@camstack/system 1.2.113 → 1.2.115

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-Duz_uJSQ.mjs";
+import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-Drb54SZD.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -24,24 +24,26 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-CuE_hBli.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Cb1ANt3i.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-SGdbr9D5.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
-import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
+import { X509Certificate, createHash, createPrivateKey, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
-import { lstat, readdir, readlink, realpath } from "node:fs/promises";
+import { chmod, copyFile, lstat, mkdtemp, readdir, readlink, realpath, rm, writeFile } from "node:fs/promises";
 import * as path$39 from "node:path";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import * as util$10 from "node:util";
 import { promisify } from "node:util";
 import * as os$18 from "node:os";
+import { tmpdir } from "node:os";
 import * as fs$17 from "node:fs";
-import { accessSync, constants, existsSync, mkdirSync, readFileSync } from "node:fs";
+import { accessSync, constants, existsSync, mkdirSync, readFileSync, renameSync } from "node:fs";
 import { request } from "node:http";
 import * as vm from "node:vm";
 import { asJsonObject, errMsg, parseJsonUnknown } from "@camstack/types/addon";
+import { isIP } from "node:net";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { EventEmitter } from "node:events";
 import As from "node:stream";
@@ -2010,71 +2012,454 @@ var StorageManager = class {
 	}
 };
 //#endregion
-//#region src/tls/cert-manager.ts
-var execFileAsync$3 = promisify(execFile);
+//#region src/tls/cert-evaluation.ts
 /**
-* Ensure a self-signed TLS certificate exists in the given directory.
-* Generates one if missing. Returns paths to cert and key files.
+* The regeneration rule (D227), as a pure function.
+*
+* `ensureTlsCert` reissues **only** when the material on disk cannot do
+* its job. Never because it is old, never because the machine picked up
+* an address the certificate does not need, never because a new build
+* shipped. The decision is a function of (files on disk, machine
+* identity, clock) alone, so the same inputs always produce the same
+* answer — which is what makes a reissue happen once and then stop.
 */
-async function ensureTlsCert(dataDir, options) {
-	const tlsDir = join(dataDir, "tls");
-	const certPath = join(tlsDir, "camstack.crt");
-	const keyPath = join(tlsDir, "camstack.key");
-	if (existsSync(certPath) && existsSync(keyPath)) try {
-		const x509 = new X509Certificate(readFileSync(certPath));
-		if (new Date(x509.validTo) > /* @__PURE__ */ new Date()) return {
-			certPath,
-			keyPath,
-			generated: false
-		};
-	} catch {}
-	mkdirSync(tlsDir, { recursive: true });
-	const cn = options?.commonName ?? "camstack.local";
-	const validDays = options?.validDays ?? 825;
-	const sanDns = new Set([
+/** OID `id-kp-serverAuth`. Apple's trustd requires it on the leaf. */
+var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+/**
+* Apple's `SecPolicyCheckOtherTrustValidityPeriod` ceiling is 825 days;
+* the CA/Browser Forum's recommended maximum is 397. We sit at 397.
+*/
+var MAX_LEAF_VALIDITY_DAYS = 397;
+/** Reissue this long before the leaf dies, so nobody serves an expired one. */
+var LEAF_RENEWAL_WINDOW_DAYS = 30;
+/** A local root outlives many leaves — it is the anchor an operator trusts. */
+var CA_VALIDITY_DAYS = 3650;
+var MS_PER_DAY = 864e5;
+/** Reasons that invalidate the root as well as the leaf. */
+var REASONS_REQUIRING_NEW_CA = [
+	"missing",
+	"unreadable",
+	"no-local-ca",
+	"ca-expiring"
+];
+function reasonRequiresNewCa(reason) {
+	return REASONS_REQUIRING_NEW_CA.includes(reason);
+}
+function parse$2(pem) {
+	try {
+		return new X509Certificate(pem);
+	} catch {
+		return null;
+	}
+}
+function daysBetween(from, to) {
+	return (to.getTime() - from.getTime()) / MS_PER_DAY;
+}
+function hasServerAuthEku(leaf) {
+	const eku = leaf.keyUsage;
+	return eku !== void 0 && eku.length === 1 && eku[0] === "1.3.6.1.5.5.7.3.1";
+}
+function keyMatches(leaf, keyPem) {
+	try {
+		return leaf.checkPrivateKey(createPrivateKey(keyPem));
+	} catch {
+		return false;
+	}
+}
+function coversIdentity(leaf, identity) {
+	for (const name of identity.requiredDnsNames) if (leaf.checkHost(name) === void 0) return false;
+	for (const ip of identity.requiredIpAddresses) if (leaf.checkIP(ip) === void 0) return false;
+	return true;
+}
+/**
+* `null` when the material on disk is fit to keep serving.
+*
+* Order matters only for the quality of the reported reason; any
+* non-null answer produces the same action.
+*/
+function evaluateExistingCert(input) {
+	const leaf = parse$2(input.chainPem);
+	const ca = parse$2(input.caPem);
+	if (leaf === null || ca === null) return "unreadable";
+	if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
+	if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
+	if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
+	if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
+	if (leaf.ca || !leaf.checkIssued(ca) || !leaf.verify(ca.publicKey)) return "not-issued-by-local-ca";
+	if (daysBetween(new Date(leaf.validFrom), new Date(leaf.validTo)) > 398) return "validity-too-long";
+	if (!coversIdentity(leaf, input.identity)) return "san-coverage-gap";
+	return null;
+}
+//#endregion
+//#region src/tls/cert-identity.ts
+/**
+* What names and addresses the hub's certificate has to answer for.
+*
+* Split out of `cert-manager.ts` because it is pure and because the
+* regeneration rule (D227) is decided entirely by the difference between
+* *this* and what the certificate on disk already carries.
+*/
+/**
+* Interfaces whose addresses are certified but never gate a reissue:
+* container bridges, VPN tunnels and mesh overlays hand out addresses
+* that change without the hub moving.
+*/
+var VOLATILE_INTERFACE_PREFIXES = [
+	"docker",
+	"br-",
+	"veth",
+	"virbr",
+	"cni",
+	"flannel",
+	"tun",
+	"utun",
+	"tap",
+	"wg",
+	"zt",
+	"tailscale",
+	"ppp",
+	"awdl",
+	"llw"
+];
+/** A DNS name we are willing to hand to openssl. */
+var DNS_NAME_PATTERN = /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+function isIpv4(value) {
+	return isIP(value) === 4;
+}
+function isIpv6(value) {
+	return isIP(value) === 6;
+}
+/**
+* `fe80::/10` and `169.254.0.0/16`. An IPv6 link-local address needs a
+* zone index to be usable and a SAN cannot carry one, so such an entry
+* can never match anything — it is noise that makes the certificate look
+* broader than it is.
+*/
+function isLinkLocal(value) {
+	if (isIpv4(value)) return value.startsWith("169.254.");
+	if (!isIpv6(value)) return false;
+	const firstGroup = value.split(":")[0] ?? "";
+	if (firstGroup === "") return false;
+	const parsed = Number.parseInt(firstGroup, 16);
+	return Number.isFinite(parsed) && (parsed & 65472) === 65152;
+}
+/** `fc00::/7` — the IPv6 range that behaves like RFC 1918 does for v4. */
+function isUniqueLocalIpv6(value) {
+	if (!isIpv6(value)) return false;
+	const firstGroup = value.split(":")[0] ?? "";
+	const parsed = Number.parseInt(firstGroup, 16);
+	return Number.isFinite(parsed) && (parsed & 65024) === 64512;
+}
+function isVolatileInterface(name) {
+	const lower = name.toLowerCase();
+	return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+/**
+* A global-scope IPv6 address is NOT a stable identity: SLAAC privacy
+* extensions rotate temporary addresses roughly daily, and `os` gives us
+* no way to tell a temporary address from a permanent one. Gating on
+* one would reissue the certificate every day.
+*/
+function isStableGateAddress(address) {
+	if (isLinkLocal(address)) return false;
+	if (isIpv4(address)) return true;
+	return isUniqueLocalIpv6(address);
+}
+function addSan(dns, ips, value) {
+	const trimmed = value.trim();
+	if (trimmed === "") return;
+	if (isIP(trimmed) !== 0) {
+		if (!isLinkLocal(trimmed)) ips.add(trimmed);
+		return;
+	}
+	if (DNS_NAME_PATTERN.test(trimmed)) dns.add(trimmed);
+}
+/**
+* Snapshot the machine's identity. Called once per `ensureTlsCert`; the
+* result is both the SAN list for a new leaf and the yardstick the
+* existing leaf is measured against.
+*/
+function collectCertIdentity(options) {
+	const dnsNames = /* @__PURE__ */ new Set();
+	const ipAddresses = new Set(["127.0.0.1", "::1"]);
+	const requiredDnsNames = /* @__PURE__ */ new Set();
+	const requiredIpAddresses = new Set(["127.0.0.1"]);
+	for (const name of [
 		"localhost",
-		cn,
+		options.commonName,
 		os$18.hostname()
-	]);
-	const sanIps = new Set(["127.0.0.1", "::1"]);
-	const interfaces = os$18.networkInterfaces();
-	for (const addrs of Object.values(interfaces)) {
-		if (!addrs) continue;
-		for (const addr of addrs) if (!addr.internal) sanIps.add(addr.address);
-	}
-	for (const san of options?.extraSans ?? []) if (san.match(/^\d+\.\d+\.\d+\.\d+$/) || san.includes(":")) sanIps.add(san);
-	else sanDns.add(san);
-	const sanParts = [];
-	for (const dns of sanDns) sanParts.push(`DNS:${dns}`);
-	for (const ip of sanIps) sanParts.push(`IP:${ip}`);
-	const sanString = sanParts.join(",");
+	]) {
+		addSan(dnsNames, ipAddresses, name);
+		addSan(requiredDnsNames, requiredIpAddresses, name);
+	}
+	for (const [ifaceName, addrs] of Object.entries(os$18.networkInterfaces())) for (const addr of addrs ?? []) {
+		if (addr.internal) continue;
+		if (isLinkLocal(addr.address)) continue;
+		ipAddresses.add(addr.address);
+		if (isVolatileInterface(ifaceName)) continue;
+		if (isStableGateAddress(addr.address)) requiredIpAddresses.add(addr.address);
+	}
+	for (const san of options.extraSans) {
+		addSan(dnsNames, ipAddresses, san);
+		addSan(requiredDnsNames, requiredIpAddresses, san);
+	}
+	return {
+		dnsNames: [...dnsNames],
+		ipAddresses: [...ipAddresses],
+		requiredDnsNames: [...requiredDnsNames],
+		requiredIpAddresses: [...requiredIpAddresses]
+	};
+}
+//#endregion
+//#region src/tls/cert-openssl.ts
+/**
+* The openssl invocations. Isolated so `cert-manager.ts` reads as policy
+* and this file reads as mechanics.
+*/
+var execFileAsync$3 = promisify(execFile);
+/** Subject of the local root. Distinct from the leaf's CN by construction. */
+var CA_COMMON_NAME = "CamStack Local CA";
+function sanValue(identity) {
+	const parts = [];
+	for (const dns of identity.dnsNames) parts.push(`DNS:${dns}`);
+	for (const ip of identity.ipAddresses) if (isIP(ip) !== 0) parts.push(`IP:${ip}`);
+	return parts.join(",");
+}
+/**
+* A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
+* else, and **no EKU** — Apple rejects an anchor asserting
+* `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
+*/
+async function generateCa(tmpDir) {
+	const caCertPath = join(tmpDir, "ca.crt");
+	const caKeyPath = join(tmpDir, "ca.key");
 	await execFileAsync$3("openssl", [
 		"req",
 		"-x509",
 		"-newkey",
 		"rsa:2048",
+		"-nodes",
+		"-sha256",
+		"-days",
+		String(CA_VALIDITY_DAYS),
+		"-keyout",
+		caKeyPath,
+		"-out",
+		caCertPath,
+		"-subj",
+		`/CN=${CA_COMMON_NAME}`,
+		"-addext",
+		"basicConstraints=critical,CA:TRUE,pathlen:0",
+		"-addext",
+		"keyUsage=critical,keyCertSign,cRLSign",
+		"-addext",
+		"subjectKeyIdentifier=hash"
+	]);
+	await chmod(caKeyPath, 384);
+	return {
+		caCertPath,
+		caKeyPath
+	};
+}
+/**
+* A server leaf signed by the local root: `CA:FALSE`, and
+* `extendedKeyUsage=serverAuth` — not `anyExtendedKeyUsage`, which
+* Apple's `testAppTrustRoot_AnyEKU_AfterJul2019` asserts must fail.
+*/
+async function issueLeaf(tmpDir, ca, identity, commonName, validDays) {
+	const keyPath = join(tmpDir, "leaf.key");
+	const csrPath = join(tmpDir, "leaf.csr");
+	const certPath = join(tmpDir, "leaf.crt");
+	const extPath = join(tmpDir, "leaf.ext");
+	await writeFile(extPath, [
+		"basicConstraints=critical,CA:FALSE",
+		"keyUsage=critical,digitalSignature,keyEncipherment",
+		"extendedKeyUsage=serverAuth",
+		"subjectKeyIdentifier=hash",
+		"authorityKeyIdentifier=keyid,issuer",
+		`subjectAltName=${sanValue(identity)}`,
+		""
+	].join("\n"), "utf-8");
+	await execFileAsync$3("openssl", [
+		"req",
+		"-new",
+		"-newkey",
+		"rsa:2048",
+		"-nodes",
+		"-sha256",
 		"-keyout",
 		keyPath,
 		"-out",
-		certPath,
+		csrPath,
+		"-subj",
+		`/CN=${commonName}`
+	]);
+	await execFileAsync$3("openssl", [
+		"x509",
+		"-req",
+		"-in",
+		csrPath,
+		"-CA",
+		ca.caCertPath,
+		"-CAkey",
+		ca.caKeyPath,
+		"-set_serial",
+		`0x00${randomBytes(16).toString("hex")}`,
 		"-days",
 		String(validDays),
-		"-nodes",
-		"-subj",
-		`/CN=${cn}`,
-		"-addext",
-		`subjectAltName=${sanString}`
+		"-sha256",
+		"-extfile",
+		extPath,
+		"-out",
+		certPath
 	]);
-	const { chmod } = await import("node:fs/promises");
 	await chmod(keyPath, 384);
+	await rm(csrPath, { force: true });
+	await rm(extPath, { force: true });
 	return {
 		certPath,
-		keyPath,
-		generated: true
+		keyPath
+	};
+}
+//#endregion
+//#region src/tls/cert-manager.ts
+var DEFAULT_COMMON_NAME = "camstack.local";
+/**
+* Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
+* a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
+* chained to it (`camstack.crt` = leaf + root, `camstack.key`).
+*
+* ## The regeneration rule (D227)
+*
+* Reissue happens when, and only when, the material on disk **cannot do
+* its job**:
+*
+* - it is absent, unreadable, or the key does not match the certificate;
+* - the root is absent (every pre-2026-08 install: one self-signed
+*   `CA:TRUE` leaf and no root) or is inside its renewal window;
+* - the leaf is inside its 30-day renewal window;
+* - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
+*   rejects an app-supplied anchor without it;
+* - the leaf is not actually issued by the root on disk;
+* - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
+* - **a name or address the hub must answer for is missing from the SAN
+*   list** — a DHCP move, a new interface or a new hostname.
+*
+* And explicitly NOT when: the certificate names an address the machine
+* no longer has (a superset still works — the check is one-directional),
+* a volatile interface (docker/VPN/mesh) or a global-scope IPv6 address
+* changed (SLAAC privacy addresses rotate daily), or a new build shipped.
+*
+* Every trigger is derived from the files plus the machine, so once a
+* reissue clears them it clears them for good: the next boot returns
+* `generated: false`. A certificate that moved on every boot would
+* invalidate every trust an operator granted by hand — worse than the
+* bugs this rule fixes.
+*
+* **The root is rotated only for root-level reasons.** SAN drift rotates
+* the leaf alone, so trust granted to `camstack-ca.crt` survives every
+* address change the hub will ever see.
+*/
+async function ensureTlsCert(dataDir, options) {
+	const tlsDir = join(dataDir, "tls");
+	const paths = {
+		certPath: join(tlsDir, "camstack.crt"),
+		keyPath: join(tlsDir, "camstack.key"),
+		caCertPath: join(tlsDir, "camstack-ca.crt"),
+		caKeyPath: join(tlsDir, "camstack-ca.key")
+	};
+	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+	const validDays = Math.min(options?.validDays ?? 397, 397);
+	const identity = collectCertIdentity({
+		commonName,
+		extraSans: options?.extraSans ?? []
+	});
+	const reason = decideRegeneration(paths, identity);
+	if (reason === null) return describe(paths, false, null, false, null);
+	const previousFingerprint = readFingerprint(paths.certPath);
+	const caRotated = reasonRequiresNewCa(reason);
+	mkdirSync(tlsDir, { recursive: true });
+	await regenerate(paths, identity, commonName, validDays, caRotated);
+	return describe(paths, true, reason, caRotated, previousFingerprint);
+}
+/** Fingerprint of whatever is on disk, or `null` if there is nothing readable. */
+function readFingerprint(certPath) {
+	try {
+		return new X509Certificate(readFileSync(certPath)).fingerprint256;
+	} catch {
+		return null;
+	}
+}
+function decideRegeneration(paths, identity) {
+	if (!existsSync(paths.certPath) || !existsSync(paths.keyPath)) return "missing";
+	if (!existsSync(paths.caCertPath) || !existsSync(paths.caKeyPath)) return "no-local-ca";
+	try {
+		return evaluateExistingCert({
+			chainPem: readFileSync(paths.certPath, "utf-8"),
+			keyPem: readFileSync(paths.keyPath, "utf-8"),
+			caPem: readFileSync(paths.caCertPath, "utf-8"),
+			identity,
+			now: /* @__PURE__ */ new Date()
+		});
+	} catch {
+		return "unreadable";
+	}
+}
+/**
+* Build every file in a scratch directory, then move them into place.
+* A crash mid-way leaves the previous material untouched; a crash
+* between the moves leaves a key/certificate mismatch, which the
+* evaluator reports as `key-mismatch` and heals on the next boot.
+*/
+async function regenerate(paths, identity, commonName, validDays, newCa) {
+	const scratch = await mkdtemp(join(tmpdir(), "camstack-tls-"));
+	try {
+		const ca = newCa ? await generateCa(scratch) : {
+			caCertPath: paths.caCertPath,
+			caKeyPath: paths.caKeyPath
+		};
+		const leaf = await issueLeaf(scratch, ca, identity, commonName, validDays);
+		const chainPath = join(scratch, "chain.crt");
+		await writeFile(chainPath, `${readFileSync(leaf.certPath, "utf-8").trimEnd()}\n${readFileSync(ca.caCertPath, "utf-8").trimEnd()}\n`, "utf-8");
+		if (newCa) {
+			await copyFile(ca.caCertPath, `${paths.caCertPath}.new`);
+			await copyFile(ca.caKeyPath, `${paths.caKeyPath}.new`);
+			renameSync(`${paths.caCertPath}.new`, paths.caCertPath);
+			renameSync(`${paths.caKeyPath}.new`, paths.caKeyPath);
+			await chmod(paths.caKeyPath, 384);
+		}
+		await copyFile(leaf.keyPath, `${paths.keyPath}.new`);
+		await copyFile(chainPath, `${paths.certPath}.new`);
+		renameSync(`${paths.keyPath}.new`, paths.keyPath);
+		renameSync(`${paths.certPath}.new`, paths.certPath);
+		await chmod(paths.keyPath, 384);
+	} finally {
+		await rm(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function describe(paths, generated, reason, caRotated, previousFingerprintSha256) {
+	const leaf = new X509Certificate(readFileSync(paths.certPath));
+	const ca = new X509Certificate(readFileSync(paths.caCertPath));
+	const san = leaf.subjectAltName ?? "";
+	return {
+		...paths,
+		generated,
+		reason,
+		caRotated,
+		fingerprintSha256: leaf.fingerprint256,
+		previousFingerprintSha256,
+		caFingerprintSha256: ca.fingerprint256,
+		validTo: new Date(leaf.validTo).toISOString(),
+		sans: san === "" ? [] : san.split(", ")
 	};
 }
 /**
-* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS options.
+* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
+* options. `certPath` is a full chain, so the listener presents the local
+* root alongside the leaf.
 */
 function loadTlsCert(certPath, keyPath) {
 	return {
@@ -94888,4 +95273,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LokiDestination, LokiLoggingAddon, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, addonSettingsCapability, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, clusterEventTopic, clusterSecretMatches, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, quarantineAddonResidue, readPendingRestart, readinessKey, registerEventBusService, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, writePendingRestart };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, addonSettingsCapability, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, quarantineAddonResidue, readPendingRestart, readinessKey, registerEventBusService, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, writePendingRestart };

package/dist/{retired-settings-keys-BtVT2f6O.mjs → retired-settings-keys-Dz5-7gjt.mjs}

@@ -1,4 +1,4 @@
-import { kt as asJsonObject } from "./dist-Duz_uJSQ.mjs";
+import { kt as asJsonObject } from "./dist-Drb54SZD.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-CYDGGkyM.js → retired-settings-keys-OfhqQio4.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-B2CtwVW2.js");
+const require_dist = require("./dist-iAwSA2_f.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/tls/cert-evaluation.d.ts

@@ -0,0 +1,41 @@
+import { CertIdentity } from './cert-identity.js';
+/** OID `id-kp-serverAuth`. Apple's trustd requires it on the leaf. */
+export declare const SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+/**
+ * Apple's `SecPolicyCheckOtherTrustValidityPeriod` ceiling is 825 days;
+ * the CA/Browser Forum's recommended maximum is 397. We sit at 397.
+ */
+export declare const MAX_LEAF_VALIDITY_DAYS = 397;
+/** Reissue this long before the leaf dies, so nobody serves an expired one. */
+export declare const LEAF_RENEWAL_WINDOW_DAYS = 30;
+/** A local root outlives many leaves — it is the anchor an operator trusts. */
+export declare const CA_VALIDITY_DAYS = 3650;
+/**
+ * The CA must outlive any leaf it signs by a margin, or a leaf issued
+ * today expires after its own issuer.
+ */
+export declare const CA_RENEWAL_WINDOW_DAYS: number;
+/**
+ * Why a reissue is happening. Reported on `EnsureTlsResult` and logged
+ * verbatim — an operator who trusted the old certificate by hand learns
+ * from this string, not from a browser error.
+ */
+export type CertRegenerationReason = 'missing' | 'unreadable' | 'no-local-ca' | 'ca-expiring' | 'key-mismatch' | 'expiring' | 'missing-server-auth-eku' | 'not-issued-by-local-ca' | 'validity-too-long' | 'san-coverage-gap';
+export interface CertEvaluationInput {
+    /** Contents of `camstack.crt` — leaf first, then the issuing CA. */
+    readonly chainPem: string;
+    /** Contents of `camstack.key` — the leaf's private key. */
+    readonly keyPem: string;
+    /** Contents of `camstack-ca.crt` — the local root. */
+    readonly caPem: string;
+    readonly identity: CertIdentity;
+    readonly now: Date;
+}
+export declare function reasonRequiresNewCa(reason: CertRegenerationReason): boolean;
+/**
+ * `null` when the material on disk is fit to keep serving.
+ *
+ * Order matters only for the quality of the reported reason; any
+ * non-null answer produces the same action.
+ */
+export declare function evaluateExistingCert(input: CertEvaluationInput): CertRegenerationReason | null;

package/dist/tls/cert-identity.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Names/addresses that go INTO the certificate, and the subset whose
+ * absence forces a reissue.
+ *
+ * The two are deliberately different sizes. Everything plausible is
+ * certified — costs nothing. Only a **stable** identity gates
+ * regeneration, because a gate that fires on a rotating address rewrites
+ * the certificate on every boot, which is a worse bug than the one the
+ * gate exists to fix.
+ */
+export interface CertIdentity {
+    readonly dnsNames: readonly string[];
+    readonly ipAddresses: readonly string[];
+    readonly requiredDnsNames: readonly string[];
+    readonly requiredIpAddresses: readonly string[];
+}
+export interface CertIdentityOptions {
+    readonly commonName: string;
+    readonly extraSans: readonly string[];
+}
+export declare function isIpv4(value: string): boolean;
+export declare function isIpv6(value: string): boolean;
+/**
+ * `fe80::/10` and `169.254.0.0/16`. An IPv6 link-local address needs a
+ * zone index to be usable and a SAN cannot carry one, so such an entry
+ * can never match anything — it is noise that makes the certificate look
+ * broader than it is.
+ */
+export declare function isLinkLocal(value: string): boolean;
+/** `fc00::/7` — the IPv6 range that behaves like RFC 1918 does for v4. */
+export declare function isUniqueLocalIpv6(value: string): boolean;
+/**
+ * Snapshot the machine's identity. Called once per `ensureTlsCert`; the
+ * result is both the SAN list for a new leaf and the yardstick the
+ * existing leaf is measured against.
+ */
+export declare function collectCertIdentity(options: CertIdentityOptions): CertIdentity;