@camstack/system 1.2.438 → 1.2.439

package/dist/{hub-mdns-ciao-CBLvq2oj.js → hub-mdns-ciao-D7S5AJRU.js}

@@ -1,10 +1,13 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_agent_https = require("./agent-https-BZIwS4xF.js");
+const require_dist = require("./dist-BOWdLjoK.js");
+const require_x509_es = require("./x509.es-C4cOo48M.js");
+const require_agent_https = require("./agent-https-DlpTMDqA.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
+let node_tls = require("node:tls");
 let node_http = require("node:http");
 //#region src/http/lan-http-bind.ts
 /**
@@ -188,24 +191,26 @@ async function ensureTlsCert(dataDir, options) {
 	};
 	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
 	const validDays = Math.min(options?.validDays ?? 397, 397);
-	const identity = require_agent_https.collectCertIdentity({
+	const rawIdentity = require_agent_https.collectCertIdentity({
 		commonName,
 		extraSans: options?.extraSans ?? [],
 		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
 	});
-	const reason = decideRegeneration(paths, identity);
-	if (reason === null) return describe(paths, false, null, false, null, null);
+	const onDisk = constrainToDiskCa(paths, rawIdentity);
+	const reason = decideRegeneration(paths, onDisk.identity);
+	if (reason === null) return describe(paths, false, null, false, null, null, onDisk.dropped);
 	const previousFingerprint = readFingerprint(paths.certPath);
 	const caRotated = require_agent_https.reasonRequiresNewCa(reason);
 	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
+	let dropped = [];
 	try {
-		await regenerate(paths, identity, commonName, validDays, caRotated);
+		dropped = await regenerate(paths, rawIdentity, commonName, validDays, caRotated, reason);
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		if (!canKeepServing(paths)) throw err;
-		return describe(paths, false, null, false, null, message);
+		return describe(paths, false, null, false, null, message, onDisk.dropped);
 	}
-	return describe(paths, true, reason, caRotated, previousFingerprint, null);
+	return describe(paths, true, reason, caRotated, previousFingerprint, null, dropped);
 }
 /**
 * Operator "Regenerate": issue a new leaf under the existing local CA.
@@ -229,8 +234,39 @@ async function reissueTlsLeaf(dataDir, options) {
 	});
 	const previousFingerprint = readFingerprint(paths.certPath);
 	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
-	await regenerate(paths, identity, commonName, validDays, false);
-	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null);
+	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null, await regenerate(paths, identity, commonName, validDays, false, null));
+}
+/**
+* Uploaded mode keeps a generated CA beside the upload (agents' leaves are still signed
+* by it). When that CA is unconstrained, replace it alone (D873): the served pair is the
+* operator's and is never touched. Returns whether the CA was replaced.
+*/
+async function replaceUnconstrainedLocalCa(dataDir, options) {
+	const tlsDir = (0, node_path.join)(dataDir, "tls");
+	const paths = {
+		certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
+		keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
+		caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
+		caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
+	};
+	if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return false;
+	try {
+		if (require_agent_https.isConstrainedCa(new require_x509_es.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath, "utf-8")))) return false;
+	} catch {
+		return false;
+	}
+	const identity = require_agent_https.collectCertIdentity({
+		commonName: options?.commonName ?? DEFAULT_COMMON_NAME,
+		extraSans: options?.extraSans ?? [],
+		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
+	});
+	const ca = await require_agent_https.generateCa(/* @__PURE__ */ new Date(), identity.dnsNames);
+	archivePreviousCa(paths, ca);
+	await (0, node_fs_promises.writeFile)(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
+	(0, _camstack_types_node.writeOwnerOnlyFileSync)(`${paths.caKeyPath}.new`, ca.keyPem);
+	(0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
+	(0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
+	return true;
 }
 /** True when the material already on disk can still terminate TLS. */
 function canKeepServing(paths) {
@@ -267,12 +303,18 @@ function decideRegeneration(paths, identity) {
 * moves leaves a key/certificate mismatch, which the evaluator reports as
 * `key-mismatch` and heals on the next boot.
 */
-async function regenerate(paths, identity, commonName, validDays, newCa) {
+async function regenerate(paths, rawIdentity, commonName, validDays, newCa, reason) {
 	const now = /* @__PURE__ */ new Date();
-	const ca = newCa ? await require_agent_https.generateCa(now) : await require_agent_https.loadCa((0, node_fs.readFileSync)(paths.caCertPath, "utf-8"), (0, node_fs.readFileSync)(paths.caKeyPath, "utf-8"));
+	const ca = newCa ? await require_agent_https.generateCa(now, rawIdentity.dnsNames) : await require_agent_https.loadCa((0, node_fs.readFileSync)(paths.caCertPath, "utf-8"), (0, node_fs.readFileSync)(paths.caKeyPath, "utf-8"));
+	const constraints = require_agent_https.readNameConstraints(ca.cert);
+	const { identity, dropped } = constraints === null ? {
+		identity: rawIdentity,
+		dropped: []
+	} : require_agent_https.permitsIdentity(constraints, rawIdentity);
 	const leaf = await require_agent_https.issueLeaf(ca, identity, commonName, validDays, now);
 	const chainPem = `${leaf.certPem.trimEnd()}\n${ca.certPem.trimEnd()}\n`;
 	if (newCa) {
+		if (reason === "ca-unconstrained") archivePreviousCa(paths, ca);
 		await (0, node_fs_promises.writeFile)(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
 		(0, _camstack_types_node.writeOwnerOnlyFileSync)(`${paths.caKeyPath}.new`, ca.keyPem);
 		(0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
@@ -282,8 +324,56 @@ async function regenerate(paths, identity, commonName, validDays, newCa) {
 	await (0, node_fs_promises.writeFile)(`${paths.certPath}.new`, chainPem, "utf-8");
 	(0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
 	(0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
+	return dropped;
+}
+/** The identity as far as the CA on disk may certify it; unchanged while that CA is absent or unconstrained. */
+function constrainToDiskCa(paths, identity) {
+	try {
+		const constraints = require_agent_https.readNameConstraints(new require_x509_es.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath, "utf-8")));
+		return constraints === null ? {
+			identity,
+			dropped: []
+		} : require_agent_https.permitsIdentity(constraints, identity);
+	} catch {
+		return {
+			identity,
+			dropped: []
+		};
+	}
+}
+/**
+* One-time replacement of an UNCONSTRAINED generated CA (D873): keep the old material
+* beside the new one until the new leaf is serving (`retirePreviousLocalCa`), and write the
+* marker the admin UI reads to tell the operator that clients must re-trust the CA.
+*/
+function archivePreviousCa(paths, replacement) {
+	if (!(0, node_fs.existsSync)(paths.caCertPath)) return;
+	const previousCert = `${paths.caCertPath}.previous`;
+	const previousKey = `${paths.caKeyPath}.previous`;
+	(0, node_fs.copyFileSync)(paths.caCertPath, previousCert);
+	if ((0, node_fs.existsSync)(paths.caKeyPath)) (0, node_fs.copyFileSync)(paths.caKeyPath, previousKey);
+	const previousFingerprint = readFingerprint(paths.caCertPath);
+	(0, _camstack_types_node.writeOwnerOnlyFileSync)((0, node_path.join)((0, node_path.dirname)(paths.caCertPath), "ca-replaced.json"), `${JSON.stringify({
+		replacedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		previousFingerprintSha256: previousFingerprint,
+		fingerprintSha256: new node_crypto.X509Certificate(replacement.certPem).fingerprint256
+	})}\n`);
+}
+/** Marker path for the status reader and the retire step. */
+function caReplacementMarkerFile(dataDir) {
+	return (0, node_path.join)(dataDir, "tls", "ca-replaced.json");
+}
+/**
+* Called once the HTTPS listener serves the leaf of the replacement CA: drop the retired
+* unconstrained CA, key first. Idempotent; returns whether anything was removed.
+*/
+function retirePreviousLocalCa(dataDir) {
+	const base = (0, node_path.join)(dataDir, "tls", "camstack-ca");
+	const present = [`${base}.key.previous`, `${base}.crt.previous`].filter((file) => (0, node_fs.existsSync)(file));
+	for (const file of present) (0, node_fs.rmSync)(file, { force: true });
+	return present.length > 0;
 }
-function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
+function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError, droppedNames) {
 	const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
 	const ca = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath));
 	const san = leaf.subjectAltName ?? "";
@@ -297,6 +387,7 @@ function describe(paths, generated, reason, caRotated, previousFingerprintSha256
 		caFingerprintSha256: ca.fingerprint256,
 		validTo: new Date(leaf.validTo).toISOString(),
 		sans: san === "" ? [] : san.split(", "),
+		droppedNames,
 		reissueError
 	};
 }
@@ -312,6 +403,140 @@ function loadTlsCert(certPath, keyPath) {
 	};
 }
 //#endregion
+//#region src/tls/uploaded-cert.ts
+var MESSAGES = {
+	"tls.cert-unparsable": "Certificate PEM could not be parsed.",
+	"tls.key-unparsable": "Private key PEM could not be parsed.",
+	"tls.key-mismatch": "Private key does not match the certificate.",
+	"tls.missing-server-auth": "Certificate is missing extendedKeyUsage = serverAuth.",
+	"tls.ca-required": "This certificate was not issued by a public certificate authority, so its CA certificate is required: devices need it to trust the hub. Paste the CA certificate (for mkcert, the rootCA.pem in the folder `mkcert -CAROOT` prints).",
+	"tls.ca-unparsable": "The CA certificate could not be parsed.",
+	"tls.ca-not-issuer": "The certificate was not issued by the CA certificate you supplied.",
+	"tls.ca-not-a-ca": "The supplied CA certificate is not a certificate authority (CA:TRUE is missing).",
+	"tls.ca-expired": "The supplied CA certificate has expired or is not valid yet."
+};
+function failure(code) {
+	return {
+		ok: false,
+		code,
+		error: MESSAGES[code]
+	};
+}
+/**
+* Operator-supplied material must parse, match its key, and carry
+* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
+* to keep generating.
+*/
+function validateUploadedTls(certPem, keyPem) {
+	let leaf;
+	try {
+		leaf = new node_crypto.X509Certificate(certPem);
+	} catch {
+		return failure("tls.cert-unparsable");
+	}
+	try {
+		if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem))) return failure("tls.key-mismatch");
+	} catch {
+		return failure("tls.key-unparsable");
+	}
+	const eku = leaf.keyUsage;
+	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return failure("tls.missing-server-auth");
+	return {
+		ok: true,
+		fingerprintSha256: leaf.fingerprint256,
+		validTo: new Date(leaf.validTo).toISOString()
+	};
+}
+/** Every certificate in a PEM bundle, in order. */
+function pemCertificates(pem) {
+	const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
+	return blocks === null ? [] : blocks.map((block) => `${block}\n`);
+}
+function parseAll(pems) {
+	const parsed = [];
+	for (const pem of pems) try {
+		parsed.push(new node_crypto.X509Certificate(pem));
+	} catch {}
+	return parsed;
+}
+function issuedBy(child, issuer) {
+	try {
+		return child.checkIssued(issuer) && child.verify(issuer.publicKey);
+	} catch {
+		return false;
+	}
+}
+var defaultPublicRoots;
+/** The trust anchors of public CAs that ship with Node. */
+function publicRootCertificates() {
+	defaultPublicRoots ??= parseAll(node_tls.rootCertificates);
+	return defaultPublicRoots;
+}
+/**
+* True when the served chain leads to a public CA that clients already trust:
+* the leaf, or one of the chain's own certificates, is signed by a public root.
+* Such a certificate needs nothing installed on a device, so no CA is required.
+*/
+function chainsToPublicRoot(chainPem, roots = publicRootCertificates()) {
+	const [leaf, ...rest] = parseAll(pemCertificates(chainPem));
+	if (leaf === void 0) return false;
+	let current = leaf;
+	const pool = [...rest];
+	for (let depth = 0; depth < 8; depth += 1) {
+		if (roots.some((root) => issuedBy(current, root))) return true;
+		const next = pool.find((candidate) => candidate !== current && issuedBy(current, candidate));
+		if (next === void 0) return false;
+		pool.splice(pool.indexOf(next), 1);
+		current = next;
+	}
+	return false;
+}
+/** Is `cert` a usable CA at `now`? */
+function caProblem(cert, now) {
+	if (!cert.ca) return "tls.ca-not-a-ca";
+	if (now < new Date(cert.validFrom) || now > new Date(cert.validTo)) return "tls.ca-expired";
+	return null;
+}
+/**
+* The CA rule for an upload (D873). A CA the operator supplies must parse, be a CA, be in
+* date and actually have signed the leaf. Without one, the upload is accepted only when
+* its own chain carries the issuer or leads to a public root; anything else is refused,
+* because a device cannot be told to trust a certificate nobody can hand it the CA of.
+*/
+function checkUploadedCa(chainPem, caPem, options) {
+	const now = options?.now ?? /* @__PURE__ */ new Date();
+	const [leaf, ...chainRest] = parseAll(pemCertificates(chainPem));
+	if (leaf === void 0) return failure("tls.cert-unparsable");
+	if (caPem !== void 0 && caPem.trim() !== "") {
+		const candidates = parseAll(pemCertificates(caPem));
+		if (candidates.length === 0) return failure("tls.ca-unparsable");
+		return pickIssuer(leaf, candidates, now, chainPem, options?.publicRoots);
+	}
+	const fromChain = chainRest.filter((cert) => issuedBy(leaf, cert));
+	if (fromChain.length > 0) return pickIssuer(leaf, fromChain, now, chainPem, options?.publicRoots);
+	if (chainsToPublicRoot(chainPem, options?.publicRoots)) return {
+		ok: true,
+		issuerPem: null,
+		publicChain: true
+	};
+	return failure("tls.ca-required");
+}
+function pickIssuer(leaf, candidates, now, chainPem, publicRoots) {
+	const signers = candidates.filter((candidate) => issuedBy(leaf, candidate));
+	if (signers.length === 0) return failure("tls.ca-not-issuer");
+	let firstProblem = null;
+	for (const signer of signers) {
+		const problem = caProblem(signer, now);
+		if (problem === null) return {
+			ok: true,
+			issuerPem: `${signer.toString().trimEnd()}\n`,
+			publicChain: chainsToPublicRoot(chainPem, publicRoots)
+		};
+		firstProblem ??= problem;
+	}
+	return failure(firstProblem ?? "tls.ca-not-issuer");
+}
+//#endregion
 //#region src/tls/tls-status.ts
 function tlsDir(dataDir) {
 	return (0, node_path.join)(dataDir, "tls");
@@ -344,6 +569,44 @@ function writeExtraSans(dataDir, sans) {
 	(0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
 	(0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}\n`, "utf-8");
 }
+/** The kept copy of the last upload: the chain and key as the operator supplied them. */
+var STORED_UPLOAD_CERT_FILE = "uploaded.crt";
+var STORED_UPLOAD_KEY_FILE = "uploaded.key";
+var CA_REPLACED_MARKER_FILE = "ca-replaced.json";
+function readStoredUpload(dir) {
+	const certPath = (0, node_path.join)(dir, STORED_UPLOAD_CERT_FILE);
+	if (!(0, node_fs.existsSync)(certPath) || !(0, node_fs.existsSync)((0, node_path.join)(dir, "uploaded.key"))) return null;
+	try {
+		const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath, "utf-8"));
+		return {
+			leafFingerprintSha256: leaf.fingerprint256,
+			validTo: new Date(leaf.validTo).toISOString(),
+			hasCa: (0, node_fs.existsSync)((0, node_path.join)(dir, UPLOADED_CA_FILE))
+		};
+	} catch {
+		return null;
+	}
+}
+function readLocalCaConstrained(dir) {
+	const caPath = (0, node_path.join)(dir, "camstack-ca.crt");
+	if (!(0, node_fs.existsSync)(caPath)) return null;
+	try {
+		return require_agent_https.isConstrainedCa(new require_x509_es.X509Certificate((0, node_fs.readFileSync)(caPath, "utf-8")));
+	} catch {
+		return null;
+	}
+}
+function readCaReplacedAt(dir) {
+	const path = (0, node_path.join)(dir, CA_REPLACED_MARKER_FILE);
+	if (!(0, node_fs.existsSync)(path)) return null;
+	try {
+		const parsed = JSON.parse((0, node_fs.readFileSync)(path, "utf-8"));
+		const at = parsed !== null && typeof parsed === "object" ? Reflect.get(parsed, "replacedAt") : null;
+		return typeof at === "string" ? at : null;
+	} catch {
+		return null;
+	}
+}
 /** Where an upload's own CA is kept — never over the local CA's `camstack-ca.crt`. */
 var UPLOADED_CA_FILE = "uploaded-ca.crt";
 /** Every certificate in a PEM bundle, in order. */
@@ -398,7 +661,11 @@ function readTlsAccessStatus(dataDir, servedLeafFingerprint) {
 		sans: [],
 		caCertPem: (mode === "uploaded" ? null : generatedIssuer(dir))?.pem ?? null,
 		reissueError: null,
-		restartRequired: false
+		restartRequired: false,
+		caMissing: false,
+		localCaConstrained: readLocalCaConstrained(dir),
+		caReplacedAt: readCaReplacedAt(dir),
+		storedUpload: readStoredUpload(dir)
 	};
 	try {
 		const chainPem = (0, node_fs.readFileSync)(certPath, "utf-8");
@@ -413,7 +680,11 @@ function readTlsAccessStatus(dataDir, servedLeafFingerprint) {
 			sans: san === "" ? [] : san.split(", "),
 			caCertPem: ca?.pem ?? null,
 			reissueError: null,
-			restartRequired: servedLeafFingerprint !== null && servedLeafFingerprint !== leaf.fingerprint256
+			restartRequired: servedLeafFingerprint !== null && servedLeafFingerprint !== leaf.fingerprint256,
+			caMissing: mode === "uploaded" && ca === null && !chainsToPublicRoot(chainPem),
+			localCaConstrained: readLocalCaConstrained(dir),
+			caReplacedAt: readCaReplacedAt(dir),
+			storedUpload: readStoredUpload(dir)
 		};
 	} catch {
 		return {
@@ -424,7 +695,11 @@ function readTlsAccessStatus(dataDir, servedLeafFingerprint) {
 			sans: [],
 			caCertPem: null,
 			reissueError: "Certificate on disk could not be parsed.",
-			restartRequired: false
+			restartRequired: false,
+			caMissing: false,
+			localCaConstrained: readLocalCaConstrained(dir),
+			caReplacedAt: readCaReplacedAt(dir),
+			storedUpload: readStoredUpload(dir)
 		};
 	}
 }
@@ -446,7 +721,8 @@ async function prepareBootTls(dataDir, options) {
 		mode: "uploaded",
 		pair: loadTlsCert(certPath, keyPath),
 		ensured: void 0,
-		uploadedMissing: false
+		uploadedMissing: false,
+		dormantCaReplaced: await replaceUnconstrainedLocalCa(dataDir, options)
 	};
 	const uploadedMissing = marked === "uploaded";
 	if (uploadedMissing) writeTlsMode(dataDir, "generated");
@@ -455,7 +731,8 @@ async function prepareBootTls(dataDir, options) {
 		mode: "generated",
 		pair: loadTlsCert(ensured.certPath, ensured.keyPath),
 		ensured,
-		uploadedMissing
+		uploadedMissing,
+		dormantCaReplaced: false
 	};
 }
 //#endregion
@@ -533,66 +810,51 @@ function reloadHttpsListener(pair) {
 	}
 }
 //#endregion
-//#region src/tls/uploaded-cert.ts
-/**
-* Operator-supplied material must parse, match its key, and carry
-* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
-* to keep generating.
-*/
-function validateUploadedTls(certPem, keyPem) {
-	let leaf;
-	try {
-		leaf = new node_crypto.X509Certificate(certPem);
-	} catch {
-		return {
-			ok: false,
-			error: "Certificate PEM could not be parsed."
-		};
-	}
-	try {
-		if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem))) return {
-			ok: false,
-			error: "Private key does not match the certificate."
-		};
-	} catch {
-		return {
-			ok: false,
-			error: "Private key PEM could not be parsed."
-		};
-	}
-	const eku = leaf.keyUsage;
-	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
-		ok: false,
-		error: "Certificate is missing extendedKeyUsage = serverAuth."
-	};
-	return {
-		ok: true,
-		fingerprintSha256: leaf.fingerprint256,
-		validTo: new Date(leaf.validTo).toISOString()
-	};
-}
-//#endregion
 //#region src/tls/tls-actions.ts
 function withNewline(pem) {
 	return pem.endsWith("\n") ? pem : `${pem}\n`;
 }
 /**
-* Store an operator's certificate. The leaf (or chain) and key replace the
-* served pair; a CA, when given, goes to its own file. The local CA
-* (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
-* and it is what "Revert to generated" and every device that trusts it
-* still need.
+* Store an operator's certificate (D873). The material is validated first, and a
+* certificate that does not lead to a public CA must come with the CA that signed it
+* (validated: it is a CA, in date, and issued the leaf) - otherwise "Download CA" would
+* have nothing to hand out. Nothing is written when anything is refused.
+*
+* The leaf (or chain) and key are written twice: as the served pair, and as a kept copy
+* (`uploaded.crt` / `uploaded.key`, with the issuing CA in `uploaded-ca.crt`) that
+* "Revert to generated" leaves in place so the upload can be selected again. The local
+* CA (`camstack-ca.crt` + key) is never touched - it did not sign the upload, and it is
+* what every device that trusts it still needs.
 */
-async function storeUploadedCertificate(dataDir, input) {
+async function storeUploadedCertificate(dataDir, input, options) {
 	const valid = validateUploadedTls(input.certPem, input.keyPem);
-	if (!valid.ok) throw new Error(valid.error);
+	if (!valid.ok) throw require_dist.userError(valid.code, {}, valid.error);
+	const ca = checkUploadedCa(input.certPem, input.caPem, options);
+	if (!ca.ok) throw require_dist.userError(ca.code, {}, ca.error);
 	const dir = (0, node_path.join)(dataDir, "tls");
 	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
-	await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.crt"), withNewline(input.certPem));
-	(0, _camstack_types_node.writeOwnerOnlyFileSync)((0, node_path.join)(dir, "camstack.key"), withNewline(input.keyPem));
+	const certText = withNewline(input.certPem);
+	const keyText = withNewline(input.keyPem);
+	(0, _camstack_types_node.writeOwnerOnlyFileSync)((0, node_path.join)(dir, STORED_UPLOAD_KEY_FILE), keyText);
+	await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, STORED_UPLOAD_CERT_FILE), certText);
 	const caPath = (0, node_path.join)(dir, UPLOADED_CA_FILE);
-	if (input.caPem !== void 0 && input.caPem.trim() !== "") await (0, node_fs_promises.writeFile)(caPath, withNewline(input.caPem));
+	if (ca.issuerPem !== null) await (0, node_fs_promises.writeFile)(caPath, ca.issuerPem);
 	else (0, node_fs.rmSync)(caPath, { force: true });
+	await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.crt"), certText);
+	(0, _camstack_types_node.writeOwnerOnlyFileSync)((0, node_path.join)(dir, "camstack.key"), keyText);
+	writeTlsMode(dataDir, "uploaded");
+}
+/**
+* Serve the kept upload again after a revert (D873). Refused with a clear error when none
+* is kept; the generated material stays on disk and is untouched.
+*/
+async function useStoredUploadedCertificate(dataDir) {
+	const dir = (0, node_path.join)(dataDir, "tls");
+	const certPath = (0, node_path.join)(dir, STORED_UPLOAD_CERT_FILE);
+	const keyPath = (0, node_path.join)(dir, STORED_UPLOAD_KEY_FILE);
+	if (!(0, node_fs.existsSync)(certPath) || !(0, node_fs.existsSync)(keyPath)) throw require_dist.userError("tls.no-stored-upload", {}, "No uploaded certificate is kept on this node.");
+	(0, node_fs.copyFileSync)(certPath, (0, node_path.join)(dir, "camstack.crt"));
+	(0, node_fs.copyFileSync)(keyPath, (0, node_path.join)(dir, "camstack.key"));
 	writeTlsMode(dataDir, "uploaded");
 }
 /** Issue a new generated leaf under the local CA. Refused while an upload is served. */
@@ -600,10 +862,20 @@ async function regenerateCertificate(dataDir, options) {
 	if (readTlsMode(dataDir) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
 	await reissueTlsLeaf(dataDir, options);
 }
-/** Drop the upload and serve the generated local-CA leaf again (D227). */
+/**
+* Serve the generated local-CA leaf again (D227). The uploaded certificate and its CA stay
+* on disk (D873) so it can be selected again; an upload made before they were kept is
+* copied aside first, from the pair being served.
+*/
 async function revertToGeneratedCertificate(dataDir, options) {
+	const dir = (0, node_path.join)(dataDir, "tls");
+	const keptCert = (0, node_path.join)(dir, STORED_UPLOAD_CERT_FILE);
+	const keptKey = (0, node_path.join)(dir, STORED_UPLOAD_KEY_FILE);
+	if (readTlsMode(dataDir) === "uploaded" && !(0, node_fs.existsSync)(keptCert) && (0, node_fs.existsSync)((0, node_path.join)(dir, "camstack.crt")) && (0, node_fs.existsSync)((0, node_path.join)(dir, "camstack.key"))) {
+		(0, node_fs.copyFileSync)((0, node_path.join)(dir, "camstack.crt"), keptCert);
+		(0, node_fs.copyFileSync)((0, node_path.join)(dir, "camstack.key"), keptKey);
+	}
 	writeTlsMode(dataDir, "generated");
-	(0, node_fs.rmSync)((0, node_path.join)(dataDir, "tls", UPLOADED_CA_FILE), { force: true });
 	await ensureTlsCert(dataDir, options);
 }
 /**
@@ -623,7 +895,7 @@ function applyCertificateToListener(dataDir) {
 //#region src/builtins/local-network/hub-mdns-ciao.ts
 function createCiaoPublisher() {
 	return { async publish(announcement) {
-		const { getResponder } = await Promise.resolve().then(() => /* @__PURE__ */ require_chunk.__toESM(require("./lib-NNxHSOIE.js").default));
+		const { getResponder } = await Promise.resolve().then(() => /* @__PURE__ */ require_chunk.__toESM(require("./lib-8oZrELLm.js").default));
 		const responder = getResponder();
 		const service = responder.createService({
 			name: announcement.name,
@@ -681,6 +953,24 @@ Object.defineProperty(exports, "bindPendingLanHttp", {
 		return bindPendingLanHttp;
 	}
 });
+Object.defineProperty(exports, "caReplacementMarkerFile", {
+	enumerable: true,
+	get: function() {
+		return caReplacementMarkerFile;
+	}
+});
+Object.defineProperty(exports, "chainsToPublicRoot", {
+	enumerable: true,
+	get: function() {
+		return chainsToPublicRoot;
+	}
+});
+Object.defineProperty(exports, "checkUploadedCa", {
+	enumerable: true,
+	get: function() {
+		return checkUploadedCa;
+	}
+});
 Object.defineProperty(exports, "clearHttpsListener", {
 	enumerable: true,
 	get: function() {
@@ -777,6 +1067,18 @@ Object.defineProperty(exports, "reloadHttpsListener", {
 		return reloadHttpsListener;
 	}
 });
+Object.defineProperty(exports, "replaceUnconstrainedLocalCa", {
+	enumerable: true,
+	get: function() {
+		return replaceUnconstrainedLocalCa;
+	}
+});
+Object.defineProperty(exports, "retirePreviousLocalCa", {
+	enumerable: true,
+	get: function() {
+		return retirePreviousLocalCa;
+	}
+});
 Object.defineProperty(exports, "revertToGeneratedCertificate", {
 	enumerable: true,
 	get: function() {
@@ -801,6 +1103,12 @@ Object.defineProperty(exports, "storeUploadedCertificate", {
 		return storeUploadedCertificate;
 	}
 });
+Object.defineProperty(exports, "useStoredUploadedCertificate", {
+	enumerable: true,
+	get: function() {
+		return useStoredUploadedCertificate;
+	}
+});
 Object.defineProperty(exports, "validateUploadedTls", {
 	enumerable: true,
 	get: function() {