@camstack/system 1.2.438 → 1.2.439

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-GgG-7amw.js");
-const require_device_ca = require("./device-ca-BSvkXqyI.js");
+const require_dist = require("./dist-BOWdLjoK.js");
+const require_device_ca = require("./device-ca-DHG9OW2m.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -22,21 +22,21 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-mjB2i-VR.js");
+const require_wal_maintenance = require("./wal-maintenance-DEL_jeG0.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_agent_https = require("./agent-https-BZIwS4xF.js");
-const require_constants = require("./constants-wkcn5Ij3.js");
+const require_agent_https = require("./agent-https-DlpTMDqA.js");
+const require_constants = require("./constants-BRsjQwi-.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-Bf_YnagS.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-CBLvq2oj.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-D7S5AJRU.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-CTRz8v9o.js");
+const require_restore_archive = require("./restore-archive-DiGiI6Jp.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -26797,7 +26797,17 @@ var en_default = {
 	"server.share-token-expired": "Share token expired: {id}",
 	"server.package-not-allowed": "Package \"{name}\" is not an allowed @camstack/* package",
 	"server.package-protected": "Cannot uninstall protected package \"{name}\"",
-	"server.package-required": "Package {packageName} is required and cannot be uninstalled"
+	"server.package-required": "Package {packageName} is required and cannot be uninstalled",
+	"tls.cert-unparsable": "The certificate PEM could not be parsed.",
+	"tls.key-unparsable": "The private key PEM could not be parsed.",
+	"tls.key-mismatch": "The private key does not match the certificate.",
+	"tls.missing-server-auth": "The certificate is missing extendedKeyUsage = serverAuth.",
+	"tls.ca-required": "This certificate was not issued by a public certificate authority, so its CA certificate is required: devices need it to trust the hub. Paste the CA certificate (for mkcert, the rootCA.pem in the folder `mkcert -CAROOT` prints).",
+	"tls.ca-unparsable": "The CA certificate could not be parsed.",
+	"tls.ca-not-issuer": "The certificate was not issued by the CA certificate you supplied.",
+	"tls.ca-not-a-ca": "The supplied CA certificate is not a certificate authority (CA:TRUE is missing).",
+	"tls.ca-expired": "The supplied CA certificate has expired or is not valid yet.",
+	"tls.no-stored-upload": "No uploaded certificate is kept on this node."
 };
 //#endregion
 //#region src/i18n/it.json
@@ -27034,7 +27044,17 @@ var it_default = {
 	"server.share-token-expired": "Token di condivisione scaduto: {id}",
 	"server.package-not-allowed": "Il pacchetto \"{name}\" non è un pacchetto @camstack/* consentito",
 	"server.package-protected": "Impossibile disinstallare il pacchetto protetto \"{name}\"",
-	"server.package-required": "Il pacchetto {packageName} è necessario e non può essere disinstallato"
+	"server.package-required": "Il pacchetto {packageName} è necessario e non può essere disinstallato",
+	"tls.cert-unparsable": "Impossibile leggere il PEM del certificato.",
+	"tls.key-unparsable": "Impossibile leggere il PEM della chiave privata.",
+	"tls.key-mismatch": "La chiave privata non corrisponde al certificato.",
+	"tls.missing-server-auth": "Al certificato manca extendedKeyUsage = serverAuth.",
+	"tls.ca-required": "Questo certificato non è stato emesso da una CA pubblica, quindi serve il certificato della sua CA: i dispositivi ne hanno bisogno per fidarsi dell'hub. Incolla il certificato della CA (per mkcert, il rootCA.pem nella cartella indicata da `mkcert -CAROOT`).",
+	"tls.ca-unparsable": "Impossibile leggere il certificato della CA.",
+	"tls.ca-not-issuer": "Il certificato non è stato emesso dalla CA che hai fornito.",
+	"tls.ca-not-a-ca": "Il certificato fornito non è una autorità di certificazione (manca CA:TRUE).",
+	"tls.ca-expired": "Il certificato della CA fornito è scaduto o non è ancora valido.",
+	"tls.no-stored-upload": "Su questo nodo non è conservato nessun certificato caricato."
 };
 //#endregion
 //#region src/i18n/catalog-registry.ts
@@ -27292,6 +27312,8 @@ exports.PAIRING_PIN_DIGITS = require_builtins_system_config_system_config_addon.
 exports.PAIRING_PROTOCOL = require_builtins_system_config_system_config_addon.PAIRING_PROTOCOL;
 exports.PAIRING_TTL_MS = require_builtins_system_config_system_config_addon.PAIRING_TTL_MS;
 exports.PARENT_ROUTED_PROVIDER_ADDON_ID = PARENT_ROUTED_PROVIDER_ADDON_ID;
+exports.PERMITTED_DNS_SUFFIXES = require_agent_https.PERMITTED_DNS_SUFFIXES;
+exports.PERMITTED_IP_RANGES = require_agent_https.PERMITTED_IP_RANGES;
 exports.PREVIOUS_LEAF_GRACE_MS = require_builtins_local_auth_local_auth_addon.PREVIOUS_LEAF_GRACE_MS;
 Object.defineProperty(exports, "PYTHON_VERSION", {
 	enumerable: true,
@@ -27381,6 +27403,7 @@ Object.defineProperty(exports, "buildBinaryPath", {
 exports.buildCapRouters = buildCapRouters;
 exports.buildHeapSample = buildHeapSample;
 exports.buildLinkChain = buildLinkChain;
+exports.buildNameConstraintSet = require_agent_https.buildNameConstraintSet;
 exports.buildNativeCapProxy = buildNativeCapProxy;
 exports.buildNodeManifest = buildNodeManifest;
 exports.buildNpmChildEnv = buildNpmChildEnv;
@@ -27389,6 +27412,7 @@ exports.buildTransporter = buildTransporter;
 exports.builderMountedCapNames = builderMountedCapNames;
 exports.caFingerprint = require_builtins_system_config_system_config_addon.caFingerprint;
 exports.caFingerprintCompact = require_builtins_system_config_system_config_addon.caFingerprintCompact;
+exports.caReplacementMarkerFile = require_hub_mdns_ciao.caReplacementMarkerFile;
 exports.callRegisterNodeWithRetry = callRegisterNodeWithRetry;
 exports.callWithServiceDiscovery = callWithServiceDiscovery;
 exports.canServeDataPlane = canServeDataPlane;
@@ -27399,6 +27423,8 @@ exports.capBareAction = capBareAction;
 exports.capServiceName = capServiceName;
 exports.catalogNamespaceOf = catalogNamespaceOf;
 exports.certificateNames = require_agent_https.certificateNames;
+exports.chainsToPublicRoot = require_hub_mdns_ciao.chainsToPublicRoot;
+exports.checkUploadedCa = require_hub_mdns_ciao.checkUploadedCa;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = classifyCapRoute;
 exports.clearHttpsListener = require_hub_mdns_ciao.clearHttpsListener;
@@ -27604,6 +27630,7 @@ exports.isAllowedAgentDashboardReturnTo = require_builtins_system_config_system_
 exports.isArrayBufferCensusReport = isArrayBufferCensusReport;
 exports.isArrayOutputSchema = require_dist.isArrayOutputSchema;
 exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
+exports.isConstrainedCa = require_agent_https.isConstrainedCa;
 exports.isContainerBridgeAddress = require_agent_https.isContainerBridgeAddress;
 exports.isCredentialKeyName = isCredentialKeyName;
 exports.isInfraCapability = isInfraCapability;
@@ -27651,6 +27678,8 @@ exports.parseTokenExpiry = require_builtins_local_auth_local_auth_addon.parseTok
 exports.parseTokenizedUrl = require_custom_action_registry.parseTokenizedUrl;
 exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
 exports.pemDigest = require_agent_https.pemDigest;
+exports.permitsIdentity = require_agent_https.permitsIdentity;
+exports.permitsName = require_agent_https.permitsName;
 exports.pinnedHttpsCaFingerprint = require_agent_https.pinnedHttpsCaFingerprint;
 exports.prepareBootTls = require_hub_mdns_ciao.prepareBootTls;
 exports.prepareRestoreArchive = require_restore_archive.prepareRestoreArchive;
@@ -27664,6 +27693,7 @@ exports.readCidrSetting = require_builtins_system_config_system_config_addon.rea
 exports.readExtraSans = require_hub_mdns_ciao.readExtraSans;
 exports.readHeapSpaces = readHeapSpaces;
 exports.readLanHttpState = require_hub_mdns_ciao.readLanHttpState;
+exports.readNameConstraints = require_agent_https.readNameConstraints;
 exports.readPendingRestart = readPendingRestart;
 exports.readSocketQueues = readSocketQueues;
 exports.readTlsAccessStatus = require_hub_mdns_ciao.readTlsAccessStatus;
@@ -27681,12 +27711,14 @@ exports.registerLanHttpHandler = require_hub_mdns_ciao.registerLanHttpHandler;
 exports.reissueTlsLeaf = require_hub_mdns_ciao.reissueTlsLeaf;
 exports.reloadHttpsListener = require_hub_mdns_ciao.reloadHttpsListener;
 exports.renewMeshCertificate = require_builtins_system_config_system_config_addon.renewMeshCertificate;
+exports.replaceUnconstrainedLocalCa = require_hub_mdns_ciao.replaceUnconstrainedLocalCa;
 exports.requireProcessMeshCa = require_builtins_system_config_system_config_addon.requireProcessMeshCa;
 exports.resetCatalogRegistryForTests = resetCatalogRegistryForTests;
 exports.resolveFilePath = require_custom_action_registry.resolveFilePath;
 exports.resolveFormatRevision = require_custom_action_registry.resolveFormatRevision;
 exports.resolveHwAccel = resolveHwAccel;
 exports.resolveNpmInvocation = resolveNpmInvocation;
+exports.retirePreviousLocalCa = require_hub_mdns_ciao.retirePreviousLocalCa;
 exports.revertToGeneratedCertificate = require_hub_mdns_ciao.revertToGeneratedCertificate;
 exports.revisionWeightUrl = require_custom_action_registry.revisionWeightUrl;
 exports.revokeMeshCertificate = require_builtins_system_config_system_config_addon.revokeMeshCertificate;
@@ -27730,6 +27762,7 @@ exports.stripForwardedCaller = require_builtins_storage_orchestrator_storage_orc
 exports.subscribePassthrough = subscribePassthrough;
 exports.systemHostFacts = require_agent_https.systemHostFacts;
 exports.udsChildLogToWorkerEntry = udsChildLogToWorkerEntry;
+exports.useStoredUploadedCertificate = require_hub_mdns_ciao.useStoredUploadedCertificate;
 exports.validateProviderRegistrations = validateProviderRegistrations;
 exports.validateUploadedTls = require_hub_mdns_ciao.validateUploadedTls;
 exports.verifyAgentUiUnlockTicket = require_builtins_system_config_system_config_addon.verifyAgentUiUnlockTicket;

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { Ar as DEVICE_SETTINGS_CONTRIBUTION_METHODS, B as METHOD_ACCESS_MAP, Br as asString$1, Dr as errMsg$1, En as objectInputDeclaresRequiredDeviceId, Fr as ReadinessTimeoutError, Gn as scopesAllowDeviceCap, Kt as extractNestedAddonId, Nr as RUNTIME_DEFAULTS, Pr as ReadinessRegistry, Qt as interpolate, R as LOG_LEVEL_RANK, Rr as asJsonObject$1, Tn as objectInputDeclaresAddonId, Vn as resolveMethodAuth, Wn as scopesAllowAddon, Wr as createEvent$1, Yr as expandCapMethods, Zn as splitTranslationRef, _ as CatalogFileSchema, an as isVoidInput, d as CATALOG_LANGS, dn as lifecycleJobSchema, en as isArrayOutputSchema, fi as scopeKey, gn as looseSchema, hn as logLevelAtMost, in as isObjectInput, ir as supportedRuntimes, jn as procedureAuthKey, jr as DEVICE_STATUS_METHOD, kr as DATAPLANE_SECRET_HEADER$1, li as readinessKey, n as AGENT_MDNS_TXT_KEYS, oi as parseJsonObject, on as kebabToCamel$1, qr as emitDownForOwnedCaps, r as ALL_CAPABILITY_DEFINITIONS, rt as addonSettingsCapability, si as parseJsonUnknown, t as AGENT_MDNS_SERVICE_TYPE, tn as isCollectionArrayMethod, ui as resolveCapMount, vi as userError, yi as EventCategory$1, zr as asNumber } from "./dist-Dc8GKC5H.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-DvIZjXIl.mjs";
+import { Ar as DEVICE_SETTINGS_CONTRIBUTION_METHODS, B as METHOD_ACCESS_MAP, Br as asString$1, Dr as errMsg$1, En as objectInputDeclaresRequiredDeviceId, Fr as ReadinessTimeoutError, Gn as scopesAllowDeviceCap, Kt as extractNestedAddonId, Nr as RUNTIME_DEFAULTS, Pr as ReadinessRegistry, Qt as interpolate, R as LOG_LEVEL_RANK, Rr as asJsonObject$1, Tn as objectInputDeclaresAddonId, Vn as resolveMethodAuth, Wn as scopesAllowAddon, Wr as createEvent$1, Yr as expandCapMethods, Zn as splitTranslationRef, _ as CatalogFileSchema, an as isVoidInput, d as CATALOG_LANGS, dn as lifecycleJobSchema, en as isArrayOutputSchema, fi as scopeKey, gn as looseSchema, hn as logLevelAtMost, in as isObjectInput, ir as supportedRuntimes, jn as procedureAuthKey, jr as DEVICE_STATUS_METHOD, kr as DATAPLANE_SECRET_HEADER$1, li as readinessKey, n as AGENT_MDNS_TXT_KEYS, oi as parseJsonObject, on as kebabToCamel$1, qr as emitDownForOwnedCaps, r as ALL_CAPABILITY_DEFINITIONS, rt as addonSettingsCapability, si as parseJsonUnknown, t as AGENT_MDNS_SERVICE_TYPE, tn as isCollectionArrayMethod, ui as resolveCapMount, vi as userError, yi as EventCategory$1, zr as asNumber } from "./dist-yI6kF6r6.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-46BUsWD1.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -21,21 +21,21 @@ import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-Bx3lcVA7.mjs";
+import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-xsvdT5Go.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { A as AgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as isPrivateAddress, f as issueAgentHttpsLeaf, g as CA_COMMON_NAME, h as pinnedHttpsCaFingerprint, i as certificateNames, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, l as isContainerBridgeAddress, m as pemDigest, n as acceptAgentSans, o as createAgentHttpsRequest, p as loadAgentHttps, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isLocalOnlyHostname, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts } from "./agent-https-BPfHrI4c.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-DQK705Sb.mjs";
+import { A as isConstrainedCa, C as MAX_LEAF_VALIDITY_DAYS, D as PERMITTED_DNS_SUFFIXES, F as AGENT_HTTPS_NAMES_COLLECTION, I as AGENT_HTTPS_NAMES_COLUMNS, L as AgentHttpsNames, M as permitsIdentity, N as permitsName, O as PERMITTED_IP_RANGES, P as readNameConstraints, R as getProcessAgentHttpsNames, S as LEAF_RENEWAL_WINDOW_DAYS, T as evaluateExistingCert, a as collectAgentNames, b as systemHostFacts, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isLocalOnlyHostname, k as buildNameConstraintSet, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as SERVER_AUTH_OID, x as CA_VALIDITY_DAYS, y as collectCertIdentity, z as setProcessAgentHttpsNames } from "./agent-https-U0d4uvn2.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-B92BjObl.mjs";
 import { $ as generateMeshKeyPair, A as setProcessMeshPeerTransportLookup, B as describeMeshLeaf, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as MeshCaKeeper, H as setProcessMeshCertificateRegistry, I as MESH_NODE_CERTIFICATES_COLLECTION, J as caFingerprint, K as getProcessMeshCaState, L as MESH_NODE_CERTIFICATES_COLUMNS, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as generateMeshCa, R as MeshCertificateRegistry, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as MeshCrl, V as getProcessMeshCertificateRegistry, W as processMeshCrl, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, _ as signPairingProof, _t as readCidrSetting, a as hubHostFromMeshAddress, at as AGENT_UI_UNLOCK_TTL_MS, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, ct as AGENT_UI_UNLOCK_VERSION, d as PAIRING_PROTOCOL, dt as mintAgentUiUnlockTicket, et as isValidAgentNodeId, f as PAIRING_TTL_MS, ft as parseAgentDashboardOrigins, g as keyFingerprintShort, gt as parseCidrList, h as describeCsr, ht as normalizeIp, i as AgentPairing, it as AGENT_DASHBOARD_ORIGINS_FIELD, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, lt as UnlockTicketJtiStore, m as computePairingSas, mt as createCidrMatcher, n as HubPairing, nt as issueMeshLeafFromCsr, o as PAIRING_CODE_DIGITS, ot as AGENT_UI_UNLOCK_TYP, p as computePairingCommitment, pt as verifyAgentUiUnlockTicket, q as requireProcessMeshCa, r as PairingHttpError, rt as loadMeshCa, s as PAIRING_MAX_CODE_ATTEMPTS, st as AGENT_UI_UNLOCK_USE, tt as issueMeshLeafForNode, u as PAIRING_PIN_DIGITS, ut as isAllowedAgentDashboardReturnTo, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as RENEWAL_ABANDONED } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BQnbN0DP.mjs";
-import { C as DEFAULT_LAN_HTTP_PORT, D as closeLanHttp, E as bindPendingLanHttp, O as readLanHttpState, S as reissueTlsLeaf, T as applyLanHttp, _ as splitPemCertificates, a as storeUploadedCertificate, b as ensureTlsCert, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, k as registerLanHttpHandler, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as validateUploadedTls, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as allFamiliesListenHost, x as loadTlsCert, y as writeTlsMode } from "./hub-mdns-ciao-DMlQTdPU.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-DGwVc2uh.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-DPg9duVY.mjs";
+import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-CpdUO-uS.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -26794,7 +26794,17 @@ var en_default = {
 	"server.share-token-expired": "Share token expired: {id}",
 	"server.package-not-allowed": "Package \"{name}\" is not an allowed @camstack/* package",
 	"server.package-protected": "Cannot uninstall protected package \"{name}\"",
-	"server.package-required": "Package {packageName} is required and cannot be uninstalled"
+	"server.package-required": "Package {packageName} is required and cannot be uninstalled",
+	"tls.cert-unparsable": "The certificate PEM could not be parsed.",
+	"tls.key-unparsable": "The private key PEM could not be parsed.",
+	"tls.key-mismatch": "The private key does not match the certificate.",
+	"tls.missing-server-auth": "The certificate is missing extendedKeyUsage = serverAuth.",
+	"tls.ca-required": "This certificate was not issued by a public certificate authority, so its CA certificate is required: devices need it to trust the hub. Paste the CA certificate (for mkcert, the rootCA.pem in the folder `mkcert -CAROOT` prints).",
+	"tls.ca-unparsable": "The CA certificate could not be parsed.",
+	"tls.ca-not-issuer": "The certificate was not issued by the CA certificate you supplied.",
+	"tls.ca-not-a-ca": "The supplied CA certificate is not a certificate authority (CA:TRUE is missing).",
+	"tls.ca-expired": "The supplied CA certificate has expired or is not valid yet.",
+	"tls.no-stored-upload": "No uploaded certificate is kept on this node."
 };
 //#endregion
 //#region src/i18n/it.json
@@ -27031,7 +27041,17 @@ var it_default = {
 	"server.share-token-expired": "Token di condivisione scaduto: {id}",
 	"server.package-not-allowed": "Il pacchetto \"{name}\" non è un pacchetto @camstack/* consentito",
 	"server.package-protected": "Impossibile disinstallare il pacchetto protetto \"{name}\"",
-	"server.package-required": "Il pacchetto {packageName} è necessario e non può essere disinstallato"
+	"server.package-required": "Il pacchetto {packageName} è necessario e non può essere disinstallato",
+	"tls.cert-unparsable": "Impossibile leggere il PEM del certificato.",
+	"tls.key-unparsable": "Impossibile leggere il PEM della chiave privata.",
+	"tls.key-mismatch": "La chiave privata non corrisponde al certificato.",
+	"tls.missing-server-auth": "Al certificato manca extendedKeyUsage = serverAuth.",
+	"tls.ca-required": "Questo certificato non è stato emesso da una CA pubblica, quindi serve il certificato della sua CA: i dispositivi ne hanno bisogno per fidarsi dell'hub. Incolla il certificato della CA (per mkcert, il rootCA.pem nella cartella indicata da `mkcert -CAROOT`).",
+	"tls.ca-unparsable": "Impossibile leggere il certificato della CA.",
+	"tls.ca-not-issuer": "Il certificato non è stato emesso dalla CA che hai fornito.",
+	"tls.ca-not-a-ca": "Il certificato fornito non è una autorità di certificazione (manca CA:TRUE).",
+	"tls.ca-expired": "Il certificato della CA fornito è scaduto o non è ancora valido.",
+	"tls.no-stored-upload": "Su questo nodo non è conservato nessun certificato caricato."
 };
 //#endregion
 //#region src/i18n/catalog-registry.ts
@@ -27129,4 +27149,4 @@ function resetCatalogRegistryForTests() {
 	shared = null;
 }
 //#endregion
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, collectAgentNames, collectCertIdentity, collectModelFiles, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, collectAgentNames, collectCertIdentity, collectModelFiles, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/{lib-NNxHSOIE.js → lib-8oZrELLm.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_x509_es = require("./x509.es-r7Ht1thA.js");
+const require_x509_es = require("./x509.es-C4cOo48M.js");
 const require_src$1 = require("./src-CnAqG6EF.js");
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) => {

package/dist/{lib-BeGzVQcd.mjs → lib-DK38ompL.mjs}

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, r as __exportAll, t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
-import { h as tslib_es6_exports, m as init_tslib_es6 } from "./x509.es-CDvj67p1.mjs";
+import { b as tslib_es6_exports, y as init_tslib_es6 } from "./x509.es-DK__ETIe.mjs";
 import { t as require_src } from "./src-hG4grMU4.mjs";
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/{restore-archive-DPg9duVY.mjs → restore-archive-CpdUO-uS.mjs}

@@ -1,4 +1,4 @@
-import { b as DATABASE_SNAPSHOT_SUFFIX } from "./dist-Dc8GKC5H.mjs";
+import { b as DATABASE_SNAPSHOT_SUFFIX } from "./dist-yI6kF6r6.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{restore-archive-CTRz8v9o.js → restore-archive-DiGiI6Jp.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-GgG-7amw.js");
+const require_dist = require("./dist-BOWdLjoK.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{retired-settings-keys-Dr_4lfKu.js → retired-settings-keys-CyQ7uvta.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-GgG-7amw.js");
+const require_dist = require("./dist-BOWdLjoK.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-Is0zO8gX.mjs → retired-settings-keys-UsVtLOT0.mjs}

@@ -1,4 +1,4 @@
-import { Rr as asJsonObject } from "./dist-Dc8GKC5H.mjs";
+import { Rr as asJsonObject } from "./dist-yI6kF6r6.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/tls/agent-https.d.ts

@@ -1,5 +1,6 @@
 import type { HttpsLeafInfo } from "@camstack/types";
 import { type CertIdentity, type HostFacts } from "./cert-identity.js";
+import { isLocalOnlyHostname } from "./cert-name-constraints.js";
 export interface AgentHttpsPaths {
 	readonly dir: string;
 	/** The one atomic file: key + leaf + pinned CA. */
@@ -63,8 +64,7 @@ export declare function describeHttpsLeaf(certPem: string): HttpsLeafInfo;
 export declare function isPrivateAddress(address: string): boolean;
 /** The default docker bridge network (172.17.0.0/16): identical on every host, so it names nothing. */
 export declare function isContainerBridgeAddress(address: string): boolean;
-/** A name that cannot collide with public DNS. */
-export declare function isLocalOnlyHostname(name: string): boolean;
+export { isLocalOnlyHostname };
 export interface AcceptedSans {
 	readonly identity: CertIdentity;
 	readonly accepted: readonly string[];

package/dist/tls/boot-tls.d.ts

@@ -17,6 +17,12 @@ export interface BootTls {
 	* a certificate source that changed under the operator is never silent.
 	*/
 	readonly uploadedMissing: boolean;
+	/**
+	* True when an UNCONSTRAINED local CA kept beside an uploaded certificate was replaced
+	* by a constrained one (D873). The served pair is untouched; agents' leaves chain to
+	* the new CA and clients that trusted the old one must re-trust. The caller logs it.
+	*/
+	readonly dormantCaReplaced: boolean;
 }
 /**
 * Decide what the listener serves at boot. The admin UI (Network → Local

package/dist/tls/cert-evaluation.d.ts

@@ -20,7 +20,7 @@ export declare const CA_RENEWAL_WINDOW_DAYS: number;
 * verbatim — an operator who trusted the old certificate by hand learns
 * from this string, not from a browser error.
 */
-export type CertRegenerationReason = "missing" | "unreadable" | "no-local-ca" | "ca-expiring" | "key-mismatch" | "expiring" | "missing-server-auth-eku" | "not-issued-by-local-ca" | "validity-too-long" | "san-coverage-gap";
+export type CertRegenerationReason = "missing" | "unreadable" | "no-local-ca" | "ca-expiring" | "ca-unconstrained" | "key-mismatch" | "expiring" | "missing-server-auth-eku" | "not-issued-by-local-ca" | "validity-too-long" | "san-coverage-gap";
 export interface CertEvaluationInput {
 	/** Contents of `camstack.crt` — leaf first, then the issuing CA. */
 	readonly chainPem: string;

package/dist/tls/cert-issue.d.ts

@@ -19,8 +19,12 @@ export interface CaSigner {
 * A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
 * else, and **no EKU** — Apple rejects an anchor asserting
 * `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
+*
+* It carries a CRITICAL `nameConstraints` extension (D873): private address
+* ranges and local-only DNS names, plus `hostnames` (the hub's own single-label
+* names at creation). A leaked key therefore cannot vouch for a public site.
 */
-export declare function generateCa(now: Date): Promise<CaSigner>;
+export declare function generateCa(now: Date, hostnames?: readonly string[]): Promise<CaSigner>;
 /** Re-open a root already on disk so a leaf can be issued under it. */
 export declare function loadCa(certPem: string, keyPem: string): Promise<CaSigner>;
 /**

package/dist/tls/cert-manager.d.ts

@@ -27,6 +27,11 @@ export interface EnsureTlsResult {
 	readonly validTo: string;
 	readonly sans: readonly string[];
 	/**
+	* SAN values the local CA's name constraints (D873) do not permit, left out of the
+	* leaf. Empty when everything the machine answers to is certifiable.
+	*/
+	readonly droppedNames: readonly string[];
+	/**
 	* Set when a reissue was needed and FAILED, and the previous material is
 	* still being served. Never null-and-degraded silently: this is the line
 	* that says the certificate is not what the rule wants it to be.
@@ -91,6 +96,19 @@ export declare function ensureTlsCert(dataDir: string, options?: CertOptions): P
 */
 export declare function reissueTlsLeaf(dataDir: string, options?: CertOptions): Promise<EnsureTlsResult>;
 /**
+* Uploaded mode keeps a generated CA beside the upload (agents' leaves are still signed
+* by it). When that CA is unconstrained, replace it alone (D873): the served pair is the
+* operator's and is never touched. Returns whether the CA was replaced.
+*/
+export declare function replaceUnconstrainedLocalCa(dataDir: string, options?: CertOptions): Promise<boolean>;
+/** Marker path for the status reader and the retire step. */
+export declare function caReplacementMarkerFile(dataDir: string): string;
+/**
+* Called once the HTTPS listener serves the leaf of the replacement CA: drop the retired
+* unconstrained CA, key first. Idempotent; returns whether anything was removed.
+*/
+export declare function retirePreviousLocalCa(dataDir: string): boolean;
+/**
 * Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS
 * options. `certPath` is a full chain, so the listener presents the local
 * root alongside the leaf.

package/dist/tls/cert-name-constraints.d.ts

@@ -0,0 +1,53 @@
+import { Extension, type X509Certificate as PeculiarCertificate } from "@peculiar/x509";
+import type { CertIdentity } from "./cert-identity.js";
+/** `id-ce-nameConstraints`. */
+export declare const NAME_CONSTRAINTS_OID = "2.5.29.30";
+/** The address space the generated CA may certify. 100.64.0.0/10 is CGNAT, which Tailscale hands out. Loopback is for the hub's own `127.0.0.1` / `::1` SANs. */
+export declare const PERMITTED_IP_RANGES: readonly string[];
+/**
+* Local-only DNS suffixes: none of them is delegated in public DNS. A leading
+* dot permits every name under the suffix and not the suffix itself.
+*/
+export declare const PERMITTED_DNS_SUFFIXES: readonly string[];
+/** A name that cannot collide with public DNS: a single label, or under a local-only suffix. */
+export declare function isLocalOnlyHostname(name: string): boolean;
+/** What a CA may certify, as read from (or written into) its extension. */
+export interface NameConstraintSet {
+	/** `ip/prefix` strings. */
+	readonly ipRanges: readonly string[];
+	/** Lower-cased DNS constraints: `.suffix` for a subtree, a bare name for the name and its subdomains. */
+	readonly dnsNames: readonly string[];
+	readonly critical: boolean;
+}
+/**
+* The constraint set for a new CA. `hostnames` are the hub's own local-only
+* names at creation time (a single-label OS hostname has no suffix to hide
+* under), added as exact entries; anything that could collide with public DNS
+* is dropped here, never constrained in.
+*/
+export declare function buildNameConstraintSet(hostnames: readonly string[]): NameConstraintSet;
+/** The `nameConstraints` extension for a CA: permitted subtrees only, marked critical. */
+export declare function createNameConstraintsExtension(set: NameConstraintSet): Extension;
+/** The CA's constraint set, or `null` when the certificate carries no `nameConstraints`. */
+export declare function readNameConstraints(cert: PeculiarCertificate): NameConstraintSet | null;
+/**
+* True when a CA is safe to keep as the hub's anchor: constrained to a
+* non-empty permitted set AND marked critical. A non-critical constraint is
+* ignored by clients that do not know the extension, which is the same as none.
+*/
+export declare function isConstrainedCa(cert: PeculiarCertificate): boolean;
+/** Is this SAN value (an IP literal or a DNS name) inside the permitted set? */
+export declare function permitsName(set: NameConstraintSet, value: string): boolean;
+export interface ConstrainedIdentity {
+	readonly identity: CertIdentity;
+	/** SAN values the CA's constraints do not permit, dropped from the leaf. */
+	readonly dropped: readonly string[];
+}
+/**
+* The part of an identity the CA is allowed to certify. A leaf naming
+* anything outside the constraints makes the WHOLE chain fail validation in
+* OpenSSL, so such names are dropped (and reported), never signed. The
+* required lists shrink the same way: otherwise a name the CA cannot certify
+* would count as a permanent SAN gap and reissue the leaf on every boot.
+*/
+export declare function permitsIdentity(set: NameConstraintSet, identity: CertIdentity): ConstrainedIdentity;

package/dist/tls/index.d.ts

@@ -1,11 +1,12 @@
 export { CA_VALIDITY_DAYS, type CertEvaluationInput, LEAF_RENEWAL_WINDOW_DAYS, SERVER_AUTH_OID } from "./cert-evaluation.js";
-export { type CertIdentity, type CertOptions, type HostFacts, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair } from "./cert-manager.js";
+export { type CertIdentity, type CertOptions, type HostFacts, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, replaceUnconstrainedLocalCa, retirePreviousLocalCa, caReplacementMarkerFile, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair } from "./cert-manager.js";
 export { type BootTls, type BootTlsMode, prepareBootTls } from "./boot-tls.js";
 export { clearHttpsListener, type HttpsReloadOutcome, leafFingerprintOf, registerHttpsListener, reloadHttpsListener, servedHttpsLeafFingerprint } from "./https-listener.js";
-export { applyCertificateToListener, regenerateCertificate, revertToGeneratedCertificate, storeUploadedCertificate, type UploadCertificateInput } from "./tls-actions.js";
+export { applyCertificateToListener, regenerateCertificate, revertToGeneratedCertificate, storeUploadedCertificate, type UploadCertificateInput, useStoredUploadedCertificate } from "./tls-actions.js";
 export { CA_COMMON_NAME } from "./cert-issue.js";
-export { validateUploadedTls, type UploadedTlsValidation } from "./uploaded-cert.js";
-export { type TlsAccessStatus, readTlsAccessStatus, splitPemCertificates, UPLOADED_CA_FILE, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans } from "./tls-status.js";
+export { checkUploadedCa, chainsToPublicRoot, validateUploadedTls, type UploadedCaCheck, type UploadedTlsErrorCode, type UploadedTlsValidation } from "./uploaded-cert.js";
+export { buildNameConstraintSet, isConstrainedCa, type NameConstraintSet, permitsIdentity, permitsName, readNameConstraints, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES } from "./cert-name-constraints.js";
+export { type StoredUploadInfo, type TlsAccessStatus, readTlsAccessStatus, splitPemCertificates, UPLOADED_CA_FILE, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans } from "./tls-status.js";
 export { acceptAgentSans, type AcceptedSans, AgentHttpsInstallError, type AgentHttpsMaterial, type AgentHttpsPaths, type AgentHttpsRequest, type AgentNames, agentHttpsPaths, certificateNames, collectAgentNames, createAgentHttpsRequest, describeHttpsLeaf, installAgentHttps, isContainerBridgeAddress, isLocalOnlyHostname, isPrivateAddress, issueAgentHttpsLeaf, type IssuedAgentHttps, loadAgentHttps, pemDigest, pinnedHttpsCaFingerprint } from "./agent-https.js";
 export { AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AgentHttpsNames, getProcessAgentHttpsNames, setProcessAgentHttpsNames } from "./agent-https-names.js";
 export { systemHostFacts } from "./cert-identity.js";

package/dist/tls/tls-actions.d.ts

@@ -1,3 +1,4 @@
+import type { X509Certificate } from "node:crypto";
 import { type CertOptions } from "./cert-manager.js";
 import { type HttpsReloadOutcome } from "./https-listener.js";
 /**
@@ -10,17 +11,36 @@ export interface UploadCertificateInput {
 	readonly keyPem: string;
 	readonly caPem?: string | undefined;
 }
+/** Test seam: the trust anchors that count as "public". Defaults to the ones Node ships. */
+export interface UploadCertificateOptions {
+	readonly publicRoots?: readonly X509Certificate[];
+	readonly now?: Date;
+}
+/**
+* Store an operator's certificate (D873). The material is validated first, and a
+* certificate that does not lead to a public CA must come with the CA that signed it
+* (validated: it is a CA, in date, and issued the leaf) - otherwise "Download CA" would
+* have nothing to hand out. Nothing is written when anything is refused.
+*
+* The leaf (or chain) and key are written twice: as the served pair, and as a kept copy
+* (`uploaded.crt` / `uploaded.key`, with the issuing CA in `uploaded-ca.crt`) that
+* "Revert to generated" leaves in place so the upload can be selected again. The local
+* CA (`camstack-ca.crt` + key) is never touched - it did not sign the upload, and it is
+* what every device that trusts it still needs.
+*/
+export declare function storeUploadedCertificate(dataDir: string, input: UploadCertificateInput, options?: UploadCertificateOptions): Promise<void>;
 /**
-* Store an operator's certificate. The leaf (or chain) and key replace the
-* served pair; a CA, when given, goes to its own file. The local CA
-* (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
-* and it is what "Revert to generated" and every device that trusts it
-* still need.
+* Serve the kept upload again after a revert (D873). Refused with a clear error when none
+* is kept; the generated material stays on disk and is untouched.
 */
-export declare function storeUploadedCertificate(dataDir: string, input: UploadCertificateInput): Promise<void>;
+export declare function useStoredUploadedCertificate(dataDir: string): Promise<void>;
 /** Issue a new generated leaf under the local CA. Refused while an upload is served. */
 export declare function regenerateCertificate(dataDir: string, options: CertOptions): Promise<void>;
-/** Drop the upload and serve the generated local-CA leaf again (D227). */
+/**
+* Serve the generated local-CA leaf again (D227). The uploaded certificate and its CA stay
+* on disk (D873) so it can be selected again; an upload made before they were kept is
+* copied aside first, from the pair being served.
+*/
 export declare function revertToGeneratedCertificate(dataDir: string, options: CertOptions): Promise<void>;
 /**
 * Put the pair on disk on the HTTPS listener. Called after every action, so

package/dist/tls/tls-status.d.ts

@@ -1,4 +1,11 @@
 export type TlsMode = "generated" | "uploaded" | "disabled";
+/** An uploaded certificate kept on disk (D873): selectable again after "Revert to generated". */
+export interface StoredUploadInfo {
+	readonly leafFingerprintSha256: string;
+	readonly validTo: string;
+	/** Whether a CA that signed it is kept with it. */
+	readonly hasCa: boolean;
+}
 export interface TlsAccessStatus {
 	readonly mode: TlsMode;
 	readonly leafFingerprintSha256: string | null;
@@ -8,11 +15,26 @@ export interface TlsAccessStatus {
 	readonly caCertPem: string | null;
 	readonly reissueError: string | null;
 	readonly restartRequired: boolean;
+	/**
+	* An uploaded certificate is served but no CA that signed it is kept and the chain does
+	* not lead to a public CA: "Download CA" has nothing to hand out, so devices cannot be
+	* made to trust the hub (D873). `false` otherwise.
+	*/
+	readonly caMissing: boolean;
+	/** Does the hub's own generated CA carry a critical name constraint? `null` while it has no CA. */
+	readonly localCaConstrained: boolean | null;
+	/** ISO time the generated CA was replaced by a constrained one; devices must re-trust it. */
+	readonly caReplacedAt: string | null;
+	/** The uploaded certificate kept on disk, whether or not it is the one served. */
+	readonly storedUpload: StoredUploadInfo | null;
 }
 export declare function readTlsMode(dataDir: string): TlsMode;
 export declare function writeTlsMode(dataDir: string, mode: TlsMode): void;
 export declare function readExtraSans(dataDir: string): readonly string[];
 export declare function writeExtraSans(dataDir: string, sans: readonly string[]): void;
+/** The kept copy of the last upload: the chain and key as the operator supplied them. */
+export declare const STORED_UPLOAD_CERT_FILE = "uploaded.crt";
+export declare const STORED_UPLOAD_KEY_FILE = "uploaded.key";
 /** Where an upload's own CA is kept — never over the local CA's `camstack-ca.crt`. */
 export declare const UPLOADED_CA_FILE = "uploaded-ca.crt";
 /** Every certificate in a PEM bundle, in order. */