@camstack/system 1.2.437 → 1.2.439

package/dist/kernel/gc-census.d.ts

@@ -59,6 +59,14 @@ export interface GcCensusWindow {
 	readonly pauseMs: number;
 	/** How long the window was, so a rate can be computed from the line. */
 	readonly windowMs: number;
+	/**
+	* Cycles in the window by V8 trigger flag NAME (`ALL_EXTERNAL_MEMORY`,
+	* `FORCED`, ...). A cycle can carry several flags and counts under each. This
+	* is what separates "driven by external-memory pressure" from "the heap is
+	* filling" ON THE LINE, instead of by inference from the rate (D867).
+	* Absent = the runtime reported no flag names.
+	*/
+	readonly flags?: Readonly<Record<string, number>>;
 }
 /**
 * A census that accumulates until it is read, then starts a new window.
@@ -76,6 +84,13 @@ export interface GcCensus {
 export interface GcObservation {
 	readonly kind: number;
 	readonly durationMs: number;
+	/** `detail.flags` bitmask; absent when the entry carried none. */
+	readonly flags?: number;
+}
+/** One V8 GC flag: its Node constant name (without the prefix) and its bit. */
+export interface GcFlagBit {
+	readonly name: string;
+	readonly bit: number;
 }
 /**
 * How the census is fed. Injectable so a spec can pose a sequence of
@@ -115,11 +130,13 @@ export declare const GC_CENSUS_MIN_WINDOW_MS = 1e3;
 * observed and a process that is not collecting look identical on the line, and
 * they are the two answers furthest apart.
 */
-export declare function createGcCensus(install: GcObserverInstall, kinds: GcKinds, startedAt: number): GcCensus | undefined;
+export declare function createGcCensus(install: GcObserverInstall, kinds: GcKinds, startedAt: number, flagBits?: readonly GcFlagBit[]): GcCensus | undefined;
 /** The real Node observer and the real kind constants, wrapped so they can be replaced in a spec. */
 export interface NodeGcObserver {
 	readonly install: GcObserverInstall;
 	readonly kinds: GcKinds;
+	/** Names of the flag bits `detail.flags` can carry. Empty = unreadable. */
+	readonly flagBits?: readonly GcFlagBit[];
 }
 /**
 * The observer this process actually gets.

package/dist/kernel/settings-view-types.d.ts

@@ -16,6 +16,8 @@ export interface AddonSettingsView {
 	*  here for the same reason: only the door-backed view can answer it in one
 	*  range scan, and a caller must fall back rather than refuse. */
 	readDeviceStoreBatch?(deviceIds: readonly number[]): Promise<ReadonlyMap<number, Record<string, unknown>>>;
+	/** See `IAddonContext['settings'].listDeviceStoreIds` — door-backed views only. */
+	listDeviceStoreIds?(): Promise<readonly number[]>;
 	writeDeviceStore(deviceId: number, patch: Record<string, unknown>): Promise<void>;
 	clearDeviceStore(deviceId: number): Promise<void>;
 	getSection(section: string): Promise<Record<string, unknown>>;

package/dist/kernel/transport/local-transport.d.ts

@@ -1,3 +1,4 @@
+import type { ErrorI18nPayload } from "@camstack/types";
 import type { CapActionChannelObserver } from "./cap-action-census.js";
 import type { SocketTrafficSample } from "./socket-traffic.js";
 /**
@@ -25,6 +26,8 @@ export type Frame = {
 	readonly id: number;
 	readonly ok: false;
 	readonly err: string;
+	/** Stable error code + params (D863), when the thrown error carried one. */
+	readonly i18n?: ErrorI18nPayload;
 } | {
 	readonly k: "evt";
 	readonly body: unknown;

package/dist/kernel/transport/peer-answered-error.d.ts

@@ -1,3 +1,4 @@
+import type { ErrorI18nPayload, TranslationParams } from "@camstack/types";
 /**
 * An error the FAR END of a channel answered with.
 *
@@ -13,5 +14,8 @@
 * node had answered (2026-09-25, device 3836).
 */
 export declare class PeerAnsweredError extends Error {
-	constructor(message: string);
+	/** The far end's stable error code (D863), carried so the hub can translate it. */
+	readonly i18nCode: string | undefined;
+	readonly i18nParams: TranslationParams | undefined;
+	constructor(message: string, i18n?: ErrorI18nPayload);
 }

package/dist/{lib-NNxHSOIE.js → lib-8oZrELLm.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_x509_es = require("./x509.es-r7Ht1thA.js");
+const require_x509_es = require("./x509.es-C4cOo48M.js");
 const require_src$1 = require("./src-CnAqG6EF.js");
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) => {

package/dist/{lib-BeGzVQcd.mjs → lib-DK38ompL.mjs}

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, r as __exportAll, t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
-import { h as tslib_es6_exports, m as init_tslib_es6 } from "./x509.es-CDvj67p1.mjs";
+import { b as tslib_es6_exports, y as init_tslib_es6 } from "./x509.es-DK__ETIe.mjs";
 import { t as require_src } from "./src-hG4grMU4.mjs";
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/{restore-archive-DNxAStrJ.mjs → restore-archive-CpdUO-uS.mjs}

@@ -1,4 +1,4 @@
-import { v as DATABASE_SNAPSHOT_SUFFIX } from "./dist-m5JkT8UN.mjs";
+import { b as DATABASE_SNAPSHOT_SUFFIX } from "./dist-yI6kF6r6.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{restore-archive-C75srVbG.js → restore-archive-DiGiI6Jp.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CEAyXW3Q.js");
+const require_dist = require("./dist-BOWdLjoK.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{retired-settings-keys-DNfV28R_.js → retired-settings-keys-CyQ7uvta.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CEAyXW3Q.js");
+const require_dist = require("./dist-BOWdLjoK.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-C5qP9QIf.mjs → retired-settings-keys-UsVtLOT0.mjs}

@@ -1,4 +1,4 @@
-import { Nr as asJsonObject } from "./dist-m5JkT8UN.mjs";
+import { Rr as asJsonObject } from "./dist-yI6kF6r6.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/tls/agent-https.d.ts

@@ -1,5 +1,6 @@
 import type { HttpsLeafInfo } from "@camstack/types";
 import { type CertIdentity, type HostFacts } from "./cert-identity.js";
+import { isLocalOnlyHostname } from "./cert-name-constraints.js";
 export interface AgentHttpsPaths {
 	readonly dir: string;
 	/** The one atomic file: key + leaf + pinned CA. */
@@ -63,8 +64,7 @@ export declare function describeHttpsLeaf(certPem: string): HttpsLeafInfo;
 export declare function isPrivateAddress(address: string): boolean;
 /** The default docker bridge network (172.17.0.0/16): identical on every host, so it names nothing. */
 export declare function isContainerBridgeAddress(address: string): boolean;
-/** A name that cannot collide with public DNS. */
-export declare function isLocalOnlyHostname(name: string): boolean;
+export { isLocalOnlyHostname };
 export interface AcceptedSans {
 	readonly identity: CertIdentity;
 	readonly accepted: readonly string[];

package/dist/tls/boot-tls.d.ts

@@ -17,6 +17,12 @@ export interface BootTls {
 	* a certificate source that changed under the operator is never silent.
 	*/
 	readonly uploadedMissing: boolean;
+	/**
+	* True when an UNCONSTRAINED local CA kept beside an uploaded certificate was replaced
+	* by a constrained one (D873). The served pair is untouched; agents' leaves chain to
+	* the new CA and clients that trusted the old one must re-trust. The caller logs it.
+	*/
+	readonly dormantCaReplaced: boolean;
 }
 /**
 * Decide what the listener serves at boot. The admin UI (Network → Local

package/dist/tls/cert-evaluation.d.ts

@@ -20,7 +20,7 @@ export declare const CA_RENEWAL_WINDOW_DAYS: number;
 * verbatim — an operator who trusted the old certificate by hand learns
 * from this string, not from a browser error.
 */
-export type CertRegenerationReason = "missing" | "unreadable" | "no-local-ca" | "ca-expiring" | "key-mismatch" | "expiring" | "missing-server-auth-eku" | "not-issued-by-local-ca" | "validity-too-long" | "san-coverage-gap";
+export type CertRegenerationReason = "missing" | "unreadable" | "no-local-ca" | "ca-expiring" | "ca-unconstrained" | "key-mismatch" | "expiring" | "missing-server-auth-eku" | "not-issued-by-local-ca" | "validity-too-long" | "san-coverage-gap";
 export interface CertEvaluationInput {
 	/** Contents of `camstack.crt` — leaf first, then the issuing CA. */
 	readonly chainPem: string;

package/dist/tls/cert-issue.d.ts

@@ -19,8 +19,12 @@ export interface CaSigner {
 * A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
 * else, and **no EKU** — Apple rejects an anchor asserting
 * `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
+*
+* It carries a CRITICAL `nameConstraints` extension (D873): private address
+* ranges and local-only DNS names, plus `hostnames` (the hub's own single-label
+* names at creation). A leaked key therefore cannot vouch for a public site.
 */
-export declare function generateCa(now: Date): Promise<CaSigner>;
+export declare function generateCa(now: Date, hostnames?: readonly string[]): Promise<CaSigner>;
 /** Re-open a root already on disk so a leaf can be issued under it. */
 export declare function loadCa(certPem: string, keyPem: string): Promise<CaSigner>;
 /**

package/dist/tls/cert-manager.d.ts

@@ -27,6 +27,11 @@ export interface EnsureTlsResult {
 	readonly validTo: string;
 	readonly sans: readonly string[];
 	/**
+	* SAN values the local CA's name constraints (D873) do not permit, left out of the
+	* leaf. Empty when everything the machine answers to is certifiable.
+	*/
+	readonly droppedNames: readonly string[];
+	/**
 	* Set when a reissue was needed and FAILED, and the previous material is
 	* still being served. Never null-and-degraded silently: this is the line
 	* that says the certificate is not what the rule wants it to be.
@@ -91,6 +96,19 @@ export declare function ensureTlsCert(dataDir: string, options?: CertOptions): P
 */
 export declare function reissueTlsLeaf(dataDir: string, options?: CertOptions): Promise<EnsureTlsResult>;
 /**
+* Uploaded mode keeps a generated CA beside the upload (agents' leaves are still signed
+* by it). When that CA is unconstrained, replace it alone (D873): the served pair is the
+* operator's and is never touched. Returns whether the CA was replaced.
+*/
+export declare function replaceUnconstrainedLocalCa(dataDir: string, options?: CertOptions): Promise<boolean>;
+/** Marker path for the status reader and the retire step. */
+export declare function caReplacementMarkerFile(dataDir: string): string;
+/**
+* Called once the HTTPS listener serves the leaf of the replacement CA: drop the retired
+* unconstrained CA, key first. Idempotent; returns whether anything was removed.
+*/
+export declare function retirePreviousLocalCa(dataDir: string): boolean;
+/**
 * Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
 * options. `certPath` is a full chain, so the listener presents the local
 * root alongside the leaf.

package/dist/tls/cert-name-constraints.d.ts

@@ -0,0 +1,53 @@
+import { Extension, type X509Certificate as PeculiarCertificate } from "@peculiar/x509";
+import type { CertIdentity } from "./cert-identity.js";
+/** `id-ce-nameConstraints`. */
+export declare const NAME_CONSTRAINTS_OID = "2.5.29.30";
+/** The address space the generated CA may certify. 100.64.0.0/10 is CGNAT, which Tailscale hands out. Loopback is for the hub's own `127.0.0.1` / `::1` SANs. */
+export declare const PERMITTED_IP_RANGES: readonly string[];
+/**
+* Local-only DNS suffixes: none of them is delegated in public DNS. A leading
+* dot permits every name under the suffix and not the suffix itself.
+*/
+export declare const PERMITTED_DNS_SUFFIXES: readonly string[];
+/** A name that cannot collide with public DNS: a single label, or under a local-only suffix. */
+export declare function isLocalOnlyHostname(name: string): boolean;
+/** What a CA may certify, as read from (or written into) its extension. */
+export interface NameConstraintSet {
+	/** `ip/prefix` strings. */
+	readonly ipRanges: readonly string[];
+	/** Lower-cased DNS constraints: `.suffix` for a subtree, a bare name for the name and its subdomains. */
+	readonly dnsNames: readonly string[];
+	readonly critical: boolean;
+}
+/**
+* The constraint set for a new CA. `hostnames` are the hub's own local-only
+* names at creation time (a single-label OS hostname has no suffix to hide
+* under), added as exact entries; anything that could collide with public DNS
+* is dropped here, never constrained in.
+*/
+export declare function buildNameConstraintSet(hostnames: readonly string[]): NameConstraintSet;
+/** The `nameConstraints` extension for a CA: permitted subtrees only, marked critical. */
+export declare function createNameConstraintsExtension(set: NameConstraintSet): Extension;
+/** The CA's constraint set, or `null` when the certificate carries no `nameConstraints`. */
+export declare function readNameConstraints(cert: PeculiarCertificate): NameConstraintSet | null;
+/**
+* True when a CA is safe to keep as the hub's anchor: constrained to a
+* non-empty permitted set AND marked critical. A non-critical constraint is
+* ignored by clients that do not know the extension, which is the same as none.
+*/
+export declare function isConstrainedCa(cert: PeculiarCertificate): boolean;
+/** Is this SAN value (an IP literal or a DNS name) inside the permitted set? */
+export declare function permitsName(set: NameConstraintSet, value: string): boolean;
+export interface ConstrainedIdentity {
+	readonly identity: CertIdentity;
+	/** SAN values the CA's constraints do not permit, dropped from the leaf. */
+	readonly dropped: readonly string[];
+}
+/**
+* The part of an identity the CA is allowed to certify. A leaf naming
+* anything outside the constraints makes the WHOLE chain fail validation in
+* OpenSSL, so such names are dropped (and reported), never signed. The
+* required lists shrink the same way: otherwise a name the CA cannot certify
+* would count as a permanent SAN gap and reissue the leaf on every boot.
+*/
+export declare function permitsIdentity(set: NameConstraintSet, identity: CertIdentity): ConstrainedIdentity;

package/dist/tls/index.d.ts

@@ -1,11 +1,12 @@
 export { CA_VALIDITY_DAYS, type CertEvaluationInput, LEAF_RENEWAL_WINDOW_DAYS, SERVER_AUTH_OID } from "./cert-evaluation.js";
-export { type CertIdentity, type CertOptions, type HostFacts, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair } from "./cert-manager.js";
+export { type CertIdentity, type CertOptions, type HostFacts, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, replaceUnconstrainedLocalCa, retirePreviousLocalCa, caReplacementMarkerFile, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair } from "./cert-manager.js";
 export { type BootTls, type BootTlsMode, prepareBootTls } from "./boot-tls.js";
 export { clearHttpsListener, type HttpsReloadOutcome, leafFingerprintOf, registerHttpsListener, reloadHttpsListener, servedHttpsLeafFingerprint } from "./https-listener.js";
-export { applyCertificateToListener, regenerateCertificate, revertToGeneratedCertificate, storeUploadedCertificate, type UploadCertificateInput } from "./tls-actions.js";
+export { applyCertificateToListener, regenerateCertificate, revertToGeneratedCertificate, storeUploadedCertificate, type UploadCertificateInput, useStoredUploadedCertificate } from "./tls-actions.js";
 export { CA_COMMON_NAME } from "./cert-issue.js";
-export { validateUploadedTls, type UploadedTlsValidation } from "./uploaded-cert.js";
-export { type TlsAccessStatus, readTlsAccessStatus, splitPemCertificates, UPLOADED_CA_FILE, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans } from "./tls-status.js";
+export { checkUploadedCa, chainsToPublicRoot, validateUploadedTls, type UploadedCaCheck, type UploadedTlsErrorCode, type UploadedTlsValidation } from "./uploaded-cert.js";
+export { buildNameConstraintSet, isConstrainedCa, type NameConstraintSet, permitsIdentity, permitsName, readNameConstraints, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES } from "./cert-name-constraints.js";
+export { type StoredUploadInfo, type TlsAccessStatus, readTlsAccessStatus, splitPemCertificates, UPLOADED_CA_FILE, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans } from "./tls-status.js";
 export { acceptAgentSans, type AcceptedSans, AgentHttpsInstallError, type AgentHttpsMaterial, type AgentHttpsPaths, type AgentHttpsRequest, type AgentNames, agentHttpsPaths, certificateNames, collectAgentNames, createAgentHttpsRequest, describeHttpsLeaf, installAgentHttps, isContainerBridgeAddress, isLocalOnlyHostname, isPrivateAddress, issueAgentHttpsLeaf, type IssuedAgentHttps, loadAgentHttps, pemDigest, pinnedHttpsCaFingerprint } from "./agent-https.js";
 export { AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AgentHttpsNames, getProcessAgentHttpsNames, setProcessAgentHttpsNames } from "./agent-https-names.js";
 export { systemHostFacts } from "./cert-identity.js";

package/dist/tls/tls-actions.d.ts

@@ -1,3 +1,4 @@
+import type { X509Certificate } from "node:crypto";
 import { type CertOptions } from "./cert-manager.js";
 import { type HttpsReloadOutcome } from "./https-listener.js";
 /**
@@ -10,17 +11,36 @@ export interface UploadCertificateInput {
 	readonly keyPem: string;
 	readonly caPem?: string | undefined;
 }
+/** Test seam: the trust anchors that count as "public". Defaults to the ones Node ships. */
+export interface UploadCertificateOptions {
+	readonly publicRoots?: readonly X509Certificate[];
+	readonly now?: Date;
+}
+/**
+* Store an operator's certificate (D873). The material is validated first, and a
+* certificate that does not lead to a public CA must come with the CA that signed it
+* (validated: it is a CA, in date, and issued the leaf) - otherwise "Download CA" would
+* have nothing to hand out. Nothing is written when anything is refused.
+*
+* The leaf (or chain) and key are written twice: as the served pair, and as a kept copy
+* (`uploaded.crt` / `uploaded.key`, with the issuing CA in `uploaded-ca.crt`) that
+* "Revert to generated" leaves in place so the upload can be selected again. The local
+* CA (`camstack-ca.crt` + key) is never touched - it did not sign the upload, and it is
+* what every device that trusts it still needs.
+*/
+export declare function storeUploadedCertificate(dataDir: string, input: UploadCertificateInput, options?: UploadCertificateOptions): Promise<void>;
 /**
-* Store an operator's certificate. The leaf (or chain) and key replace the
-* served pair; a CA, when given, goes to its own file. The local CA
-* (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
-* and it is what "Revert to generated" and every device that trusts it
-* still need.
+* Serve the kept upload again after a revert (D873). Refused with a clear error when none
+* is kept; the generated material stays on disk and is untouched.
 */
-export declare function storeUploadedCertificate(dataDir: string, input: UploadCertificateInput): Promise<void>;
+export declare function useStoredUploadedCertificate(dataDir: string): Promise<void>;
 /** Issue a new generated leaf under the local CA. Refused while an upload is served. */
 export declare function regenerateCertificate(dataDir: string, options: CertOptions): Promise<void>;
-/** Drop the upload and serve the generated local-CA leaf again (D227). */
+/**
+* Serve the generated local-CA leaf again (D227). The uploaded certificate and its CA stay
+* on disk (D873) so it can be selected again; an upload made before they were kept is
+* copied aside first, from the pair being served.
+*/
 export declare function revertToGeneratedCertificate(dataDir: string, options: CertOptions): Promise<void>;
 /**
 * Put the pair on disk on the HTTPS listener. Called after every action, so

package/dist/tls/tls-status.d.ts

@@ -1,4 +1,11 @@
 export type TlsMode = "generated" | "uploaded" | "disabled";
+/** An uploaded certificate kept on disk (D873): selectable again after "Revert to generated". */
+export interface StoredUploadInfo {
+	readonly leafFingerprintSha256: string;
+	readonly validTo: string;
+	/** Whether a CA that signed it is kept with it. */
+	readonly hasCa: boolean;
+}
 export interface TlsAccessStatus {
 	readonly mode: TlsMode;
 	readonly leafFingerprintSha256: string | null;
@@ -8,11 +15,26 @@ export interface TlsAccessStatus {
 	readonly caCertPem: string | null;
 	readonly reissueError: string | null;
 	readonly restartRequired: boolean;
+	/**
+	* An uploaded certificate is served but no CA that signed it is kept and the chain does
+	* not lead to a public CA: "Download CA" has nothing to hand out, so devices cannot be
+	* made to trust the hub (D873). `false` otherwise.
+	*/
+	readonly caMissing: boolean;
+	/** Does the hub's own generated CA carry a critical name constraint? `null` while it has no CA. */
+	readonly localCaConstrained: boolean | null;
+	/** ISO time the generated CA was replaced by a constrained one; devices must re-trust it. */
+	readonly caReplacedAt: string | null;
+	/** The uploaded certificate kept on disk, whether or not it is the one served. */
+	readonly storedUpload: StoredUploadInfo | null;
 }
 export declare function readTlsMode(dataDir: string): TlsMode;
 export declare function writeTlsMode(dataDir: string, mode: TlsMode): void;
 export declare function readExtraSans(dataDir: string): readonly string[];
 export declare function writeExtraSans(dataDir: string, sans: readonly string[]): void;
+/** The kept copy of the last upload: the chain and key as the operator supplied them. */
+export declare const STORED_UPLOAD_CERT_FILE = "uploaded.crt";
+export declare const STORED_UPLOAD_KEY_FILE = "uploaded.key";
 /** Where an upload's own CA is kept — never over the local CA's `camstack-ca.crt`. */
 export declare const UPLOADED_CA_FILE = "uploaded-ca.crt";
 /** Every certificate in a PEM bundle, in order. */

package/dist/tls/uploaded-cert.d.ts

@@ -1,14 +1,46 @@
+import { X509Certificate } from "node:crypto";
+/** Stable codes of the `server` i18n catalog (D863); the English text always travels beside them. */
+export type UploadedTlsErrorCode = "tls.cert-unparsable" | "tls.key-unparsable" | "tls.key-mismatch" | "tls.missing-server-auth" | "tls.ca-required" | "tls.ca-unparsable" | "tls.ca-not-issuer" | "tls.ca-not-a-ca" | "tls.ca-expired";
+export interface UploadedTlsFailure {
+	readonly ok: false;
+	readonly code: UploadedTlsErrorCode;
+	/** English text; the hub translates by `code`. */
+	readonly error: string;
+}
 export type UploadedTlsValidation = {
 	readonly ok: true;
 	readonly fingerprintSha256: string;
 	readonly validTo: string;
-} | {
-	readonly ok: false;
-	readonly error: string;
-};
+} | UploadedTlsFailure;
 /**
 * Operator-supplied material must parse, match its key, and carry
 * `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
 * to keep generating.
 */
 export declare function validateUploadedTls(certPem: string, keyPem: string): UploadedTlsValidation;
+/** Every certificate in a PEM bundle, in order. */
+export declare function pemCertificates(pem: string): readonly string[];
+/** The trust anchors of public CAs that ship with Node. */
+export declare function publicRootCertificates(): readonly X509Certificate[];
+/**
+* True when the served chain leads to a public CA that clients already trust:
+* the leaf, or one of the chain's own certificates, is signed by a public root.
+* Such a certificate needs nothing installed on a device, so no CA is required.
+*/
+export declare function chainsToPublicRoot(chainPem: string, roots?: readonly X509Certificate[]): boolean;
+export type UploadedCaCheck = {
+	readonly ok: true;
+	/** The CA that signed the leaf, to be kept for "Download CA"; `null` for a public chain with none supplied. */
+	readonly issuerPem: string | null;
+	readonly publicChain: boolean;
+} | UploadedTlsFailure;
+/**
+* The CA rule for an upload (D873). A CA the operator supplies must parse, be a CA, be in
+* date and actually have signed the leaf. Without one, the upload is accepted only when
+* its own chain carries the issuer or leads to a public root; anything else is refused,
+* because a device cannot be told to trust a certificate nobody can hand it the CA of.
+*/
+export declare function checkUploadedCa(chainPem: string, caPem: string | undefined, options?: {
+	readonly now?: Date;
+	readonly publicRoots?: readonly X509Certificate[];
+}): UploadedCaCheck;

package/dist/{x509.es-r7Ht1thA.js → x509.es-C4cOo48M.js}

@@ -11913,6 +11913,12 @@ AsnEcSignatureFormatter.namedCurveSize.set("K-256", 32);
 AsnEcSignatureFormatter.namedCurveSize.set("P-384", 48);
 AsnEcSignatureFormatter.namedCurveSize.set("P-521", 66);
 //#endregion
+Object.defineProperty(exports, "AsnConvert", {
+	enumerable: true,
+	get: function() {
+		return AsnConvert;
+	}
+});
 Object.defineProperty(exports, "AuthorityKeyIdentifierExtension", {
 	enumerable: true,
 	get: function() {
@@ -11931,6 +11937,30 @@ Object.defineProperty(exports, "ExtendedKeyUsageExtension", {
 		return ExtendedKeyUsageExtension;
 	}
 });
+Object.defineProperty(exports, "Extension", {
+	enumerable: true,
+	get: function() {
+		return Extension;
+	}
+});
+Object.defineProperty(exports, "GeneralName", {
+	enumerable: true,
+	get: function() {
+		return GeneralName$1;
+	}
+});
+Object.defineProperty(exports, "GeneralSubtree", {
+	enumerable: true,
+	get: function() {
+		return GeneralSubtree;
+	}
+});
+Object.defineProperty(exports, "GeneralSubtrees", {
+	enumerable: true,
+	get: function() {
+		return GeneralSubtrees;
+	}
+});
 Object.defineProperty(exports, "KeyUsageFlags", {
 	enumerable: true,
 	get: function() {
@@ -11943,6 +11973,12 @@ Object.defineProperty(exports, "KeyUsagesExtension", {
 		return KeyUsagesExtension;
 	}
 });
+Object.defineProperty(exports, "NameConstraints", {
+	enumerable: true,
+	get: function() {
+		return NameConstraints;
+	}
+});
 Object.defineProperty(exports, "PemConverter", {
 	enumerable: true,
 	get: function() {

package/dist/{x509.es-CDvj67p1.mjs → x509.es-DK__ETIe.mjs}

@@ -11913,4 +11913,4 @@ AsnEcSignatureFormatter.namedCurveSize.set("K-256", 32);
 AsnEcSignatureFormatter.namedCurveSize.set("P-384", 48);
 AsnEcSignatureFormatter.namedCurveSize.set("P-521", 66);
 //#endregion
-export { KeyUsagesExtension as a, Pkcs10CertificateRequestGenerator as c, X509Certificate as d, X509CertificateGenerator as f, backdatedNotBefore as g, tslib_es6_exports as h, KeyUsageFlags as i, SubjectAlternativeNameExtension as l, init_tslib_es6 as m, BasicConstraintsExtension as n, PemConverter as o, cryptoProvider as p, ExtendedKeyUsageExtension as r, Pkcs10CertificateRequest as s, AuthorityKeyIdentifierExtension as t, SubjectKeyIdentifierExtension as u };
+export { backdatedNotBefore as S, NameConstraints as _, KeyUsageFlags as a, tslib_es6_exports as b, Pkcs10CertificateRequest as c, SubjectKeyIdentifierExtension as d, X509Certificate as f, GeneralSubtrees as g, GeneralSubtree as h, Extension as i, Pkcs10CertificateRequestGenerator as l, cryptoProvider as m, BasicConstraintsExtension as n, KeyUsagesExtension as o, X509CertificateGenerator as p, ExtendedKeyUsageExtension as r, PemConverter as s, AuthorityKeyIdentifierExtension as t, SubjectAlternativeNameExtension as u, GeneralName$1 as v, AsnConvert as x, init_tslib_es6 as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.437",
+  "version": "1.2.439",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -491,6 +491,8 @@
     "@camstack/types": "*",
     "@homebridge/ciao": "^1.3.9",
     "@msgpack/msgpack": "^3.1.3",
+    "@peculiar/asn1-schema": "^2.6.0",
+    "@peculiar/asn1-x509": "^2.6.1",
     "@peculiar/x509": "^1.14.3",
     "@trpc/client": "^11.16.0",
     "@trpc/server": "^11.16.0",