@camstack/system 1.2.274 → 1.2.276

package/dist/tls-2xbgg78V.mjs

@@ -1,752 +0,0 @@
-import { X509Certificate, createPrivateKey, randomBytes } from "node:crypto";
-import { chmod, copyFile, mkdtemp, rm, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { execFile } from "node:child_process";
-import * as os from "node:os";
-import { tmpdir } from "node:os";
-import { promisify } from "node:util";
-import { createServer } from "node:http";
-import { isIP } from "node:net";
-//#region src/http/lan-http-bind.ts
-/**
-* Second HTTP listener that shares the hub's existing request handler.
-*
-* Fastify is one protocol per instance; HTTPS stays on :4443 and this
-* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
-* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
-*
-* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
-* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
-* hangs because nobody handles the upgrade on this socket.
-*/
-var DEFAULT_HTTP_PORT = 4480;
-var handlers = null;
-var server = null;
-var pending = null;
-var state = {
-	listening: false,
-	error: null,
-	port: DEFAULT_HTTP_PORT
-};
-var boundRequestedHost = null;
-var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
-/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
-function allFamiliesListenHost(host) {
-	if (host === "0.0.0.0" || host === "*" || host === "") return {
-		host: "::",
-		ipv6Only: false
-	};
-	return {
-		host,
-		ipv6Only: false
-	};
-}
-function registerLanHttpHandler(next) {
-	handlers = next;
-}
-function readLanHttpState() {
-	return state;
-}
-async function applyLanHttp(options) {
-	pending = options;
-	if (!options.enabled) {
-		await closeLanHttp();
-		state = {
-			listening: false,
-			error: null,
-			port: options.port
-		};
-		return state;
-	}
-	if (handlers === null) {
-		state = {
-			listening: false,
-			error: "HTTP listener is not registered yet",
-			port: options.port
-		};
-		return state;
-	}
-	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
-	await closeLanHttp();
-	try {
-		const bound = await listenHttp(options.port, options.host, handlers);
-		server = bound;
-		boundRequestedHost = options.host;
-		const addr = bound.address();
-		state = {
-			listening: true,
-			error: null,
-			port: typeof addr === "object" && addr !== null ? addr.port : options.port
-		};
-		return state;
-	} catch (err) {
-		server = null;
-		state = {
-			listening: false,
-			error: err instanceof Error ? err.message : String(err),
-			port: options.port
-		};
-		return state;
-	}
-}
-/** After the hub registers the Fastify request handler, bind whatever was pending. */
-async function bindPendingLanHttp() {
-	if (pending === null) return applyLanHttp({
-		enabled: true,
-		port: DEFAULT_HTTP_PORT,
-		host: "0.0.0.0"
-	});
-	return applyLanHttp(pending);
-}
-async function closeLanHttp() {
-	const current = server;
-	server = null;
-	boundRequestedHost = null;
-	if (current === null) return;
-	await new Promise((resolve) => {
-		current.close(() => resolve());
-	});
-}
-function listenHttp(port, host, next) {
-	const resolved = allFamiliesListenHost(host);
-	return listenOn(port, resolved, next).catch((err) => {
-		if (resolved.host === "::" && host !== "::") return listenOn(port, {
-			host: "0.0.0.0",
-			ipv6Only: false
-		}, next);
-		throw err;
-	});
-}
-function listenOn(port, bind, next) {
-	return new Promise((resolve, reject) => {
-		const created = createServer(next.onRequest);
-		created.on("upgrade", next.onUpgrade);
-		const onError = (err) => {
-			created.off("listening", onListening);
-			created.close();
-			reject(err);
-		};
-		const onListening = () => {
-			created.off("error", onError);
-			resolve(created);
-		};
-		created.once("error", onError);
-		created.once("listening", onListening);
-		created.listen({
-			port,
-			host: bind.host,
-			ipv6Only: bind.ipv6Only
-		});
-	});
-}
-//#endregion
-//#region src/tls/cert-evaluation.ts
-/**
-* The regeneration rule (D227), as a pure function.
-*
-* `ensureTlsCert` reissues **only** when the material on disk cannot do
-* its job. Never because it is old, never because the machine picked up
-* an address the certificate does not need, never because a new build
-* shipped. The decision is a function of (files on disk, machine
-* identity, clock) alone, so the same inputs always produce the same
-* answer — which is what makes a reissue happen once and then stop.
-*/
-/** OID `id-kp-serverAuth`. Apple's trustd requires it on the leaf. */
-var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
-/**
-* Apple's `SecPolicyCheckOtherTrustValidityPeriod` ceiling is 825 days;
-* the CA/Browser Forum's recommended maximum is 397. We sit at 397.
-*/
-var MAX_LEAF_VALIDITY_DAYS = 397;
-/** Reissue this long before the leaf dies, so nobody serves an expired one. */
-var LEAF_RENEWAL_WINDOW_DAYS = 30;
-/** A local root outlives many leaves — it is the anchor an operator trusts. */
-var CA_VALIDITY_DAYS = 3650;
-var MS_PER_DAY = 864e5;
-/** Reasons that invalidate the root as well as the leaf. */
-var REASONS_REQUIRING_NEW_CA = [
-	"missing",
-	"unreadable",
-	"no-local-ca",
-	"ca-expiring"
-];
-function reasonRequiresNewCa(reason) {
-	return REASONS_REQUIRING_NEW_CA.includes(reason);
-}
-function parse(pem) {
-	try {
-		return new X509Certificate(pem);
-	} catch {
-		return null;
-	}
-}
-function daysBetween(from, to) {
-	return (to.getTime() - from.getTime()) / MS_PER_DAY;
-}
-function hasServerAuthEku(leaf) {
-	const eku = leaf.keyUsage;
-	return eku !== void 0 && eku.length === 1 && eku[0] === "1.3.6.1.5.5.7.3.1";
-}
-function keyMatches(leaf, keyPem) {
-	try {
-		return leaf.checkPrivateKey(createPrivateKey(keyPem));
-	} catch {
-		return false;
-	}
-}
-function coversIdentity(leaf, identity) {
-	for (const name of identity.requiredDnsNames) if (leaf.checkHost(name) === void 0) return false;
-	for (const ip of identity.requiredIpAddresses) if (leaf.checkIP(ip) === void 0) return false;
-	return true;
-}
-/**
-* `null` when the material on disk is fit to keep serving.
-*
-* Order matters only for the quality of the reported reason; any
-* non-null answer produces the same action.
-*/
-function evaluateExistingCert(input) {
-	const leaf = parse(input.chainPem);
-	const ca = parse(input.caPem);
-	if (leaf === null || ca === null) return "unreadable";
-	if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
-	if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
-	if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
-	if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
-	if (leaf.ca || !leaf.checkIssued(ca) || !leaf.verify(ca.publicKey)) return "not-issued-by-local-ca";
-	if (daysBetween(new Date(leaf.validFrom), new Date(leaf.validTo)) > 398) return "validity-too-long";
-	if (!coversIdentity(leaf, input.identity)) return "san-coverage-gap";
-	return null;
-}
-//#endregion
-//#region src/tls/cert-identity.ts
-/**
-* What names and addresses the hub's certificate has to answer for.
-*
-* Split out of `cert-manager.ts` because it is pure and because the
-* regeneration rule (D227) is decided entirely by the difference between
-* *this* and what the certificate on disk already carries.
-*/
-/**
-* Interfaces whose addresses are certified but never gate a reissue:
-* container bridges, VPN tunnels and mesh overlays hand out addresses
-* that change without the hub moving.
-*/
-var VOLATILE_INTERFACE_PREFIXES = [
-	"docker",
-	"br-",
-	"veth",
-	"virbr",
-	"cni",
-	"flannel",
-	"tun",
-	"utun",
-	"tap",
-	"wg",
-	"zt",
-	"tailscale",
-	"ppp",
-	"awdl",
-	"llw"
-];
-/** A DNS name we are willing to hand to openssl. */
-var DNS_NAME_PATTERN = /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/;
-function isIpv4(value) {
-	return isIP(value) === 4;
-}
-function isIpv6(value) {
-	return isIP(value) === 6;
-}
-/**
-* `fe80::/10` and `169.254.0.0/16`. An IPv6 link-local address needs a
-* zone index to be usable and a SAN cannot carry one, so such an entry
-* can never match anything — it is noise that makes the certificate look
-* broader than it is.
-*/
-function isLinkLocal(value) {
-	if (isIpv4(value)) return value.startsWith("169.254.");
-	if (!isIpv6(value)) return false;
-	const firstGroup = value.split(":")[0] ?? "";
-	if (firstGroup === "") return false;
-	const parsed = Number.parseInt(firstGroup, 16);
-	return Number.isFinite(parsed) && (parsed & 65472) === 65152;
-}
-/** `fc00::/7` — the IPv6 range that behaves like RFC 1918 does for v4. */
-function isUniqueLocalIpv6(value) {
-	if (!isIpv6(value)) return false;
-	const firstGroup = value.split(":")[0] ?? "";
-	const parsed = Number.parseInt(firstGroup, 16);
-	return Number.isFinite(parsed) && (parsed & 65024) === 64512;
-}
-function isVolatileInterface(name) {
-	const lower = name.toLowerCase();
-	return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
-}
-/**
-* A global-scope IPv6 address is NOT a stable identity: SLAAC privacy
-* extensions rotate temporary addresses roughly daily, and `os` gives us
-* no way to tell a temporary address from a permanent one. Gating on
-* one would reissue the certificate every day.
-*/
-function isStableGateAddress(address) {
-	if (isLinkLocal(address)) return false;
-	if (isIpv4(address)) return true;
-	return isUniqueLocalIpv6(address);
-}
-function addSan(dns, ips, value) {
-	const trimmed = value.trim();
-	if (trimmed === "") return;
-	if (isIP(trimmed) !== 0) {
-		if (!isLinkLocal(trimmed)) ips.add(trimmed);
-		return;
-	}
-	if (DNS_NAME_PATTERN.test(trimmed)) dns.add(trimmed);
-}
-/**
-* Snapshot the machine's identity. Called once per `ensureTlsCert`; the
-* result is both the SAN list for a new leaf and the yardstick the
-* existing leaf is measured against.
-*/
-function collectCertIdentity(options) {
-	const dnsNames = /* @__PURE__ */ new Set();
-	const ipAddresses = new Set(["127.0.0.1", "::1"]);
-	const requiredDnsNames = /* @__PURE__ */ new Set();
-	const requiredIpAddresses = new Set(["127.0.0.1"]);
-	for (const name of [
-		"localhost",
-		options.commonName,
-		os.hostname()
-	]) {
-		addSan(dnsNames, ipAddresses, name);
-		addSan(requiredDnsNames, requiredIpAddresses, name);
-	}
-	for (const [ifaceName, addrs] of Object.entries(os.networkInterfaces())) for (const addr of addrs ?? []) {
-		if (addr.internal) continue;
-		if (isLinkLocal(addr.address)) continue;
-		ipAddresses.add(addr.address);
-		if (isVolatileInterface(ifaceName)) continue;
-		if (isStableGateAddress(addr.address)) requiredIpAddresses.add(addr.address);
-	}
-	for (const san of options.extraSans) {
-		addSan(dnsNames, ipAddresses, san);
-		addSan(requiredDnsNames, requiredIpAddresses, san);
-	}
-	return {
-		dnsNames: [...dnsNames],
-		ipAddresses: [...ipAddresses],
-		requiredDnsNames: [...requiredDnsNames],
-		requiredIpAddresses: [...requiredIpAddresses]
-	};
-}
-//#endregion
-//#region src/tls/cert-openssl.ts
-/**
-* The openssl invocations. Isolated so `cert-manager.ts` reads as policy
-* and this file reads as mechanics.
-*/
-var execFileAsync = promisify(execFile);
-/** Subject of the local root. Distinct from the leaf's CN by construction. */
-var CA_COMMON_NAME = "CamStack Local CA";
-function sanValue(identity) {
-	const parts = [];
-	for (const dns of identity.dnsNames) parts.push(`DNS:${dns}`);
-	for (const ip of identity.ipAddresses) if (isIP(ip) !== 0) parts.push(`IP:${ip}`);
-	return parts.join(",");
-}
-/**
-* A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
-* else, and **no EKU** — Apple rejects an anchor asserting
-* `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
-*/
-async function generateCa(tmpDir) {
-	const caCertPath = join(tmpDir, "ca.crt");
-	const caKeyPath = join(tmpDir, "ca.key");
-	await execFileAsync("openssl", [
-		"req",
-		"-x509",
-		"-newkey",
-		"rsa:2048",
-		"-nodes",
-		"-sha256",
-		"-days",
-		String(CA_VALIDITY_DAYS),
-		"-keyout",
-		caKeyPath,
-		"-out",
-		caCertPath,
-		"-subj",
-		`/CN=${CA_COMMON_NAME}`,
-		"-addext",
-		"basicConstraints=critical,CA:TRUE,pathlen:0",
-		"-addext",
-		"keyUsage=critical,keyCertSign,cRLSign",
-		"-addext",
-		"subjectKeyIdentifier=hash"
-	]);
-	await chmod(caKeyPath, 384);
-	return {
-		caCertPath,
-		caKeyPath
-	};
-}
-/**
-* A server leaf signed by the local root: `CA:FALSE`, and
-* `extendedKeyUsage=serverAuth` — not `anyExtendedKeyUsage`, which
-* Apple's `testAppTrustRoot_AnyEKU_AfterJul2019` asserts must fail.
-*/
-async function issueLeaf(tmpDir, ca, identity, commonName, validDays) {
-	const keyPath = join(tmpDir, "leaf.key");
-	const csrPath = join(tmpDir, "leaf.csr");
-	const certPath = join(tmpDir, "leaf.crt");
-	const extPath = join(tmpDir, "leaf.ext");
-	await writeFile(extPath, [
-		"basicConstraints=critical,CA:FALSE",
-		"keyUsage=critical,digitalSignature,keyEncipherment",
-		"extendedKeyUsage=serverAuth",
-		"subjectKeyIdentifier=hash",
-		"authorityKeyIdentifier=keyid,issuer",
-		`subjectAltName=${sanValue(identity)}`,
-		""
-	].join("\n"), "utf-8");
-	await execFileAsync("openssl", [
-		"req",
-		"-new",
-		"-newkey",
-		"rsa:2048",
-		"-nodes",
-		"-sha256",
-		"-keyout",
-		keyPath,
-		"-out",
-		csrPath,
-		"-subj",
-		`/CN=${commonName}`
-	]);
-	await execFileAsync("openssl", [
-		"x509",
-		"-req",
-		"-in",
-		csrPath,
-		"-CA",
-		ca.caCertPath,
-		"-CAkey",
-		ca.caKeyPath,
-		"-set_serial",
-		`0x00${randomBytes(16).toString("hex")}`,
-		"-days",
-		String(validDays),
-		"-sha256",
-		"-extfile",
-		extPath,
-		"-out",
-		certPath
-	]);
-	await chmod(keyPath, 384);
-	await rm(csrPath, { force: true });
-	await rm(extPath, { force: true });
-	return {
-		certPath,
-		keyPath
-	};
-}
-//#endregion
-//#region src/tls/cert-manager.ts
-var DEFAULT_COMMON_NAME = "camstack.local";
-/**
-* Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
-* a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
-* chained to it (`camstack.crt` = leaf + root, `camstack.key`).
-*
-* ## The regeneration rule (D227)
-*
-* Reissue happens when, and only when, the material on disk **cannot do
-* its job**:
-*
-* - it is absent, unreadable, or the key does not match the certificate;
-* - the root is absent (every pre-2026-08 install: one self-signed
-*   `CA:TRUE` leaf and no root) or is inside its renewal window;
-* - the leaf is inside its 30-day renewal window;
-* - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
-*   rejects an app-supplied anchor without it;
-* - the leaf is not actually issued by the root on disk;
-* - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
-* - **a name or address the hub must answer for is missing from the SAN
-*   list** — a DHCP move, a new interface or a new hostname.
-*
-* And explicitly NOT when: the certificate names an address the machine
-* no longer has (a superset still works — the check is one-directional),
-* a volatile interface (docker/VPN/mesh) or a global-scope IPv6 address
-* changed (SLAAC privacy addresses rotate daily), or a new build shipped.
-*
-* Every trigger is derived from the files plus the machine, so once a
-* reissue clears them it clears them for good: the next boot returns
-* `generated: false`. A certificate that moved on every boot would
-* invalidate every trust an operator granted by hand — worse than the
-* bugs this rule fixes.
-*
-* **The root is rotated only for root-level reasons.** SAN drift rotates
-* the leaf alone, so trust granted to `camstack-ca.crt` survives every
-* address change the hub will ever see.
-*/
-async function ensureTlsCert(dataDir, options) {
-	const tlsDir = join(dataDir, "tls");
-	const paths = {
-		certPath: join(tlsDir, "camstack.crt"),
-		keyPath: join(tlsDir, "camstack.key"),
-		caCertPath: join(tlsDir, "camstack-ca.crt"),
-		caKeyPath: join(tlsDir, "camstack-ca.key")
-	};
-	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
-	const validDays = Math.min(options?.validDays ?? 397, 397);
-	const identity = collectCertIdentity({
-		commonName,
-		extraSans: options?.extraSans ?? []
-	});
-	const reason = decideRegeneration(paths, identity);
-	if (reason === null) return describe(paths, false, null, false, null, null);
-	const previousFingerprint = readFingerprint(paths.certPath);
-	const caRotated = reasonRequiresNewCa(reason);
-	mkdirSync(tlsDir, { recursive: true });
-	try {
-		await regenerate(paths, identity, commonName, validDays, caRotated);
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		if (!canKeepServing(paths)) throw err;
-		return describe(paths, false, null, false, null, message);
-	}
-	return describe(paths, true, reason, caRotated, previousFingerprint, null);
-}
-/**
-* Operator "Regenerate": issue a new leaf under the existing local CA.
-* Never rotates the root — trust granted to `camstack-ca.crt` survives.
-*/
-async function reissueTlsLeaf(dataDir, options) {
-	const tlsDir = join(dataDir, "tls");
-	const paths = {
-		certPath: join(tlsDir, "camstack.crt"),
-		keyPath: join(tlsDir, "camstack.key"),
-		caCertPath: join(tlsDir, "camstack-ca.crt"),
-		caKeyPath: join(tlsDir, "camstack-ca.key")
-	};
-	if (!existsSync(paths.caCertPath) || !existsSync(paths.caKeyPath)) return ensureTlsCert(dataDir, options);
-	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
-	const validDays = Math.min(options?.validDays ?? 397, 397);
-	const identity = collectCertIdentity({
-		commonName,
-		extraSans: options?.extraSans ?? []
-	});
-	const previousFingerprint = readFingerprint(paths.certPath);
-	mkdirSync(tlsDir, { recursive: true });
-	await regenerate(paths, identity, commonName, validDays, false);
-	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null);
-}
-/** True when the material already on disk can still terminate TLS. */
-function canKeepServing(paths) {
-	if (!existsSync(paths.certPath) || !existsSync(paths.keyPath)) return false;
-	if (!existsSync(paths.caCertPath)) return false;
-	return readFingerprint(paths.certPath) !== null;
-}
-/** Fingerprint of whatever is on disk, or `null` if there is nothing readable. */
-function readFingerprint(certPath) {
-	try {
-		return new X509Certificate(readFileSync(certPath)).fingerprint256;
-	} catch {
-		return null;
-	}
-}
-function decideRegeneration(paths, identity) {
-	if (!existsSync(paths.certPath) || !existsSync(paths.keyPath)) return "missing";
-	if (!existsSync(paths.caCertPath) || !existsSync(paths.caKeyPath)) return "no-local-ca";
-	try {
-		return evaluateExistingCert({
-			chainPem: readFileSync(paths.certPath, "utf-8"),
-			keyPem: readFileSync(paths.keyPath, "utf-8"),
-			caPem: readFileSync(paths.caCertPath, "utf-8"),
-			identity,
-			now: /* @__PURE__ */ new Date()
-		});
-	} catch {
-		return "unreadable";
-	}
-}
-/**
-* Build every file in a scratch directory, then move them into place.
-* A crash mid-way leaves the previous material untouched; a crash
-* between the moves leaves a key/certificate mismatch, which the
-* evaluator reports as `key-mismatch` and heals on the next boot.
-*/
-async function regenerate(paths, identity, commonName, validDays, newCa) {
-	const scratch = await mkdtemp(join(tmpdir(), "camstack-tls-"));
-	try {
-		const ca = newCa ? await generateCa(scratch) : {
-			caCertPath: paths.caCertPath,
-			caKeyPath: paths.caKeyPath
-		};
-		const leaf = await issueLeaf(scratch, ca, identity, commonName, validDays);
-		const chainPath = join(scratch, "chain.crt");
-		await writeFile(chainPath, `${readFileSync(leaf.certPath, "utf-8").trimEnd()}\n${readFileSync(ca.caCertPath, "utf-8").trimEnd()}\n`, "utf-8");
-		if (newCa) {
-			await copyFile(ca.caCertPath, `${paths.caCertPath}.new`);
-			await copyFile(ca.caKeyPath, `${paths.caKeyPath}.new`);
-			renameSync(`${paths.caCertPath}.new`, paths.caCertPath);
-			renameSync(`${paths.caKeyPath}.new`, paths.caKeyPath);
-			await chmod(paths.caKeyPath, 384);
-		}
-		await copyFile(leaf.keyPath, `${paths.keyPath}.new`);
-		await copyFile(chainPath, `${paths.certPath}.new`);
-		renameSync(`${paths.keyPath}.new`, paths.keyPath);
-		renameSync(`${paths.certPath}.new`, paths.certPath);
-		await chmod(paths.keyPath, 384);
-	} finally {
-		await rm(scratch, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
-	const leaf = new X509Certificate(readFileSync(paths.certPath));
-	const ca = new X509Certificate(readFileSync(paths.caCertPath));
-	const san = leaf.subjectAltName ?? "";
-	return {
-		...paths,
-		generated,
-		reason,
-		caRotated,
-		fingerprintSha256: leaf.fingerprint256,
-		previousFingerprintSha256,
-		caFingerprintSha256: ca.fingerprint256,
-		validTo: new Date(leaf.validTo).toISOString(),
-		sans: san === "" ? [] : san.split(", "),
-		reissueError
-	};
-}
-/**
-* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
-* options. `certPath` is a full chain, so the listener presents the local
-* root alongside the leaf.
-*/
-function loadTlsCert(certPath, keyPath) {
-	return {
-		cert: readFileSync(certPath),
-		key: readFileSync(keyPath)
-	};
-}
-//#endregion
-//#region src/tls/uploaded-cert.ts
-/**
-* Operator-supplied material must parse, match its key, and carry
-* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
-* to keep generating.
-*/
-function validateUploadedTls(certPem, keyPem) {
-	let leaf;
-	try {
-		leaf = new X509Certificate(certPem);
-	} catch {
-		return {
-			ok: false,
-			error: "Certificate PEM could not be parsed."
-		};
-	}
-	try {
-		if (!leaf.checkPrivateKey(createPrivateKey(keyPem))) return {
-			ok: false,
-			error: "Private key does not match the certificate."
-		};
-	} catch {
-		return {
-			ok: false,
-			error: "Private key PEM could not be parsed."
-		};
-	}
-	const eku = leaf.keyUsage;
-	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
-		ok: false,
-		error: "Certificate is missing extendedKeyUsage = serverAuth."
-	};
-	return {
-		ok: true,
-		fingerprintSha256: leaf.fingerprint256,
-		validTo: new Date(leaf.validTo).toISOString()
-	};
-}
-//#endregion
-//#region src/tls/tls-status.ts
-function tlsDir(dataDir) {
-	return join(dataDir, "tls");
-}
-function readTlsMode(dataDir) {
-	const marker = join(tlsDir(dataDir), "mode");
-	if (existsSync(marker)) {
-		const raw = readFileSync(marker, "utf-8").trim();
-		if (raw === "uploaded") return "uploaded";
-		if (raw === "disabled") return "disabled";
-	}
-	return existsSync(join(tlsDir(dataDir), "camstack.crt")) ? "generated" : "disabled";
-}
-function writeTlsMode(dataDir, mode) {
-	mkdirSync(tlsDir(dataDir), { recursive: true });
-	writeFileSync(join(tlsDir(dataDir), "mode"), `${mode}\n`, "utf-8");
-}
-function readExtraSans(dataDir) {
-	const path = join(tlsDir(dataDir), "extra-sans.json");
-	if (!existsSync(path)) return [];
-	try {
-		const parsed = JSON.parse(readFileSync(path, "utf-8"));
-		if (!Array.isArray(parsed)) return [];
-		return parsed.filter((entry) => typeof entry === "string" && entry.length > 0);
-	} catch {
-		return [];
-	}
-}
-function writeExtraSans(dataDir, sans) {
-	mkdirSync(tlsDir(dataDir), { recursive: true });
-	writeFileSync(join(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}\n`, "utf-8");
-}
-function readTlsAccessStatus(dataDir, restartRequired = false) {
-	const dir = tlsDir(dataDir);
-	const certPath = join(dir, "camstack.crt");
-	const caPath = join(dir, "camstack-ca.crt");
-	const mode = readTlsMode(dataDir);
-	if (!existsSync(certPath)) return {
-		mode: "disabled",
-		leafFingerprintSha256: null,
-		caFingerprintSha256: null,
-		validTo: null,
-		sans: [],
-		caCertPem: existsSync(caPath) ? readFileSync(caPath, "utf-8") : null,
-		reissueError: null,
-		restartRequired
-	};
-	try {
-		const leaf = new X509Certificate(readFileSync(certPath));
-		const caPem = existsSync(caPath) ? readFileSync(caPath, "utf-8") : null;
-		const ca = caPem !== null ? new X509Certificate(caPem) : null;
-		const san = leaf.subjectAltName ?? "";
-		return {
-			mode,
-			leafFingerprintSha256: leaf.fingerprint256,
-			caFingerprintSha256: ca?.fingerprint256 ?? null,
-			validTo: new Date(leaf.validTo).toISOString(),
-			sans: san === "" ? [] : san.split(", "),
-			caCertPem: caPem,
-			reissueError: null,
-			restartRequired
-		};
-	} catch {
-		return {
-			mode,
-			leafFingerprintSha256: null,
-			caFingerprintSha256: null,
-			validTo: null,
-			sans: [],
-			caCertPem: null,
-			reissueError: "Certificate on disk could not be parsed.",
-			restartRequired
-		};
-	}
-}
-//#endregion
-export { registerLanHttpHandler as C, readLanHttpState as S, DEFAULT_LAN_HTTP_PORT as _, writeTlsMode as a, bindPendingLanHttp as b, loadTlsCert as c, collectCertIdentity as d, CA_VALIDITY_DAYS as f, evaluateExistingCert as g, SERVER_AUTH_OID as h, writeExtraSans as i, reissueTlsLeaf as l, MAX_LEAF_VALIDITY_DAYS as m, readTlsAccessStatus as n, validateUploadedTls as o, LEAF_RENEWAL_WINDOW_DAYS as p, readTlsMode as r, ensureTlsCert as s, readExtraSans as t, CA_COMMON_NAME as u, allFamiliesListenHost as v, closeLanHttp as x, applyLanHttp as y };