@camstack/system 1.2.115 → 1.2.117

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-iAwSA2_f.js");
+const require_dist = require("./dist-DMEGlqg6.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -27,6 +27,7 @@ const require_builtins_winston_logging_index = require("./builtins/winston-loggi
 const require_file_data_plane = require("./file-data-plane-DUHPHa-Y.js");
 const require_manifest_python_deps = require("./manifest-python-deps-CwBbX4Ut.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
+const require_lan_http_bind = require("./lan-http-bind-DmgpFP6_.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -46,7 +47,6 @@ let node_http = require("node:http");
 let node_vm = require("node:vm");
 node_vm = require_chunk.__toESM(node_vm);
 let _camstack_types_addon = require("@camstack/types/addon");
-let node_net = require("node:net");
 let node_url = require("node:url");
 let node_events = require("node:events");
 let node_stream = require("node:stream");
@@ -1516,7 +1516,7 @@ var PipelineValidator = class {
 };
 //#endregion
 //#region src/python/python-env-manager.ts
-var execFileAsync$4 = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
 var PythonEnvManager = class {
 	venvPath;
 	cachedProbe = null;
@@ -1526,12 +1526,12 @@ var PythonEnvManager = class {
 	async probe() {
 		if (this.cachedProbe) return this.cachedProbe;
 		for (const cmd of ["python3", "python"]) try {
-			const { stdout } = await execFileAsync$4(cmd, ["--version"]);
+			const { stdout } = await execFileAsync$3(cmd, ["--version"]);
 			const version = stdout.trim().replace("Python ", "");
 			const major = parseInt(version.split(".")[0] ?? "0", 10);
 			const minor = parseInt(version.split(".")[1] ?? "0", 10);
 			if (major < 3 || major === 3 && minor < 10) continue;
-			const { stdout: pathOut } = await execFileAsync$4(cmd, ["-c", "import sys; print(sys.executable)"]);
+			const { stdout: pathOut } = await execFileAsync$3(cmd, ["-c", "import sys; print(sys.executable)"]);
 			this.cachedProbe = {
 				available: true,
 				version,
@@ -1547,13 +1547,13 @@ var PythonEnvManager = class {
 	async ensure(options) {
 		const probe = await this.probe();
 		if (!probe.available || !probe.path) throw new Error("Python 3.10+ is required but not found on this system");
-		if (!node_fs.existsSync(node_path.join(this.venvPath, "bin", "python"))) await execFileAsync$4(probe.path, [
+		if (!node_fs.existsSync(node_path.join(this.venvPath, "bin", "python"))) await execFileAsync$3(probe.path, [
 			"-m",
 			"venv",
 			this.venvPath
 		]);
 		const venvPython = node_path.join(this.venvPath, "bin", "python");
-		if (options.packages.length > 0) await execFileAsync$4(venvPython, [
+		if (options.packages.length > 0) await execFileAsync$3(venvPython, [
 			"-m",
 			"pip",
 			"install",
@@ -2018,462 +2018,6 @@ var StorageManager = class {
 	}
 };
 //#endregion
-//#region src/tls/cert-evaluation.ts
-/**
-* The regeneration rule (D227), as a pure function.
-*
-* `ensureTlsCert` reissues **only** when the material on disk cannot do
-* its job. Never because it is old, never because the machine picked up
-* an address the certificate does not need, never because a new build
-* shipped. The decision is a function of (files on disk, machine
-* identity, clock) alone, so the same inputs always produce the same
-* answer — which is what makes a reissue happen once and then stop.
-*/
-/** OID `id-kp-serverAuth`. Apple's trustd requires it on the leaf. */
-var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
-/**
-* Apple's `SecPolicyCheckOtherTrustValidityPeriod` ceiling is 825 days;
-* the CA/Browser Forum's recommended maximum is 397. We sit at 397.
-*/
-var MAX_LEAF_VALIDITY_DAYS = 397;
-/** Reissue this long before the leaf dies, so nobody serves an expired one. */
-var LEAF_RENEWAL_WINDOW_DAYS = 30;
-/** A local root outlives many leaves — it is the anchor an operator trusts. */
-var CA_VALIDITY_DAYS = 3650;
-var MS_PER_DAY = 864e5;
-/** Reasons that invalidate the root as well as the leaf. */
-var REASONS_REQUIRING_NEW_CA = [
-	"missing",
-	"unreadable",
-	"no-local-ca",
-	"ca-expiring"
-];
-function reasonRequiresNewCa(reason) {
-	return REASONS_REQUIRING_NEW_CA.includes(reason);
-}
-function parse$1(pem) {
-	try {
-		return new node_crypto.X509Certificate(pem);
-	} catch {
-		return null;
-	}
-}
-function daysBetween(from, to) {
-	return (to.getTime() - from.getTime()) / MS_PER_DAY;
-}
-function hasServerAuthEku(leaf) {
-	const eku = leaf.keyUsage;
-	return eku !== void 0 && eku.length === 1 && eku[0] === "1.3.6.1.5.5.7.3.1";
-}
-function keyMatches(leaf, keyPem) {
-	try {
-		return leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem));
-	} catch {
-		return false;
-	}
-}
-function coversIdentity(leaf, identity) {
-	for (const name of identity.requiredDnsNames) if (leaf.checkHost(name) === void 0) return false;
-	for (const ip of identity.requiredIpAddresses) if (leaf.checkIP(ip) === void 0) return false;
-	return true;
-}
-/**
-* `null` when the material on disk is fit to keep serving.
-*
-* Order matters only for the quality of the reported reason; any
-* non-null answer produces the same action.
-*/
-function evaluateExistingCert(input) {
-	const leaf = parse$1(input.chainPem);
-	const ca = parse$1(input.caPem);
-	if (leaf === null || ca === null) return "unreadable";
-	if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
-	if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
-	if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
-	if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
-	if (leaf.ca || !leaf.checkIssued(ca) || !leaf.verify(ca.publicKey)) return "not-issued-by-local-ca";
-	if (daysBetween(new Date(leaf.validFrom), new Date(leaf.validTo)) > 398) return "validity-too-long";
-	if (!coversIdentity(leaf, input.identity)) return "san-coverage-gap";
-	return null;
-}
-//#endregion
-//#region src/tls/cert-identity.ts
-/**
-* What names and addresses the hub's certificate has to answer for.
-*
-* Split out of `cert-manager.ts` because it is pure and because the
-* regeneration rule (D227) is decided entirely by the difference between
-* *this* and what the certificate on disk already carries.
-*/
-/**
-* Interfaces whose addresses are certified but never gate a reissue:
-* container bridges, VPN tunnels and mesh overlays hand out addresses
-* that change without the hub moving.
-*/
-var VOLATILE_INTERFACE_PREFIXES = [
-	"docker",
-	"br-",
-	"veth",
-	"virbr",
-	"cni",
-	"flannel",
-	"tun",
-	"utun",
-	"tap",
-	"wg",
-	"zt",
-	"tailscale",
-	"ppp",
-	"awdl",
-	"llw"
-];
-/** A DNS name we are willing to hand to openssl. */
-var DNS_NAME_PATTERN = /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/;
-function isIpv4(value) {
-	return (0, node_net.isIP)(value) === 4;
-}
-function isIpv6(value) {
-	return (0, node_net.isIP)(value) === 6;
-}
-/**
-* `fe80::/10` and `169.254.0.0/16`. An IPv6 link-local address needs a
-* zone index to be usable and a SAN cannot carry one, so such an entry
-* can never match anything — it is noise that makes the certificate look
-* broader than it is.
-*/
-function isLinkLocal(value) {
-	if (isIpv4(value)) return value.startsWith("169.254.");
-	if (!isIpv6(value)) return false;
-	const firstGroup = value.split(":")[0] ?? "";
-	if (firstGroup === "") return false;
-	const parsed = Number.parseInt(firstGroup, 16);
-	return Number.isFinite(parsed) && (parsed & 65472) === 65152;
-}
-/** `fc00::/7` — the IPv6 range that behaves like RFC 1918 does for v4. */
-function isUniqueLocalIpv6(value) {
-	if (!isIpv6(value)) return false;
-	const firstGroup = value.split(":")[0] ?? "";
-	const parsed = Number.parseInt(firstGroup, 16);
-	return Number.isFinite(parsed) && (parsed & 65024) === 64512;
-}
-function isVolatileInterface(name) {
-	const lower = name.toLowerCase();
-	return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
-}
-/**
-* A global-scope IPv6 address is NOT a stable identity: SLAAC privacy
-* extensions rotate temporary addresses roughly daily, and `os` gives us
-* no way to tell a temporary address from a permanent one. Gating on
-* one would reissue the certificate every day.
-*/
-function isStableGateAddress(address) {
-	if (isLinkLocal(address)) return false;
-	if (isIpv4(address)) return true;
-	return isUniqueLocalIpv6(address);
-}
-function addSan(dns, ips, value) {
-	const trimmed = value.trim();
-	if (trimmed === "") return;
-	if ((0, node_net.isIP)(trimmed) !== 0) {
-		if (!isLinkLocal(trimmed)) ips.add(trimmed);
-		return;
-	}
-	if (DNS_NAME_PATTERN.test(trimmed)) dns.add(trimmed);
-}
-/**
-* Snapshot the machine's identity. Called once per `ensureTlsCert`; the
-* result is both the SAN list for a new leaf and the yardstick the
-* existing leaf is measured against.
-*/
-function collectCertIdentity(options) {
-	const dnsNames = /* @__PURE__ */ new Set();
-	const ipAddresses = new Set(["127.0.0.1", "::1"]);
-	const requiredDnsNames = /* @__PURE__ */ new Set();
-	const requiredIpAddresses = new Set(["127.0.0.1"]);
-	for (const name of [
-		"localhost",
-		options.commonName,
-		node_os.hostname()
-	]) {
-		addSan(dnsNames, ipAddresses, name);
-		addSan(requiredDnsNames, requiredIpAddresses, name);
-	}
-	for (const [ifaceName, addrs] of Object.entries(node_os.networkInterfaces())) for (const addr of addrs ?? []) {
-		if (addr.internal) continue;
-		if (isLinkLocal(addr.address)) continue;
-		ipAddresses.add(addr.address);
-		if (isVolatileInterface(ifaceName)) continue;
-		if (isStableGateAddress(addr.address)) requiredIpAddresses.add(addr.address);
-	}
-	for (const san of options.extraSans) {
-		addSan(dnsNames, ipAddresses, san);
-		addSan(requiredDnsNames, requiredIpAddresses, san);
-	}
-	return {
-		dnsNames: [...dnsNames],
-		ipAddresses: [...ipAddresses],
-		requiredDnsNames: [...requiredDnsNames],
-		requiredIpAddresses: [...requiredIpAddresses]
-	};
-}
-//#endregion
-//#region src/tls/cert-openssl.ts
-/**
-* The openssl invocations. Isolated so `cert-manager.ts` reads as policy
-* and this file reads as mechanics.
-*/
-var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
-/** Subject of the local root. Distinct from the leaf's CN by construction. */
-var CA_COMMON_NAME = "CamStack Local CA";
-function sanValue(identity) {
-	const parts = [];
-	for (const dns of identity.dnsNames) parts.push(`DNS:${dns}`);
-	for (const ip of identity.ipAddresses) if ((0, node_net.isIP)(ip) !== 0) parts.push(`IP:${ip}`);
-	return parts.join(",");
-}
-/**
-* A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
-* else, and **no EKU** — Apple rejects an anchor asserting
-* `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
-*/
-async function generateCa(tmpDir) {
-	const caCertPath = (0, node_path.join)(tmpDir, "ca.crt");
-	const caKeyPath = (0, node_path.join)(tmpDir, "ca.key");
-	await execFileAsync$3("openssl", [
-		"req",
-		"-x509",
-		"-newkey",
-		"rsa:2048",
-		"-nodes",
-		"-sha256",
-		"-days",
-		String(CA_VALIDITY_DAYS),
-		"-keyout",
-		caKeyPath,
-		"-out",
-		caCertPath,
-		"-subj",
-		`/CN=${CA_COMMON_NAME}`,
-		"-addext",
-		"basicConstraints=critical,CA:TRUE,pathlen:0",
-		"-addext",
-		"keyUsage=critical,keyCertSign,cRLSign",
-		"-addext",
-		"subjectKeyIdentifier=hash"
-	]);
-	await (0, node_fs_promises.chmod)(caKeyPath, 384);
-	return {
-		caCertPath,
-		caKeyPath
-	};
-}
-/**
-* A server leaf signed by the local root: `CA:FALSE`, and
-* `extendedKeyUsage=serverAuth` — not `anyExtendedKeyUsage`, which
-* Apple's `testAppTrustRoot_AnyEKU_AfterJul2019` asserts must fail.
-*/
-async function issueLeaf(tmpDir, ca, identity, commonName, validDays) {
-	const keyPath = (0, node_path.join)(tmpDir, "leaf.key");
-	const csrPath = (0, node_path.join)(tmpDir, "leaf.csr");
-	const certPath = (0, node_path.join)(tmpDir, "leaf.crt");
-	const extPath = (0, node_path.join)(tmpDir, "leaf.ext");
-	await (0, node_fs_promises.writeFile)(extPath, [
-		"basicConstraints=critical,CA:FALSE",
-		"keyUsage=critical,digitalSignature,keyEncipherment",
-		"extendedKeyUsage=serverAuth",
-		"subjectKeyIdentifier=hash",
-		"authorityKeyIdentifier=keyid,issuer",
-		`subjectAltName=${sanValue(identity)}`,
-		""
-	].join("\n"), "utf-8");
-	await execFileAsync$3("openssl", [
-		"req",
-		"-new",
-		"-newkey",
-		"rsa:2048",
-		"-nodes",
-		"-sha256",
-		"-keyout",
-		keyPath,
-		"-out",
-		csrPath,
-		"-subj",
-		`/CN=${commonName}`
-	]);
-	await execFileAsync$3("openssl", [
-		"x509",
-		"-req",
-		"-in",
-		csrPath,
-		"-CA",
-		ca.caCertPath,
-		"-CAkey",
-		ca.caKeyPath,
-		"-set_serial",
-		`0x00${(0, node_crypto.randomBytes)(16).toString("hex")}`,
-		"-days",
-		String(validDays),
-		"-sha256",
-		"-extfile",
-		extPath,
-		"-out",
-		certPath
-	]);
-	await (0, node_fs_promises.chmod)(keyPath, 384);
-	await (0, node_fs_promises.rm)(csrPath, { force: true });
-	await (0, node_fs_promises.rm)(extPath, { force: true });
-	return {
-		certPath,
-		keyPath
-	};
-}
-//#endregion
-//#region src/tls/cert-manager.ts
-var DEFAULT_COMMON_NAME = "camstack.local";
-/**
-* Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
-* a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
-* chained to it (`camstack.crt` = leaf + root, `camstack.key`).
-*
-* ## The regeneration rule (D227)
-*
-* Reissue happens when, and only when, the material on disk **cannot do
-* its job**:
-*
-* - it is absent, unreadable, or the key does not match the certificate;
-* - the root is absent (every pre-2026-08 install: one self-signed
-*   `CA:TRUE` leaf and no root) or is inside its renewal window;
-* - the leaf is inside its 30-day renewal window;
-* - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
-*   rejects an app-supplied anchor without it;
-* - the leaf is not actually issued by the root on disk;
-* - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
-* - **a name or address the hub must answer for is missing from the SAN
-*   list** — a DHCP move, a new interface or a new hostname.
-*
-* And explicitly NOT when: the certificate names an address the machine
-* no longer has (a superset still works — the check is one-directional),
-* a volatile interface (docker/VPN/mesh) or a global-scope IPv6 address
-* changed (SLAAC privacy addresses rotate daily), or a new build shipped.
-*
-* Every trigger is derived from the files plus the machine, so once a
-* reissue clears them it clears them for good: the next boot returns
-* `generated: false`. A certificate that moved on every boot would
-* invalidate every trust an operator granted by hand — worse than the
-* bugs this rule fixes.
-*
-* **The root is rotated only for root-level reasons.** SAN drift rotates
-* the leaf alone, so trust granted to `camstack-ca.crt` survives every
-* address change the hub will ever see.
-*/
-async function ensureTlsCert(dataDir, options) {
-	const tlsDir = (0, node_path.join)(dataDir, "tls");
-	const paths = {
-		certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
-		keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
-		caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
-		caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
-	};
-	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
-	const validDays = Math.min(options?.validDays ?? 397, 397);
-	const identity = collectCertIdentity({
-		commonName,
-		extraSans: options?.extraSans ?? []
-	});
-	const reason = decideRegeneration(paths, identity);
-	if (reason === null) return describe(paths, false, null, false, null);
-	const previousFingerprint = readFingerprint(paths.certPath);
-	const caRotated = reasonRequiresNewCa(reason);
-	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
-	await regenerate(paths, identity, commonName, validDays, caRotated);
-	return describe(paths, true, reason, caRotated, previousFingerprint);
-}
-/** Fingerprint of whatever is on disk, or `null` if there is nothing readable. */
-function readFingerprint(certPath) {
-	try {
-		return new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath)).fingerprint256;
-	} catch {
-		return null;
-	}
-}
-function decideRegeneration(paths, identity) {
-	if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return "missing";
-	if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return "no-local-ca";
-	try {
-		return evaluateExistingCert({
-			chainPem: (0, node_fs.readFileSync)(paths.certPath, "utf-8"),
-			keyPem: (0, node_fs.readFileSync)(paths.keyPath, "utf-8"),
-			caPem: (0, node_fs.readFileSync)(paths.caCertPath, "utf-8"),
-			identity,
-			now: /* @__PURE__ */ new Date()
-		});
-	} catch {
-		return "unreadable";
-	}
-}
-/**
-* Build every file in a scratch directory, then move them into place.
-* A crash mid-way leaves the previous material untouched; a crash
-* between the moves leaves a key/certificate mismatch, which the
-* evaluator reports as `key-mismatch` and heals on the next boot.
-*/
-async function regenerate(paths, identity, commonName, validDays, newCa) {
-	const scratch = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "camstack-tls-"));
-	try {
-		const ca = newCa ? await generateCa(scratch) : {
-			caCertPath: paths.caCertPath,
-			caKeyPath: paths.caKeyPath
-		};
-		const leaf = await issueLeaf(scratch, ca, identity, commonName, validDays);
-		const chainPath = (0, node_path.join)(scratch, "chain.crt");
-		await (0, node_fs_promises.writeFile)(chainPath, `${(0, node_fs.readFileSync)(leaf.certPath, "utf-8").trimEnd()}\n${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}\n`, "utf-8");
-		if (newCa) {
-			await (0, node_fs_promises.copyFile)(ca.caCertPath, `${paths.caCertPath}.new`);
-			await (0, node_fs_promises.copyFile)(ca.caKeyPath, `${paths.caKeyPath}.new`);
-			(0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
-			(0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
-			await (0, node_fs_promises.chmod)(paths.caKeyPath, 384);
-		}
-		await (0, node_fs_promises.copyFile)(leaf.keyPath, `${paths.keyPath}.new`);
-		await (0, node_fs_promises.copyFile)(chainPath, `${paths.certPath}.new`);
-		(0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
-		(0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
-		await (0, node_fs_promises.chmod)(paths.keyPath, 384);
-	} finally {
-		await (0, node_fs_promises.rm)(scratch, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-function describe(paths, generated, reason, caRotated, previousFingerprintSha256) {
-	const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
-	const ca = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath));
-	const san = leaf.subjectAltName ?? "";
-	return {
-		...paths,
-		generated,
-		reason,
-		caRotated,
-		fingerprintSha256: leaf.fingerprint256,
-		previousFingerprintSha256,
-		caFingerprintSha256: ca.fingerprint256,
-		validTo: new Date(leaf.validTo).toISOString(),
-		sans: san === "" ? [] : san.split(", ")
-	};
-}
-/**
-* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
-* options. `certPath` is a full chain, so the listener presents the local
-* root alongside the leaf.
-*/
-function loadTlsCert(certPath, keyPath) {
-	return {
-		cert: (0, node_fs.readFileSync)(certPath),
-		key: (0, node_fs.readFileSync)(keyPath)
-	};
-}
-//#endregion
 //#region src/builtins/sqlite-storage/integration-registry.ts
 function serializeSetting(value) {
 	if (typeof value === "number") return {
@@ -95294,8 +94838,8 @@ exports.AddonRouteRegistry = AddonRouteRegistry;
 exports.AlertCenterAddon = require_builtins_alerts_alerts_addon.AlertCenterAddon;
 exports.ApiKeyManager = require_builtins_local_auth_local_auth_addon.ApiKeyManager;
 exports.AuthManager = require_builtins_local_auth_local_auth_addon.AuthManager;
-exports.CA_COMMON_NAME = CA_COMMON_NAME;
-exports.CA_VALIDITY_DAYS = CA_VALIDITY_DAYS;
+exports.CA_COMMON_NAME = require_lan_http_bind.CA_COMMON_NAME;
+exports.CA_VALIDITY_DAYS = require_lan_http_bind.CA_VALIDITY_DAYS;
 exports.CLUSTER_SECRET_MISMATCH_TYPE = CLUSTER_SECRET_MISMATCH_TYPE;
 exports.CLUSTER_SECRET_REJECTED_EXIT_CODE = CLUSTER_SECRET_REJECTED_EXIT_CODE;
 exports.CORE_CAP_SERVICE_NAME = CORE_CAP_SERVICE_NAME;
@@ -95312,6 +94856,7 @@ exports.ConsoleLoggingAddon = require_builtins_console_logging_index.ConsoleLogg
 exports.CoreBlocksAddon = require_builtins_core_blocks_core_blocks_addon.CoreBlocksAddon;
 exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
 exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
+exports.DEFAULT_LAN_HTTP_PORT = require_lan_http_bind.DEFAULT_LAN_HTTP_PORT;
 exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_dist.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
 exports.DEVICE_STATUS_METHOD = require_dist.DEVICE_STATUS_METHOD;
 exports.DataPlaneRegistry = DataPlaneRegistry;
@@ -95342,7 +94887,7 @@ exports.HubNodeRegistry = HubNodeRegistry;
 exports.INFRA_CAPABILITIES = INFRA_CAPABILITIES;
 exports.IntegrationRegistry = IntegrationRegistry;
 exports.JobJournal = JobJournal;
-exports.LEAF_RENEWAL_WINDOW_DAYS = LEAF_RENEWAL_WINDOW_DAYS;
+exports.LEAF_RENEWAL_WINDOW_DAYS = require_lan_http_bind.LEAF_RENEWAL_WINDOW_DAYS;
 exports.LifecycleJobEngine = LifecycleJobEngine;
 exports.LifecycleStateMachine = LifecycleStateMachine;
 exports.LivenessMonitorAddon = require_builtins_liveness_monitor_liveness_monitor_addon.LivenessMonitorAddon;
@@ -95353,7 +94898,7 @@ exports.LogManager = LogManager;
 exports.LogRingBuffer = LogRingBuffer;
 exports.LokiDestination = require_builtins_loki_logging_index.LokiDestination$1;
 exports.LokiLoggingAddon = require_builtins_loki_logging_index.LokiLoggingAddon$1;
-exports.MAX_LEAF_VALIDITY_DAYS = MAX_LEAF_VALIDITY_DAYS;
+exports.MAX_LEAF_VALIDITY_DAYS = require_lan_http_bind.MAX_LEAF_VALIDITY_DAYS;
 exports.METHOD_ACCESS_MAP = require_dist.METHOD_ACCESS_MAP;
 exports.ModelDownloadService = require_file_data_plane.ModelDownloadService;
 exports.NATIVE_PROVIDER_SERVICE_INFIX = require_manifest_python_deps.NATIVE_PROVIDER_SERVICE_INFIX;
@@ -95379,7 +94924,7 @@ exports.ReadinessRegistry = require_dist.ReadinessRegistry;
 exports.ReadinessTimeoutError = require_dist.ReadinessTimeoutError;
 exports.ReplEngine = ReplEngine;
 exports.RingBuffer = RingBuffer;
-exports.SERVER_AUTH_OID = SERVER_AUTH_OID;
+exports.SERVER_AUTH_OID = require_lan_http_bind.SERVER_AUTH_OID;
 exports.ScopedLogger = ScopedLogger;
 exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
 exports.SocketChannel = require_manifest_python_deps.SocketChannel;
@@ -95403,6 +94948,9 @@ exports.WinstonLoggingAddon = require_builtins_winston_logging_index.WinstonLogg
 exports.__resetCapUsageRegistryForTests = require_manifest_python_deps.__resetCapUsageRegistryForTests;
 exports.adaptBrokerToCluster = require_manifest_python_deps.adaptBrokerToCluster;
 exports.addonSettingsCapability = require_dist.addonSettingsCapability;
+exports.allFamiliesListenHost = require_lan_http_bind.allFamiliesListenHost;
+exports.applyLanHttp = require_lan_http_bind.applyLanHttp;
+exports.bindPendingLanHttp = require_lan_http_bind.bindPendingLanHttp;
 exports.bootstrapSchema = bootstrapSchema;
 exports.brokerCallForCap = require_manifest_python_deps.brokerCallForCap;
 exports.brokerTransportLink = require_manifest_python_deps.brokerTransportLink;
@@ -95429,9 +94977,10 @@ exports.capServiceName = require_manifest_python_deps.capServiceName;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = require_manifest_python_deps.classifyCapRoute;
 exports.clearPendingRestart = clearPendingRestart;
+exports.closeLanHttp = require_lan_http_bind.closeLanHttp;
 exports.clusterEventTopic = require_manifest_python_deps.clusterEventTopic;
 exports.clusterSecretMatches = clusterSecretMatches;
-exports.collectCertIdentity = collectCertIdentity;
+exports.collectCertIdentity = require_lan_http_bind.collectCertIdentity;
 exports.collectModelFiles = require_file_data_plane.collectModelFiles;
 exports.contentTypeFor = require_file_data_plane.contentTypeFor;
 exports.copyDirRecursive = copyDirRecursive;
@@ -95497,8 +95046,8 @@ Object.defineProperty(exports, "ensurePython", {
 		return _camstack_types_node.ensurePython;
 	}
 });
-exports.ensureTlsCert = ensureTlsCert;
-exports.evaluateExistingCert = evaluateExistingCert;
+exports.ensureTlsCert = require_lan_http_bind.ensureTlsCert;
+exports.evaluateExistingCert = require_lan_http_bind.evaluateExistingCert;
 exports.expandCapMethods = require_dist.expandCapMethods;
 exports.fetchJson = require_file_data_plane.fetchJson;
 Object.defineProperty(exports, "findInPath", {
@@ -95562,7 +95111,7 @@ exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
 exports.isInfraCapability = isInfraCapability;
 exports.isModelDownloaded = require_file_data_plane.isModelDownloaded;
 exports.isSourceNewer = isSourceNewer;
-exports.loadTlsCert = loadTlsCert;
+exports.loadTlsCert = require_lan_http_bind.loadTlsCert;
 exports.localEndpointPath = require_manifest_python_deps.localEndpointPath;
 exports.localProviderLink = require_manifest_python_deps.localProviderLink;
 exports.mountNativeCapService = require_manifest_python_deps.mountNativeCapService;
@@ -95571,9 +95120,15 @@ exports.parseRangeHeader = require_file_data_plane.parseRangeHeader;
 exports.parseTokenizedUrl = require_file_data_plane.parseTokenizedUrl;
 exports.proxyToUpstream = proxyToUpstream;
 exports.quarantineAddonResidue = quarantineAddonResidue;
+exports.readExtraSans = require_lan_http_bind.readExtraSans;
+exports.readLanHttpState = require_lan_http_bind.readLanHttpState;
 exports.readPendingRestart = readPendingRestart;
+exports.readTlsAccessStatus = require_lan_http_bind.readTlsAccessStatus;
+exports.readTlsMode = require_lan_http_bind.readTlsMode;
 exports.readinessKey = require_dist.readinessKey;
 exports.registerEventBusService = require_manifest_python_deps.registerEventBusService;
+exports.registerLanHttpHandler = require_lan_http_bind.registerLanHttpHandler;
+exports.reissueTlsLeaf = require_lan_http_bind.reissueTlsLeaf;
 exports.resolveFilePath = require_file_data_plane.resolveFilePath;
 exports.resolveHwAccel = require_manifest_python_deps.resolveHwAccel;
 exports.resolveNpmInvocation = require_manifest_python_deps.resolveNpmInvocation;
@@ -95594,4 +95149,7 @@ exports.stripCamstackDeps = stripCamstackDeps;
 exports.subscribePassthrough = require_manifest_python_deps.subscribePassthrough;
 exports.udsChildLogToWorkerEntry = require_manifest_python_deps.udsChildLogToWorkerEntry;
 exports.validateProviderRegistrations = require_manifest_python_deps.validateProviderRegistrations;
+exports.validateUploadedTls = require_lan_http_bind.validateUploadedTls;
+exports.writeExtraSans = require_lan_http_bind.writeExtraSans;
 exports.writePendingRestart = writePendingRestart;
+exports.writeTlsMode = require_lan_http_bind.writeTlsMode;