@camstack/system 1.2.438 → 1.2.439

package/dist/{agent-https-BZIwS4xF.js → agent-https-DlpTMDqA.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_x509_es = require("./x509.es-r7Ht1thA.js");
+const require_x509_es = require("./x509.es-C4cOo48M.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_net = require("node:net");
@@ -101,6 +101,188 @@ function getProcessAgentHttpsNames() {
 	return value !== null && typeof value === "object" && typeof Reflect.get(value, "takenByOthers") === "function" ? value : null;
 }
 //#endregion
+//#region src/tls/cert-name-constraints.ts
+/**
+* Name constraints of the hub's generated local CA (D873).
+*
+* An unconstrained private CA vouches for EVERY site on the internet to any
+* device that trusts it, so a leaked CA key would let its holder impersonate
+* a bank. The generated CA therefore carries a CRITICAL `nameConstraints`
+* extension (RFC 5280 4.2.1.10) that limits what it can ever certify to the
+* private address space and local-only names. A verifier that does not
+* understand a critical extension must reject the certificate, so the
+* constraint cannot be silently ignored by a conforming client.
+*
+* Pure: no filesystem, no clock. `cert-issue.ts` embeds the extension,
+* `cert-manager.ts` filters leaf names through {@link permitsIdentity}.
+*/
+/** `id-ce-nameConstraints`. */
+var NAME_CONSTRAINTS_OID = "2.5.29.30";
+/** The address space the generated CA may certify. 100.64.0.0/10 is CGNAT, which Tailscale hands out. Loopback is for the hub's own `127.0.0.1` / `::1` SANs. */
+var PERMITTED_IP_RANGES = [
+	"10.0.0.0/8",
+	"172.16.0.0/12",
+	"192.168.0.0/16",
+	"100.64.0.0/10",
+	"127.0.0.0/8",
+	"fc00::/7",
+	"::1/128"
+];
+/**
+* Local-only DNS suffixes: none of them is delegated in public DNS. A leading
+* dot permits every name under the suffix and not the suffix itself.
+*/
+var PERMITTED_DNS_SUFFIXES = [
+	".local",
+	".lan",
+	".home.arpa",
+	".internal",
+	".localdomain",
+	"localhost"
+];
+var LABEL_RE = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/i;
+/** A name that cannot collide with public DNS: a single label, or under a local-only suffix. */
+function isLocalOnlyHostname(name) {
+	const lower = name.toLowerCase();
+	if (lower.length === 0 || lower.length > 253) return false;
+	if (!lower.includes(".")) return LABEL_RE.test(lower);
+	if (!PERMITTED_DNS_SUFFIXES.some((suffix) => suffix.startsWith(".") && lower.endsWith(suffix))) return false;
+	return lower.split(".").every((label) => LABEL_RE.test(label));
+}
+/**
+* The constraint set for a new CA. `hostnames` are the hub's own local-only
+* names at creation time (a single-label OS hostname has no suffix to hide
+* under), added as exact entries; anything that could collide with public DNS
+* is dropped here, never constrained in.
+*/
+function buildNameConstraintSet(hostnames) {
+	const dns = new Set(PERMITTED_DNS_SUFFIXES);
+	for (const name of hostnames) {
+		const lower = name.trim().toLowerCase();
+		if ((0, node_net.isIP)(lower) === 0 && isLocalOnlyHostname(lower)) dns.add(lower);
+	}
+	return {
+		ipRanges: PERMITTED_IP_RANGES,
+		dnsNames: [...dns],
+		critical: true
+	};
+}
+/** The `nameConstraints` extension for a CA: permitted subtrees only, marked critical. */
+function createNameConstraintsExtension(set) {
+	const subtrees = [...set.ipRanges.map((range) => new require_x509_es.GeneralSubtree({ base: new require_x509_es.GeneralName({ iPAddress: range }) })), ...set.dnsNames.map((name) => new require_x509_es.GeneralSubtree({ base: new require_x509_es.GeneralName({ dNSName: name }) }))];
+	const value = require_x509_es.AsnConvert.serialize(new require_x509_es.NameConstraints({ permittedSubtrees: new require_x509_es.GeneralSubtrees(subtrees) }));
+	return new require_x509_es.Extension(NAME_CONSTRAINTS_OID, set.critical, value);
+}
+/** The CA's constraint set, or `null` when the certificate carries no `nameConstraints`. */
+function readNameConstraints(cert) {
+	const ext = cert.extensions.find((e) => e.type === NAME_CONSTRAINTS_OID);
+	if (ext === void 0) return null;
+	const parsed = require_x509_es.AsnConvert.parse(ext.value, require_x509_es.NameConstraints);
+	const ipRanges = [];
+	const dnsNames = [];
+	for (const subtree of parsed.permittedSubtrees ?? []) {
+		if (subtree.base.iPAddress !== void 0) ipRanges.push(subtree.base.iPAddress);
+		if (subtree.base.dNSName !== void 0) dnsNames.push(subtree.base.dNSName.toLowerCase());
+	}
+	return {
+		ipRanges,
+		dnsNames,
+		critical: ext.critical
+	};
+}
+/**
+* True when a CA is safe to keep as the hub's anchor: constrained to a
+* non-empty permitted set AND marked critical. A non-critical constraint is
+* ignored by clients that do not know the extension, which is the same as none.
+*/
+function isConstrainedCa(cert) {
+	const set = readNameConstraints(cert);
+	return set !== null && set.critical && (set.ipRanges.length > 0 || set.dnsNames.length > 0);
+}
+function ipv4ToBigInt(address) {
+	return address.split(".").reduce((acc, octet) => acc << 8n | BigInt(Number(octet)), 0n);
+}
+function ipv6ToBigInt(address) {
+	const mapped = /^(.*:)(\d+\.\d+\.\d+\.\d+)$/.exec(address);
+	let text = address;
+	if (mapped !== null) {
+		const v4 = ipv4ToBigInt(mapped[2] ?? "0.0.0.0");
+		text = `${mapped[1] ?? ""}${(v4 >> 16n & 65535n).toString(16)}:${(v4 & 65535n).toString(16)}`;
+	}
+	const halves = text.split("::");
+	if (halves.length > 2) return null;
+	const head = (halves[0] ?? "") === "" ? [] : (halves[0] ?? "").split(":");
+	const tail = halves.length === 2 && (halves[1] ?? "") !== "" ? (halves[1] ?? "").split(":") : [];
+	const fill = halves.length === 2 ? 8 - head.length - tail.length : 0;
+	if (fill < 0 || halves.length === 1 && head.length !== 8) return null;
+	return [
+		...head,
+		...Array(fill).fill("0"),
+		...tail
+	].reduce((acc, group) => acc << 16n | BigInt(Number.parseInt(group, 16)), 0n);
+}
+function toBigInt(address) {
+	const family = (0, node_net.isIP)(address);
+	if (family === 4) return {
+		value: ipv4ToBigInt(address),
+		bits: 32
+	};
+	if (family === 6) {
+		const value = ipv6ToBigInt(address);
+		return value === null ? null : {
+			value,
+			bits: 128
+		};
+	}
+	return null;
+}
+function ipInRange(address, range) {
+	const [base, prefixText] = range.split("/");
+	if (base === void 0 || prefixText === void 0) return false;
+	const target = toBigInt(address);
+	const net = toBigInt(base);
+	const prefix = Number(prefixText);
+	if (target === null || net === null || target.bits !== net.bits) return false;
+	if (!Number.isInteger(prefix) || prefix < 0 || prefix > net.bits) return false;
+	const shift = BigInt(net.bits - prefix);
+	return target.value >> shift === net.value >> shift;
+}
+/** RFC 5280 DNS matching: a leading dot is a strict subtree, a bare name is itself and everything under it. */
+function dnsPermitted(name, constraint) {
+	const lower = name.toLowerCase();
+	if (constraint.startsWith(".")) return lower.endsWith(constraint);
+	return lower === constraint || lower.endsWith(`.${constraint}`);
+}
+/** Is this SAN value (an IP literal or a DNS name) inside the permitted set? */
+function permitsName(set, value) {
+	if ((0, node_net.isIP)(value) !== 0) return set.ipRanges.some((range) => ipInRange(value, range));
+	return set.dnsNames.some((constraint) => dnsPermitted(value, constraint));
+}
+/**
+* The part of an identity the CA is allowed to certify. A leaf naming
+* anything outside the constraints makes the WHOLE chain fail validation in
+* OpenSSL, so such names are dropped (and reported), never signed. The
+* required lists shrink the same way: otherwise a name the CA cannot certify
+* would count as a permanent SAN gap and reissue the leaf on every boot.
+*/
+function permitsIdentity(set, identity) {
+	const dropped = /* @__PURE__ */ new Set();
+	const keep = (values) => values.filter((value) => {
+		if (permitsName(set, value)) return true;
+		dropped.add(value);
+		return false;
+	});
+	return {
+		identity: {
+			dnsNames: keep(identity.dnsNames),
+			ipAddresses: keep(identity.ipAddresses),
+			requiredDnsNames: keep(identity.requiredDnsNames),
+			requiredIpAddresses: keep(identity.requiredIpAddresses)
+		},
+		dropped: [...dropped]
+	};
+}
+//#endregion
 //#region src/tls/cert-evaluation.ts
 /**
 * The regeneration rule (D227), as a pure function.
@@ -129,7 +311,8 @@ var REASONS_REQUIRING_NEW_CA = [
 	"missing",
 	"unreadable",
 	"no-local-ca",
-	"ca-expiring"
+	"ca-expiring",
+	"ca-unconstrained"
 ];
 function reasonRequiresNewCa(reason) {
 	return REASONS_REQUIRING_NEW_CA.includes(reason);
@@ -141,6 +324,14 @@ function parse(pem) {
 		return null;
 	}
 }
+/** A root without a CRITICAL name constraint (every pre-D873 install) can vouch for any site. */
+function caIsUnconstrained(caPem) {
+	try {
+		return !isConstrainedCa(new require_x509_es.X509Certificate(caPem));
+	} catch {
+		return true;
+	}
+}
 function daysBetween(from, to) {
 	return (to.getTime() - from.getTime()) / MS_PER_DAY$1;
 }
@@ -171,6 +362,7 @@ function evaluateExistingCert(input) {
 	const ca = parse(input.caPem);
 	if (leaf === null || ca === null) return "unreadable";
 	if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
+	if (caIsUnconstrained(input.caPem)) return "ca-unconstrained";
 	if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
 	if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
 	if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
@@ -383,13 +575,18 @@ function subjectAltNames(identity) {
 * A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
 * else, and **no EKU** — Apple rejects an anchor asserting
 * `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
+*
+* It carries a CRITICAL `nameConstraints` extension (D873): private address
+* ranges and local-only DNS names, plus `hostnames` (the hub's own single-label
+* names at creation). A leaked key therefore cannot vouch for a public site.
 */
-async function generateCa(now) {
+async function generateCa(now, hostnames = []) {
 	const keys = await node_crypto.webcrypto.subtle.generateKey(SIGNING_ALGORITHM, true, ["sign", "verify"]);
 	const extensions = [
 		new require_x509_es.BasicConstraintsExtension(true, 0, true),
 		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
-		await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey)
+		await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey),
+		createNameConstraintsExtension(buildNameConstraintSet(hostnames))
 	];
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
@@ -652,14 +849,6 @@ function describeHttpsLeaf(certPem) {
 		notAfter: Date.parse(x509.validTo)
 	};
 }
-var LOCAL_SUFFIXES = [
-	".local",
-	".lan",
-	".home.arpa",
-	".internal",
-	".localdomain"
-];
-var LABEL_RE = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/i;
 /** Private-network IPv4/IPv6: RFC 1918, CGNAT (Tailscale), link-local, ULA. */
 function isPrivateAddress(address) {
 	const family = (0, node_net.isIP)(address);
@@ -677,14 +866,6 @@ function isPrivateAddress(address) {
 function isContainerBridgeAddress(address) {
 	return /^172\.17\.\d{1,3}\.\d{1,3}$/.test(address);
 }
-/** A name that cannot collide with public DNS. */
-function isLocalOnlyHostname(name) {
-	const lower = name.toLowerCase();
-	if (lower.length === 0 || lower.length > 253) return false;
-	if (!lower.includes(".")) return LABEL_RE.test(lower);
-	if (!LOCAL_SUFFIXES.some((suffix) => lower.endsWith(suffix))) return false;
-	return lower.split(".").every((label) => LABEL_RE.test(label));
-}
 /**
 * The names the hub will sign for `nodeId`: its node id and the address of its live mesh
 * socket - nothing the agent says about itself. `excluded` holds every name already taken
@@ -737,14 +918,21 @@ async function issueAgentHttpsLeaf(input) {
 	if (!(0, node_fs.existsSync)(caCertPath) || !(0, node_fs.existsSync)(caKeyPath)) throw new Error("the hub has no local CA to sign with (no tls/camstack-ca.crt + key)");
 	const excluded = new Set(input.takenByOthers ?? []);
 	if ((0, node_fs.existsSync)(hubLeafPath)) for (const name of certificateNames((0, node_fs.readFileSync)(hubLeafPath, "utf8"))) excluded.add(name);
-	const sans = acceptAgentSans({
+	const ca = await loadCa((0, node_fs.readFileSync)(caCertPath, "utf8"), (0, node_fs.readFileSync)(caKeyPath, "utf8"));
+	const policy = acceptAgentSans({
 		nodeId: input.nodeId,
 		observedAddress: input.observedAddress,
 		excluded,
 		...input.reportedNames !== void 0 ? { reported: input.reportedNames } : {}
 	});
+	const constraints = readNameConstraints(ca.cert);
+	const constrained = constraints === null ? null : permitsIdentity(constraints, policy.identity);
+	const sans = constrained === null ? policy : {
+		identity: constrained.identity,
+		accepted: policy.accepted.filter((name) => !constrained.dropped.includes(name)),
+		rejected: [...policy.rejected, ...constrained.dropped.map((name) => `${name} (outside the local CA's name constraints)`)]
+	};
 	if (sans.accepted.length === 0) throw new Error(`no name of node '${input.nodeId}' can be certified (${sans.rejected.join("; ") || "nothing offered"})`);
-	const ca = await loadCa((0, node_fs.readFileSync)(caCertPath, "utf8"), (0, node_fs.readFileSync)(caKeyPath, "utf8"));
 	return {
 		certPem: await issueLeafFromCsr(ca, input.csrPem, sans.identity, input.nodeId, 397, input.now ?? /* @__PURE__ */ new Date()),
 		caCertPem: ca.certPem,
@@ -805,6 +993,18 @@ Object.defineProperty(exports, "MAX_LEAF_VALIDITY_DAYS", {
 		return MAX_LEAF_VALIDITY_DAYS;
 	}
 });
+Object.defineProperty(exports, "PERMITTED_DNS_SUFFIXES", {
+	enumerable: true,
+	get: function() {
+		return PERMITTED_DNS_SUFFIXES;
+	}
+});
+Object.defineProperty(exports, "PERMITTED_IP_RANGES", {
+	enumerable: true,
+	get: function() {
+		return PERMITTED_IP_RANGES;
+	}
+});
 Object.defineProperty(exports, "SERVER_AUTH_OID", {
 	enumerable: true,
 	get: function() {
@@ -823,6 +1023,12 @@ Object.defineProperty(exports, "agentHttpsPaths", {
 		return agentHttpsPaths;
 	}
 });
+Object.defineProperty(exports, "buildNameConstraintSet", {
+	enumerable: true,
+	get: function() {
+		return buildNameConstraintSet;
+	}
+});
 Object.defineProperty(exports, "certificateNames", {
 	enumerable: true,
 	get: function() {
@@ -877,6 +1083,12 @@ Object.defineProperty(exports, "installAgentHttps", {
 		return installAgentHttps;
 	}
 });
+Object.defineProperty(exports, "isConstrainedCa", {
+	enumerable: true,
+	get: function() {
+		return isConstrainedCa;
+	}
+});
 Object.defineProperty(exports, "isContainerBridgeAddress", {
 	enumerable: true,
 	get: function() {
@@ -925,12 +1137,30 @@ Object.defineProperty(exports, "pemDigest", {
 		return pemDigest;
 	}
 });
+Object.defineProperty(exports, "permitsIdentity", {
+	enumerable: true,
+	get: function() {
+		return permitsIdentity;
+	}
+});
+Object.defineProperty(exports, "permitsName", {
+	enumerable: true,
+	get: function() {
+		return permitsName;
+	}
+});
 Object.defineProperty(exports, "pinnedHttpsCaFingerprint", {
 	enumerable: true,
 	get: function() {
 		return pinnedHttpsCaFingerprint;
 	}
 });
+Object.defineProperty(exports, "readNameConstraints", {
+	enumerable: true,
+	get: function() {
+		return readNameConstraints;
+	}
+});
 Object.defineProperty(exports, "reasonRequiresNewCa", {
 	enumerable: true,
 	get: function() {

package/dist/{agent-https-BPfHrI4c.mjs → agent-https-U0d4uvn2.mjs}

@@ -1,4 +1,4 @@
-import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CDvj67p1.mjs";
+import { S as backdatedNotBefore, _ as NameConstraints, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, g as GeneralSubtrees, h as GeneralSubtree, i as Extension, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension, v as GeneralName, x as AsnConvert } from "./x509.es-DK__ETIe.mjs";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { isIP } from "node:net";
@@ -99,6 +99,188 @@ function getProcessAgentHttpsNames() {
 	return value !== null && typeof value === "object" && typeof Reflect.get(value, "takenByOthers") === "function" ? value : null;
 }
 //#endregion
+//#region src/tls/cert-name-constraints.ts
+/**
+* Name constraints of the hub's generated local CA (D873).
+*
+* An unconstrained private CA vouches for EVERY site on the internet to any
+* device that trusts it, so a leaked CA key would let its holder impersonate
+* a bank. The generated CA therefore carries a CRITICAL `nameConstraints`
+* extension (RFC 5280 4.2.1.10) that limits what it can ever certify to the
+* private address space and local-only names. A verifier that does not
+* understand a critical extension must reject the certificate, so the
+* constraint cannot be silently ignored by a conforming client.
+*
+* Pure: no filesystem, no clock. `cert-issue.ts` embeds the extension,
+* `cert-manager.ts` filters leaf names through {@link permitsIdentity}.
+*/
+/** `id-ce-nameConstraints`. */
+var NAME_CONSTRAINTS_OID = "2.5.29.30";
+/** The address space the generated CA may certify. 100.64.0.0/10 is CGNAT, which Tailscale hands out. Loopback is for the hub's own `127.0.0.1` / `::1` SANs. */
+var PERMITTED_IP_RANGES = [
+	"10.0.0.0/8",
+	"172.16.0.0/12",
+	"192.168.0.0/16",
+	"100.64.0.0/10",
+	"127.0.0.0/8",
+	"fc00::/7",
+	"::1/128"
+];
+/**
+* Local-only DNS suffixes: none of them is delegated in public DNS. A leading
+* dot permits every name under the suffix and not the suffix itself.
+*/
+var PERMITTED_DNS_SUFFIXES = [
+	".local",
+	".lan",
+	".home.arpa",
+	".internal",
+	".localdomain",
+	"localhost"
+];
+var LABEL_RE = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/i;
+/** A name that cannot collide with public DNS: a single label, or under a local-only suffix. */
+function isLocalOnlyHostname(name) {
+	const lower = name.toLowerCase();
+	if (lower.length === 0 || lower.length > 253) return false;
+	if (!lower.includes(".")) return LABEL_RE.test(lower);
+	if (!PERMITTED_DNS_SUFFIXES.some((suffix) => suffix.startsWith(".") && lower.endsWith(suffix))) return false;
+	return lower.split(".").every((label) => LABEL_RE.test(label));
+}
+/**
+* The constraint set for a new CA. `hostnames` are the hub's own local-only
+* names at creation time (a single-label OS hostname has no suffix to hide
+* under), added as exact entries; anything that could collide with public DNS
+* is dropped here, never constrained in.
+*/
+function buildNameConstraintSet(hostnames) {
+	const dns = new Set(PERMITTED_DNS_SUFFIXES);
+	for (const name of hostnames) {
+		const lower = name.trim().toLowerCase();
+		if (isIP(lower) === 0 && isLocalOnlyHostname(lower)) dns.add(lower);
+	}
+	return {
+		ipRanges: PERMITTED_IP_RANGES,
+		dnsNames: [...dns],
+		critical: true
+	};
+}
+/** The `nameConstraints` extension for a CA: permitted subtrees only, marked critical. */
+function createNameConstraintsExtension(set) {
+	const subtrees = [...set.ipRanges.map((range) => new GeneralSubtree({ base: new GeneralName({ iPAddress: range }) })), ...set.dnsNames.map((name) => new GeneralSubtree({ base: new GeneralName({ dNSName: name }) }))];
+	const value = AsnConvert.serialize(new NameConstraints({ permittedSubtrees: new GeneralSubtrees(subtrees) }));
+	return new Extension(NAME_CONSTRAINTS_OID, set.critical, value);
+}
+/** The CA's constraint set, or `null` when the certificate carries no `nameConstraints`. */
+function readNameConstraints(cert) {
+	const ext = cert.extensions.find((e) => e.type === NAME_CONSTRAINTS_OID);
+	if (ext === void 0) return null;
+	const parsed = AsnConvert.parse(ext.value, NameConstraints);
+	const ipRanges = [];
+	const dnsNames = [];
+	for (const subtree of parsed.permittedSubtrees ?? []) {
+		if (subtree.base.iPAddress !== void 0) ipRanges.push(subtree.base.iPAddress);
+		if (subtree.base.dNSName !== void 0) dnsNames.push(subtree.base.dNSName.toLowerCase());
+	}
+	return {
+		ipRanges,
+		dnsNames,
+		critical: ext.critical
+	};
+}
+/**
+* True when a CA is safe to keep as the hub's anchor: constrained to a
+* non-empty permitted set AND marked critical. A non-critical constraint is
+* ignored by clients that do not know the extension, which is the same as none.
+*/
+function isConstrainedCa(cert) {
+	const set = readNameConstraints(cert);
+	return set !== null && set.critical && (set.ipRanges.length > 0 || set.dnsNames.length > 0);
+}
+function ipv4ToBigInt(address) {
+	return address.split(".").reduce((acc, octet) => acc << 8n | BigInt(Number(octet)), 0n);
+}
+function ipv6ToBigInt(address) {
+	const mapped = /^(.*:)(\d+\.\d+\.\d+\.\d+)$/.exec(address);
+	let text = address;
+	if (mapped !== null) {
+		const v4 = ipv4ToBigInt(mapped[2] ?? "0.0.0.0");
+		text = `${mapped[1] ?? ""}${(v4 >> 16n & 65535n).toString(16)}:${(v4 & 65535n).toString(16)}`;
+	}
+	const halves = text.split("::");
+	if (halves.length > 2) return null;
+	const head = (halves[0] ?? "") === "" ? [] : (halves[0] ?? "").split(":");
+	const tail = halves.length === 2 && (halves[1] ?? "") !== "" ? (halves[1] ?? "").split(":") : [];
+	const fill = halves.length === 2 ? 8 - head.length - tail.length : 0;
+	if (fill < 0 || halves.length === 1 && head.length !== 8) return null;
+	return [
+		...head,
+		...Array(fill).fill("0"),
+		...tail
+	].reduce((acc, group) => acc << 16n | BigInt(Number.parseInt(group, 16)), 0n);
+}
+function toBigInt(address) {
+	const family = isIP(address);
+	if (family === 4) return {
+		value: ipv4ToBigInt(address),
+		bits: 32
+	};
+	if (family === 6) {
+		const value = ipv6ToBigInt(address);
+		return value === null ? null : {
+			value,
+			bits: 128
+		};
+	}
+	return null;
+}
+function ipInRange(address, range) {
+	const [base, prefixText] = range.split("/");
+	if (base === void 0 || prefixText === void 0) return false;
+	const target = toBigInt(address);
+	const net = toBigInt(base);
+	const prefix = Number(prefixText);
+	if (target === null || net === null || target.bits !== net.bits) return false;
+	if (!Number.isInteger(prefix) || prefix < 0 || prefix > net.bits) return false;
+	const shift = BigInt(net.bits - prefix);
+	return target.value >> shift === net.value >> shift;
+}
+/** RFC 5280 DNS matching: a leading dot is a strict subtree, a bare name is itself and everything under it. */
+function dnsPermitted(name, constraint) {
+	const lower = name.toLowerCase();
+	if (constraint.startsWith(".")) return lower.endsWith(constraint);
+	return lower === constraint || lower.endsWith(`.${constraint}`);
+}
+/** Is this SAN value (an IP literal or a DNS name) inside the permitted set? */
+function permitsName(set, value) {
+	if (isIP(value) !== 0) return set.ipRanges.some((range) => ipInRange(value, range));
+	return set.dnsNames.some((constraint) => dnsPermitted(value, constraint));
+}
+/**
+* The part of an identity the CA is allowed to certify. A leaf naming
+* anything outside the constraints makes the WHOLE chain fail validation in
+* OpenSSL, so such names are dropped (and reported), never signed. The
+* required lists shrink the same way: otherwise a name the CA cannot certify
+* would count as a permanent SAN gap and reissue the leaf on every boot.
+*/
+function permitsIdentity(set, identity) {
+	const dropped = /* @__PURE__ */ new Set();
+	const keep = (values) => values.filter((value) => {
+		if (permitsName(set, value)) return true;
+		dropped.add(value);
+		return false;
+	});
+	return {
+		identity: {
+			dnsNames: keep(identity.dnsNames),
+			ipAddresses: keep(identity.ipAddresses),
+			requiredDnsNames: keep(identity.requiredDnsNames),
+			requiredIpAddresses: keep(identity.requiredIpAddresses)
+		},
+		dropped: [...dropped]
+	};
+}
+//#endregion
 //#region src/tls/cert-evaluation.ts
 /**
 * The regeneration rule (D227), as a pure function.
@@ -127,7 +309,8 @@ var REASONS_REQUIRING_NEW_CA = [
 	"missing",
 	"unreadable",
 	"no-local-ca",
-	"ca-expiring"
+	"ca-expiring",
+	"ca-unconstrained"
 ];
 function reasonRequiresNewCa(reason) {
 	return REASONS_REQUIRING_NEW_CA.includes(reason);
@@ -139,6 +322,14 @@ function parse(pem) {
 		return null;
 	}
 }
+/** A root without a CRITICAL name constraint (every pre-D873 install) can vouch for any site. */
+function caIsUnconstrained(caPem) {
+	try {
+		return !isConstrainedCa(new X509Certificate$1(caPem));
+	} catch {
+		return true;
+	}
+}
 function daysBetween(from, to) {
 	return (to.getTime() - from.getTime()) / MS_PER_DAY$1;
 }
@@ -169,6 +360,7 @@ function evaluateExistingCert(input) {
 	const ca = parse(input.caPem);
 	if (leaf === null || ca === null) return "unreadable";
 	if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
+	if (caIsUnconstrained(input.caPem)) return "ca-unconstrained";
 	if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
 	if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
 	if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
@@ -381,13 +573,18 @@ function subjectAltNames(identity) {
 * A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
 * else, and **no EKU** — Apple rejects an anchor asserting
 * `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
+*
+* It carries a CRITICAL `nameConstraints` extension (D873): private address
+* ranges and local-only DNS names, plus `hostnames` (the hub's own single-label
+* names at creation). A leaked key therefore cannot vouch for a public site.
 */
-async function generateCa(now) {
+async function generateCa(now, hostnames = []) {
 	const keys = await webcrypto.subtle.generateKey(SIGNING_ALGORITHM, true, ["sign", "verify"]);
 	const extensions = [
 		new BasicConstraintsExtension(true, 0, true),
 		new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
-		await SubjectKeyIdentifierExtension.create(keys.publicKey)
+		await SubjectKeyIdentifierExtension.create(keys.publicKey),
+		createNameConstraintsExtension(buildNameConstraintSet(hostnames))
 	];
 	const cert = await X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
@@ -650,14 +847,6 @@ function describeHttpsLeaf(certPem) {
 		notAfter: Date.parse(x509.validTo)
 	};
 }
-var LOCAL_SUFFIXES = [
-	".local",
-	".lan",
-	".home.arpa",
-	".internal",
-	".localdomain"
-];
-var LABEL_RE = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/i;
 /** Private-network IPv4/IPv6: RFC 1918, CGNAT (Tailscale), link-local, ULA. */
 function isPrivateAddress(address) {
 	const family = isIP(address);
@@ -675,14 +864,6 @@ function isPrivateAddress(address) {
 function isContainerBridgeAddress(address) {
 	return /^172\.17\.\d{1,3}\.\d{1,3}$/.test(address);
 }
-/** A name that cannot collide with public DNS. */
-function isLocalOnlyHostname(name) {
-	const lower = name.toLowerCase();
-	if (lower.length === 0 || lower.length > 253) return false;
-	if (!lower.includes(".")) return LABEL_RE.test(lower);
-	if (!LOCAL_SUFFIXES.some((suffix) => lower.endsWith(suffix))) return false;
-	return lower.split(".").every((label) => LABEL_RE.test(label));
-}
 /**
 * The names the hub will sign for `nodeId`: its node id and the address of its live mesh
 * socket - nothing the agent says about itself. `excluded` holds every name already taken
@@ -735,14 +916,21 @@ async function issueAgentHttpsLeaf(input) {
 	if (!existsSync(caCertPath) || !existsSync(caKeyPath)) throw new Error("the hub has no local CA to sign with (no tls/camstack-ca.crt + key)");
 	const excluded = new Set(input.takenByOthers ?? []);
 	if (existsSync(hubLeafPath)) for (const name of certificateNames(readFileSync(hubLeafPath, "utf8"))) excluded.add(name);
-	const sans = acceptAgentSans({
+	const ca = await loadCa(readFileSync(caCertPath, "utf8"), readFileSync(caKeyPath, "utf8"));
+	const policy = acceptAgentSans({
 		nodeId: input.nodeId,
 		observedAddress: input.observedAddress,
 		excluded,
 		...input.reportedNames !== void 0 ? { reported: input.reportedNames } : {}
 	});
+	const constraints = readNameConstraints(ca.cert);
+	const constrained = constraints === null ? null : permitsIdentity(constraints, policy.identity);
+	const sans = constrained === null ? policy : {
+		identity: constrained.identity,
+		accepted: policy.accepted.filter((name) => !constrained.dropped.includes(name)),
+		rejected: [...policy.rejected, ...constrained.dropped.map((name) => `${name} (outside the local CA's name constraints)`)]
+	};
 	if (sans.accepted.length === 0) throw new Error(`no name of node '${input.nodeId}' can be certified (${sans.rejected.join("; ") || "nothing offered"})`);
-	const ca = await loadCa(readFileSync(caCertPath, "utf8"), readFileSync(caKeyPath, "utf8"));
 	return {
 		certPem: await issueLeafFromCsr(ca, input.csrPem, sans.identity, input.nodeId, 397, input.now ?? /* @__PURE__ */ new Date()),
 		caCertPem: ca.certPem,
@@ -755,4 +943,4 @@ function pemDigest(pem) {
 	return createHash("sha256").update(pem).digest("hex").slice(0, 16);
 }
 //#endregion
-export { AgentHttpsNames as A, LEAF_RENEWAL_WINDOW_DAYS as C, reasonRequiresNewCa as D, evaluateExistingCert as E, setProcessAgentHttpsNames as M, AGENT_HTTPS_NAMES_COLLECTION as O, CA_VALIDITY_DAYS as S, SERVER_AUTH_OID as T, generateCa as _, collectAgentNames as a, collectCertIdentity as b, installAgentHttps as c, isPrivateAddress as d, issueAgentHttpsLeaf as f, CA_COMMON_NAME as g, pinnedHttpsCaFingerprint as h, certificateNames as i, getProcessAgentHttpsNames as j, AGENT_HTTPS_NAMES_COLUMNS as k, isContainerBridgeAddress as l, pemDigest as m, acceptAgentSans as n, createAgentHttpsRequest as o, loadAgentHttps as p, agentHttpsPaths as r, describeHttpsLeaf as s, AgentHttpsInstallError as t, isLocalOnlyHostname as u, issueLeaf as v, MAX_LEAF_VALIDITY_DAYS as w, systemHostFacts as x, loadCa as y };
+export { isConstrainedCa as A, MAX_LEAF_VALIDITY_DAYS as C, PERMITTED_DNS_SUFFIXES as D, reasonRequiresNewCa as E, AGENT_HTTPS_NAMES_COLLECTION as F, AGENT_HTTPS_NAMES_COLUMNS as I, AgentHttpsNames as L, permitsIdentity as M, permitsName as N, PERMITTED_IP_RANGES as O, readNameConstraints as P, getProcessAgentHttpsNames as R, LEAF_RENEWAL_WINDOW_DAYS as S, evaluateExistingCert as T, issueLeaf as _, collectAgentNames as a, systemHostFacts as b, installAgentHttps as c, issueAgentHttpsLeaf as d, loadAgentHttps as f, generateCa as g, CA_COMMON_NAME as h, certificateNames as i, isLocalOnlyHostname as j, buildNameConstraintSet as k, isContainerBridgeAddress as l, pinnedHttpsCaFingerprint as m, acceptAgentSans as n, createAgentHttpsRequest as o, pemDigest as p, agentHttpsPaths as r, describeHttpsLeaf as s, AgentHttpsInstallError as t, isPrivateAddress as u, loadCa as v, SERVER_AUTH_OID as w, CA_VALIDITY_DAYS as x, collectCertIdentity as y, setProcessAgentHttpsNames as z };