@camstack/system 1.2.432 → 1.2.434

package/dist/{tls-C5IYg3V5.js → agent-https-BZIwS4xF.js}

@@ -1,145 +1,104 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_x509_es = require("./x509.es-Dzl0BbmG.js");
+const require_x509_es = require("./x509.es-r7Ht1thA.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_net = require("node:net");
-let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
-let node_http = require("node:http");
-//#region src/http/lan-http-bind.ts
-/**
-* Second HTTP listener that shares the hub's existing request handler.
-*
-* Fastify is one protocol per instance; HTTPS stays on :4443 and this
-* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
-* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
-*
-* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
-* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
-* hangs because nobody handles the upgrade on this socket.
-*/
-var DEFAULT_HTTP_PORT = 4480;
-var handlers = null;
-var server = null;
-var pending = null;
-var state = {
-	listening: false,
-	error: null,
-	port: DEFAULT_HTTP_PORT
-};
-var boundRequestedHost = null;
-var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
-/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
-function allFamiliesListenHost(host) {
-	if (host === "0.0.0.0" || host === "*" || host === "") return {
-		host: "::",
-		ipv6Only: false
-	};
-	return {
-		host,
-		ipv6Only: false
-	};
-}
-function registerLanHttpHandler(next) {
-	handlers = next;
-}
-function readLanHttpState() {
-	return state;
-}
-async function applyLanHttp(options) {
-	pending = options;
-	if (!options.enabled) {
-		await closeLanHttp();
-		state = {
-			listening: false,
-			error: null,
-			port: options.port
-		};
-		return state;
+//#region src/tls/agent-https-names.ts
+/**
+* @durable class=config owner=system-config
+*   write="the hub records the names it signed into an agent's HTTPS leaf, replacing that
+*     node's previous row"
+*   retention="one row per node, replaced on every issue; a forgotten node's row stays until
+*     the node is issued again or an operator clears it (it only blocks reuse of its names)"
+*/
+var AGENT_HTTPS_NAMES_COLLECTION = "agent_https_names";
+var AGENT_HTTPS_NAMES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "names",
+		type: "JSON",
+		notNull: true
+	},
+	{
+		name: "issuedAt",
+		type: "INTEGER",
+		notNull: true
 	}
-	if (handlers === null) {
-		state = {
-			listening: false,
-			error: "HTTP listener is not registered yet",
-			port: options.port
-		};
-		return state;
+];
+var AgentHttpsNames = class {
+	store;
+	byNode = /* @__PURE__ */ new Map();
+	constructor(store) {
+		this.store = store;
+	}
+	async load() {
+		const rows = await this.store.query.query({ collection: AGENT_HTTPS_NAMES_COLLECTION });
+		for (const row of rows) {
+			const names = row.data["names"];
+			if (Array.isArray(names)) this.byNode.set(row.id, names.filter((n) => typeof n === "string").map((n) => n.toLowerCase()));
+		}
 	}
-	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
-	await closeLanHttp();
-	try {
-		const bound = await listenHttp(options.port, options.host, handlers);
-		server = bound;
-		boundRequestedHost = options.host;
-		const addr = bound.address();
-		state = {
-			listening: true,
-			error: null,
-			port: typeof addr === "object" && addr !== null ? addr.port : options.port
-		};
-		return state;
-	} catch (err) {
-		server = null;
-		state = {
-			listening: false,
-			error: err instanceof Error ? err.message : String(err),
-			port: options.port
-		};
-		return state;
+	/** The names certified to `nodeId` (its id and the address of its live mesh socket), or `null`. */
+	namesOf(nodeId) {
+		return this.byNode.get(nodeId) ?? null;
 	}
-}
-/** After the hub registers the Fastify request handler, bind whatever was pending. */
-async function bindPendingLanHttp() {
-	if (pending === null) return applyLanHttp({
-		enabled: true,
-		port: DEFAULT_HTTP_PORT,
-		host: "0.0.0.0"
-	});
-	return applyLanHttp(pending);
-}
-async function closeLanHttp() {
-	const current = server;
-	server = null;
-	boundRequestedHost = null;
-	if (current === null) return;
-	await new Promise((resolve) => {
-		current.close(() => resolve());
-	});
-}
-function listenHttp(port, host, next) {
-	const resolved = allFamiliesListenHost(host);
-	return listenOn(port, resolved, next).catch((err) => {
-		if (resolved.host === "::" && host !== "::") return listenOn(port, {
-			host: "0.0.0.0",
-			ipv6Only: false
-		}, next);
-		throw err;
-	});
-}
-function listenOn(port, bind, next) {
-	return new Promise((resolve, reject) => {
-		const created = (0, node_http.createServer)(next.onRequest);
-		created.on("upgrade", next.onUpgrade);
-		const onError = (err) => {
-			created.off("listening", onListening);
-			created.close();
-			reject(err);
-		};
-		const onListening = () => {
-			created.off("error", onError);
-			resolve(created);
+	/** Every name certified to a node other than `nodeId`. */
+	takenByOthers(nodeId) {
+		const out = /* @__PURE__ */ new Set();
+		for (const [id, names] of this.byNode) {
+			if (id === nodeId) continue;
+			for (const n of names) out.add(n);
+		}
+		return out;
+	}
+	/** Free every name certified to a node that was forgotten. */
+	async release(nodeId) {
+		if (!this.byNode.delete(nodeId)) return false;
+		await this.store.delete.mutate({
+			collection: AGENT_HTTPS_NAMES_COLLECTION,
+			key: nodeId
+		});
+		return true;
+	}
+	async record(nodeId, names) {
+		const lowered = names.map((n) => n.toLowerCase());
+		const existed = this.byNode.has(nodeId);
+		this.byNode.set(nodeId, lowered);
+		const data = {
+			names: lowered,
+			issuedAt: Date.now()
 		};
-		created.once("error", onError);
-		created.once("listening", onListening);
-		created.listen({
-			port,
-			host: bind.host,
-			ipv6Only: bind.ipv6Only
+		if (existed) await this.store.update.mutate({
+			collection: AGENT_HTTPS_NAMES_COLLECTION,
+			id: nodeId,
+			data
 		});
-	});
+		else await this.store.insert.mutate({
+			collection: AGENT_HTTPS_NAMES_COLLECTION,
+			record: {
+				id: nodeId,
+				data
+			}
+		});
+	}
+};
+var SLOT = Symbol.for("camstack.agent-https.names");
+function setProcessAgentHttpsNames(names) {
+	if (names === null) Reflect.deleteProperty(globalThis, SLOT);
+	else Reflect.set(globalThis, SLOT, names);
+}
+function getProcessAgentHttpsNames() {
+	const value = Reflect.get(globalThis, SLOT);
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "takenByOthers") === "function" ? value : null;
 }
 //#endregion
 //#region src/tls/cert-evaluation.ts
@@ -344,11 +303,39 @@ function collectCertIdentity(options) {
 }
 //#endregion
 //#region src/tls/cert-issue.ts
+/**
+* Certificate issuance. Isolated so `cert-manager.ts` reads as policy and
+* this file reads as mechanics.
+*
+* **In-process, by decision (D551).** This used to shell out to `openssl`
+* three times. The hub's own TLS identity is not allowed to be a function
+* of which openssl happens to sit on the host: this fleet alone runs four
+* of them, and one — Ubuntu 20.04's 1.1.1f — silently ADDED the ambient
+* `/etc/ssl/openssl.cnf` `[req] x509_extensions = v3_ca` block on top of
+* our `-addext` flags, producing a root with two `basicConstraints` and
+* two `subjectKeyIdentifier` extensions. RFC 5280 §4.2 allows each at
+* most once, so OpenSSL 3 (which is what `node:crypto` is) marked that
+* root invalid: `X509Certificate.ca` read `false` on our own CA and
+* `checkIssued()` refused the pair. Under D227 that means "not issued by
+* the local CA", i.e. rotate the root — on every boot, forever, voiding
+* every trust an operator had granted by hand.
+*
+* Keys come from WebCrypto (`node:crypto`'s own implementation) and the
+* DER is assembled by `@peculiar/x509`. Nothing here reads the host.
+*/
 require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
 /** Subject of the local root. Distinct from the leaf's CN by construction. */
 var CA_COMMON_NAME = "CamStack Local CA";
 var MS_PER_DAY = 864e5;
 /**
+* Expiry of a served leaf. Browsers cap the TOTAL span (notBefore to notAfter) at 397 days, so
+* the span is `validDays` counted from the backdated start: the backdate costs five minutes of
+* expiry here, never extra span.
+*/
+function leafNotAfter(now, validDays) {
+	return new Date(require_x509_es.backdatedNotBefore(now).getTime() + validDays * MS_PER_DAY);
+}
+/**
 * RSA-2048 / SHA-256. Unchanged from the openssl invocation this replaces:
 * every client that trusted the previous material still understands this.
 */
@@ -407,7 +394,7 @@ async function generateCa(now) {
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: require_x509_es.backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
 		signingAlgorithm: SIGNING_ALGORITHM,
@@ -449,8 +436,8 @@ async function issueLeaf(ca, identity, commonName, validDays, now) {
 			serialNumber: freshSerial(),
 			subject: `CN=${commonName}`,
 			issuer: ca.cert.subject,
-			notBefore: now,
-			notAfter: new Date(now.getTime() + validDays * MS_PER_DAY),
+			notBefore: require_x509_es.backdatedNotBefore(now),
+			notAfter: leafNotAfter(now, validDays),
 			publicKey: keys.publicKey,
 			signingKey: ca.privateKey,
 			signingAlgorithm: SIGNING_ALGORITHM,
@@ -480,8 +467,8 @@ async function issueLeafFromCsr(ca, csrPem, identity, commonName, validDays, now
 		serialNumber: freshSerial(),
 		subject: `CN=${commonName}`,
 		issuer: ca.cert.subject,
-		notBefore: now,
-		notAfter: new Date(now.getTime() + validDays * MS_PER_DAY),
+		notBefore: require_x509_es.backdatedNotBefore(now),
+		notAfter: leafNotAfter(now, validDays),
 		publicKey: csr.publicKey,
 		signingKey: ca.privateKey,
 		signingAlgorithm: SIGNING_ALGORITHM,
@@ -489,487 +476,6 @@ async function issueLeafFromCsr(ca, csrPem, identity, commonName, validDays, now
 	}));
 }
 //#endregion
-//#region src/tls/cert-manager.ts
-var DEFAULT_COMMON_NAME = "camstack.local";
-/**
-* Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
-* a long-lived local **root** (`camstack-ca.crt`) and a short **leaf**
-* chained to it (`camstack.crt` = leaf + root, `camstack.key`).
-*
-* ## The regeneration rule (D227)
-*
-* Reissue happens when, and only when, the material on disk **cannot do
-* its job**:
-*
-* - it is absent, unreadable, or the key does not match the certificate;
-* - the root is absent (every pre-2026-08 install: one self-signed
-*   `CA:TRUE` leaf and no root) or is inside its renewal window;
-* - the leaf is inside its 30-day renewal window;
-* - the leaf lacks `extendedKeyUsage = serverAuth` — Apple's trustd
-*   rejects an app-supplied anchor without it;
-* - the leaf is not actually issued by the root on disk;
-* - the leaf's validity span exceeds {@link MAX_LEAF_VALIDITY_DAYS};
-* - **a name or address the hub must answer for is missing from the SAN
-*   list** — a DHCP move, a new interface or a new hostname.
-*
-* And explicitly NOT when: the certificate names an address the machine
-* no longer has (a superset still works — the check is one-directional),
-* a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
-* (global and ULA both rotate under privacy extensions / interface-id
-* churn — `os` cannot tell temporary from permanent), or a new build shipped.
-*
-* Every trigger is derived from the files plus the machine, so once a
-* reissue clears them it clears them for good: the next boot returns
-* `generated: false`. A certificate that moved on every boot would
-* invalidate every trust an operator granted by hand — worse than the
-* bugs this rule fixes.
-*
-* **The root is rotated only for root-level reasons.** SAN drift rotates
-* the leaf alone, so trust granted to `camstack-ca.crt` survives every
-* address change the hub will ever see.
-*/
-async function ensureTlsCert(dataDir, options) {
-	const tlsDir = (0, node_path.join)(dataDir, "tls");
-	const paths = {
-		certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
-		keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
-		caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
-		caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
-	};
-	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
-	const validDays = Math.min(options?.validDays ?? 397, 397);
-	const identity = collectCertIdentity({
-		commonName,
-		extraSans: options?.extraSans ?? [],
-		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
-	});
-	const reason = decideRegeneration(paths, identity);
-	if (reason === null) return describe(paths, false, null, false, null, null);
-	const previousFingerprint = readFingerprint(paths.certPath);
-	const caRotated = reasonRequiresNewCa(reason);
-	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
-	try {
-		await regenerate(paths, identity, commonName, validDays, caRotated);
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		if (!canKeepServing(paths)) throw err;
-		return describe(paths, false, null, false, null, message);
-	}
-	return describe(paths, true, reason, caRotated, previousFingerprint, null);
-}
-/**
-* Operator "Regenerate": issue a new leaf under the existing local CA.
-* Never rotates the root — trust granted to `camstack-ca.crt` survives.
-*/
-async function reissueTlsLeaf(dataDir, options) {
-	const tlsDir = (0, node_path.join)(dataDir, "tls");
-	const paths = {
-		certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
-		keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
-		caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
-		caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
-	};
-	if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return ensureTlsCert(dataDir, options);
-	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
-	const validDays = Math.min(options?.validDays ?? 397, 397);
-	const identity = collectCertIdentity({
-		commonName,
-		extraSans: options?.extraSans ?? [],
-		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
-	});
-	const previousFingerprint = readFingerprint(paths.certPath);
-	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
-	await regenerate(paths, identity, commonName, validDays, false);
-	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null);
-}
-/** True when the material already on disk can still terminate TLS. */
-function canKeepServing(paths) {
-	if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return false;
-	if (!(0, node_fs.existsSync)(paths.caCertPath)) return false;
-	return readFingerprint(paths.certPath) !== null;
-}
-/** Fingerprint of whatever is on disk, or `null` if there is nothing readable. */
-function readFingerprint(certPath) {
-	try {
-		return new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath)).fingerprint256;
-	} catch {
-		return null;
-	}
-}
-function decideRegeneration(paths, identity) {
-	if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return "missing";
-	if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return "no-local-ca";
-	try {
-		return evaluateExistingCert({
-			chainPem: (0, node_fs.readFileSync)(paths.certPath, "utf-8"),
-			keyPem: (0, node_fs.readFileSync)(paths.keyPath, "utf-8"),
-			caPem: (0, node_fs.readFileSync)(paths.caCertPath, "utf-8"),
-			identity,
-			now: /* @__PURE__ */ new Date()
-		});
-	} catch {
-		return "unreadable";
-	}
-}
-/**
-* Build every byte in memory, then move the files into place. A crash
-* mid-way leaves the previous material untouched; a crash between the
-* moves leaves a key/certificate mismatch, which the evaluator reports as
-* `key-mismatch` and heals on the next boot.
-*/
-async function regenerate(paths, identity, commonName, validDays, newCa) {
-	const now = /* @__PURE__ */ new Date();
-	const ca = newCa ? await generateCa(now) : await loadCa((0, node_fs.readFileSync)(paths.caCertPath, "utf-8"), (0, node_fs.readFileSync)(paths.caKeyPath, "utf-8"));
-	const leaf = await issueLeaf(ca, identity, commonName, validDays, now);
-	const chainPem = `${leaf.certPem.trimEnd()}\n${ca.certPem.trimEnd()}\n`;
-	if (newCa) {
-		await (0, node_fs_promises.writeFile)(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
-		(0, _camstack_types_node.writeOwnerOnlyFileSync)(`${paths.caKeyPath}.new`, ca.keyPem);
-		(0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
-		(0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
-	}
-	(0, _camstack_types_node.writeOwnerOnlyFileSync)(`${paths.keyPath}.new`, leaf.keyPem);
-	await (0, node_fs_promises.writeFile)(`${paths.certPath}.new`, chainPem, "utf-8");
-	(0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
-	(0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
-}
-function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
-	const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
-	const ca = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath));
-	const san = leaf.subjectAltName ?? "";
-	return {
-		...paths,
-		generated,
-		reason,
-		caRotated,
-		fingerprintSha256: leaf.fingerprint256,
-		previousFingerprintSha256,
-		caFingerprintSha256: ca.fingerprint256,
-		validTo: new Date(leaf.validTo).toISOString(),
-		sans: san === "" ? [] : san.split(", "),
-		reissueError
-	};
-}
-/**
-* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
-* options. `certPath` is a full chain, so the listener presents the local
-* root alongside the leaf.
-*/
-function loadTlsCert(certPath, keyPath) {
-	return {
-		cert: (0, node_fs.readFileSync)(certPath),
-		key: (0, node_fs.readFileSync)(keyPath)
-	};
-}
-//#endregion
-//#region src/tls/tls-status.ts
-function tlsDir(dataDir) {
-	return (0, node_path.join)(dataDir, "tls");
-}
-function readTlsMode(dataDir) {
-	const marker = (0, node_path.join)(tlsDir(dataDir), "mode");
-	if ((0, node_fs.existsSync)(marker)) {
-		const raw = (0, node_fs.readFileSync)(marker, "utf-8").trim();
-		if (raw === "uploaded") return "uploaded";
-		if (raw === "disabled") return "disabled";
-	}
-	return (0, node_fs.existsSync)((0, node_path.join)(tlsDir(dataDir), "camstack.crt")) ? "generated" : "disabled";
-}
-function writeTlsMode(dataDir, mode) {
-	(0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
-	(0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "mode"), `${mode}\n`, "utf-8");
-}
-function readExtraSans(dataDir) {
-	const path = (0, node_path.join)(tlsDir(dataDir), "extra-sans.json");
-	if (!(0, node_fs.existsSync)(path)) return [];
-	try {
-		const parsed = JSON.parse((0, node_fs.readFileSync)(path, "utf-8"));
-		if (!Array.isArray(parsed)) return [];
-		return parsed.filter((entry) => typeof entry === "string" && entry.length > 0);
-	} catch {
-		return [];
-	}
-}
-function writeExtraSans(dataDir, sans) {
-	(0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
-	(0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}\n`, "utf-8");
-}
-/** Where an upload's own CA is kept — never over the local CA's `camstack-ca.crt`. */
-var UPLOADED_CA_FILE = "uploaded-ca.crt";
-/** Every certificate in a PEM bundle, in order. */
-function splitPemCertificates(pem) {
-	const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
-	return blocks === null ? [] : blocks.map((block) => `${block}\n`);
-}
-/**
-* The certificate that signed `leaf`, from the upload itself: the CA the
-* operator supplied, else the rest of the uploaded chain. `null` when the
-* upload did not include it — and then nothing may stand in for it: the
-* local CA did not sign an uploaded leaf, so handing it out as "the CA" would
-* tell a client to trust a root that verifies nothing it is served.
-*/
-function uploadedIssuer(dir, leaf, chainPem) {
-	const caPath = (0, node_path.join)(dir, UPLOADED_CA_FILE);
-	const candidates = [...(0, node_fs.existsSync)(caPath) ? splitPemCertificates((0, node_fs.readFileSync)(caPath, "utf-8")) : [], ...splitPemCertificates(chainPem).slice(1)];
-	for (const pem of candidates) try {
-		const cert = new node_crypto.X509Certificate(pem);
-		if (leaf.checkIssued(cert) && leaf.verify(cert.publicKey)) return {
-			pem,
-			cert
-		};
-	} catch {}
-	return null;
-}
-function generatedIssuer(dir) {
-	const caPath = (0, node_path.join)(dir, "camstack-ca.crt");
-	if (!(0, node_fs.existsSync)(caPath)) return null;
-	const pem = (0, node_fs.readFileSync)(caPath, "utf-8");
-	return {
-		pem,
-		cert: new node_crypto.X509Certificate(pem)
-	};
-}
-/**
-* What the node's certificate is, and whether the listener serves it.
-* `servedLeafFingerprint` is the leaf the HTTPS listener presents right now
-* (`servedHttpsLeafFingerprint()`), or `null` when unknown; a restart is
-* required exactly when the listener serves a different leaf than the one
-* on disk — a measured fact, not a flag a mutation remembered to set.
-*/
-function readTlsAccessStatus(dataDir, servedLeafFingerprint) {
-	const dir = tlsDir(dataDir);
-	const certPath = (0, node_path.join)(dir, "camstack.crt");
-	const mode = readTlsMode(dataDir);
-	if (!(0, node_fs.existsSync)(certPath)) return {
-		mode: "disabled",
-		leafFingerprintSha256: null,
-		caFingerprintSha256: null,
-		validTo: null,
-		sans: [],
-		caCertPem: (mode === "uploaded" ? null : generatedIssuer(dir))?.pem ?? null,
-		reissueError: null,
-		restartRequired: false
-	};
-	try {
-		const chainPem = (0, node_fs.readFileSync)(certPath, "utf-8");
-		const leaf = new node_crypto.X509Certificate(chainPem);
-		const ca = mode === "uploaded" ? uploadedIssuer(dir, leaf, chainPem) : generatedIssuer(dir);
-		const san = leaf.subjectAltName ?? "";
-		return {
-			mode,
-			leafFingerprintSha256: leaf.fingerprint256,
-			caFingerprintSha256: ca?.cert.fingerprint256 ?? null,
-			validTo: new Date(leaf.validTo).toISOString(),
-			sans: san === "" ? [] : san.split(", "),
-			caCertPem: ca?.pem ?? null,
-			reissueError: null,
-			restartRequired: servedLeafFingerprint !== null && servedLeafFingerprint !== leaf.fingerprint256
-		};
-	} catch {
-		return {
-			mode,
-			leafFingerprintSha256: null,
-			caFingerprintSha256: null,
-			validTo: null,
-			sans: [],
-			caCertPem: null,
-			reissueError: "Certificate on disk could not be parsed.",
-			restartRequired: false
-		};
-	}
-}
-//#endregion
-//#region src/tls/boot-tls.ts
-/**
-* Decide what the listener serves at boot. The admin UI (Network → Local
-* access) is the only way to set a certificate (D726): it either leaves the
-* hub on its generated local-CA leaf (D227) or uploads one, recorded by the
-* `tls/mode` marker. An uploaded certificate is served verbatim — running it
-* through `ensureTlsCert` would replace it on the first restart, because a
-* leaf the local root did not issue is one of that rule's reissue triggers.
-*/
-async function prepareBootTls(dataDir, options) {
-	const certPath = (0, node_path.join)(dataDir, "tls", "camstack.crt");
-	const keyPath = (0, node_path.join)(dataDir, "tls", "camstack.key");
-	const marked = readTlsMode(dataDir);
-	if (marked === "uploaded" && (0, node_fs.existsSync)(certPath) && (0, node_fs.existsSync)(keyPath)) return {
-		mode: "uploaded",
-		pair: loadTlsCert(certPath, keyPath),
-		ensured: void 0,
-		uploadedMissing: false
-	};
-	const uploadedMissing = marked === "uploaded";
-	if (uploadedMissing) writeTlsMode(dataDir, "generated");
-	const ensured = await ensureTlsCert(dataDir, options);
-	return {
-		mode: "generated",
-		pair: loadTlsCert(ensured.certPath, ensured.keyPath),
-		ensured,
-		uploadedMissing
-	};
-}
-//#endregion
-//#region src/tls/https-listener.ts
-var SLOT_KEY = Symbol.for("camstack.tls.https-listener");
-var EMPTY_SLOT = {
-	reload: null,
-	servedLeafFingerprint: null
-};
-function isSlot(value) {
-	if (typeof value !== "object" || value === null) return false;
-	if (!("reload" in value) || !("servedLeafFingerprint" in value)) return false;
-	const reload = value.reload;
-	const served = value.servedLeafFingerprint;
-	return (reload === null || typeof reload === "function") && (served === null || typeof served === "string");
-}
-function readSlot() {
-	const current = Reflect.get(globalThis, SLOT_KEY);
-	return isSlot(current) ? current : EMPTY_SLOT;
-}
-function writeSlot(next) {
-	Reflect.set(globalThis, SLOT_KEY, next);
-}
-/** SHA-256 fingerprint of the first certificate (the leaf) in a PEM chain. */
-function leafFingerprintOf(chain) {
-	return new node_crypto.X509Certificate(chain).fingerprint256;
-}
-/**
-* Called once by the server after its HTTPS listener is up, with the pair it
-* was started on. From here on a certificate action swaps the served
-* certificate in place (`setSecureContext`) — new handshakes get the new
-* leaf, open connections keep theirs, nothing restarts.
-*/
-function registerHttpsListener(server, pair) {
-	writeSlot({
-		reload: (next) => server.setSecureContext({
-			cert: next.cert,
-			key: next.key
-		}),
-		servedLeafFingerprint: leafFingerprintOf(pair.cert)
-	});
-}
-/** Forget the listener — on shutdown, and between specs. */
-function clearHttpsListener() {
-	writeSlot(EMPTY_SLOT);
-}
-/**
-* The leaf the HTTPS listener serves now, or `null` when this process has no
-* registered listener (TLS off, or a process that does not own one) — in
-* which case nobody can say, and `null` is the honest answer.
-*/
-function servedHttpsLeafFingerprint() {
-	return readSlot().servedLeafFingerprint;
-}
-/** Serve `pair` from now on. Never throws: the outcome says what happened. */
-function reloadHttpsListener(pair) {
-	const slot = readSlot();
-	if (slot.reload === null) return { kind: "no-listener" };
-	try {
-		const servedLeafFingerprint = leafFingerprintOf(pair.cert);
-		slot.reload(pair);
-		writeSlot({
-			reload: slot.reload,
-			servedLeafFingerprint
-		});
-		return {
-			kind: "reloaded",
-			servedLeafFingerprint
-		};
-	} catch (err) {
-		return {
-			kind: "failed",
-			error: err instanceof Error ? err.message : String(err)
-		};
-	}
-}
-//#endregion
-//#region src/tls/uploaded-cert.ts
-/**
-* Operator-supplied material must parse, match its key, and carry
-* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
-* to keep generating.
-*/
-function validateUploadedTls(certPem, keyPem) {
-	let leaf;
-	try {
-		leaf = new node_crypto.X509Certificate(certPem);
-	} catch {
-		return {
-			ok: false,
-			error: "Certificate PEM could not be parsed."
-		};
-	}
-	try {
-		if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem))) return {
-			ok: false,
-			error: "Private key does not match the certificate."
-		};
-	} catch {
-		return {
-			ok: false,
-			error: "Private key PEM could not be parsed."
-		};
-	}
-	const eku = leaf.keyUsage;
-	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
-		ok: false,
-		error: "Certificate is missing extendedKeyUsage = serverAuth."
-	};
-	return {
-		ok: true,
-		fingerprintSha256: leaf.fingerprint256,
-		validTo: new Date(leaf.validTo).toISOString()
-	};
-}
-//#endregion
-//#region src/tls/tls-actions.ts
-function withNewline(pem) {
-	return pem.endsWith("\n") ? pem : `${pem}\n`;
-}
-/**
-* Store an operator's certificate. The leaf (or chain) and key replace the
-* served pair; a CA, when given, goes to its own file. The local CA
-* (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
-* and it is what "Revert to generated" and every device that trusts it
-* still need.
-*/
-async function storeUploadedCertificate(dataDir, input) {
-	const valid = validateUploadedTls(input.certPem, input.keyPem);
-	if (!valid.ok) throw new Error(valid.error);
-	const dir = (0, node_path.join)(dataDir, "tls");
-	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
-	await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.crt"), withNewline(input.certPem));
-	(0, _camstack_types_node.writeOwnerOnlyFileSync)((0, node_path.join)(dir, "camstack.key"), withNewline(input.keyPem));
-	const caPath = (0, node_path.join)(dir, UPLOADED_CA_FILE);
-	if (input.caPem !== void 0 && input.caPem.trim() !== "") await (0, node_fs_promises.writeFile)(caPath, withNewline(input.caPem));
-	else (0, node_fs.rmSync)(caPath, { force: true });
-	writeTlsMode(dataDir, "uploaded");
-}
-/** Issue a new generated leaf under the local CA. Refused while an upload is served. */
-async function regenerateCertificate(dataDir, options) {
-	if (readTlsMode(dataDir) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
-	await reissueTlsLeaf(dataDir, options);
-}
-/** Drop the upload and serve the generated local-CA leaf again (D227). */
-async function revertToGeneratedCertificate(dataDir, options) {
-	writeTlsMode(dataDir, "generated");
-	(0, node_fs.rmSync)((0, node_path.join)(dataDir, "tls", UPLOADED_CA_FILE), { force: true });
-	await ensureTlsCert(dataDir, options);
-}
-/**
-* Put the pair on disk on the HTTPS listener. Called after every action, so
-* "the certificate changed" and "clients see it" are the same moment.
-*/
-function applyCertificateToListener(dataDir) {
-	const certPath = (0, node_path.join)(dataDir, "tls", "camstack.crt");
-	const keyPath = (0, node_path.join)(dataDir, "tls", "camstack.key");
-	if (!(0, node_fs.existsSync)(certPath) || !(0, node_fs.existsSync)(keyPath)) return {
-		kind: "failed",
-		error: `No certificate pair under ${(0, node_path.join)(dataDir, "tls")}`
-	};
-	return reloadHttpsListener(loadTlsCert(certPath, keyPath));
-}
-//#endregion
 //#region src/tls/agent-https.ts
 /**
 * HTTPS for agents (D856): a leaf from the hub's LOCAL CA, so a device that
@@ -1251,28 +757,40 @@ function pemDigest(pem) {
 	return (0, node_crypto.createHash)("sha256").update(pem).digest("hex").slice(0, 16);
 }
 //#endregion
+Object.defineProperty(exports, "AGENT_HTTPS_NAMES_COLLECTION", {
+	enumerable: true,
+	get: function() {
+		return AGENT_HTTPS_NAMES_COLLECTION;
+	}
+});
+Object.defineProperty(exports, "AGENT_HTTPS_NAMES_COLUMNS", {
+	enumerable: true,
+	get: function() {
+		return AGENT_HTTPS_NAMES_COLUMNS;
+	}
+});
 Object.defineProperty(exports, "AgentHttpsInstallError", {
 	enumerable: true,
 	get: function() {
 		return AgentHttpsInstallError;
 	}
 });
-Object.defineProperty(exports, "CA_COMMON_NAME", {
+Object.defineProperty(exports, "AgentHttpsNames", {
 	enumerable: true,
 	get: function() {
-		return CA_COMMON_NAME;
+		return AgentHttpsNames;
 	}
 });
-Object.defineProperty(exports, "CA_VALIDITY_DAYS", {
+Object.defineProperty(exports, "CA_COMMON_NAME", {
 	enumerable: true,
 	get: function() {
-		return CA_VALIDITY_DAYS;
+		return CA_COMMON_NAME;
 	}
 });
-Object.defineProperty(exports, "DEFAULT_LAN_HTTP_PORT", {
+Object.defineProperty(exports, "CA_VALIDITY_DAYS", {
 	enumerable: true,
 	get: function() {
-		return DEFAULT_LAN_HTTP_PORT;
+		return CA_VALIDITY_DAYS;
 	}
 });
 Object.defineProperty(exports, "LEAF_RENEWAL_WINDOW_DAYS", {
@@ -1293,12 +811,6 @@ Object.defineProperty(exports, "SERVER_AUTH_OID", {
 		return SERVER_AUTH_OID;
 	}
 });
-Object.defineProperty(exports, "UPLOADED_CA_FILE", {
-	enumerable: true,
-	get: function() {
-		return UPLOADED_CA_FILE;
-	}
-});
 Object.defineProperty(exports, "acceptAgentSans", {
 	enumerable: true,
 	get: function() {
@@ -1311,48 +823,12 @@ Object.defineProperty(exports, "agentHttpsPaths", {
 		return agentHttpsPaths;
 	}
 });
-Object.defineProperty(exports, "allFamiliesListenHost", {
-	enumerable: true,
-	get: function() {
-		return allFamiliesListenHost;
-	}
-});
-Object.defineProperty(exports, "applyCertificateToListener", {
-	enumerable: true,
-	get: function() {
-		return applyCertificateToListener;
-	}
-});
-Object.defineProperty(exports, "applyLanHttp", {
-	enumerable: true,
-	get: function() {
-		return applyLanHttp;
-	}
-});
-Object.defineProperty(exports, "bindPendingLanHttp", {
-	enumerable: true,
-	get: function() {
-		return bindPendingLanHttp;
-	}
-});
 Object.defineProperty(exports, "certificateNames", {
 	enumerable: true,
 	get: function() {
 		return certificateNames;
 	}
 });
-Object.defineProperty(exports, "clearHttpsListener", {
-	enumerable: true,
-	get: function() {
-		return clearHttpsListener;
-	}
-});
-Object.defineProperty(exports, "closeLanHttp", {
-	enumerable: true,
-	get: function() {
-		return closeLanHttp;
-	}
-});
 Object.defineProperty(exports, "collectAgentNames", {
 	enumerable: true,
 	get: function() {
@@ -1377,16 +853,22 @@ Object.defineProperty(exports, "describeHttpsLeaf", {
 		return describeHttpsLeaf;
 	}
 });
-Object.defineProperty(exports, "ensureTlsCert", {
+Object.defineProperty(exports, "evaluateExistingCert", {
 	enumerable: true,
 	get: function() {
-		return ensureTlsCert;
+		return evaluateExistingCert;
 	}
 });
-Object.defineProperty(exports, "evaluateExistingCert", {
+Object.defineProperty(exports, "generateCa", {
 	enumerable: true,
 	get: function() {
-		return evaluateExistingCert;
+		return generateCa;
+	}
+});
+Object.defineProperty(exports, "getProcessAgentHttpsNames", {
+	enumerable: true,
+	get: function() {
+		return getProcessAgentHttpsNames;
 	}
 });
 Object.defineProperty(exports, "installAgentHttps", {
@@ -1419,10 +901,10 @@ Object.defineProperty(exports, "issueAgentHttpsLeaf", {
 		return issueAgentHttpsLeaf;
 	}
 });
-Object.defineProperty(exports, "leafFingerprintOf", {
+Object.defineProperty(exports, "issueLeaf", {
 	enumerable: true,
 	get: function() {
-		return leafFingerprintOf;
+		return issueLeaf;
 	}
 });
 Object.defineProperty(exports, "loadAgentHttps", {
@@ -1431,10 +913,10 @@ Object.defineProperty(exports, "loadAgentHttps", {
 		return loadAgentHttps;
 	}
 });
-Object.defineProperty(exports, "loadTlsCert", {
+Object.defineProperty(exports, "loadCa", {
 	enumerable: true,
 	get: function() {
-		return loadTlsCert;
+		return loadCa;
 	}
 });
 Object.defineProperty(exports, "pemDigest", {
@@ -1449,88 +931,16 @@ Object.defineProperty(exports, "pinnedHttpsCaFingerprint", {
 		return pinnedHttpsCaFingerprint;
 	}
 });
-Object.defineProperty(exports, "prepareBootTls", {
-	enumerable: true,
-	get: function() {
-		return prepareBootTls;
-	}
-});
-Object.defineProperty(exports, "readExtraSans", {
-	enumerable: true,
-	get: function() {
-		return readExtraSans;
-	}
-});
-Object.defineProperty(exports, "readLanHttpState", {
-	enumerable: true,
-	get: function() {
-		return readLanHttpState;
-	}
-});
-Object.defineProperty(exports, "readTlsAccessStatus", {
-	enumerable: true,
-	get: function() {
-		return readTlsAccessStatus;
-	}
-});
-Object.defineProperty(exports, "readTlsMode", {
+Object.defineProperty(exports, "reasonRequiresNewCa", {
 	enumerable: true,
 	get: function() {
-		return readTlsMode;
+		return reasonRequiresNewCa;
 	}
 });
-Object.defineProperty(exports, "regenerateCertificate", {
+Object.defineProperty(exports, "setProcessAgentHttpsNames", {
 	enumerable: true,
 	get: function() {
-		return regenerateCertificate;
-	}
-});
-Object.defineProperty(exports, "registerHttpsListener", {
-	enumerable: true,
-	get: function() {
-		return registerHttpsListener;
-	}
-});
-Object.defineProperty(exports, "registerLanHttpHandler", {
-	enumerable: true,
-	get: function() {
-		return registerLanHttpHandler;
-	}
-});
-Object.defineProperty(exports, "reissueTlsLeaf", {
-	enumerable: true,
-	get: function() {
-		return reissueTlsLeaf;
-	}
-});
-Object.defineProperty(exports, "reloadHttpsListener", {
-	enumerable: true,
-	get: function() {
-		return reloadHttpsListener;
-	}
-});
-Object.defineProperty(exports, "revertToGeneratedCertificate", {
-	enumerable: true,
-	get: function() {
-		return revertToGeneratedCertificate;
-	}
-});
-Object.defineProperty(exports, "servedHttpsLeafFingerprint", {
-	enumerable: true,
-	get: function() {
-		return servedHttpsLeafFingerprint;
-	}
-});
-Object.defineProperty(exports, "splitPemCertificates", {
-	enumerable: true,
-	get: function() {
-		return splitPemCertificates;
-	}
-});
-Object.defineProperty(exports, "storeUploadedCertificate", {
-	enumerable: true,
-	get: function() {
-		return storeUploadedCertificate;
+		return setProcessAgentHttpsNames;
 	}
 });
 Object.defineProperty(exports, "systemHostFacts", {
@@ -1539,21 +949,3 @@ Object.defineProperty(exports, "systemHostFacts", {
 		return systemHostFacts;
 	}
 });
-Object.defineProperty(exports, "validateUploadedTls", {
-	enumerable: true,
-	get: function() {
-		return validateUploadedTls;
-	}
-});
-Object.defineProperty(exports, "writeExtraSans", {
-	enumerable: true,
-	get: function() {
-		return writeExtraSans;
-	}
-});
-Object.defineProperty(exports, "writeTlsMode", {
-	enumerable: true,
-	get: function() {
-		return writeTlsMode;
-	}
-});