@lamalibre/create-lamaste 4.0.0

package/vendor/serverd/src/lib/csr-signing.js

@@ -0,0 +1,331 @@
+import crypto from 'node:crypto';
+import { access, constants, mkdir, readFile, writeFile, unlink } from 'node:fs/promises';
+import { execa } from 'execa';
+import { randomCertSerial, readCsrCN, signAgentCsr } from './pki-sign.js';
+import {
+  readCertExpiry,
+  loadAgentRegistry,
+  saveAgentRegistry,
+  withRegistryLock,
+  getValidCapabilities,
+} from './mtls.js';
+import { addChiselCredential } from './chisel-users.js';
+
+const PKI_DIR = process.env.LAMALIBRE_LAMASTE_PKI_DIR || '/etc/lamalibre/lamaste/pki';
+const AGENTS_DIR = `${PKI_DIR}/agents`;
+
+/**
+ * Sign an admin CSR with the panel CA for hardware-bound admin upgrade.
+ *
+ * SECURITY (B9): the panel does not issue certificates with `CN=admin`;
+ * `signAgentCsr` refuses any CN that is not an agent label.
+ *
+ * Admin cert issuance now lives only in `lamaste-server reset-admin`, which
+ * runs as root directly (not via sudo) and has its own audit/recovery story.
+ * Hardware-bound admin upgrades must be performed via that root-only flow.
+ *
+ * This stub is preserved so the panel route returns a clear, actionable error
+ * to the operator instead of failing with an opaque sudo error. Callers
+ * receive a 503 with instructions.
+ *
+ * @param {string} _csrPem - PEM-encoded CSR (ignored)
+ * @param {import('pino').Logger} logger
+ * @returns {Promise<never>}
+ */
+export async function signAdminCSR(_csrPem, logger) {
+  logger.warn(
+    'Refused admin CSR signing request — panel-side admin cert issuance is disabled (B9). Use `sudo lamaste-server reset-admin` on the server.',
+  );
+  throw Object.assign(
+    new Error(
+      'Panel-initiated admin cert issuance is disabled for security. ' +
+        'Run `sudo lamaste-server reset-admin` on the server console to issue a new admin certificate.',
+    ),
+    { statusCode: 503 },
+  );
+}
+
+/**
+ * Rotate an agent's certificate via CSR for hardware-bound upgrade.
+ *
+ * Signs a new CSR for an existing agent, revokes the old certificate,
+ * preserves capabilities and allowed sites, and sets enrollmentMethod
+ * to 'hardware-bound'.
+ *
+ * @param {string} csrPem - PEM-encoded CSR
+ * @param {string} label - Agent label (must match an existing non-revoked agent)
+ * @param {import('pino').Logger} logger
+ * @returns {Promise<{ certPem: string, caCertPem: string, serial: string, expiresAt: string, label: string }>}
+ */
+export async function rotateAgentCSR(csrPem, label, logger) {
+  // Defense-in-depth: re-validate label for DN safety
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(label) || label.length > 50) {
+    throw Object.assign(new Error('Invalid agent label'), { statusCode: 400 });
+  }
+
+  if (csrPem.length > 8192) {
+    throw Object.assign(new Error('CSR too large'), { statusCode: 400 });
+  }
+
+  return withRegistryLock(async () => {
+    // Find the existing non-revoked agent entry
+    const registry = await loadAgentRegistry();
+    const existing = registry.agents.find((a) => a.label === label && !a.revoked);
+    if (!existing) {
+      throw Object.assign(new Error(`Agent certificate "${label}" not found`), {
+        statusCode: 404,
+      });
+    }
+
+    // Verify CA key exists
+    try {
+      await access(`${PKI_DIR}/ca.key`, constants.R_OK);
+    } catch {
+      throw Object.assign(new Error('CA key not found — cannot sign certificate'), {
+        statusCode: 500,
+      });
+    }
+
+    const tmpSuffix = crypto.randomBytes(8).toString('hex');
+    const csrPath = `${AGENTS_DIR}/.rotate-csr-${tmpSuffix}.pem`;
+    const certPath = `${AGENTS_DIR}/.rotate-cert-${tmpSuffix}.pem`;
+
+    try {
+      // Write the CSR to a temp file
+      await writeFile(csrPath, csrPem, { mode: 0o600 });
+
+      // Validate CSR structure and signature
+      try {
+        await execa('openssl', ['req', '-verify', '-in', csrPath, '-noout']);
+      } catch {
+        throw Object.assign(new Error('Invalid CSR: structure or signature verification failed'), {
+          statusCode: 400,
+        });
+      }
+
+      // The certificate keeps the CSR's subject, and signAgentCsr checks
+      // only its shape — so verify here that the CSR's CN is exactly
+      // `agent:<label>`. A mismatch indicates either a buggy client or an
+      // attempt to rotate one agent's cert into a different label.
+      const expectedCN = `agent:${label}`;
+      const actualCN = await readCsrCN(csrPath);
+      if (actualCN !== expectedCN) {
+        throw Object.assign(new Error(`CSR CN must be ${expectedCN}, got ${actualCN ?? 'none'}`), {
+          statusCode: 400,
+        });
+      }
+
+      const serial = randomCertSerial();
+      logger.info({ label, serial }, 'Signing rotation CSR');
+      await signAgentCsr(csrPath, certPath, serial, 730);
+
+      // Read expiry
+      const expiry = await readCertExpiry(certPath);
+      const expiresAt = expiry?.expiresAt || new Date(Date.now() + 730 * 86400000).toISOString();
+
+      // Read the signed certificate PEM
+      const certPem = await readFile(certPath, 'utf-8');
+
+      // Read the CA certificate PEM
+      const caCertPem = await readFile(`${PKI_DIR}/ca.crt`, 'utf-8');
+
+      // Revoke the old certificate
+      const { addToRevocationList } = await import('./revocation.js');
+      logger.info(
+        { label, oldSerial: existing.serial },
+        'Revoking old agent certificate for hardware-bound upgrade',
+      );
+      await addToRevocationList(existing.serial, `agent:${label} (upgraded to hardware-bound)`);
+
+      // Update the existing registry entry atomically: new serial, new expiry,
+      // mark as hardware-bound, preserve allowedSites and the *currently
+      // valid* subset of capabilities. Filtering against the live
+      // `getValidCapabilities()` set ensures that capabilities contributed
+      // by a now-uninstalled plugin or a now-deregistered ticket scope are
+      // dropped from the rotated cert, rather than being silently re-issued.
+      const storedCaps = Array.isArray(existing.capabilities) ? existing.capabilities : [];
+      const validCaps = new Set(getValidCapabilities());
+      const liveCaps = storedCaps.filter((c) => validCaps.has(c));
+      const droppedCapabilities = storedCaps.filter((c) => !validCaps.has(c));
+      if (droppedCapabilities.length > 0) {
+        logger.info(
+          { label, droppedCapabilities, reason: 'no_longer_valid' },
+          'Dropping stale agent capabilities during hardware-bound rotation',
+        );
+      }
+      existing.capabilities = liveCaps;
+      existing.serial = serial;
+      existing.expiresAt = expiresAt;
+      existing.enrollmentMethod = 'hardware-bound';
+      existing.revoked = false;
+      await saveAgentRegistry(registry);
+
+      logger.info({ label, serial }, 'Agent certificate rotated for hardware-bound upgrade');
+
+      return { certPem, caCertPem, serial, expiresAt, label };
+    } finally {
+      await unlink(csrPath).catch(() => {});
+      await unlink(certPath).catch(() => {});
+    }
+  });
+}
+
+/**
+ * Sign an externally-generated CSR with the panel CA.
+ *
+ * Validates that the CSR subject matches the expected agent CN format,
+ * signs it with the CA (2-year validity), reads serial and expiry,
+ * and adds the agent to the registry with `enrollmentMethod: 'hardware-bound'`.
+ *
+ * For delegated enrollments, uses the `plugin-agent:<delegatingLabel>:<pluginAgentLabel>`
+ * CN format and stores the registry entry with `enrollmentType: 'delegated'` and
+ * `delegatedBy` field.
+ *
+ * @param {string} csrPem - PEM-encoded CSR
+ * @param {string} label - Agent label (must match CSR subject)
+ * @param {string[]} capabilities - Capability list
+ * @param {string[]} allowedSites - Allowed site labels
+ * @param {import('pino').Logger} logger
+ * @param {{ type?: 'delegated', delegatedBy?: string }} [opts] - Optional enrollment metadata
+ * @returns {Promise<{ certPem: string, caCertPem: string, serial: string, expiresAt: string, label: string }>}
+ */
+export async function signCSR(csrPem, label, capabilities, allowedSites, logger, opts) {
+  const isDelegated = opts?.type === 'delegated';
+
+  // Defense-in-depth: re-validate label for DN safety even though routes validate via Zod.
+  // For delegated enrollments, the label is "plugin-agent:<delegating>:<plugin>" — validate each segment.
+  if (isDelegated) {
+    const match = label.match(/^plugin-agent:([a-z0-9][a-z0-9-]*):([a-z0-9][a-z0-9-]*)$/);
+    if (!match || label.length > 150) {
+      throw Object.assign(new Error('Invalid plugin-agent label'), { statusCode: 400 });
+    }
+  } else if (!/^[a-z0-9][a-z0-9-]*$/.test(label) || label.length > 50) {
+    throw Object.assign(new Error('Invalid agent label'), { statusCode: 400 });
+  }
+
+  // Reject oversized CSRs (a 4096-bit RSA CSR is ~1600 bytes PEM)
+  if (csrPem.length > 8192) {
+    throw Object.assign(new Error('CSR too large'), { statusCode: 400 });
+  }
+
+  return withRegistryLock(async () => {
+    // Check registry for duplicate (non-revoked) label
+    const registry = await loadAgentRegistry();
+    const existing = registry.agents.find((a) => a.label === label && !a.revoked);
+    if (existing) {
+      throw Object.assign(new Error(`Agent certificate with label "${label}" already exists`), {
+        statusCode: 409,
+      });
+    }
+
+    // Verify CA key exists
+    try {
+      await access(`${PKI_DIR}/ca.key`, constants.R_OK);
+    } catch {
+      throw Object.assign(new Error('CA key not found — cannot sign certificate'), {
+        statusCode: 500,
+      });
+    }
+
+    const tmpSuffix = crypto.randomBytes(8).toString('hex');
+    const csrPath = `${AGENTS_DIR}/.enroll-csr-${tmpSuffix}.pem`;
+    const certPath = `${AGENTS_DIR}/.enroll-cert-${tmpSuffix}.pem`;
+
+    try {
+      // Ensure agents directory exists
+      await mkdir(AGENTS_DIR, { recursive: true, mode: 0o700 });
+
+      // Write the CSR to a temp file
+      await writeFile(csrPath, csrPem, { mode: 0o600 });
+
+      // Validate CSR structure and signature before signing
+      try {
+        await execa('openssl', ['req', '-verify', '-in', csrPath, '-noout']);
+      } catch {
+        throw Object.assign(new Error('Invalid CSR: structure or signature verification failed'), {
+          statusCode: 400,
+        });
+      }
+
+      // The certificate keeps the CSR's subject, and signAgentCsr checks
+      // only its shape (and rejects CN=admin). Verify here that the CSR's
+      // CN matches exactly what the enrollment token says.
+      //
+      // Delegated tokens carry a `plugin-agent:<delegating>:<plugin>` label;
+      // regular tokens carry the bare label and the panel signs as
+      // `agent:<label>`. The agent CLI (B9-aware) builds its CSR to match —
+      // older agents that send `/CN=agent:pending` will be rejected here
+      // with a clear error, prompting an upgrade.
+      const expectedCN = isDelegated ? label : `agent:${label}`;
+      const actualCN = await readCsrCN(csrPath);
+      if (actualCN !== expectedCN) {
+        throw Object.assign(
+          new Error(
+            `CSR CN must be "${expectedCN}", got "${actualCN ?? 'none'}". ` +
+              'If you are upgrading from an older agent, use the new client that ' +
+              'looks up the enrollment label before generating the CSR.',
+          ),
+          { statusCode: 400 },
+        );
+      }
+
+      const serial = randomCertSerial();
+      logger.info({ label, isDelegated, serial }, 'Signing enrollment CSR');
+      await signAgentCsr(csrPath, certPath, serial, 730);
+
+      // Read expiry
+      const expiry = await readCertExpiry(certPath);
+      const expiresAt = expiry?.expiresAt || new Date(Date.now() + 730 * 86400000).toISOString();
+
+      // Read the signed certificate PEM
+      const certPem = await readFile(certPath, 'utf-8');
+
+      // Read the CA certificate PEM
+      const caCertPem = await readFile(`${PKI_DIR}/ca.crt`, 'utf-8');
+
+      // Add to registry. For delegated enrollments, store the delegation metadata.
+      // We reuse the registry loaded at the top of withRegistryLock — the mutex
+      // guarantees no concurrent modifications.
+      const registryEntry = {
+        label,
+        serial,
+        capabilities: isDelegated ? capabilities || [] : capabilities || ['tunnels:read'],
+        allowedSites: isDelegated ? [] : allowedSites || [],
+        enrollmentMethod: isDelegated ? 'delegated' : 'hardware-bound',
+        createdAt: new Date().toISOString(),
+        expiresAt,
+        revoked: false,
+      };
+      if (isDelegated && opts?.delegatedBy) {
+        registryEntry.delegatedBy = opts.delegatedBy;
+      }
+      registry.agents.push(registryEntry);
+      await saveAgentRegistry(registry);
+
+      logger.info({ label, serial, isDelegated }, 'Enrollment CSR signed and agent registered');
+
+      // Mint a chisel tunnel-server credential for non-delegated agents.
+      // Plugin-agents (delegated) participate only in tickets and never open
+      // chisel tunnels, so they are skipped. Failure to mint is non-fatal —
+      // the agent can re-fetch via `lamaste-agent chisel refresh-credential`
+      // once the underlying issue is resolved.
+      if (!isDelegated) {
+        try {
+          await addChiselCredential(label, logger);
+        } catch (chErr) {
+          logger.warn(
+            { err: chErr, label },
+            'Failed to mint chisel credential during enrollment — agent must run `lamaste-agent chisel refresh-credential` once the panel-side issue is resolved',
+          );
+        }
+      }
+
+      return { certPem, caCertPem, serial, expiresAt, label };
+    } finally {
+      // Clean up temp files. The wrapper uses -set_serial, so there is no
+      // ca.srl to clean up.
+      await unlink(csrPath).catch(() => {});
+      await unlink(certPath).catch(() => {});
+    }
+  });
+}

package/vendor/serverd/src/lib/enrollment.js

@@ -0,0 +1,302 @@
+import crypto from 'node:crypto';
+import { loadAgentRegistry, PLUGIN_AGENT_CN_PREFIX, BASE_CAPABILITIES } from './mtls.js';
+import { isRegisteredTicketScope } from './tickets.js';
+import { getStateDb } from './state-db.js';
+
+const TOKEN_EXPIRY_MS = 10 * 60 * 1000;
+const CLEANUP_THRESHOLD_MS = 60 * 60 * 1000;
+
+// Promise-chain mutex. Each operation is a single SQLite transaction so
+// BEGIN IMMEDIATE already serialises writers — this lock is defensive
+// belt-and-braces around the read-modify-write helpers below. Removable
+// once each operation is collapsed into one transaction.
+let tokenLock = Promise.resolve();
+function withTokenLock(fn) {
+  const prev = tokenLock;
+  let resolve;
+  tokenLock = new Promise((r) => {
+    resolve = r;
+  });
+  return prev.then(fn).finally(resolve);
+}
+
+const COMPARE_KEY = crypto.randomBytes(32);
+
+function safeTokenCompare(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') return false;
+  const ha = crypto.createHmac('sha256', COMPARE_KEY).update(a).digest();
+  const hb = crypto.createHmac('sha256', COMPARE_KEY).update(b).digest();
+  return crypto.timingSafeEqual(ha, hb);
+}
+
+let stmts = null;
+
+async function getStmts() {
+  if (stmts) return stmts;
+
+  const db = await getStateDb();
+
+  stmts = {
+    selectActive: db.prepare(`
+      SELECT * FROM enrollment_tokens
+      WHERE used = 0 AND expires_at > ?
+    `),
+    insert: db.prepare(`
+      INSERT INTO enrollment_tokens
+        (token, label, capabilities, allowed_sites, type, delegated_by, scope, created_at, expires_at, used)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0)
+    `),
+    markUsed: db.prepare(`
+      UPDATE enrollment_tokens SET used = 1, used_at = ? WHERE id = ?
+    `),
+    deleteActiveByLabel: db.prepare(`
+      DELETE FROM enrollment_tokens
+      WHERE label = ? AND used = 0 AND expires_at > ?
+    `),
+    deleteStale: db.prepare(`
+      DELETE FROM enrollment_tokens WHERE created_at < ?
+    `),
+    begin: db.prepare('BEGIN IMMEDIATE'),
+    commit: db.prepare('COMMIT'),
+    rollback: db.prepare('ROLLBACK'),
+  };
+
+  return stmts;
+}
+
+function rowToEntry(row) {
+  return {
+    id: row.id,
+    token: row.token,
+    label: row.label,
+    capabilities: JSON.parse(row.capabilities),
+    allowedSites: JSON.parse(row.allowed_sites),
+    type: row.type ?? undefined,
+    delegatedBy: row.delegated_by ?? undefined,
+    scope: row.scope ?? undefined,
+    createdAt: row.created_at,
+    expiresAt: row.expires_at,
+    used: row.used === 1,
+    usedAt: row.used_at ?? undefined,
+  };
+}
+
+function purgeStale() {
+  const cutoff = new Date(Date.now() - CLEANUP_THRESHOLD_MS).toISOString();
+  stmts.deleteStale.run(cutoff);
+}
+
+export async function createEnrollmentToken(label, capabilities, allowedSites, logger) {
+  return withTokenLock(async () => {
+    const registry = await loadAgentRegistry();
+    const existing = registry.agents.find((a) => a.label === label && !a.revoked);
+    if (existing) {
+      throw Object.assign(new Error(`Agent certificate with label "${label}" already exists`), {
+        statusCode: 409,
+      });
+    }
+
+    await getStmts();
+    purgeStale();
+
+    const token = crypto.randomBytes(32).toString('hex');
+    const createdAt = new Date().toISOString();
+    const expiresAt = new Date(Date.now() + TOKEN_EXPIRY_MS).toISOString();
+
+    stmts.begin.run();
+    try {
+      // Replace any active (unused, unexpired) token for the same label so a
+      // retried installation does not 409 on the create-token side.
+      stmts.deleteActiveByLabel.run(label, new Date().toISOString());
+      stmts.insert.run(
+        token,
+        label,
+        JSON.stringify(capabilities),
+        JSON.stringify(allowedSites),
+        null,
+        null,
+        null,
+        createdAt,
+        expiresAt,
+      );
+      stmts.commit.run();
+    } catch (err) {
+      stmts.rollback.run();
+      throw err;
+    }
+
+    logger.info({ label, expiresAt }, 'Created enrollment token');
+    return { token, label, expiresAt };
+  });
+}
+
+export async function validateAndConsumeToken(token) {
+  return withTokenLock(async () => {
+    await getStmts();
+    purgeStale();
+
+    // Linear scan over active tokens with timing-safe HMAC compare. SQLite
+    // gives us O(log N) on indexed columns, but the timing-safe comparison
+    // is the security-relevant part — an indexed lookup would leak which
+    // candidate token was found via differential timing. Keep the scan.
+    const rows = stmts.selectActive.all(new Date().toISOString());
+    const entryRow = rows.find((r) => safeTokenCompare(r.token, token));
+
+    if (!entryRow) {
+      throw Object.assign(new Error('Invalid enrollment token'), { statusCode: 401 });
+    }
+    const entry = rowToEntry(entryRow);
+
+    if (entry.used) {
+      throw Object.assign(new Error('Enrollment token has already been used'), { statusCode: 401 });
+    }
+    if (new Date(entry.expiresAt).getTime() < Date.now()) {
+      throw Object.assign(new Error('Enrollment token has expired'), { statusCode: 401 });
+    }
+
+    // For delegated tokens, re-check that the delegating agent is still valid.
+    // The agent may have been revoked between token creation and consumption.
+    if (entry.type === 'delegated' && entry.delegatedBy) {
+      const registry = await loadAgentRegistry();
+      const delegator = registry.agents.find((a) => a.label === entry.delegatedBy && !a.revoked);
+      if (!delegator) {
+        throw Object.assign(new Error('Invalid enrollment token'), { statusCode: 401 });
+      }
+    }
+
+    stmts.markUsed.run(new Date().toISOString(), entry.id);
+
+    /** @type {{ label: string, capabilities: string[], allowedSites: string[], type?: string, delegatedBy?: string, scope?: string }} */
+    const result = {
+      label: entry.label,
+      capabilities: entry.capabilities,
+      allowedSites: entry.allowedSites,
+    };
+    if (entry.type) result.type = entry.type;
+    if (entry.delegatedBy) result.delegatedBy = entry.delegatedBy;
+    if (entry.scope) result.scope = entry.scope;
+    return result;
+  });
+}
+
+export async function createDelegatedEnrollmentToken(
+  delegatingLabel,
+  scope,
+  pluginAgentLabel,
+  logger,
+) {
+  // Validate that the scope is a registered ticket scope, not a base capability.
+  // Base capabilities (tunnels:read, services:write, etc.) must never be
+  // delegated through enrollment — they are admin-assigned per-agent. These
+  // checks run outside the token lock because scope validation is independent
+  // of token operations and avoids nesting the ticket lock inside the token
+  // lock.
+  if (BASE_CAPABILITIES.includes(scope)) {
+    throw Object.assign(new Error('Scope conflicts with a base capability'), {
+      statusCode: 400,
+    });
+  }
+
+  const isTicketScope = await isRegisteredTicketScope(scope);
+  if (!isTicketScope) {
+    throw Object.assign(new Error(`Scope "${scope}" is not a registered ticket scope`), {
+      statusCode: 400,
+    });
+  }
+
+  return withTokenLock(async () => {
+    const registry = await loadAgentRegistry();
+    const delegatingAgent = registry.agents.find((a) => a.label === delegatingLabel && !a.revoked);
+    if (!delegatingAgent) {
+      throw Object.assign(new Error(`Delegating agent "${delegatingLabel}" not found or revoked`), {
+        statusCode: 404,
+      });
+    }
+
+    const fullLabel = `${PLUGIN_AGENT_CN_PREFIX}${delegatingLabel}:${pluginAgentLabel}`;
+
+    const existing = registry.agents.find((a) => a.label === fullLabel && !a.revoked);
+    if (existing) {
+      throw Object.assign(
+        new Error(
+          `Plugin agent certificate with label "${pluginAgentLabel}" for delegator "${delegatingLabel}" already exists`,
+        ),
+        { statusCode: 409 },
+      );
+    }
+
+    await getStmts();
+    purgeStale();
+
+    const token = crypto.randomBytes(32).toString('hex');
+    const createdAt = new Date().toISOString();
+    const expiresAt = new Date(Date.now() + TOKEN_EXPIRY_MS).toISOString();
+
+    stmts.begin.run();
+    try {
+      stmts.deleteActiveByLabel.run(fullLabel, new Date().toISOString());
+      stmts.insert.run(
+        token,
+        fullLabel,
+        JSON.stringify([scope]),
+        JSON.stringify([]),
+        'delegated',
+        delegatingLabel,
+        scope,
+        createdAt,
+        expiresAt,
+      );
+      stmts.commit.run();
+    } catch (err) {
+      stmts.rollback.run();
+      throw err;
+    }
+
+    logger.info(
+      { delegatingLabel, pluginAgentLabel, scope, expiresAt },
+      'Created delegated enrollment token',
+    );
+    return { token, pluginAgentLabel, expiresAt };
+  });
+}
+
+export async function lookupToken(token) {
+  return withTokenLock(async () => {
+    await getStmts();
+    purgeStale();
+
+    const rows = stmts.selectActive.all(new Date().toISOString());
+    const entryRow = rows.find((r) => safeTokenCompare(r.token, token));
+
+    if (!entryRow) {
+      throw Object.assign(new Error('Invalid enrollment token'), { statusCode: 401 });
+    }
+    const entry = rowToEntry(entryRow);
+
+    if (entry.used) {
+      throw Object.assign(new Error('Enrollment token has already been used'), { statusCode: 401 });
+    }
+    if (new Date(entry.expiresAt).getTime() < Date.now()) {
+      throw Object.assign(new Error('Enrollment token has expired'), { statusCode: 401 });
+    }
+
+    /** @type {{ label: string, type?: string }} */
+    const result = { label: entry.label };
+    if (entry.type) result.type = entry.type;
+    return result;
+  });
+}
+
+export async function revokeEnrollmentToken(label, logger) {
+  return withTokenLock(async () => {
+    await getStmts();
+    purgeStale();
+
+    const result = stmts.deleteActiveByLabel.run(label, new Date().toISOString());
+    const revoked = result.changes > 0;
+    if (revoked) {
+      logger.info({ label }, 'Revoked unused enrollment token');
+    }
+    return { revoked };
+  });
+}

package/vendor/serverd/src/lib/files.js

@@ -0,0 +1,19 @@
+/**
+ * Re-exports the static site filesystem helpers from
+ * `@lamalibre/lamaste/server`. They need no privileges: the web root belongs
+ * to the lamaste user (group www-data, for nginx).
+ */
+
+export {
+  SITES_ROOT,
+  ALLOWED_EXTENSIONS,
+  validateFileExtension,
+  validatePath,
+  getSiteRoot,
+  createSiteDirectory,
+  removeSiteDirectory,
+  listFiles,
+  saveUploadedFile,
+  deleteFile,
+  getSiteSize,
+} from '@lamalibre/lamaste/server';