@camstack/system 1.2.390 → 1.2.391

package/dist/tls/cert-evaluation.d.ts

@@ -1,41 +1,41 @@
-import { CertIdentity } from './cert-identity.js';
+import type { CertIdentity } from "./cert-identity.js";
 /** OID `id-kp-serverAuth`. Apple's trustd requires it on the leaf. */
 export declare const SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
 /**
- * Apple's `SecPolicyCheckOtherTrustValidityPeriod` ceiling is 825 days;
- * the CA/Browser Forum's recommended maximum is 397. We sit at 397.
- */
+* Apple's `SecPolicyCheckOtherTrustValidityPeriod` ceiling is 825 days;
+* the CA/Browser Forum's recommended maximum is 397. We sit at 397.
+*/
 export declare const MAX_LEAF_VALIDITY_DAYS = 397;
 /** Reissue this long before the leaf dies, so nobody serves an expired one. */
 export declare const LEAF_RENEWAL_WINDOW_DAYS = 30;
 /** A local root outlives many leaves — it is the anchor an operator trusts. */
 export declare const CA_VALIDITY_DAYS = 3650;
 /**
- * The CA must outlive any leaf it signs by a margin, or a leaf issued
- * today expires after its own issuer.
- */
+* The CA must outlive any leaf it signs by a margin, or a leaf issued
+* today expires after its own issuer.
+*/
 export declare const CA_RENEWAL_WINDOW_DAYS: number;
 /**
- * Why a reissue is happening. Reported on `EnsureTlsResult` and logged
- * verbatim — an operator who trusted the old certificate by hand learns
- * from this string, not from a browser error.
- */
-export type CertRegenerationReason = 'missing' | 'unreadable' | 'no-local-ca' | 'ca-expiring' | 'key-mismatch' | 'expiring' | 'missing-server-auth-eku' | 'not-issued-by-local-ca' | 'validity-too-long' | 'san-coverage-gap';
+* Why a reissue is happening. Reported on `EnsureTlsResult` and logged
+* verbatim — an operator who trusted the old certificate by hand learns
+* from this string, not from a browser error.
+*/
+export type CertRegenerationReason = "missing" | "unreadable" | "no-local-ca" | "ca-expiring" | "key-mismatch" | "expiring" | "missing-server-auth-eku" | "not-issued-by-local-ca" | "validity-too-long" | "san-coverage-gap";
 export interface CertEvaluationInput {
-    /** Contents of `camstack.crt` — leaf first, then the issuing CA. */
-    readonly chainPem: string;
-    /** Contents of `camstack.key` — the leaf's private key. */
-    readonly keyPem: string;
-    /** Contents of `camstack-ca.crt` — the local root. */
-    readonly caPem: string;
-    readonly identity: CertIdentity;
-    readonly now: Date;
+	/** Contents of `camstack.crt` — leaf first, then the issuing CA. */
+	readonly chainPem: string;
+	/** Contents of `camstack.key` — the leaf's private key. */
+	readonly keyPem: string;
+	/** Contents of `camstack-ca.crt` — the local root. */
+	readonly caPem: string;
+	readonly identity: CertIdentity;
+	readonly now: Date;
 }
 export declare function reasonRequiresNewCa(reason: CertRegenerationReason): boolean;
 /**
- * `null` when the material on disk is fit to keep serving.
- *
- * Order matters only for the quality of the reported reason; any
- * non-null answer produces the same action.
- */
+* `null` when the material on disk is fit to keep serving.
+*
+* Order matters only for the quality of the reported reason; any
+* non-null answer produces the same action.
+*/
 export declare function evaluateExistingCert(input: CertEvaluationInput): CertRegenerationReason | null;

package/dist/tls/cert-identity.d.ts

@@ -1,60 +1,60 @@
 /** One address on one interface — the slice of `os.NetworkInterfaceInfo` this uses. */
 export interface HostInterfaceAddress {
-    readonly address: string;
-    readonly internal: boolean;
+	readonly address: string;
+	readonly internal: boolean;
 }
 /**
- * What the certificate needs to know about the machine it identifies.
- *
- * Injected rather than read, for the same reason `evaluateExistingCert`
- * takes `now` instead of calling `Date.now()`: a rule whose inputs are
- * ambient cannot be stated in a test, and a spec that reads the real
- * `os.hostname()` is a statement about the machine running it. The CI
- * runner and this laptop disagreed about both halves (D551).
- */
+* What the certificate needs to know about the machine it identifies.
+*
+* Injected rather than read, for the same reason `evaluateExistingCert`
+* takes `now` instead of calling `Date.now()`: a rule whose inputs are
+* ambient cannot be stated in a test, and a spec that reads the real
+* `os.hostname()` is a statement about the machine running it. The CI
+* runner and this laptop disagreed about both halves (D551).
+*/
 export interface HostFacts {
-    readonly hostname: string;
-    readonly networkInterfaces: Readonly<Record<string, readonly HostInterfaceAddress[] | undefined>>;
+	readonly hostname: string;
+	readonly networkInterfaces: Readonly<Record<string, readonly HostInterfaceAddress[] | undefined>>;
 }
 /** The real machine. The only place in `tls/` that touches `os`. */
 export declare function systemHostFacts(): HostFacts;
 /**
- * Names/addresses that go INTO the certificate, and the subset whose
- * absence forces a reissue.
- *
- * The two are deliberately different sizes. Everything plausible is
- * certified — costs nothing. Only a **stable** identity gates
- * regeneration (IPv4 + DNS + operator `extraSans`), because a gate that
- * fires on a rotating address rewrites the certificate on every boot,
- * which is a worse bug than the one the gate exists to fix. IPv6 never
- * gates — ULA proved as unstable as global SLAAC on the live hub.
- */
+* Names/addresses that go INTO the certificate, and the subset whose
+* absence forces a reissue.
+*
+* The two are deliberately different sizes. Everything plausible is
+* certified — costs nothing. Only a **stable** identity gates
+* regeneration (IPv4 + DNS + operator `extraSans`), because a gate that
+* fires on a rotating address rewrites the certificate on every boot,
+* which is a worse bug than the one the gate exists to fix. IPv6 never
+* gates — ULA proved as unstable as global SLAAC on the live hub.
+*/
 export interface CertIdentity {
-    readonly dnsNames: readonly string[];
-    readonly ipAddresses: readonly string[];
-    readonly requiredDnsNames: readonly string[];
-    readonly requiredIpAddresses: readonly string[];
+	readonly dnsNames: readonly string[];
+	readonly ipAddresses: readonly string[];
+	readonly requiredDnsNames: readonly string[];
+	readonly requiredIpAddresses: readonly string[];
 }
 export interface CertIdentityOptions {
-    readonly commonName: string;
-    readonly extraSans: readonly string[];
-    /** The machine being certified. Defaults to {@link systemHostFacts}. */
-    readonly hostFacts?: HostFacts;
+	readonly commonName: string;
+	readonly extraSans: readonly string[];
+	/** The machine being certified. Defaults to {@link systemHostFacts}. */
+	readonly hostFacts?: HostFacts;
 }
 export declare function isIpv4(value: string): boolean;
 export declare function isIpv6(value: string): boolean;
 /**
- * `fe80::/10` and `169.254.0.0/16`. An IPv6 link-local address needs a
- * zone index to be usable and a SAN cannot carry one, so such an entry
- * can never match anything — it is noise that makes the certificate look
- * broader than it is.
- */
+* `fe80::/10` and `169.254.0.0/16`. An IPv6 link-local address needs a
+* zone index to be usable and a SAN cannot carry one, so such an entry
+* can never match anything — it is noise that makes the certificate look
+* broader than it is.
+*/
 export declare function isLinkLocal(value: string): boolean;
 /** `fc00::/7` — the IPv6 range that behaves like RFC 1918 does for v4. */
 export declare function isUniqueLocalIpv6(value: string): boolean;
 /**
- * Snapshot the machine's identity. Called once per `ensureTlsCert`; the
- * result is both the SAN list for a new leaf and the yardstick the
- * existing leaf is measured against.
- */
+* Snapshot the machine's identity. Called once per `ensureTlsCert`; the
+* result is both the SAN list for a new leaf and the yardstick the
+* existing leaf is measured against.
+*/
 export declare function collectCertIdentity(options: CertIdentityOptions): CertIdentity;

package/dist/tls/cert-issue.d.ts

@@ -1,31 +1,51 @@
-import { webcrypto as WebCrypto } from 'node:crypto';
-import { X509Certificate as PeculiarCertificate } from '@peculiar/x509';
-import { CertIdentity } from './cert-identity.js';
+/**
+* Certificate issuance. Isolated so `cert-manager.ts` reads as policy and
+* this file reads as mechanics.
+*
+* **In-process, by decision (D551).** This used to shell out to `openssl`
+* three times. The hub's own TLS identity is not allowed to be a function
+* of which openssl happens to sit on the host: this fleet alone runs four
+* of them, and one — Ubuntu 20.04's 1.1.1f — silently ADDED the ambient
+* `/etc/ssl/openssl.cnf` `[req] x509_extensions = v3_ca` block on top of
+* our `-addext` flags, producing a root with two `basicConstraints` and
+* two `subjectKeyIdentifier` extensions. RFC 5280 §4.2 allows each at
+* most once, so OpenSSL 3 (which is what `node:crypto` is) marked that
+* root invalid: `X509Certificate.ca` read `false` on our own CA and
+* `checkIssued()` refused the pair. Under D227 that means "not issued by
+* the local CA", i.e. rotate the root — on every boot, forever, voiding
+* every trust an operator had granted by hand.
+*
+* Keys come from WebCrypto (`node:crypto`'s own implementation) and the
+* DER is assembled by `@peculiar/x509`. Nothing here reads the host.
+*/
+import type { webcrypto as WebCrypto } from "node:crypto";
+import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
+import type { CertIdentity } from "./cert-identity.js";
 /** Subject of the local root. Distinct from the leaf's CN by construction. */
 export declare const CA_COMMON_NAME = "CamStack Local CA";
 /** A PEM-encoded certificate and the PKCS#8 PEM of its private key. */
 export interface CertMaterial {
-    readonly certPem: string;
-    readonly keyPem: string;
+	readonly certPem: string;
+	readonly keyPem: string;
 }
 /** An issuing root: its PEM, and the live key handle needed to sign with it. */
 export interface CaSigner {
-    readonly certPem: string;
-    readonly keyPem: string;
-    readonly cert: PeculiarCertificate;
-    readonly privateKey: WebCrypto.CryptoKey;
+	readonly certPem: string;
+	readonly keyPem: string;
+	readonly cert: PeculiarCertificate;
+	readonly privateKey: WebCrypto.CryptoKey;
 }
 /**
- * A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
- * else, and **no EKU** — Apple rejects an anchor asserting
- * `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
- */
+* A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
+* else, and **no EKU** — Apple rejects an anchor asserting
+* `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
+*/
 export declare function generateCa(now: Date): Promise<CaSigner>;
 /** Re-open a root already on disk so a leaf can be issued under it. */
 export declare function loadCa(certPem: string, keyPem: string): Promise<CaSigner>;
 /**
- * A server leaf signed by the local root: `CA:FALSE`, and
- * `extendedKeyUsage=serverAuth` — not `anyExtendedKeyUsage`, which
- * Apple's `testAppTrustRoot_AnyEKU_AfterJul2019` asserts must fail.
- */
+* A server leaf signed by the local root: `CA:FALSE`, and
+* `extendedKeyUsage=serverAuth` — not `anyExtendedKeyUsage`, which
+* Apple's `testAppTrustRoot_AnyEKU_AfterJul2019` asserts must fail.
+*/
 export declare function issueLeaf(ca: CaSigner, identity: CertIdentity, commonName: string, validDays: number, now: Date): Promise<CertMaterial>;

package/dist/tls/cert-manager.d.ts

@@ -1,98 +1,100 @@
-import { CertRegenerationReason, evaluateExistingCert, MAX_LEAF_VALIDITY_DAYS } from './cert-evaluation.js';
-import { CertIdentity, HostFacts, collectCertIdentity } from './cert-identity.js';
+import type { CertRegenerationReason } from "./cert-evaluation.js";
+import { evaluateExistingCert, MAX_LEAF_VALIDITY_DAYS } from "./cert-evaluation.js";
+import type { CertIdentity, HostFacts } from "./cert-identity.js";
+import { collectCertIdentity } from "./cert-identity.js";
 export interface TlsCertPair {
-    readonly cert: Buffer;
-    readonly key: Buffer;
+	readonly cert: Buffer;
+	readonly key: Buffer;
 }
 export interface EnsureTlsResult {
-    /** Full chain — leaf then CA. This is what the listener serves. */
-    readonly certPath: string;
-    /** The leaf's private key. */
-    readonly keyPath: string;
-    /** The local root. **This** is the file an operator installs as trusted. */
-    readonly caCertPath: string;
-    readonly caKeyPath: string;
-    readonly generated: boolean;
-    /** Why it was reissued — `null` when the existing material was kept. */
-    readonly reason: CertRegenerationReason | null;
-    /** True when the ROOT rotated, i.e. trust granted by hand is now void. */
-    readonly caRotated: boolean;
-    readonly fingerprintSha256: string;
-    readonly caFingerprintSha256: string;
-    /** Fingerprint of the leaf this one replaced — `null` on a fresh install. */
-    readonly previousFingerprintSha256: string | null;
-    /** ISO timestamp at which the leaf stops being valid. */
-    readonly validTo: string;
-    readonly sans: readonly string[];
-    /**
-     * Set when a reissue was needed and FAILED, and the previous material is
-     * still being served. Never null-and-degraded silently: this is the line
-     * that says the certificate is not what the rule wants it to be.
-     */
-    readonly reissueError: string | null;
+	/** Full chain — leaf then CA. This is what the listener serves. */
+	readonly certPath: string;
+	/** The leaf's private key. */
+	readonly keyPath: string;
+	/** The local root. **This** is the file an operator installs as trusted. */
+	readonly caCertPath: string;
+	readonly caKeyPath: string;
+	readonly generated: boolean;
+	/** Why it was reissued — `null` when the existing material was kept. */
+	readonly reason: CertRegenerationReason | null;
+	/** True when the ROOT rotated, i.e. trust granted by hand is now void. */
+	readonly caRotated: boolean;
+	readonly fingerprintSha256: string;
+	readonly caFingerprintSha256: string;
+	/** Fingerprint of the leaf this one replaced — `null` on a fresh install. */
+	readonly previousFingerprintSha256: string | null;
+	/** ISO timestamp at which the leaf stops being valid. */
+	readonly validTo: string;
+	readonly sans: readonly string[];
+	/**
+	* Set when a reissue was needed and FAILED, and the previous material is
+	* still being served. Never null-and-degraded silently: this is the line
+	* that says the certificate is not what the rule wants it to be.
+	*/
+	readonly reissueError: string | null;
 }
 export interface CertOptions {
-    /** Common Name for the leaf (default: 'camstack.local') */
-    readonly commonName?: string;
-    /** Leaf validity in days. Clamped to `MAX_LEAF_VALIDITY_DAYS`. */
-    readonly validDays?: number;
-    /** Additional SANs (DNS names or IPs). Required coverage by definition. */
-    readonly extraSans?: readonly string[];
-    /**
-     * The machine being certified. Defaults to the real one; injected by the
-     * spec so the regeneration rule can be stated without reference to
-     * whichever box happens to run it (D551).
-     */
-    readonly hostFacts?: HostFacts;
+	/** Common Name for the leaf (default: 'camstack.local') */
+	readonly commonName?: string;
+	/** Leaf validity in days. Clamped to `MAX_LEAF_VALIDITY_DAYS`. */
+	readonly validDays?: number;
+	/** Additional SANs (DNS names or IPs). Required coverage by definition. */
+	readonly extraSans?: readonly string[];
+	/**
+	* The machine being certified. Defaults to the real one; injected by the
+	* spec so the regeneration rule can be stated without reference to
+	* whichever box happens to run it (D551).
+	*/
+	readonly hostFacts?: HostFacts;
 }
 /**
- * Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
- * a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
- * chained to it (`camstack.crt` = leaf + root, `camstack.key`).
- *
- * ## The regeneration rule (D227)
- *
- * Reissue happens when, and only when, the material on disk **cannot do
- * its job**:
- *
- * - it is absent, unreadable, or the key does not match the certificate;
- * - the root is absent (every pre-2026-08 install: one self-signed
- *   `CA:TRUE` leaf and no root) or is inside its renewal window;
- * - the leaf is inside its 30-day renewal window;
- * - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
- *   rejects an app-supplied anchor without it;
- * - the leaf is not actually issued by the root on disk;
- * - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
- * - **a name or address the hub must answer for is missing from the SAN
- *   list** — a DHCP move, a new interface or a new hostname.
- *
- * And explicitly NOT when: the certificate names an address the machine
- * no longer has (a superset still works — the check is one-directional),
- * a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
- * (global and ULA both rotate under privacy extensions / interface-id
- * churn — `os` cannot tell temporary from permanent), or a new build shipped.
- *
- * Every trigger is derived from the files plus the machine, so once a
- * reissue clears them it clears them for good: the next boot returns
- * `generated: false`. A certificate that moved on every boot would
- * invalidate every trust an operator granted by hand — worse than the
- * bugs this rule fixes.
- *
- * **The root is rotated only for root-level reasons.** SAN drift rotates
- * the leaf alone, so trust granted to `camstack-ca.crt` survives every
- * address change the hub will ever see.
- */
+* Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
+* a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
+* chained to it (`camstack.crt` = leaf + root, `camstack.key`).
+*
+* ## The regeneration rule (D227)
+*
+* Reissue happens when, and only when, the material on disk **cannot do
+* its job**:
+*
+* - it is absent, unreadable, or the key does not match the certificate;
+* - the root is absent (every pre-2026-08 install: one self-signed
+*   `CA:TRUE` leaf and no root) or is inside its renewal window;
+* - the leaf is inside its 30-day renewal window;
+* - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
+*   rejects an app-supplied anchor without it;
+* - the leaf is not actually issued by the root on disk;
+* - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
+* - **a name or address the hub must answer for is missing from the SAN
+*   list** — a DHCP move, a new interface or a new hostname.
+*
+* And explicitly NOT when: the certificate names an address the machine
+* no longer has (a superset still works — the check is one-directional),
+* a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
+* (global and ULA both rotate under privacy extensions / interface-id
+* churn — `os` cannot tell temporary from permanent), or a new build shipped.
+*
+* Every trigger is derived from the files plus the machine, so once a
+* reissue clears them it clears them for good: the next boot returns
+* `generated: false`. A certificate that moved on every boot would
+* invalidate every trust an operator granted by hand — worse than the
+* bugs this rule fixes.
+*
+* **The root is rotated only for root-level reasons.** SAN drift rotates
+* the leaf alone, so trust granted to `camstack-ca.crt` survives every
+* address change the hub will ever see.
+*/
 export declare function ensureTlsCert(dataDir: string, options?: CertOptions): Promise<EnsureTlsResult>;
 /**
- * Operator "Regenerate": issue a new leaf under the existing local CA.
- * Never rotates the root — trust granted to `camstack-ca.crt` survives.
- */
+* Operator "Regenerate": issue a new leaf under the existing local CA.
+* Never rotates the root — trust granted to `camstack-ca.crt` survives.
+*/
 export declare function reissueTlsLeaf(dataDir: string, options?: CertOptions): Promise<EnsureTlsResult>;
 /**
- * Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
- * options. `certPath` is a full chain, so the listener presents the local
- * root alongside the leaf.
- */
+* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
+* options. `certPath` is a full chain, so the listener presents the local
+* root alongside the leaf.
+*/
 export declare function loadTlsCert(certPath: string, keyPath: string): TlsCertPair;
 export type { CertIdentity, CertRegenerationReason, HostFacts };
 export { collectCertIdentity, evaluateExistingCert, MAX_LEAF_VALIDITY_DAYS };

package/dist/tls/https-listener.d.ts

@@ -1,30 +1,30 @@
-import { Server as TlsServer } from 'node:tls';
-import { TlsCertPair } from './cert-manager.js';
+import type { Server as TlsServer } from "node:tls";
+import type { TlsCertPair } from "./cert-manager.js";
 export type HttpsReloadOutcome = {
-    readonly kind: 'reloaded';
-    readonly servedLeafFingerprint: string;
+	readonly kind: "reloaded";
+	readonly servedLeafFingerprint: string;
 } | {
-    readonly kind: 'no-listener';
+	readonly kind: "no-listener";
 } | {
-    readonly kind: 'failed';
-    readonly error: string;
+	readonly kind: "failed";
+	readonly error: string;
 };
 /** SHA-256 fingerprint of the first certificate (the leaf) in a PEM chain. */
 export declare function leafFingerprintOf(chain: Buffer | string): string;
 /**
- * Called once by the server after its HTTPS listener is up, with the pair it
- * was started on. From here on a certificate action swaps the served
- * certificate in place (`setSecureContext`) — new handshakes get the new
- * leaf, open connections keep theirs, nothing restarts.
- */
+* Called once by the server after its HTTPS listener is up, with the pair it
+* was started on. From here on a certificate action swaps the served
+* certificate in place (`setSecureContext`) — new handshakes get the new
+* leaf, open connections keep theirs, nothing restarts.
+*/
 export declare function registerHttpsListener(server: TlsServer, pair: TlsCertPair): void;
 /** Forget the listener — on shutdown, and between specs. */
 export declare function clearHttpsListener(): void;
 /**
- * The leaf the HTTPS listener serves now, or `null` when this process has no
- * registered listener (TLS off, or a process that does not own one) — in
- * which case nobody can say, and `null` is the honest answer.
- */
+* The leaf the HTTPS listener serves now, or `null` when this process has no
+* registered listener (TLS off, or a process that does not own one) — in
+* which case nobody can say, and `null` is the honest answer.
+*/
 export declare function servedHttpsLeafFingerprint(): string | null;
 /** Serve `pair` from now on. Never throws: the outcome says what happened. */
 export declare function reloadHttpsListener(pair: TlsCertPair): HttpsReloadOutcome;

package/dist/tls/index.d.ts

@@ -1,8 +1,8 @@
-export { CA_VALIDITY_DAYS, type CertEvaluationInput, LEAF_RENEWAL_WINDOW_DAYS, SERVER_AUTH_OID, } from './cert-evaluation.js';
-export { type CertIdentity, type CertOptions, type HostFacts, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair, } from './cert-manager.js';
-export { type BootTls, type BootTlsMode, prepareBootTls } from './boot-tls.js';
-export { clearHttpsListener, type HttpsReloadOutcome, leafFingerprintOf, registerHttpsListener, reloadHttpsListener, servedHttpsLeafFingerprint, } from './https-listener.js';
-export { applyCertificateToListener, regenerateCertificate, revertToGeneratedCertificate, storeUploadedCertificate, type UploadCertificateInput, } from './tls-actions.js';
-export { CA_COMMON_NAME } from './cert-issue.js';
-export { validateUploadedTls, type UploadedTlsValidation } from './uploaded-cert.js';
-export { type TlsAccessStatus, readTlsAccessStatus, splitPemCertificates, UPLOADED_CA_FILE, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans, } from './tls-status.js';
+export { CA_VALIDITY_DAYS, type CertEvaluationInput, LEAF_RENEWAL_WINDOW_DAYS, SERVER_AUTH_OID } from "./cert-evaluation.js";
+export { type CertIdentity, type CertOptions, type HostFacts, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair } from "./cert-manager.js";
+export { type BootTls, type BootTlsMode, prepareBootTls } from "./boot-tls.js";
+export { clearHttpsListener, type HttpsReloadOutcome, leafFingerprintOf, registerHttpsListener, reloadHttpsListener, servedHttpsLeafFingerprint } from "./https-listener.js";
+export { applyCertificateToListener, regenerateCertificate, revertToGeneratedCertificate, storeUploadedCertificate, type UploadCertificateInput } from "./tls-actions.js";
+export { CA_COMMON_NAME } from "./cert-issue.js";
+export { validateUploadedTls, type UploadedTlsValidation } from "./uploaded-cert.js";
+export { type TlsAccessStatus, readTlsAccessStatus, splitPemCertificates, UPLOADED_CA_FILE, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans } from "./tls-status.js";

package/dist/tls/tls-actions.d.ts

@@ -1,29 +1,29 @@
-import { CertOptions } from './cert-manager.js';
-import { HttpsReloadOutcome } from './https-listener.js';
+import { type CertOptions } from "./cert-manager.js";
+import { type HttpsReloadOutcome } from "./https-listener.js";
 /**
- * The certificate actions of Network → Local access (D726). Each one changes
- * the files under `<dataDir>/tls` and then puts them on the listener, so the
- * certificate the status reports is the certificate a client is served.
- */
+* The certificate actions of Network → Local access (D726). Each one changes
+* the files under `<dataDir>/tls` and then puts them on the listener, so the
+* certificate the status reports is the certificate a client is served.
+*/
 export interface UploadCertificateInput {
-    readonly certPem: string;
-    readonly keyPem: string;
-    readonly caPem?: string | undefined;
+	readonly certPem: string;
+	readonly keyPem: string;
+	readonly caPem?: string | undefined;
 }
 /**
- * Store an operator's certificate. The leaf (or chain) and key replace the
- * served pair; a CA, when given, goes to its own file. The local CA
- * (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
- * and it is what "Revert to generated" and every device that trusts it
- * still need.
- */
+* Store an operator's certificate. The leaf (or chain) and key replace the
+* served pair; a CA, when given, goes to its own file. The local CA
+* (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
+* and it is what "Revert to generated" and every device that trusts it
+* still need.
+*/
 export declare function storeUploadedCertificate(dataDir: string, input: UploadCertificateInput): Promise<void>;
 /** Issue a new generated leaf under the local CA. Refused while an upload is served. */
 export declare function regenerateCertificate(dataDir: string, options: CertOptions): Promise<void>;
 /** Drop the upload and serve the generated local-CA leaf again (D227). */
 export declare function revertToGeneratedCertificate(dataDir: string, options: CertOptions): Promise<void>;
 /**
- * Put the pair on disk on the HTTPS listener. Called after every action, so
- * "the certificate changed" and "clients see it" are the same moment.
- */
+* Put the pair on disk on the HTTPS listener. Called after every action, so
+* "the certificate changed" and "clients see it" are the same moment.
+*/
 export declare function applyCertificateToListener(dataDir: string): HttpsReloadOutcome;

package/dist/tls/tls-status.d.ts

@@ -1,13 +1,13 @@
-export type TlsMode = 'generated' | 'uploaded' | 'disabled';
+export type TlsMode = "generated" | "uploaded" | "disabled";
 export interface TlsAccessStatus {
-    readonly mode: TlsMode;
-    readonly leafFingerprintSha256: string | null;
-    readonly caFingerprintSha256: string | null;
-    readonly validTo: string | null;
-    readonly sans: readonly string[];
-    readonly caCertPem: string | null;
-    readonly reissueError: string | null;
-    readonly restartRequired: boolean;
+	readonly mode: TlsMode;
+	readonly leafFingerprintSha256: string | null;
+	readonly caFingerprintSha256: string | null;
+	readonly validTo: string | null;
+	readonly sans: readonly string[];
+	readonly caCertPem: string | null;
+	readonly reissueError: string | null;
+	readonly restartRequired: boolean;
 }
 export declare function readTlsMode(dataDir: string): TlsMode;
 export declare function writeTlsMode(dataDir: string, mode: TlsMode): void;
@@ -18,10 +18,10 @@ export declare const UPLOADED_CA_FILE = "uploaded-ca.crt";
 /** Every certificate in a PEM bundle, in order. */
 export declare function splitPemCertificates(pem: string): readonly string[];
 /**
- * What the node's certificate is, and whether the listener serves it.
- * `servedLeafFingerprint` is the leaf the HTTPS listener presents right now
- * (`servedHttpsLeafFingerprint()`), or `null` when unknown; a restart is
- * required exactly when the listener serves a different leaf than the one
- * on disk — a measured fact, not a flag a mutation remembered to set.
- */
+* What the node's certificate is, and whether the listener serves it.
+* `servedLeafFingerprint` is the leaf the HTTPS listener presents right now
+* (`servedHttpsLeafFingerprint()`), or `null` when unknown; a restart is
+* required exactly when the listener serves a different leaf than the one
+* on disk — a measured fact, not a flag a mutation remembered to set.
+*/
 export declare function readTlsAccessStatus(dataDir: string, servedLeafFingerprint: string | null): TlsAccessStatus;

package/dist/tls/uploaded-cert.d.ts

@@ -1,14 +1,14 @@
 export type UploadedTlsValidation = {
-    readonly ok: true;
-    readonly fingerprintSha256: string;
-    readonly validTo: string;
+	readonly ok: true;
+	readonly fingerprintSha256: string;
+	readonly validTo: string;
 } | {
-    readonly ok: false;
-    readonly error: string;
+	readonly ok: false;
+	readonly error: string;
 };
 /**
- * Operator-supplied material must parse, match its key, and carry
- * `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
- * to keep generating.
- */
+* Operator-supplied material must parse, match its key, and carry
+* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
+* to keep generating.
+*/
 export declare function validateUploadedTls(certPem: string, keyPem: string): UploadedTlsValidation;