@camstack/system 1.2.382 → 1.2.384

package/dist/tls-C2NT-Orr.mjs

@@ -0,0 +1,949 @@
+import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-Xf3K_brW.mjs";
+import { X509Certificate, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
+import { isIP } from "node:net";
+import { chmod, mkdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import * as os from "node:os";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { createServer as createServer$1 } from "node:http";
+//#region src/http/lan-http-bind.ts
+/**
+* Second HTTP listener that shares the hub's existing request handler.
+*
+* Fastify is one protocol per instance; HTTPS stays on :4443 and this
+* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
+* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
+*
+* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
+* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
+* hangs because nobody handles the upgrade on this socket.
+*/
+var DEFAULT_HTTP_PORT = 4480;
+var handlers = null;
+var server = null;
+var pending = null;
+var state = {
+	listening: false,
+	error: null,
+	port: DEFAULT_HTTP_PORT
+};
+var boundRequestedHost = null;
+var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
+/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
+function allFamiliesListenHost(host) {
+	if (host === "0.0.0.0" || host === "*" || host === "") return {
+		host: "::",
+		ipv6Only: false
+	};
+	return {
+		host,
+		ipv6Only: false
+	};
+}
+function registerLanHttpHandler(next) {
+	handlers = next;
+}
+function readLanHttpState() {
+	return state;
+}
+async function applyLanHttp(options) {
+	pending = options;
+	if (!options.enabled) {
+		await closeLanHttp();
+		state = {
+			listening: false,
+			error: null,
+			port: options.port
+		};
+		return state;
+	}
+	if (handlers === null) {
+		state = {
+			listening: false,
+			error: "HTTP listener is not registered yet",
+			port: options.port
+		};
+		return state;
+	}
+	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
+	await closeLanHttp();
+	try {
+		const bound = await listenHttp(options.port, options.host, handlers);
+		server = bound;
+		boundRequestedHost = options.host;
+		const addr = bound.address();
+		state = {
+			listening: true,
+			error: null,
+			port: typeof addr === "object" && addr !== null ? addr.port : options.port
+		};
+		return state;
+	} catch (err) {
+		server = null;
+		state = {
+			listening: false,
+			error: err instanceof Error ? err.message : String(err),
+			port: options.port
+		};
+		return state;
+	}
+}
+/** After the hub registers the Fastify request handler, bind whatever was pending. */
+async function bindPendingLanHttp() {
+	if (pending === null) return applyLanHttp({
+		enabled: true,
+		port: DEFAULT_HTTP_PORT,
+		host: "0.0.0.0"
+	});
+	return applyLanHttp(pending);
+}
+async function closeLanHttp() {
+	const current = server;
+	server = null;
+	boundRequestedHost = null;
+	if (current === null) return;
+	await new Promise((resolve) => {
+		current.close(() => resolve());
+	});
+}
+function listenHttp(port, host, next) {
+	const resolved = allFamiliesListenHost(host);
+	return listenOn(port, resolved, next).catch((err) => {
+		if (resolved.host === "::" && host !== "::") return listenOn(port, {
+			host: "0.0.0.0",
+			ipv6Only: false
+		}, next);
+		throw err;
+	});
+}
+function listenOn(port, bind, next) {
+	return new Promise((resolve, reject) => {
+		const created = createServer$1(next.onRequest);
+		created.on("upgrade", next.onUpgrade);
+		const onError = (err) => {
+			created.off("listening", onListening);
+			created.close();
+			reject(err);
+		};
+		const onListening = () => {
+			created.off("error", onError);
+			resolve(created);
+		};
+		created.once("error", onError);
+		created.once("listening", onListening);
+		created.listen({
+			port,
+			host: bind.host,
+			ipv6Only: bind.ipv6Only
+		});
+	});
+}
+//#endregion
+//#region src/tls/cert-evaluation.ts
+/**
+* The regeneration rule (D227), as a pure function.
+*
+* `ensureTlsCert` reissues **only** when the material on disk cannot do
+* its job. Never because it is old, never because the machine picked up
+* an address the certificate does not need, never because a new build
+* shipped. The decision is a function of (files on disk, machine
+* identity, clock) alone, so the same inputs always produce the same
+* answer — which is what makes a reissue happen once and then stop.
+*/
+/** OID `id-kp-serverAuth`. Apple's trustd requires it on the leaf. */
+var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+/**
+* Apple's `SecPolicyCheckOtherTrustValidityPeriod` ceiling is 825 days;
+* the CA/Browser Forum's recommended maximum is 397. We sit at 397.
+*/
+var MAX_LEAF_VALIDITY_DAYS = 397;
+/** Reissue this long before the leaf dies, so nobody serves an expired one. */
+var LEAF_RENEWAL_WINDOW_DAYS = 30;
+/** A local root outlives many leaves — it is the anchor an operator trusts. */
+var CA_VALIDITY_DAYS = 3650;
+var MS_PER_DAY$1 = 864e5;
+/** Reasons that invalidate the root as well as the leaf. */
+var REASONS_REQUIRING_NEW_CA = [
+	"missing",
+	"unreadable",
+	"no-local-ca",
+	"ca-expiring"
+];
+function reasonRequiresNewCa(reason) {
+	return REASONS_REQUIRING_NEW_CA.includes(reason);
+}
+function parse(pem) {
+	try {
+		return new X509Certificate(pem);
+	} catch {
+		return null;
+	}
+}
+function daysBetween(from, to) {
+	return (to.getTime() - from.getTime()) / MS_PER_DAY$1;
+}
+function hasServerAuthEku(leaf) {
+	const eku = leaf.keyUsage;
+	return eku !== void 0 && eku.length === 1 && eku[0] === "1.3.6.1.5.5.7.3.1";
+}
+function keyMatches(leaf, keyPem) {
+	try {
+		return leaf.checkPrivateKey(createPrivateKey(keyPem));
+	} catch {
+		return false;
+	}
+}
+function coversIdentity(leaf, identity) {
+	for (const name of identity.requiredDnsNames) if (leaf.checkHost(name) === void 0) return false;
+	for (const ip of identity.requiredIpAddresses) if (leaf.checkIP(ip) === void 0) return false;
+	return true;
+}
+/**
+* `null` when the material on disk is fit to keep serving.
+*
+* Order matters only for the quality of the reported reason; any
+* non-null answer produces the same action.
+*/
+function evaluateExistingCert(input) {
+	const leaf = parse(input.chainPem);
+	const ca = parse(input.caPem);
+	if (leaf === null || ca === null) return "unreadable";
+	if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
+	if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
+	if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
+	if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
+	if (leaf.ca || !leaf.checkIssued(ca) || !leaf.verify(ca.publicKey)) return "not-issued-by-local-ca";
+	if (daysBetween(new Date(leaf.validFrom), new Date(leaf.validTo)) > 398) return "validity-too-long";
+	if (!coversIdentity(leaf, input.identity)) return "san-coverage-gap";
+	return null;
+}
+//#endregion
+//#region src/tls/cert-identity.ts
+/**
+* What names and addresses the hub's certificate has to answer for.
+*
+* Split out of `cert-manager.ts` because it is pure and because the
+* regeneration rule (D227) is decided entirely by the difference between
+* *this* and what the certificate on disk already carries.
+*/
+/** The real machine. The only place in `tls/` that touches `os`. */
+function systemHostFacts() {
+	return {
+		hostname: os.hostname(),
+		networkInterfaces: os.networkInterfaces()
+	};
+}
+/**
+* Interfaces whose addresses are certified but never gate a reissue:
+* container bridges, VPN tunnels and mesh overlays hand out addresses
+* that change without the hub moving.
+*/
+var VOLATILE_INTERFACE_PREFIXES = [
+	"docker",
+	"br-",
+	"veth",
+	"virbr",
+	"cni",
+	"flannel",
+	"tun",
+	"utun",
+	"tap",
+	"wg",
+	"zt",
+	"tailscale",
+	"ppp",
+	"awdl",
+	"llw"
+];
+/** A DNS name we are willing to put in a SAN. */
+var DNS_NAME_PATTERN = /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+function isIpv4(value) {
+	return isIP(value) === 4;
+}
+function isIpv6(value) {
+	return isIP(value) === 6;
+}
+/**
+* `fe80::/10` and `169.254.0.0/16`. An IPv6 link-local address needs a
+* zone index to be usable and a SAN cannot carry one, so such an entry
+* can never match anything — it is noise that makes the certificate look
+* broader than it is.
+*/
+function isLinkLocal(value) {
+	if (isIpv4(value)) return value.startsWith("169.254.");
+	if (!isIpv6(value)) return false;
+	const firstGroup = value.split(":")[0] ?? "";
+	if (firstGroup === "") return false;
+	const parsed = Number.parseInt(firstGroup, 16);
+	return Number.isFinite(parsed) && (parsed & 65472) === 65152;
+}
+function isVolatileInterface(name) {
+	const lower = name.toLowerCase();
+	return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+/**
+* Only IPv4 gates a reissue. Every IPv6 address we see — global **or**
+* ULA — is certified but never required: `os` cannot tell a temporary
+* address from a permanent one, and the live hub's ULA interface-id
+* rotated on every restart (eight leaf reissues in one day under
+* `san-coverage-gap`). Gating on ULA reproduced the churn D227 exists
+* to prevent. Operators who need a fixed IPv6 declare it via `extraSans`.
+*/
+function isStableGateAddress(address) {
+	if (isLinkLocal(address)) return false;
+	return isIpv4(address);
+}
+function addSan(dns, ips, value) {
+	const trimmed = value.trim();
+	if (trimmed === "") return;
+	if (isIP(trimmed) !== 0) {
+		if (!isLinkLocal(trimmed)) ips.add(trimmed);
+		return;
+	}
+	if (DNS_NAME_PATTERN.test(trimmed)) dns.add(trimmed);
+}
+/**
+* Snapshot the machine's identity. Called once per `ensureTlsCert`; the
+* result is both the SAN list for a new leaf and the yardstick the
+* existing leaf is measured against.
+*/
+function collectCertIdentity(options) {
+	const host = options.hostFacts ?? systemHostFacts();
+	const dnsNames = /* @__PURE__ */ new Set();
+	const ipAddresses = new Set(["127.0.0.1", "::1"]);
+	const requiredDnsNames = /* @__PURE__ */ new Set();
+	const requiredIpAddresses = new Set(["127.0.0.1"]);
+	for (const name of [
+		"localhost",
+		options.commonName,
+		host.hostname
+	]) {
+		addSan(dnsNames, ipAddresses, name);
+		addSan(requiredDnsNames, requiredIpAddresses, name);
+	}
+	for (const [ifaceName, addrs] of Object.entries(host.networkInterfaces)) for (const addr of addrs ?? []) {
+		if (addr.internal) continue;
+		if (isLinkLocal(addr.address)) continue;
+		ipAddresses.add(addr.address);
+		if (isVolatileInterface(ifaceName)) continue;
+		if (isStableGateAddress(addr.address)) requiredIpAddresses.add(addr.address);
+	}
+	for (const san of options.extraSans) {
+		addSan(dnsNames, ipAddresses, san);
+		addSan(requiredDnsNames, requiredIpAddresses, san);
+	}
+	return {
+		dnsNames: [...dnsNames],
+		ipAddresses: [...ipAddresses],
+		requiredDnsNames: [...requiredDnsNames],
+		requiredIpAddresses: [...requiredIpAddresses]
+	};
+}
+//#endregion
+//#region src/tls/cert-issue.ts
+cryptoProvider.set(webcrypto);
+/** Subject of the local root. Distinct from the leaf's CN by construction. */
+var CA_COMMON_NAME = "CamStack Local CA";
+var MS_PER_DAY = 864e5;
+/**
+* RSA-2048 / SHA-256. Unchanged from the openssl invocation this replaces:
+* every client that trusted the previous material still understands this.
+*/
+var SIGNING_ALGORITHM = {
+	name: "RSASSA-PKCS1-v1_5",
+	hash: "SHA-256",
+	publicExponent: new Uint8Array([
+		1,
+		0,
+		1
+	]),
+	modulusLength: 2048
+};
+/**
+* A serial number that is positive and unpredictable. `00` prefix for the
+* same reason the openssl invocation carried one: a leading bit of 1 would
+* make the DER INTEGER negative.
+*/
+function freshSerial() {
+	return `00${randomBytes(16).toString("hex")}`;
+}
+function toPkcs8Pem(pkcs8) {
+	return `${PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`;
+}
+function toCertPem(cert) {
+	return `${cert.toString("pem")}\n`;
+}
+async function exportKeyPem(key) {
+	return toPkcs8Pem(await webcrypto.subtle.exportKey("pkcs8", key));
+}
+/** SAN entries, in the order `cert-identity` produced them. */
+function subjectAltNames(identity) {
+	const names = [];
+	for (const dns of identity.dnsNames) names.push({
+		type: "dns",
+		value: dns
+	});
+	for (const ip of identity.ipAddresses) if (isIP(ip) !== 0) names.push({
+		type: "ip",
+		value: ip
+	});
+	return names;
+}
+/**
+* A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
+* else, and **no EKU** — Apple rejects an anchor asserting
+* `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
+*/
+async function generateCa(now) {
+	const keys = await webcrypto.subtle.generateKey(SIGNING_ALGORITHM, true, ["sign", "verify"]);
+	const extensions = [
+		new BasicConstraintsExtension(true, 0, true),
+		new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
+		await SubjectKeyIdentifierExtension.create(keys.publicKey)
+	];
+	const cert = await X509CertificateGenerator.createSelfSigned({
+		serialNumber: freshSerial(),
+		name: `CN=${CA_COMMON_NAME}`,
+		notBefore: now,
+		notAfter: new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY),
+		keys,
+		signingAlgorithm: SIGNING_ALGORITHM,
+		extensions
+	});
+	return {
+		certPem: toCertPem(cert),
+		keyPem: await exportKeyPem(keys.privateKey),
+		cert,
+		privateKey: keys.privateKey
+	};
+}
+/** Re-open a root already on disk so a leaf can be issued under it. */
+async function loadCa(certPem, keyPem) {
+	return {
+		certPem,
+		keyPem,
+		cert: new X509Certificate$1(certPem),
+		privateKey: await webcrypto.subtle.importKey("pkcs8", PemConverter.decodeFirst(keyPem), SIGNING_ALGORITHM, true, ["sign"])
+	};
+}
+/**
+* A server leaf signed by the local root: `CA:FALSE`, and
+* `extendedKeyUsage=serverAuth` — not `anyExtendedKeyUsage`, which
+* Apple's `testAppTrustRoot_AnyEKU_AfterJul2019` asserts must fail.
+*/
+async function issueLeaf(ca, identity, commonName, validDays, now) {
+	const keys = await webcrypto.subtle.generateKey(SIGNING_ALGORITHM, true, ["sign", "verify"]);
+	const extensions = [
+		new BasicConstraintsExtension(false, void 0, true),
+		new KeyUsagesExtension(KeyUsageFlags.digitalSignature | KeyUsageFlags.keyEncipherment, true),
+		new ExtendedKeyUsageExtension([SERVER_AUTH_OID]),
+		await SubjectKeyIdentifierExtension.create(keys.publicKey),
+		await AuthorityKeyIdentifierExtension.create(ca.cert),
+		new SubjectAlternativeNameExtension(subjectAltNames(identity))
+	];
+	return {
+		certPem: toCertPem(await X509CertificateGenerator.create({
+			serialNumber: freshSerial(),
+			subject: `CN=${commonName}`,
+			issuer: ca.cert.subject,
+			notBefore: now,
+			notAfter: new Date(now.getTime() + validDays * MS_PER_DAY),
+			publicKey: keys.publicKey,
+			signingKey: ca.privateKey,
+			signingAlgorithm: SIGNING_ALGORITHM,
+			extensions
+		})),
+		keyPem: await exportKeyPem(keys.privateKey)
+	};
+}
+//#endregion
+//#region src/tls/cert-manager.ts
+var DEFAULT_COMMON_NAME = "camstack.local";
+/**
+* Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
+* a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
+* chained to it (`camstack.crt` = leaf + root, `camstack.key`).
+*
+* ## The regeneration rule (D227)
+*
+* Reissue happens when, and only when, the material on disk **cannot do
+* its job**:
+*
+* - it is absent, unreadable, or the key does not match the certificate;
+* - the root is absent (every pre-2026-08 install: one self-signed
+*   `CA:TRUE` leaf and no root) or is inside its renewal window;
+* - the leaf is inside its 30-day renewal window;
+* - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
+*   rejects an app-supplied anchor without it;
+* - the leaf is not actually issued by the root on disk;
+* - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
+* - **a name or address the hub must answer for is missing from the SAN
+*   list** — a DHCP move, a new interface or a new hostname.
+*
+* And explicitly NOT when: the certificate names an address the machine
+* no longer has (a superset still works — the check is one-directional),
+* a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
+* (global and ULA both rotate under privacy extensions / interface-id
+* churn — `os` cannot tell temporary from permanent), or a new build shipped.
+*
+* Every trigger is derived from the files plus the machine, so once a
+* reissue clears them it clears them for good: the next boot returns
+* `generated: false`. A certificate that moved on every boot would
+* invalidate every trust an operator granted by hand — worse than the
+* bugs this rule fixes.
+*
+* **The root is rotated only for root-level reasons.** SAN drift rotates
+* the leaf alone, so trust granted to `camstack-ca.crt` survives every
+* address change the hub will ever see.
+*/
+async function ensureTlsCert(dataDir, options) {
+	const tlsDir = join(dataDir, "tls");
+	const paths = {
+		certPath: join(tlsDir, "camstack.crt"),
+		keyPath: join(tlsDir, "camstack.key"),
+		caCertPath: join(tlsDir, "camstack-ca.crt"),
+		caKeyPath: join(tlsDir, "camstack-ca.key")
+	};
+	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+	const validDays = Math.min(options?.validDays ?? 397, 397);
+	const identity = collectCertIdentity({
+		commonName,
+		extraSans: options?.extraSans ?? [],
+		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
+	});
+	const reason = decideRegeneration(paths, identity);
+	if (reason === null) return describe(paths, false, null, false, null, null);
+	const previousFingerprint = readFingerprint(paths.certPath);
+	const caRotated = reasonRequiresNewCa(reason);
+	mkdirSync(tlsDir, { recursive: true });
+	try {
+		await regenerate(paths, identity, commonName, validDays, caRotated);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		if (!canKeepServing(paths)) throw err;
+		return describe(paths, false, null, false, null, message);
+	}
+	return describe(paths, true, reason, caRotated, previousFingerprint, null);
+}
+/**
+* Operator "Regenerate": issue a new leaf under the existing local CA.
+* Never rotates the root — trust granted to `camstack-ca.crt` survives.
+*/
+async function reissueTlsLeaf(dataDir, options) {
+	const tlsDir = join(dataDir, "tls");
+	const paths = {
+		certPath: join(tlsDir, "camstack.crt"),
+		keyPath: join(tlsDir, "camstack.key"),
+		caCertPath: join(tlsDir, "camstack-ca.crt"),
+		caKeyPath: join(tlsDir, "camstack-ca.key")
+	};
+	if (!existsSync(paths.caCertPath) || !existsSync(paths.caKeyPath)) return ensureTlsCert(dataDir, options);
+	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+	const validDays = Math.min(options?.validDays ?? 397, 397);
+	const identity = collectCertIdentity({
+		commonName,
+		extraSans: options?.extraSans ?? [],
+		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
+	});
+	const previousFingerprint = readFingerprint(paths.certPath);
+	mkdirSync(tlsDir, { recursive: true });
+	await regenerate(paths, identity, commonName, validDays, false);
+	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null);
+}
+/** True when the material already on disk can still terminate TLS. */
+function canKeepServing(paths) {
+	if (!existsSync(paths.certPath) || !existsSync(paths.keyPath)) return false;
+	if (!existsSync(paths.caCertPath)) return false;
+	return readFingerprint(paths.certPath) !== null;
+}
+/** Fingerprint of whatever is on disk, or `null` if there is nothing readable. */
+function readFingerprint(certPath) {
+	try {
+		return new X509Certificate(readFileSync(certPath)).fingerprint256;
+	} catch {
+		return null;
+	}
+}
+function decideRegeneration(paths, identity) {
+	if (!existsSync(paths.certPath) || !existsSync(paths.keyPath)) return "missing";
+	if (!existsSync(paths.caCertPath) || !existsSync(paths.caKeyPath)) return "no-local-ca";
+	try {
+		return evaluateExistingCert({
+			chainPem: readFileSync(paths.certPath, "utf-8"),
+			keyPem: readFileSync(paths.keyPath, "utf-8"),
+			caPem: readFileSync(paths.caCertPath, "utf-8"),
+			identity,
+			now: /* @__PURE__ */ new Date()
+		});
+	} catch {
+		return "unreadable";
+	}
+}
+/**
+* Build every byte in memory, then move the files into place. A crash
+* mid-way leaves the previous material untouched; a crash between the
+* moves leaves a key/certificate mismatch, which the evaluator reports as
+* `key-mismatch` and heals on the next boot.
+*/
+async function regenerate(paths, identity, commonName, validDays, newCa) {
+	const now = /* @__PURE__ */ new Date();
+	const ca = newCa ? await generateCa(now) : await loadCa(readFileSync(paths.caCertPath, "utf-8"), readFileSync(paths.caKeyPath, "utf-8"));
+	const leaf = await issueLeaf(ca, identity, commonName, validDays, now);
+	const chainPem = `${leaf.certPem.trimEnd()}\n${ca.certPem.trimEnd()}\n`;
+	if (newCa) {
+		await writeFile(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
+		await writeFile(`${paths.caKeyPath}.new`, ca.keyPem, {
+			encoding: "utf-8",
+			mode: 384
+		});
+		renameSync(`${paths.caCertPath}.new`, paths.caCertPath);
+		renameSync(`${paths.caKeyPath}.new`, paths.caKeyPath);
+		await chmod(paths.caKeyPath, 384);
+	}
+	await writeFile(`${paths.keyPath}.new`, leaf.keyPem, {
+		encoding: "utf-8",
+		mode: 384
+	});
+	await writeFile(`${paths.certPath}.new`, chainPem, "utf-8");
+	renameSync(`${paths.keyPath}.new`, paths.keyPath);
+	renameSync(`${paths.certPath}.new`, paths.certPath);
+	await chmod(paths.keyPath, 384);
+}
+function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
+	const leaf = new X509Certificate(readFileSync(paths.certPath));
+	const ca = new X509Certificate(readFileSync(paths.caCertPath));
+	const san = leaf.subjectAltName ?? "";
+	return {
+		...paths,
+		generated,
+		reason,
+		caRotated,
+		fingerprintSha256: leaf.fingerprint256,
+		previousFingerprintSha256,
+		caFingerprintSha256: ca.fingerprint256,
+		validTo: new Date(leaf.validTo).toISOString(),
+		sans: san === "" ? [] : san.split(", "),
+		reissueError
+	};
+}
+/**
+* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
+* options. `certPath` is a full chain, so the listener presents the local
+* root alongside the leaf.
+*/
+function loadTlsCert(certPath, keyPath) {
+	return {
+		cert: readFileSync(certPath),
+		key: readFileSync(keyPath)
+	};
+}
+//#endregion
+//#region src/tls/tls-status.ts
+function tlsDir(dataDir) {
+	return join(dataDir, "tls");
+}
+function readTlsMode(dataDir) {
+	const marker = join(tlsDir(dataDir), "mode");
+	if (existsSync(marker)) {
+		const raw = readFileSync(marker, "utf-8").trim();
+		if (raw === "uploaded") return "uploaded";
+		if (raw === "disabled") return "disabled";
+	}
+	return existsSync(join(tlsDir(dataDir), "camstack.crt")) ? "generated" : "disabled";
+}
+function writeTlsMode(dataDir, mode) {
+	mkdirSync(tlsDir(dataDir), { recursive: true });
+	writeFileSync(join(tlsDir(dataDir), "mode"), `${mode}\n`, "utf-8");
+}
+function readExtraSans(dataDir) {
+	const path = join(tlsDir(dataDir), "extra-sans.json");
+	if (!existsSync(path)) return [];
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf-8"));
+		if (!Array.isArray(parsed)) return [];
+		return parsed.filter((entry) => typeof entry === "string" && entry.length > 0);
+	} catch {
+		return [];
+	}
+}
+function writeExtraSans(dataDir, sans) {
+	mkdirSync(tlsDir(dataDir), { recursive: true });
+	writeFileSync(join(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}\n`, "utf-8");
+}
+/** Where an upload's own CA is kept — never over the local CA's `camstack-ca.crt`. */
+var UPLOADED_CA_FILE = "uploaded-ca.crt";
+/** Every certificate in a PEM bundle, in order. */
+function splitPemCertificates(pem) {
+	const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
+	return blocks === null ? [] : blocks.map((block) => `${block}\n`);
+}
+/**
+* The certificate that signed `leaf`, from the upload itself: the CA the
+* operator supplied, else the rest of the uploaded chain. `null` when the
+* upload did not include it — and then nothing may stand in for it: the
+* local CA did not sign an uploaded leaf, so handing it out as "the CA" would
+* tell a client to trust a root that verifies nothing it is served.
+*/
+function uploadedIssuer(dir, leaf, chainPem) {
+	const caPath = join(dir, UPLOADED_CA_FILE);
+	const candidates = [...existsSync(caPath) ? splitPemCertificates(readFileSync(caPath, "utf-8")) : [], ...splitPemCertificates(chainPem).slice(1)];
+	for (const pem of candidates) try {
+		const cert = new X509Certificate(pem);
+		if (leaf.checkIssued(cert) && leaf.verify(cert.publicKey)) return {
+			pem,
+			cert
+		};
+	} catch {}
+	return null;
+}
+function generatedIssuer(dir) {
+	const caPath = join(dir, "camstack-ca.crt");
+	if (!existsSync(caPath)) return null;
+	const pem = readFileSync(caPath, "utf-8");
+	return {
+		pem,
+		cert: new X509Certificate(pem)
+	};
+}
+/**
+* What the node's certificate is, and whether the listener serves it.
+* `servedLeafFingerprint` is the leaf the HTTPS listener presents right now
+* (`servedHttpsLeafFingerprint()`), or `null` when unknown; a restart is
+* required exactly when the listener serves a different leaf than the one
+* on disk — a measured fact, not a flag a mutation remembered to set.
+*/
+function readTlsAccessStatus(dataDir, servedLeafFingerprint) {
+	const dir = tlsDir(dataDir);
+	const certPath = join(dir, "camstack.crt");
+	const mode = readTlsMode(dataDir);
+	if (!existsSync(certPath)) return {
+		mode: "disabled",
+		leafFingerprintSha256: null,
+		caFingerprintSha256: null,
+		validTo: null,
+		sans: [],
+		caCertPem: (mode === "uploaded" ? null : generatedIssuer(dir))?.pem ?? null,
+		reissueError: null,
+		restartRequired: false
+	};
+	try {
+		const chainPem = readFileSync(certPath, "utf-8");
+		const leaf = new X509Certificate(chainPem);
+		const ca = mode === "uploaded" ? uploadedIssuer(dir, leaf, chainPem) : generatedIssuer(dir);
+		const san = leaf.subjectAltName ?? "";
+		return {
+			mode,
+			leafFingerprintSha256: leaf.fingerprint256,
+			caFingerprintSha256: ca?.cert.fingerprint256 ?? null,
+			validTo: new Date(leaf.validTo).toISOString(),
+			sans: san === "" ? [] : san.split(", "),
+			caCertPem: ca?.pem ?? null,
+			reissueError: null,
+			restartRequired: servedLeafFingerprint !== null && servedLeafFingerprint !== leaf.fingerprint256
+		};
+	} catch {
+		return {
+			mode,
+			leafFingerprintSha256: null,
+			caFingerprintSha256: null,
+			validTo: null,
+			sans: [],
+			caCertPem: null,
+			reissueError: "Certificate on disk could not be parsed.",
+			restartRequired: false
+		};
+	}
+}
+//#endregion
+//#region src/tls/boot-tls.ts
+/**
+* Decide what the listener serves at boot. The admin UI (Network → Local
+* access) is the only way to set a certificate (D726): it either leaves the
+* hub on its generated local-CA leaf (D227) or uploads one, recorded by the
+* `tls/mode` marker. An uploaded certificate is served verbatim — running it
+* through `ensureTlsCert` would replace it on the first restart, because a
+* leaf the local root did not issue is one of that rule's reissue triggers.
+*/
+async function prepareBootTls(dataDir, options) {
+	const certPath = join(dataDir, "tls", "camstack.crt");
+	const keyPath = join(dataDir, "tls", "camstack.key");
+	const marked = readTlsMode(dataDir);
+	if (marked === "uploaded" && existsSync(certPath) && existsSync(keyPath)) return {
+		mode: "uploaded",
+		pair: loadTlsCert(certPath, keyPath),
+		ensured: void 0,
+		uploadedMissing: false
+	};
+	const uploadedMissing = marked === "uploaded";
+	if (uploadedMissing) writeTlsMode(dataDir, "generated");
+	const ensured = await ensureTlsCert(dataDir, options);
+	return {
+		mode: "generated",
+		pair: loadTlsCert(ensured.certPath, ensured.keyPath),
+		ensured,
+		uploadedMissing
+	};
+}
+//#endregion
+//#region src/tls/https-listener.ts
+var SLOT_KEY = Symbol.for("camstack.tls.https-listener");
+var EMPTY_SLOT = {
+	reload: null,
+	servedLeafFingerprint: null
+};
+function isSlot(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("reload" in value) || !("servedLeafFingerprint" in value)) return false;
+	const reload = value.reload;
+	const served = value.servedLeafFingerprint;
+	return (reload === null || typeof reload === "function") && (served === null || typeof served === "string");
+}
+function readSlot() {
+	const current = Reflect.get(globalThis, SLOT_KEY);
+	return isSlot(current) ? current : EMPTY_SLOT;
+}
+function writeSlot(next) {
+	Reflect.set(globalThis, SLOT_KEY, next);
+}
+/** SHA-256 fingerprint of the first certificate (the leaf) in a PEM chain. */
+function leafFingerprintOf(chain) {
+	return new X509Certificate(chain).fingerprint256;
+}
+/**
+* Called once by the server after its HTTPS listener is up, with the pair it
+* was started on. From here on a certificate action swaps the served
+* certificate in place (`setSecureContext`) — new handshakes get the new
+* leaf, open connections keep theirs, nothing restarts.
+*/
+function registerHttpsListener(server, pair) {
+	writeSlot({
+		reload: (next) => server.setSecureContext({
+			cert: next.cert,
+			key: next.key
+		}),
+		servedLeafFingerprint: leafFingerprintOf(pair.cert)
+	});
+}
+/** Forget the listener — on shutdown, and between specs. */
+function clearHttpsListener() {
+	writeSlot(EMPTY_SLOT);
+}
+/**
+* The leaf the HTTPS listener serves now, or `null` when this process has no
+* registered listener (TLS off, or a process that does not own one) — in
+* which case nobody can say, and `null` is the honest answer.
+*/
+function servedHttpsLeafFingerprint() {
+	return readSlot().servedLeafFingerprint;
+}
+/** Serve `pair` from now on. Never throws: the outcome says what happened. */
+function reloadHttpsListener(pair) {
+	const slot = readSlot();
+	if (slot.reload === null) return { kind: "no-listener" };
+	try {
+		const servedLeafFingerprint = leafFingerprintOf(pair.cert);
+		slot.reload(pair);
+		writeSlot({
+			reload: slot.reload,
+			servedLeafFingerprint
+		});
+		return {
+			kind: "reloaded",
+			servedLeafFingerprint
+		};
+	} catch (err) {
+		return {
+			kind: "failed",
+			error: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+//#endregion
+//#region src/tls/uploaded-cert.ts
+/**
+* Operator-supplied material must parse, match its key, and carry
+* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
+* to keep generating.
+*/
+function validateUploadedTls(certPem, keyPem) {
+	let leaf;
+	try {
+		leaf = new X509Certificate(certPem);
+	} catch {
+		return {
+			ok: false,
+			error: "Certificate PEM could not be parsed."
+		};
+	}
+	try {
+		if (!leaf.checkPrivateKey(createPrivateKey(keyPem))) return {
+			ok: false,
+			error: "Private key does not match the certificate."
+		};
+	} catch {
+		return {
+			ok: false,
+			error: "Private key PEM could not be parsed."
+		};
+	}
+	const eku = leaf.keyUsage;
+	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
+		ok: false,
+		error: "Certificate is missing extendedKeyUsage = serverAuth."
+	};
+	return {
+		ok: true,
+		fingerprintSha256: leaf.fingerprint256,
+		validTo: new Date(leaf.validTo).toISOString()
+	};
+}
+//#endregion
+//#region src/tls/tls-actions.ts
+function withNewline(pem) {
+	return pem.endsWith("\n") ? pem : `${pem}\n`;
+}
+/**
+* Store an operator's certificate. The leaf (or chain) and key replace the
+* served pair; a CA, when given, goes to its own file. The local CA
+* (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
+* and it is what "Revert to generated" and every device that trusts it
+* still need.
+*/
+async function storeUploadedCertificate(dataDir, input) {
+	const valid = validateUploadedTls(input.certPem, input.keyPem);
+	if (!valid.ok) throw new Error(valid.error);
+	const dir = join(dataDir, "tls");
+	await mkdir(dir, { recursive: true });
+	await writeFile(join(dir, "camstack.crt"), withNewline(input.certPem));
+	await writeFile(join(dir, "camstack.key"), withNewline(input.keyPem), { mode: 384 });
+	const caPath = join(dir, UPLOADED_CA_FILE);
+	if (input.caPem !== void 0 && input.caPem.trim() !== "") await writeFile(caPath, withNewline(input.caPem));
+	else rmSync(caPath, { force: true });
+	writeTlsMode(dataDir, "uploaded");
+}
+/** Issue a new generated leaf under the local CA. Refused while an upload is served. */
+async function regenerateCertificate(dataDir, options) {
+	if (readTlsMode(dataDir) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
+	await reissueTlsLeaf(dataDir, options);
+}
+/** Drop the upload and serve the generated local-CA leaf again (D227). */
+async function revertToGeneratedCertificate(dataDir, options) {
+	writeTlsMode(dataDir, "generated");
+	rmSync(join(dataDir, "tls", UPLOADED_CA_FILE), { force: true });
+	await ensureTlsCert(dataDir, options);
+}
+/**
+* Put the pair on disk on the HTTPS listener. Called after every action, so
+* "the certificate changed" and "clients see it" are the same moment.
+*/
+function applyCertificateToListener(dataDir) {
+	const certPath = join(dataDir, "tls", "camstack.crt");
+	const keyPath = join(dataDir, "tls", "camstack.key");
+	if (!existsSync(certPath) || !existsSync(keyPath)) return {
+		kind: "failed",
+		error: `No certificate pair under ${join(dataDir, "tls")}`
+	};
+	return reloadHttpsListener(loadTlsCert(certPath, keyPath));
+}
+//#endregion
+export { allFamiliesListenHost as A, collectCertIdentity as C, SERVER_AUTH_OID as D, MAX_LEAF_VALIDITY_DAYS as E, registerLanHttpHandler as F, bindPendingLanHttp as M, closeLanHttp as N, evaluateExistingCert as O, readLanHttpState as P, CA_COMMON_NAME as S, LEAF_RENEWAL_WINDOW_DAYS as T, writeExtraSans as _, validateUploadedTls as a, loadTlsCert as b, registerHttpsListener as c, prepareBootTls as d, UPLOADED_CA_FILE as f, splitPemCertificates as g, readTlsMode as h, storeUploadedCertificate as i, applyLanHttp as j, DEFAULT_LAN_HTTP_PORT as k, reloadHttpsListener as l, readTlsAccessStatus as m, regenerateCertificate as n, clearHttpsListener as o, readExtraSans as p, revertToGeneratedCertificate as r, leafFingerprintOf as s, applyCertificateToListener as t, servedHttpsLeafFingerprint as u, writeTlsMode as v, CA_VALIDITY_DAYS as w, reissueTlsLeaf as x, ensureTlsCert as y };