@salesforce/b2c-cli 2.1.0 → 2.2.1

package/dist/commands/ecdn/mtls/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../../src/commands/ecdn/mtls/setup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAC,KAAK,EAAE,EAAE,EAAC,MAAM,aAAa,CAAC;AACtC,OAAO,EAAC,OAAO,EAAE,KAAK,EAAC,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,oBAAoB,EAAC,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAC,WAAW,EAAC,MAAM,8BAA8B,CAAC;AACzD,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,sCAAsC,EACtC,0BAA0B,GAE3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAC,CAAC,EAAE,QAAQ,EAAC,MAAM,wBAAwB,CAAC;AAcnD;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAiC;IAC1E,MAAM,CAAC,WAAW,GAAG,QAAQ,CAC3B,CAAC,CACC,sCAAsC,EACtC,gLAAgL,CACjL,EACD,oCAAoC,CACrC,CAAC;IAEF,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAE7B,MAAM,CAAC,QAAQ,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAE/E,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,WAAW,CAAC,SAAS;QACxB,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC;YAC7B,WAAW,EAAE,CAAC,CAAC,iCAAiC,EAAE,qDAAqD,CAAC;YACxG,GAAG,EAAE,0BAA0B;SAChC,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClD,IAAI,CAAC,KAAK,CACR,CAAC,CACC,yCAAyC,EACzC,8FAA8F,CAC/F,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAE/B,MAAM,cAAc,GAAG,0BAA0B,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC5E,IAAI,cAAc;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,mCAAmC,EAAE,oCAAoC,CAAC,CAAC,CAAC;YACxF,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,EAAE,CAAC,MAAM,CACP,OAAO,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,iBAAiB,aAAa,IAAI,CAAC,SAAS,IAAI,GAAG,cAAc,IAAI,CAAC,gCAAgC,IAAI,GAAG,GAAG,CACzJ,CAAC;YACJ,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACd,EAAE,CAAC,MAAM,CACP,CAAC,CACC,uCAAuC,EACvC,oLAAoL,CACrL,CACF,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;gBAC5B,OAAO,EAAE,CAAC,CAAC,wCAAwC,EAAE,8BAA8B,CAAC;gBACpF,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,EAAE,CAAC,MAAM,CACP,CAAC,CACC,mCAAmC,EACnC,4EAA4E,CAC7E,CACF,CAAC;gBACF,OAAO,EAAC,OAAO,EAAE,KAAK,EAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC;YACvB,OAAO,EAAE,CAAC,CAAC,qCAAqC,EAAE,uDAAuD,CAAC;YAC1G,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB;SAC3D,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC;YAC7B,OAAO,EAAE,CAAC,CACR,2CAA2C,EAC3C,mIAAmI,CACpI;YACD,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB;SAC3D,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;YACzB,OAAO,EAAE,CAAC,CAAC,uCAAuC,EAAE,gCAAgC,CAAC;YACrF,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAC,OAAO,EAAE,KAAK,EAAC,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,sCAAsC,CAAC;YAC1D,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE;YAClC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE;YACxC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACjB,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC;YACnF,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;YAC7B,MAAM;YACN,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACxC,KAAK;YACL,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE;gBACtB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;oBAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;SACF,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEjG,MAAM,MAAM,GAAgB,EAAC,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAC,CAAC;QACvD,MAAM,CAAC,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAE3F,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACd,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,kCAAkC,EAAE,mCAAmC,CAAC,CAAC,CAAC,CAAC;QAC5G,EAAE,CAAC,MAAM,CAAC,sBAAsB,IAAI,CAAC,iBAAiB,IAAI,GAAG,EAAE,CAAC,CAAC;QACjE,EAAE,CAAC,MAAM,CAAC,sBAAsB,IAAI,CAAC,gCAAgC,IAAI,GAAG,EAAE,CAAC,CAAC;QAChF,EAAE,CAAC,MAAM,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QAC9D,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACd,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9E,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACd,EAAE,CAAC,MAAM,CACP,uBAAuB,CAAC;YACtB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB;YACpC,QAAQ,EAAE,IAAI,CAAC,gCAAgC;YAC/C,UAAU,EAAE,MAAM,CAAC,gBAAgB;SACpC,CAAC,CACH,CAAC;QACF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACd,EAAE,CAAC,MAAM,CACP,CAAC,CACC,qCAAqC,EACrC,kGAAkG,CACnG,CACF,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,MAAc;QAC3C,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1G,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC;YAC9B,OAAO,EAAE,CAAC,CAAC,oCAAoC,EAAE,uCAAuC,EAAE;gBACxF,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3B,CAAC;YACF,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,EAAC,IAAI,EAAE,KAAK,EAAC,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,GAAG,CACtD,+DAA+D,EAC/D,EAAC,MAAM,EAAE,EAAC,IAAI,EAAE,EAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE,EAAC,EAAC,EAAC,CAC7D,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAC,KAAK,EAAC,EAAE,2CAA2C,CAAC,CAAC;YACxE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAAiC,EAAE,UAAkB;QACnF,mGAAmG;QACnG,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;QAC9G,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAC7B,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAC1G,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,EAAE,CAAC,MAAM,CACP,CAAC,CACC,mCAAmC,EACnC,+GAA+G,CAChH,CACF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC3B,OAAO,EAAE,CAAC,CACR,uCAAuC,EACvC,iFAAiF,EACjF,EAAC,IAAI,EAAE,UAAU,EAAC,CACnB;YACD,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC;gBACE,WAAW,EAAE,KAAK,CAAC,iBAAiB;gBACpC,qBAAqB,EAAE,UAAU;aAClC,EACD,EAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAC,CAClD,CAAC;YACF,EAAE,CAAC,MAAM,CACP,CAAC,CAAC,wCAAwC,EAAE,yCAAyC,EAAE;gBACrF,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM;gBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CACH,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CACP,CAAC,CAAC,6CAA6C,EAAE,uCAAuC,EAAE;gBACxF,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC,CACH,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC"}

package/dist/utils/ecdn/mtls.d.ts

@@ -0,0 +1,80 @@
+import { type CdnZonesClient } from '@salesforce/b2c-tooling-sdk/clients';
+import { type MtlsCertificate } from '@salesforce/b2c-tooling-sdk/operations/mtls';
+/** Paths of the files written when generating code upload certificates. */
+export interface CodeUploadCertificateFiles {
+    /** CA certificate (PEM) — uploaded to eCDN */
+    caCertificate: string;
+    /** CA private key (PEM) — needed to issue more client certificates */
+    caPrivateKey: string;
+    /** Client certificate bundle (PKCS12) — used for WebDAV code upload */
+    clientCertificate: string;
+}
+/** Options for {@link generateAndUploadCodeUploadCertificate}. */
+export interface GenerateAndUploadOptions {
+    caCommonName?: string;
+    caValidityDays?: number;
+    client: CdnZonesClient;
+    clientName: string;
+    clientValidityDays?: number;
+    force?: boolean;
+    name: string;
+    onProgress?: (message: string) => void;
+    organizationId: string;
+    outDir: string;
+    passphrase?: string;
+}
+/** Result of {@link generateAndUploadCodeUploadCertificate}. */
+export interface GenerateAndUploadResult {
+    /** Expiry of the generated CA (ISO 8601) */
+    caExpiresOn: string;
+    certificate: MtlsCertificate;
+    clientPassphrase: string;
+    files: CodeUploadCertificateFiles;
+}
+/**
+ * Converts a name into a safe file name stem.
+ */
+export declare function toFileStem(name: string): string;
+/**
+ * Throws if any of the given files exist and `force` is not set.
+ */
+export declare function assertFilesWritable(files: string[], force?: boolean): void;
+/**
+ * Writes a file readable only by the current user, creating parent directories.
+ */
+export declare function writePrivateFile(file: string, data: Buffer | string): void;
+/**
+ * Writes a `.gitignore` ignoring everything in a directory of generated secrets,
+ * unless the directory already has one.
+ */
+export declare function ensureGitIgnored(dir: string): void;
+/**
+ * Resolves the default CA common name. Salesforce recommends the staging
+ * Business Manager hostname (`staging-<realm>-<customer>.demandware.net`).
+ */
+export declare function defaultCaCommonName(name: string, hostname?: string): string;
+/**
+ * Returns a warning if the organization is not a staging organization;
+ * eCDN only accepts code upload certificates for `_stg` organizations.
+ */
+export declare function stagingOrganizationWarning(organizationId: string): string | undefined;
+/**
+ * Human-readable security guidance for a generated CA private key.
+ */
+export declare function caKeySecurityNotice(caPrivateKey: string, caExpiresOn?: string): string;
+/**
+ * Human-readable guidance for an issued client certificate.
+ */
+export declare function clientCertificateNotice(options: {
+    file: string;
+    hostname?: string;
+    passphrase: string;
+}): string;
+/**
+ * Generates a CA, uploads it to eCDN, and issues a first client certificate.
+ *
+ * CA files are written before the upload so the CA key is never lost: if the
+ * upload fails, the files can be uploaded later with `--certificate-file` and
+ * `--private-key-file`.
+ */
+export declare function generateAndUploadCodeUploadCertificate(options: GenerateAndUploadOptions): Promise<GenerateAndUploadResult>;

package/dist/utils/ecdn/mtls.js

@@ -0,0 +1,164 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+import { ux } from '@oclif/core';
+import * as fs from 'node:fs';
+import path from 'node:path';
+import { normalizeTenantId } from '@salesforce/b2c-tooling-sdk/clients';
+import { createCodeUploadCertificate, generateCaCertificate, issueClientCertificate, } from '@salesforce/b2c-tooling-sdk/operations/mtls';
+/**
+ * Converts a name into a safe file name stem.
+ */
+export function toFileStem(name) {
+    return (name
+        .trim()
+        .replaceAll(/[^\w.-]+/g, '-')
+        .replaceAll(/^-+|-+$/g, '') || 'client');
+}
+/**
+ * Throws if any of the given files exist and `force` is not set.
+ */
+export function assertFilesWritable(files, force = false) {
+    if (force)
+        return;
+    const existing = files.filter((f) => fs.existsSync(f));
+    if (existing.length > 0) {
+        throw new Error(`Refusing to overwrite existing file(s): ${existing.join(', ')}. Use --force to overwrite.`);
+    }
+}
+/**
+ * Writes a file readable only by the current user, creating parent directories.
+ */
+export function writePrivateFile(file, data) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, data, { mode: 0o600 });
+    // writeFileSync only applies mode to new files
+    fs.chmodSync(file, 0o600);
+}
+/**
+ * Writes a `.gitignore` ignoring everything in a directory of generated secrets,
+ * unless the directory already has one.
+ */
+export function ensureGitIgnored(dir) {
+    const gitignore = path.resolve(dir, '.gitignore');
+    if (fs.existsSync(gitignore))
+        return;
+    fs.mkdirSync(path.dirname(gitignore), { recursive: true });
+    fs.writeFileSync(gitignore, '# Generated mTLS certificates and keys: never commit these\n*\n');
+}
+/**
+ * Resolves the default CA common name. Salesforce recommends the staging
+ * Business Manager hostname (`staging-<realm>-<customer>.demandware.net`).
+ */
+export function defaultCaCommonName(name, hostname) {
+    return hostname?.startsWith('staging-') ? hostname : `${name} CA`;
+}
+/**
+ * Returns a warning if the organization is not a staging organization;
+ * eCDN only accepts code upload certificates for `_stg` organizations.
+ */
+export function stagingOrganizationWarning(organizationId) {
+    if (organizationId.endsWith('_stg'))
+        return undefined;
+    return `Code upload certificates are only supported for staging organizations (tenant ID ending in "_stg"); "${organizationId}" may be rejected.`;
+}
+/**
+ * Human-readable security guidance for a generated CA private key.
+ */
+export function caKeySecurityNotice(caPrivateKey, caExpiresOn) {
+    const lines = [
+        ux.colorize('yellow', 'IMPORTANT: protect the CA private key'),
+        `  ${caPrivateKey}`,
+        '  Anyone with this key can issue client certificates that are trusted for code upload',
+        '  to your staging instance. Treat it like a password:',
+        '    - Move it (and ca.pem) to a secure location such as a password manager or secrets vault.',
+        '      It is only needed to issue new client certificates ("b2c ecdn mtls issue").',
+        '    - Never commit it to a source repository or share it. The output directory',
+        '      contains a .gitignore to help prevent this.',
+        '    - Give each user or pipeline its own client certificate (.p12) instead of sharing the CA.',
+    ];
+    if (caExpiresOn) {
+        lines.push('', `  The CA expires on ${caExpiresOn}. The CA certificate bundle is allowed a maximum expiry`, '  of 1 year; renew it before it expires to avoid disruption with code uploads. Create a', '  new CA, re-issue client certificates from it, verify uploads, then delete the old CA.');
+    }
+    return lines.join('\n');
+}
+/**
+ * Human-readable guidance for an issued client certificate.
+ */
+export function clientCertificateNotice(options) {
+    // On Hyperforce the code upload hostname is the standard staging hostname, so a
+    // separate webdav-hostname isn't needed.
+    const config = {};
+    if (options.hostname)
+        config.hostname = options.hostname;
+    config.certificate = options.file;
+    config['certificate-passphrase'] = options.passphrase;
+    const snippet = JSON.stringify(config, null, 2)
+        .split('\n')
+        .map((line) => `    ${line}`)
+        .join('\n');
+    return [
+        'Client certificate (use this for code upload, not the CA):',
+        `  File:        ${options.file}`,
+        `  Passphrase:  ${options.passphrase}`,
+        '  The .p12 and its passphrase are credentials: store them securely, keep the',
+        '  passphrase separate from the file, and never commit either to a repository.',
+        '',
+        '  For CI, store the base64-encoded .p12 and the passphrase as secrets:',
+        `    base64 -i ${options.file} | tr -d '\\n'`,
+        '',
+        '  To upload from this machine, add these settings to your instance in dw.json',
+        '  (or use --server, --certificate and --passphrase):',
+        snippet,
+    ].join('\n');
+}
+/**
+ * Generates a CA, uploads it to eCDN, and issues a first client certificate.
+ *
+ * CA files are written before the upload so the CA key is never lost: if the
+ * upload fails, the files can be uploaded later with `--certificate-file` and
+ * `--private-key-file`.
+ */
+export async function generateAndUploadCodeUploadCertificate(options) {
+    const progress = options.onProgress ?? (() => { });
+    const files = {
+        caCertificate: path.resolve(options.outDir, 'ca.pem'),
+        caPrivateKey: path.resolve(options.outDir, 'ca.key'),
+        clientCertificate: path.resolve(options.outDir, `${toFileStem(options.clientName)}.p12`),
+    };
+    assertFilesWritable(Object.values(files), options.force);
+    ensureGitIgnored(options.outDir);
+    progress(`Generating CA certificate for tenant ${normalizeTenantId(options.organizationId)}...`);
+    const ca = generateCaCertificate({
+        commonName: options.caCommonName ?? `${options.name} CA`,
+        validityDays: options.caValidityDays,
+    });
+    writePrivateFile(files.caCertificate, ca.certificatePem);
+    writePrivateFile(files.caPrivateKey, ca.privateKeyPem);
+    progress('Uploading CA certificate to eCDN...');
+    let certificate;
+    try {
+        certificate = await createCodeUploadCertificate(options.client, options.organizationId, {
+            name: options.name,
+            certificatePem: ca.certificatePem,
+            privateKeyPem: ca.privateKeyPem,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`${message}\nThe generated CA was saved to ${files.caCertificate} and ${files.caPrivateKey}; ` +
+            'retry the upload with --certificate-file and --private-key-file.', { cause: error });
+    }
+    progress(`Issuing client certificate "${options.clientName}" signed by the CA...`);
+    const clientCert = issueClientCertificate({
+        ca,
+        commonName: options.clientName,
+        validityDays: options.clientValidityDays,
+        passphrase: options.passphrase,
+    });
+    writePrivateFile(files.clientCertificate, clientCert.pkcs12);
+    return { caExpiresOn: ca.notAfter.toISOString(), certificate, clientPassphrase: clientCert.passphrase, files };
+}
+//# sourceMappingURL=mtls.js.map

package/dist/utils/ecdn/mtls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mtls.js","sourceRoot":"","sources":["../../../src/utils/ecdn/mtls.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,iBAAiB,EAAsB,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,6CAA6C,CAAC;AAoCrD;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,CACL,IAAI;SACD,IAAI,EAAE;SACN,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC;SAC5B,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,QAAQ,CAC1C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAe,EAAE,KAAK,GAAG,KAAK;IAChE,IAAI,KAAK;QAAE,OAAO;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAqB;IAClE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;IACpD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAC,IAAI,EAAE,KAAK,EAAC,CAAC,CAAC;IAC5C,+CAA+C;IAC/C,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO;IACrC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;IACzD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,iEAAiE,CAAC,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAiB;IACjE,OAAO,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,cAAsB;IAC/D,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,OAAO,wGAAwG,cAAc,oBAAoB,CAAC;AACpJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,WAAoB;IAC5E,MAAM,KAAK,GAAG;QACZ,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,uCAAuC,CAAC;QAC9D,KAAK,YAAY,EAAE;QACnB,uFAAuF;QACvF,uDAAuD;QACvD,8FAA8F;QAC9F,mFAAmF;QACnF,gFAAgF;QAChF,mDAAmD;QACnD,+FAA+F;KAChG,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,uBAAuB,WAAW,yDAAyD,EAC3F,yFAAyF,EACzF,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA8D;IACpG,gFAAgF;IAChF,yCAAyC;IACzC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IACzD,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAClC,MAAM,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;SAC5C,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;SAC5B,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,4DAA4D;QAC5D,kBAAkB,OAAO,CAAC,IAAI,EAAE;QAChC,kBAAkB,OAAO,CAAC,UAAU,EAAE;QACtC,8EAA8E;QAC9E,+EAA+E;QAC/E,EAAE;QACF,wEAAwE;QACxE,iBAAiB,OAAO,CAAC,IAAI,gBAAgB;QAC7C,EAAE;QACF,+EAA+E;QAC/E,sDAAsD;QACtD,OAAO;KACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,OAAiC;IAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClD,MAAM,KAAK,GAA+B;QACxC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC;QACrD,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC;QACpD,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;KACzF,CAAC;IACF,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAEzD,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,wCAAwC,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACjG,MAAM,EAAE,GAAG,qBAAqB,CAAC;QAC/B,UAAU,EAAE,OAAO,CAAC,YAAY,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK;QACxD,YAAY,EAAE,OAAO,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,gBAAgB,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;IACzD,gBAAgB,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC;IAEvD,QAAQ,CAAC,qCAAqC,CAAC,CAAC;IAChD,IAAI,WAA4B,CAAC;IACjC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE;YACtF,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,cAAc,EAAE,EAAE,CAAC,cAAc;YACjC,aAAa,EAAE,EAAE,CAAC,aAAa;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,mCAAmC,KAAK,CAAC,aAAa,QAAQ,KAAK,CAAC,YAAY,IAAI;YAC5F,kEAAkE,EACpE,EAAC,KAAK,EAAE,KAAK,EAAC,CACf,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,+BAA+B,OAAO,CAAC,UAAU,uBAAuB,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,sBAAsB,CAAC;QACxC,EAAE;QACF,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,kBAAkB;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAE7D,OAAO,EAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,CAAC,UAAU,EAAE,KAAK,EAAC,CAAC;AAC/G,CAAC"}