signalk-ssl 0.1.6 → 0.2.1

package/dist/plugin/crypto.d.ts

@@ -1,3 +1,4 @@
+import 'reflect-metadata';
 import type { FingerprintAlgorithm, GenerateCaInput, GeneratedCa, SignLeafInput, SignedLeaf } from './types.js';
 export declare const generateKeyPair: () => Promise<CryptoKeyPair>;
 export declare const generateCa: (input: GenerateCaInput) => Promise<GeneratedCa>;

package/dist/plugin/crypto.js

@@ -1,3 +1,8 @@
+// `@peculiar/x509` v2 wires `tsyringe` for DI, which requires the
+// reflect-metadata polyfill loaded before any peculiar/x509 import is
+// resolved. Putting it first in this file guarantees the side-effect
+// runs ahead of every other import the module-graph pulls below.
+import 'reflect-metadata';
 import { createPrivateKey, randomBytes, webcrypto } from 'node:crypto';
 import { AuthorityKeyIdentifierExtension, BasicConstraintsExtension, cryptoProvider, ExtendedKeyUsage, ExtendedKeyUsageExtension, KeyUsageFlags, KeyUsagesExtension, SubjectAlternativeNameExtension, SubjectKeyIdentifierExtension, X509Certificate, X509CertificateGenerator } from '@peculiar/x509';
 // Build the DN as a structured JsonName so @peculiar/x509 handles RFC 4514

package/dist/plugin/index.d.ts

@@ -1,3 +1,4 @@
+import 'reflect-metadata';
 import type { PluginConstructor } from '@signalk/server-api';
 declare const pluginConstructor: PluginConstructor;
 export default pluginConstructor;

package/dist/plugin/index.js

@@ -1,3 +1,8 @@
+// `@peculiar/x509` v2 (transitively imported via ./service -> ./crypto)
+// requires reflect-metadata to be loaded before any peculiar/x509 import
+// resolves. Side-effect import placed first to satisfy the polyfill order
+// at module-graph resolution time.
+import 'reflect-metadata';
 import { CertStore } from './storage.js';
 import { PassphraseSource } from './passphrase-source.js';
 import { SslService } from './service.js';

package/dist/plugin/schema.d.ts

@@ -4,8 +4,8 @@ export declare const SansSchema: import("@sinclair/typebox").TObject<{
     ipAddresses: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
 }>;
 export declare const ImportSchema: import("@sinclair/typebox").TObject<{
-    caCertPath: import("@sinclair/typebox").TString;
-    caKeyPath: import("@sinclair/typebox").TString;
+    caCertPath: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    caKeyPath: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
 }>;
 export declare const ConfigSchema: import("@sinclair/typebox").TObject<{
     mode: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"generate">, import("@sinclair/typebox").TLiteral<"import">]>;
@@ -19,8 +19,8 @@ export declare const ConfigSchema: import("@sinclair/typebox").TObject<{
     }>;
     passphraseMode: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"env">, import("@sinclair/typebox").TLiteral<"webapp">, import("@sinclair/typebox").TLiteral<"convenience">]>;
     import: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
-        caCertPath: import("@sinclair/typebox").TString;
-        caKeyPath: import("@sinclair/typebox").TString;
+        caCertPath: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        caKeyPath: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     }>>;
     renewalThresholdDays: import("@sinclair/typebox").TInteger;
     clockSkewHours: import("@sinclair/typebox").TInteger;

package/dist/plugin/schema.js

@@ -4,8 +4,19 @@ export const SansSchema = Type.Object({
     ipAddresses: Type.Array(Type.String(), { default: [] })
 }, { title: 'Subject Alternative Names' });
 export const ImportSchema = Type.Object({
-    caCertPath: Type.String({ title: 'CA certificate file path' }),
-    caKeyPath: Type.String({ title: 'CA private-key file path (encrypted PKCS#8)' })
+    caCertPath: Type.Optional(Type.String({
+        title: 'CA certificate file path',
+        description: 'Only used when mode = import. Leave blank for generate mode.',
+        default: ''
+    })),
+    caKeyPath: Type.Optional(Type.String({
+        title: 'CA private-key file path (encrypted PKCS#8)',
+        description: 'Only used when mode = import. Leave blank for generate mode.',
+        default: ''
+    }))
+}, {
+    title: 'Import (only used when mode = import)',
+    description: 'Paths to an existing CA cert + encrypted private key on disk. Ignored in generate mode.'
 });
 export const ConfigSchema = Type.Object({
     mode: Type.Union([Type.Literal('generate'), Type.Literal('import')], {

package/dist/plugin/service.js

@@ -72,12 +72,15 @@ export class SslService {
     }
     async importCa(passphrase) {
         const importCfg = this.deps.config.import;
-        if (importCfg === undefined) {
-            throw new Error('import mode selected but no import paths configured');
+        const caCertPath = importCfg?.caCertPath ?? '';
+        const caKeyPath = importCfg?.caKeyPath ?? '';
+        if (caCertPath === '' || caKeyPath === '') {
+            throw new Error('import mode requires both "Import → CA certificate file path" and ' +
+                '"Import → CA private-key file path (encrypted PKCS#8)" to be set in the plugin config.');
         }
         const [certificatePem, encryptedKeyPem] = await Promise.all([
-            readFile(importCfg.caCertPath, 'utf8'),
-            readFile(importCfg.caKeyPath, 'utf8')
+            readFile(caCertPath, 'utf8'),
+            readFile(caKeyPath, 'utf8')
         ]);
         // Validate the key actually decrypts before persisting — fail fast.
         await decryptPrivateKeyPkcs8(encryptedKeyPem, passphrase);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "signalk-ssl",
-  "version": "0.1.6",
+  "version": "0.2.1",
   "description": "SSL/TLS certificate management plugin for SignalK Node Server — generate a local CA, issue server certs, distribute the root via QR to phones/tablets",
   "type": "module",
   "main": "dist/plugin/index.js",
@@ -64,12 +64,13 @@
     "@signalk/server-api": "^2.0.0"
   },
   "dependencies": {
-    "@peculiar/x509": "^1.12.3",
+    "@peculiar/x509": "^2.0.0",
     "@sinclair/typebox": "^0.34.49",
-    "qrcode": "^1.5.4"
+    "qrcode": "^1.5.4",
+    "reflect-metadata": "^0.2.2"
   },
   "devDependencies": {
-    "@eslint/js": "^9.28.0",
+    "@eslint/js": "^10.0.1",
     "@hookform/resolvers": "^5.4.0",
     "@signalk/server-api": "^2.0.0",
     "@tailwindcss/vite": "^4.3.0",
@@ -82,8 +83,8 @@
     "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
-    "@vitest/coverage-v8": "^3.2.4",
-    "eslint": "^9.28.0",
+    "@vitest/coverage-v8": "^4.1.7",
+    "eslint": "^10.4.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.4",
     "jsdom": "^29.1.1",
@@ -96,7 +97,7 @@
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.33.1",
     "vite": "^8.0.14",
-    "vitest": "^3.0.0",
+    "vitest": "^4.1.7",
     "wouter": "^3.10.0",
     "zod": "^4.4.3"
   }