camstack 1.2.37 → 1.2.38

package/dist/{chunk-OR2CMMOE.js → chunk-UYHYTS5M.js}

@@ -14522,7 +14522,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-zMxKWD0M.mjs
+// ../types/dist/sleep-B8EIZt4h.mjs
 var WELL_KNOWN_TABS = [
   {
     id: "overview",

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runDiscover
-} from "./chunk-OR2CMMOE.js";
+} from "./chunk-UYHYTS5M.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/cli.ts
@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-6VDFMPM6.js");
+  await import("./launcher-SCKDFMNR.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-6VDFMPM6.js");
+  await import("./launcher-SCKDFMNR.js");
 }
 
 // src/commands/setup.ts
@@ -1130,7 +1130,7 @@ function isUnknown(_value) {
   return true;
 }
 async function resolveServerInteractive(presetNamespace) {
-  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-Y3C7HOBU.js");
+  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-5NNX7OG3.js");
   if (presetNamespace) {
     const spinner4 = clack.spinner();
     spinner4.start(`Discovering hub on LAN (namespace "${presetNamespace}")`);

package/dist/{discover-Y3C7HOBU.js → discover-5NNX7OG3.js}

@@ -5,7 +5,7 @@ import {
   filterHubNodes,
   resolveHubFromDiscovered,
   runDiscover
-} from "./chunk-OR2CMMOE.js";
+} from "./chunk-UYHYTS5M.js";
 import "./chunk-LMMQX4CK.js";
 export {
   DEFAULT_HUB_HTTPS_PORT,

package/dist/{launcher-6VDFMPM6.js → launcher-SCKDFMNR.js}

@@ -23631,9 +23631,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-C1Aea3c6.js
-var require_dist_C1Aea3c6 = __commonJS({
-  "../system/dist/dist-C1Aea3c6.js"(exports) {
+// ../system/dist/dist-iAwSA2_f.js
+var require_dist_iAwSA2_f = __commonJS({
+  "../system/dist/dist-iAwSA2_f.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -23641,6 +23641,7 @@ var require_dist_C1Aea3c6 = __commonJS({
       EventCategory2["SystemAddonsReady"] = "system.addons-ready";
       EventCategory2["SystemRestarting"] = "system.restarting";
       EventCategory2["SystemRestartCompleted"] = "system.restart-completed";
+      EventCategory2["SystemTlsCertChanged"] = "system.tls-cert-changed";
       EventCategory2["UpdateAvailable"] = "update.available";
       EventCategory2["SystemReadyState"] = "system.ready-state";
       EventCategory2["AddonStarted"] = "addon.started";
@@ -56255,7 +56256,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -56307,6 +56308,10 @@ var require_alerts_addon = __commonJS({
         severity: "warning",
         titleTemplate: "System restarting"
       },
+      "system.tls-cert-changed": {
+        severity: "warning",
+        titleTemplate: "TLS certificate changed"
+      },
       "device.registered": {
         severity: "info",
         titleTemplate: "Device registered"
@@ -56795,6 +56800,8 @@ var require_alerts_addon = __commonJS({
             return `Storage critical for device "${deviceId ?? "unknown"}"`;
           case "system.boot":
             return `System booted in "${data.mode ?? "unknown"}" mode`;
+          case "system.tls-cert-changed":
+            return data.caRotated === true ? `TLS certificate reissued (${String(data.reason)}) \u2014 the local CA also changed. Re-install ${String(data.caCertPath)} on any device that trusted the old one.` : `TLS certificate reissued (${String(data.reason)}) \u2014 the local CA is unchanged, previously trusted devices keep working.`;
           case "process.crashed":
             return `Process "${processId ?? "unknown"}" crashed`;
           default:
@@ -57068,7 +57075,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -57162,7 +57169,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -58059,11 +58066,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-B52KsNz8.js
-var require_retired_settings_keys_B52KsNz8 = __commonJS({
-  "../system/dist/retired-settings-keys-B52KsNz8.js"(exports) {
+// ../system/dist/retired-settings-keys-OfhqQio4.js
+var require_retired_settings_keys_OfhqQio4 = __commonJS({
+  "../system/dist/retired-settings-keys-OfhqQio4.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -60106,8 +60113,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
-    var require_retired_settings_keys = require_retired_settings_keys_B52KsNz8();
+    var require_dist10 = require_dist_iAwSA2_f();
+    var require_retired_settings_keys = require_retired_settings_keys_OfhqQio4();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -64434,7 +64441,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -64571,7 +64578,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -64761,7 +64768,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -72445,7 +72452,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -73010,7 +73017,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     var node_child_process = __require("child_process");
     var node_util = __require("util");
     var node_os = __require("os");
@@ -73952,7 +73959,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -75068,8 +75075,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
-    var require_retired_settings_keys = require_retired_settings_keys_B52KsNz8();
+    var require_dist10 = require_dist_iAwSA2_f();
+    var require_retired_settings_keys = require_retired_settings_keys_OfhqQio4();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -76613,7 +76620,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -78492,7 +78499,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -96553,7 +96560,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -97541,15 +97548,16 @@ var require_file_data_plane_DUHPHa_Y = __commonJS({
   }
 });
 
-// ../types/dist/event-category-CRPORAAz.js
-var require_event_category_CRPORAAz = __commonJS({
-  "../types/dist/event-category-CRPORAAz.js"(exports) {
+// ../types/dist/event-category-EY0GNjV9.js
+var require_event_category_EY0GNjV9 = __commonJS({
+  "../types/dist/event-category-EY0GNjV9.js"(exports) {
     "use strict";
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
       EventCategory2["SystemBoot"] = "system.boot";
       EventCategory2["SystemAddonsReady"] = "system.addons-ready";
       EventCategory2["SystemRestarting"] = "system.restarting";
       EventCategory2["SystemRestartCompleted"] = "system.restart-completed";
+      EventCategory2["SystemTlsCertChanged"] = "system.tls-cert-changed";
       EventCategory2["UpdateAvailable"] = "update.available";
       EventCategory2["SystemReadyState"] = "system.ready-state";
       EventCategory2["AddonStarted"] = "addon.started";
@@ -97707,11 +97715,11 @@ var require_event_category_CRPORAAz = __commonJS({
   }
 });
 
-// ../types/dist/sleep-CMRLJj2e.js
-var require_sleep_CMRLJj2e = __commonJS({
-  "../types/dist/sleep-CMRLJj2e.js"(exports) {
+// ../types/dist/sleep-C2XhJhkd.js
+var require_sleep_C2XhJhkd = __commonJS({
+  "../types/dist/sleep-C2XhJhkd.js"(exports) {
     "use strict";
-    var require_event_category = require_event_category_CRPORAAz();
+    var require_event_category = require_event_category_EY0GNjV9();
     var zod = require_zod();
     var WELL_KNOWN_TABS = [
       {
@@ -101148,8 +101156,8 @@ var require_addon = __commonJS({
   "../types/dist/addon.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_CRPORAAz();
-    var require_sleep = require_sleep_CMRLJj2e();
+    var require_event_category = require_event_category_EY0GNjV9();
+    var require_sleep = require_sleep_C2XhJhkd();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -108023,9 +108031,9 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-MA_BZGBz.js
-var require_manifest_python_deps_MA_BZGBz = __commonJS({
-  "../system/dist/manifest-python-deps-MA_BZGBz.js"(exports) {
+// ../system/dist/manifest-python-deps-CwBbX4Ut.js
+var require_manifest_python_deps_CwBbX4Ut = __commonJS({
+  "../system/dist/manifest-python-deps-CwBbX4Ut.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
     var node_crypto = __require("crypto");
@@ -108046,8 +108054,8 @@ var require_manifest_python_deps_MA_BZGBz = __commonJS({
     var node_vm = __require("vm");
     node_vm = require_chunk.__toESM(node_vm);
     var _camstack_types_addon = require_addon();
-    var _trpc_client = require_dist2();
     var node_net = __require("net");
+    var _trpc_client = require_dist2();
     var HEAP_WATCH_INTERVAL_MS = 6e4;
     var HEAP_WATCH_WARN_RATIO = 0.8;
     var HEAP_WATCH_ESCALATE_RATIO = 0.7;
@@ -118829,7 +118837,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C1Aea3c6();
+    var require_dist10 = require_dist_iAwSA2_f();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -118854,7 +118862,7 @@ var require_dist3 = __commonJS({
     require_system_config();
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DUHPHa_Y();
-    var require_manifest_python_deps = require_manifest_python_deps_MA_BZGBz();
+    var require_manifest_python_deps = require_manifest_python_deps_CwBbX4Ut();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -118875,6 +118883,7 @@ var require_dist3 = __commonJS({
     var node_vm = __require("vm");
     node_vm = require_chunk.__toESM(node_vm);
     var _camstack_types_addon = require_addon();
+    var node_net = __require("net");
     var node_url = __require("url");
     var node_events = __require("events");
     var node_stream = __require("stream");
@@ -120639,63 +120648,330 @@ var require_dist3 = __commonJS({
         };
       }
     };
-    var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
-    async function ensureTlsCert(dataDir, options) {
-      const tlsDir = (0, node_path.join)(dataDir, "tls");
-      const certPath = (0, node_path.join)(tlsDir, "camstack.crt");
-      const keyPath = (0, node_path.join)(tlsDir, "camstack.key");
-      if ((0, node_fs.existsSync)(certPath) && (0, node_fs.existsSync)(keyPath)) try {
-        const x509 = new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath));
-        if (new Date(x509.validTo) > /* @__PURE__ */ new Date()) return {
-          certPath,
-          keyPath,
-          generated: false
-        };
+    var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+    var MAX_LEAF_VALIDITY_DAYS = 397;
+    var LEAF_RENEWAL_WINDOW_DAYS = 30;
+    var CA_VALIDITY_DAYS = 3650;
+    var MS_PER_DAY = 864e5;
+    var REASONS_REQUIRING_NEW_CA = [
+      "missing",
+      "unreadable",
+      "no-local-ca",
+      "ca-expiring"
+    ];
+    function reasonRequiresNewCa(reason) {
+      return REASONS_REQUIRING_NEW_CA.includes(reason);
+    }
+    function parse$1(pem) {
+      try {
+        return new node_crypto.X509Certificate(pem);
+      } catch {
+        return null;
+      }
+    }
+    function daysBetween(from, to) {
+      return (to.getTime() - from.getTime()) / MS_PER_DAY;
+    }
+    function hasServerAuthEku(leaf) {
+      const eku = leaf.keyUsage;
+      return eku !== void 0 && eku.length === 1 && eku[0] === "1.3.6.1.5.5.7.3.1";
+    }
+    function keyMatches(leaf, keyPem) {
+      try {
+        return leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem));
       } catch {
+        return false;
       }
-      (0, node_fs.mkdirSync)(tlsDir, { recursive: true });
-      const cn = options?.commonName ?? "camstack.local";
-      const validDays = options?.validDays ?? 825;
-      const sanDns = /* @__PURE__ */ new Set([
+    }
+    function coversIdentity(leaf, identity) {
+      for (const name2 of identity.requiredDnsNames) if (leaf.checkHost(name2) === void 0) return false;
+      for (const ip of identity.requiredIpAddresses) if (leaf.checkIP(ip) === void 0) return false;
+      return true;
+    }
+    function evaluateExistingCert(input) {
+      const leaf = parse$1(input.chainPem);
+      const ca = parse$1(input.caPem);
+      if (leaf === null || ca === null) return "unreadable";
+      if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
+      if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
+      if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
+      if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
+      if (leaf.ca || !leaf.checkIssued(ca) || !leaf.verify(ca.publicKey)) return "not-issued-by-local-ca";
+      if (daysBetween(new Date(leaf.validFrom), new Date(leaf.validTo)) > 398) return "validity-too-long";
+      if (!coversIdentity(leaf, input.identity)) return "san-coverage-gap";
+      return null;
+    }
+    var VOLATILE_INTERFACE_PREFIXES = [
+      "docker",
+      "br-",
+      "veth",
+      "virbr",
+      "cni",
+      "flannel",
+      "tun",
+      "utun",
+      "tap",
+      "wg",
+      "zt",
+      "tailscale",
+      "ppp",
+      "awdl",
+      "llw"
+    ];
+    var DNS_NAME_PATTERN = /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+    function isIpv4(value) {
+      return (0, node_net.isIP)(value) === 4;
+    }
+    function isIpv6(value) {
+      return (0, node_net.isIP)(value) === 6;
+    }
+    function isLinkLocal(value) {
+      if (isIpv4(value)) return value.startsWith("169.254.");
+      if (!isIpv6(value)) return false;
+      const firstGroup = value.split(":")[0] ?? "";
+      if (firstGroup === "") return false;
+      const parsed = Number.parseInt(firstGroup, 16);
+      return Number.isFinite(parsed) && (parsed & 65472) === 65152;
+    }
+    function isUniqueLocalIpv6(value) {
+      if (!isIpv6(value)) return false;
+      const firstGroup = value.split(":")[0] ?? "";
+      const parsed = Number.parseInt(firstGroup, 16);
+      return Number.isFinite(parsed) && (parsed & 65024) === 64512;
+    }
+    function isVolatileInterface(name2) {
+      const lower = name2.toLowerCase();
+      return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
+    }
+    function isStableGateAddress(address) {
+      if (isLinkLocal(address)) return false;
+      if (isIpv4(address)) return true;
+      return isUniqueLocalIpv6(address);
+    }
+    function addSan(dns, ips, value) {
+      const trimmed = value.trim();
+      if (trimmed === "") return;
+      if ((0, node_net.isIP)(trimmed) !== 0) {
+        if (!isLinkLocal(trimmed)) ips.add(trimmed);
+        return;
+      }
+      if (DNS_NAME_PATTERN.test(trimmed)) dns.add(trimmed);
+    }
+    function collectCertIdentity(options) {
+      const dnsNames = /* @__PURE__ */ new Set();
+      const ipAddresses = /* @__PURE__ */ new Set(["127.0.0.1", "::1"]);
+      const requiredDnsNames = /* @__PURE__ */ new Set();
+      const requiredIpAddresses = /* @__PURE__ */ new Set(["127.0.0.1"]);
+      for (const name2 of [
         "localhost",
-        cn,
+        options.commonName,
         node_os.hostname()
-      ]);
-      const sanIps = /* @__PURE__ */ new Set(["127.0.0.1", "::1"]);
-      const interfaces = node_os.networkInterfaces();
-      for (const addrs of Object.values(interfaces)) {
-        if (!addrs) continue;
-        for (const addr of addrs) if (!addr.internal) sanIps.add(addr.address);
-      }
-      for (const san of options?.extraSans ?? []) if (san.match(/^\d+\.\d+\.\d+\.\d+$/) || san.includes(":")) sanIps.add(san);
-      else sanDns.add(san);
-      const sanParts = [];
-      for (const dns of sanDns) sanParts.push(`DNS:${dns}`);
-      for (const ip of sanIps) sanParts.push(`IP:${ip}`);
-      const sanString = sanParts.join(",");
+      ]) {
+        addSan(dnsNames, ipAddresses, name2);
+        addSan(requiredDnsNames, requiredIpAddresses, name2);
+      }
+      for (const [ifaceName, addrs] of Object.entries(node_os.networkInterfaces())) for (const addr of addrs ?? []) {
+        if (addr.internal) continue;
+        if (isLinkLocal(addr.address)) continue;
+        ipAddresses.add(addr.address);
+        if (isVolatileInterface(ifaceName)) continue;
+        if (isStableGateAddress(addr.address)) requiredIpAddresses.add(addr.address);
+      }
+      for (const san of options.extraSans) {
+        addSan(dnsNames, ipAddresses, san);
+        addSan(requiredDnsNames, requiredIpAddresses, san);
+      }
+      return {
+        dnsNames: [...dnsNames],
+        ipAddresses: [...ipAddresses],
+        requiredDnsNames: [...requiredDnsNames],
+        requiredIpAddresses: [...requiredIpAddresses]
+      };
+    }
+    var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
+    var CA_COMMON_NAME = "CamStack Local CA";
+    function sanValue(identity) {
+      const parts = [];
+      for (const dns of identity.dnsNames) parts.push(`DNS:${dns}`);
+      for (const ip of identity.ipAddresses) if ((0, node_net.isIP)(ip) !== 0) parts.push(`IP:${ip}`);
+      return parts.join(",");
+    }
+    async function generateCa(tmpDir) {
+      const caCertPath = (0, node_path.join)(tmpDir, "ca.crt");
+      const caKeyPath = (0, node_path.join)(tmpDir, "ca.key");
       await execFileAsync$3("openssl", [
         "req",
         "-x509",
         "-newkey",
         "rsa:2048",
+        "-nodes",
+        "-sha256",
+        "-days",
+        String(CA_VALIDITY_DAYS),
+        "-keyout",
+        caKeyPath,
+        "-out",
+        caCertPath,
+        "-subj",
+        `/CN=${CA_COMMON_NAME}`,
+        "-addext",
+        "basicConstraints=critical,CA:TRUE,pathlen:0",
+        "-addext",
+        "keyUsage=critical,keyCertSign,cRLSign",
+        "-addext",
+        "subjectKeyIdentifier=hash"
+      ]);
+      await (0, node_fs_promises.chmod)(caKeyPath, 384);
+      return {
+        caCertPath,
+        caKeyPath
+      };
+    }
+    async function issueLeaf(tmpDir, ca, identity, commonName, validDays) {
+      const keyPath = (0, node_path.join)(tmpDir, "leaf.key");
+      const csrPath = (0, node_path.join)(tmpDir, "leaf.csr");
+      const certPath = (0, node_path.join)(tmpDir, "leaf.crt");
+      const extPath = (0, node_path.join)(tmpDir, "leaf.ext");
+      await (0, node_fs_promises.writeFile)(extPath, [
+        "basicConstraints=critical,CA:FALSE",
+        "keyUsage=critical,digitalSignature,keyEncipherment",
+        "extendedKeyUsage=serverAuth",
+        "subjectKeyIdentifier=hash",
+        "authorityKeyIdentifier=keyid,issuer",
+        `subjectAltName=${sanValue(identity)}`,
+        ""
+      ].join("\n"), "utf-8");
+      await execFileAsync$3("openssl", [
+        "req",
+        "-new",
+        "-newkey",
+        "rsa:2048",
+        "-nodes",
+        "-sha256",
         "-keyout",
         keyPath,
         "-out",
-        certPath,
+        csrPath,
+        "-subj",
+        `/CN=${commonName}`
+      ]);
+      await execFileAsync$3("openssl", [
+        "x509",
+        "-req",
+        "-in",
+        csrPath,
+        "-CA",
+        ca.caCertPath,
+        "-CAkey",
+        ca.caKeyPath,
+        "-set_serial",
+        `0x00${(0, node_crypto.randomBytes)(16).toString("hex")}`,
         "-days",
         String(validDays),
-        "-nodes",
-        "-subj",
-        `/CN=${cn}`,
-        "-addext",
-        `subjectAltName=${sanString}`
+        "-sha256",
+        "-extfile",
+        extPath,
+        "-out",
+        certPath
       ]);
-      const { chmod } = await import("fs/promises");
-      await chmod(keyPath, 384);
+      await (0, node_fs_promises.chmod)(keyPath, 384);
+      await (0, node_fs_promises.rm)(csrPath, { force: true });
+      await (0, node_fs_promises.rm)(extPath, { force: true });
       return {
         certPath,
-        keyPath,
-        generated: true
+        keyPath
+      };
+    }
+    var DEFAULT_COMMON_NAME = "camstack.local";
+    async function ensureTlsCert(dataDir, options) {
+      const tlsDir = (0, node_path.join)(dataDir, "tls");
+      const paths = {
+        certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
+        keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
+        caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
+        caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
+      };
+      const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+      const validDays = Math.min(options?.validDays ?? 397, 397);
+      const identity = collectCertIdentity({
+        commonName,
+        extraSans: options?.extraSans ?? []
+      });
+      const reason = decideRegeneration(paths, identity);
+      if (reason === null) return describe(paths, false, null, false, null);
+      const previousFingerprint = readFingerprint(paths.certPath);
+      const caRotated = reasonRequiresNewCa(reason);
+      (0, node_fs.mkdirSync)(tlsDir, { recursive: true });
+      await regenerate(paths, identity, commonName, validDays, caRotated);
+      return describe(paths, true, reason, caRotated, previousFingerprint);
+    }
+    function readFingerprint(certPath) {
+      try {
+        return new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath)).fingerprint256;
+      } catch {
+        return null;
+      }
+    }
+    function decideRegeneration(paths, identity) {
+      if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return "missing";
+      if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return "no-local-ca";
+      try {
+        return evaluateExistingCert({
+          chainPem: (0, node_fs.readFileSync)(paths.certPath, "utf-8"),
+          keyPem: (0, node_fs.readFileSync)(paths.keyPath, "utf-8"),
+          caPem: (0, node_fs.readFileSync)(paths.caCertPath, "utf-8"),
+          identity,
+          now: /* @__PURE__ */ new Date()
+        });
+      } catch {
+        return "unreadable";
+      }
+    }
+    async function regenerate(paths, identity, commonName, validDays, newCa) {
+      const scratch = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "camstack-tls-"));
+      try {
+        const ca = newCa ? await generateCa(scratch) : {
+          caCertPath: paths.caCertPath,
+          caKeyPath: paths.caKeyPath
+        };
+        const leaf = await issueLeaf(scratch, ca, identity, commonName, validDays);
+        const chainPath = (0, node_path.join)(scratch, "chain.crt");
+        await (0, node_fs_promises.writeFile)(chainPath, `${(0, node_fs.readFileSync)(leaf.certPath, "utf-8").trimEnd()}
+${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
+`, "utf-8");
+        if (newCa) {
+          await (0, node_fs_promises.copyFile)(ca.caCertPath, `${paths.caCertPath}.new`);
+          await (0, node_fs_promises.copyFile)(ca.caKeyPath, `${paths.caKeyPath}.new`);
+          (0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
+          (0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
+          await (0, node_fs_promises.chmod)(paths.caKeyPath, 384);
+        }
+        await (0, node_fs_promises.copyFile)(leaf.keyPath, `${paths.keyPath}.new`);
+        await (0, node_fs_promises.copyFile)(chainPath, `${paths.certPath}.new`);
+        (0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
+        (0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
+        await (0, node_fs_promises.chmod)(paths.keyPath, 384);
+      } finally {
+        await (0, node_fs_promises.rm)(scratch, {
+          recursive: true,
+          force: true
+        });
+      }
+    }
+    function describe(paths, generated, reason, caRotated, previousFingerprintSha256) {
+      const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
+      const ca = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath));
+      const san = leaf.subjectAltName ?? "";
+      return {
+        ...paths,
+        generated,
+        reason,
+        caRotated,
+        fingerprintSha256: leaf.fingerprint256,
+        previousFingerprintSha256,
+        caFingerprintSha256: ca.fingerprint256,
+        validTo: new Date(leaf.validTo).toISOString(),
+        sans: san === "" ? [] : san.split(", ")
       };
     }
     function loadTlsCert(certPath, keyPath) {
@@ -198975,6 +199251,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.AlertCenterAddon = require_builtins_alerts_alerts_addon.AlertCenterAddon;
     exports.ApiKeyManager = require_builtins_local_auth_local_auth_addon.ApiKeyManager;
     exports.AuthManager = require_builtins_local_auth_local_auth_addon.AuthManager;
+    exports.CA_COMMON_NAME = CA_COMMON_NAME;
+    exports.CA_VALIDITY_DAYS = CA_VALIDITY_DAYS;
     exports.CLUSTER_SECRET_MISMATCH_TYPE = CLUSTER_SECRET_MISMATCH_TYPE;
     exports.CLUSTER_SECRET_REJECTED_EXIT_CODE = CLUSTER_SECRET_REJECTED_EXIT_CODE;
     exports.CORE_CAP_SERVICE_NAME = CORE_CAP_SERVICE_NAME;
@@ -199021,6 +199299,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.INFRA_CAPABILITIES = INFRA_CAPABILITIES;
     exports.IntegrationRegistry = IntegrationRegistry;
     exports.JobJournal = JobJournal;
+    exports.LEAF_RENEWAL_WINDOW_DAYS = LEAF_RENEWAL_WINDOW_DAYS;
     exports.LifecycleJobEngine = LifecycleJobEngine;
     exports.LifecycleStateMachine = LifecycleStateMachine;
     exports.LivenessMonitorAddon = require_builtins_liveness_monitor_liveness_monitor_addon.LivenessMonitorAddon;
@@ -199031,6 +199310,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.LogRingBuffer = LogRingBuffer;
     exports.LokiDestination = require_builtins_loki_logging_index.LokiDestination$1;
     exports.LokiLoggingAddon = require_builtins_loki_logging_index.LokiLoggingAddon$1;
+    exports.MAX_LEAF_VALIDITY_DAYS = MAX_LEAF_VALIDITY_DAYS;
     exports.METHOD_ACCESS_MAP = require_dist10.METHOD_ACCESS_MAP;
     exports.ModelDownloadService = require_file_data_plane.ModelDownloadService;
     exports.NATIVE_PROVIDER_SERVICE_INFIX = require_manifest_python_deps.NATIVE_PROVIDER_SERVICE_INFIX;
@@ -199056,6 +199336,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.ReadinessTimeoutError = require_dist10.ReadinessTimeoutError;
     exports.ReplEngine = ReplEngine;
     exports.RingBuffer = RingBuffer;
+    exports.SERVER_AUTH_OID = SERVER_AUTH_OID;
     exports.ScopedLogger = ScopedLogger;
     exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
     exports.SocketChannel = require_manifest_python_deps.SocketChannel;
@@ -199107,6 +199388,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.clearPendingRestart = clearPendingRestart;
     exports.clusterEventTopic = require_manifest_python_deps.clusterEventTopic;
     exports.clusterSecretMatches = clusterSecretMatches;
+    exports.collectCertIdentity = collectCertIdentity;
     exports.collectModelFiles = require_file_data_plane.collectModelFiles;
     exports.contentTypeFor = require_file_data_plane.contentTypeFor;
     exports.copyDirRecursive = copyDirRecursive;
@@ -199173,6 +199455,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       }
     });
     exports.ensureTlsCert = ensureTlsCert;
+    exports.evaluateExistingCert = evaluateExistingCert;
     exports.expandCapMethods = require_dist10.expandCapMethods;
     exports.fetchJson = require_file_data_plane.fetchJson;
     Object.defineProperty(exports, "findInPath", {
@@ -237936,7 +238219,7 @@ var require_enums = __commonJS({
   "../types/dist/enums.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_CRPORAAz();
+    var require_event_category = require_event_category_EY0GNjV9();
     var EventSourceType = /* @__PURE__ */ (function(EventSourceType2) {
       EventSourceType2["Addon"] = "addon";
       EventSourceType2["Core"] = "core";
@@ -237956,8 +238239,8 @@ var require_dist9 = __commonJS({
   "../types/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_CRPORAAz();
-    var require_sleep = require_sleep_CMRLJj2e();
+    var require_event_category = require_event_category_EY0GNjV9();
+    var require_sleep = require_sleep_C2XhJhkd();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -399394,7 +399677,7 @@ var require_post_boot_service = __commonJS({
         return entry.payload;
       }
       async run(context) {
-        const { port, host, dataPath, trpcRegistered } = context;
+        const { port, host, dataPath, trpcRegistered, tlsCert } = context;
         this.eventBus.emit({
           id: (0, node_crypto_1.randomUUID)(),
           timestamp: /* @__PURE__ */ new Date(),
@@ -399403,6 +399686,7 @@ var require_post_boot_service = __commonJS({
           data: { port, host, trpcRegistered, dataPath }
         });
         this.emitRestartCompletedIfPending(dataPath);
+        this.emitTlsCertChangedIfReissued(tlsCert);
         await this.reconcileLifecycleJobsIfAny();
       }
       async reconcileLifecycleJobsIfAny() {
@@ -399411,6 +399695,27 @@ var require_post_boot_service = __commonJS({
           this.logger.info("Lifecycle jobs reconciled at boot", { meta: { resumed, failed } });
         }
       }
+      emitTlsCertChangedIfReissued(tlsCert) {
+        if (tlsCert === void 0 || !tlsCert.generated)
+          return;
+        const payload = {
+          reason: tlsCert.reason ?? "unknown",
+          fingerprintSha256: tlsCert.fingerprintSha256,
+          caFingerprintSha256: tlsCert.caFingerprintSha256,
+          caRotated: tlsCert.caRotated,
+          caCertPath: tlsCert.caCertPath,
+          validTo: tlsCert.validTo,
+          sans: tlsCert.sans
+        };
+        this.logger.warn("TLS certificate reissued", { meta: payload });
+        this.eventBus.emit({
+          id: (0, node_crypto_1.randomUUID)(),
+          timestamp: /* @__PURE__ */ new Date(),
+          source: { type: "core", id: "system" },
+          category: types_1.EventCategory.SystemTlsCertChanged,
+          data: payload
+        });
+      }
       emitRestartCompletedIfPending(dataDir) {
         const marker = (0, system_1.readPendingRestart)(dataDir);
         if (marker === null)
@@ -401980,11 +402285,11 @@ var require_boot_config = __commonJS({
     exports.loadBootstrapConfig = loadBootstrapConfig;
     exports.autoGenerateJwtSecret = autoGenerateJwtSecret;
     exports.setupInfra = setupInfra;
+    var node_crypto_1 = __require("crypto");
     var fs = __importStar(__require("fs"));
     var path = __importStar(__require("path"));
-    var yaml = __importStar(require_js_yaml());
-    var node_crypto_1 = __require("crypto");
     var types_1 = require_dist9();
+    var yaml = __importStar(require_js_yaml());
     var config_schema_1 = require_config_schema();
     var storage_location_manager_1 = require_storage_location_manager();
     var CONFIG_DEFAULTS = {
@@ -402104,6 +402409,7 @@ var require_boot_config = __commonJS({
         console.log(`[Phase2] Location "${name}": ${available ? "OK" : "UNAVAILABLE"} \u2192 ${locPath}`);
       }
       let tlsOptions;
+      let tlsCert;
       if (config.tls.enabled) {
         const core = require_dist3();
         const { ensureTlsCert, loadTlsCert } = core;
@@ -402113,11 +402419,8 @@ var require_boot_config = __commonJS({
           tlsOptions = { key: pair.key, cert: pair.cert };
         } else {
           const tlsResult = await ensureTlsCert(dataPath);
-          if (tlsResult.generated) {
-            console.log(`[Phase2c] Generated self-signed TLS cert at ${tlsResult.certPath}`);
-          } else {
-            console.log(`[Phase2c] Using existing TLS cert at ${tlsResult.certPath}`);
-          }
+          tlsCert = tlsResult;
+          logTlsCert(tlsResult);
           const pair = loadTlsCert(tlsResult.certPath, tlsResult.keyPath);
           tlsOptions = { key: pair.key, cert: pair.cert };
         }
@@ -402126,9 +402429,20 @@ var require_boot_config = __commonJS({
         bootstrapConfig: config,
         dataPath,
         locationManager,
-        tlsOptions
+        tlsOptions,
+        tlsCert
       };
     }
+    function logTlsCert(result) {
+      if (!result.generated) {
+        console.log(`[Phase2c] TLS cert unchanged \u2014 ${result.certPath} (leaf ${result.fingerprintSha256}, valid to ${result.validTo})`);
+        return;
+      }
+      console.log(`[Phase2c] TLS CERTIFICATE REISSUED \u2014 reason=${result.reason}, caRotated=${result.caRotated}`);
+      console.log(`[Phase2c]   leaf ${result.previousFingerprintSha256 ?? "(none)"} \u2192 ${result.fingerprintSha256}`);
+      console.log(`[Phase2c]   valid to ${result.validTo}, names: ${result.sans.join(", ")}`);
+      console.log(result.caRotated ? `[Phase2c]   ACTION REQUIRED: the local CA changed. Install ${result.caCertPath} (SHA-256 ${result.caFingerprintSha256}) on every device that trusted the previous certificate.` : `[Phase2c]   Local CA unchanged (${result.caFingerprintSha256}) \u2014 devices that trust ${result.caCertPath} keep working.`);
+    }
   }
 });
 
@@ -409611,7 +409925,7 @@ var require_main4 = __commonJS({
       const configPath = process.env.CONFIG_PATH ?? path.join(process.env.CAMSTACK_DATA ?? path.join(process.cwd(), "camstack-data"), "config.yaml");
       const bootstrapConfig = (0, boot_config_1.loadBootstrapConfig)(configPath);
       const infra = await (0, boot_config_1.setupInfra)(configPath, bootstrapConfig);
-      const { dataPath, tlsOptions } = infra;
+      const { dataPath, tlsOptions, tlsCert } = infra;
       const port = infra.bootstrapConfig.server.port;
       const host = infra.bootstrapConfig.server.host;
       const fastifyOpts = tlsOptions ? { https: tlsOptions } : {};
@@ -410360,7 +410674,7 @@ var require_main4 = __commonJS({
       logger.info("CamStack server listening", { meta: { protocol, host, port, trpcRegistered } });
       void Promise.all([resolveAdminUi(), resolveViewerUi()]);
       const postBoot = app.get(post_boot_service_1.PostBootService);
-      await postBoot.run({ port, host, dataPath, trpcRegistered });
+      await postBoot.run({ port, host, dataPath, trpcRegistered, tlsCert });
       try {
         const confirm = app.get(server_update_service_1.ServerUpdateService).confirmBootHealthy();
         if (confirm.promoted !== null) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "camstack",
-  "version": "1.2.37",
+  "version": "1.2.38",
   "description": "CLI tool for managing and running CamStack server",
   "keywords": [
     "camstack",