@camstack/system 1.2.431 → 1.2.433

package/dist/hub-mdns-ciao-B50jAU5C.js

@@ -0,0 +1,821 @@
+const require_chunk = require("./chunk-Cek0wNdY.js");
+const require_agent_https = require("./agent-https-CHZTxK-q.js");
+let node_crypto = require("node:crypto");
+let _camstack_types_node = require("@camstack/types/node");
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+let node_http = require("node:http");
+//#region src/http/lan-http-bind.ts
+/**
+* Second HTTP listener that shares the hub's existing request handler.
+*
+* Fastify is one protocol per instance; HTTPS stays on :4443 and this
+* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
+* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
+*
+* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
+* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
+* hangs because nobody handles the upgrade on this socket.
+*/
+var DEFAULT_HTTP_PORT = 4480;
+var handlers = null;
+var server = null;
+var pending = null;
+var state = {
+	listening: false,
+	error: null,
+	port: DEFAULT_HTTP_PORT
+};
+var boundRequestedHost = null;
+var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
+/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
+function allFamiliesListenHost(host) {
+	if (host === "0.0.0.0" || host === "*" || host === "") return {
+		host: "::",
+		ipv6Only: false
+	};
+	return {
+		host,
+		ipv6Only: false
+	};
+}
+function registerLanHttpHandler(next) {
+	handlers = next;
+}
+function readLanHttpState() {
+	return state;
+}
+async function applyLanHttp(options) {
+	pending = options;
+	if (!options.enabled) {
+		await closeLanHttp();
+		state = {
+			listening: false,
+			error: null,
+			port: options.port
+		};
+		return state;
+	}
+	if (handlers === null) {
+		state = {
+			listening: false,
+			error: "HTTP listener is not registered yet",
+			port: options.port
+		};
+		return state;
+	}
+	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
+	await closeLanHttp();
+	try {
+		const bound = await listenHttp(options.port, options.host, handlers);
+		server = bound;
+		boundRequestedHost = options.host;
+		const addr = bound.address();
+		state = {
+			listening: true,
+			error: null,
+			port: typeof addr === "object" && addr !== null ? addr.port : options.port
+		};
+		return state;
+	} catch (err) {
+		server = null;
+		state = {
+			listening: false,
+			error: err instanceof Error ? err.message : String(err),
+			port: options.port
+		};
+		return state;
+	}
+}
+/** After the hub registers the Fastify request handler, bind whatever was pending. */
+async function bindPendingLanHttp() {
+	if (pending === null) return applyLanHttp({
+		enabled: true,
+		port: DEFAULT_HTTP_PORT,
+		host: "0.0.0.0"
+	});
+	return applyLanHttp(pending);
+}
+async function closeLanHttp() {
+	const current = server;
+	server = null;
+	boundRequestedHost = null;
+	if (current === null) return;
+	await new Promise((resolve) => {
+		current.close(() => resolve());
+	});
+}
+function listenHttp(port, host, next) {
+	const resolved = allFamiliesListenHost(host);
+	return listenOn(port, resolved, next).catch((err) => {
+		if (resolved.host === "::" && host !== "::") return listenOn(port, {
+			host: "0.0.0.0",
+			ipv6Only: false
+		}, next);
+		throw err;
+	});
+}
+function listenOn(port, bind, next) {
+	return new Promise((resolve, reject) => {
+		const created = (0, node_http.createServer)(next.onRequest);
+		created.on("upgrade", next.onUpgrade);
+		const onError = (err) => {
+			created.off("listening", onListening);
+			created.close();
+			reject(err);
+		};
+		const onListening = () => {
+			created.off("error", onError);
+			resolve(created);
+		};
+		created.once("error", onError);
+		created.once("listening", onListening);
+		created.listen({
+			port,
+			host: bind.host,
+			ipv6Only: bind.ipv6Only
+		});
+	});
+}
+//#endregion
+//#region src/tls/cert-manager.ts
+var DEFAULT_COMMON_NAME = "camstack.local";
+/**
+* Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
+* a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
+* chained to it (`camstack.crt` = leaf + root, `camstack.key`).
+*
+* ## The regeneration rule (D227)
+*
+* Reissue happens when, and only when, the material on disk **cannot do
+* its job**:
+*
+* - it is absent, unreadable, or the key does not match the certificate;
+* - the root is absent (every pre-2026-08 install: one self-signed
+*   `CA:TRUE` leaf and no root) or is inside its renewal window;
+* - the leaf is inside its 30-day renewal window;
+* - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
+*   rejects an app-supplied anchor without it;
+* - the leaf is not actually issued by the root on disk;
+* - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
+* - **a name or address the hub must answer for is missing from the SAN
+*   list** — a DHCP move, a new interface or a new hostname.
+*
+* And explicitly NOT when: the certificate names an address the machine
+* no longer has (a superset still works — the check is one-directional),
+* a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
+* (global and ULA both rotate under privacy extensions / interface-id
+* churn — `os` cannot tell temporary from permanent), or a new build shipped.
+*
+* Every trigger is derived from the files plus the machine, so once a
+* reissue clears them it clears them for good: the next boot returns
+* `generated: false`. A certificate that moved on every boot would
+* invalidate every trust an operator granted by hand — worse than the
+* bugs this rule fixes.
+*
+* **The root is rotated only for root-level reasons.** SAN drift rotates
+* the leaf alone, so trust granted to `camstack-ca.crt` survives every
+* address change the hub will ever see.
+*/
+async function ensureTlsCert(dataDir, options) {
+	const tlsDir = (0, node_path.join)(dataDir, "tls");
+	const paths = {
+		certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
+		keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
+		caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
+		caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
+	};
+	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+	const validDays = Math.min(options?.validDays ?? 397, 397);
+	const identity = require_agent_https.collectCertIdentity({
+		commonName,
+		extraSans: options?.extraSans ?? [],
+		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
+	});
+	const reason = decideRegeneration(paths, identity);
+	if (reason === null) return describe(paths, false, null, false, null, null);
+	const previousFingerprint = readFingerprint(paths.certPath);
+	const caRotated = require_agent_https.reasonRequiresNewCa(reason);
+	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
+	try {
+		await regenerate(paths, identity, commonName, validDays, caRotated);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		if (!canKeepServing(paths)) throw err;
+		return describe(paths, false, null, false, null, message);
+	}
+	return describe(paths, true, reason, caRotated, previousFingerprint, null);
+}
+/**
+* Operator "Regenerate": issue a new leaf under the existing local CA.
+* Never rotates the root — trust granted to `camstack-ca.crt` survives.
+*/
+async function reissueTlsLeaf(dataDir, options) {
+	const tlsDir = (0, node_path.join)(dataDir, "tls");
+	const paths = {
+		certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
+		keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
+		caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
+		caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
+	};
+	if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return ensureTlsCert(dataDir, options);
+	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+	const validDays = Math.min(options?.validDays ?? 397, 397);
+	const identity = require_agent_https.collectCertIdentity({
+		commonName,
+		extraSans: options?.extraSans ?? [],
+		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
+	});
+	const previousFingerprint = readFingerprint(paths.certPath);
+	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
+	await regenerate(paths, identity, commonName, validDays, false);
+	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null);
+}
+/** True when the material already on disk can still terminate TLS. */
+function canKeepServing(paths) {
+	if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return false;
+	if (!(0, node_fs.existsSync)(paths.caCertPath)) return false;
+	return readFingerprint(paths.certPath) !== null;
+}
+/** Fingerprint of whatever is on disk, or `null` if there is nothing readable. */
+function readFingerprint(certPath) {
+	try {
+		return new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath)).fingerprint256;
+	} catch {
+		return null;
+	}
+}
+function decideRegeneration(paths, identity) {
+	if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return "missing";
+	if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return "no-local-ca";
+	try {
+		return require_agent_https.evaluateExistingCert({
+			chainPem: (0, node_fs.readFileSync)(paths.certPath, "utf-8"),
+			keyPem: (0, node_fs.readFileSync)(paths.keyPath, "utf-8"),
+			caPem: (0, node_fs.readFileSync)(paths.caCertPath, "utf-8"),
+			identity,
+			now: /* @__PURE__ */ new Date()
+		});
+	} catch {
+		return "unreadable";
+	}
+}
+/**
+* Build every byte in memory, then move the files into place. A crash
+* mid-way leaves the previous material untouched; a crash between the
+* moves leaves a key/certificate mismatch, which the evaluator reports as
+* `key-mismatch` and heals on the next boot.
+*/
+async function regenerate(paths, identity, commonName, validDays, newCa) {
+	const now = /* @__PURE__ */ new Date();
+	const ca = newCa ? await require_agent_https.generateCa(now) : await require_agent_https.loadCa((0, node_fs.readFileSync)(paths.caCertPath, "utf-8"), (0, node_fs.readFileSync)(paths.caKeyPath, "utf-8"));
+	const leaf = await require_agent_https.issueLeaf(ca, identity, commonName, validDays, now);
+	const chainPem = `${leaf.certPem.trimEnd()}\n${ca.certPem.trimEnd()}\n`;
+	if (newCa) {
+		await (0, node_fs_promises.writeFile)(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
+		(0, _camstack_types_node.writeOwnerOnlyFileSync)(`${paths.caKeyPath}.new`, ca.keyPem);
+		(0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
+		(0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
+	}
+	(0, _camstack_types_node.writeOwnerOnlyFileSync)(`${paths.keyPath}.new`, leaf.keyPem);
+	await (0, node_fs_promises.writeFile)(`${paths.certPath}.new`, chainPem, "utf-8");
+	(0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
+	(0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
+}
+function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
+	const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
+	const ca = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath));
+	const san = leaf.subjectAltName ?? "";
+	return {
+		...paths,
+		generated,
+		reason,
+		caRotated,
+		fingerprintSha256: leaf.fingerprint256,
+		previousFingerprintSha256,
+		caFingerprintSha256: ca.fingerprint256,
+		validTo: new Date(leaf.validTo).toISOString(),
+		sans: san === "" ? [] : san.split(", "),
+		reissueError
+	};
+}
+/**
+* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
+* options. `certPath` is a full chain, so the listener presents the local
+* root alongside the leaf.
+*/
+function loadTlsCert(certPath, keyPath) {
+	return {
+		cert: (0, node_fs.readFileSync)(certPath),
+		key: (0, node_fs.readFileSync)(keyPath)
+	};
+}
+//#endregion
+//#region src/tls/tls-status.ts
+function tlsDir(dataDir) {
+	return (0, node_path.join)(dataDir, "tls");
+}
+function readTlsMode(dataDir) {
+	const marker = (0, node_path.join)(tlsDir(dataDir), "mode");
+	if ((0, node_fs.existsSync)(marker)) {
+		const raw = (0, node_fs.readFileSync)(marker, "utf-8").trim();
+		if (raw === "uploaded") return "uploaded";
+		if (raw === "disabled") return "disabled";
+	}
+	return (0, node_fs.existsSync)((0, node_path.join)(tlsDir(dataDir), "camstack.crt")) ? "generated" : "disabled";
+}
+function writeTlsMode(dataDir, mode) {
+	(0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
+	(0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "mode"), `${mode}\n`, "utf-8");
+}
+function readExtraSans(dataDir) {
+	const path = (0, node_path.join)(tlsDir(dataDir), "extra-sans.json");
+	if (!(0, node_fs.existsSync)(path)) return [];
+	try {
+		const parsed = JSON.parse((0, node_fs.readFileSync)(path, "utf-8"));
+		if (!Array.isArray(parsed)) return [];
+		return parsed.filter((entry) => typeof entry === "string" && entry.length > 0);
+	} catch {
+		return [];
+	}
+}
+function writeExtraSans(dataDir, sans) {
+	(0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
+	(0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}\n`, "utf-8");
+}
+/** Where an upload's own CA is kept — never over the local CA's `camstack-ca.crt`. */
+var UPLOADED_CA_FILE = "uploaded-ca.crt";
+/** Every certificate in a PEM bundle, in order. */
+function splitPemCertificates(pem) {
+	const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
+	return blocks === null ? [] : blocks.map((block) => `${block}\n`);
+}
+/**
+* The certificate that signed `leaf`, from the upload itself: the CA the
+* operator supplied, else the rest of the uploaded chain. `null` when the
+* upload did not include it — and then nothing may stand in for it: the
+* local CA did not sign an uploaded leaf, so handing it out as "the CA" would
+* tell a client to trust a root that verifies nothing it is served.
+*/
+function uploadedIssuer(dir, leaf, chainPem) {
+	const caPath = (0, node_path.join)(dir, UPLOADED_CA_FILE);
+	const candidates = [...(0, node_fs.existsSync)(caPath) ? splitPemCertificates((0, node_fs.readFileSync)(caPath, "utf-8")) : [], ...splitPemCertificates(chainPem).slice(1)];
+	for (const pem of candidates) try {
+		const cert = new node_crypto.X509Certificate(pem);
+		if (leaf.checkIssued(cert) && leaf.verify(cert.publicKey)) return {
+			pem,
+			cert
+		};
+	} catch {}
+	return null;
+}
+function generatedIssuer(dir) {
+	const caPath = (0, node_path.join)(dir, "camstack-ca.crt");
+	if (!(0, node_fs.existsSync)(caPath)) return null;
+	const pem = (0, node_fs.readFileSync)(caPath, "utf-8");
+	return {
+		pem,
+		cert: new node_crypto.X509Certificate(pem)
+	};
+}
+/**
+* What the node's certificate is, and whether the listener serves it.
+* `servedLeafFingerprint` is the leaf the HTTPS listener presents right now
+* (`servedHttpsLeafFingerprint()`), or `null` when unknown; a restart is
+* required exactly when the listener serves a different leaf than the one
+* on disk — a measured fact, not a flag a mutation remembered to set.
+*/
+function readTlsAccessStatus(dataDir, servedLeafFingerprint) {
+	const dir = tlsDir(dataDir);
+	const certPath = (0, node_path.join)(dir, "camstack.crt");
+	const mode = readTlsMode(dataDir);
+	if (!(0, node_fs.existsSync)(certPath)) return {
+		mode: "disabled",
+		leafFingerprintSha256: null,
+		caFingerprintSha256: null,
+		validTo: null,
+		sans: [],
+		caCertPem: (mode === "uploaded" ? null : generatedIssuer(dir))?.pem ?? null,
+		reissueError: null,
+		restartRequired: false
+	};
+	try {
+		const chainPem = (0, node_fs.readFileSync)(certPath, "utf-8");
+		const leaf = new node_crypto.X509Certificate(chainPem);
+		const ca = mode === "uploaded" ? uploadedIssuer(dir, leaf, chainPem) : generatedIssuer(dir);
+		const san = leaf.subjectAltName ?? "";
+		return {
+			mode,
+			leafFingerprintSha256: leaf.fingerprint256,
+			caFingerprintSha256: ca?.cert.fingerprint256 ?? null,
+			validTo: new Date(leaf.validTo).toISOString(),
+			sans: san === "" ? [] : san.split(", "),
+			caCertPem: ca?.pem ?? null,
+			reissueError: null,
+			restartRequired: servedLeafFingerprint !== null && servedLeafFingerprint !== leaf.fingerprint256
+		};
+	} catch {
+		return {
+			mode,
+			leafFingerprintSha256: null,
+			caFingerprintSha256: null,
+			validTo: null,
+			sans: [],
+			caCertPem: null,
+			reissueError: "Certificate on disk could not be parsed.",
+			restartRequired: false
+		};
+	}
+}
+//#endregion
+//#region src/tls/boot-tls.ts
+/**
+* Decide what the listener serves at boot. The admin UI (Network → Local
+* access) is the only way to set a certificate (D726): it either leaves the
+* hub on its generated local-CA leaf (D227) or uploads one, recorded by the
+* `tls/mode` marker. An uploaded certificate is served verbatim — running it
+* through `ensureTlsCert` would replace it on the first restart, because a
+* leaf the local root did not issue is one of that rule's reissue triggers.
+*/
+async function prepareBootTls(dataDir, options) {
+	const certPath = (0, node_path.join)(dataDir, "tls", "camstack.crt");
+	const keyPath = (0, node_path.join)(dataDir, "tls", "camstack.key");
+	const marked = readTlsMode(dataDir);
+	if (marked === "uploaded" && (0, node_fs.existsSync)(certPath) && (0, node_fs.existsSync)(keyPath)) return {
+		mode: "uploaded",
+		pair: loadTlsCert(certPath, keyPath),
+		ensured: void 0,
+		uploadedMissing: false
+	};
+	const uploadedMissing = marked === "uploaded";
+	if (uploadedMissing) writeTlsMode(dataDir, "generated");
+	const ensured = await ensureTlsCert(dataDir, options);
+	return {
+		mode: "generated",
+		pair: loadTlsCert(ensured.certPath, ensured.keyPath),
+		ensured,
+		uploadedMissing
+	};
+}
+//#endregion
+//#region src/tls/https-listener.ts
+var SLOT_KEY = Symbol.for("camstack.tls.https-listener");
+var EMPTY_SLOT = {
+	reload: null,
+	servedLeafFingerprint: null
+};
+function isSlot(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("reload" in value) || !("servedLeafFingerprint" in value)) return false;
+	const reload = value.reload;
+	const served = value.servedLeafFingerprint;
+	return (reload === null || typeof reload === "function") && (served === null || typeof served === "string");
+}
+function readSlot() {
+	const current = Reflect.get(globalThis, SLOT_KEY);
+	return isSlot(current) ? current : EMPTY_SLOT;
+}
+function writeSlot(next) {
+	Reflect.set(globalThis, SLOT_KEY, next);
+}
+/** SHA-256 fingerprint of the first certificate (the leaf) in a PEM chain. */
+function leafFingerprintOf(chain) {
+	return new node_crypto.X509Certificate(chain).fingerprint256;
+}
+/**
+* Called once by the server after its HTTPS listener is up, with the pair it
+* was started on. From here on a certificate action swaps the served
+* certificate in place (`setSecureContext`) — new handshakes get the new
+* leaf, open connections keep theirs, nothing restarts.
+*/
+function registerHttpsListener(server, pair) {
+	writeSlot({
+		reload: (next) => server.setSecureContext({
+			cert: next.cert,
+			key: next.key
+		}),
+		servedLeafFingerprint: leafFingerprintOf(pair.cert)
+	});
+}
+/** Forget the listener — on shutdown, and between specs. */
+function clearHttpsListener() {
+	writeSlot(EMPTY_SLOT);
+}
+/**
+* The leaf the HTTPS listener serves now, or `null` when this process has no
+* registered listener (TLS off, or a process that does not own one) — in
+* which case nobody can say, and `null` is the honest answer.
+*/
+function servedHttpsLeafFingerprint() {
+	return readSlot().servedLeafFingerprint;
+}
+/** Serve `pair` from now on. Never throws: the outcome says what happened. */
+function reloadHttpsListener(pair) {
+	const slot = readSlot();
+	if (slot.reload === null) return { kind: "no-listener" };
+	try {
+		const servedLeafFingerprint = leafFingerprintOf(pair.cert);
+		slot.reload(pair);
+		writeSlot({
+			reload: slot.reload,
+			servedLeafFingerprint
+		});
+		return {
+			kind: "reloaded",
+			servedLeafFingerprint
+		};
+	} catch (err) {
+		return {
+			kind: "failed",
+			error: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+//#endregion
+//#region src/tls/uploaded-cert.ts
+/**
+* Operator-supplied material must parse, match its key, and carry
+* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
+* to keep generating.
+*/
+function validateUploadedTls(certPem, keyPem) {
+	let leaf;
+	try {
+		leaf = new node_crypto.X509Certificate(certPem);
+	} catch {
+		return {
+			ok: false,
+			error: "Certificate PEM could not be parsed."
+		};
+	}
+	try {
+		if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem))) return {
+			ok: false,
+			error: "Private key does not match the certificate."
+		};
+	} catch {
+		return {
+			ok: false,
+			error: "Private key PEM could not be parsed."
+		};
+	}
+	const eku = leaf.keyUsage;
+	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
+		ok: false,
+		error: "Certificate is missing extendedKeyUsage = serverAuth."
+	};
+	return {
+		ok: true,
+		fingerprintSha256: leaf.fingerprint256,
+		validTo: new Date(leaf.validTo).toISOString()
+	};
+}
+//#endregion
+//#region src/tls/tls-actions.ts
+function withNewline(pem) {
+	return pem.endsWith("\n") ? pem : `${pem}\n`;
+}
+/**
+* Store an operator's certificate. The leaf (or chain) and key replace the
+* served pair; a CA, when given, goes to its own file. The local CA
+* (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
+* and it is what "Revert to generated" and every device that trusts it
+* still need.
+*/
+async function storeUploadedCertificate(dataDir, input) {
+	const valid = validateUploadedTls(input.certPem, input.keyPem);
+	if (!valid.ok) throw new Error(valid.error);
+	const dir = (0, node_path.join)(dataDir, "tls");
+	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
+	await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.crt"), withNewline(input.certPem));
+	(0, _camstack_types_node.writeOwnerOnlyFileSync)((0, node_path.join)(dir, "camstack.key"), withNewline(input.keyPem));
+	const caPath = (0, node_path.join)(dir, UPLOADED_CA_FILE);
+	if (input.caPem !== void 0 && input.caPem.trim() !== "") await (0, node_fs_promises.writeFile)(caPath, withNewline(input.caPem));
+	else (0, node_fs.rmSync)(caPath, { force: true });
+	writeTlsMode(dataDir, "uploaded");
+}
+/** Issue a new generated leaf under the local CA. Refused while an upload is served. */
+async function regenerateCertificate(dataDir, options) {
+	if (readTlsMode(dataDir) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
+	await reissueTlsLeaf(dataDir, options);
+}
+/** Drop the upload and serve the generated local-CA leaf again (D227). */
+async function revertToGeneratedCertificate(dataDir, options) {
+	writeTlsMode(dataDir, "generated");
+	(0, node_fs.rmSync)((0, node_path.join)(dataDir, "tls", UPLOADED_CA_FILE), { force: true });
+	await ensureTlsCert(dataDir, options);
+}
+/**
+* Put the pair on disk on the HTTPS listener. Called after every action, so
+* "the certificate changed" and "clients see it" are the same moment.
+*/
+function applyCertificateToListener(dataDir) {
+	const certPath = (0, node_path.join)(dataDir, "tls", "camstack.crt");
+	const keyPath = (0, node_path.join)(dataDir, "tls", "camstack.key");
+	if (!(0, node_fs.existsSync)(certPath) || !(0, node_fs.existsSync)(keyPath)) return {
+		kind: "failed",
+		error: `No certificate pair under ${(0, node_path.join)(dataDir, "tls")}`
+	};
+	return reloadHttpsListener(loadTlsCert(certPath, keyPath));
+}
+//#endregion
+//#region src/builtins/local-network/hub-mdns-ciao.ts
+function createCiaoPublisher() {
+	return { async publish(announcement) {
+		const { getResponder } = await Promise.resolve().then(() => /* @__PURE__ */ require_chunk.__toESM(require("./lib-DOJ5yyWA.js").default));
+		const responder = getResponder();
+		const service = responder.createService({
+			name: announcement.name,
+			type: announcement.type,
+			port: announcement.port,
+			txt: { ...announcement.txt },
+			...announcement.address !== null ? { restrictedAddresses: [announcement.address] } : {}
+		});
+		try {
+			await service.advertise();
+		} catch (err) {
+			await responder.shutdown().catch(() => void 0);
+			throw err;
+		}
+		return { stop: async () => {
+			await service.destroy();
+			await responder.shutdown();
+		} };
+	} };
+}
+//#endregion
+Object.defineProperty(exports, "DEFAULT_LAN_HTTP_PORT", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_LAN_HTTP_PORT;
+	}
+});
+Object.defineProperty(exports, "UPLOADED_CA_FILE", {
+	enumerable: true,
+	get: function() {
+		return UPLOADED_CA_FILE;
+	}
+});
+Object.defineProperty(exports, "allFamiliesListenHost", {
+	enumerable: true,
+	get: function() {
+		return allFamiliesListenHost;
+	}
+});
+Object.defineProperty(exports, "applyCertificateToListener", {
+	enumerable: true,
+	get: function() {
+		return applyCertificateToListener;
+	}
+});
+Object.defineProperty(exports, "applyLanHttp", {
+	enumerable: true,
+	get: function() {
+		return applyLanHttp;
+	}
+});
+Object.defineProperty(exports, "bindPendingLanHttp", {
+	enumerable: true,
+	get: function() {
+		return bindPendingLanHttp;
+	}
+});
+Object.defineProperty(exports, "clearHttpsListener", {
+	enumerable: true,
+	get: function() {
+		return clearHttpsListener;
+	}
+});
+Object.defineProperty(exports, "closeLanHttp", {
+	enumerable: true,
+	get: function() {
+		return closeLanHttp;
+	}
+});
+Object.defineProperty(exports, "createCiaoPublisher", {
+	enumerable: true,
+	get: function() {
+		return createCiaoPublisher;
+	}
+});
+Object.defineProperty(exports, "ensureTlsCert", {
+	enumerable: true,
+	get: function() {
+		return ensureTlsCert;
+	}
+});
+Object.defineProperty(exports, "leafFingerprintOf", {
+	enumerable: true,
+	get: function() {
+		return leafFingerprintOf;
+	}
+});
+Object.defineProperty(exports, "loadTlsCert", {
+	enumerable: true,
+	get: function() {
+		return loadTlsCert;
+	}
+});
+Object.defineProperty(exports, "prepareBootTls", {
+	enumerable: true,
+	get: function() {
+		return prepareBootTls;
+	}
+});
+Object.defineProperty(exports, "readExtraSans", {
+	enumerable: true,
+	get: function() {
+		return readExtraSans;
+	}
+});
+Object.defineProperty(exports, "readLanHttpState", {
+	enumerable: true,
+	get: function() {
+		return readLanHttpState;
+	}
+});
+Object.defineProperty(exports, "readTlsAccessStatus", {
+	enumerable: true,
+	get: function() {
+		return readTlsAccessStatus;
+	}
+});
+Object.defineProperty(exports, "readTlsMode", {
+	enumerable: true,
+	get: function() {
+		return readTlsMode;
+	}
+});
+Object.defineProperty(exports, "regenerateCertificate", {
+	enumerable: true,
+	get: function() {
+		return regenerateCertificate;
+	}
+});
+Object.defineProperty(exports, "registerHttpsListener", {
+	enumerable: true,
+	get: function() {
+		return registerHttpsListener;
+	}
+});
+Object.defineProperty(exports, "registerLanHttpHandler", {
+	enumerable: true,
+	get: function() {
+		return registerLanHttpHandler;
+	}
+});
+Object.defineProperty(exports, "reissueTlsLeaf", {
+	enumerable: true,
+	get: function() {
+		return reissueTlsLeaf;
+	}
+});
+Object.defineProperty(exports, "reloadHttpsListener", {
+	enumerable: true,
+	get: function() {
+		return reloadHttpsListener;
+	}
+});
+Object.defineProperty(exports, "revertToGeneratedCertificate", {
+	enumerable: true,
+	get: function() {
+		return revertToGeneratedCertificate;
+	}
+});
+Object.defineProperty(exports, "servedHttpsLeafFingerprint", {
+	enumerable: true,
+	get: function() {
+		return servedHttpsLeafFingerprint;
+	}
+});
+Object.defineProperty(exports, "splitPemCertificates", {
+	enumerable: true,
+	get: function() {
+		return splitPemCertificates;
+	}
+});
+Object.defineProperty(exports, "storeUploadedCertificate", {
+	enumerable: true,
+	get: function() {
+		return storeUploadedCertificate;
+	}
+});
+Object.defineProperty(exports, "validateUploadedTls", {
+	enumerable: true,
+	get: function() {
+		return validateUploadedTls;
+	}
+});
+Object.defineProperty(exports, "writeExtraSans", {
+	enumerable: true,
+	get: function() {
+		return writeExtraSans;
+	}
+});
+Object.defineProperty(exports, "writeTlsMode", {
+	enumerable: true,
+	get: function() {
+		return writeTlsMode;
+	}
+});