@camstack/system 1.2.115 → 1.2.117

package/dist/lan-http-bind-DmgpFP6_.js

@@ -0,0 +1,890 @@
+const require_chunk = require("./chunk-Cek0wNdY.js");
+let node_crypto = require("node:crypto");
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+let node_child_process = require("node:child_process");
+let node_util = require("node:util");
+let node_os = require("node:os");
+node_os = require_chunk.__toESM(node_os);
+let node_fs = require("node:fs");
+let node_http = require("node:http");
+let node_net = require("node:net");
+//#region src/tls/cert-evaluation.ts
+/**
+* The regeneration rule (D227), as a pure function.
+*
+* `ensureTlsCert` reissues **only** when the material on disk cannot do
+* its job. Never because it is old, never because the machine picked up
+* an address the certificate does not need, never because a new build
+* shipped. The decision is a function of (files on disk, machine
+* identity, clock) alone, so the same inputs always produce the same
+* answer — which is what makes a reissue happen once and then stop.
+*/
+/** OID `id-kp-serverAuth`. Apple's trustd requires it on the leaf. */
+var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+/**
+* Apple's `SecPolicyCheckOtherTrustValidityPeriod` ceiling is 825 days;
+* the CA/Browser Forum's recommended maximum is 397. We sit at 397.
+*/
+var MAX_LEAF_VALIDITY_DAYS = 397;
+/** Reissue this long before the leaf dies, so nobody serves an expired one. */
+var LEAF_RENEWAL_WINDOW_DAYS = 30;
+/** A local root outlives many leaves — it is the anchor an operator trusts. */
+var CA_VALIDITY_DAYS = 3650;
+var MS_PER_DAY = 864e5;
+/** Reasons that invalidate the root as well as the leaf. */
+var REASONS_REQUIRING_NEW_CA = [
+	"missing",
+	"unreadable",
+	"no-local-ca",
+	"ca-expiring"
+];
+function reasonRequiresNewCa(reason) {
+	return REASONS_REQUIRING_NEW_CA.includes(reason);
+}
+function parse(pem) {
+	try {
+		return new node_crypto.X509Certificate(pem);
+	} catch {
+		return null;
+	}
+}
+function daysBetween(from, to) {
+	return (to.getTime() - from.getTime()) / MS_PER_DAY;
+}
+function hasServerAuthEku(leaf) {
+	const eku = leaf.keyUsage;
+	return eku !== void 0 && eku.length === 1 && eku[0] === "1.3.6.1.5.5.7.3.1";
+}
+function keyMatches(leaf, keyPem) {
+	try {
+		return leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem));
+	} catch {
+		return false;
+	}
+}
+function coversIdentity(leaf, identity) {
+	for (const name of identity.requiredDnsNames) if (leaf.checkHost(name) === void 0) return false;
+	for (const ip of identity.requiredIpAddresses) if (leaf.checkIP(ip) === void 0) return false;
+	return true;
+}
+/**
+* `null` when the material on disk is fit to keep serving.
+*
+* Order matters only for the quality of the reported reason; any
+* non-null answer produces the same action.
+*/
+function evaluateExistingCert(input) {
+	const leaf = parse(input.chainPem);
+	const ca = parse(input.caPem);
+	if (leaf === null || ca === null) return "unreadable";
+	if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
+	if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
+	if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
+	if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
+	if (leaf.ca || !leaf.checkIssued(ca) || !leaf.verify(ca.publicKey)) return "not-issued-by-local-ca";
+	if (daysBetween(new Date(leaf.validFrom), new Date(leaf.validTo)) > 398) return "validity-too-long";
+	if (!coversIdentity(leaf, input.identity)) return "san-coverage-gap";
+	return null;
+}
+//#endregion
+//#region src/tls/cert-identity.ts
+/**
+* What names and addresses the hub's certificate has to answer for.
+*
+* Split out of `cert-manager.ts` because it is pure and because the
+* regeneration rule (D227) is decided entirely by the difference between
+* *this* and what the certificate on disk already carries.
+*/
+/**
+* Interfaces whose addresses are certified but never gate a reissue:
+* container bridges, VPN tunnels and mesh overlays hand out addresses
+* that change without the hub moving.
+*/
+var VOLATILE_INTERFACE_PREFIXES = [
+	"docker",
+	"br-",
+	"veth",
+	"virbr",
+	"cni",
+	"flannel",
+	"tun",
+	"utun",
+	"tap",
+	"wg",
+	"zt",
+	"tailscale",
+	"ppp",
+	"awdl",
+	"llw"
+];
+/** A DNS name we are willing to hand to openssl. */
+var DNS_NAME_PATTERN = /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+function isIpv4(value) {
+	return (0, node_net.isIP)(value) === 4;
+}
+function isIpv6(value) {
+	return (0, node_net.isIP)(value) === 6;
+}
+/**
+* `fe80::/10` and `169.254.0.0/16`. An IPv6 link-local address needs a
+* zone index to be usable and a SAN cannot carry one, so such an entry
+* can never match anything — it is noise that makes the certificate look
+* broader than it is.
+*/
+function isLinkLocal(value) {
+	if (isIpv4(value)) return value.startsWith("169.254.");
+	if (!isIpv6(value)) return false;
+	const firstGroup = value.split(":")[0] ?? "";
+	if (firstGroup === "") return false;
+	const parsed = Number.parseInt(firstGroup, 16);
+	return Number.isFinite(parsed) && (parsed & 65472) === 65152;
+}
+/** `fc00::/7` — the IPv6 range that behaves like RFC 1918 does for v4. */
+function isUniqueLocalIpv6(value) {
+	if (!isIpv6(value)) return false;
+	const firstGroup = value.split(":")[0] ?? "";
+	const parsed = Number.parseInt(firstGroup, 16);
+	return Number.isFinite(parsed) && (parsed & 65024) === 64512;
+}
+function isVolatileInterface(name) {
+	const lower = name.toLowerCase();
+	return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+/**
+* A global-scope IPv6 address is NOT a stable identity: SLAAC privacy
+* extensions rotate temporary addresses roughly daily, and `os` gives us
+* no way to tell a temporary address from a permanent one. Gating on
+* one would reissue the certificate every day.
+*/
+function isStableGateAddress(address) {
+	if (isLinkLocal(address)) return false;
+	if (isIpv4(address)) return true;
+	return isUniqueLocalIpv6(address);
+}
+function addSan(dns, ips, value) {
+	const trimmed = value.trim();
+	if (trimmed === "") return;
+	if ((0, node_net.isIP)(trimmed) !== 0) {
+		if (!isLinkLocal(trimmed)) ips.add(trimmed);
+		return;
+	}
+	if (DNS_NAME_PATTERN.test(trimmed)) dns.add(trimmed);
+}
+/**
+* Snapshot the machine's identity. Called once per `ensureTlsCert`; the
+* result is both the SAN list for a new leaf and the yardstick the
+* existing leaf is measured against.
+*/
+function collectCertIdentity(options) {
+	const dnsNames = /* @__PURE__ */ new Set();
+	const ipAddresses = new Set(["127.0.0.1", "::1"]);
+	const requiredDnsNames = /* @__PURE__ */ new Set();
+	const requiredIpAddresses = new Set(["127.0.0.1"]);
+	for (const name of [
+		"localhost",
+		options.commonName,
+		node_os.hostname()
+	]) {
+		addSan(dnsNames, ipAddresses, name);
+		addSan(requiredDnsNames, requiredIpAddresses, name);
+	}
+	for (const [ifaceName, addrs] of Object.entries(node_os.networkInterfaces())) for (const addr of addrs ?? []) {
+		if (addr.internal) continue;
+		if (isLinkLocal(addr.address)) continue;
+		ipAddresses.add(addr.address);
+		if (isVolatileInterface(ifaceName)) continue;
+		if (isStableGateAddress(addr.address)) requiredIpAddresses.add(addr.address);
+	}
+	for (const san of options.extraSans) {
+		addSan(dnsNames, ipAddresses, san);
+		addSan(requiredDnsNames, requiredIpAddresses, san);
+	}
+	return {
+		dnsNames: [...dnsNames],
+		ipAddresses: [...ipAddresses],
+		requiredDnsNames: [...requiredDnsNames],
+		requiredIpAddresses: [...requiredIpAddresses]
+	};
+}
+//#endregion
+//#region src/tls/cert-openssl.ts
+/**
+* The openssl invocations. Isolated so `cert-manager.ts` reads as policy
+* and this file reads as mechanics.
+*/
+var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+/** Subject of the local root. Distinct from the leaf's CN by construction. */
+var CA_COMMON_NAME = "CamStack Local CA";
+function sanValue(identity) {
+	const parts = [];
+	for (const dns of identity.dnsNames) parts.push(`DNS:${dns}`);
+	for (const ip of identity.ipAddresses) if ((0, node_net.isIP)(ip) !== 0) parts.push(`IP:${ip}`);
+	return parts.join(",");
+}
+/**
+* A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
+* else, and **no EKU** — Apple rejects an anchor asserting
+* `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
+*/
+async function generateCa(tmpDir) {
+	const caCertPath = (0, node_path.join)(tmpDir, "ca.crt");
+	const caKeyPath = (0, node_path.join)(tmpDir, "ca.key");
+	await execFileAsync("openssl", [
+		"req",
+		"-x509",
+		"-newkey",
+		"rsa:2048",
+		"-nodes",
+		"-sha256",
+		"-days",
+		String(CA_VALIDITY_DAYS),
+		"-keyout",
+		caKeyPath,
+		"-out",
+		caCertPath,
+		"-subj",
+		`/CN=${CA_COMMON_NAME}`,
+		"-addext",
+		"basicConstraints=critical,CA:TRUE,pathlen:0",
+		"-addext",
+		"keyUsage=critical,keyCertSign,cRLSign",
+		"-addext",
+		"subjectKeyIdentifier=hash"
+	]);
+	await (0, node_fs_promises.chmod)(caKeyPath, 384);
+	return {
+		caCertPath,
+		caKeyPath
+	};
+}
+/**
+* A server leaf signed by the local root: `CA:FALSE`, and
+* `extendedKeyUsage=serverAuth` — not `anyExtendedKeyUsage`, which
+* Apple's `testAppTrustRoot_AnyEKU_AfterJul2019` asserts must fail.
+*/
+async function issueLeaf(tmpDir, ca, identity, commonName, validDays) {
+	const keyPath = (0, node_path.join)(tmpDir, "leaf.key");
+	const csrPath = (0, node_path.join)(tmpDir, "leaf.csr");
+	const certPath = (0, node_path.join)(tmpDir, "leaf.crt");
+	const extPath = (0, node_path.join)(tmpDir, "leaf.ext");
+	await (0, node_fs_promises.writeFile)(extPath, [
+		"basicConstraints=critical,CA:FALSE",
+		"keyUsage=critical,digitalSignature,keyEncipherment",
+		"extendedKeyUsage=serverAuth",
+		"subjectKeyIdentifier=hash",
+		"authorityKeyIdentifier=keyid,issuer",
+		`subjectAltName=${sanValue(identity)}`,
+		""
+	].join("\n"), "utf-8");
+	await execFileAsync("openssl", [
+		"req",
+		"-new",
+		"-newkey",
+		"rsa:2048",
+		"-nodes",
+		"-sha256",
+		"-keyout",
+		keyPath,
+		"-out",
+		csrPath,
+		"-subj",
+		`/CN=${commonName}`
+	]);
+	await execFileAsync("openssl", [
+		"x509",
+		"-req",
+		"-in",
+		csrPath,
+		"-CA",
+		ca.caCertPath,
+		"-CAkey",
+		ca.caKeyPath,
+		"-set_serial",
+		`0x00${(0, node_crypto.randomBytes)(16).toString("hex")}`,
+		"-days",
+		String(validDays),
+		"-sha256",
+		"-extfile",
+		extPath,
+		"-out",
+		certPath
+	]);
+	await (0, node_fs_promises.chmod)(keyPath, 384);
+	await (0, node_fs_promises.rm)(csrPath, { force: true });
+	await (0, node_fs_promises.rm)(extPath, { force: true });
+	return {
+		certPath,
+		keyPath
+	};
+}
+//#endregion
+//#region src/tls/cert-manager.ts
+var DEFAULT_COMMON_NAME = "camstack.local";
+/**
+* Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
+* a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
+* chained to it (`camstack.crt` = leaf + root, `camstack.key`).
+*
+* ## The regeneration rule (D227)
+*
+* Reissue happens when, and only when, the material on disk **cannot do
+* its job**:
+*
+* - it is absent, unreadable, or the key does not match the certificate;
+* - the root is absent (every pre-2026-08 install: one self-signed
+*   `CA:TRUE` leaf and no root) or is inside its renewal window;
+* - the leaf is inside its 30-day renewal window;
+* - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
+*   rejects an app-supplied anchor without it;
+* - the leaf is not actually issued by the root on disk;
+* - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
+* - **a name or address the hub must answer for is missing from the SAN
+*   list** — a DHCP move, a new interface or a new hostname.
+*
+* And explicitly NOT when: the certificate names an address the machine
+* no longer has (a superset still works — the check is one-directional),
+* a volatile interface (docker/VPN/mesh) or a global-scope IPv6 address
+* changed (SLAAC privacy addresses rotate daily), or a new build shipped.
+*
+* Every trigger is derived from the files plus the machine, so once a
+* reissue clears them it clears them for good: the next boot returns
+* `generated: false`. A certificate that moved on every boot would
+* invalidate every trust an operator granted by hand — worse than the
+* bugs this rule fixes.
+*
+* **The root is rotated only for root-level reasons.** SAN drift rotates
+* the leaf alone, so trust granted to `camstack-ca.crt` survives every
+* address change the hub will ever see.
+*/
+async function ensureTlsCert(dataDir, options) {
+	const tlsDir = (0, node_path.join)(dataDir, "tls");
+	const paths = {
+		certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
+		keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
+		caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
+		caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
+	};
+	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+	const validDays = Math.min(options?.validDays ?? 397, 397);
+	const identity = collectCertIdentity({
+		commonName,
+		extraSans: options?.extraSans ?? []
+	});
+	const reason = decideRegeneration(paths, identity);
+	if (reason === null) return describe(paths, false, null, false, null, null);
+	const previousFingerprint = readFingerprint(paths.certPath);
+	const caRotated = reasonRequiresNewCa(reason);
+	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
+	try {
+		await regenerate(paths, identity, commonName, validDays, caRotated);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		if (!canKeepServing(paths)) throw err;
+		return describe(paths, false, null, false, null, message);
+	}
+	return describe(paths, true, reason, caRotated, previousFingerprint, null);
+}
+/**
+* Operator "Regenerate": issue a new leaf under the existing local CA.
+* Never rotates the root — trust granted to `camstack-ca.crt` survives.
+*/
+async function reissueTlsLeaf(dataDir, options) {
+	const tlsDir = (0, node_path.join)(dataDir, "tls");
+	const paths = {
+		certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
+		keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
+		caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
+		caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
+	};
+	if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return ensureTlsCert(dataDir, options);
+	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+	const validDays = Math.min(options?.validDays ?? 397, 397);
+	const identity = collectCertIdentity({
+		commonName,
+		extraSans: options?.extraSans ?? []
+	});
+	const previousFingerprint = readFingerprint(paths.certPath);
+	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
+	await regenerate(paths, identity, commonName, validDays, false);
+	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null);
+}
+/** True when the material already on disk can still terminate TLS. */
+function canKeepServing(paths) {
+	if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return false;
+	if (!(0, node_fs.existsSync)(paths.caCertPath)) return false;
+	return readFingerprint(paths.certPath) !== null;
+}
+/** Fingerprint of whatever is on disk, or `null` if there is nothing readable. */
+function readFingerprint(certPath) {
+	try {
+		return new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath)).fingerprint256;
+	} catch {
+		return null;
+	}
+}
+function decideRegeneration(paths, identity) {
+	if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return "missing";
+	if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return "no-local-ca";
+	try {
+		return evaluateExistingCert({
+			chainPem: (0, node_fs.readFileSync)(paths.certPath, "utf-8"),
+			keyPem: (0, node_fs.readFileSync)(paths.keyPath, "utf-8"),
+			caPem: (0, node_fs.readFileSync)(paths.caCertPath, "utf-8"),
+			identity,
+			now: /* @__PURE__ */ new Date()
+		});
+	} catch {
+		return "unreadable";
+	}
+}
+/**
+* Build every file in a scratch directory, then move them into place.
+* A crash mid-way leaves the previous material untouched; a crash
+* between the moves leaves a key/certificate mismatch, which the
+* evaluator reports as `key-mismatch` and heals on the next boot.
+*/
+async function regenerate(paths, identity, commonName, validDays, newCa) {
+	const scratch = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "camstack-tls-"));
+	try {
+		const ca = newCa ? await generateCa(scratch) : {
+			caCertPath: paths.caCertPath,
+			caKeyPath: paths.caKeyPath
+		};
+		const leaf = await issueLeaf(scratch, ca, identity, commonName, validDays);
+		const chainPath = (0, node_path.join)(scratch, "chain.crt");
+		await (0, node_fs_promises.writeFile)(chainPath, `${(0, node_fs.readFileSync)(leaf.certPath, "utf-8").trimEnd()}\n${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}\n`, "utf-8");
+		if (newCa) {
+			await (0, node_fs_promises.copyFile)(ca.caCertPath, `${paths.caCertPath}.new`);
+			await (0, node_fs_promises.copyFile)(ca.caKeyPath, `${paths.caKeyPath}.new`);
+			(0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
+			(0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
+			await (0, node_fs_promises.chmod)(paths.caKeyPath, 384);
+		}
+		await (0, node_fs_promises.copyFile)(leaf.keyPath, `${paths.keyPath}.new`);
+		await (0, node_fs_promises.copyFile)(chainPath, `${paths.certPath}.new`);
+		(0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
+		(0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
+		await (0, node_fs_promises.chmod)(paths.keyPath, 384);
+	} finally {
+		await (0, node_fs_promises.rm)(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
+	const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
+	const ca = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath));
+	const san = leaf.subjectAltName ?? "";
+	return {
+		...paths,
+		generated,
+		reason,
+		caRotated,
+		fingerprintSha256: leaf.fingerprint256,
+		previousFingerprintSha256,
+		caFingerprintSha256: ca.fingerprint256,
+		validTo: new Date(leaf.validTo).toISOString(),
+		sans: san === "" ? [] : san.split(", "),
+		reissueError
+	};
+}
+/**
+* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
+* options. `certPath` is a full chain, so the listener presents the local
+* root alongside the leaf.
+*/
+function loadTlsCert(certPath, keyPath) {
+	return {
+		cert: (0, node_fs.readFileSync)(certPath),
+		key: (0, node_fs.readFileSync)(keyPath)
+	};
+}
+//#endregion
+//#region src/tls/uploaded-cert.ts
+/**
+* Operator-supplied material must parse, match its key, and carry
+* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
+* to keep generating.
+*/
+function validateUploadedTls(certPem, keyPem) {
+	let leaf;
+	try {
+		leaf = new node_crypto.X509Certificate(certPem);
+	} catch {
+		return {
+			ok: false,
+			error: "Certificate PEM could not be parsed."
+		};
+	}
+	try {
+		if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem))) return {
+			ok: false,
+			error: "Private key does not match the certificate."
+		};
+	} catch {
+		return {
+			ok: false,
+			error: "Private key PEM could not be parsed."
+		};
+	}
+	const eku = leaf.keyUsage;
+	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
+		ok: false,
+		error: "Certificate is missing extendedKeyUsage = serverAuth."
+	};
+	return {
+		ok: true,
+		fingerprintSha256: leaf.fingerprint256,
+		validTo: new Date(leaf.validTo).toISOString()
+	};
+}
+//#endregion
+//#region src/tls/tls-status.ts
+function tlsDir(dataDir) {
+	return (0, node_path.join)(dataDir, "tls");
+}
+function readTlsMode(dataDir) {
+	const marker = (0, node_path.join)(tlsDir(dataDir), "mode");
+	if ((0, node_fs.existsSync)(marker)) {
+		const raw = (0, node_fs.readFileSync)(marker, "utf-8").trim();
+		if (raw === "uploaded") return "uploaded";
+		if (raw === "disabled") return "disabled";
+	}
+	return (0, node_fs.existsSync)((0, node_path.join)(tlsDir(dataDir), "camstack.crt")) ? "generated" : "disabled";
+}
+function writeTlsMode(dataDir, mode) {
+	(0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
+	(0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "mode"), `${mode}\n`, "utf-8");
+}
+function readExtraSans(dataDir) {
+	const path = (0, node_path.join)(tlsDir(dataDir), "extra-sans.json");
+	if (!(0, node_fs.existsSync)(path)) return [];
+	try {
+		const parsed = JSON.parse((0, node_fs.readFileSync)(path, "utf-8"));
+		if (!Array.isArray(parsed)) return [];
+		return parsed.filter((entry) => typeof entry === "string" && entry.length > 0);
+	} catch {
+		return [];
+	}
+}
+function writeExtraSans(dataDir, sans) {
+	(0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
+	(0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}\n`, "utf-8");
+}
+function readTlsAccessStatus(dataDir, restartRequired = false) {
+	const dir = tlsDir(dataDir);
+	const certPath = (0, node_path.join)(dir, "camstack.crt");
+	const caPath = (0, node_path.join)(dir, "camstack-ca.crt");
+	const mode = readTlsMode(dataDir);
+	if (!(0, node_fs.existsSync)(certPath)) return {
+		mode: "disabled",
+		leafFingerprintSha256: null,
+		caFingerprintSha256: null,
+		validTo: null,
+		sans: [],
+		caCertPem: (0, node_fs.existsSync)(caPath) ? (0, node_fs.readFileSync)(caPath, "utf-8") : null,
+		reissueError: null,
+		restartRequired
+	};
+	try {
+		const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath));
+		const caPem = (0, node_fs.existsSync)(caPath) ? (0, node_fs.readFileSync)(caPath, "utf-8") : null;
+		const ca = caPem !== null ? new node_crypto.X509Certificate(caPem) : null;
+		const san = leaf.subjectAltName ?? "";
+		return {
+			mode,
+			leafFingerprintSha256: leaf.fingerprint256,
+			caFingerprintSha256: ca?.fingerprint256 ?? null,
+			validTo: new Date(leaf.validTo).toISOString(),
+			sans: san === "" ? [] : san.split(", "),
+			caCertPem: caPem,
+			reissueError: null,
+			restartRequired
+		};
+	} catch {
+		return {
+			mode,
+			leafFingerprintSha256: null,
+			caFingerprintSha256: null,
+			validTo: null,
+			sans: [],
+			caCertPem: null,
+			reissueError: "Certificate on disk could not be parsed.",
+			restartRequired
+		};
+	}
+}
+//#endregion
+//#region src/http/lan-http-bind.ts
+/**
+* Second HTTP listener that shares the hub's existing request handler.
+*
+* Fastify is one protocol per instance; HTTPS stays on :4443 and this
+* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
+* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
+*
+* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
+* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
+* hangs because nobody handles the upgrade on this socket.
+*/
+var DEFAULT_HTTP_PORT = 4480;
+var handlers = null;
+var server = null;
+var pending = null;
+var state = {
+	listening: false,
+	error: null,
+	port: DEFAULT_HTTP_PORT
+};
+var boundRequestedHost = null;
+var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
+/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
+function allFamiliesListenHost(host) {
+	if (host === "0.0.0.0" || host === "*" || host === "") return {
+		host: "::",
+		ipv6Only: false
+	};
+	return {
+		host,
+		ipv6Only: false
+	};
+}
+function registerLanHttpHandler(next) {
+	handlers = next;
+}
+function readLanHttpState() {
+	return state;
+}
+async function applyLanHttp(options) {
+	pending = options;
+	if (!options.enabled) {
+		await closeLanHttp();
+		state = {
+			listening: false,
+			error: null,
+			port: options.port
+		};
+		return state;
+	}
+	if (handlers === null) {
+		state = {
+			listening: false,
+			error: "HTTP listener is not registered yet",
+			port: options.port
+		};
+		return state;
+	}
+	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
+	await closeLanHttp();
+	try {
+		const bound = await listenHttp(options.port, options.host, handlers);
+		server = bound;
+		boundRequestedHost = options.host;
+		const addr = bound.address();
+		state = {
+			listening: true,
+			error: null,
+			port: typeof addr === "object" && addr !== null ? addr.port : options.port
+		};
+		return state;
+	} catch (err) {
+		server = null;
+		state = {
+			listening: false,
+			error: err instanceof Error ? err.message : String(err),
+			port: options.port
+		};
+		return state;
+	}
+}
+/** After the hub registers the Fastify request handler, bind whatever was pending. */
+async function bindPendingLanHttp() {
+	if (pending === null) return applyLanHttp({
+		enabled: true,
+		port: DEFAULT_HTTP_PORT,
+		host: "0.0.0.0"
+	});
+	return applyLanHttp(pending);
+}
+async function closeLanHttp() {
+	const current = server;
+	server = null;
+	boundRequestedHost = null;
+	if (current === null) return;
+	await new Promise((resolve) => {
+		current.close(() => resolve());
+	});
+}
+function listenHttp(port, host, next) {
+	const resolved = allFamiliesListenHost(host);
+	return listenOn(port, resolved, next).catch((err) => {
+		if (resolved.host === "::" && host !== "::") return listenOn(port, {
+			host: "0.0.0.0",
+			ipv6Only: false
+		}, next);
+		throw err;
+	});
+}
+function listenOn(port, bind, next) {
+	return new Promise((resolve, reject) => {
+		const created = (0, node_http.createServer)(next.onRequest);
+		created.on("upgrade", next.onUpgrade);
+		const onError = (err) => {
+			created.off("listening", onListening);
+			created.close();
+			reject(err);
+		};
+		const onListening = () => {
+			created.off("error", onError);
+			resolve(created);
+		};
+		created.once("error", onError);
+		created.once("listening", onListening);
+		created.listen({
+			port,
+			host: bind.host,
+			ipv6Only: bind.ipv6Only
+		});
+	});
+}
+//#endregion
+Object.defineProperty(exports, "CA_COMMON_NAME", {
+	enumerable: true,
+	get: function() {
+		return CA_COMMON_NAME;
+	}
+});
+Object.defineProperty(exports, "CA_VALIDITY_DAYS", {
+	enumerable: true,
+	get: function() {
+		return CA_VALIDITY_DAYS;
+	}
+});
+Object.defineProperty(exports, "DEFAULT_LAN_HTTP_PORT", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_LAN_HTTP_PORT;
+	}
+});
+Object.defineProperty(exports, "LEAF_RENEWAL_WINDOW_DAYS", {
+	enumerable: true,
+	get: function() {
+		return LEAF_RENEWAL_WINDOW_DAYS;
+	}
+});
+Object.defineProperty(exports, "MAX_LEAF_VALIDITY_DAYS", {
+	enumerable: true,
+	get: function() {
+		return MAX_LEAF_VALIDITY_DAYS;
+	}
+});
+Object.defineProperty(exports, "SERVER_AUTH_OID", {
+	enumerable: true,
+	get: function() {
+		return SERVER_AUTH_OID;
+	}
+});
+Object.defineProperty(exports, "allFamiliesListenHost", {
+	enumerable: true,
+	get: function() {
+		return allFamiliesListenHost;
+	}
+});
+Object.defineProperty(exports, "applyLanHttp", {
+	enumerable: true,
+	get: function() {
+		return applyLanHttp;
+	}
+});
+Object.defineProperty(exports, "bindPendingLanHttp", {
+	enumerable: true,
+	get: function() {
+		return bindPendingLanHttp;
+	}
+});
+Object.defineProperty(exports, "closeLanHttp", {
+	enumerable: true,
+	get: function() {
+		return closeLanHttp;
+	}
+});
+Object.defineProperty(exports, "collectCertIdentity", {
+	enumerable: true,
+	get: function() {
+		return collectCertIdentity;
+	}
+});
+Object.defineProperty(exports, "ensureTlsCert", {
+	enumerable: true,
+	get: function() {
+		return ensureTlsCert;
+	}
+});
+Object.defineProperty(exports, "evaluateExistingCert", {
+	enumerable: true,
+	get: function() {
+		return evaluateExistingCert;
+	}
+});
+Object.defineProperty(exports, "loadTlsCert", {
+	enumerable: true,
+	get: function() {
+		return loadTlsCert;
+	}
+});
+Object.defineProperty(exports, "readExtraSans", {
+	enumerable: true,
+	get: function() {
+		return readExtraSans;
+	}
+});
+Object.defineProperty(exports, "readLanHttpState", {
+	enumerable: true,
+	get: function() {
+		return readLanHttpState;
+	}
+});
+Object.defineProperty(exports, "readTlsAccessStatus", {
+	enumerable: true,
+	get: function() {
+		return readTlsAccessStatus;
+	}
+});
+Object.defineProperty(exports, "readTlsMode", {
+	enumerable: true,
+	get: function() {
+		return readTlsMode;
+	}
+});
+Object.defineProperty(exports, "registerLanHttpHandler", {
+	enumerable: true,
+	get: function() {
+		return registerLanHttpHandler;
+	}
+});
+Object.defineProperty(exports, "reissueTlsLeaf", {
+	enumerable: true,
+	get: function() {
+		return reissueTlsLeaf;
+	}
+});
+Object.defineProperty(exports, "validateUploadedTls", {
+	enumerable: true,
+	get: function() {
+		return validateUploadedTls;
+	}
+});
+Object.defineProperty(exports, "writeExtraSans", {
+	enumerable: true,
+	get: function() {
+		return writeExtraSans;
+	}
+});
+Object.defineProperty(exports, "writeTlsMode", {
+	enumerable: true,
+	get: function() {
+		return writeTlsMode;
+	}
+});