@camstack/system 1.2.115 → 1.2.117

package/dist/lan-http-bind-jKrj6OjQ.mjs

@@ -0,0 +1,752 @@
+import { X509Certificate, createPrivateKey, randomBytes } from "node:crypto";
+import { chmod, copyFile, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import * as os from "node:os";
+import { tmpdir } from "node:os";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { isIP } from "node:net";
+//#region src/tls/cert-evaluation.ts
+/**
+* The regeneration rule (D227), as a pure function.
+*
+* `ensureTlsCert` reissues **only** when the material on disk cannot do
+* its job. Never because it is old, never because the machine picked up
+* an address the certificate does not need, never because a new build
+* shipped. The decision is a function of (files on disk, machine
+* identity, clock) alone, so the same inputs always produce the same
+* answer — which is what makes a reissue happen once and then stop.
+*/
+/** OID `id-kp-serverAuth`. Apple's trustd requires it on the leaf. */
+var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+/**
+* Apple's `SecPolicyCheckOtherTrustValidityPeriod` ceiling is 825 days;
+* the CA/Browser Forum's recommended maximum is 397. We sit at 397.
+*/
+var MAX_LEAF_VALIDITY_DAYS = 397;
+/** Reissue this long before the leaf dies, so nobody serves an expired one. */
+var LEAF_RENEWAL_WINDOW_DAYS = 30;
+/** A local root outlives many leaves — it is the anchor an operator trusts. */
+var CA_VALIDITY_DAYS = 3650;
+var MS_PER_DAY = 864e5;
+/** Reasons that invalidate the root as well as the leaf. */
+var REASONS_REQUIRING_NEW_CA = [
+	"missing",
+	"unreadable",
+	"no-local-ca",
+	"ca-expiring"
+];
+function reasonRequiresNewCa(reason) {
+	return REASONS_REQUIRING_NEW_CA.includes(reason);
+}
+function parse(pem) {
+	try {
+		return new X509Certificate(pem);
+	} catch {
+		return null;
+	}
+}
+function daysBetween(from, to) {
+	return (to.getTime() - from.getTime()) / MS_PER_DAY;
+}
+function hasServerAuthEku(leaf) {
+	const eku = leaf.keyUsage;
+	return eku !== void 0 && eku.length === 1 && eku[0] === "1.3.6.1.5.5.7.3.1";
+}
+function keyMatches(leaf, keyPem) {
+	try {
+		return leaf.checkPrivateKey(createPrivateKey(keyPem));
+	} catch {
+		return false;
+	}
+}
+function coversIdentity(leaf, identity) {
+	for (const name of identity.requiredDnsNames) if (leaf.checkHost(name) === void 0) return false;
+	for (const ip of identity.requiredIpAddresses) if (leaf.checkIP(ip) === void 0) return false;
+	return true;
+}
+/**
+* `null` when the material on disk is fit to keep serving.
+*
+* Order matters only for the quality of the reported reason; any
+* non-null answer produces the same action.
+*/
+function evaluateExistingCert(input) {
+	const leaf = parse(input.chainPem);
+	const ca = parse(input.caPem);
+	if (leaf === null || ca === null) return "unreadable";
+	if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
+	if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
+	if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
+	if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
+	if (leaf.ca || !leaf.checkIssued(ca) || !leaf.verify(ca.publicKey)) return "not-issued-by-local-ca";
+	if (daysBetween(new Date(leaf.validFrom), new Date(leaf.validTo)) > 398) return "validity-too-long";
+	if (!coversIdentity(leaf, input.identity)) return "san-coverage-gap";
+	return null;
+}
+//#endregion
+//#region src/tls/cert-identity.ts
+/**
+* What names and addresses the hub's certificate has to answer for.
+*
+* Split out of `cert-manager.ts` because it is pure and because the
+* regeneration rule (D227) is decided entirely by the difference between
+* *this* and what the certificate on disk already carries.
+*/
+/**
+* Interfaces whose addresses are certified but never gate a reissue:
+* container bridges, VPN tunnels and mesh overlays hand out addresses
+* that change without the hub moving.
+*/
+var VOLATILE_INTERFACE_PREFIXES = [
+	"docker",
+	"br-",
+	"veth",
+	"virbr",
+	"cni",
+	"flannel",
+	"tun",
+	"utun",
+	"tap",
+	"wg",
+	"zt",
+	"tailscale",
+	"ppp",
+	"awdl",
+	"llw"
+];
+/** A DNS name we are willing to hand to openssl. */
+var DNS_NAME_PATTERN = /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+function isIpv4(value) {
+	return isIP(value) === 4;
+}
+function isIpv6(value) {
+	return isIP(value) === 6;
+}
+/**
+* `fe80::/10` and `169.254.0.0/16`. An IPv6 link-local address needs a
+* zone index to be usable and a SAN cannot carry one, so such an entry
+* can never match anything — it is noise that makes the certificate look
+* broader than it is.
+*/
+function isLinkLocal(value) {
+	if (isIpv4(value)) return value.startsWith("169.254.");
+	if (!isIpv6(value)) return false;
+	const firstGroup = value.split(":")[0] ?? "";
+	if (firstGroup === "") return false;
+	const parsed = Number.parseInt(firstGroup, 16);
+	return Number.isFinite(parsed) && (parsed & 65472) === 65152;
+}
+/** `fc00::/7` — the IPv6 range that behaves like RFC 1918 does for v4. */
+function isUniqueLocalIpv6(value) {
+	if (!isIpv6(value)) return false;
+	const firstGroup = value.split(":")[0] ?? "";
+	const parsed = Number.parseInt(firstGroup, 16);
+	return Number.isFinite(parsed) && (parsed & 65024) === 64512;
+}
+function isVolatileInterface(name) {
+	const lower = name.toLowerCase();
+	return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+/**
+* A global-scope IPv6 address is NOT a stable identity: SLAAC privacy
+* extensions rotate temporary addresses roughly daily, and `os` gives us
+* no way to tell a temporary address from a permanent one. Gating on
+* one would reissue the certificate every day.
+*/
+function isStableGateAddress(address) {
+	if (isLinkLocal(address)) return false;
+	if (isIpv4(address)) return true;
+	return isUniqueLocalIpv6(address);
+}
+function addSan(dns, ips, value) {
+	const trimmed = value.trim();
+	if (trimmed === "") return;
+	if (isIP(trimmed) !== 0) {
+		if (!isLinkLocal(trimmed)) ips.add(trimmed);
+		return;
+	}
+	if (DNS_NAME_PATTERN.test(trimmed)) dns.add(trimmed);
+}
+/**
+* Snapshot the machine's identity. Called once per `ensureTlsCert`; the
+* result is both the SAN list for a new leaf and the yardstick the
+* existing leaf is measured against.
+*/
+function collectCertIdentity(options) {
+	const dnsNames = /* @__PURE__ */ new Set();
+	const ipAddresses = new Set(["127.0.0.1", "::1"]);
+	const requiredDnsNames = /* @__PURE__ */ new Set();
+	const requiredIpAddresses = new Set(["127.0.0.1"]);
+	for (const name of [
+		"localhost",
+		options.commonName,
+		os.hostname()
+	]) {
+		addSan(dnsNames, ipAddresses, name);
+		addSan(requiredDnsNames, requiredIpAddresses, name);
+	}
+	for (const [ifaceName, addrs] of Object.entries(os.networkInterfaces())) for (const addr of addrs ?? []) {
+		if (addr.internal) continue;
+		if (isLinkLocal(addr.address)) continue;
+		ipAddresses.add(addr.address);
+		if (isVolatileInterface(ifaceName)) continue;
+		if (isStableGateAddress(addr.address)) requiredIpAddresses.add(addr.address);
+	}
+	for (const san of options.extraSans) {
+		addSan(dnsNames, ipAddresses, san);
+		addSan(requiredDnsNames, requiredIpAddresses, san);
+	}
+	return {
+		dnsNames: [...dnsNames],
+		ipAddresses: [...ipAddresses],
+		requiredDnsNames: [...requiredDnsNames],
+		requiredIpAddresses: [...requiredIpAddresses]
+	};
+}
+//#endregion
+//#region src/tls/cert-openssl.ts
+/**
+* The openssl invocations. Isolated so `cert-manager.ts` reads as policy
+* and this file reads as mechanics.
+*/
+var execFileAsync = promisify(execFile);
+/** Subject of the local root. Distinct from the leaf's CN by construction. */
+var CA_COMMON_NAME = "CamStack Local CA";
+function sanValue(identity) {
+	const parts = [];
+	for (const dns of identity.dnsNames) parts.push(`DNS:${dns}`);
+	for (const ip of identity.ipAddresses) if (isIP(ip) !== 0) parts.push(`IP:${ip}`);
+	return parts.join(",");
+}
+/**
+* A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
+* else, and **no EKU** — Apple rejects an anchor asserting
+* `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
+*/
+async function generateCa(tmpDir) {
+	const caCertPath = join(tmpDir, "ca.crt");
+	const caKeyPath = join(tmpDir, "ca.key");
+	await execFileAsync("openssl", [
+		"req",
+		"-x509",
+		"-newkey",
+		"rsa:2048",
+		"-nodes",
+		"-sha256",
+		"-days",
+		String(CA_VALIDITY_DAYS),
+		"-keyout",
+		caKeyPath,
+		"-out",
+		caCertPath,
+		"-subj",
+		`/CN=${CA_COMMON_NAME}`,
+		"-addext",
+		"basicConstraints=critical,CA:TRUE,pathlen:0",
+		"-addext",
+		"keyUsage=critical,keyCertSign,cRLSign",
+		"-addext",
+		"subjectKeyIdentifier=hash"
+	]);
+	await chmod(caKeyPath, 384);
+	return {
+		caCertPath,
+		caKeyPath
+	};
+}
+/**
+* A server leaf signed by the local root: `CA:FALSE`, and
+* `extendedKeyUsage=serverAuth` — not `anyExtendedKeyUsage`, which
+* Apple's `testAppTrustRoot_AnyEKU_AfterJul2019` asserts must fail.
+*/
+async function issueLeaf(tmpDir, ca, identity, commonName, validDays) {
+	const keyPath = join(tmpDir, "leaf.key");
+	const csrPath = join(tmpDir, "leaf.csr");
+	const certPath = join(tmpDir, "leaf.crt");
+	const extPath = join(tmpDir, "leaf.ext");
+	await writeFile(extPath, [
+		"basicConstraints=critical,CA:FALSE",
+		"keyUsage=critical,digitalSignature,keyEncipherment",
+		"extendedKeyUsage=serverAuth",
+		"subjectKeyIdentifier=hash",
+		"authorityKeyIdentifier=keyid,issuer",
+		`subjectAltName=${sanValue(identity)}`,
+		""
+	].join("\n"), "utf-8");
+	await execFileAsync("openssl", [
+		"req",
+		"-new",
+		"-newkey",
+		"rsa:2048",
+		"-nodes",
+		"-sha256",
+		"-keyout",
+		keyPath,
+		"-out",
+		csrPath,
+		"-subj",
+		`/CN=${commonName}`
+	]);
+	await execFileAsync("openssl", [
+		"x509",
+		"-req",
+		"-in",
+		csrPath,
+		"-CA",
+		ca.caCertPath,
+		"-CAkey",
+		ca.caKeyPath,
+		"-set_serial",
+		`0x00${randomBytes(16).toString("hex")}`,
+		"-days",
+		String(validDays),
+		"-sha256",
+		"-extfile",
+		extPath,
+		"-out",
+		certPath
+	]);
+	await chmod(keyPath, 384);
+	await rm(csrPath, { force: true });
+	await rm(extPath, { force: true });
+	return {
+		certPath,
+		keyPath
+	};
+}
+//#endregion
+//#region src/tls/cert-manager.ts
+var DEFAULT_COMMON_NAME = "camstack.local";
+/**
+* Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
+* a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
+* chained to it (`camstack.crt` = leaf + root, `camstack.key`).
+*
+* ## The regeneration rule (D227)
+*
+* Reissue happens when, and only when, the material on disk **cannot do
+* its job**:
+*
+* - it is absent, unreadable, or the key does not match the certificate;
+* - the root is absent (every pre-2026-08 install: one self-signed
+*   `CA:TRUE` leaf and no root) or is inside its renewal window;
+* - the leaf is inside its 30-day renewal window;
+* - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
+*   rejects an app-supplied anchor without it;
+* - the leaf is not actually issued by the root on disk;
+* - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
+* - **a name or address the hub must answer for is missing from the SAN
+*   list** — a DHCP move, a new interface or a new hostname.
+*
+* And explicitly NOT when: the certificate names an address the machine
+* no longer has (a superset still works — the check is one-directional),
+* a volatile interface (docker/VPN/mesh) or a global-scope IPv6 address
+* changed (SLAAC privacy addresses rotate daily), or a new build shipped.
+*
+* Every trigger is derived from the files plus the machine, so once a
+* reissue clears them it clears them for good: the next boot returns
+* `generated: false`. A certificate that moved on every boot would
+* invalidate every trust an operator granted by hand — worse than the
+* bugs this rule fixes.
+*
+* **The root is rotated only for root-level reasons.** SAN drift rotates
+* the leaf alone, so trust granted to `camstack-ca.crt` survives every
+* address change the hub will ever see.
+*/
+async function ensureTlsCert(dataDir, options) {
+	const tlsDir = join(dataDir, "tls");
+	const paths = {
+		certPath: join(tlsDir, "camstack.crt"),
+		keyPath: join(tlsDir, "camstack.key"),
+		caCertPath: join(tlsDir, "camstack-ca.crt"),
+		caKeyPath: join(tlsDir, "camstack-ca.key")
+	};
+	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+	const validDays = Math.min(options?.validDays ?? 397, 397);
+	const identity = collectCertIdentity({
+		commonName,
+		extraSans: options?.extraSans ?? []
+	});
+	const reason = decideRegeneration(paths, identity);
+	if (reason === null) return describe(paths, false, null, false, null, null);
+	const previousFingerprint = readFingerprint(paths.certPath);
+	const caRotated = reasonRequiresNewCa(reason);
+	mkdirSync(tlsDir, { recursive: true });
+	try {
+		await regenerate(paths, identity, commonName, validDays, caRotated);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		if (!canKeepServing(paths)) throw err;
+		return describe(paths, false, null, false, null, message);
+	}
+	return describe(paths, true, reason, caRotated, previousFingerprint, null);
+}
+/**
+* Operator "Regenerate": issue a new leaf under the existing local CA.
+* Never rotates the root — trust granted to `camstack-ca.crt` survives.
+*/
+async function reissueTlsLeaf(dataDir, options) {
+	const tlsDir = join(dataDir, "tls");
+	const paths = {
+		certPath: join(tlsDir, "camstack.crt"),
+		keyPath: join(tlsDir, "camstack.key"),
+		caCertPath: join(tlsDir, "camstack-ca.crt"),
+		caKeyPath: join(tlsDir, "camstack-ca.key")
+	};
+	if (!existsSync(paths.caCertPath) || !existsSync(paths.caKeyPath)) return ensureTlsCert(dataDir, options);
+	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+	const validDays = Math.min(options?.validDays ?? 397, 397);
+	const identity = collectCertIdentity({
+		commonName,
+		extraSans: options?.extraSans ?? []
+	});
+	const previousFingerprint = readFingerprint(paths.certPath);
+	mkdirSync(tlsDir, { recursive: true });
+	await regenerate(paths, identity, commonName, validDays, false);
+	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null);
+}
+/** True when the material already on disk can still terminate TLS. */
+function canKeepServing(paths) {
+	if (!existsSync(paths.certPath) || !existsSync(paths.keyPath)) return false;
+	if (!existsSync(paths.caCertPath)) return false;
+	return readFingerprint(paths.certPath) !== null;
+}
+/** Fingerprint of whatever is on disk, or `null` if there is nothing readable. */
+function readFingerprint(certPath) {
+	try {
+		return new X509Certificate(readFileSync(certPath)).fingerprint256;
+	} catch {
+		return null;
+	}
+}
+function decideRegeneration(paths, identity) {
+	if (!existsSync(paths.certPath) || !existsSync(paths.keyPath)) return "missing";
+	if (!existsSync(paths.caCertPath) || !existsSync(paths.caKeyPath)) return "no-local-ca";
+	try {
+		return evaluateExistingCert({
+			chainPem: readFileSync(paths.certPath, "utf-8"),
+			keyPem: readFileSync(paths.keyPath, "utf-8"),
+			caPem: readFileSync(paths.caCertPath, "utf-8"),
+			identity,
+			now: /* @__PURE__ */ new Date()
+		});
+	} catch {
+		return "unreadable";
+	}
+}
+/**
+* Build every file in a scratch directory, then move them into place.
+* A crash mid-way leaves the previous material untouched; a crash
+* between the moves leaves a key/certificate mismatch, which the
+* evaluator reports as `key-mismatch` and heals on the next boot.
+*/
+async function regenerate(paths, identity, commonName, validDays, newCa) {
+	const scratch = await mkdtemp(join(tmpdir(), "camstack-tls-"));
+	try {
+		const ca = newCa ? await generateCa(scratch) : {
+			caCertPath: paths.caCertPath,
+			caKeyPath: paths.caKeyPath
+		};
+		const leaf = await issueLeaf(scratch, ca, identity, commonName, validDays);
+		const chainPath = join(scratch, "chain.crt");
+		await writeFile(chainPath, `${readFileSync(leaf.certPath, "utf-8").trimEnd()}\n${readFileSync(ca.caCertPath, "utf-8").trimEnd()}\n`, "utf-8");
+		if (newCa) {
+			await copyFile(ca.caCertPath, `${paths.caCertPath}.new`);
+			await copyFile(ca.caKeyPath, `${paths.caKeyPath}.new`);
+			renameSync(`${paths.caCertPath}.new`, paths.caCertPath);
+			renameSync(`${paths.caKeyPath}.new`, paths.caKeyPath);
+			await chmod(paths.caKeyPath, 384);
+		}
+		await copyFile(leaf.keyPath, `${paths.keyPath}.new`);
+		await copyFile(chainPath, `${paths.certPath}.new`);
+		renameSync(`${paths.keyPath}.new`, paths.keyPath);
+		renameSync(`${paths.certPath}.new`, paths.certPath);
+		await chmod(paths.keyPath, 384);
+	} finally {
+		await rm(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
+	const leaf = new X509Certificate(readFileSync(paths.certPath));
+	const ca = new X509Certificate(readFileSync(paths.caCertPath));
+	const san = leaf.subjectAltName ?? "";
+	return {
+		...paths,
+		generated,
+		reason,
+		caRotated,
+		fingerprintSha256: leaf.fingerprint256,
+		previousFingerprintSha256,
+		caFingerprintSha256: ca.fingerprint256,
+		validTo: new Date(leaf.validTo).toISOString(),
+		sans: san === "" ? [] : san.split(", "),
+		reissueError
+	};
+}
+/**
+* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
+* options. `certPath` is a full chain, so the listener presents the local
+* root alongside the leaf.
+*/
+function loadTlsCert(certPath, keyPath) {
+	return {
+		cert: readFileSync(certPath),
+		key: readFileSync(keyPath)
+	};
+}
+//#endregion
+//#region src/tls/uploaded-cert.ts
+/**
+* Operator-supplied material must parse, match its key, and carry
+* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
+* to keep generating.
+*/
+function validateUploadedTls(certPem, keyPem) {
+	let leaf;
+	try {
+		leaf = new X509Certificate(certPem);
+	} catch {
+		return {
+			ok: false,
+			error: "Certificate PEM could not be parsed."
+		};
+	}
+	try {
+		if (!leaf.checkPrivateKey(createPrivateKey(keyPem))) return {
+			ok: false,
+			error: "Private key does not match the certificate."
+		};
+	} catch {
+		return {
+			ok: false,
+			error: "Private key PEM could not be parsed."
+		};
+	}
+	const eku = leaf.keyUsage;
+	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
+		ok: false,
+		error: "Certificate is missing extendedKeyUsage = serverAuth."
+	};
+	return {
+		ok: true,
+		fingerprintSha256: leaf.fingerprint256,
+		validTo: new Date(leaf.validTo).toISOString()
+	};
+}
+//#endregion
+//#region src/tls/tls-status.ts
+function tlsDir(dataDir) {
+	return join(dataDir, "tls");
+}
+function readTlsMode(dataDir) {
+	const marker = join(tlsDir(dataDir), "mode");
+	if (existsSync(marker)) {
+		const raw = readFileSync(marker, "utf-8").trim();
+		if (raw === "uploaded") return "uploaded";
+		if (raw === "disabled") return "disabled";
+	}
+	return existsSync(join(tlsDir(dataDir), "camstack.crt")) ? "generated" : "disabled";
+}
+function writeTlsMode(dataDir, mode) {
+	mkdirSync(tlsDir(dataDir), { recursive: true });
+	writeFileSync(join(tlsDir(dataDir), "mode"), `${mode}\n`, "utf-8");
+}
+function readExtraSans(dataDir) {
+	const path = join(tlsDir(dataDir), "extra-sans.json");
+	if (!existsSync(path)) return [];
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf-8"));
+		if (!Array.isArray(parsed)) return [];
+		return parsed.filter((entry) => typeof entry === "string" && entry.length > 0);
+	} catch {
+		return [];
+	}
+}
+function writeExtraSans(dataDir, sans) {
+	mkdirSync(tlsDir(dataDir), { recursive: true });
+	writeFileSync(join(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}\n`, "utf-8");
+}
+function readTlsAccessStatus(dataDir, restartRequired = false) {
+	const dir = tlsDir(dataDir);
+	const certPath = join(dir, "camstack.crt");
+	const caPath = join(dir, "camstack-ca.crt");
+	const mode = readTlsMode(dataDir);
+	if (!existsSync(certPath)) return {
+		mode: "disabled",
+		leafFingerprintSha256: null,
+		caFingerprintSha256: null,
+		validTo: null,
+		sans: [],
+		caCertPem: existsSync(caPath) ? readFileSync(caPath, "utf-8") : null,
+		reissueError: null,
+		restartRequired
+	};
+	try {
+		const leaf = new X509Certificate(readFileSync(certPath));
+		const caPem = existsSync(caPath) ? readFileSync(caPath, "utf-8") : null;
+		const ca = caPem !== null ? new X509Certificate(caPem) : null;
+		const san = leaf.subjectAltName ?? "";
+		return {
+			mode,
+			leafFingerprintSha256: leaf.fingerprint256,
+			caFingerprintSha256: ca?.fingerprint256 ?? null,
+			validTo: new Date(leaf.validTo).toISOString(),
+			sans: san === "" ? [] : san.split(", "),
+			caCertPem: caPem,
+			reissueError: null,
+			restartRequired
+		};
+	} catch {
+		return {
+			mode,
+			leafFingerprintSha256: null,
+			caFingerprintSha256: null,
+			validTo: null,
+			sans: [],
+			caCertPem: null,
+			reissueError: "Certificate on disk could not be parsed.",
+			restartRequired
+		};
+	}
+}
+//#endregion
+//#region src/http/lan-http-bind.ts
+/**
+* Second HTTP listener that shares the hub's existing request handler.
+*
+* Fastify is one protocol per instance; HTTPS stays on :4443 and this
+* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
+* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
+*
+* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
+* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
+* hangs because nobody handles the upgrade on this socket.
+*/
+var DEFAULT_HTTP_PORT = 4480;
+var handlers = null;
+var server = null;
+var pending = null;
+var state = {
+	listening: false,
+	error: null,
+	port: DEFAULT_HTTP_PORT
+};
+var boundRequestedHost = null;
+var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
+/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
+function allFamiliesListenHost(host) {
+	if (host === "0.0.0.0" || host === "*" || host === "") return {
+		host: "::",
+		ipv6Only: false
+	};
+	return {
+		host,
+		ipv6Only: false
+	};
+}
+function registerLanHttpHandler(next) {
+	handlers = next;
+}
+function readLanHttpState() {
+	return state;
+}
+async function applyLanHttp(options) {
+	pending = options;
+	if (!options.enabled) {
+		await closeLanHttp();
+		state = {
+			listening: false,
+			error: null,
+			port: options.port
+		};
+		return state;
+	}
+	if (handlers === null) {
+		state = {
+			listening: false,
+			error: "HTTP listener is not registered yet",
+			port: options.port
+		};
+		return state;
+	}
+	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
+	await closeLanHttp();
+	try {
+		const bound = await listenHttp(options.port, options.host, handlers);
+		server = bound;
+		boundRequestedHost = options.host;
+		const addr = bound.address();
+		state = {
+			listening: true,
+			error: null,
+			port: typeof addr === "object" && addr !== null ? addr.port : options.port
+		};
+		return state;
+	} catch (err) {
+		server = null;
+		state = {
+			listening: false,
+			error: err instanceof Error ? err.message : String(err),
+			port: options.port
+		};
+		return state;
+	}
+}
+/** After the hub registers the Fastify request handler, bind whatever was pending. */
+async function bindPendingLanHttp() {
+	if (pending === null) return applyLanHttp({
+		enabled: true,
+		port: DEFAULT_HTTP_PORT,
+		host: "0.0.0.0"
+	});
+	return applyLanHttp(pending);
+}
+async function closeLanHttp() {
+	const current = server;
+	server = null;
+	boundRequestedHost = null;
+	if (current === null) return;
+	await new Promise((resolve) => {
+		current.close(() => resolve());
+	});
+}
+function listenHttp(port, host, next) {
+	const resolved = allFamiliesListenHost(host);
+	return listenOn(port, resolved, next).catch((err) => {
+		if (resolved.host === "::" && host !== "::") return listenOn(port, {
+			host: "0.0.0.0",
+			ipv6Only: false
+		}, next);
+		throw err;
+	});
+}
+function listenOn(port, bind, next) {
+	return new Promise((resolve, reject) => {
+		const created = createServer(next.onRequest);
+		created.on("upgrade", next.onUpgrade);
+		const onError = (err) => {
+			created.off("listening", onListening);
+			created.close();
+			reject(err);
+		};
+		const onListening = () => {
+			created.off("error", onError);
+			resolve(created);
+		};
+		created.once("error", onError);
+		created.once("listening", onListening);
+		created.listen({
+			port,
+			host: bind.host,
+			ipv6Only: bind.ipv6Only
+		});
+	});
+}
+//#endregion
+export { evaluateExistingCert as C, SERVER_AUTH_OID as S, CA_COMMON_NAME as _, closeLanHttp as a, LEAF_RENEWAL_WINDOW_DAYS as b, readExtraSans as c, writeExtraSans as d, writeTlsMode as f, reissueTlsLeaf as g, loadTlsCert as h, bindPendingLanHttp as i, readTlsAccessStatus as l, ensureTlsCert as m, allFamiliesListenHost as n, readLanHttpState as o, validateUploadedTls as p, applyLanHttp as r, registerLanHttpHandler as s, DEFAULT_LAN_HTTP_PORT as t, readTlsMode as u, collectCertIdentity as v, MAX_LEAF_VALIDITY_DAYS as x, CA_VALIDITY_DAYS as y };