@camstack/system 1.2.438 → 1.2.439

package/dist/tls/uploaded-cert.d.ts

@@ -1,14 +1,46 @@
+import { X509Certificate } from "node:crypto";
+/** Stable codes of the `server` i18n catalog (D863); the English text always travels beside them. */
+export type UploadedTlsErrorCode = "tls.cert-unparsable" | "tls.key-unparsable" | "tls.key-mismatch" | "tls.missing-server-auth" | "tls.ca-required" | "tls.ca-unparsable" | "tls.ca-not-issuer" | "tls.ca-not-a-ca" | "tls.ca-expired";
+export interface UploadedTlsFailure {
+	readonly ok: false;
+	readonly code: UploadedTlsErrorCode;
+	/** English text; the hub translates by `code`. */
+	readonly error: string;
+}
 export type UploadedTlsValidation = {
 	readonly ok: true;
 	readonly fingerprintSha256: string;
 	readonly validTo: string;
-} | {
-	readonly ok: false;
-	readonly error: string;
-};
+} | UploadedTlsFailure;
 /**
 * Operator-supplied material must parse, match its key, and carry
 * `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
 * to keep generating.
 */
 export declare function validateUploadedTls(certPem: string, keyPem: string): UploadedTlsValidation;
+/** Every certificate in a PEM bundle, in order. */
+export declare function pemCertificates(pem: string): readonly string[];
+/** The trust anchors of public CAs that ship with Node. */
+export declare function publicRootCertificates(): readonly X509Certificate[];
+/**
+* True when the served chain leads to a public CA that clients already trust:
+* the leaf, or one of the chain's own certificates, is signed by a public root.
+* Such a certificate needs nothing installed on a device, so no CA is required.
+*/
+export declare function chainsToPublicRoot(chainPem: string, roots?: readonly X509Certificate[]): boolean;
+export type UploadedCaCheck = {
+	readonly ok: true;
+	/** The CA that signed the leaf, to be kept for "Download CA"; `null` for a public chain with none supplied. */
+	readonly issuerPem: string | null;
+	readonly publicChain: boolean;
+} | UploadedTlsFailure;
+/**
+* The CA rule for an upload (D873). A CA the operator supplies must parse, be a CA, be in
+* date and actually have signed the leaf. Without one, the upload is accepted only when
+* its own chain carries the issuer or leads to a public root; anything else is refused,
+* because a device cannot be told to trust a certificate nobody can hand it the CA of.
+*/
+export declare function checkUploadedCa(chainPem: string, caPem: string | undefined, options?: {
+	readonly now?: Date;
+	readonly publicRoots?: readonly X509Certificate[];
+}): UploadedCaCheck;

package/dist/{x509.es-r7Ht1thA.js → x509.es-C4cOo48M.js}

@@ -11913,6 +11913,12 @@ AsnEcSignatureFormatter.namedCurveSize.set("K-256", 32);
 AsnEcSignatureFormatter.namedCurveSize.set("P-384", 48);
 AsnEcSignatureFormatter.namedCurveSize.set("P-521", 66);
 //#endregion
+Object.defineProperty(exports, "AsnConvert", {
+	enumerable: true,
+	get: function() {
+		return AsnConvert;
+	}
+});
 Object.defineProperty(exports, "AuthorityKeyIdentifierExtension", {
 	enumerable: true,
 	get: function() {
@@ -11931,6 +11937,30 @@ Object.defineProperty(exports, "ExtendedKeyUsageExtension", {
 		return ExtendedKeyUsageExtension;
 	}
 });
+Object.defineProperty(exports, "Extension", {
+	enumerable: true,
+	get: function() {
+		return Extension;
+	}
+});
+Object.defineProperty(exports, "GeneralName", {
+	enumerable: true,
+	get: function() {
+		return GeneralName$1;
+	}
+});
+Object.defineProperty(exports, "GeneralSubtree", {
+	enumerable: true,
+	get: function() {
+		return GeneralSubtree;
+	}
+});
+Object.defineProperty(exports, "GeneralSubtrees", {
+	enumerable: true,
+	get: function() {
+		return GeneralSubtrees;
+	}
+});
 Object.defineProperty(exports, "KeyUsageFlags", {
 	enumerable: true,
 	get: function() {
@@ -11943,6 +11973,12 @@ Object.defineProperty(exports, "KeyUsagesExtension", {
 		return KeyUsagesExtension;
 	}
 });
+Object.defineProperty(exports, "NameConstraints", {
+	enumerable: true,
+	get: function() {
+		return NameConstraints;
+	}
+});
 Object.defineProperty(exports, "PemConverter", {
 	enumerable: true,
 	get: function() {

package/dist/{x509.es-CDvj67p1.mjs → x509.es-DK__ETIe.mjs}

@@ -11913,4 +11913,4 @@ AsnEcSignatureFormatter.namedCurveSize.set("K-256", 32);
 AsnEcSignatureFormatter.namedCurveSize.set("P-384", 48);
 AsnEcSignatureFormatter.namedCurveSize.set("P-521", 66);
 //#endregion
-export { KeyUsagesExtension as a, Pkcs10CertificateRequestGenerator as c, X509Certificate as d, X509CertificateGenerator as f, backdatedNotBefore as g, tslib_es6_exports as h, KeyUsageFlags as i, SubjectAlternativeNameExtension as l, init_tslib_es6 as m, BasicConstraintsExtension as n, PemConverter as o, cryptoProvider as p, ExtendedKeyUsageExtension as r, Pkcs10CertificateRequest as s, AuthorityKeyIdentifierExtension as t, SubjectKeyIdentifierExtension as u };
+export { backdatedNotBefore as S, NameConstraints as _, KeyUsageFlags as a, tslib_es6_exports as b, Pkcs10CertificateRequest as c, SubjectKeyIdentifierExtension as d, X509Certificate as f, GeneralSubtrees as g, GeneralSubtree as h, Extension as i, Pkcs10CertificateRequestGenerator as l, cryptoProvider as m, BasicConstraintsExtension as n, KeyUsagesExtension as o, X509CertificateGenerator as p, ExtendedKeyUsageExtension as r, PemConverter as s, AuthorityKeyIdentifierExtension as t, SubjectAlternativeNameExtension as u, GeneralName$1 as v, AsnConvert as x, init_tslib_es6 as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.438",
+  "version": "1.2.439",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -491,6 +491,8 @@
     "@camstack/types": "*",
     "@homebridge/ciao": "^1.3.9",
     "@msgpack/msgpack": "^3.1.3",
+    "@peculiar/asn1-schema": "^2.6.0",
+    "@peculiar/asn1-x509": "^2.6.1",
     "@peculiar/x509": "^1.14.3",
     "@trpc/client": "^11.16.0",
     "@trpc/server": "^11.16.0",