@camstack/system 1.2.438 → 1.2.440

package/dist/{hub-mdns-ciao-DMlQTdPU.mjs → hub-mdns-ciao-Dy2YjRqC.mjs}

@@ -1,10 +1,13 @@
 import { o as __toESM } from "./chunk-CNf5ZN-e.mjs";
-import { D as reasonRequiresNewCa, E as evaluateExistingCert, _ as generateCa, b as collectCertIdentity, v as issueLeaf, y as loadCa } from "./agent-https-BPfHrI4c.mjs";
+import { xi as userError } from "./dist-9fcsrFU3.mjs";
+import { f as X509Certificate$1 } from "./x509.es-DK__ETIe.mjs";
+import { A as isConstrainedCa, E as reasonRequiresNewCa, M as permitsIdentity, P as readNameConstraints, T as evaluateExistingCert, _ as issueLeaf, g as generateCa, v as loadCa, y as collectCertIdentity } from "./agent-https-U0d4uvn2.mjs";
 import { X509Certificate, createPrivateKey } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { mkdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { rootCertificates } from "node:tls";
 import { createServer } from "node:http";
 //#region src/http/lan-http-bind.ts
 /**
@@ -188,24 +191,26 @@ async function ensureTlsCert(dataDir, options) {
 	};
 	const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
 	const validDays = Math.min(options?.validDays ?? 397, 397);
-	const identity = collectCertIdentity({
+	const rawIdentity = collectCertIdentity({
 		commonName,
 		extraSans: options?.extraSans ?? [],
 		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
 	});
-	const reason = decideRegeneration(paths, identity);
-	if (reason === null) return describe(paths, false, null, false, null, null);
+	const onDisk = constrainToDiskCa(paths, rawIdentity);
+	const reason = decideRegeneration(paths, onDisk.identity);
+	if (reason === null) return describe(paths, false, null, false, null, null, onDisk.dropped);
 	const previousFingerprint = readFingerprint(paths.certPath);
 	const caRotated = reasonRequiresNewCa(reason);
 	mkdirSync(tlsDir, { recursive: true });
+	let dropped = [];
 	try {
-		await regenerate(paths, identity, commonName, validDays, caRotated);
+		dropped = await regenerate(paths, rawIdentity, commonName, validDays, caRotated, reason);
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		if (!canKeepServing(paths)) throw err;
-		return describe(paths, false, null, false, null, message);
+		return describe(paths, false, null, false, null, message, onDisk.dropped);
 	}
-	return describe(paths, true, reason, caRotated, previousFingerprint, null);
+	return describe(paths, true, reason, caRotated, previousFingerprint, null, dropped);
 }
 /**
 * Operator "Regenerate": issue a new leaf under the existing local CA.
@@ -229,8 +234,39 @@ async function reissueTlsLeaf(dataDir, options) {
 	});
 	const previousFingerprint = readFingerprint(paths.certPath);
 	mkdirSync(tlsDir, { recursive: true });
-	await regenerate(paths, identity, commonName, validDays, false);
-	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null);
+	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null, await regenerate(paths, identity, commonName, validDays, false, null));
+}
+/**
+* Uploaded mode keeps a generated CA beside the upload (agents' leaves are still signed
+* by it). When that CA is unconstrained, replace it alone (D873): the served pair is the
+* operator's and is never touched. Returns whether the CA was replaced.
+*/
+async function replaceUnconstrainedLocalCa(dataDir, options) {
+	const tlsDir = join(dataDir, "tls");
+	const paths = {
+		certPath: join(tlsDir, "camstack.crt"),
+		keyPath: join(tlsDir, "camstack.key"),
+		caCertPath: join(tlsDir, "camstack-ca.crt"),
+		caKeyPath: join(tlsDir, "camstack-ca.key")
+	};
+	if (!existsSync(paths.caCertPath) || !existsSync(paths.caKeyPath)) return false;
+	try {
+		if (isConstrainedCa(new X509Certificate$1(readFileSync(paths.caCertPath, "utf-8")))) return false;
+	} catch {
+		return false;
+	}
+	const identity = collectCertIdentity({
+		commonName: options?.commonName ?? DEFAULT_COMMON_NAME,
+		extraSans: options?.extraSans ?? [],
+		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
+	});
+	const ca = await generateCa(/* @__PURE__ */ new Date(), identity.dnsNames);
+	archivePreviousCa(paths, ca);
+	await writeFile(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
+	writeOwnerOnlyFileSync(`${paths.caKeyPath}.new`, ca.keyPem);
+	renameSync(`${paths.caCertPath}.new`, paths.caCertPath);
+	renameSync(`${paths.caKeyPath}.new`, paths.caKeyPath);
+	return true;
 }
 /** True when the material already on disk can still terminate TLS. */
 function canKeepServing(paths) {
@@ -267,12 +303,18 @@ function decideRegeneration(paths, identity) {
 * moves leaves a key/certificate mismatch, which the evaluator reports as
 * `key-mismatch` and heals on the next boot.
 */
-async function regenerate(paths, identity, commonName, validDays, newCa) {
+async function regenerate(paths, rawIdentity, commonName, validDays, newCa, reason) {
 	const now = /* @__PURE__ */ new Date();
-	const ca = newCa ? await generateCa(now) : await loadCa(readFileSync(paths.caCertPath, "utf-8"), readFileSync(paths.caKeyPath, "utf-8"));
+	const ca = newCa ? await generateCa(now, rawIdentity.dnsNames) : await loadCa(readFileSync(paths.caCertPath, "utf-8"), readFileSync(paths.caKeyPath, "utf-8"));
+	const constraints = readNameConstraints(ca.cert);
+	const { identity, dropped } = constraints === null ? {
+		identity: rawIdentity,
+		dropped: []
+	} : permitsIdentity(constraints, rawIdentity);
 	const leaf = await issueLeaf(ca, identity, commonName, validDays, now);
 	const chainPem = `${leaf.certPem.trimEnd()}\n${ca.certPem.trimEnd()}\n`;
 	if (newCa) {
+		if (reason === "ca-unconstrained") archivePreviousCa(paths, ca);
 		await writeFile(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
 		writeOwnerOnlyFileSync(`${paths.caKeyPath}.new`, ca.keyPem);
 		renameSync(`${paths.caCertPath}.new`, paths.caCertPath);
@@ -282,8 +324,56 @@ async function regenerate(paths, identity, commonName, validDays, newCa) {
 	await writeFile(`${paths.certPath}.new`, chainPem, "utf-8");
 	renameSync(`${paths.keyPath}.new`, paths.keyPath);
 	renameSync(`${paths.certPath}.new`, paths.certPath);
+	return dropped;
 }
-function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
+/** The identity as far as the CA on disk may certify it; unchanged while that CA is absent or unconstrained. */
+function constrainToDiskCa(paths, identity) {
+	try {
+		const constraints = readNameConstraints(new X509Certificate$1(readFileSync(paths.caCertPath, "utf-8")));
+		return constraints === null ? {
+			identity,
+			dropped: []
+		} : permitsIdentity(constraints, identity);
+	} catch {
+		return {
+			identity,
+			dropped: []
+		};
+	}
+}
+/**
+* One-time replacement of an UNCONSTRAINED generated CA (D873): keep the old material
+* beside the new one until the new leaf is serving (`retirePreviousLocalCa`), and write the
+* marker the admin UI reads to tell the operator that clients must re-trust the CA.
+*/
+function archivePreviousCa(paths, replacement) {
+	if (!existsSync(paths.caCertPath)) return;
+	const previousCert = `${paths.caCertPath}.previous`;
+	const previousKey = `${paths.caKeyPath}.previous`;
+	copyFileSync(paths.caCertPath, previousCert);
+	if (existsSync(paths.caKeyPath)) copyFileSync(paths.caKeyPath, previousKey);
+	const previousFingerprint = readFingerprint(paths.caCertPath);
+	writeOwnerOnlyFileSync(join(dirname(paths.caCertPath), "ca-replaced.json"), `${JSON.stringify({
+		replacedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		previousFingerprintSha256: previousFingerprint,
+		fingerprintSha256: new X509Certificate(replacement.certPem).fingerprint256
+	})}\n`);
+}
+/** Marker path for the status reader and the retire step. */
+function caReplacementMarkerFile(dataDir) {
+	return join(dataDir, "tls", "ca-replaced.json");
+}
+/**
+* Called once the HTTPS listener serves the leaf of the replacement CA: drop the retired
+* unconstrained CA, key first. Idempotent; returns whether anything was removed.
+*/
+function retirePreviousLocalCa(dataDir) {
+	const base = join(dataDir, "tls", "camstack-ca");
+	const present = [`${base}.key.previous`, `${base}.crt.previous`].filter((file) => existsSync(file));
+	for (const file of present) rmSync(file, { force: true });
+	return present.length > 0;
+}
+function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError, droppedNames) {
 	const leaf = new X509Certificate(readFileSync(paths.certPath));
 	const ca = new X509Certificate(readFileSync(paths.caCertPath));
 	const san = leaf.subjectAltName ?? "";
@@ -297,6 +387,7 @@ function describe(paths, generated, reason, caRotated, previousFingerprintSha256
 		caFingerprintSha256: ca.fingerprint256,
 		validTo: new Date(leaf.validTo).toISOString(),
 		sans: san === "" ? [] : san.split(", "),
+		droppedNames,
 		reissueError
 	};
 }
@@ -312,6 +403,140 @@ function loadTlsCert(certPath, keyPath) {
 	};
 }
 //#endregion
+//#region src/tls/uploaded-cert.ts
+var MESSAGES = {
+	"tls.cert-unparsable": "Certificate PEM could not be parsed.",
+	"tls.key-unparsable": "Private key PEM could not be parsed.",
+	"tls.key-mismatch": "Private key does not match the certificate.",
+	"tls.missing-server-auth": "Certificate is missing extendedKeyUsage = serverAuth.",
+	"tls.ca-required": "This certificate was not issued by a public certificate authority, so its CA certificate is required: devices need it to trust the hub. Paste the CA certificate (for mkcert, the rootCA.pem in the folder `mkcert -CAROOT` prints).",
+	"tls.ca-unparsable": "The CA certificate could not be parsed.",
+	"tls.ca-not-issuer": "The certificate was not issued by the CA certificate you supplied.",
+	"tls.ca-not-a-ca": "The supplied CA certificate is not a certificate authority (CA:TRUE is missing).",
+	"tls.ca-expired": "The supplied CA certificate has expired or is not valid yet."
+};
+function failure(code) {
+	return {
+		ok: false,
+		code,
+		error: MESSAGES[code]
+	};
+}
+/**
+* Operator-supplied material must parse, match its key, and carry
+* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
+* to keep generating.
+*/
+function validateUploadedTls(certPem, keyPem) {
+	let leaf;
+	try {
+		leaf = new X509Certificate(certPem);
+	} catch {
+		return failure("tls.cert-unparsable");
+	}
+	try {
+		if (!leaf.checkPrivateKey(createPrivateKey(keyPem))) return failure("tls.key-mismatch");
+	} catch {
+		return failure("tls.key-unparsable");
+	}
+	const eku = leaf.keyUsage;
+	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return failure("tls.missing-server-auth");
+	return {
+		ok: true,
+		fingerprintSha256: leaf.fingerprint256,
+		validTo: new Date(leaf.validTo).toISOString()
+	};
+}
+/** Every certificate in a PEM bundle, in order. */
+function pemCertificates(pem) {
+	const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
+	return blocks === null ? [] : blocks.map((block) => `${block}\n`);
+}
+function parseAll(pems) {
+	const parsed = [];
+	for (const pem of pems) try {
+		parsed.push(new X509Certificate(pem));
+	} catch {}
+	return parsed;
+}
+function issuedBy(child, issuer) {
+	try {
+		return child.checkIssued(issuer) && child.verify(issuer.publicKey);
+	} catch {
+		return false;
+	}
+}
+var defaultPublicRoots;
+/** The trust anchors of public CAs that ship with Node. */
+function publicRootCertificates() {
+	defaultPublicRoots ??= parseAll(rootCertificates);
+	return defaultPublicRoots;
+}
+/**
+* True when the served chain leads to a public CA that clients already trust:
+* the leaf, or one of the chain's own certificates, is signed by a public root.
+* Such a certificate needs nothing installed on a device, so no CA is required.
+*/
+function chainsToPublicRoot(chainPem, roots = publicRootCertificates()) {
+	const [leaf, ...rest] = parseAll(pemCertificates(chainPem));
+	if (leaf === void 0) return false;
+	let current = leaf;
+	const pool = [...rest];
+	for (let depth = 0; depth < 8; depth += 1) {
+		if (roots.some((root) => issuedBy(current, root))) return true;
+		const next = pool.find((candidate) => candidate !== current && issuedBy(current, candidate));
+		if (next === void 0) return false;
+		pool.splice(pool.indexOf(next), 1);
+		current = next;
+	}
+	return false;
+}
+/** Is `cert` a usable CA at `now`? */
+function caProblem(cert, now) {
+	if (!cert.ca) return "tls.ca-not-a-ca";
+	if (now < new Date(cert.validFrom) || now > new Date(cert.validTo)) return "tls.ca-expired";
+	return null;
+}
+/**
+* The CA rule for an upload (D873). A CA the operator supplies must parse, be a CA, be in
+* date and actually have signed the leaf. Without one, the upload is accepted only when
+* its own chain carries the issuer or leads to a public root; anything else is refused,
+* because a device cannot be told to trust a certificate nobody can hand it the CA of.
+*/
+function checkUploadedCa(chainPem, caPem, options) {
+	const now = options?.now ?? /* @__PURE__ */ new Date();
+	const [leaf, ...chainRest] = parseAll(pemCertificates(chainPem));
+	if (leaf === void 0) return failure("tls.cert-unparsable");
+	if (caPem !== void 0 && caPem.trim() !== "") {
+		const candidates = parseAll(pemCertificates(caPem));
+		if (candidates.length === 0) return failure("tls.ca-unparsable");
+		return pickIssuer(leaf, candidates, now, chainPem, options?.publicRoots);
+	}
+	const fromChain = chainRest.filter((cert) => issuedBy(leaf, cert));
+	if (fromChain.length > 0) return pickIssuer(leaf, fromChain, now, chainPem, options?.publicRoots);
+	if (chainsToPublicRoot(chainPem, options?.publicRoots)) return {
+		ok: true,
+		issuerPem: null,
+		publicChain: true
+	};
+	return failure("tls.ca-required");
+}
+function pickIssuer(leaf, candidates, now, chainPem, publicRoots) {
+	const signers = candidates.filter((candidate) => issuedBy(leaf, candidate));
+	if (signers.length === 0) return failure("tls.ca-not-issuer");
+	let firstProblem = null;
+	for (const signer of signers) {
+		const problem = caProblem(signer, now);
+		if (problem === null) return {
+			ok: true,
+			issuerPem: `${signer.toString().trimEnd()}\n`,
+			publicChain: chainsToPublicRoot(chainPem, publicRoots)
+		};
+		firstProblem ??= problem;
+	}
+	return failure(firstProblem ?? "tls.ca-not-issuer");
+}
+//#endregion
 //#region src/tls/tls-status.ts
 function tlsDir(dataDir) {
 	return join(dataDir, "tls");
@@ -344,6 +569,44 @@ function writeExtraSans(dataDir, sans) {
 	mkdirSync(tlsDir(dataDir), { recursive: true });
 	writeFileSync(join(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}\n`, "utf-8");
 }
+/** The kept copy of the last upload: the chain and key as the operator supplied them. */
+var STORED_UPLOAD_CERT_FILE = "uploaded.crt";
+var STORED_UPLOAD_KEY_FILE = "uploaded.key";
+var CA_REPLACED_MARKER_FILE = "ca-replaced.json";
+function readStoredUpload(dir) {
+	const certPath = join(dir, STORED_UPLOAD_CERT_FILE);
+	if (!existsSync(certPath) || !existsSync(join(dir, "uploaded.key"))) return null;
+	try {
+		const leaf = new X509Certificate(readFileSync(certPath, "utf-8"));
+		return {
+			leafFingerprintSha256: leaf.fingerprint256,
+			validTo: new Date(leaf.validTo).toISOString(),
+			hasCa: existsSync(join(dir, UPLOADED_CA_FILE))
+		};
+	} catch {
+		return null;
+	}
+}
+function readLocalCaConstrained(dir) {
+	const caPath = join(dir, "camstack-ca.crt");
+	if (!existsSync(caPath)) return null;
+	try {
+		return isConstrainedCa(new X509Certificate$1(readFileSync(caPath, "utf-8")));
+	} catch {
+		return null;
+	}
+}
+function readCaReplacedAt(dir) {
+	const path = join(dir, CA_REPLACED_MARKER_FILE);
+	if (!existsSync(path)) return null;
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf-8"));
+		const at = parsed !== null && typeof parsed === "object" ? Reflect.get(parsed, "replacedAt") : null;
+		return typeof at === "string" ? at : null;
+	} catch {
+		return null;
+	}
+}
 /** Where an upload's own CA is kept — never over the local CA's `camstack-ca.crt`. */
 var UPLOADED_CA_FILE = "uploaded-ca.crt";
 /** Every certificate in a PEM bundle, in order. */
@@ -398,7 +661,11 @@ function readTlsAccessStatus(dataDir, servedLeafFingerprint) {
 		sans: [],
 		caCertPem: (mode === "uploaded" ? null : generatedIssuer(dir))?.pem ?? null,
 		reissueError: null,
-		restartRequired: false
+		restartRequired: false,
+		caMissing: false,
+		localCaConstrained: readLocalCaConstrained(dir),
+		caReplacedAt: readCaReplacedAt(dir),
+		storedUpload: readStoredUpload(dir)
 	};
 	try {
 		const chainPem = readFileSync(certPath, "utf-8");
@@ -413,7 +680,11 @@ function readTlsAccessStatus(dataDir, servedLeafFingerprint) {
 			sans: san === "" ? [] : san.split(", "),
 			caCertPem: ca?.pem ?? null,
 			reissueError: null,
-			restartRequired: servedLeafFingerprint !== null && servedLeafFingerprint !== leaf.fingerprint256
+			restartRequired: servedLeafFingerprint !== null && servedLeafFingerprint !== leaf.fingerprint256,
+			caMissing: mode === "uploaded" && ca === null && !chainsToPublicRoot(chainPem),
+			localCaConstrained: readLocalCaConstrained(dir),
+			caReplacedAt: readCaReplacedAt(dir),
+			storedUpload: readStoredUpload(dir)
 		};
 	} catch {
 		return {
@@ -424,7 +695,11 @@ function readTlsAccessStatus(dataDir, servedLeafFingerprint) {
 			sans: [],
 			caCertPem: null,
 			reissueError: "Certificate on disk could not be parsed.",
-			restartRequired: false
+			restartRequired: false,
+			caMissing: false,
+			localCaConstrained: readLocalCaConstrained(dir),
+			caReplacedAt: readCaReplacedAt(dir),
+			storedUpload: readStoredUpload(dir)
 		};
 	}
 }
@@ -446,7 +721,8 @@ async function prepareBootTls(dataDir, options) {
 		mode: "uploaded",
 		pair: loadTlsCert(certPath, keyPath),
 		ensured: void 0,
-		uploadedMissing: false
+		uploadedMissing: false,
+		dormantCaReplaced: await replaceUnconstrainedLocalCa(dataDir, options)
 	};
 	const uploadedMissing = marked === "uploaded";
 	if (uploadedMissing) writeTlsMode(dataDir, "generated");
@@ -455,7 +731,8 @@ async function prepareBootTls(dataDir, options) {
 		mode: "generated",
 		pair: loadTlsCert(ensured.certPath, ensured.keyPath),
 		ensured,
-		uploadedMissing
+		uploadedMissing,
+		dormantCaReplaced: false
 	};
 }
 //#endregion
@@ -533,66 +810,51 @@ function reloadHttpsListener(pair) {
 	}
 }
 //#endregion
-//#region src/tls/uploaded-cert.ts
-/**
-* Operator-supplied material must parse, match its key, and carry
-* `extendedKeyUsage = serverAuth` — the same leaf defects D227 refused
-* to keep generating.
-*/
-function validateUploadedTls(certPem, keyPem) {
-	let leaf;
-	try {
-		leaf = new X509Certificate(certPem);
-	} catch {
-		return {
-			ok: false,
-			error: "Certificate PEM could not be parsed."
-		};
-	}
-	try {
-		if (!leaf.checkPrivateKey(createPrivateKey(keyPem))) return {
-			ok: false,
-			error: "Private key does not match the certificate."
-		};
-	} catch {
-		return {
-			ok: false,
-			error: "Private key PEM could not be parsed."
-		};
-	}
-	const eku = leaf.keyUsage;
-	if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
-		ok: false,
-		error: "Certificate is missing extendedKeyUsage = serverAuth."
-	};
-	return {
-		ok: true,
-		fingerprintSha256: leaf.fingerprint256,
-		validTo: new Date(leaf.validTo).toISOString()
-	};
-}
-//#endregion
 //#region src/tls/tls-actions.ts
 function withNewline(pem) {
 	return pem.endsWith("\n") ? pem : `${pem}\n`;
 }
 /**
-* Store an operator's certificate. The leaf (or chain) and key replace the
-* served pair; a CA, when given, goes to its own file. The local CA
-* (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
-* and it is what "Revert to generated" and every device that trusts it
-* still need.
+* Store an operator's certificate (D873). The material is validated first, and a
+* certificate that does not lead to a public CA must come with the CA that signed it
+* (validated: it is a CA, in date, and issued the leaf) - otherwise "Download CA" would
+* have nothing to hand out. Nothing is written when anything is refused.
+*
+* The leaf (or chain) and key are written twice: as the served pair, and as a kept copy
+* (`uploaded.crt` / `uploaded.key`, with the issuing CA in `uploaded-ca.crt`) that
+* "Revert to generated" leaves in place so the upload can be selected again. The local
+* CA (`camstack-ca.crt` + key) is never touched - it did not sign the upload, and it is
+* what every device that trusts it still needs.
 */
-async function storeUploadedCertificate(dataDir, input) {
+async function storeUploadedCertificate(dataDir, input, options) {
 	const valid = validateUploadedTls(input.certPem, input.keyPem);
-	if (!valid.ok) throw new Error(valid.error);
+	if (!valid.ok) throw userError(valid.code, {}, valid.error);
+	const ca = checkUploadedCa(input.certPem, input.caPem, options);
+	if (!ca.ok) throw userError(ca.code, {}, ca.error);
 	const dir = join(dataDir, "tls");
 	await mkdir(dir, { recursive: true });
-	await writeFile(join(dir, "camstack.crt"), withNewline(input.certPem));
-	writeOwnerOnlyFileSync(join(dir, "camstack.key"), withNewline(input.keyPem));
+	const certText = withNewline(input.certPem);
+	const keyText = withNewline(input.keyPem);
+	writeOwnerOnlyFileSync(join(dir, STORED_UPLOAD_KEY_FILE), keyText);
+	await writeFile(join(dir, STORED_UPLOAD_CERT_FILE), certText);
 	const caPath = join(dir, UPLOADED_CA_FILE);
-	if (input.caPem !== void 0 && input.caPem.trim() !== "") await writeFile(caPath, withNewline(input.caPem));
+	if (ca.issuerPem !== null) await writeFile(caPath, ca.issuerPem);
 	else rmSync(caPath, { force: true });
+	await writeFile(join(dir, "camstack.crt"), certText);
+	writeOwnerOnlyFileSync(join(dir, "camstack.key"), keyText);
+	writeTlsMode(dataDir, "uploaded");
+}
+/**
+* Serve the kept upload again after a revert (D873). Refused with a clear error when none
+* is kept; the generated material stays on disk and is untouched.
+*/
+async function useStoredUploadedCertificate(dataDir) {
+	const dir = join(dataDir, "tls");
+	const certPath = join(dir, STORED_UPLOAD_CERT_FILE);
+	const keyPath = join(dir, STORED_UPLOAD_KEY_FILE);
+	if (!existsSync(certPath) || !existsSync(keyPath)) throw userError("tls.no-stored-upload", {}, "No uploaded certificate is kept on this node.");
+	copyFileSync(certPath, join(dir, "camstack.crt"));
+	copyFileSync(keyPath, join(dir, "camstack.key"));
 	writeTlsMode(dataDir, "uploaded");
 }
 /** Issue a new generated leaf under the local CA. Refused while an upload is served. */
@@ -600,10 +862,20 @@ async function regenerateCertificate(dataDir, options) {
 	if (readTlsMode(dataDir) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
 	await reissueTlsLeaf(dataDir, options);
 }
-/** Drop the upload and serve the generated local-CA leaf again (D227). */
+/**
+* Serve the generated local-CA leaf again (D227). The uploaded certificate and its CA stay
+* on disk (D873) so it can be selected again; an upload made before they were kept is
+* copied aside first, from the pair being served.
+*/
 async function revertToGeneratedCertificate(dataDir, options) {
+	const dir = join(dataDir, "tls");
+	const keptCert = join(dir, STORED_UPLOAD_CERT_FILE);
+	const keptKey = join(dir, STORED_UPLOAD_KEY_FILE);
+	if (readTlsMode(dataDir) === "uploaded" && !existsSync(keptCert) && existsSync(join(dir, "camstack.crt")) && existsSync(join(dir, "camstack.key"))) {
+		copyFileSync(join(dir, "camstack.crt"), keptCert);
+		copyFileSync(join(dir, "camstack.key"), keptKey);
+	}
 	writeTlsMode(dataDir, "generated");
-	rmSync(join(dataDir, "tls", UPLOADED_CA_FILE), { force: true });
 	await ensureTlsCert(dataDir, options);
 }
 /**
@@ -623,7 +895,7 @@ function applyCertificateToListener(dataDir) {
 //#region src/builtins/local-network/hub-mdns-ciao.ts
 function createCiaoPublisher() {
 	return { async publish(announcement) {
-		const { getResponder } = await import("./lib-BeGzVQcd.mjs").then((m) => /* @__PURE__ */ __toESM(m.default));
+		const { getResponder } = await import("./lib-DK38ompL.mjs").then((m) => /* @__PURE__ */ __toESM(m.default));
 		const responder = getResponder();
 		const service = responder.createService({
 			name: announcement.name,
@@ -645,4 +917,4 @@ function createCiaoPublisher() {
 	} };
 }
 //#endregion
-export { DEFAULT_LAN_HTTP_PORT as C, closeLanHttp as D, bindPendingLanHttp as E, readLanHttpState as O, reissueTlsLeaf as S, applyLanHttp as T, splitPemCertificates as _, storeUploadedCertificate as a, ensureTlsCert as b, leafFingerprintOf as c, servedHttpsLeafFingerprint as d, prepareBootTls as f, readTlsMode as g, readTlsAccessStatus as h, revertToGeneratedCertificate as i, registerLanHttpHandler as k, registerHttpsListener as l, readExtraSans as m, applyCertificateToListener as n, validateUploadedTls as o, UPLOADED_CA_FILE as p, regenerateCertificate as r, clearHttpsListener as s, createCiaoPublisher as t, reloadHttpsListener as u, writeExtraSans as v, allFamiliesListenHost as w, loadTlsCert as x, writeTlsMode as y };
+export { allFamiliesListenHost as A, caReplacementMarkerFile as C, replaceUnconstrainedLocalCa as D, reissueTlsLeaf as E, registerLanHttpHandler as F, bindPendingLanHttp as M, closeLanHttp as N, retirePreviousLocalCa as O, readLanHttpState as P, validateUploadedTls as S, loadTlsCert as T, splitPemCertificates as _, storeUploadedCertificate as a, chainsToPublicRoot as b, leafFingerprintOf as c, servedHttpsLeafFingerprint as d, prepareBootTls as f, readTlsMode as g, readTlsAccessStatus as h, revertToGeneratedCertificate as i, applyLanHttp as j, DEFAULT_LAN_HTTP_PORT as k, registerHttpsListener as l, readExtraSans as m, applyCertificateToListener as n, useStoredUploadedCertificate as o, UPLOADED_CA_FILE as p, regenerateCertificate as r, clearHttpsListener as s, createCiaoPublisher as t, reloadHttpsListener as u, writeExtraSans as v, ensureTlsCert as w, checkUploadedCa as x, writeTlsMode as y };