@camstack/addon-terminal 0.1.28 → 0.1.30

package/dist/addon.js

@@ -31,7 +31,7 @@ let node_module = require("node:module");
 let sharp = require("sharp");
 sharp = __toESM(sharp);
 let node_http = require("node:http");
-//#region ../types/dist/event-category-XfKNtfCc.mjs
+//#region ../types/dist/event-category-CIa_iT6b.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -47,6 +47,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
+	* The hub reissued its own TLS certificate at boot (`ensureTlsCert`).
+	* Emitted only when the material on disk actually changed, so an
+	* operator who trusted the old certificate by hand is told rather than
+	* discovering it as a browser error. Payload `TlsCertChangedPayload`.
+	*
+	* Rule: docs/decisions/adr-0227-*.md
+	*/
+	EventCategory["SystemTlsCertChanged"] = "system.tls-cert-changed";
+	/**
 	* A newer addon or server-root package version was found by the
 	* authoritative registry check. Emitted once when any observed
 	* `latestVersion` changes (or a package/node first appears behind);
@@ -20023,7 +20032,12 @@ var TerminalSessionInfoSchema = object({
 var TerminalProfileInfoSchema = object({
 	profileId: string(),
 	label: string(),
-	description: string().optional()
+	description: string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: string().optional(),
+	args: array(string()).readonly().optional(),
+	cwd: string().optional(),
+	environment: array(string()).readonly().optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -20036,7 +20050,11 @@ var TerminalInstanceInfoSchema = object({
 	profileId: string(),
 	profileLabel: string(),
 	name: string(),
-	enabled: boolean()
+	enabled: boolean(),
+	executable: string(),
+	args: array(string()).readonly(),
+	cwd: string(),
+	environment: array(string()).readonly()
 });
 var TerminalLegacyCameraSchema = object({
 	stableId: string(),
@@ -20082,7 +20100,22 @@ var terminalSessionCapability = {
 		createInstance: method(object({
 			targetNodeId: string().min(1),
 			profileId: string().min(1),
-			name: string().trim().min(1).max(160).optional()
+			name: string().trim().min(1).max(160).optional(),
+			executable: string().max(1024).optional(),
+			args: array(string().max(2048)).max(64).optional(),
+			cwd: string().max(1024).optional(),
+			environment: array(string().max(4096)).max(64).optional()
+		}), TerminalInstanceInfoSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateInstance: method(object({
+			instanceId: string().min(1),
+			name: string().trim().min(1).max(160).optional(),
+			executable: string().max(1024).optional(),
+			args: array(string().max(2048)).max(64).optional(),
+			cwd: string().max(1024).optional(),
+			environment: array(string().max(4096)).max(64).optional()
 		}), TerminalInstanceInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -20117,7 +20150,11 @@ var terminalSessionCapability = {
 		openSession: method(object({
 			profileId: string(),
 			cols: number().int().positive(),
-			rows: number().int().positive()
+			rows: number().int().positive(),
+			executable: string().max(1024).optional(),
+			args: array(string().max(2048)).max(64).optional(),
+			cwd: string().max(1024).optional(),
+			environment: array(string().max(4096)).max(64).optional()
 		}), TerminalSessionInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -24172,6 +24209,20 @@ var AllowedAddressesSchema = object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: array(string()).readonly() });
+var TlsStatusSchema = object({
+	mode: _enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: string().nullable(),
+	caFingerprintSha256: string().nullable(),
+	validTo: string().nullable(),
+	sans: array(string()),
+	caCertPem: string().nullable(),
+	reissueError: string().nullable(),
+	restartRequired: boolean()
+});
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
 	* LEGACY HINT — do not send from new code. Kept optional so clients
@@ -24191,7 +24242,20 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	keyPem: string().min(1),
+	caPem: string().optional()
+}), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 var LockControlStatusSchema = object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
 	*  failure to reach the target — operator intervention required. */
@@ -32216,6 +32280,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -32240,18 +32310,36 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -32264,6 +32352,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -35144,6 +35238,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -37631,6 +37731,35 @@ Object.freeze(Object.fromEntries([{
 	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -43338,7 +43467,8 @@ var TerminalCameraRelay = class {
 		const opening = this.api.openSession(state.nodeId, {
 			profileId: state.profileId,
 			cols: 120,
-			rows: 40
+			rows: 40,
+			instanceId: state.instanceId
 		});
 		state.openPromise = opening;
 		try {
@@ -43725,8 +43855,25 @@ var TerminalInstanceSchema = object({
 	profileId: string().min(1).max(64),
 	profileLabel: string().min(1).max(120),
 	name: string().min(1).max(160),
-	enabled: boolean()
+	enabled: boolean(),
+	executable: string().max(1024).default(""),
+	args: array(string().max(2048)).max(64).default([]),
+	cwd: string().max(1024).default(""),
+	environment: array(string().max(4096)).max(64).default([])
 });
+function environmentEntriesToRecord(entries) {
+	const out = {};
+	for (const entry of entries) {
+		const eq = entry.indexOf("=");
+		if (eq <= 0) continue;
+		out[entry.slice(0, eq)] = entry.slice(eq + 1);
+	}
+	return out;
+}
+function environmentRecordToEntries(env) {
+	if (env === void 0) return [];
+	return Object.entries(env).map(([name, value]) => `${name}=${value}`);
+}
 /**
 * Config is operator-writable, so malformed or duplicate rows are ignored
 * rather than allowed to make declaration reconciliation destructive.
@@ -43990,7 +44137,11 @@ var TerminalSessionManager = class {
 		return this.profiles.map((p) => ({
 			profileId: p.profileId,
 			label: p.label,
-			...p.description !== void 0 ? { description: p.description } : {}
+			...p.description !== void 0 ? { description: p.description } : {},
+			executable: p.file,
+			args: [...p.args],
+			cwd: p.cwd ?? "",
+			environment: environmentRecordToEntries(p.env)
 		}));
 	}
 	setInstanceControl(control) {
@@ -44002,6 +44153,9 @@ var TerminalSessionManager = class {
 	async createInstance(input) {
 		return this.requireInstanceControl().createInstance(input);
 	}
+	async updateInstance(input) {
+		return this.requireInstanceControl().updateInstance(input);
+	}
 	async deleteInstance(input) {
 		await this.requireInstanceControl().deleteInstance(input);
 	}
@@ -44024,24 +44178,29 @@ var TerminalSessionManager = class {
 		const cols = clampDimension(input.cols, MAX_COLS);
 		const rows = clampDimension(input.rows, MAX_ROWS);
 		const sessionId = this.mintId();
+		const file = input.executable?.trim() || profile.file;
+		const args = input.args !== void 0 ? [...input.args] : [...profile.args];
+		const cwd = input.cwd?.trim() || profile.cwd || this.opts.cwd;
+		const env = {
+			...this.opts.env,
+			...profile.env,
+			...environmentEntriesToRecord(input.environment ?? [])
+		};
 		const executable = [{
-			file: profile.file,
-			args: profile.args
-		}, ...profile.fallbacks ?? []].map((candidate) => ({
+			file,
+			args
+		}, ...input.executable?.trim() ? [] : profile.fallbacks ?? []].map((candidate) => ({
 			...candidate,
 			resolvedFile: this.resolveBinary(candidate.file)
 		})).find((candidate) => candidate.resolvedFile !== null);
-		if (executable === void 0) throw new Error(`Terminal profile '${profile.profileId}' cannot start: executable '${profile.file}' was not found on PATH. Install it in the server image or set its path in Terminal settings.`);
+		if (executable === void 0) throw new Error(`Terminal profile '${profile.profileId}' cannot start: executable '${file}' was not found on PATH. Install it in the server image or set its path in Terminal settings.`);
 		const pty = this.opts.spawn({
 			file: executable.resolvedFile,
 			args: executable.args,
 			cols,
 			rows,
-			...profile.cwd !== void 0 || this.opts.cwd !== void 0 ? { cwd: profile.cwd ?? this.opts.cwd } : {},
-			...profile.env !== void 0 || this.opts.env !== void 0 ? { env: {
-				...this.opts.env,
-				...profile.env
-			} } : {}
+			...cwd !== void 0 && cwd !== "" ? { cwd } : {},
+			...Object.keys(env).length > 0 ? { env } : {}
 		});
 		const screen = this.opts.screenFactory(cols, rows);
 		const info = {
@@ -44139,7 +44298,7 @@ var TerminalSessionManager = class {
 		const oldestSeq = session.output[0]?.seq ?? session.nextSeq;
 		if (input.afterSeq === 0 || input.afterSeq < oldestSeq - 1 || input.afterSeq > cursor) {
 			await session.screen.flush();
-			const exit = [...session.output].reverse().find((event) => event.kind === "exit");
+			const exit = session.output.toReversed().find((event) => event.kind === "exit");
 			return {
 				cursor,
 				reset: true,
@@ -44383,7 +44542,21 @@ var TerminalAddon = class extends BaseAddon {
 			const localNodeId = declarationOwnerNodeId(this.ctx.kernel.localNodeId);
 			const cameraRelay = new TerminalCameraRelay({
 				listProfiles: (nodeId) => nodeId === localNodeId ? manager.listProfiles() : this.ctx.api.terminalSession.listProfiles.query(void 0, nodePin(nodeId)),
-				openSession: (nodeId, input) => nodeId === localNodeId ? manager.openSession(input) : this.ctx.api.terminalSession.openSession.mutate(input, nodePin(nodeId)),
+				openSession: (nodeId, input) => {
+					const instance = input.instanceId ? this.terminalInstances().find((row) => row.id === input.instanceId) : void 0;
+					const payload = {
+						profileId: input.profileId,
+						cols: input.cols,
+						rows: input.rows,
+						...instance ? {
+							...instance.executable ? { executable: instance.executable } : {},
+							...instance.args.length > 0 ? { args: [...instance.args] } : {},
+							...instance.cwd ? { cwd: instance.cwd } : {},
+							...instance.environment.length > 0 ? { environment: [...instance.environment] } : {}
+						} : {}
+					};
+					return nodeId === localNodeId ? manager.openSession(payload) : this.ctx.api.terminalSession.openSession.mutate(payload, nodePin(nodeId));
+				},
 				pullOutput: (nodeId, input) => nodeId === localNodeId ? manager.pullOutput(input) : this.ctx.api.terminalSession.pullOutput.mutate(input, nodePin(nodeId)),
 				closeSession: async (nodeId, sessionId) => {
 					if (nodeId === localNodeId) await manager.close({ sessionId });
@@ -44588,6 +44761,7 @@ var TerminalAddon = class extends BaseAddon {
 		return {
 			listInstances: async () => this.terminalInstances().map((instance) => this.instanceInfo(instance)),
 			createInstance: async (input) => this.createTerminalInstance(input),
+			updateInstance: async (input) => this.updateTerminalInstance(input),
 			deleteInstance: async ({ instanceId }) => this.deleteTerminalInstance(instanceId),
 			setInstanceEnabled: async ({ instanceId, enabled }) => this.setTerminalInstanceEnabled(instanceId, enabled),
 			listLegacyCameras: async () => this.listLegacyTerminalCameras(),
@@ -44607,7 +44781,11 @@ var TerminalAddon = class extends BaseAddon {
 			profileId: instance.profileId,
 			profileLabel: instance.profileLabel,
 			name: instance.name,
-			enabled: instance.enabled
+			enabled: instance.enabled,
+			executable: instance.executable,
+			args: instance.args,
+			cwd: instance.cwd,
+			environment: instance.environment
 		};
 	}
 	replaceTerminalCameraTombstones(stableIds) {
@@ -44635,11 +44813,35 @@ var TerminalAddon = class extends BaseAddon {
 			profileId: profile.profileId,
 			profileLabel: profile.label,
 			name,
-			enabled: true
+			enabled: true,
+			executable: input.executable?.trim() || profile.executable || "",
+			args: input.args ? [...input.args] : [...profile.args ?? []],
+			cwd: input.cwd?.trim() || profile.cwd || "",
+			environment: input.environment ? [...input.environment] : [...profile.environment ?? []]
 		};
 		await this.updateGlobalSettings({ terminalInstances: [...this.config.terminalInstances, instance] });
 		return this.instanceInfo(instance);
 	}
+	async updateTerminalInstance(input) {
+		const updated = await this.instanceMutationQueue.run(() => this.updateTerminalInstanceUnlocked(input));
+		await this.cameraRelay?.closeInstance(updated.instanceId);
+		await this.reconcileTerminalCameras();
+		return updated;
+	}
+	async updateTerminalInstanceUnlocked(input) {
+		const instance = this.terminalInstances().find((candidate) => candidate.id === input.instanceId);
+		if (!instance) throw new Error(`No such Terminal instance: ${input.instanceId}`);
+		const updated = {
+			...instance,
+			...input.name !== void 0 ? { name: input.name.trim() } : {},
+			...input.executable !== void 0 ? { executable: input.executable.trim() } : {},
+			...input.args !== void 0 ? { args: [...input.args] } : {},
+			...input.cwd !== void 0 ? { cwd: input.cwd.trim() } : {},
+			...input.environment !== void 0 ? { environment: [...input.environment] } : {}
+		};
+		await this.updateGlobalSettings({ terminalInstances: this.config.terminalInstances.map((candidate) => candidate.id === input.instanceId ? updated : candidate) });
+		return this.instanceInfo(updated);
+	}
 	async deleteTerminalInstance(instanceId) {
 		await this.instanceMutationQueue.run(() => this.deleteTerminalInstanceUnlocked(instanceId));
 		await this.reconcileTerminalCameras();
@@ -44699,7 +44901,11 @@ var TerminalAddon = class extends BaseAddon {
 			profileId: "monitor",
 			profileLabel: legacy.profileLabel,
 			name: requestedName?.trim() || legacy.name,
-			enabled: true
+			enabled: true,
+			executable: "",
+			args: [],
+			cwd: "",
+			environment: []
 		};
 		await this.updateGlobalSettings({ terminalInstances: [...this.config.terminalInstances, instance] });
 		return this.instanceInfo(instance);

package/dist/addon.mjs

@@ -8,7 +8,7 @@ import { createServer } from "node:http";
 //#region \0rolldown/runtime.js
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 //#endregion
-//#region ../types/dist/event-category-XfKNtfCc.mjs
+//#region ../types/dist/event-category-CIa_iT6b.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -24,6 +24,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
+	* The hub reissued its own TLS certificate at boot (`ensureTlsCert`).
+	* Emitted only when the material on disk actually changed, so an
+	* operator who trusted the old certificate by hand is told rather than
+	* discovering it as a browser error. Payload `TlsCertChangedPayload`.
+	*
+	* Rule: docs/decisions/adr-0227-*.md
+	*/
+	EventCategory["SystemTlsCertChanged"] = "system.tls-cert-changed";
+	/**
 	* A newer addon or server-root package version was found by the
 	* authoritative registry check. Emitted once when any observed
 	* `latestVersion` changes (or a package/node first appears behind);
@@ -20000,7 +20009,12 @@ var TerminalSessionInfoSchema = object({
 var TerminalProfileInfoSchema = object({
 	profileId: string(),
 	label: string(),
-	description: string().optional()
+	description: string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: string().optional(),
+	args: array(string()).readonly().optional(),
+	cwd: string().optional(),
+	environment: array(string()).readonly().optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -20013,7 +20027,11 @@ var TerminalInstanceInfoSchema = object({
 	profileId: string(),
 	profileLabel: string(),
 	name: string(),
-	enabled: boolean()
+	enabled: boolean(),
+	executable: string(),
+	args: array(string()).readonly(),
+	cwd: string(),
+	environment: array(string()).readonly()
 });
 var TerminalLegacyCameraSchema = object({
 	stableId: string(),
@@ -20059,7 +20077,22 @@ var terminalSessionCapability = {
 		createInstance: method(object({
 			targetNodeId: string().min(1),
 			profileId: string().min(1),
-			name: string().trim().min(1).max(160).optional()
+			name: string().trim().min(1).max(160).optional(),
+			executable: string().max(1024).optional(),
+			args: array(string().max(2048)).max(64).optional(),
+			cwd: string().max(1024).optional(),
+			environment: array(string().max(4096)).max(64).optional()
+		}), TerminalInstanceInfoSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateInstance: method(object({
+			instanceId: string().min(1),
+			name: string().trim().min(1).max(160).optional(),
+			executable: string().max(1024).optional(),
+			args: array(string().max(2048)).max(64).optional(),
+			cwd: string().max(1024).optional(),
+			environment: array(string().max(4096)).max(64).optional()
 		}), TerminalInstanceInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -20094,7 +20127,11 @@ var terminalSessionCapability = {
 		openSession: method(object({
 			profileId: string(),
 			cols: number().int().positive(),
-			rows: number().int().positive()
+			rows: number().int().positive(),
+			executable: string().max(1024).optional(),
+			args: array(string().max(2048)).max(64).optional(),
+			cwd: string().max(1024).optional(),
+			environment: array(string().max(4096)).max(64).optional()
 		}), TerminalSessionInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -24149,6 +24186,20 @@ var AllowedAddressesSchema = object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: array(string()).readonly() });
+var TlsStatusSchema = object({
+	mode: _enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: string().nullable(),
+	caFingerprintSha256: string().nullable(),
+	validTo: string().nullable(),
+	sans: array(string()),
+	caCertPem: string().nullable(),
+	reissueError: string().nullable(),
+	restartRequired: boolean()
+});
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
 	* LEGACY HINT — do not send from new code. Kept optional so clients
@@ -24168,7 +24219,20 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	keyPem: string().min(1),
+	caPem: string().optional()
+}), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 var LockControlStatusSchema = object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
 	*  failure to reach the target — operator intervention required. */
@@ -32193,6 +32257,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -32217,18 +32287,36 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -32241,6 +32329,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -35121,6 +35215,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -37608,6 +37708,35 @@ Object.freeze(Object.fromEntries([{
 	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -43315,7 +43444,8 @@ var TerminalCameraRelay = class {
 		const opening = this.api.openSession(state.nodeId, {
 			profileId: state.profileId,
 			cols: 120,
-			rows: 40
+			rows: 40,
+			instanceId: state.instanceId
 		});
 		state.openPromise = opening;
 		try {
@@ -43702,8 +43832,25 @@ var TerminalInstanceSchema = object({
 	profileId: string().min(1).max(64),
 	profileLabel: string().min(1).max(120),
 	name: string().min(1).max(160),
-	enabled: boolean()
+	enabled: boolean(),
+	executable: string().max(1024).default(""),
+	args: array(string().max(2048)).max(64).default([]),
+	cwd: string().max(1024).default(""),
+	environment: array(string().max(4096)).max(64).default([])
 });
+function environmentEntriesToRecord(entries) {
+	const out = {};
+	for (const entry of entries) {
+		const eq = entry.indexOf("=");
+		if (eq <= 0) continue;
+		out[entry.slice(0, eq)] = entry.slice(eq + 1);
+	}
+	return out;
+}
+function environmentRecordToEntries(env) {
+	if (env === void 0) return [];
+	return Object.entries(env).map(([name, value]) => `${name}=${value}`);
+}
 /**
 * Config is operator-writable, so malformed or duplicate rows are ignored
 * rather than allowed to make declaration reconciliation destructive.
@@ -43967,7 +44114,11 @@ var TerminalSessionManager = class {
 		return this.profiles.map((p) => ({
 			profileId: p.profileId,
 			label: p.label,
-			...p.description !== void 0 ? { description: p.description } : {}
+			...p.description !== void 0 ? { description: p.description } : {},
+			executable: p.file,
+			args: [...p.args],
+			cwd: p.cwd ?? "",
+			environment: environmentRecordToEntries(p.env)
 		}));
 	}
 	setInstanceControl(control) {
@@ -43979,6 +44130,9 @@ var TerminalSessionManager = class {
 	async createInstance(input) {
 		return this.requireInstanceControl().createInstance(input);
 	}
+	async updateInstance(input) {
+		return this.requireInstanceControl().updateInstance(input);
+	}
 	async deleteInstance(input) {
 		await this.requireInstanceControl().deleteInstance(input);
 	}
@@ -44001,24 +44155,29 @@ var TerminalSessionManager = class {
 		const cols = clampDimension(input.cols, MAX_COLS);
 		const rows = clampDimension(input.rows, MAX_ROWS);
 		const sessionId = this.mintId();
+		const file = input.executable?.trim() || profile.file;
+		const args = input.args !== void 0 ? [...input.args] : [...profile.args];
+		const cwd = input.cwd?.trim() || profile.cwd || this.opts.cwd;
+		const env = {
+			...this.opts.env,
+			...profile.env,
+			...environmentEntriesToRecord(input.environment ?? [])
+		};
 		const executable = [{
-			file: profile.file,
-			args: profile.args
-		}, ...profile.fallbacks ?? []].map((candidate) => ({
+			file,
+			args
+		}, ...input.executable?.trim() ? [] : profile.fallbacks ?? []].map((candidate) => ({
 			...candidate,
 			resolvedFile: this.resolveBinary(candidate.file)
 		})).find((candidate) => candidate.resolvedFile !== null);
-		if (executable === void 0) throw new Error(`Terminal profile '${profile.profileId}' cannot start: executable '${profile.file}' was not found on PATH. Install it in the server image or set its path in Terminal settings.`);
+		if (executable === void 0) throw new Error(`Terminal profile '${profile.profileId}' cannot start: executable '${file}' was not found on PATH. Install it in the server image or set its path in Terminal settings.`);
 		const pty = this.opts.spawn({
 			file: executable.resolvedFile,
 			args: executable.args,
 			cols,
 			rows,
-			...profile.cwd !== void 0 || this.opts.cwd !== void 0 ? { cwd: profile.cwd ?? this.opts.cwd } : {},
-			...profile.env !== void 0 || this.opts.env !== void 0 ? { env: {
-				...this.opts.env,
-				...profile.env
-			} } : {}
+			...cwd !== void 0 && cwd !== "" ? { cwd } : {},
+			...Object.keys(env).length > 0 ? { env } : {}
 		});
 		const screen = this.opts.screenFactory(cols, rows);
 		const info = {
@@ -44116,7 +44275,7 @@ var TerminalSessionManager = class {
 		const oldestSeq = session.output[0]?.seq ?? session.nextSeq;
 		if (input.afterSeq === 0 || input.afterSeq < oldestSeq - 1 || input.afterSeq > cursor) {
 			await session.screen.flush();
-			const exit = [...session.output].reverse().find((event) => event.kind === "exit");
+			const exit = session.output.toReversed().find((event) => event.kind === "exit");
 			return {
 				cursor,
 				reset: true,
@@ -44360,7 +44519,21 @@ var TerminalAddon = class extends BaseAddon {
 			const localNodeId = declarationOwnerNodeId(this.ctx.kernel.localNodeId);
 			const cameraRelay = new TerminalCameraRelay({
 				listProfiles: (nodeId) => nodeId === localNodeId ? manager.listProfiles() : this.ctx.api.terminalSession.listProfiles.query(void 0, nodePin(nodeId)),
-				openSession: (nodeId, input) => nodeId === localNodeId ? manager.openSession(input) : this.ctx.api.terminalSession.openSession.mutate(input, nodePin(nodeId)),
+				openSession: (nodeId, input) => {
+					const instance = input.instanceId ? this.terminalInstances().find((row) => row.id === input.instanceId) : void 0;
+					const payload = {
+						profileId: input.profileId,
+						cols: input.cols,
+						rows: input.rows,
+						...instance ? {
+							...instance.executable ? { executable: instance.executable } : {},
+							...instance.args.length > 0 ? { args: [...instance.args] } : {},
+							...instance.cwd ? { cwd: instance.cwd } : {},
+							...instance.environment.length > 0 ? { environment: [...instance.environment] } : {}
+						} : {}
+					};
+					return nodeId === localNodeId ? manager.openSession(payload) : this.ctx.api.terminalSession.openSession.mutate(payload, nodePin(nodeId));
+				},
 				pullOutput: (nodeId, input) => nodeId === localNodeId ? manager.pullOutput(input) : this.ctx.api.terminalSession.pullOutput.mutate(input, nodePin(nodeId)),
 				closeSession: async (nodeId, sessionId) => {
 					if (nodeId === localNodeId) await manager.close({ sessionId });
@@ -44565,6 +44738,7 @@ var TerminalAddon = class extends BaseAddon {
 		return {
 			listInstances: async () => this.terminalInstances().map((instance) => this.instanceInfo(instance)),
 			createInstance: async (input) => this.createTerminalInstance(input),
+			updateInstance: async (input) => this.updateTerminalInstance(input),
 			deleteInstance: async ({ instanceId }) => this.deleteTerminalInstance(instanceId),
 			setInstanceEnabled: async ({ instanceId, enabled }) => this.setTerminalInstanceEnabled(instanceId, enabled),
 			listLegacyCameras: async () => this.listLegacyTerminalCameras(),
@@ -44584,7 +44758,11 @@ var TerminalAddon = class extends BaseAddon {
 			profileId: instance.profileId,
 			profileLabel: instance.profileLabel,
 			name: instance.name,
-			enabled: instance.enabled
+			enabled: instance.enabled,
+			executable: instance.executable,
+			args: instance.args,
+			cwd: instance.cwd,
+			environment: instance.environment
 		};
 	}
 	replaceTerminalCameraTombstones(stableIds) {
@@ -44612,11 +44790,35 @@ var TerminalAddon = class extends BaseAddon {
 			profileId: profile.profileId,
 			profileLabel: profile.label,
 			name,
-			enabled: true
+			enabled: true,
+			executable: input.executable?.trim() || profile.executable || "",
+			args: input.args ? [...input.args] : [...profile.args ?? []],
+			cwd: input.cwd?.trim() || profile.cwd || "",
+			environment: input.environment ? [...input.environment] : [...profile.environment ?? []]
 		};
 		await this.updateGlobalSettings({ terminalInstances: [...this.config.terminalInstances, instance] });
 		return this.instanceInfo(instance);
 	}
+	async updateTerminalInstance(input) {
+		const updated = await this.instanceMutationQueue.run(() => this.updateTerminalInstanceUnlocked(input));
+		await this.cameraRelay?.closeInstance(updated.instanceId);
+		await this.reconcileTerminalCameras();
+		return updated;
+	}
+	async updateTerminalInstanceUnlocked(input) {
+		const instance = this.terminalInstances().find((candidate) => candidate.id === input.instanceId);
+		if (!instance) throw new Error(`No such Terminal instance: ${input.instanceId}`);
+		const updated = {
+			...instance,
+			...input.name !== void 0 ? { name: input.name.trim() } : {},
+			...input.executable !== void 0 ? { executable: input.executable.trim() } : {},
+			...input.args !== void 0 ? { args: [...input.args] } : {},
+			...input.cwd !== void 0 ? { cwd: input.cwd.trim() } : {},
+			...input.environment !== void 0 ? { environment: [...input.environment] } : {}
+		};
+		await this.updateGlobalSettings({ terminalInstances: this.config.terminalInstances.map((candidate) => candidate.id === input.instanceId ? updated : candidate) });
+		return this.instanceInfo(updated);
+	}
 	async deleteTerminalInstance(instanceId) {
 		await this.instanceMutationQueue.run(() => this.deleteTerminalInstanceUnlocked(instanceId));
 		await this.reconcileTerminalCameras();
@@ -44676,7 +44878,11 @@ var TerminalAddon = class extends BaseAddon {
 			profileId: "monitor",
 			profileLabel: legacy.profileLabel,
 			name: requestedName?.trim() || legacy.name,
-			enabled: true
+			enabled: true,
+			executable: "",
+			args: [],
+			cwd: "",
+			environment: []
 		};
 		await this.updateGlobalSettings({ terminalInstances: [...this.config.terminalInstances, instance] });
 		return this.instanceInfo(instance);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-terminal",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "description": "Interactive terminal sessions (pty + xterm) as a CamStack addon",
   "keywords": [
     "camstack",