+* Put the pair on disk on the HTTPS listener. Called after every action, so
+* "the certificate changed" and "clients see it" are the same moment.
+*/
+function applyCertificateToListener(dataDir) {
+	const certPath = join(dataDir, "tls", "camstack.crt");
+	const keyPath = join(dataDir, "tls", "camstack.key");
+	if (!existsSync(certPath) || !existsSync(keyPath)) return {
+		kind: "failed",
+		error: `No certificate pair under ${join(dataDir, "tls")}`
+	};
+	return reloadHttpsListener(loadTlsCert(certPath, keyPath));
+}
+//#endregion
+export { allFamiliesListenHost as A, collectCertIdentity as C, SERVER_AUTH_OID as D, MAX_LEAF_VALIDITY_DAYS as E, registerLanHttpHandler as F, bindPendingLanHttp as M, closeLanHttp as N, evaluateExistingCert as O, readLanHttpState as P, CA_COMMON_NAME as S, LEAF_RENEWAL_WINDOW_DAYS as T, writeExtraSans as _, validateUploadedTls as a, loadTlsCert as b, registerHttpsListener as c, prepareBootTls as d, UPLOADED_CA_FILE as f, splitPemCertificates as g, readTlsMode as h, storeUploadedCertificate as i, applyLanHttp as j, DEFAULT_LAN_HTTP_PORT as k, reloadHttpsListener as l, readTlsAccessStatus as m, regenerateCertificate as n, clearHttpsListener as o, readExtraSans as p, revertToGeneratedCertificate as r, leafFingerprintOf as s, applyCertificateToListener as t, servedHttpsLeafFingerprint as u, writeTlsMode as v, CA_VALIDITY_DAYS as w, reissueTlsLeaf as x, ensureTlsCert as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.356",
+  "version": "1.2.358",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -53,7 +53,7 @@
         "category": "system",
         "name": "SQLite Settings",
         "entry": "./dist/builtins/sqlite-storage/sqlite-settings.addon.js",
-        "description": "The relational ENGINE behind the data door (SQLite WAL). Registers `data-store-provider`, an internal collection cap; the public `settings-store` door is owned by `storage-orchestrator`, which dispatches here. Callers never reach this addon directly — that is what makes the engine replaceable. It ALSO registers `vector-store` (sqlite-vec) from the same database file and the same open handle, and `database-snapshot`: the verified copy of its database that the nightly backup archives in place of the live files, written by this runner on a thread over its own connection ([D693]). Runs in its OWN process (`execution.isolate`) — `better-sqlite3` `Statement.run` does not belong on the event loop that serves the API ([D181]).",
+        "description": "The relational ENGINE behind the data door (SQLite WAL). Registers `data-store-provider`, an internal collection cap; the public `settings-store` door is owned by `storage-orchestrator`, which dispatches here. Callers never reach this addon directly — that is what makes the engine replaceable. It ALSO registers `vector-store` (sqlite-vec) from the same database file and the same open handle, and `database-snapshot`: the verified copy of its database that the nightly backup archives in place of the live files, written by this runner on a thread over its own connection. Runs in its OWN process (`execution.isolate`) — `better-sqlite3` `Statement.run` does not belong on the event loop that serves the API.",
         "execution": {
           "isolate": true,
           "heapProfile": "heavy",
@@ -363,7 +363,7 @@
         "id": "composer",
         "category": "system",
         "name": "Composer",
-        "description": "Runs every DECLARATIVE composition (a core block whose source is `composition`): declares the composed device under the shared Blocks integration, registers its caps natively, and derives each field from other devices' state by `from` / expression — event-driven, no polling. Hub-only. Runs in its OWN runner (`execution.isolate` + `group: composer`): frame-free and low-crash, grouped with no device provider or data plane (D29, D659).",
+        "description": "Runs every DECLARATIVE composition (a core block whose source is `composition`): declares the composed device under the shared Blocks integration, registers its caps natively, and derives each field from other devices' state by `from` / expression — event-driven, no polling. Hub-only. Runs in its OWN runner (`execution.isolate` + `group: composer`): frame-free and low-crash, grouped with no device provider or data plane.",
         "entry": "./dist/builtins/composer/index.js",
         "protected": true,
         "execution": {