@camstack/system 1.2.382 → 1.2.384

package/dist/{tls-CljF057D.js → x509.es-BhTzcFhZ.js}

@@ -1,345 +1,4 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-let node_crypto = require("node:crypto");
-let node_net = require("node:net");
-let node_fs_promises = require("node:fs/promises");
-let node_path = require("node:path");
-let node_os = require("node:os");
-node_os = require_chunk.__toESM(node_os);
-let node_fs = require("node:fs");
-let node_http = require("node:http");
-//#region src/http/lan-http-bind.ts
-/**
-* Second HTTP listener that shares the hub's existing request handler.
-*
-* Fastify is one protocol per instance; HTTPS stays on :4443 and this
-* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
-* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
-*
-* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
-* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
-* hangs because nobody handles the upgrade on this socket.
-*/
-var DEFAULT_HTTP_PORT = 4480;
-var handlers = null;
-var server = null;
-var pending = null;
-var state = {
-	listening: false,
-	error: null,
-	port: DEFAULT_HTTP_PORT
-};
-var boundRequestedHost = null;
-var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
-/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
-function allFamiliesListenHost(host) {
-	if (host === "0.0.0.0" || host === "*" || host === "") return {
-		host: "::",
-		ipv6Only: false
-	};
-	return {
-		host,
-		ipv6Only: false
-	};
-}
-function registerLanHttpHandler(next) {
-	handlers = next;
-}
-function readLanHttpState() {
-	return state;
-}
-async function applyLanHttp(options) {
-	pending = options;
-	if (!options.enabled) {
-		await closeLanHttp();
-		state = {
-			listening: false,
-			error: null,
-			port: options.port
-		};
-		return state;
-	}
-	if (handlers === null) {
-		state = {
-			listening: false,
-			error: "HTTP listener is not registered yet",
-			port: options.port
-		};
-		return state;
-	}
-	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
-	await closeLanHttp();
-	try {
-		const bound = await listenHttp(options.port, options.host, handlers);
-		server = bound;
-		boundRequestedHost = options.host;
-		const addr = bound.address();
-		state = {
-			listening: true,
-			error: null,
-			port: typeof addr === "object" && addr !== null ? addr.port : options.port
-		};
-		return state;
-	} catch (err) {
-		server = null;
-		state = {
-			listening: false,
-			error: err instanceof Error ? err.message : String(err),
-			port: options.port
-		};
-		return state;
-	}
-}
-/** After the hub registers the Fastify request handler, bind whatever was pending. */
-async function bindPendingLanHttp() {
-	if (pending === null) return applyLanHttp({
-		enabled: true,
-		port: DEFAULT_HTTP_PORT,
-		host: "0.0.0.0"
-	});
-	return applyLanHttp(pending);
-}
-async function closeLanHttp() {
-	const current = server;
-	server = null;
-	boundRequestedHost = null;
-	if (current === null) return;
-	await new Promise((resolve) => {
-		current.close(() => resolve());
-	});
-}
-function listenHttp(port, host, next) {
-	const resolved = allFamiliesListenHost(host);
-	return listenOn(port, resolved, next).catch((err) => {
-		if (resolved.host === "::" && host !== "::") return listenOn(port, {
-			host: "0.0.0.0",
-			ipv6Only: false
-		}, next);
-		throw err;
-	});
-}
-function listenOn(port, bind, next) {
-	return new Promise((resolve, reject) => {
-		const created = (0, node_http.createServer)(next.onRequest);
-		created.on("upgrade", next.onUpgrade);
-		const onError = (err) => {
-			created.off("listening", onListening);
-			created.close();
-			reject(err);
-		};
-		const onListening = () => {
-			created.off("error", onError);
-			resolve(created);
-		};
-		created.once("error", onError);
-		created.once("listening", onListening);
-		created.listen({
-			port,
-			host: bind.host,
-			ipv6Only: bind.ipv6Only
-		});
-	});
-}
-//#endregion
-//#region src/tls/cert-evaluation.ts
-/**
-* The regeneration rule (D227), as a pure function.
-*
-* `ensureTlsCert` reissues **only** when the material on disk cannot do
-* its job. Never because it is old, never because the machine picked up
-* an address the certificate does not need, never because a new build
-* shipped. The decision is a function of (files on disk, machine
-* identity, clock) alone, so the same inputs always produce the same
-* answer — which is what makes a reissue happen once and then stop.
-*/
-/** OID `id-kp-serverAuth`. Apple's trustd requires it on the leaf. */
-var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
-/**
-* Apple's `SecPolicyCheckOtherTrustValidityPeriod` ceiling is 825 days;
-* the CA/Browser Forum's recommended maximum is 397. We sit at 397.
-*/
-var MAX_LEAF_VALIDITY_DAYS = 397;
-/** Reissue this long before the leaf dies, so nobody serves an expired one. */
-var LEAF_RENEWAL_WINDOW_DAYS = 30;
-/** A local root outlives many leaves — it is the anchor an operator trusts. */
-var CA_VALIDITY_DAYS = 3650;
-var MS_PER_DAY$1 = 864e5;
-/** Reasons that invalidate the root as well as the leaf. */
-var REASONS_REQUIRING_NEW_CA = [
-	"missing",
-	"unreadable",
-	"no-local-ca",
-	"ca-expiring"
-];
-function reasonRequiresNewCa(reason) {
-	return REASONS_REQUIRING_NEW_CA.includes(reason);
-}
-function parse(pem) {
-	try {
-		return new node_crypto.X509Certificate(pem);
-	} catch {
-		return null;
-	}
-}
-function daysBetween(from, to) {
-	return (to.getTime() - from.getTime()) / MS_PER_DAY$1;
-}
-function hasServerAuthEku(leaf) {
-	const eku = leaf.keyUsage;
-	return eku !== void 0 && eku.length === 1 && eku[0] === "1.3.6.1.5.5.7.3.1";
-}
-function keyMatches(leaf, keyPem) {
-	try {
-		return leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem));
-	} catch {
-		return false;
-	}
-}
-function coversIdentity(leaf, identity) {
-	for (const name of identity.requiredDnsNames) if (leaf.checkHost(name) === void 0) return false;
-	for (const ip of identity.requiredIpAddresses) if (leaf.checkIP(ip) === void 0) return false;
-	return true;
-}
-/**
-* `null` when the material on disk is fit to keep serving.
-*
-* Order matters only for the quality of the reported reason; any
-* non-null answer produces the same action.
-*/
-function evaluateExistingCert(input) {
-	const leaf = parse(input.chainPem);
-	const ca = parse(input.caPem);
-	if (leaf === null || ca === null) return "unreadable";
-	if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
-	if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
-	if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
-	if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
-	if (leaf.ca || !leaf.checkIssued(ca) || !leaf.verify(ca.publicKey)) return "not-issued-by-local-ca";
-	if (daysBetween(new Date(leaf.validFrom), new Date(leaf.validTo)) > 398) return "validity-too-long";
-	if (!coversIdentity(leaf, input.identity)) return "san-coverage-gap";
-	return null;
-}
-//#endregion
-//#region src/tls/cert-identity.ts
-/**
-* What names and addresses the hub's certificate has to answer for.
-*
-* Split out of `cert-manager.ts` because it is pure and because the
-* regeneration rule (D227) is decided entirely by the difference between
-* *this* and what the certificate on disk already carries.
-*/
-/** The real machine. The only place in `tls/` that touches `os`. */
-function systemHostFacts() {
-	return {
-		hostname: node_os.hostname(),
-		networkInterfaces: node_os.networkInterfaces()
-	};
-}
-/**
-* Interfaces whose addresses are certified but never gate a reissue:
-* container bridges, VPN tunnels and mesh overlays hand out addresses
-* that change without the hub moving.
-*/
-var VOLATILE_INTERFACE_PREFIXES = [
-	"docker",
-	"br-",
-	"veth",
-	"virbr",
-	"cni",
-	"flannel",
-	"tun",
-	"utun",
-	"tap",
-	"wg",
-	"zt",
-	"tailscale",
-	"ppp",
-	"awdl",
-	"llw"
-];
-/** A DNS name we are willing to put in a SAN. */
-var DNS_NAME_PATTERN = /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/;
-function isIpv4(value) {
-	return (0, node_net.isIP)(value) === 4;
-}
-function isIpv6(value) {
-	return (0, node_net.isIP)(value) === 6;
-}
-/**
-* `fe80::/10` and `169.254.0.0/16`. An IPv6 link-local address needs a
-* zone index to be usable and a SAN cannot carry one, so such an entry
-* can never match anything — it is noise that makes the certificate look
-* broader than it is.
-*/
-function isLinkLocal(value) {
-	if (isIpv4(value)) return value.startsWith("169.254.");
-	if (!isIpv6(value)) return false;
-	const firstGroup = value.split(":")[0] ?? "";
-	if (firstGroup === "") return false;
-	const parsed = Number.parseInt(firstGroup, 16);
-	return Number.isFinite(parsed) && (parsed & 65472) === 65152;
-}
-function isVolatileInterface(name) {
-	const lower = name.toLowerCase();
-	return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
-}
-/**
-* Only IPv4 gates a reissue. Every IPv6 address we see — global **or**
-* ULA — is certified but never required: `os` cannot tell a temporary
-* address from a permanent one, and the live hub's ULA interface-id
-* rotated on every restart (eight leaf reissues in one day under
-* `san-coverage-gap`). Gating on ULA reproduced the churn D227 exists
-* to prevent. Operators who need a fixed IPv6 declare it via `extraSans`.
-*/
-function isStableGateAddress(address) {
-	if (isLinkLocal(address)) return false;
-	return isIpv4(address);
-}
-function addSan(dns, ips, value) {
-	const trimmed = value.trim();
-	if (trimmed === "") return;
-	if ((0, node_net.isIP)(trimmed) !== 0) {
-		if (!isLinkLocal(trimmed)) ips.add(trimmed);
-		return;
-	}
-	if (DNS_NAME_PATTERN.test(trimmed)) dns.add(trimmed);
-}
-/**
-* Snapshot the machine's identity. Called once per `ensureTlsCert`; the
-* result is both the SAN list for a new leaf and the yardstick the
-* existing leaf is measured against.
-*/
-function collectCertIdentity(options) {
-	const host = options.hostFacts ?? systemHostFacts();
-	const dnsNames = /* @__PURE__ */ new Set();
-	const ipAddresses = new Set(["127.0.0.1", "::1"]);
-	const requiredDnsNames = /* @__PURE__ */ new Set();
-	const requiredIpAddresses = new Set(["127.0.0.1"]);
-	for (const name of [
-		"localhost",
-		options.commonName,
-		host.hostname
-	]) {
-		addSan(dnsNames, ipAddresses, name);
-		addSan(requiredDnsNames, requiredIpAddresses, name);
-	}
-	for (const [ifaceName, addrs] of Object.entries(host.networkInterfaces)) for (const addr of addrs ?? []) {
-		if (addr.internal) continue;
-		if (isLinkLocal(addr.address)) continue;
-		ipAddresses.add(addr.address);
-		if (isVolatileInterface(ifaceName)) continue;
-		if (isStableGateAddress(addr.address)) requiredIpAddresses.add(addr.address);
-	}
-	for (const san of options.extraSans) {
-		addSan(dnsNames, ipAddresses, san);
-		addSan(requiredDnsNames, requiredIpAddresses, san);
-	}
-	return {
-		dnsNames: [...dnsNames],
-		ipAddresses: [...ipAddresses],
-		requiredDnsNames: [...requiredDnsNames],
-		requiredIpAddresses: [...requiredIpAddresses]
-	};
-}
 /*! *****************************************************************************
 Copyright (C) Microsoft. All rights reserved.
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -11248,8 +10907,44 @@ var Pkcs10CertificateRequest = class extends PemData {
 };
 _Pkcs10CertificateRequest_tbs = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_subjectName = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_subject = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_signatureAlgorithm = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_signature = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_publicKey = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_attributes = /* @__PURE__ */ new WeakMap(), _Pkcs10CertificateRequest_extensions = /* @__PURE__ */ new WeakMap();
 Pkcs10CertificateRequest.NAME = "PKCS#10 Certificate Request";
+var Pkcs10CertificateRequestGenerator = class {
+	static async create(params, crypto = cryptoProvider.get()) {
+		if (!params.keys.privateKey) throw new Error("Bad field 'keys' in 'params' argument. 'privateKey' is empty");
+		if (!params.keys.publicKey) throw new Error("Bad field 'keys' in 'params' argument. 'publicKey' is empty");
+		const spki = await crypto.subtle.exportKey("spki", params.keys.publicKey);
+		const asnReq = new CertificationRequest({ certificationRequestInfo: new CertificationRequestInfo({ subjectPKInfo: AsnConvert.parse(spki, SubjectPublicKeyInfo) }) });
+		if (params.name) {
+			const name = params.name instanceof Name ? params.name : new Name(params.name);
+			asnReq.certificationRequestInfo.subject = AsnConvert.parse(name.toArrayBuffer(), Name$1);
+		}
+		if (params.attributes) for (const o of params.attributes) asnReq.certificationRequestInfo.attributes.push(AsnConvert.parse(o.rawData, Attribute$2));
+		if (params.extensions && params.extensions.length) {
+			const attr = new Attribute$2({ type: id_pkcs9_at_extensionRequest });
+			const extensions = new Extensions();
+			for (const o of params.extensions) extensions.push(AsnConvert.parse(o.rawData, Extension$1));
+			attr.values.push(AsnConvert.serialize(extensions));
+			asnReq.certificationRequestInfo.attributes.push(attr);
+		}
+		const signingAlgorithm = {
+			...params.signingAlgorithm,
+			...params.keys.privateKey.algorithm
+		};
+		asnReq.signatureAlgorithm = instance.resolve(diAlgorithmProvider).toAsnAlgorithm(signingAlgorithm);
+		const tbs = AsnConvert.serialize(asnReq.certificationRequestInfo);
+		const signature = await crypto.subtle.sign(signingAlgorithm, params.keys.privateKey, tbs);
+		const signatureFormatters = instance.resolveAll(diAsnSignatureFormatter).reverse();
+		let asnSignature = null;
+		for (const signatureFormatter of signatureFormatters) {
+			asnSignature = signatureFormatter.toAsnSignature(signingAlgorithm, signature);
+			if (asnSignature) break;
+		}
+		if (!asnSignature) throw Error("Cannot convert WebCrypto signature value to ASN.1 format");
+		asnReq.signature = asnSignature;
+		return new Pkcs10CertificateRequest(AsnConvert.serialize(asnReq));
+	}
+};
 var _X509Certificate_tbs, _X509Certificate_serialNumber, _X509Certificate_subjectName, _X509Certificate_subject, _X509Certificate_issuerName, _X509Certificate_issuer, _X509Certificate_notBefore, _X509Certificate_notAfter, _X509Certificate_signatureAlgorithm, _X509Certificate_signature, _X509Certificate_extensions, _X509Certificate_publicKey;
-var X509Certificate$4 = class extends PemData {
+var X509Certificate = class extends PemData {
 	get publicKey() {
 		if (!__classPrivateFieldGet(this, _X509Certificate_publicKey, "f")) __classPrivateFieldSet(this, _X509Certificate_publicKey, new PublicKey(this.asn.tbsCertificate.subjectPublicKeyInfo), "f");
 		return __classPrivateFieldGet(this, _X509Certificate_publicKey, "f");
@@ -11449,7 +11144,7 @@ var X509Certificate$4 = class extends PemData {
 	}
 };
 _X509Certificate_tbs = /* @__PURE__ */ new WeakMap(), _X509Certificate_serialNumber = /* @__PURE__ */ new WeakMap(), _X509Certificate_subjectName = /* @__PURE__ */ new WeakMap(), _X509Certificate_subject = /* @__PURE__ */ new WeakMap(), _X509Certificate_issuerName = /* @__PURE__ */ new WeakMap(), _X509Certificate_issuer = /* @__PURE__ */ new WeakMap(), _X509Certificate_notBefore = /* @__PURE__ */ new WeakMap(), _X509Certificate_notAfter = /* @__PURE__ */ new WeakMap(), _X509Certificate_signatureAlgorithm = /* @__PURE__ */ new WeakMap(), _X509Certificate_signature = /* @__PURE__ */ new WeakMap(), _X509Certificate_extensions = /* @__PURE__ */ new WeakMap(), _X509Certificate_publicKey = /* @__PURE__ */ new WeakMap();
-X509Certificate$4.NAME = "Certificate";
+X509Certificate.NAME = "Certificate";
 function generateCertificateSerialNumber(input, crypto = cryptoProvider.get()) {
 	const inputView = BufferSourceConverter.toUint8Array(Convert.FromHex(input || ""));
 	let serialNumber = inputView && inputView.length && inputView.some((o) => o > 0) ? new Uint8Array(inputView) : void 0;
@@ -11530,7 +11225,7 @@ var X509CertificateGenerator = class {
 		}
 		if (!asnSignature) throw Error("Cannot convert ASN.1 signature value to WebCrypto format");
 		asnX509.signatureValue = asnSignature;
-		return new X509Certificate$4(AsnConvert.serialize(asnX509));
+		return new X509Certificate(AsnConvert.serialize(asnX509));
 	}
 };
 var X509CrlReason;
@@ -11564,819 +11259,81 @@ AsnEcSignatureFormatter.namedCurveSize.set("K-256", 32);
 AsnEcSignatureFormatter.namedCurveSize.set("P-384", 48);
 AsnEcSignatureFormatter.namedCurveSize.set("P-521", 66);
 //#endregion
-//#region src/tls/cert-issue.ts
-cryptoProvider.set(node_crypto.webcrypto);
-/** Subject of the local root. Distinct from the leaf's CN by construction. */
-var CA_COMMON_NAME = "CamStack Local CA";
-var MS_PER_DAY = 864e5;
-/**
-* RSA-2048 / SHA-256. Unchanged from the openssl invocation this replaces:
-* every client that trusted the previous material still understands this.
-*/
-var SIGNING_ALGORITHM = {
-	name: "RSASSA-PKCS1-v1_5",
-	hash: "SHA-256",
-	publicExponent: new Uint8Array([
-		1,
-		0,
-		1
-	]),
-	modulusLength: 2048
-};
-/**
-* A serial number that is positive and unpredictable. `00` prefix for the
-* same reason the openssl invocation carried one: a leading bit of 1 would
-* make the DER INTEGER negative.
-*/
-function freshSerial() {
-	return `00${(0, node_crypto.randomBytes)(16).toString("hex")}`;
-}
-function toPkcs8Pem(pkcs8) {
-	return `${PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`;
-}
-function toCertPem(cert) {
-	return `${cert.toString("pem")}\n`;
-}
-async function exportKeyPem(key) {
-	return toPkcs8Pem(await node_crypto.webcrypto.subtle.exportKey("pkcs8", key));
-}
-/** SAN entries, in the order `cert-identity` produced them. */
-function subjectAltNames(identity) {
-	const names = [];
-	for (const dns of identity.dnsNames) names.push({
-		type: "dns",
-		value: dns
-	});
-	for (const ip of identity.ipAddresses) if ((0, node_net.isIP)(ip) !== 0) names.push({
-		type: "ip",
-		value: ip
-	});
-	return names;
-}
-/**
-* A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
-* else, and **no EKU** — Apple rejects an anchor asserting
-* `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
-*/
-async function generateCa(now) {
-	const keys = await node_crypto.webcrypto.subtle.generateKey(SIGNING_ALGORITHM, true, ["sign", "verify"]);
-	const extensions = [
-		new BasicConstraintsExtension(true, 0, true),
-		new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
-		await SubjectKeyIdentifierExtension.create(keys.publicKey)
-	];
-	const cert = await X509CertificateGenerator.createSelfSigned({
-		serialNumber: freshSerial(),
-		name: `CN=${CA_COMMON_NAME}`,
-		notBefore: now,
-		notAfter: new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY),
-		keys,
-		signingAlgorithm: SIGNING_ALGORITHM,
-		extensions
-	});
-	return {
-		certPem: toCertPem(cert),
-		keyPem: await exportKeyPem(keys.privateKey),
-		cert,
-		privateKey: keys.privateKey
-	};
-}
-/** Re-open a root already on disk so a leaf can be issued under it. */
-async function loadCa(certPem, keyPem) {
-	return {
-		certPem,
-		keyPem,
-		cert: new X509Certificate$4(certPem),
-		privateKey: await node_crypto.webcrypto.subtle.importKey("pkcs8", PemConverter.decodeFirst(keyPem), SIGNING_ALGORITHM, true, ["sign"])
-	};
-}
-/**
-* A server leaf signed by the local root: `CA:FALSE`, and
-* `extendedKeyUsage=serverAuth` — not `anyExtendedKeyUsage`, which
-* Apple's `testAppTrustRoot_AnyEKU_AfterJul2019` asserts must fail.
-*/
-async function issueLeaf(ca, identity, commonName, validDays, now) {
-	const keys = await node_crypto.webcrypto.subtle.generateKey(SIGNING_ALGORITHM, true, ["sign", "verify"]);
-	const extensions = [
-		new BasicConstraintsExtension(false, void 0, true),
-		new KeyUsagesExtension(KeyUsageFlags.digitalSignature | KeyUsageFlags.keyEncipherment, true),
-		new ExtendedKeyUsageExtension([SERVER_AUTH_OID]),
-		await SubjectKeyIdentifierExtension.create(keys.publicKey),
-		await AuthorityKeyIdentifierExtension.create(ca.cert),
-		new SubjectAlternativeNameExtension(subjectAltNames(identity))
-	];
-	return {
-		certPem: toCertPem(await X509CertificateGenerator.create({
-			serialNumber: freshSerial(),
-			subject: `CN=${commonName}`,
-			issuer: ca.cert.subject,
-			notBefore: now,
-			notAfter: new Date(now.getTime() + validDays * MS_PER_DAY),
-			publicKey: keys.publicKey,
-			signingKey: ca.privateKey,
-			signingAlgorithm: SIGNING_ALGORITHM,
-			extensions
-		})),
-		keyPem: await exportKeyPem(keys.privateKey)
-	};
-}
-//#endregion
-//#region src/tls/cert-manager.ts
-var DEFAULT_COMMON_NAME = "camstack.local";
-/**
-* Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
-* a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
-* chained to it (`camstack.crt` = leaf + root, `camstack.key`).
-*
-* ## The regeneration rule (D227)
-*
-* Reissue happens when, and only when, the material on disk **cannot do
-* its job**:
-*
-* - it is absent, unreadable, or the key does not match the certificate;
-* - the root is absent (every pre-2026-08 install: one self-signed
-*   `CA:TRUE` leaf and no root) or is inside its renewal window;
-* - the leaf is inside its 30-day renewal window;
-* - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
-*   rejects an app-supplied anchor without it;
-* - the leaf is not actually issued by the root on disk;
-* - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
-* - **a name or address the hub must answer for is missing from the SAN
-*   list** — a DHCP move, a new interface or a new hostname.
-*
-* And explicitly NOT when: the certificate names an address the machine
-* no longer has (a superset still works — the check is one-directional),
-* a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
-* (global and ULA both rotate under privacy extensions / interface-id
-* churn — `os` cannot tell temporary from permanent), or a new build shipped.
-*
-* Every trigger is derived from the files plus the machine, so once a
-* reissue clears them it clears them for good: the next boot returns
-* `generated: false`. A certificate that moved on every boot would
-* invalidate every trust an operator granted by hand — worse than the
-* bugs this rule fixes.
-*
-* **The root is rotated only for root-level reasons.** SAN drift rotates
-* the leaf alone, so trust granted to `camstack-ca.crt` survives every
-* address change the hub will ever see.
-*/
-async function ensureTlsCert(dataDir, options) {
-	const tlsDir = (0, node_path.join)(dataDir, "tls");
-	const paths = {
-		certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
-		keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
-		caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
-		caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
-	};
-	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
-	const validDays = Math.min(options?.validDays ?? 397, 397);
-	const identity = collectCertIdentity({
-		commonName,
-		extraSans: options?.extraSans ?? [],
-		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
-	});
-	const reason = decideRegeneration(paths, identity);
-	if (reason === null) return describe(paths, false, null, false, null, null);
-	const previousFingerprint = readFingerprint(paths.certPath);
-	const caRotated = reasonRequiresNewCa(reason);
-	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
-	try {
-		await regenerate(paths, identity, commonName, validDays, caRotated);
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		if (!canKeepServing(paths)) throw err;
-		return describe(paths, false, null, false, null, message);
-	}
-	return describe(paths, true, reason, caRotated, previousFingerprint, null);
-}
-/**
-* Operator "Regenerate": issue a new leaf under the existing local CA.
-* Never rotates the root — trust granted to `camstack-ca.crt` survives.
-*/
-async function reissueTlsLeaf(dataDir, options) {
-	const tlsDir = (0, node_path.join)(dataDir, "tls");
-	const paths = {
-		certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
-		keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
-		caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
-		caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
-	};
-	if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return ensureTlsCert(dataDir, options);
-	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
-	const validDays = Math.min(options?.validDays ?? 397, 397);
-	const identity = collectCertIdentity({
-		commonName,
-		extraSans: options?.extraSans ?? [],
-		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
-	});
-	const previousFingerprint = readFingerprint(paths.certPath);
-	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
-	await regenerate(paths, identity, commonName, validDays, false);
-	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null);
-}
-/** True when the material already on disk can still terminate TLS. */
-function canKeepServing(paths) {
-	if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return false;
-	if (!(0, node_fs.existsSync)(paths.caCertPath)) return false;
-	return readFingerprint(paths.certPath) !== null;
-}
-/** Fingerprint of whatever is on disk, or `null` if there is nothing readable. */
-function readFingerprint(certPath) {
-	try {
-		return new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath)).fingerprint256;
-	} catch {
-		return null;
-	}
-}
-function decideRegeneration(paths, identity) {
-	if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return "missing";
-	if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return "no-local-ca";
-	try {
-		return evaluateExistingCert({
-			chainPem: (0, node_fs.readFileSync)(paths.certPath, "utf-8"),
-			keyPem: (0, node_fs.readFileSync)(paths.keyPath, "utf-8"),
-			caPem: (0, node_fs.readFileSync)(paths.caCertPath, "utf-8"),
-			identity,
-			now: /* @__PURE__ */ new Date()
-		});
-	} catch {
-		return "unreadable";
-	}
-}
-/**
-* Build every byte in memory, then move the files into place. A crash
-* mid-way leaves the previous material untouched; a crash between the
-* moves leaves a key/certificate mismatch, which the evaluator reports as
-* `key-mismatch` and heals on the next boot.
-*/
-async function regenerate(paths, identity, commonName, validDays, newCa) {
-	const now = /* @__PURE__ */ new Date();
-	const ca = newCa ? await generateCa(now) : await loadCa((0, node_fs.readFileSync)(paths.caCertPath, "utf-8"), (0, node_fs.readFileSync)(paths.caKeyPath, "utf-8"));
-	const leaf = await issueLeaf(ca, identity, commonName, validDays, now);
-	const chainPem = `${leaf.certPem.trimEnd()}\n${ca.certPem.trimEnd()}\n`;
-	if (newCa) {
-		await (0, node_fs_promises.writeFile)(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
-		await (0, node_fs_promises.writeFile)(`${paths.caKeyPath}.new`, ca.keyPem, {
-			encoding: "utf-8",
-			mode: 384
-		});
-		(0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
-		(0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
-		await (0, node_fs_promises.chmod)(paths.caKeyPath, 384);
-	}
-	await (0, node_fs_promises.writeFile)(`${paths.keyPath}.new`, leaf.keyPem, {
-		encoding: "utf-8",
-		mode: 384
-	});
-	await (0, node_fs_promises.writeFile)(`${paths.certPath}.new`, chainPem, "utf-8");
-	(0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
-	(0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
-	await (0, node_fs_promises.chmod)(paths.keyPath, 384);
-}
-function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
-	const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
-	const ca = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath));
-	const san = leaf.subjectAltName ?? "";
-	return {
-		...paths,
-		generated,
-		reason,
-		caRotated,
-		fingerprintSha256: leaf.fingerprint256,
-		previousFingerprintSha256,
-		caFingerprintSha256: ca.fingerprint256,
-		validTo: new Date(leaf.validTo).toISOString(),
-		sans: san === "" ? [] : san.split(", "),
-		reissueError
-	};
-}
-/**
-* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
-* options. `certPath` is a full chain, so the listener presents the local
-* root alongside the leaf.
-*/
-function loadTlsCert(certPath, keyPath) {
-	return {
-		cert: (0, node_fs.readFileSync)(certPath),
-		key: (0, node_fs.readFileSync)(keyPath)
-	};
-}
-//#endregion
-//#region src/tls/tls-status.ts
-function tlsDir(dataDir) {
-	return (0, node_path.join)(dataDir, "tls");
-}
-function readTlsMode(dataDir) {
-	const marker = (0, node_path.join)(tlsDir(dataDir), "mode");
-	if ((0, node_fs.existsSync)(marker)) {
-		const raw = (0, node_fs.readFileSync)(marker, "utf-8").trim();
-		if (raw === "uploaded") return "uploaded";
-		if (raw === "disabled") return "disabled";
-	}
-	return (0, node_fs.existsSync)((0, node_path.join)(tlsDir(dataDir), "camstack.crt")) ? "generated" : "disabled";
-}
-function writeTlsMode(dataDir, mode) {
-	(0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
-	(0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "mode"), `${mode}\n`, "utf-8");
-}
-function readExtraSans(dataDir) {
-	const path = (0, node_path.join)(tlsDir(dataDir), "extra-sans.json");
-	if (!(0, node_fs.existsSync)(path)) return [];
-	try {
-		const parsed = JSON.parse((0, node_fs.readFileSync)(path, "utf-8"));
-		if (!Array.isArray(parsed)) return [];
-		return parsed.filter((entry) => typeof entry === "string" && entry.length > 0);
-	} catch {
-		return [];
-	}
-}
-function writeExtraSans(dataDir, sans) {
-	(0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
-	(0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}\n`, "utf-8");
-}
-/** Where an upload's own CA is kept — never over the local CA's `camstack-ca.crt`. */
-var UPLOADED_CA_FILE = "uploaded-ca.crt";
-/** Every certificate in a PEM bundle, in order. */
-function splitPemCertificates(pem) {
-	const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
-	return blocks === null ? [] : blocks.map((block) => `${block}\n`);
-}
-/**
-* The certificate that signed `leaf`, from the upload itself: the CA the
-* operator supplied, else the rest of the uploaded chain. `null` when the
-* upload did not include it — and then nothing may stand in for it: the
-* local CA did not sign an uploaded leaf, so handing it out as "the CA" would
-* tell a client to trust a root that verifies nothing it is served.
-*/
-function uploadedIssuer(dir, leaf, chainPem) {
-	const caPath = (0, node_path.join)(dir, UPLOADED_CA_FILE);
-	const candidates = [...(0, node_fs.existsSync)(caPath) ? splitPemCertificates((0, node_fs.readFileSync)(caPath, "utf-8")) : [], ...splitPemCertificates(chainPem).slice(1)];
-	for (const pem of candidates) try {
-		const cert = new node_crypto.X509Certificate(pem);
-		if (leaf.checkIssued(cert) && leaf.verify(cert.publicKey)) return {
-			pem,
-			cert
-		};
-	} catch {}
-	return null;
-}
-function generatedIssuer(dir) {
-	const caPath = (0, node_path.join)(dir, "camstack-ca.crt");
-	if (!(0, node_fs.existsSync)(caPath)) return null;
-	const pem = (0, node_fs.readFileSync)(caPath, "utf-8");
-	return {
-		pem,
-		cert: new node_crypto.X509Certificate(pem)
-	};
-}
-/**
-* What the node's certificate is, and whether the listener serves it.
-* `servedLeafFingerprint` is the leaf the HTTPS listener presents right now
-* (`servedHttpsLeafFingerprint()`), or `null` when unknown; a restart is
-* required exactly when the listener serves a different leaf than the one
-* on disk — a measured fact, not a flag a mutation remembered to set.
-*/
-function readTlsAccessStatus(dataDir, servedLeafFingerprint) {
-	const dir = tlsDir(dataDir);
-	const certPath = (0, node_path.join)(dir, "camstack.crt");
-	const mode = readTlsMode(dataDir);
-	if (!(0, node_fs.existsSync)(certPath)) return {
-		mode: "disabled",
-		leafFingerprintSha256: null,
-		caFingerprintSha256: null,
-		validTo: null,
-		sans: [],
-		caCertPem: (mode === "uploaded" ? null : generatedIssuer(dir))?.pem ?? null,
-		reissueError: null,
-		restartRequired: false
-	};
-	try {
-		const chainPem = (0, node_fs.readFileSync)(certPath, "utf-8");
-		const leaf = new node_crypto.X509Certificate(chainPem);
-		const ca = mode === "uploaded" ? uploadedIssuer(dir, leaf, chainPem) : generatedIssuer(dir);
-		const san = leaf.subjectAltName ?? "";
-		return {
-			mode,
-			leafFingerprintSha256: leaf.fingerprint256,
-			caFingerprintSha256: ca?.cert.fingerprint256 ?? null,
-			validTo: new Date(leaf.validTo).toISOString(),
-			sans: san === "" ? [] : san.split(", "),
-			caCertPem: ca?.pem ?? null,
-			reissueError: null,
-			restartRequired: servedLeafFingerprint !== null && servedLeafFingerprint !== leaf.fingerprint256
-		};
-	} catch {
-		return {
-			mode,
-			leafFingerprintSha256: null,
-			caFingerprintSha256: null,
-			validTo: null,
-			sans: [],
-			caCertPem: null,
-			reissueError: "Certificate on disk could not be parsed.",
-			restartRequired: false
-		};
-	}
-}
-//#endregion
-//#region src/tls/boot-tls.ts
-/**
-* Decide what the listener serves at boot. The admin UI (Network → Local
-* access) is the only way to set a certificate (D726): it either leaves the
-* hub on its generated local-CA leaf (D227) or uploads one, recorded by the
-* `tls/mode` marker. An uploaded certificate is served verbatim — running it
-* through `ensureTlsCert` would replace it on the first restart, because a
-* leaf the local root did not issue is one of that rule's reissue triggers.
-*/
-async function prepareBootTls(dataDir, options) {
-	const certPath = (0, node_path.join)(dataDir, "tls", "camstack.crt");
-	const keyPath = (0, node_path.join)(dataDir, "tls", "camstack.key");
-	const marked = readTlsMode(dataDir);
-	if (marked === "uploaded" && (0, node_fs.existsSync)(certPath) && (0, node_fs.existsSync)(keyPath)) return {
-		mode: "uploaded",
-		pair: loadTlsCert(certPath, keyPath),
-		ensured: void 0,
-		uploadedMissing: false
-	};
-	const uploadedMissing = marked === "uploaded";
-	if (uploadedMissing) writeTlsMode(dataDir, "generated");
-	const ensured = await ensureTlsCert(dataDir, options);
-	return {
-		mode: "generated",
-		pair: loadTlsCert(ensured.certPath, ensured.keyPath),
-		ensured,
-		uploadedMissing
-	};
-}
-//#endregion
-//#region src/tls/https-listener.ts
-var SLOT_KEY = Symbol.for("camstack.tls.https-listener");
-var EMPTY_SLOT = {
-	reload: null,
-	servedLeafFingerprint: null
-};
-function isSlot(value) {
-	if (typeof value !== "object" || value === null) return false;
-	if (!("reload" in value) || !("servedLeafFingerprint" in value)) return false;
-	const reload = value.reload;
-	const served = value.servedLeafFingerprint;
-	return (reload === null || typeof reload === "function") && (served === null || typeof served === "string");
-}
-function readSlot() {
-	const current = Reflect.get(globalThis, SLOT_KEY);
-	return isSlot(current) ? current : EMPTY_SLOT;
-}
-function writeSlot(next) {
-	Reflect.set(globalThis, SLOT_KEY, next);
-}
-/** SHA-256 fingerprint of the first certificate (the leaf) in a PEM chain. */
-function leafFingerprintOf(chain) {
-	return new node_crypto.X509Certificate(chain).fingerprint256;
-}
-/**
-* Called once by the server after its HTTPS listener is up, with the pair it
-* was started on. From here on a certificate action swaps the served
-* certificate in place (`setSecureContext`) — new handshakes get the new
-* leaf, open connections keep theirs, nothing restarts.
-*/
-function registerHttpsListener(server, pair) {
-	writeSlot({
-		reload: (next) => server.setSecureContext({
-			cert: next.cert,
-			key: next.key
-		}),
-		servedLeafFingerprint: leafFingerprintOf(pair.cert)
-	});
-}
-/** Forget the listener — on shutdown, and between specs. */
-function clearHttpsListener() {
-	writeSlot(EMPTY_SLOT);
-}
-/**
-* The leaf the HTTPS listener serves now, or `null` when this process has no
-* registered listener (TLS off, or a process that does not own one) — in
-* which case nobody can say, and `null` is the honest answer.
-*/
-function servedHttpsLeafFingerprint() {
-	return readSlot().servedLeafFingerprint;
-}
-/** Serve `pair` from now on. Never throws: the outcome says what happened. */
-function reloadHttpsListener(pair) {
-	const slot = readSlot();
-	if (slot.reload === null) return { kind: "no-listener" };
-	try {
-		const servedLeafFingerprint = leafFingerprintOf(pair.cert);
-		slot.reload(pair);
-		writeSlot({
-			reload: slot.reload,
-			servedLeafFingerprint
-		});
-		return {
-			kind: "reloaded",
-			servedLeafFingerprint
-		};
-	} catch (err) {
-		return {
-			kind: "failed",
-			error: err instanceof Error ? err.message : String(err)
-		};
-	}
-}
-//#endregion
-//#region src/tls/uploaded-cert.ts
-/**
-* Operator-supplied material must parse, match its key, and carry
-* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
-* to keep generating.
-*/
-function validateUploadedTls(certPem, keyPem) {
-	let leaf;
-	try {
-		leaf = new node_crypto.X509Certificate(certPem);
-	} catch {
-		return {
-			ok: false,
-			error: "Certificate PEM could not be parsed."
-		};
-	}
-	try {
-		if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem))) return {
-			ok: false,
-			error: "Private key does not match the certificate."
-		};
-	} catch {
-		return {
-			ok: false,
-			error: "Private key PEM could not be parsed."
-		};
-	}
-	const eku = leaf.keyUsage;
-	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
-		ok: false,
-		error: "Certificate is missing extendedKeyUsage = serverAuth."
-	};
-	return {
-		ok: true,
-		fingerprintSha256: leaf.fingerprint256,
-		validTo: new Date(leaf.validTo).toISOString()
-	};
-}
-//#endregion
-//#region src/tls/tls-actions.ts
-function withNewline(pem) {
-	return pem.endsWith("\n") ? pem : `${pem}\n`;
-}
-/**
-* Store an operator's certificate. The leaf (or chain) and key replace the
-* served pair; a CA, when given, goes to its own file. The local CA
-* (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
-* and it is what "Revert to generated" and every device that trusts it
-* still need.
-*/
-async function storeUploadedCertificate(dataDir, input) {
-	const valid = validateUploadedTls(input.certPem, input.keyPem);
-	if (!valid.ok) throw new Error(valid.error);
-	const dir = (0, node_path.join)(dataDir, "tls");
-	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
-	await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.crt"), withNewline(input.certPem));
-	await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.key"), withNewline(input.keyPem), { mode: 384 });
-	const caPath = (0, node_path.join)(dir, UPLOADED_CA_FILE);
-	if (input.caPem !== void 0 && input.caPem.trim() !== "") await (0, node_fs_promises.writeFile)(caPath, withNewline(input.caPem));
-	else (0, node_fs.rmSync)(caPath, { force: true });
-	writeTlsMode(dataDir, "uploaded");
-}
-/** Issue a new generated leaf under the local CA. Refused while an upload is served. */
-async function regenerateCertificate(dataDir, options) {
-	if (readTlsMode(dataDir) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
-	await reissueTlsLeaf(dataDir, options);
-}
-/** Drop the upload and serve the generated local-CA leaf again (D227). */
-async function revertToGeneratedCertificate(dataDir, options) {
-	writeTlsMode(dataDir, "generated");
-	(0, node_fs.rmSync)((0, node_path.join)(dataDir, "tls", UPLOADED_CA_FILE), { force: true });
-	await ensureTlsCert(dataDir, options);
-}
-/**
-* Put the pair on disk on the HTTPS listener. Called after every action, so
-* "the certificate changed" and "clients see it" are the same moment.
-*/
-function applyCertificateToListener(dataDir) {
-	const certPath = (0, node_path.join)(dataDir, "tls", "camstack.crt");
-	const keyPath = (0, node_path.join)(dataDir, "tls", "camstack.key");
-	if (!(0, node_fs.existsSync)(certPath) || !(0, node_fs.existsSync)(keyPath)) return {
-		kind: "failed",
-		error: `No certificate pair under ${(0, node_path.join)(dataDir, "tls")}`
-	};
-	return reloadHttpsListener(loadTlsCert(certPath, keyPath));
-}
-//#endregion
-Object.defineProperty(exports, "CA_COMMON_NAME", {
-	enumerable: true,
-	get: function() {
-		return CA_COMMON_NAME;
-	}
-});
-Object.defineProperty(exports, "CA_VALIDITY_DAYS", {
-	enumerable: true,
-	get: function() {
-		return CA_VALIDITY_DAYS;
-	}
-});
-Object.defineProperty(exports, "DEFAULT_LAN_HTTP_PORT", {
-	enumerable: true,
-	get: function() {
-		return DEFAULT_LAN_HTTP_PORT;
-	}
-});
-Object.defineProperty(exports, "LEAF_RENEWAL_WINDOW_DAYS", {
-	enumerable: true,
-	get: function() {
-		return LEAF_RENEWAL_WINDOW_DAYS;
-	}
-});
-Object.defineProperty(exports, "MAX_LEAF_VALIDITY_DAYS", {
-	enumerable: true,
-	get: function() {
-		return MAX_LEAF_VALIDITY_DAYS;
-	}
-});
-Object.defineProperty(exports, "SERVER_AUTH_OID", {
-	enumerable: true,
-	get: function() {
-		return SERVER_AUTH_OID;
-	}
-});
-Object.defineProperty(exports, "UPLOADED_CA_FILE", {
-	enumerable: true,
-	get: function() {
-		return UPLOADED_CA_FILE;
-	}
-});
-Object.defineProperty(exports, "allFamiliesListenHost", {
-	enumerable: true,
-	get: function() {
-		return allFamiliesListenHost;
-	}
-});
-Object.defineProperty(exports, "applyCertificateToListener", {
-	enumerable: true,
-	get: function() {
-		return applyCertificateToListener;
-	}
-});
-Object.defineProperty(exports, "applyLanHttp", {
-	enumerable: true,
-	get: function() {
-		return applyLanHttp;
-	}
-});
-Object.defineProperty(exports, "bindPendingLanHttp", {
-	enumerable: true,
-	get: function() {
-		return bindPendingLanHttp;
-	}
-});
-Object.defineProperty(exports, "clearHttpsListener", {
-	enumerable: true,
-	get: function() {
-		return clearHttpsListener;
-	}
-});
-Object.defineProperty(exports, "closeLanHttp", {
-	enumerable: true,
-	get: function() {
-		return closeLanHttp;
-	}
-});
-Object.defineProperty(exports, "collectCertIdentity", {
-	enumerable: true,
-	get: function() {
-		return collectCertIdentity;
-	}
-});
-Object.defineProperty(exports, "ensureTlsCert", {
-	enumerable: true,
-	get: function() {
-		return ensureTlsCert;
-	}
-});
-Object.defineProperty(exports, "evaluateExistingCert", {
-	enumerable: true,
-	get: function() {
-		return evaluateExistingCert;
-	}
-});
-Object.defineProperty(exports, "leafFingerprintOf", {
-	enumerable: true,
-	get: function() {
-		return leafFingerprintOf;
-	}
-});
-Object.defineProperty(exports, "loadTlsCert", {
-	enumerable: true,
-	get: function() {
-		return loadTlsCert;
-	}
-});
-Object.defineProperty(exports, "prepareBootTls", {
-	enumerable: true,
-	get: function() {
-		return prepareBootTls;
-	}
-});
-Object.defineProperty(exports, "readExtraSans", {
-	enumerable: true,
-	get: function() {
-		return readExtraSans;
-	}
-});
-Object.defineProperty(exports, "readLanHttpState", {
-	enumerable: true,
-	get: function() {
-		return readLanHttpState;
-	}
-});
-Object.defineProperty(exports, "readTlsAccessStatus", {
-	enumerable: true,
-	get: function() {
-		return readTlsAccessStatus;
-	}
-});
-Object.defineProperty(exports, "readTlsMode", {
+Object.defineProperty(exports, "AuthorityKeyIdentifierExtension", {
 	enumerable: true,
 	get: function() {
-		return readTlsMode;
+		return AuthorityKeyIdentifierExtension;
 	}
 });
-Object.defineProperty(exports, "regenerateCertificate", {
+Object.defineProperty(exports, "BasicConstraintsExtension", {
 	enumerable: true,
 	get: function() {
-		return regenerateCertificate;
+		return BasicConstraintsExtension;
 	}
 });
-Object.defineProperty(exports, "registerHttpsListener", {
+Object.defineProperty(exports, "ExtendedKeyUsageExtension", {
 	enumerable: true,
 	get: function() {
-		return registerHttpsListener;
+		return ExtendedKeyUsageExtension;
 	}
 });
-Object.defineProperty(exports, "registerLanHttpHandler", {
+Object.defineProperty(exports, "KeyUsageFlags", {
 	enumerable: true,
 	get: function() {
-		return registerLanHttpHandler;
+		return KeyUsageFlags;
 	}
 });
-Object.defineProperty(exports, "reissueTlsLeaf", {
+Object.defineProperty(exports, "KeyUsagesExtension", {
 	enumerable: true,
 	get: function() {
-		return reissueTlsLeaf;
+		return KeyUsagesExtension;
 	}
 });
-Object.defineProperty(exports, "reloadHttpsListener", {
+Object.defineProperty(exports, "PemConverter", {
 	enumerable: true,
 	get: function() {
-		return reloadHttpsListener;
+		return PemConverter;
 	}
 });
-Object.defineProperty(exports, "revertToGeneratedCertificate", {
+Object.defineProperty(exports, "Pkcs10CertificateRequest", {
 	enumerable: true,
 	get: function() {
-		return revertToGeneratedCertificate;
+		return Pkcs10CertificateRequest;
 	}
 });
-Object.defineProperty(exports, "servedHttpsLeafFingerprint", {
+Object.defineProperty(exports, "Pkcs10CertificateRequestGenerator", {
 	enumerable: true,
 	get: function() {
-		return servedHttpsLeafFingerprint;
+		return Pkcs10CertificateRequestGenerator;
 	}
 });
-Object.defineProperty(exports, "splitPemCertificates", {
+Object.defineProperty(exports, "SubjectAlternativeNameExtension", {
 	enumerable: true,
 	get: function() {
-		return splitPemCertificates;
+		return SubjectAlternativeNameExtension;
 	}
 });
-Object.defineProperty(exports, "storeUploadedCertificate", {
+Object.defineProperty(exports, "SubjectKeyIdentifierExtension", {
 	enumerable: true,
 	get: function() {
-		return storeUploadedCertificate;
+		return SubjectKeyIdentifierExtension;
 	}
 });
-Object.defineProperty(exports, "validateUploadedTls", {
+Object.defineProperty(exports, "X509Certificate", {
 	enumerable: true,
 	get: function() {
-		return validateUploadedTls;
+		return X509Certificate;
 	}
 });
-Object.defineProperty(exports, "writeExtraSans", {
+Object.defineProperty(exports, "X509CertificateGenerator", {
 	enumerable: true,
 	get: function() {
-		return writeExtraSans;
+		return X509CertificateGenerator;
 	}
 });
-Object.defineProperty(exports, "writeTlsMode", {
+Object.defineProperty(exports, "cryptoProvider", {
 	enumerable: true,
 	get: function() {
-		return writeTlsMode;
+		return cryptoProvider;
 	}
 });