@camstack/system 1.2.432 → 1.2.433

package/dist/{tls-CpcGkeJV.mjs → agent-https-DtRU9A7I.mjs}

@@ -2,142 +2,101 @@ import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X
 import { X509Certificate, createHash, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { isIP } from "node:net";
-import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import * as os from "node:os";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { createServer as createServer$1 } from "node:http";
-//#region src/http/lan-http-bind.ts
-/**
-* Second HTTP listener that shares the hub's existing request handler.
-*
-* Fastify is one protocol per instance; HTTPS stays on :4443 and this
-* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
-* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
-*
-* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
-* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
-* hangs because nobody handles the upgrade on this socket.
-*/
-var DEFAULT_HTTP_PORT = 4480;
-var handlers = null;
-var server = null;
-var pending = null;
-var state = {
-	listening: false,
-	error: null,
-	port: DEFAULT_HTTP_PORT
-};
-var boundRequestedHost = null;
-var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
-/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
-function allFamiliesListenHost(host) {
-	if (host === "0.0.0.0" || host === "*" || host === "") return {
-		host: "::",
-		ipv6Only: false
-	};
-	return {
-		host,
-		ipv6Only: false
-	};
-}
-function registerLanHttpHandler(next) {
-	handlers = next;
-}
-function readLanHttpState() {
-	return state;
-}
-async function applyLanHttp(options) {
-	pending = options;
-	if (!options.enabled) {
-		await closeLanHttp();
-		state = {
-			listening: false,
-			error: null,
-			port: options.port
-		};
-		return state;
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+//#region src/tls/agent-https-names.ts
+/**
+* @durable class=config owner=system-config
+*   write="the hub records the names it signed into an agent's HTTPS leaf, replacing that
+*     node's previous row"
+*   retention="one row per node, replaced on every issue; a forgotten node's row stays until
+*     the node is issued again or an operator clears it (it only blocks reuse of its names)"
+*/
+var AGENT_HTTPS_NAMES_COLLECTION = "agent_https_names";
+var AGENT_HTTPS_NAMES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "names",
+		type: "JSON",
+		notNull: true
+	},
+	{
+		name: "issuedAt",
+		type: "INTEGER",
+		notNull: true
 	}
-	if (handlers === null) {
-		state = {
-			listening: false,
-			error: "HTTP listener is not registered yet",
-			port: options.port
-		};
-		return state;
+];
+var AgentHttpsNames = class {
+	store;
+	byNode = /* @__PURE__ */ new Map();
+	constructor(store) {
+		this.store = store;
 	}
-	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
-	await closeLanHttp();
-	try {
-		const bound = await listenHttp(options.port, options.host, handlers);
-		server = bound;
-		boundRequestedHost = options.host;
-		const addr = bound.address();
-		state = {
-			listening: true,
-			error: null,
-			port: typeof addr === "object" && addr !== null ? addr.port : options.port
-		};
-		return state;
-	} catch (err) {
-		server = null;
-		state = {
-			listening: false,
-			error: err instanceof Error ? err.message : String(err),
-			port: options.port
-		};
-		return state;
+	async load() {
+		const rows = await this.store.query.query({ collection: AGENT_HTTPS_NAMES_COLLECTION });
+		for (const row of rows) {
+			const names = row.data["names"];
+			if (Array.isArray(names)) this.byNode.set(row.id, names.filter((n) => typeof n === "string").map((n) => n.toLowerCase()));
+		}
 	}
-}
-/** After the hub registers the Fastify request handler, bind whatever was pending. */
-async function bindPendingLanHttp() {
-	if (pending === null) return applyLanHttp({
-		enabled: true,
-		port: DEFAULT_HTTP_PORT,
-		host: "0.0.0.0"
-	});
-	return applyLanHttp(pending);
-}
-async function closeLanHttp() {
-	const current = server;
-	server = null;
-	boundRequestedHost = null;
-	if (current === null) return;
-	await new Promise((resolve) => {
-		current.close(() => resolve());
-	});
-}
-function listenHttp(port, host, next) {
-	const resolved = allFamiliesListenHost(host);
-	return listenOn(port, resolved, next).catch((err) => {
-		if (resolved.host === "::" && host !== "::") return listenOn(port, {
-			host: "0.0.0.0",
-			ipv6Only: false
-		}, next);
-		throw err;
-	});
-}
-function listenOn(port, bind, next) {
-	return new Promise((resolve, reject) => {
-		const created = createServer$1(next.onRequest);
-		created.on("upgrade", next.onUpgrade);
-		const onError = (err) => {
-			created.off("listening", onListening);
-			created.close();
-			reject(err);
-		};
-		const onListening = () => {
-			created.off("error", onError);
-			resolve(created);
+	/** The names certified to `nodeId` (its id and the address of its live mesh socket), or `null`. */
+	namesOf(nodeId) {
+		return this.byNode.get(nodeId) ?? null;
+	}
+	/** Every name certified to a node other than `nodeId`. */
+	takenByOthers(nodeId) {
+		const out = /* @__PURE__ */ new Set();
+		for (const [id, names] of this.byNode) {
+			if (id === nodeId) continue;
+			for (const n of names) out.add(n);
+		}
+		return out;
+	}
+	/** Free every name certified to a node that was forgotten. */
+	async release(nodeId) {
+		if (!this.byNode.delete(nodeId)) return false;
+		await this.store.delete.mutate({
+			collection: AGENT_HTTPS_NAMES_COLLECTION,
+			key: nodeId
+		});
+		return true;
+	}
+	async record(nodeId, names) {
+		const lowered = names.map((n) => n.toLowerCase());
+		const existed = this.byNode.has(nodeId);
+		this.byNode.set(nodeId, lowered);
+		const data = {
+			names: lowered,
+			issuedAt: Date.now()
 		};
-		created.once("error", onError);
-		created.once("listening", onListening);
-		created.listen({
-			port,
-			host: bind.host,
-			ipv6Only: bind.ipv6Only
+		if (existed) await this.store.update.mutate({
+			collection: AGENT_HTTPS_NAMES_COLLECTION,
+			id: nodeId,
+			data
 		});
-	});
+		else await this.store.insert.mutate({
+			collection: AGENT_HTTPS_NAMES_COLLECTION,
+			record: {
+				id: nodeId,
+				data
+			}
+		});
+	}
+};
+var SLOT = Symbol.for("camstack.agent-https.names");
+function setProcessAgentHttpsNames(names) {
+	if (names === null) Reflect.deleteProperty(globalThis, SLOT);
+	else Reflect.set(globalThis, SLOT, names);
+}
+function getProcessAgentHttpsNames() {
+	const value = Reflect.get(globalThis, SLOT);
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "takenByOthers") === "function" ? value : null;
 }
 //#endregion
 //#region src/tls/cert-evaluation.ts
@@ -487,487 +446,6 @@ async function issueLeafFromCsr(ca, csrPem, identity, commonName, validDays, now
 	}));
 }
 //#endregion
-//#region src/tls/cert-manager.ts
-var DEFAULT_COMMON_NAME = "camstack.local";
-/**
-* Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
-* a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
-* chained to it (`camstack.crt` = leaf + root, `camstack.key`).
-*
-* ## The regeneration rule (D227)
-*
-* Reissue happens when, and only when, the material on disk **cannot do
-* its job**:
-*
-* - it is absent, unreadable, or the key does not match the certificate;
-* - the root is absent (every pre-2026-08 install: one self-signed
-*   `CA:TRUE` leaf and no root) or is inside its renewal window;
-* - the leaf is inside its 30-day renewal window;
-* - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
-*   rejects an app-supplied anchor without it;
-* - the leaf is not actually issued by the root on disk;
-* - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
-* - **a name or address the hub must answer for is missing from the SAN
-*   list** — a DHCP move, a new interface or a new hostname.
-*
-* And explicitly NOT when: the certificate names an address the machine
-* no longer has (a superset still works — the check is one-directional),
-* a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
-* (global and ULA both rotate under privacy extensions / interface-id
-* churn — `os` cannot tell temporary from permanent), or a new build shipped.
-*
-* Every trigger is derived from the files plus the machine, so once a
-* reissue clears them it clears them for good: the next boot returns
-* `generated: false`. A certificate that moved on every boot would
-* invalidate every trust an operator granted by hand — worse than the
-* bugs this rule fixes.
-*
-* **The root is rotated only for root-level reasons.** SAN drift rotates
-* the leaf alone, so trust granted to `camstack-ca.crt` survives every
-* address change the hub will ever see.
-*/
-async function ensureTlsCert(dataDir, options) {
-	const tlsDir = join(dataDir, "tls");
-	const paths = {
-		certPath: join(tlsDir, "camstack.crt"),
-		keyPath: join(tlsDir, "camstack.key"),
-		caCertPath: join(tlsDir, "camstack-ca.crt"),
-		caKeyPath: join(tlsDir, "camstack-ca.key")
-	};
-	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
-	const validDays = Math.min(options?.validDays ?? 397, 397);
-	const identity = collectCertIdentity({
-		commonName,
-		extraSans: options?.extraSans ?? [],
-		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
-	});
-	const reason = decideRegeneration(paths, identity);
-	if (reason === null) return describe(paths, false, null, false, null, null);
-	const previousFingerprint = readFingerprint(paths.certPath);
-	const caRotated = reasonRequiresNewCa(reason);
-	mkdirSync(tlsDir, { recursive: true });
-	try {
-		await regenerate(paths, identity, commonName, validDays, caRotated);
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		if (!canKeepServing(paths)) throw err;
-		return describe(paths, false, null, false, null, message);
-	}
-	return describe(paths, true, reason, caRotated, previousFingerprint, null);
-}
-/**
-* Operator "Regenerate": issue a new leaf under the existing local CA.
-* Never rotates the root — trust granted to `camstack-ca.crt` survives.
-*/
-async function reissueTlsLeaf(dataDir, options) {
-	const tlsDir = join(dataDir, "tls");
-	const paths = {
-		certPath: join(tlsDir, "camstack.crt"),
-		keyPath: join(tlsDir, "camstack.key"),
-		caCertPath: join(tlsDir, "camstack-ca.crt"),
-		caKeyPath: join(tlsDir, "camstack-ca.key")
-	};
-	if (!existsSync(paths.caCertPath) || !existsSync(paths.caKeyPath)) return ensureTlsCert(dataDir, options);
-	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
-	const validDays = Math.min(options?.validDays ?? 397, 397);
-	const identity = collectCertIdentity({
-		commonName,
-		extraSans: options?.extraSans ?? [],
-		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
-	});
-	const previousFingerprint = readFingerprint(paths.certPath);
-	mkdirSync(tlsDir, { recursive: true });
-	await regenerate(paths, identity, commonName, validDays, false);
-	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null);
-}
-/** True when the material already on disk can still terminate TLS. */
-function canKeepServing(paths) {
-	if (!existsSync(paths.certPath) || !existsSync(paths.keyPath)) return false;
-	if (!existsSync(paths.caCertPath)) return false;
-	return readFingerprint(paths.certPath) !== null;
-}
-/** Fingerprint of whatever is on disk, or `null` if there is nothing readable. */
-function readFingerprint(certPath) {
-	try {
-		return new X509Certificate(readFileSync(certPath)).fingerprint256;
-	} catch {
-		return null;
-	}
-}
-function decideRegeneration(paths, identity) {
-	if (!existsSync(paths.certPath) || !existsSync(paths.keyPath)) return "missing";
-	if (!existsSync(paths.caCertPath) || !existsSync(paths.caKeyPath)) return "no-local-ca";
-	try {
-		return evaluateExistingCert({
-			chainPem: readFileSync(paths.certPath, "utf-8"),
-			keyPem: readFileSync(paths.keyPath, "utf-8"),
-			caPem: readFileSync(paths.caCertPath, "utf-8"),
-			identity,
-			now: /* @__PURE__ */ new Date()
-		});
-	} catch {
-		return "unreadable";
-	}
-}
-/**
-* Build every byte in memory, then move the files into place. A crash
-* mid-way leaves the previous material untouched; a crash between the
-* moves leaves a key/certificate mismatch, which the evaluator reports as
-* `key-mismatch` and heals on the next boot.
-*/
-async function regenerate(paths, identity, commonName, validDays, newCa) {
-	const now = /* @__PURE__ */ new Date();
-	const ca = newCa ? await generateCa(now) : await loadCa(readFileSync(paths.caCertPath, "utf-8"), readFileSync(paths.caKeyPath, "utf-8"));
-	const leaf = await issueLeaf(ca, identity, commonName, validDays, now);
-	const chainPem = `${leaf.certPem.trimEnd()}\n${ca.certPem.trimEnd()}\n`;
-	if (newCa) {
-		await writeFile(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
-		writeOwnerOnlyFileSync(`${paths.caKeyPath}.new`, ca.keyPem);
-		renameSync(`${paths.caCertPath}.new`, paths.caCertPath);
-		renameSync(`${paths.caKeyPath}.new`, paths.caKeyPath);
-	}
-	writeOwnerOnlyFileSync(`${paths.keyPath}.new`, leaf.keyPem);
-	await writeFile(`${paths.certPath}.new`, chainPem, "utf-8");
-	renameSync(`${paths.keyPath}.new`, paths.keyPath);
-	renameSync(`${paths.certPath}.new`, paths.certPath);
-}
-function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
-	const leaf = new X509Certificate(readFileSync(paths.certPath));
-	const ca = new X509Certificate(readFileSync(paths.caCertPath));
-	const san = leaf.subjectAltName ?? "";
-	return {
-		...paths,
-		generated,
-		reason,
-		caRotated,
-		fingerprintSha256: leaf.fingerprint256,
-		previousFingerprintSha256,
-		caFingerprintSha256: ca.fingerprint256,
-		validTo: new Date(leaf.validTo).toISOString(),
-		sans: san === "" ? [] : san.split(", "),
-		reissueError
-	};
-}
-/**
-* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
-* options. `certPath` is a full chain, so the listener presents the local
-* root alongside the leaf.
-*/
-function loadTlsCert(certPath, keyPath) {
-	return {
-		cert: readFileSync(certPath),
-		key: readFileSync(keyPath)
-	};
-}
-//#endregion
-//#region src/tls/tls-status.ts
-function tlsDir(dataDir) {
-	return join(dataDir, "tls");
-}
-function readTlsMode(dataDir) {
-	const marker = join(tlsDir(dataDir), "mode");
-	if (existsSync(marker)) {
-		const raw = readFileSync(marker, "utf-8").trim();
-		if (raw === "uploaded") return "uploaded";
-		if (raw === "disabled") return "disabled";
-	}
-	return existsSync(join(tlsDir(dataDir), "camstack.crt")) ? "generated" : "disabled";
-}
-function writeTlsMode(dataDir, mode) {
-	mkdirSync(tlsDir(dataDir), { recursive: true });
-	writeFileSync(join(tlsDir(dataDir), "mode"), `${mode}\n`, "utf-8");
-}
-function readExtraSans(dataDir) {
-	const path = join(tlsDir(dataDir), "extra-sans.json");
-	if (!existsSync(path)) return [];
-	try {
-		const parsed = JSON.parse(readFileSync(path, "utf-8"));
-		if (!Array.isArray(parsed)) return [];
-		return parsed.filter((entry) => typeof entry === "string" && entry.length > 0);
-	} catch {
-		return [];
-	}
-}
-function writeExtraSans(dataDir, sans) {
-	mkdirSync(tlsDir(dataDir), { recursive: true });
-	writeFileSync(join(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}\n`, "utf-8");
-}
-/** Where an upload's own CA is kept — never over the local CA's `camstack-ca.crt`. */
-var UPLOADED_CA_FILE = "uploaded-ca.crt";
-/** Every certificate in a PEM bundle, in order. */
-function splitPemCertificates(pem) {
-	const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
-	return blocks === null ? [] : blocks.map((block) => `${block}\n`);
-}
-/**
-* The certificate that signed `leaf`, from the upload itself: the CA the
-* operator supplied, else the rest of the uploaded chain. `null` when the
-* upload did not include it — and then nothing may stand in for it: the
-* local CA did not sign an uploaded leaf, so handing it out as "the CA" would
-* tell a client to trust a root that verifies nothing it is served.
-*/
-function uploadedIssuer(dir, leaf, chainPem) {
-	const caPath = join(dir, UPLOADED_CA_FILE);
-	const candidates = [...existsSync(caPath) ? splitPemCertificates(readFileSync(caPath, "utf-8")) : [], ...splitPemCertificates(chainPem).slice(1)];
-	for (const pem of candidates) try {
-		const cert = new X509Certificate(pem);
-		if (leaf.checkIssued(cert) && leaf.verify(cert.publicKey)) return {
-			pem,
-			cert
-		};
-	} catch {}
-	return null;
-}
-function generatedIssuer(dir) {
-	const caPath = join(dir, "camstack-ca.crt");
-	if (!existsSync(caPath)) return null;
-	const pem = readFileSync(caPath, "utf-8");
-	return {
-		pem,
-		cert: new X509Certificate(pem)
-	};
-}
-/**
-* What the node's certificate is, and whether the listener serves it.
-* `servedLeafFingerprint` is the leaf the HTTPS listener presents right now
-* (`servedHttpsLeafFingerprint()`), or `null` when unknown; a restart is
-* required exactly when the listener serves a different leaf than the one
-* on disk — a measured fact, not a flag a mutation remembered to set.
-*/
-function readTlsAccessStatus(dataDir, servedLeafFingerprint) {
-	const dir = tlsDir(dataDir);
-	const certPath = join(dir, "camstack.crt");
-	const mode = readTlsMode(dataDir);
-	if (!existsSync(certPath)) return {
-		mode: "disabled",
-		leafFingerprintSha256: null,
-		caFingerprintSha256: null,
-		validTo: null,
-		sans: [],
-		caCertPem: (mode === "uploaded" ? null : generatedIssuer(dir))?.pem ?? null,
-		reissueError: null,
-		restartRequired: false
-	};
-	try {
-		const chainPem = readFileSync(certPath, "utf-8");
-		const leaf = new X509Certificate(chainPem);
-		const ca = mode === "uploaded" ? uploadedIssuer(dir, leaf, chainPem) : generatedIssuer(dir);
-		const san = leaf.subjectAltName ?? "";
-		return {
-			mode,
-			leafFingerprintSha256: leaf.fingerprint256,
-			caFingerprintSha256: ca?.cert.fingerprint256 ?? null,
-			validTo: new Date(leaf.validTo).toISOString(),
-			sans: san === "" ? [] : san.split(", "),
-			caCertPem: ca?.pem ?? null,
-			reissueError: null,
-			restartRequired: servedLeafFingerprint !== null && servedLeafFingerprint !== leaf.fingerprint256
-		};
-	} catch {
-		return {
-			mode,
-			leafFingerprintSha256: null,
-			caFingerprintSha256: null,
-			validTo: null,
-			sans: [],
-			caCertPem: null,
-			reissueError: "Certificate on disk could not be parsed.",
-			restartRequired: false
-		};
-	}
-}
-//#endregion
-//#region src/tls/boot-tls.ts
-/**
-* Decide what the listener serves at boot. The admin UI (Network → Local
-* access) is the only way to set a certificate (D726): it either leaves the
-* hub on its generated local-CA leaf (D227) or uploads one, recorded by the
-* `tls/mode` marker. An uploaded certificate is served verbatim — running it
-* through `ensureTlsCert` would replace it on the first restart, because a
-* leaf the local root did not issue is one of that rule's reissue triggers.
-*/
-async function prepareBootTls(dataDir, options) {
-	const certPath = join(dataDir, "tls", "camstack.crt");
-	const keyPath = join(dataDir, "tls", "camstack.key");
-	const marked = readTlsMode(dataDir);
-	if (marked === "uploaded" && existsSync(certPath) && existsSync(keyPath)) return {
-		mode: "uploaded",
-		pair: loadTlsCert(certPath, keyPath),
-		ensured: void 0,
-		uploadedMissing: false
-	};
-	const uploadedMissing = marked === "uploaded";
-	if (uploadedMissing) writeTlsMode(dataDir, "generated");
-	const ensured = await ensureTlsCert(dataDir, options);
-	return {
-		mode: "generated",
-		pair: loadTlsCert(ensured.certPath, ensured.keyPath),
-		ensured,
-		uploadedMissing
-	};
-}
-//#endregion
-//#region src/tls/https-listener.ts
-var SLOT_KEY = Symbol.for("camstack.tls.https-listener");
-var EMPTY_SLOT = {
-	reload: null,
-	servedLeafFingerprint: null
-};
-function isSlot(value) {
-	if (typeof value !== "object" || value === null) return false;
-	if (!("reload" in value) || !("servedLeafFingerprint" in value)) return false;
-	const reload = value.reload;
-	const served = value.servedLeafFingerprint;
-	return (reload === null || typeof reload === "function") && (served === null || typeof served === "string");
-}
-function readSlot() {
-	const current = Reflect.get(globalThis, SLOT_KEY);
-	return isSlot(current) ? current : EMPTY_SLOT;
-}
-function writeSlot(next) {
-	Reflect.set(globalThis, SLOT_KEY, next);
-}
-/** SHA-256 fingerprint of the first certificate (the leaf) in a PEM chain. */
-function leafFingerprintOf(chain) {
-	return new X509Certificate(chain).fingerprint256;
-}
-/**
-* Called once by the server after its HTTPS listener is up, with the pair it
-* was started on. From here on a certificate action swaps the served
-* certificate in place (`setSecureContext`) — new handshakes get the new
-* leaf, open connections keep theirs, nothing restarts.
-*/
-function registerHttpsListener(server, pair) {
-	writeSlot({
-		reload: (next) => server.setSecureContext({
-			cert: next.cert,
-			key: next.key
-		}),
-		servedLeafFingerprint: leafFingerprintOf(pair.cert)
-	});
-}
-/** Forget the listener — on shutdown, and between specs. */
-function clearHttpsListener() {
-	writeSlot(EMPTY_SLOT);
-}
-/**
-* The leaf the HTTPS listener serves now, or `null` when this process has no
-* registered listener (TLS off, or a process that does not own one) — in
-* which case nobody can say, and `null` is the honest answer.
-*/
-function servedHttpsLeafFingerprint() {
-	return readSlot().servedLeafFingerprint;
-}
-/** Serve `pair` from now on. Never throws: the outcome says what happened. */
-function reloadHttpsListener(pair) {
-	const slot = readSlot();
-	if (slot.reload === null) return { kind: "no-listener" };
-	try {
-		const servedLeafFingerprint = leafFingerprintOf(pair.cert);
-		slot.reload(pair);
-		writeSlot({
-			reload: slot.reload,
-			servedLeafFingerprint
-		});
-		return {
-			kind: "reloaded",
-			servedLeafFingerprint
-		};
-	} catch (err) {
-		return {
-			kind: "failed",
-			error: err instanceof Error ? err.message : String(err)
-		};
-	}
-}
-//#endregion
-//#region src/tls/uploaded-cert.ts
-/**
-* Operator-supplied material must parse, match its key, and carry
-* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
-* to keep generating.
-*/
-function validateUploadedTls(certPem, keyPem) {
-	let leaf;
-	try {
-		leaf = new X509Certificate(certPem);
-	} catch {
-		return {
-			ok: false,
-			error: "Certificate PEM could not be parsed."
-		};
-	}
-	try {
-		if (!leaf.checkPrivateKey(createPrivateKey(keyPem))) return {
-			ok: false,
-			error: "Private key does not match the certificate."
-		};
-	} catch {
-		return {
-			ok: false,
-			error: "Private key PEM could not be parsed."
-		};
-	}
-	const eku = leaf.keyUsage;
-	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
-		ok: false,
-		error: "Certificate is missing extendedKeyUsage = serverAuth."
-	};
-	return {
-		ok: true,
-		fingerprintSha256: leaf.fingerprint256,
-		validTo: new Date(leaf.validTo).toISOString()
-	};
-}
-//#endregion
-//#region src/tls/tls-actions.ts
-function withNewline(pem) {
-	return pem.endsWith("\n") ? pem : `${pem}\n`;
-}
-/**
-* Store an operator's certificate. The leaf (or chain) and key replace the
-* served pair; a CA, when given, goes to its own file. The local CA
-* (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
-* and it is what "Revert to generated" and every device that trusts it
-* still need.
-*/
-async function storeUploadedCertificate(dataDir, input) {
-	const valid = validateUploadedTls(input.certPem, input.keyPem);
-	if (!valid.ok) throw new Error(valid.error);
-	const dir = join(dataDir, "tls");
-	await mkdir(dir, { recursive: true });
-	await writeFile(join(dir, "camstack.crt"), withNewline(input.certPem));
-	writeOwnerOnlyFileSync(join(dir, "camstack.key"), withNewline(input.keyPem));
-	const caPath = join(dir, UPLOADED_CA_FILE);
-	if (input.caPem !== void 0 && input.caPem.trim() !== "") await writeFile(caPath, withNewline(input.caPem));
-	else rmSync(caPath, { force: true });
-	writeTlsMode(dataDir, "uploaded");
-}
-/** Issue a new generated leaf under the local CA. Refused while an upload is served. */
-async function regenerateCertificate(dataDir, options) {
-	if (readTlsMode(dataDir) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
-	await reissueTlsLeaf(dataDir, options);
-}
-/** Drop the upload and serve the generated local-CA leaf again (D227). */
-async function revertToGeneratedCertificate(dataDir, options) {
-	writeTlsMode(dataDir, "generated");
-	rmSync(join(dataDir, "tls", UPLOADED_CA_FILE), { force: true });
-	await ensureTlsCert(dataDir, options);
-}
-/**
-* Put the pair on disk on the HTTPS listener. Called after every action, so
-* "the certificate changed" and "clients see it" are the same moment.
-*/
-function applyCertificateToListener(dataDir) {
-	const certPath = join(dataDir, "tls", "camstack.crt");
-	const keyPath = join(dataDir, "tls", "camstack.key");
-	if (!existsSync(certPath) || !existsSync(keyPath)) return {
-		kind: "failed",
-		error: `No certificate pair under ${join(dataDir, "tls")}`
-	};
-	return reloadHttpsListener(loadTlsCert(certPath, keyPath));
-}
-//#endregion
 //#region src/tls/agent-https.ts
 /**
 * HTTPS for agents (D856): a leaf from the hub's LOCAL CA, so a device that
@@ -1249,4 +727,4 @@ function pemDigest(pem) {
 	return createHash("sha256").update(pem).digest("hex").slice(0, 16);
 }
 //#endregion
-export { readTlsMode as A, CA_VALIDITY_DAYS as B, registerHttpsListener as C, UPLOADED_CA_FILE as D, prepareBootTls as E, loadTlsCert as F, DEFAULT_LAN_HTTP_PORT as G, MAX_LEAF_VALIDITY_DAYS as H, reissueTlsLeaf as I, bindPendingLanHttp as J, allFamiliesListenHost as K, CA_COMMON_NAME as L, writeExtraSans as M, writeTlsMode as N, readExtraSans as O, ensureTlsCert as P, collectCertIdentity as R, leafFingerprintOf as S, servedHttpsLeafFingerprint as T, SERVER_AUTH_OID as U, LEAF_RENEWAL_WINDOW_DAYS as V, evaluateExistingCert as W, readLanHttpState as X, closeLanHttp as Y, registerLanHttpHandler as Z, regenerateCertificate as _, collectAgentNames as a, validateUploadedTls as b, installAgentHttps as c, isPrivateAddress as d, issueAgentHttpsLeaf as f, applyCertificateToListener as g, pinnedHttpsCaFingerprint as h, certificateNames as i, splitPemCertificates as j, readTlsAccessStatus as k, isContainerBridgeAddress as l, pemDigest as m, acceptAgentSans as n, createAgentHttpsRequest as o, loadAgentHttps as p, applyLanHttp as q, agentHttpsPaths as r, describeHttpsLeaf as s, AgentHttpsInstallError as t, isLocalOnlyHostname as u, revertToGeneratedCertificate as v, reloadHttpsListener as w, clearHttpsListener as x, storeUploadedCertificate as y, systemHostFacts as z };
+export { AgentHttpsNames as A, LEAF_RENEWAL_WINDOW_DAYS as C, reasonRequiresNewCa as D, evaluateExistingCert as E, setProcessAgentHttpsNames as M, AGENT_HTTPS_NAMES_COLLECTION as O, CA_VALIDITY_DAYS as S, SERVER_AUTH_OID as T, generateCa as _, collectAgentNames as a, collectCertIdentity as b, installAgentHttps as c, isPrivateAddress as d, issueAgentHttpsLeaf as f, CA_COMMON_NAME as g, pinnedHttpsCaFingerprint as h, certificateNames as i, getProcessAgentHttpsNames as j, AGENT_HTTPS_NAMES_COLUMNS as k, isContainerBridgeAddress as l, pemDigest as m, acceptAgentSans as n, createAgentHttpsRequest as o, loadAgentHttps as p, agentHttpsPaths as r, describeHttpsLeaf as s, AgentHttpsInstallError as t, isLocalOnlyHostname as u, issueLeaf as v, MAX_LEAF_VALIDITY_DAYS as w, systemHostFacts as x, loadCa as y };