@sema-agent/client-core 0.111.0 → 0.112.1

package/dist/consoleCaPin.d.ts

@@ -0,0 +1,136 @@
+import type { UiLanguage } from './env/uiLanguage.js';
+export declare const CA_PIN_LIMITS: Readonly<{
+    addressMaxChars: 2048;
+    authorityMaxChars: 300;
+    fingerprintsMax: 16;
+    fingerprintMaxChars: 128;
+    bodyMaxBytes: 1048576;
+    servedMax: 16;
+    pemMaxBytes: 16384;
+    budgetMs: 120000;
+    roundMs: 10000;
+    retriesMax: 3;
+    waitCapMs: 60000;
+    jitterMaxMs: 2000;
+}>;
+export type CenterAddressSeat = 'invite' | 'address';
+export type CenterAddressRefusal = 'bad_input' | 'empty' | 'too_long' | 'unsafe_character' | 'scheme' | 'userinfo' | 'percent_in_host' | 'unparseable' | 'query' | 'fragment' | 'trailing_dot' | 'ip_not_canonical' | 'plaintext_remote' | 'path' | 'fingerprint' | 'too_many_fingerprints';
+export type CenterAddressReading = {
+    readonly ok: true;
+    readonly seat: CenterAddressSeat;
+    readonly origin: string;
+    readonly centerKey: string;
+    readonly fingerprints: readonly string[];
+} | {
+    readonly ok: false;
+    readonly reason: CenterAddressRefusal;
+};
+export type TrustOriginRefusal = 'empty' | 'too_long' | 'unsafe_character' | 'scheme' | 'userinfo' | 'percent_in_host' | 'unparseable' | 'trailing_dot' | 'ip_not_canonical';
+export type TrustOriginReading = {
+    readonly ok: true;
+    readonly origin: string;
+} | {
+    readonly ok: false;
+    readonly reason: TrustOriginRefusal;
+};
+export declare function readCenterAddress(raw: string | null | undefined, seat: CenterAddressSeat): CenterAddressReading;
+export declare function trustOriginOf(url: string | null | undefined): TrustOriginReading;
+export type CaFingerprintsRefusal = 'bad_input' | 'prefix' | 'fingerprint' | 'too_many_fingerprints';
+export type CaFingerprintsReading = {
+    readonly ok: true;
+    readonly fingerprints: readonly string[];
+} | {
+    readonly ok: false;
+    readonly reason: CaFingerprintsRefusal;
+    readonly index?: number;
+};
+export declare function caFingerprintsOf(texts: readonly string[] | null | undefined): CaFingerprintsReading;
+export declare function caFingerprintOfDer(der: Uint8Array): string;
+export declare function caFingerprintDisplay(fp: string | null | undefined): string | undefined;
+export type CaCertificateParser = (der: Uint8Array) => CaCertificateFacts | null | undefined;
+export interface CaCertificateFacts {
+    readonly raw: Uint8Array;
+    readonly subject: string;
+    readonly notAfter: string;
+    readonly selfSigned: boolean;
+}
+export interface CaBootstrapRequest {
+    readonly named?: readonly string[];
+    readonly parseCertificate?: CaCertificateParser;
+}
+export interface CaServedCertificate {
+    readonly fingerprint: string;
+    readonly pem: string;
+    readonly selfSigned: boolean;
+    readonly subject?: string;
+    readonly notAfter?: string;
+}
+export type CaBootstrapRefusal = 'bad_input' | 'parser_unavailable' | 'body_too_large' | 'body_not_json' | 'body_shape' | 'served_count' | 'certificate_too_large' | 'certificate_not_canonical' | 'certificate_unparseable' | 'served_duplicate' | 'named_not_served' | 'anchor_not_self_signed' | 'unconfigured_with_fingerprints';
+export type CaBootstrapReading = {
+    readonly kind: 'unconfigured';
+} | {
+    readonly kind: 'served';
+    readonly certificates: readonly CaServedCertificate[];
+    readonly anchors: readonly CaServedCertificate[];
+} | {
+    readonly kind: 'refused';
+    readonly reason: CaBootstrapRefusal;
+    readonly index?: number;
+};
+export declare function readCaBootstrapBody(body: Uint8Array, request: CaBootstrapRequest): CaBootstrapReading;
+export type CaBootstrapPhase = 'idle' | 'in-flight' | 'reading' | 'waiting' | 'stopped';
+export type CaBootstrapStopReason = 'bad_input' | 'cancelled' | 'timed_out' | 'transport_failed' | 'content_type' | 'ca_unavailable' | 'endpoint_missing' | 'unexpected_status' | 'retry_after_unusable' | 'retry_after_too_long' | 'retries_exhausted' | 'budget_exhausted';
+export interface CaBootstrapStop {
+    readonly action: 'stop';
+    readonly reason: CaBootstrapStopReason;
+    readonly status?: number;
+    readonly retryAfterSec?: number;
+    readonly remainingSec?: number;
+}
+export type CaBootstrapDecision = {
+    readonly action: 'attempt';
+    readonly timeoutMs: number;
+} | {
+    readonly action: 'wait';
+    readonly afterMs: number;
+    readonly retryAfterSec: number;
+} | {
+    readonly action: 'read-body';
+} | {
+    readonly action: 'proceed';
+} | CaBootstrapStop;
+export interface CaBootstrapState {
+    readonly phase: CaBootstrapPhase;
+    readonly deadlineMs: number;
+    readonly lastNowMs: number;
+    readonly attempts: number;
+    readonly roundDeadlineMs?: number;
+    readonly notBeforeMs?: number;
+    readonly retryAfterSec?: number;
+    readonly stop?: CaBootstrapStop;
+}
+export type CaBootstrapEvent = {
+    readonly type: 'begin';
+} | {
+    readonly type: 'response';
+    readonly status: number;
+    readonly contentType?: string;
+    readonly retryAfter?: string;
+    readonly jitter?: number;
+} | {
+    readonly type: 'checkpoint';
+} | {
+    readonly type: 'timed-out';
+} | {
+    readonly type: 'failed';
+} | {
+    readonly type: 'cancelled';
+};
+export interface CaBootstrapStep {
+    readonly state: CaBootstrapState;
+    readonly decision: CaBootstrapDecision;
+}
+export declare function caBootstrapOpen(nowMs: number): CaBootstrapState;
+export declare function caBootstrapStep(state: CaBootstrapState, event: CaBootstrapEvent, nowMs: number): CaBootstrapStep;
+export type CaPinRefusal = CenterAddressRefusal | TrustOriginRefusal | CaFingerprintsRefusal | CaBootstrapRefusal | CaBootstrapStopReason;
+export declare function caPinRefusalSentence(reason: CaPinRefusal | (string & {}), lang?: UiLanguage): string;