@camstack/system 1.2.390 → 1.2.392

package/dist/storage/fs-storage-backend.d.ts

@@ -1,40 +1,40 @@
 export interface IStorageBackend {
-    /** Backend type identifier */
-    readonly type: string;
-    /** Base path of this backend */
-    readonly basePath: string;
-    /** Resolve a subpath to an absolute path */
-    resolve(subpath: string): string;
-    /**
-     * Check whether the backend is usable: either the base directory
-     * already exists and is writable, OR we can create it on first
-     * write (i.e. the nearest existing ancestor is writable).
-     */
-    isAvailable(): boolean;
-    /** No-op for lazy backends. Kept for API compatibility. */
-    initialize(): Promise<void>;
+	/** Backend type identifier */
+	readonly type: string;
+	/** Base path of this backend */
+	readonly basePath: string;
+	/** Resolve a subpath to an absolute path */
+	resolve(subpath: string): string;
+	/**
+	* Check whether the backend is usable: either the base directory
+	* already exists and is writable, OR we can create it on first
+	* write (i.e. the nearest existing ancestor is writable).
+	*/
+	isAvailable(): boolean;
+	/** No-op for lazy backends. Kept for API compatibility. */
+	initialize(): Promise<void>;
 }
 /**
- * Filesystem storage backend — lazy by design.
- *
- * `initialize()` does NOT create the base directory eagerly. Instead,
- * consumers that write via `FilesystemStorageProvider` (and other write
- * helpers in storage-manager.ts) run `fs.mkdir(dirname(filePath), { recursive: true })`
- * right before every `writeFile`, so the directory tree appears on demand.
- *
- * The previous behaviour eagerly mkdir'd every location declared in
- * `StorageLocationManager.initializeDefaults()` — six directories (`db`,
- * `media`, `recordings`, `models`, `cache`, `logs`) got created at boot
- * even if the installation had no cameras, no recording addon, no
- * analytics addon, etc. That meant every fresh install looked like it
- * was producing data when it had nothing to write. Laziness fixes that:
- * a directory only exists once an addon decides to put a file there.
- */
+* Filesystem storage backend — lazy by design.
+*
+* `initialize()` does NOT create the base directory eagerly. Instead,
+* consumers that write via `FilesystemStorageProvider` (and other write
+* helpers in storage-manager.ts) run `fs.mkdir(dirname(filePath), { recursive: true })`
+* right before every `writeFile`, so the directory tree appears on demand.
+*
+* The previous behaviour eagerly mkdir'd every location declared in
+* `StorageLocationManager.initializeDefaults()` — six directories (`db`,
+* `media`, `recordings`, `models`, `cache`, `logs`) got created at boot
+* even if the installation had no cameras, no recording addon, no
+* analytics addon, etc. That meant every fresh install looked like it
+* was producing data when it had nothing to write. Laziness fixes that:
+* a directory only exists once an addon decides to put a file there.
+*/
 export declare class FsStorageBackend implements IStorageBackend {
-    readonly type = "local";
-    readonly basePath: string;
-    constructor(basePath: string);
-    resolve(subpath: string): string;
-    isAvailable(): boolean;
-    initialize(): Promise<void>;
+	readonly type = "local";
+	readonly basePath: string;
+	constructor(basePath: string);
+	resolve(subpath: string): string;
+	isAvailable(): boolean;
+	initialize(): Promise<void>;
 }

package/dist/storage/storage-location-manager.d.ts

@@ -1,23 +1,23 @@
-import { IStorageBackend } from './fs-storage-backend.js';
-export type StorageLocationName = 'data' | 'media' | 'recordings' | 'models' | 'cache' | 'logs';
+import { type IStorageBackend } from "./fs-storage-backend.js";
+export type StorageLocationName = "data" | "media" | "recordings" | "models" | "cache" | "logs";
 export declare class StorageLocationManager {
-    private readonly backends;
-    private readonly dataPath;
-    constructor(dataPath: string);
-    /** Initialize all locations with default paths */
-    initializeDefaults(): Promise<void>;
-    /** Override a specific location's backend path */
-    setLocationPath(name: StorageLocationName, basePath: string): Promise<void>;
-    /** Get the backend for a location */
-    getBackend(name: StorageLocationName): IStorageBackend;
-    /** Resolve a path within a location */
-    resolve(location: StorageLocationName, subpath: string): string;
-    /** Check if all locations are available */
-    getStatus(): Array<{
-        name: StorageLocationName;
-        available: boolean;
-        path: string;
-    }>;
-    /** All location names */
-    getLocationNames(): StorageLocationName[];
+	private readonly backends;
+	private readonly dataPath;
+	constructor(dataPath: string);
+	/** Initialize all locations with default paths */
+	initializeDefaults(): Promise<void>;
+	/** Override a specific location's backend path */
+	setLocationPath(name: StorageLocationName, basePath: string): Promise<void>;
+	/** Get the backend for a location */
+	getBackend(name: StorageLocationName): IStorageBackend;
+	/** Resolve a path within a location */
+	resolve(location: StorageLocationName, subpath: string): string;
+	/** Check if all locations are available */
+	getStatus(): Array<{
+		name: StorageLocationName;
+		available: boolean;
+		path: string;
+	}>;
+	/** All location names */
+	getLocationNames(): StorageLocationName[];
 }

package/dist/storage/storage-manager.d.ts

@@ -1,83 +1,83 @@
-import { StorageLocationManager, StorageLocationName } from './storage-location-manager.js';
-import { IStorageProvider as INewStorageProvider, ISettingsBackend, HistogramBucket } from '@camstack/types';
+import { StorageLocationManager, type StorageLocationName } from "./storage-location-manager.js";
+import type { IStorageProvider as INewStorageProvider, ISettingsBackend, HistogramBucket } from "@camstack/types";
 export interface IStorageProvider {
-    initialize(): Promise<void>;
-    shutdown(): Promise<void>;
-    getLocation(name: StorageLocationName): IStorageLocation;
-    export?(locationName: StorageLocationName): Promise<Buffer>;
-    import?(locationName: StorageLocationName, data: Buffer): Promise<void>;
+	initialize(): Promise<void>;
+	shutdown(): Promise<void>;
+	getLocation(name: StorageLocationName): IStorageLocation;
+	export?(locationName: StorageLocationName): Promise<Buffer>;
+	import?(locationName: StorageLocationName, data: Buffer): Promise<void>;
 }
 export interface QueryFilter {
-    where?: Record<string, unknown>;
-    whereIn?: Record<string, unknown[]>;
-    whereBetween?: Record<string, [unknown, unknown]>;
-    orderBy?: {
-        field: string;
-        direction: 'asc' | 'desc';
-    };
-    limit?: number;
-    offset?: number;
+	where?: Record<string, unknown>;
+	whereIn?: Record<string, unknown[]>;
+	whereBetween?: Record<string, [unknown, unknown]>;
+	orderBy?: {
+		field: string;
+		direction: "asc" | "desc";
+	};
+	limit?: number;
+	offset?: number;
 }
 export interface StorageRecord {
-    collection: string;
-    id: string;
-    data: Record<string, unknown>;
+	collection: string;
+	id: string;
+	data: Record<string, unknown>;
 }
 export interface IStructuredStorage {
-    query(collection: string, filter?: QueryFilter): Promise<readonly StorageRecord[]>;
-    insert(record: StorageRecord): Promise<StorageRecord>;
-    update(collection: string, id: string, data: Record<string, unknown>): Promise<StorageRecord>;
-    delete(collection: string, id: string): Promise<void>;
-    count(collection: string, filter?: QueryFilter): Promise<number>;
-    histogram(input: {
-        collection: string;
-        field: string;
-        bucketSize: number;
-        origin: number;
-        filter?: QueryFilter;
-    }): Promise<readonly HistogramBucket[]>;
+	query(collection: string, filter?: QueryFilter): Promise<readonly StorageRecord[]>;
+	insert(record: StorageRecord): Promise<StorageRecord>;
+	update(collection: string, id: string, data: Record<string, unknown>): Promise<StorageRecord>;
+	delete(collection: string, id: string): Promise<void>;
+	count(collection: string, filter?: QueryFilter): Promise<number>;
+	histogram(input: {
+		collection: string;
+		field: string;
+		bucketSize: number;
+		origin: number;
+		filter?: QueryFilter;
+	}): Promise<readonly HistogramBucket[]>;
 }
 export interface IFileStorage {
-    readFile(path: string): Promise<Buffer>;
-    writeFile(path: string, data: Buffer): Promise<void>;
-    deleteFile(path: string): Promise<void>;
-    listFiles(prefix?: string): Promise<readonly string[]>;
-    getFileUrl(path: string): Promise<string>;
-    exists(path: string): Promise<boolean>;
+	readFile(path: string): Promise<Buffer>;
+	writeFile(path: string, data: Buffer): Promise<void>;
+	deleteFile(path: string): Promise<void>;
+	listFiles(prefix?: string): Promise<readonly string[]>;
+	getFileUrl(path: string): Promise<string>;
+	exists(path: string): Promise<boolean>;
 }
 export interface IStorageLocation {
-    structured?: IStructuredStorage;
-    files?: IFileStorage;
+	structured?: IStructuredStorage;
+	files?: IFileStorage;
 }
 /**
- * StorageManager — bridge between legacy code (getLocation/getLocationPath)
- * and the new capability-based storage system.
- *
- * Legacy consumers call getLocation('addon', namespace) to get structured + file storage.
- * This manager builds the response from:
- *   - SettingsBackend (for structured queries) — provided by sqlite-settings addon
- *   - LocationManager (for file paths) — set during Phase 2 boot
- */
+* StorageManager — bridge between legacy code (getLocation/getLocationPath)
+* and the new capability-based storage system.
+*
+* Legacy consumers call getLocation('addon', namespace) to get structured + file storage.
+* This manager builds the response from:
+*   - SettingsBackend (for structured queries) — provided by sqlite-settings addon
+*   - LocationManager (for file paths) — set during Phase 2 boot
+*/
 export declare class StorageManager {
-    private legacyProvider;
-    private locationManager;
-    private newStorageProvider;
-    private settingsBackend;
-    /** @deprecated Set by legacy capability consumer — use setNewStorageProvider instead */
-    setProvider(provider: IStorageProvider | INewStorageProvider): void;
-    setNewStorageProvider(provider: INewStorageProvider): void;
-    setSettingsBackend(backend: ISettingsBackend): void;
-    getSettingsBackend(): ISettingsBackend;
-    getProvider(): IStorageProvider;
-    setLocationManager(manager: StorageLocationManager): void;
-    getLocationManager(): StorageLocationManager;
-    initializeLocations(dataPath: string): Promise<void>;
-    getLocationPath(name: StorageLocationName): string;
-    /**
-     * Get a storage location with optional namespace scoping.
-     * Builds IStorageLocation from settingsBackend (structured) + locationManager (files).
-     */
-    getLocation(name: StorageLocationName | string, namespace?: string): IStorageLocation;
-    private createLegacyShim;
-    private createNamespacedLocation;
+	private legacyProvider;
+	private locationManager;
+	private newStorageProvider;
+	private settingsBackend;
+	/** @deprecated Set by legacy capability consumer — use setNewStorageProvider instead */
+	setProvider(provider: IStorageProvider | INewStorageProvider): void;
+	setNewStorageProvider(provider: INewStorageProvider): void;
+	setSettingsBackend(backend: ISettingsBackend): void;
+	getSettingsBackend(): ISettingsBackend;
+	getProvider(): IStorageProvider;
+	setLocationManager(manager: StorageLocationManager): void;
+	getLocationManager(): StorageLocationManager;
+	initializeLocations(dataPath: string): Promise<void>;
+	getLocationPath(name: StorageLocationName): string;
+	/**
+	* Get a storage location with optional namespace scoping.
+	* Builds IStorageLocation from settingsBackend (structured) + locationManager (files).
+	*/
+	getLocation(name: StorageLocationName | string, namespace?: string): IStorageLocation;
+	private createLegacyShim;
+	private createNamespacedLocation;
 }

package/dist/tls/boot-tls.d.ts

@@ -1,29 +1,29 @@
-import { CertOptions, EnsureTlsResult, TlsCertPair } from './cert-manager.js';
+import { type CertOptions, type EnsureTlsResult, type TlsCertPair } from "./cert-manager.js";
 /** The certificate source a booting listener serves. */
-export type BootTlsMode = 'generated' | 'uploaded';
+export type BootTlsMode = "generated" | "uploaded";
 export interface BootTls {
-    readonly mode: BootTlsMode;
-    readonly pair: TlsCertPair;
-    /**
-     * The `ensureTlsCert` outcome — present only for a generated certificate,
-     * so a reissue reaches the operator as an alert. `undefined` when an
-     * uploaded certificate is served: the hub never evaluates, let alone
-     * reissues, a certificate the operator supplied.
-     */
-    readonly ensured: EnsureTlsResult | undefined;
-    /**
-     * True when the mode marker said `uploaded` but the files were gone, so
-     * the node fell back to its generated certificate. The caller logs it:
-     * a certificate source that changed under the operator is never silent.
-     */
-    readonly uploadedMissing: boolean;
+	readonly mode: BootTlsMode;
+	readonly pair: TlsCertPair;
+	/**
+	* The `ensureTlsCert` outcome — present only for a generated certificate,
+	* so a reissue reaches the operator as an alert. `undefined` when an
+	* uploaded certificate is served: the hub never evaluates, let alone
+	* reissues, a certificate the operator supplied.
+	*/
+	readonly ensured: EnsureTlsResult | undefined;
+	/**
+	* True when the mode marker said `uploaded` but the files were gone, so
+	* the node fell back to its generated certificate. The caller logs it:
+	* a certificate source that changed under the operator is never silent.
+	*/
+	readonly uploadedMissing: boolean;
 }
 /**
- * Decide what the listener serves at boot. The admin UI (Network → Local
- * access) is the only way to set a certificate (D726): it either leaves the
- * hub on its generated local-CA leaf (D227) or uploads one, recorded by the
- * `tls/mode` marker. An uploaded certificate is served verbatim — running it
- * through `ensureTlsCert` would replace it on the first restart, because a
- * leaf the local root did not issue is one of that rule's reissue triggers.
- */
+* Decide what the listener serves at boot. The admin UI (Network → Local
+* access) is the only way to set a certificate (D726): it either leaves the
+* hub on its generated local-CA leaf (D227) or uploads one, recorded by the
+* `tls/mode` marker. An uploaded certificate is served verbatim — running it
+* through `ensureTlsCert` would replace it on the first restart, because a
+* leaf the local root did not issue is one of that rule's reissue triggers.
+*/
 export declare function prepareBootTls(dataDir: string, options?: CertOptions): Promise<BootTls>;

package/dist/tls/cert-evaluation.d.ts

@@ -1,41 +1,41 @@
-import { CertIdentity } from './cert-identity.js';
+import type { CertIdentity } from "./cert-identity.js";
 /** OID `id-kp-serverAuth`. Apple's trustd requires it on the leaf. */
 export declare const SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
 /**
- * Apple's `SecPolicyCheckOtherTrustValidityPeriod` ceiling is 825 days;
- * the CA/Browser Forum's recommended maximum is 397. We sit at 397.
- */
+* Apple's `SecPolicyCheckOtherTrustValidityPeriod` ceiling is 825 days;
+* the CA/Browser Forum's recommended maximum is 397. We sit at 397.
+*/
 export declare const MAX_LEAF_VALIDITY_DAYS = 397;
 /** Reissue this long before the leaf dies, so nobody serves an expired one. */
 export declare const LEAF_RENEWAL_WINDOW_DAYS = 30;
 /** A local root outlives many leaves — it is the anchor an operator trusts. */
 export declare const CA_VALIDITY_DAYS = 3650;
 /**
- * The CA must outlive any leaf it signs by a margin, or a leaf issued
- * today expires after its own issuer.
- */
+* The CA must outlive any leaf it signs by a margin, or a leaf issued
+* today expires after its own issuer.
+*/
 export declare const CA_RENEWAL_WINDOW_DAYS: number;
 /**
- * Why a reissue is happening. Reported on `EnsureTlsResult` and logged
- * verbatim — an operator who trusted the old certificate by hand learns
- * from this string, not from a browser error.
- */
-export type CertRegenerationReason = 'missing' | 'unreadable' | 'no-local-ca' | 'ca-expiring' | 'key-mismatch' | 'expiring' | 'missing-server-auth-eku' | 'not-issued-by-local-ca' | 'validity-too-long' | 'san-coverage-gap';
+* Why a reissue is happening. Reported on `EnsureTlsResult` and logged
+* verbatim — an operator who trusted the old certificate by hand learns
+* from this string, not from a browser error.
+*/
+export type CertRegenerationReason = "missing" | "unreadable" | "no-local-ca" | "ca-expiring" | "key-mismatch" | "expiring" | "missing-server-auth-eku" | "not-issued-by-local-ca" | "validity-too-long" | "san-coverage-gap";
 export interface CertEvaluationInput {
-    /** Contents of `camstack.crt` — leaf first, then the issuing CA. */
-    readonly chainPem: string;
-    /** Contents of `camstack.key` — the leaf's private key. */
-    readonly keyPem: string;
-    /** Contents of `camstack-ca.crt` — the local root. */
-    readonly caPem: string;
-    readonly identity: CertIdentity;
-    readonly now: Date;
+	/** Contents of `camstack.crt` — leaf first, then the issuing CA. */
+	readonly chainPem: string;
+	/** Contents of `camstack.key` — the leaf's private key. */
+	readonly keyPem: string;
+	/** Contents of `camstack-ca.crt` — the local root. */
+	readonly caPem: string;
+	readonly identity: CertIdentity;
+	readonly now: Date;
 }
 export declare function reasonRequiresNewCa(reason: CertRegenerationReason): boolean;
 /**
- * `null` when the material on disk is fit to keep serving.
- *
- * Order matters only for the quality of the reported reason; any
- * non-null answer produces the same action.
- */
+* `null` when the material on disk is fit to keep serving.
+*
+* Order matters only for the quality of the reported reason; any
+* non-null answer produces the same action.
+*/
 export declare function evaluateExistingCert(input: CertEvaluationInput): CertRegenerationReason | null;

package/dist/tls/cert-identity.d.ts

@@ -1,60 +1,60 @@
 /** One address on one interface — the slice of `os.NetworkInterfaceInfo` this uses. */
 export interface HostInterfaceAddress {
-    readonly address: string;
-    readonly internal: boolean;
+	readonly address: string;
+	readonly internal: boolean;
 }
 /**
- * What the certificate needs to know about the machine it identifies.
- *
- * Injected rather than read, for the same reason `evaluateExistingCert`
- * takes `now` instead of calling `Date.now()`: a rule whose inputs are
- * ambient cannot be stated in a test, and a spec that reads the real
- * `os.hostname()` is a statement about the machine running it. The CI
- * runner and this laptop disagreed about both halves (D551).
- */
+* What the certificate needs to know about the machine it identifies.
+*
+* Injected rather than read, for the same reason `evaluateExistingCert`
+* takes `now` instead of calling `Date.now()`: a rule whose inputs are
+* ambient cannot be stated in a test, and a spec that reads the real
+* `os.hostname()` is a statement about the machine running it. The CI
+* runner and this laptop disagreed about both halves (D551).
+*/
 export interface HostFacts {
-    readonly hostname: string;
-    readonly networkInterfaces: Readonly<Record<string, readonly HostInterfaceAddress[] | undefined>>;
+	readonly hostname: string;
+	readonly networkInterfaces: Readonly<Record<string, readonly HostInterfaceAddress[] | undefined>>;
 }
 /** The real machine. The only place in `tls/` that touches `os`. */
 export declare function systemHostFacts(): HostFacts;
 /**
- * Names/addresses that go INTO the certificate, and the subset whose
- * absence forces a reissue.
- *
- * The two are deliberately different sizes. Everything plausible is
- * certified — costs nothing. Only a **stable** identity gates
- * regeneration (IPv4 + DNS + operator `extraSans`), because a gate that
- * fires on a rotating address rewrites the certificate on every boot,
- * which is a worse bug than the one the gate exists to fix. IPv6 never
- * gates — ULA proved as unstable as global SLAAC on the live hub.
- */
+* Names/addresses that go INTO the certificate, and the subset whose
+* absence forces a reissue.
+*
+* The two are deliberately different sizes. Everything plausible is
+* certified — costs nothing. Only a **stable** identity gates
+* regeneration (IPv4 + DNS + operator `extraSans`), because a gate that
+* fires on a rotating address rewrites the certificate on every boot,
+* which is a worse bug than the one the gate exists to fix. IPv6 never
+* gates — ULA proved as unstable as global SLAAC on the live hub.
+*/
 export interface CertIdentity {
-    readonly dnsNames: readonly string[];
-    readonly ipAddresses: readonly string[];
-    readonly requiredDnsNames: readonly string[];
-    readonly requiredIpAddresses: readonly string[];
+	readonly dnsNames: readonly string[];
+	readonly ipAddresses: readonly string[];
+	readonly requiredDnsNames: readonly string[];
+	readonly requiredIpAddresses: readonly string[];
 }
 export interface CertIdentityOptions {
-    readonly commonName: string;
-    readonly extraSans: readonly string[];
-    /** The machine being certified. Defaults to {@link systemHostFacts}. */
-    readonly hostFacts?: HostFacts;
+	readonly commonName: string;
+	readonly extraSans: readonly string[];
+	/** The machine being certified. Defaults to {@link systemHostFacts}. */
+	readonly hostFacts?: HostFacts;
 }
 export declare function isIpv4(value: string): boolean;
 export declare function isIpv6(value: string): boolean;
 /**
- * `fe80::/10` and `169.254.0.0/16`. An IPv6 link-local address needs a
- * zone index to be usable and a SAN cannot carry one, so such an entry
- * can never match anything — it is noise that makes the certificate look
- * broader than it is.
- */
+* `fe80::/10` and `169.254.0.0/16`. An IPv6 link-local address needs a
+* zone index to be usable and a SAN cannot carry one, so such an entry
+* can never match anything — it is noise that makes the certificate look
+* broader than it is.
+*/
 export declare function isLinkLocal(value: string): boolean;
 /** `fc00::/7` — the IPv6 range that behaves like RFC 1918 does for v4. */
 export declare function isUniqueLocalIpv6(value: string): boolean;
 /**
- * Snapshot the machine's identity. Called once per `ensureTlsCert`; the
- * result is both the SAN list for a new leaf and the yardstick the
- * existing leaf is measured against.
- */
+* Snapshot the machine's identity. Called once per `ensureTlsCert`; the
+* result is both the SAN list for a new leaf and the yardstick the
+* existing leaf is measured against.
+*/
 export declare function collectCertIdentity(options: CertIdentityOptions): CertIdentity;

package/dist/tls/cert-issue.d.ts

@@ -1,31 +1,51 @@
-import { webcrypto as WebCrypto } from 'node:crypto';
-import { X509Certificate as PeculiarCertificate } from '@peculiar/x509';
-import { CertIdentity } from './cert-identity.js';
+/**
+* Certificate issuance. Isolated so `cert-manager.ts` reads as policy and
+* this file reads as mechanics.
+*
+* **In-process, by decision (D551).** This used to shell out to `openssl`
+* three times. The hub's own TLS identity is not allowed to be a function
+* of which openssl happens to sit on the host: this fleet alone runs four
+* of them, and one — Ubuntu 20.04's 1.1.1f — silently ADDED the ambient
+* `/etc/ssl/openssl.cnf` `[req] x509_extensions = v3_ca` block on top of
+* our `-addext` flags, producing a root with two `basicConstraints` and
+* two `subjectKeyIdentifier` extensions. RFC 5280 §4.2 allows each at
+* most once, so OpenSSL 3 (which is what `node:crypto` is) marked that
+* root invalid: `X509Certificate.ca` read `false` on our own CA and
+* `checkIssued()` refused the pair. Under D227 that means "not issued by
+* the local CA", i.e. rotate the root — on every boot, forever, voiding
+* every trust an operator had granted by hand.
+*
+* Keys come from WebCrypto (`node:crypto`'s own implementation) and the
+* DER is assembled by `@peculiar/x509`. Nothing here reads the host.
+*/
+import type { webcrypto as WebCrypto } from "node:crypto";
+import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
+import type { CertIdentity } from "./cert-identity.js";
 /** Subject of the local root. Distinct from the leaf's CN by construction. */
 export declare const CA_COMMON_NAME = "CamStack Local CA";
 /** A PEM-encoded certificate and the PKCS#8 PEM of its private key. */
 export interface CertMaterial {
-    readonly certPem: string;
-    readonly keyPem: string;
+	readonly certPem: string;
+	readonly keyPem: string;
 }
 /** An issuing root: its PEM, and the live key handle needed to sign with it. */
 export interface CaSigner {
-    readonly certPem: string;
-    readonly keyPem: string;
-    readonly cert: PeculiarCertificate;
-    readonly privateKey: WebCrypto.CryptoKey;
+	readonly certPem: string;
+	readonly keyPem: string;
+	readonly cert: PeculiarCertificate;
+	readonly privateKey: WebCrypto.CryptoKey;
 }
 /**
- * A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
- * else, and **no EKU** — Apple rejects an anchor asserting
- * `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
- */
+* A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
+* else, and **no EKU** — Apple rejects an anchor asserting
+* `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
+*/
 export declare function generateCa(now: Date): Promise<CaSigner>;
 /** Re-open a root already on disk so a leaf can be issued under it. */
 export declare function loadCa(certPem: string, keyPem: string): Promise<CaSigner>;
 /**
- * A server leaf signed by the local root: `CA:FALSE`, and
- * `extendedKeyUsage=serverAuth` — not `anyExtendedKeyUsage`, which
- * Apple's `testAppTrustRoot_AnyEKU_AfterJul2019` asserts must fail.
- */
+* A server leaf signed by the local root: `CA:FALSE`, and
+* `extendedKeyUsage=serverAuth` — not `anyExtendedKeyUsage`, which
+* Apple's `testAppTrustRoot_AnyEKU_AfterJul2019` asserts must fail.
+*/
 export declare function issueLeaf(ca: CaSigner, identity: CertIdentity, commonName: string, validDays: number, now: Date): Promise<CertMaterial>;