@camstack/system 1.2.390 → 1.2.392

package/dist/tls/cert-manager.d.ts

@@ -1,98 +1,100 @@
-import { CertRegenerationReason, evaluateExistingCert, MAX_LEAF_VALIDITY_DAYS } from './cert-evaluation.js';
-import { CertIdentity, HostFacts, collectCertIdentity } from './cert-identity.js';
+import type { CertRegenerationReason } from "./cert-evaluation.js";
+import { evaluateExistingCert, MAX_LEAF_VALIDITY_DAYS } from "./cert-evaluation.js";
+import type { CertIdentity, HostFacts } from "./cert-identity.js";
+import { collectCertIdentity } from "./cert-identity.js";
 export interface TlsCertPair {
-    readonly cert: Buffer;
-    readonly key: Buffer;
+	readonly cert: Buffer;
+	readonly key: Buffer;
 }
 export interface EnsureTlsResult {
-    /** Full chain — leaf then CA. This is what the listener serves. */
-    readonly certPath: string;
-    /** The leaf's private key. */
-    readonly keyPath: string;
-    /** The local root. **This** is the file an operator installs as trusted. */
-    readonly caCertPath: string;
-    readonly caKeyPath: string;
-    readonly generated: boolean;
-    /** Why it was reissued — `null` when the existing material was kept. */
-    readonly reason: CertRegenerationReason | null;
-    /** True when the ROOT rotated, i.e. trust granted by hand is now void. */
-    readonly caRotated: boolean;
-    readonly fingerprintSha256: string;
-    readonly caFingerprintSha256: string;
-    /** Fingerprint of the leaf this one replaced — `null` on a fresh install. */
-    readonly previousFingerprintSha256: string | null;
-    /** ISO timestamp at which the leaf stops being valid. */
-    readonly validTo: string;
-    readonly sans: readonly string[];
-    /**
-     * Set when a reissue was needed and FAILED, and the previous material is
-     * still being served. Never null-and-degraded silently: this is the line
-     * that says the certificate is not what the rule wants it to be.
-     */
-    readonly reissueError: string | null;
+	/** Full chain — leaf then CA. This is what the listener serves. */
+	readonly certPath: string;
+	/** The leaf's private key. */
+	readonly keyPath: string;
+	/** The local root. **This** is the file an operator installs as trusted. */
+	readonly caCertPath: string;
+	readonly caKeyPath: string;
+	readonly generated: boolean;
+	/** Why it was reissued — `null` when the existing material was kept. */
+	readonly reason: CertRegenerationReason | null;
+	/** True when the ROOT rotated, i.e. trust granted by hand is now void. */
+	readonly caRotated: boolean;
+	readonly fingerprintSha256: string;
+	readonly caFingerprintSha256: string;
+	/** Fingerprint of the leaf this one replaced — `null` on a fresh install. */
+	readonly previousFingerprintSha256: string | null;
+	/** ISO timestamp at which the leaf stops being valid. */
+	readonly validTo: string;
+	readonly sans: readonly string[];
+	/**
+	* Set when a reissue was needed and FAILED, and the previous material is
+	* still being served. Never null-and-degraded silently: this is the line
+	* that says the certificate is not what the rule wants it to be.
+	*/
+	readonly reissueError: string | null;
 }
 export interface CertOptions {
-    /** Common Name for the leaf (default: 'camstack.local') */
-    readonly commonName?: string;
-    /** Leaf validity in days. Clamped to `MAX_LEAF_VALIDITY_DAYS`. */
-    readonly validDays?: number;
-    /** Additional SANs (DNS names or IPs). Required coverage by definition. */
-    readonly extraSans?: readonly string[];
-    /**
-     * The machine being certified. Defaults to the real one; injected by the
-     * spec so the regeneration rule can be stated without reference to
-     * whichever box happens to run it (D551).
-     */
-    readonly hostFacts?: HostFacts;
+	/** Common Name for the leaf (default: 'camstack.local') */
+	readonly commonName?: string;
+	/** Leaf validity in days. Clamped to `MAX_LEAF_VALIDITY_DAYS`. */
+	readonly validDays?: number;
+	/** Additional SANs (DNS names or IPs). Required coverage by definition. */
+	readonly extraSans?: readonly string[];
+	/**
+	* The machine being certified. Defaults to the real one; injected by the
+	* spec so the regeneration rule can be stated without reference to
+	* whichever box happens to run it (D551).
+	*/
+	readonly hostFacts?: HostFacts;
 }
 /**
- * Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
- * a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
- * chained to it (`camstack.crt` = leaf + root, `camstack.key`).
- *
- * ## The regeneration rule (D227)
- *
- * Reissue happens when, and only when, the material on disk **cannot do
- * its job**:
- *
- * - it is absent, unreadable, or the key does not match the certificate;
- * - the root is absent (every pre-2026-08 install: one self-signed
- *   `CA:TRUE` leaf and no root) or is inside its renewal window;
- * - the leaf is inside its 30-day renewal window;
- * - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
- *   rejects an app-supplied anchor without it;
- * - the leaf is not actually issued by the root on disk;
- * - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
- * - **a name or address the hub must answer for is missing from the SAN
- *   list** — a DHCP move, a new interface or a new hostname.
- *
- * And explicitly NOT when: the certificate names an address the machine
- * no longer has (a superset still works — the check is one-directional),
- * a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
- * (global and ULA both rotate under privacy extensions / interface-id
- * churn — `os` cannot tell temporary from permanent), or a new build shipped.
- *
- * Every trigger is derived from the files plus the machine, so once a
- * reissue clears them it clears them for good: the next boot returns
- * `generated: false`. A certificate that moved on every boot would
- * invalidate every trust an operator granted by hand — worse than the
- * bugs this rule fixes.
- *
- * **The root is rotated only for root-level reasons.** SAN drift rotates
- * the leaf alone, so trust granted to `camstack-ca.crt` survives every
- * address change the hub will ever see.
- */
+* Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
+* a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
+* chained to it (`camstack.crt` = leaf + root, `camstack.key`).
+*
+* ## The regeneration rule (D227)
+*
+* Reissue happens when, and only when, the material on disk **cannot do
+* its job**:
+*
+* - it is absent, unreadable, or the key does not match the certificate;
+* - the root is absent (every pre-2026-08 install: one self-signed
+*   `CA:TRUE` leaf and no root) or is inside its renewal window;
+* - the leaf is inside its 30-day renewal window;
+* - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
+*   rejects an app-supplied anchor without it;
+* - the leaf is not actually issued by the root on disk;
+* - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
+* - **a name or address the hub must answer for is missing from the SAN
+*   list** — a DHCP move, a new interface or a new hostname.
+*
+* And explicitly NOT when: the certificate names an address the machine
+* no longer has (a superset still works — the check is one-directional),
+* a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
+* (global and ULA both rotate under privacy extensions / interface-id
+* churn — `os` cannot tell temporary from permanent), or a new build shipped.
+*
+* Every trigger is derived from the files plus the machine, so once a
+* reissue clears them it clears them for good: the next boot returns
+* `generated: false`. A certificate that moved on every boot would
+* invalidate every trust an operator granted by hand — worse than the
+* bugs this rule fixes.
+*
+* **The root is rotated only for root-level reasons.** SAN drift rotates
+* the leaf alone, so trust granted to `camstack-ca.crt` survives every
+* address change the hub will ever see.
+*/
 export declare function ensureTlsCert(dataDir: string, options?: CertOptions): Promise<EnsureTlsResult>;
 /**
- * Operator "Regenerate": issue a new leaf under the existing local CA.
- * Never rotates the root — trust granted to `camstack-ca.crt` survives.
- */
+* Operator "Regenerate": issue a new leaf under the existing local CA.
+* Never rotates the root — trust granted to `camstack-ca.crt` survives.
+*/
 export declare function reissueTlsLeaf(dataDir: string, options?: CertOptions): Promise<EnsureTlsResult>;
 /**
- * Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
- * options. `certPath` is a full chain, so the listener presents the local
- * root alongside the leaf.
- */
+* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
+* options. `certPath` is a full chain, so the listener presents the local
+* root alongside the leaf.
+*/
 export declare function loadTlsCert(certPath: string, keyPath: string): TlsCertPair;
 export type { CertIdentity, CertRegenerationReason, HostFacts };
 export { collectCertIdentity, evaluateExistingCert, MAX_LEAF_VALIDITY_DAYS };

package/dist/tls/https-listener.d.ts

@@ -1,30 +1,30 @@
-import { Server as TlsServer } from 'node:tls';
-import { TlsCertPair } from './cert-manager.js';
+import type { Server as TlsServer } from "node:tls";
+import type { TlsCertPair } from "./cert-manager.js";
 export type HttpsReloadOutcome = {
-    readonly kind: 'reloaded';
-    readonly servedLeafFingerprint: string;
+	readonly kind: "reloaded";
+	readonly servedLeafFingerprint: string;
 } | {
-    readonly kind: 'no-listener';
+	readonly kind: "no-listener";
 } | {
-    readonly kind: 'failed';
-    readonly error: string;
+	readonly kind: "failed";
+	readonly error: string;
 };
 /** SHA-256 fingerprint of the first certificate (the leaf) in a PEM chain. */
 export declare function leafFingerprintOf(chain: Buffer | string): string;
 /**
- * Called once by the server after its HTTPS listener is up, with the pair it
- * was started on. From here on a certificate action swaps the served
- * certificate in place (`setSecureContext`) — new handshakes get the new
- * leaf, open connections keep theirs, nothing restarts.
- */
+* Called once by the server after its HTTPS listener is up, with the pair it
+* was started on. From here on a certificate action swaps the served
+* certificate in place (`setSecureContext`) — new handshakes get the new
+* leaf, open connections keep theirs, nothing restarts.
+*/
 export declare function registerHttpsListener(server: TlsServer, pair: TlsCertPair): void;
 /** Forget the listener — on shutdown, and between specs. */
 export declare function clearHttpsListener(): void;
 /**
- * The leaf the HTTPS listener serves now, or `null` when this process has no
- * registered listener (TLS off, or a process that does not own one) — in
- * which case nobody can say, and `null` is the honest answer.
- */
+* The leaf the HTTPS listener serves now, or `null` when this process has no
+* registered listener (TLS off, or a process that does not own one) — in
+* which case nobody can say, and `null` is the honest answer.
+*/
 export declare function servedHttpsLeafFingerprint(): string | null;
 /** Serve `pair` from now on. Never throws: the outcome says what happened. */
 export declare function reloadHttpsListener(pair: TlsCertPair): HttpsReloadOutcome;

package/dist/tls/index.d.ts

@@ -1,8 +1,8 @@
-export { CA_VALIDITY_DAYS, type CertEvaluationInput, LEAF_RENEWAL_WINDOW_DAYS, SERVER_AUTH_OID, } from './cert-evaluation.js';
-export { type CertIdentity, type CertOptions, type HostFacts, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair, } from './cert-manager.js';
-export { type BootTls, type BootTlsMode, prepareBootTls } from './boot-tls.js';
-export { clearHttpsListener, type HttpsReloadOutcome, leafFingerprintOf, registerHttpsListener, reloadHttpsListener, servedHttpsLeafFingerprint, } from './https-listener.js';
-export { applyCertificateToListener, regenerateCertificate, revertToGeneratedCertificate, storeUploadedCertificate, type UploadCertificateInput, } from './tls-actions.js';
-export { CA_COMMON_NAME } from './cert-issue.js';
-export { validateUploadedTls, type UploadedTlsValidation } from './uploaded-cert.js';
-export { type TlsAccessStatus, readTlsAccessStatus, splitPemCertificates, UPLOADED_CA_FILE, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans, } from './tls-status.js';
+export { CA_VALIDITY_DAYS, type CertEvaluationInput, LEAF_RENEWAL_WINDOW_DAYS, SERVER_AUTH_OID } from "./cert-evaluation.js";
+export { type CertIdentity, type CertOptions, type HostFacts, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair } from "./cert-manager.js";
+export { type BootTls, type BootTlsMode, prepareBootTls } from "./boot-tls.js";
+export { clearHttpsListener, type HttpsReloadOutcome, leafFingerprintOf, registerHttpsListener, reloadHttpsListener, servedHttpsLeafFingerprint } from "./https-listener.js";
+export { applyCertificateToListener, regenerateCertificate, revertToGeneratedCertificate, storeUploadedCertificate, type UploadCertificateInput } from "./tls-actions.js";
+export { CA_COMMON_NAME } from "./cert-issue.js";
+export { validateUploadedTls, type UploadedTlsValidation } from "./uploaded-cert.js";
+export { type TlsAccessStatus, readTlsAccessStatus, splitPemCertificates, UPLOADED_CA_FILE, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans } from "./tls-status.js";

package/dist/tls/tls-actions.d.ts

@@ -1,29 +1,29 @@
-import { CertOptions } from './cert-manager.js';
-import { HttpsReloadOutcome } from './https-listener.js';
+import { type CertOptions } from "./cert-manager.js";
+import { type HttpsReloadOutcome } from "./https-listener.js";
 /**
- * The certificate actions of Network → Local access (D726). Each one changes
- * the files under `<dataDir>/tls` and then puts them on the listener, so the
- * certificate the status reports is the certificate a client is served.
- */
+* The certificate actions of Network → Local access (D726). Each one changes
+* the files under `<dataDir>/tls` and then puts them on the listener, so the
+* certificate the status reports is the certificate a client is served.
+*/
 export interface UploadCertificateInput {
-    readonly certPem: string;
-    readonly keyPem: string;
-    readonly caPem?: string | undefined;
+	readonly certPem: string;
+	readonly keyPem: string;
+	readonly caPem?: string | undefined;
 }
 /**
- * Store an operator's certificate. The leaf (or chain) and key replace the
- * served pair; a CA, when given, goes to its own file. The local CA
- * (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
- * and it is what "Revert to generated" and every device that trusts it
- * still need.
- */
+* Store an operator's certificate. The leaf (or chain) and key replace the
+* served pair; a CA, when given, goes to its own file. The local CA
+* (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
+* and it is what "Revert to generated" and every device that trusts it
+* still need.
+*/
 export declare function storeUploadedCertificate(dataDir: string, input: UploadCertificateInput): Promise<void>;
 /** Issue a new generated leaf under the local CA. Refused while an upload is served. */
 export declare function regenerateCertificate(dataDir: string, options: CertOptions): Promise<void>;
 /** Drop the upload and serve the generated local-CA leaf again (D227). */
 export declare function revertToGeneratedCertificate(dataDir: string, options: CertOptions): Promise<void>;
 /**
- * Put the pair on disk on the HTTPS listener. Called after every action, so
- * "the certificate changed" and "clients see it" are the same moment.
- */
+* Put the pair on disk on the HTTPS listener. Called after every action, so
+* "the certificate changed" and "clients see it" are the same moment.
+*/
 export declare function applyCertificateToListener(dataDir: string): HttpsReloadOutcome;

package/dist/tls/tls-status.d.ts

@@ -1,13 +1,13 @@
-export type TlsMode = 'generated' | 'uploaded' | 'disabled';
+export type TlsMode = "generated" | "uploaded" | "disabled";
 export interface TlsAccessStatus {
-    readonly mode: TlsMode;
-    readonly leafFingerprintSha256: string | null;
-    readonly caFingerprintSha256: string | null;
-    readonly validTo: string | null;
-    readonly sans: readonly string[];
-    readonly caCertPem: string | null;
-    readonly reissueError: string | null;
-    readonly restartRequired: boolean;
+	readonly mode: TlsMode;
+	readonly leafFingerprintSha256: string | null;
+	readonly caFingerprintSha256: string | null;
+	readonly validTo: string | null;
+	readonly sans: readonly string[];
+	readonly caCertPem: string | null;
+	readonly reissueError: string | null;
+	readonly restartRequired: boolean;
 }
 export declare function readTlsMode(dataDir: string): TlsMode;
 export declare function writeTlsMode(dataDir: string, mode: TlsMode): void;
@@ -18,10 +18,10 @@ export declare const UPLOADED_CA_FILE = "uploaded-ca.crt";
 /** Every certificate in a PEM bundle, in order. */
 export declare function splitPemCertificates(pem: string): readonly string[];
 /**
- * What the node's certificate is, and whether the listener serves it.
- * `servedLeafFingerprint` is the leaf the HTTPS listener presents right now
- * (`servedHttpsLeafFingerprint()`), or `null` when unknown; a restart is
- * required exactly when the listener serves a different leaf than the one
- * on disk — a measured fact, not a flag a mutation remembered to set.
- */
+* What the node's certificate is, and whether the listener serves it.
+* `servedLeafFingerprint` is the leaf the HTTPS listener presents right now
+* (`servedHttpsLeafFingerprint()`), or `null` when unknown; a restart is
+* required exactly when the listener serves a different leaf than the one
+* on disk — a measured fact, not a flag a mutation remembered to set.
+*/
 export declare function readTlsAccessStatus(dataDir: string, servedLeafFingerprint: string | null): TlsAccessStatus;

package/dist/tls/uploaded-cert.d.ts

@@ -1,14 +1,14 @@
 export type UploadedTlsValidation = {
-    readonly ok: true;
-    readonly fingerprintSha256: string;
-    readonly validTo: string;
+	readonly ok: true;
+	readonly fingerprintSha256: string;
+	readonly validTo: string;
 } | {
-    readonly ok: false;
-    readonly error: string;
+	readonly ok: false;
+	readonly error: string;
 };
 /**
- * Operator-supplied material must parse, match its key, and carry
- * `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
- * to keep generating.
- */
+* Operator-supplied material must parse, match its key, and carry
+* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
+* to keep generating.
+*/
 export declare function validateUploadedTls(certPem: string, keyPem: string): UploadedTlsValidation;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.390",
+  "version": "1.2.392",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -475,7 +475,7 @@
   ],
   "scripts": {
     "copy:hook": "node -e \"const fs=require('fs'),p=require('path');const dst=p.join('dist');fs.mkdirSync(dst,{recursive:true});fs.copyFileSync(p.join('src','kernel','moleculer','framework-resolver-hook.mjs'),p.join(dst,'framework-resolver-hook.mjs'));console.log('copied framework-resolver-hook.mjs ->',dst)\"",
-    "build": "vite build && npm run copy:hook",
+    "build": "vite build && npx tsx ../../scripts/emit-isolated-dts.ts --root . --src src --out dist && npm run copy:hook",
     "dev": "tsup --watch",
     "typecheck": "tsc --noEmit -p tsconfig.spec.json",
     "test": "vitest run",
@@ -519,7 +519,13 @@
     "tsup": "^8.0.0",
     "typescript": "~6.0.3",
     "vite": "^8.0.11",
-    "vite-plugin-dts": "^5.0.0",
     "vitest": "^3.0.0"
+  },
+  "nx": {
+    "targets": {
+      "build": {
+        "parallelism": false
+      }
+    }
   }
 }