@camstack/server 1.2.459 → 1.2.461

package/THIRD_PARTY_MODELS.md

@@ -134,7 +134,7 @@ entry kept resolvable for a saved selection but no longer offered.
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `yunet-2023mar` (default) | [OpenCV Zoo YuNet](https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet) | BSD-3-Clause (`BSD-3-Clause.txt`) / MIT (`MIT-yunet-reference.txt`) | WIDER FACE: research-oriented terms; images CC BY-NC-ND | input contract baked into the graph (the pool RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather); internal tensor names cleared in the OpenVINO IR; ONNX fp32, OpenVINO IR fp32, CoreML fp16 (scripts/build-yunet-model.py) | mirror `faceDetection/yunet` |
+| `yunet-2023mar` (default) | [OpenCV Zoo YuNet](https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet) | BSD-3-Clause (`BSD-3-Clause.txt`) / MIT (`MIT-yunet-reference.txt`) | WIDER FACE: research-oriented terms; images CC BY-NC-ND | input contract baked into the graph (the pool RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather); internal tensor names cleared in the OpenVINO IR; ONNX fp32, OpenVINO IR fp32, CoreML fp16 (scripts/build-yunet-model.py); Edge TPU build: the bake folded into the first Conv, full-integer int8 post-training quantisation calibrated on CamStack person crops, compiled with edgetpu_compiler 14 (scripts/build-yunet-edgetpu.py) | mirror `faceDetection/yunet` |
 
 ### Face recognition
 
@@ -146,7 +146,7 @@ entry kept resolvable for a saved selection but no longer offered.
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `yolox-tiny-plate` (default) | [open-lpr models (faisalthaheem/open-lpr-models), YOLOX-tiny](https://huggingface.co/faisalthaheem/open-lpr-models) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | Simanno annotated plate corpus plus community-contributed photographs, pseudo-labelled by a teacher model (not published; the upstream NOTICE says the photographs were uploaded without consent obtained): UNKNOWN | input contract baked into the graph (static 1x3x640x640 RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather) and the output reshaped to the YOLOv8 layout (cx, cy, w, h, obj*cls); ONNX fp32, OpenVINO IR fp16, CoreML fp16 (scripts/build-yolox-plate-model.py) | mirror `plateDetection/yolox-tiny-plate` |
+| `yolox-tiny-plate` (default) | [open-lpr models (faisalthaheem/open-lpr-models), YOLOX-tiny](https://huggingface.co/faisalthaheem/open-lpr-models) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | Simanno annotated plate corpus plus community-contributed photographs, pseudo-labelled by a teacher model (not published; the upstream NOTICE says the photographs were uploaded without consent obtained): UNKNOWN | input contract baked into the graph (static 1x3x640x640 RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather) and the output reshaped to the YOLOv8 layout (cx, cy, w, h, obj*cls); ONNX fp32, OpenVINO IR fp16, CoreML fp16 (scripts/build-yolox-plate-model.py); Edge TPU build: the Focus stem rewritten as the equivalent 6x6 stride-2 Conv with the input bake folded into it, the graph cut before the grid decode (raw per-stride head), full-integer int8 post-training quantisation calibrated on CamStack vehicle crops, compiled with edgetpu_compiler 14 (scripts/build-yolox-plate-edgetpu.py) | mirror `plateDetection/yolox-tiny-plate` |
 
 ### Licence plate reading
 

package/dist/api/addon-upload.js

@@ -35,7 +35,6 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getDeployStageRegistry = getDeployStageRegistry;
 exports.registerDeployBundleRoute = registerDeployBundleRoute;
-exports.hubBundleBaseUrl = hubBundleBaseUrl;
 exports.buildHubHttpSource = buildHubHttpSource;
 exports.registerAddonUploadRoute = registerAddonUploadRoute;
 const fs = __importStar(require("node:fs"));
@@ -94,9 +93,14 @@ function readMultipartTextField(fields, name) {
     const value = field.value;
     return typeof value === 'string' ? value : null;
 }
-/** Base URL agents pull staged deploy bundles from. */
-function hubBundleBaseUrl() {
-    return process.env['CAMSTACK_HUB_PUBLIC_URL'] ?? 'https://127.0.0.1:4443';
+/** Resolve the agent-facing base URL, turning a refusal into its reason. */
+async function resolveBaseUrlOrReason(resolve) {
+    try {
+        return { ok: true, baseUrl: await resolve() };
+    }
+    catch (err) {
+        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
 }
 function buildHubHttpSource(buffer, hubBaseUrl) {
     const staged = getDeployStageRegistry().stage(buffer);
@@ -109,6 +113,11 @@ function buildHubHttpSource(buffer, hubBaseUrl) {
     };
 }
 async function registerAddonUploadRoute(fastify, addonBridge, authService, moleculer, addonRegistry, addonPackageService, logger, 
+/**
+ * The base URL agents pull the staged bundle from — the `local-network`
+ * cap's cluster address (`hub-cluster-url.ts`), resolved per delivery.
+ */
+resolveClusterBaseUrl, 
 /**
  * Marks the "hub is writing to this node" window around every agent
  * delivery so the addon back-fill cannot mistake the roster gap a deploy
@@ -171,12 +180,11 @@ deliveryLedger) {
         // the hub AND broadcasts to every connected agent that can run any of
         // the package's addons (i.e. anything not marked hub-only). Any other
         // explicit `nodeId` value routes only to that agent via `$agent.deploy`.
-        const baseUrl = hubBundleBaseUrl();
         if (!nodeId || nodeId === 'hub') {
-            return installToHub(reply, addonBridge, addonRegistry, addonPackageService, moleculer, logger, data.filename, buffer, baseUrl, deliveryLedger);
+            return installToHub(reply, addonBridge, addonRegistry, addonPackageService, moleculer, logger, data.filename, buffer, resolveClusterBaseUrl, deliveryLedger);
         }
         const agentAddonId = addonIdHint ?? manifest.name;
-        return deployToAgent(reply, moleculer, logger, nodeId, agentAddonId, buffer, baseUrl, deliveryLedger);
+        return deployToAgent(reply, moleculer, logger, nodeId, agentAddonId, buffer, resolveClusterBaseUrl, deliveryLedger);
     });
 }
 /**
@@ -214,7 +222,7 @@ function packageHasAgentDeployable(addonsDir, packageName) {
  * without an agent restart. Agents that fail are reported per-node — one
  * unreachable agent must not block the others or the hub install.
  */
-async function propagateToAgents(moleculer, logger, packageName, buffer, hubBaseUrl, deliveryLedger) {
+async function propagateToAgents(moleculer, logger, packageName, buffer, resolveClusterBaseUrl, deliveryLedger) {
     const broker = moleculer.broker;
     const nodes = broker.registry?.getNodeList?.({ onlyAvailable: true }) ?? [];
     // Moleculer reports both top-level nodes (`hub`, `dev-agent-0`, …) AND
@@ -233,6 +241,13 @@ async function propagateToAgents(moleculer, logger, packageName, buffer, hubBase
     });
     if (agentNodeIds.length === 0)
         return [];
+    const hubBaseUrl = await resolveBaseUrlOrReason(resolveClusterBaseUrl);
+    if (!hubBaseUrl.ok) {
+        logger.error('propagate: no hub address an agent can reach — nothing delivered', {
+            meta: { packageName, targetAgents: agentNodeIds, error: hubBaseUrl.error },
+        });
+        return agentNodeIds.map((nodeId) => ({ nodeId, success: false, error: hubBaseUrl.error }));
+    }
     const results = [];
     for (const nodeId of agentNodeIds) {
         // The hub currently only ever sends the `hub-http` source (agent streams
@@ -246,7 +261,7 @@ async function propagateToAgents(moleculer, logger, packageName, buffer, hubBase
             logger,
             nodeId,
             packageName,
-            source: buildHubHttpSource(buffer, hubBaseUrl),
+            source: buildHubHttpSource(buffer, hubBaseUrl.baseUrl),
             ...(deliveryLedger === undefined ? {} : { deliveryLedger }),
         }));
     }
@@ -261,7 +276,7 @@ async function propagateToAgents(moleculer, logger, packageName, buffer, hubBase
  * Without this the CLI push was write-to-disk-only and required a server
  * restart to actually run the new code.
  */
-async function installToHub(reply, addonBridge, addonRegistry, addonPackageService, moleculer, logger, filename, buffer, hubBaseUrl, deliveryLedger) {
+async function installToHub(reply, addonBridge, addonRegistry, addonPackageService, moleculer, logger, filename, buffer, resolveClusterBaseUrl, deliveryLedger) {
     const tmpDir = path.join(os.tmpdir(), `camstack-addon-upload-${Date.now()}`);
     fs.mkdirSync(tmpDir, { recursive: true });
     const tgzPath = path.join(tmpDir, filename);
@@ -386,7 +401,7 @@ async function installToHub(reply, addonBridge, addonRegistry, addonPackageServi
             });
         }
         if (propagatable) {
-            void propagateToAgents(moleculer, logger, result.name, buffer, hubBaseUrl, deliveryLedger).then((agentResults) => {
+            void propagateToAgents(moleculer, logger, result.name, buffer, resolveClusterBaseUrl, deliveryLedger).then((agentResults) => {
                 logger.info('propagation done', {
                     meta: { packageName: result.name, agents: agentResults },
                 });
@@ -417,7 +432,14 @@ async function installToHub(reply, addonBridge, addonRegistry, addonPackageServi
  * evidence. The response now carries what was reloaded and what was verified,
  * so the CLI can print facts instead of a bare tick.
  */
-async function deployToAgent(reply, moleculer, logger, nodeId, addonId, buffer, hubBaseUrl, deliveryLedger) {
+async function deployToAgent(reply, moleculer, logger, nodeId, addonId, buffer, resolveClusterBaseUrl, deliveryLedger) {
+    const hubBaseUrl = await resolveBaseUrlOrReason(resolveClusterBaseUrl);
+    if (!hubBaseUrl.ok) {
+        logger.error('agent deploy: no hub address the agent can reach — nothing delivered', {
+            meta: { nodeId, addonId, error: hubBaseUrl.error },
+        });
+        return reply.status(502).send({ error: `Agent deploy failed: ${hubBaseUrl.error}` });
+    }
     // The hub currently only ever sends the `hub-http` source (agent streams the
     // tgz directly from this hub). The `{kind:'npm'}` source is a reserved
     // follow-up (published-addon optimization) and is intentionally not produced
@@ -429,7 +451,7 @@ async function deployToAgent(reply, moleculer, logger, nodeId, addonId, buffer,
         logger,
         nodeId,
         packageName: addonId,
-        source: buildHubHttpSource(buffer, hubBaseUrl),
+        source: buildHubHttpSource(buffer, hubBaseUrl.baseUrl),
         ...(deliveryLedger === undefined ? {} : { deliveryLedger }),
     });
     if (!result.success) {

package/dist/api/cors/cors-policy.js

@@ -18,8 +18,9 @@
  *  - {@link OPAQUE_ORIGIN} (`null`): the native app's OTA-bundled embed is a
  *    `file://` page inside a WKWebView, whose origin is opaque. Removing it
  *    breaks live view on iOS;
- *  - `CAMSTACK_HUB_PUBLIC_URL`, when set, and the operator's extras
- *    (`server.corsOrigins` in config.yaml / `CAMSTACK_CORS_ORIGINS`).
+ *  - the operator's extras (`server.corsOrigins` in config.yaml /
+ *    `CAMSTACK_CORS_ORIGINS`). The hub's own public address needs no entry:
+ *    a browser on it is the `own-host` case above.
  *
  * The answer to an allowed origin REFLECTS it exactly — never `*` — and never
  * carries `Access-Control-Allow-Credentials`. The cross-origin viewer
@@ -111,13 +112,9 @@ function parseConfiguredOrigins(value) {
     }
     return { origins, rejected };
 }
-/** The built-in entries plus the optional public origin. */
-function builtInOrigins(publicOrigin) {
-    const entries = [exports.VIEWER_PWA_ORIGIN, exports.OPAQUE_ORIGIN];
-    const pub = publicOrigin !== undefined ? normalizeOrigin(publicOrigin) : null;
-    if (pub !== null && pub !== exports.OPAQUE_ORIGIN)
-        entries.push(pub);
-    return entries;
+/** The built-in entries. */
+function builtInOrigins() {
+    return [exports.VIEWER_PWA_ORIGIN, exports.OPAQUE_ORIGIN];
 }
 /** The first value of a possibly comma-joined forwarding header, lower case. */
 function firstHost(value) {

package/dist/api/cors/register-cors-policy.js

@@ -19,7 +19,7 @@ function varyText(value) {
     return undefined;
 }
 function createCorsPolicy(deps) {
-    const builtIns = (0, cors_policy_js_1.builtInOrigins)(deps.publicOrigin);
+    const builtIns = (0, cors_policy_js_1.builtInOrigins)();
     let lastConfigured = Symbol('unset');
     let listed = new Set(builtIns);
     const loggedDenials = new Set();

package/dist/api/hub-cluster-url.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HubAddressUnavailableError = void 0;
+exports.resolveHubBaseUrl = resolveHubBaseUrl;
+exports.clusterBaseUrlResolver = clusterBaseUrlResolver;
+/** Thrown when the hub cannot name an address `audience` can reach. */
+class HubAddressUnavailableError extends Error {
+    audience;
+    reason;
+    constructor(audience, reason) {
+        super(reason === 'local-network-unavailable'
+            ? `cannot name this hub's ${audience} address: the local-network capability is not available yet`
+            : `cannot name this hub's ${audience} address: Network lists no reachable LAN address ` +
+                '(set the hub address in Settings → Network, or check the allowed addresses)');
+        this.audience = audience;
+        this.reason = reason;
+        this.name = 'HubAddressUnavailableError';
+    }
+}
+exports.HubAddressUnavailableError = HubAddressUnavailableError;
+/**
+ * Resolve the hub's base URL for `audience` from the live provider. Called per
+ * delivery — interfaces and the allowlist move, and a deploy is rare enough
+ * that a cache would only add a way to be stale.
+ */
+async function resolveHubBaseUrl(getSource, audience) {
+    const source = getSource();
+    if (source === null)
+        throw new HubAddressUnavailableError(audience, 'local-network-unavailable');
+    const baseUrl = (await source.getHubAddresses())[audience].resolved;
+    if (baseUrl === null)
+        throw new HubAddressUnavailableError(audience, 'no-reachable-endpoint');
+    return baseUrl;
+}
+function clusterBaseUrlResolver(getSource) {
+    return () => resolveHubBaseUrl(getSource, 'cluster');
+}

package/dist/api/model-distributor.js

@@ -36,18 +36,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.tarModelFiles = tarModelFiles;
 exports.distributeModelWith = distributeModelWith;
 exports.buildModelDistributorProvider = buildModelDistributorProvider;
+const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
-const node_child_process_1 = require("node:child_process");
 const system_1 = require("@camstack/system");
 const addon_upload_js_1 = require("./addon-upload.js");
 const AGENT_DISTRIBUTE_TIMEOUT_MS = 60_000;
 function hubModelsDir() {
     return path.join(process.env['CAMSTACK_DATA'] ?? 'camstack-data', 'models');
 }
-function hubBundleBaseUrl() {
-    return process.env['CAMSTACK_HUB_PUBLIC_URL'] ?? 'https://127.0.0.1:4443';
-}
 /**
  * `tar -czf -` the given files relative to `cwd`, buffering the gzip stream.
  * Async (spawn, not execFileSync) so a large model doesn't block the event
@@ -87,7 +84,7 @@ async function distributeModelWith(seam, input) {
         throw new Error(`model ${modelId}/${format} resolved no files to distribute`);
     }
     const tgz = await seam.tar(files);
-    const source = seam.stage(tgz);
+    const source = await seam.stage(tgz);
     const res = await seam.callAgent(targetNodeId, { modelId, format, source });
     return { ok: true, sha256: source.sha256, bytes: source.bytes, path: res.path ?? '' };
 }
@@ -97,7 +94,9 @@ async function distributeModelWith(seam, input) {
  * Moleculer broker + the deploy-stage registry, which a forked addon can't
  * reach.
  */
-function buildModelDistributorProvider(moleculer, loggingService) {
+function buildModelDistributorProvider(moleculer, loggingService, 
+/** The `local-network` cap's cluster address (`hub-cluster-url.ts`). */
+resolveClusterBaseUrl) {
     const logger = loggingService.createLogger('model-distributor');
     const modelsDir = hubModelsDir();
     const seam = {
@@ -105,7 +104,7 @@ function buildModelDistributorProvider(moleculer, loggingService) {
         isPresent: (entry, format) => (0, system_1.isModelDownloaded)(modelsDir, entry, format),
         fileExists: (rel) => fs.existsSync(path.join(modelsDir, rel)),
         tar: (files) => tarModelFiles(modelsDir, files),
-        stage: (buffer) => (0, addon_upload_js_1.buildHubHttpSource)(buffer, hubBundleBaseUrl()),
+        stage: async (buffer) => (0, addon_upload_js_1.buildHubHttpSource)(buffer, await resolveClusterBaseUrl()),
         callAgent: async (nodeId, payload) => {
             const broker = moleculer?.broker;
             if (!broker)

package/dist/api/oauth2/oauth2-routes.js

@@ -463,7 +463,7 @@ function registerOauth2Routes(fastify, deps) {
             // external-access endpoint surfaced by a forked exporter addon) so the
             // claim the cloud Lambda routes back on is the reachable public URL, not
             // the hub-global fallback (which defaults to localhost in dev).
-            hubUrl: descriptor.hubUrl ?? deps.publicHubUrl(),
+            hubUrl: descriptor.hubUrl ?? (await deps.publicHubUrl()),
             ...(v.codeChallenge !== '' ? { codeChallenge: v.codeChallenge } : {}),
             // The integration declares its own refresh lifetime; omitting the field
             // keeps the 30-day default. Baked in HERE, at consent, so the link the

package/dist/api/trpc/generated-cap-routers.js

@@ -4912,6 +4912,22 @@ function createCapRouter_localNetwork(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.setViewerEndpoints(methodInput);
         }),
+        getHubAddresses: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
+            .output(types_65.localNetworkCapability.methods.getHubAddresses.output)
+            .query(async ({ input, ctx }) => {
+            const p = resolveProvider('local-network', input?.nodeId, () => getProvider(ctx), createRemoteProxy);
+            return p.getHubAddresses();
+        }),
+        setHubAddress: trpc_middleware_js_1.adminProcedure
+            .input(types_65.localNetworkCapability.methods.setHubAddress.input.loose())
+            .output(types_65.localNetworkCapability.methods.setHubAddress.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('local-network', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.setHubAddress(methodInput);
+        }),
         getAllowedAddresses: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
             .output(types_65.localNetworkCapability.methods.getAllowedAddresses.output)

package/dist/boot/boot-config.js

@@ -38,6 +38,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ignoredTlsCertSources = ignoredTlsCertSources;
 exports.loadBootstrapConfig = loadBootstrapConfig;
 exports.autoGenerateJwtSecret = autoGenerateJwtSecret;
 exports.setupInfra = setupInfra;
@@ -67,9 +68,15 @@ const ENV_VAR_MAP = {
     CAMSTACK_ADMIN_USER: 'auth.adminUsername',
     CAMSTACK_ADMIN_PASS: 'auth.adminPassword',
     CAMSTACK_TLS_ENABLED: 'tls.enabled',
-    CAMSTACK_TLS_CERT: 'tls.certPath',
-    CAMSTACK_TLS_KEY: 'tls.keyPath',
 };
+/**
+ * Env variables that once set the node's certificate. Ignored since D726:
+ * the admin UI (Network → Local access) is the one way to set it. Still
+ * named here so a node that has them set is told, not silently re-keyed.
+ */
+const IGNORED_TLS_CERT_ENV = ['CAMSTACK_TLS_CERT', 'CAMSTACK_TLS_KEY'];
+/** The `config.yaml` keys those variables were mapped onto — ignored too. */
+const IGNORED_TLS_CERT_KEYS = ['certPath', 'keyPath'];
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -82,6 +89,20 @@ function setNested(obj, p, value) {
     const child = (0, types_1.asJsonObject)(obj[head]) ?? {};
     return { ...obj, [head]: setNested(child, rest.join('.'), value) };
 }
+/**
+ * Every env variable and `config.yaml` key that would once have set the
+ * certificate and is now ignored (D726). Blank env values count as unset,
+ * exactly as the override loop treats them.
+ */
+function ignoredTlsCertSources(env, raw) {
+    const fromEnv = IGNORED_TLS_CERT_ENV.filter((name) => {
+        const value = env[name];
+        return value !== undefined && value !== '';
+    });
+    const tls = (0, types_1.asJsonObject)(raw['tls']) ?? {};
+    const fromYaml = IGNORED_TLS_CERT_KEYS.filter((key) => tls[key] !== undefined).map((key) => `tls.${key}`);
+    return [...fromEnv, ...fromYaml];
+}
 // ---------------------------------------------------------------------------
 // loadBootstrapConfig
 // ---------------------------------------------------------------------------
@@ -145,6 +166,11 @@ function loadBootstrapConfig(configPath) {
         raw = setNested(raw, configPath_, coerced);
         console.log(`[Phase1] Env override: ${envKey} → ${configPath_}`);
     }
+    const ignored = ignoredTlsCertSources(process.env, raw);
+    if (ignored.length > 0) {
+        console.warn(`[Phase1] WARN ${ignored.join(', ')} ignored — the certificate is set only in the admin UI. ` +
+            'Upload the certificate in Network → Local access (D726).');
+    }
     return config_schema_1.bootstrapSchema.parse(raw);
 }
 // ---------------------------------------------------------------------------
@@ -210,22 +236,21 @@ async function setupInfra(configPath, bootstrapConfig) {
         // broken chunks with require("fs") when leaked .js files exist in core/src/.
         // CJS build works correctly and tsx supports require().
         const core = require('@camstack/system');
-        const { ensureTlsCert, loadTlsCert } = core;
-        if (config.tls.certPath && config.tls.keyPath) {
-            // User-provided cert
-            console.log(`[Phase2c] Loading custom TLS cert from ${config.tls.certPath}`);
-            const pair = loadTlsCert(config.tls.certPath, config.tls.keyPath);
-            tlsOptions = { key: pair.key, cert: pair.cert };
+        // The certificate comes only from the admin UI (D726): the generated
+        // local CA → leaf (D227), or an operator upload served verbatim.
+        const extraSans = [...core.readExtraSans(dataPath)];
+        const boot = await core.prepareBootTls(dataPath, extraSans.length > 0 ? { extraSans } : undefined);
+        if (boot.uploadedMissing) {
+            console.warn(`[Phase2c] WARN the uploaded TLS certificate is missing from ${path.join(dataPath, 'tls')} — serving the generated one. Upload it again in Network → Local access.`);
+        }
+        if (boot.ensured !== undefined) {
+            tlsCert = boot.ensured;
+            logTlsCert(boot.ensured);
         }
         else {
-            // Hub-generated local CA → leaf (D227)
-            const extraSans = [...(core.readExtraSans?.(dataPath) ?? [])];
-            const tlsResult = await ensureTlsCert(dataPath, extraSans.length > 0 ? { extraSans } : undefined);
-            tlsCert = tlsResult;
-            logTlsCert(tlsResult);
-            const pair = loadTlsCert(tlsResult.certPath, tlsResult.keyPath);
-            tlsOptions = { key: pair.key, cert: pair.cert };
+            console.log(`[Phase2c] Serving the uploaded TLS certificate from ${path.join(dataPath, 'tls')}`);
         }
+        tlsOptions = { key: boot.pair.key, cert: boot.pair.cert };
     }
     return {
         bootstrapConfig: config,

package/dist/boot/retired-public-url-env.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * The hub's address is not an environment variable.
+ *
+ * `CAMSTACK_HUB_PUBLIC_URL` (and its older alias `CAMSTACK_PUBLIC_ORIGIN`)
+ * restated something the hub already knows: its interfaces, its listen port,
+ * the operator's allowlist, its tunnel and mesh names — the `local-network`
+ * capability, shown and edited on the admin Network page. A hub without the
+ * variable (every Mac hub: the desktop app has no field for it) handed agents
+ * `https://127.0.0.1:4443`, which names the agent, and every addon and model
+ * pull to an agent failed. Every reader now asks `local-network`
+ * (`pickHubBaseUrl`); nothing reads the variables.
+ *
+ * A container that still sets one gets a WARN on every boot naming it as
+ * ignored, and the variable is removed from this process's environment before
+ * any addon runner is forked — so no child can grow a new reader of it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RETIRED_HUB_ADDRESS_ENVS = void 0;
+exports.dropRetiredHubAddressEnv = dropRetiredHubAddressEnv;
+/** Variables that used to name the hub's address; all ignored now. */
+exports.RETIRED_HUB_ADDRESS_ENVS = [
+    'CAMSTACK_HUB_PUBLIC_URL',
+    'CAMSTACK_PUBLIC_ORIGIN',
+];
+/**
+ * Remove every retired address variable from `env` and return the warning to
+ * log once a logger exists, or `undefined` when none was set.
+ */
+function dropRetiredHubAddressEnv(env) {
+    const present = exports.RETIRED_HUB_ADDRESS_ENVS.filter((name) => {
+        const value = env[name];
+        return value !== undefined && value.trim() !== '';
+    });
+    for (const name of exports.RETIRED_HUB_ADDRESS_ENVS)
+        delete env[name];
+    if (present.length === 0)
+        return undefined;
+    return (`${present.join(' and ')} ${present.length === 1 ? 'is' : 'are'} ignored — the hub address ` +
+        'comes from Network (Settings → Network). Remove it from this container.');
+}

package/dist/first-boot-addon-plan.js

@@ -55,7 +55,7 @@ function decide(pkg, installed, closureVersions, closureProvided) {
             installedVersion: version,
             closureVersion,
             twoVersions: false,
-            reason: 'provided by the server closure — a copy here would shadow it (D15)',
+            reason: 'provided by the server closure — a copy here would shadow it',
         };
     }
     if (version === null) {
@@ -78,7 +78,7 @@ function decide(pkg, installed, closureVersions, closureProvided) {
         closureVersion,
         twoVersions,
         reason: twoVersions
-            ? `installed ${version}; this closure carries ${closureVersion} — the installed copy is what runs (D90)`
+            ? `installed ${version}; this closure carries ${closureVersion} — the installed copy is what runs`
             : `installed ${version} — kept`,
     };
 }

package/dist/main.js

@@ -40,6 +40,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const node_tls_1 = require("node:tls");
 // Boot-time capability declaration runs over the auto-generated
 // `ALL_CAPABILITY_DEFINITIONS` array — every `*.cap.ts` file that ships
 // with `@camstack/types` is included automatically. Adding a new cap
@@ -65,6 +66,7 @@ const request_census_settings_1 = require("./api/core/request-census-settings");
 const register_cors_policy_1 = require("./api/cors/register-cors-policy");
 const adaptive_probe_routes_1 = require("./api/health/adaptive-probe.routes");
 const health_routes_1 = require("./api/health/health.routes");
+const hub_cluster_url_1 = require("./api/hub-cluster-url");
 const model_distributor_js_1 = require("./api/model-distributor.js");
 const oauth2_routes_js_1 = require("./api/oauth2/oauth2-routes.js");
 const server_upload_1 = require("./api/server-upload");
@@ -89,9 +91,9 @@ const session_cookie_js_1 = require("./auth/session-cookie.js");
 const session_mint_js_1 = require("./auth/session-mint.js");
 const sso_finish_js_1 = require("./auth/sso-finish.js");
 const boot_config_1 = require("./boot/boot-config");
-const public_url_1 = require("./boot/public-url");
 const integration_id_backfill_1 = require("./boot/integration-id-backfill");
 const post_boot_service_1 = require("./boot/post-boot.service");
+const retired_public_url_env_1 = require("./boot/retired-public-url-env");
 const addon_package_service_1 = require("./core/addon/addon-package.service");
 const addon_registry_service_1 = require("./core/addon/addon-registry.service");
 const addon_bridge_service_1 = require("./core/addon-bridge/addon-bridge.service");
@@ -241,11 +243,11 @@ async function sendMaybePrecompressed(reply, absolutePath, acceptEncoding) {
 }
 // ---- Bootstrap ----
 async function bootstrap() {
-    // ONE public-URL variable (CAMSTACK_HUB_PUBLIC_URL). The retired
-    // CAMSTACK_PUBLIC_ORIGIN is folded into it here — before any addon runner is
-    // forked, so every child inherits one name — and warned about once a logger
-    // exists (below). See `boot/public-url.ts`.
-    const publicUrlWarning = (0, public_url_1.applyHubPublicUrl)(process.env);
+    // The hub's address comes from the `local-network` cap, never from env. A
+    // retired address variable is dropped here — before any addon runner is
+    // forked, so no child can read it — and warned about once a logger exists
+    // (below). See `boot/retired-public-url-env.ts`.
+    const publicUrlWarning = (0, retired_public_url_env_1.dropRetiredHubAddressEnv)(process.env);
     // hub-main's own memory, on the record. Deliberately started HERE and not in
     // the starter: the starter runs from the image's /opt closure, which only
     // changes with a new image, while this entry is what `applyServerUpdate`
@@ -364,7 +366,6 @@ async function bootstrap() {
     const corsConfig = app.get(config_service_1.ConfigService);
     const corsPolicy = (0, register_cors_policy_1.createCorsPolicy)({
         configuredOrigins: () => corsConfig.get('server.corsOrigins'),
-        publicOrigin: process.env[public_url_1.HUB_PUBLIC_URL_ENV],
         logger: app.get(logging_service_1.LoggingService).createLogger('cors'),
     });
     (0, register_cors_policy_1.registerCorsPolicy)(fastify, corsPolicy);
@@ -411,7 +412,9 @@ async function bootstrap() {
         // The delivery ledger marks "the hub is writing addons to this node" for
         // the whole deploy+reload, so the addon back-fill cannot read the roster
         // gap a deploy opens and repair the node over the bytes just shipped.
-        await (0, addon_upload_1.registerAddonUploadRoute)(fastify, uploadAddonBridge, uploadAuthService, uploadMoleculer, uploadAddonRegistry, uploadAddonPackage, uploadLogger, app.get(agent_registry_service_1.AgentRegistryService).deliveryLedger);
+        await (0, addon_upload_1.registerAddonUploadRoute)(fastify, uploadAddonBridge, uploadAuthService, uploadMoleculer, uploadAddonRegistry, uploadAddonPackage, uploadLogger, (0, hub_cluster_url_1.clusterBaseUrlResolver)(() => uploadAddonRegistry
+            .getCapabilityRegistry()
+            .getSingleton('local-network')), app.get(agent_registry_service_1.AgentRegistryService).deliveryLedger);
         console.log('[bootstrap] Addon upload route registered at POST /api/addons/upload');
         // Dev server-deploy channel gateway (`camstack deploy-server`). MUST be
         // registered AFTER registerAddonUploadRoute — it reuses the multipart
@@ -591,7 +594,7 @@ async function bootstrap() {
     // router) so forked addons (addon-model-studio) can reach it via `ctx.api`,
     // not only external HTTP clients. Needs the broker + the deploy-stage
     // registry, which an addon can't access.
-    capabilityRegistry.registerProvider('model-distributor', '$hub', (0, model_distributor_js_1.buildModelDistributorProvider)(moleculer, loggingService));
+    capabilityRegistry.registerProvider('model-distributor', '$hub', (0, model_distributor_js_1.buildModelDistributorProvider)(moleculer, loggingService, (0, hub_cluster_url_1.clusterBaseUrlResolver)(() => capabilityRegistry.getSingleton('local-network'))));
     // ── Health routes (hub self + agent forwarding) ──────────────────
     // Registered after app.init() so the AgentRegistryService is wired and
     // the Moleculer broker is ready to forward `$agent.health` calls.
@@ -1116,7 +1119,10 @@ async function bootstrap() {
         (0, oauth2_routes_js_1.registerOauth2Routes)(fastify, {
             getRegistry: () => capabilityRegistry,
             verifyToken: (t) => authService.verifyToken(t),
-            publicHubUrl: () => process.env[public_url_1.HUB_PUBLIC_URL_ENV] ?? `https://localhost:${port}`,
+            // The hub's browser-facing address from the `local-network` cap (tunnel,
+            // then mesh, then LAN). `localhost` only when the palette names nothing —
+            // the dev case, where it is the truth.
+            publicHubUrl: () => (0, hub_cluster_url_1.resolveHubBaseUrl)(() => capabilityRegistry.getSingleton('local-network'), 'browser').catch(() => `https://localhost:${port}`),
             // Every /authorize refusal is a dropped account-linking attempt. Without
             // this scope the drop is invisible in Loki and the only signal left is an
             // operator noticing that linking stopped working.
@@ -1489,6 +1495,17 @@ async function bootstrap() {
     const logger = app.get(logging_service_1.LoggingService).createLogger('System');
     const protocol = tlsOptions ? 'https' : 'http';
     logger.info('CamStack server listening', { meta: { protocol, host, port, trpcRegistered } });
+    // Certificate actions (Network → Local access) swap the served certificate
+    // in place through this registration — without it an upload sat on disk
+    // while the listener kept serving the boot-time leaf (D726).
+    if (tlsOptions) {
+        if (fastify.server instanceof node_tls_1.Server) {
+            (0, system_1.registerHttpsListener)(fastify.server, tlsOptions);
+        }
+        else {
+            logger.warn('HTTPS listener is not a TLS server — certificate changes need a restart');
+        }
+    }
     // LAN HTTP sibling — same Fastify request graph, dedicated port. Handler
     // is registered as soon as we have the instance; bind happens after HTTPS
     // is up so a failed HTTPS listen does not leave HTTP serving alone.

package/dist/manual-boot.js

@@ -51,6 +51,7 @@ const types_1 = require("@camstack/types");
 const fastify_1 = __importDefault(require("fastify"));
 const addon_upload_1 = require("./api/addon-upload");
 const cap_providers_1 = require("./api/core/cap-providers");
+const hub_cluster_url_1 = require("./api/hub-cluster-url");
 const init_sequence_1 = require("./boot/init-sequence");
 const post_boot_service_1 = require("./boot/post-boot.service");
 const addon_package_service_1 = require("./core/addon/addon-package.service");
@@ -184,6 +185,11 @@ async function bootManual(opts) {
     // reverted ~1.5s later and read as a stale dist. See `packInstalledPackage`.
     // Delivery is an RPC pair, never an event (D8/D11).
     const backfillLogger = loggingService.createLogger('agent-backfill');
+    // Where the agent pulls the bundle from: the hub's own cluster address, from
+    // the `local-network` cap — never an env var, never loopback.
+    const resolveClusterBaseUrl = (0, hub_cluster_url_1.clusterBaseUrlResolver)(() => addonRegistryService
+        .getCapabilityRegistry()
+        .getSingleton('local-network'));
     agentRegistryService.setAddonBackfill({
         pack: async (name, version) => {
             const installed = await addonPackageService.packInstalledPackage(name);
@@ -200,7 +206,7 @@ async function bootManual(opts) {
             return (installed ?? (await addonPackageService.packPackage(name, version))).buffer;
         },
         deploy: async (nodeId, packageName, bundle) => {
-            await moleculerService.broker.call('$agent.deploy', { addonId: packageName, source: (0, addon_upload_1.buildHubHttpSource)(bundle, (0, addon_upload_1.hubBundleBaseUrl)()) }, { nodeID: nodeId, timeout: agent_registry_service_1.AGENT_BACKFILL_RPC_TIMEOUT_MS });
+            await moleculerService.broker.call('$agent.deploy', { addonId: packageName, source: (0, addon_upload_1.buildHubHttpSource)(bundle, await resolveClusterBaseUrl()) }, { nodeID: nodeId, timeout: agent_registry_service_1.AGENT_BACKFILL_RPC_TIMEOUT_MS });
         },
         reload: async (nodeId) => {
             await moleculerService.broker.call('$agent.reload', {}, { nodeID: nodeId, timeout: agent_registry_service_1.AGENT_BACKFILL_RPC_TIMEOUT_MS });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.459",
+  "version": "1.2.461",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.333",
-    "@camstack/addon-agent-ui": "1.2.175",
-    "@camstack/addon-auth": "1.2.127",
+    "@camstack/addon-admin-ui": "1.2.335",
+    "@camstack/addon-agent-ui": "1.2.177",
+    "@camstack/addon-auth": "1.2.128",
     "@camstack/addon-decoder-nodeav": "1.2.119",
     "@camstack/addon-notifiers": "1.2.128",
-    "@camstack/addon-pipeline": "1.2.328",
-    "@camstack/addon-pipeline-orchestrator": "1.2.283",
-    "@camstack/addon-post-analysis": "1.2.335",
+    "@camstack/addon-pipeline": "1.2.330",
+    "@camstack/addon-pipeline-orchestrator": "1.2.285",
+    "@camstack/addon-post-analysis": "1.2.337",
     "@camstack/sdk": "1.2.122",
-    "@camstack/system": "1.2.356",
-    "@camstack/types": "1.2.307",
-    "@camstack/ui-library": "1.2.233",
+    "@camstack/system": "1.2.358",
+    "@camstack/types": "1.2.309",
+    "@camstack/ui-library": "1.2.235",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",

package/dist/boot/public-url.js

@@ -1,67 +0,0 @@
-"use strict";
-/**
- * The hub's public URL — ONE environment variable, resolved once at boot.
- *
- * Two names used to answer the same question ("at which address do clients
- * reach this hub?"): `CAMSTACK_HUB_PUBLIC_URL` (addon bundle and model
- * distribution, notification links, the Dreame RFC host) and
- * `CAMSTACK_PUBLIC_ORIGIN` (magic-link, OIDC callback, WebAuthn relying party,
- * the OAuth2 issuer and the CORS allowlist, D707). An operator who set one got
- * half a configured hub and no line saying so.
- *
- * `CAMSTACK_HUB_PUBLIC_URL` is the survivor. `CAMSTACK_PUBLIC_ORIGIN` is still
- * accepted, for hubs that already set it, and costs a WARN on every boot until
- * it is renamed. The resolution writes the survivor back into `process.env`
- * and deletes the retired name, so every forked addon runner — which inherits
- * this process's environment — reads exactly one variable.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RETIRED_PUBLIC_ORIGIN_ENV = exports.HUB_PUBLIC_URL_ENV = void 0;
-exports.resolveHubPublicUrl = resolveHubPublicUrl;
-exports.applyHubPublicUrl = applyHubPublicUrl;
-/** The single public-URL variable every reader uses. */
-exports.HUB_PUBLIC_URL_ENV = 'CAMSTACK_HUB_PUBLIC_URL';
-/** Retired alias, accepted with a deprecation warning. */
-exports.RETIRED_PUBLIC_ORIGIN_ENV = 'CAMSTACK_PUBLIC_ORIGIN';
-function readTrimmed(env, name) {
-    const raw = env[name]?.trim();
-    if (raw === undefined || raw === '')
-        return undefined;
-    return raw.replace(/\/+$/, '');
-}
-/** Pure: which URL wins, and what to warn about. */
-function resolveHubPublicUrl(env) {
-    const current = readTrimmed(env, exports.HUB_PUBLIC_URL_ENV);
-    const retired = readTrimmed(env, exports.RETIRED_PUBLIC_ORIGIN_ENV);
-    if (retired === undefined)
-        return { url: current, warning: undefined };
-    if (current === undefined) {
-        return {
-            url: retired,
-            warning: `${exports.RETIRED_PUBLIC_ORIGIN_ENV} is deprecated and was read as ${exports.HUB_PUBLIC_URL_ENV}=${retired}. ` +
-                `Rename it to ${exports.HUB_PUBLIC_URL_ENV}; the old name will stop being read in a future release.`,
-        };
-    }
-    const disagree = current !== retired;
-    return {
-        url: current,
-        warning: `${exports.RETIRED_PUBLIC_ORIGIN_ENV} is deprecated and IGNORED because ${exports.HUB_PUBLIC_URL_ENV} is set` +
-            (disagree ? ` (${current} wins over ${retired})` : '') +
-            `. Remove ${exports.RETIRED_PUBLIC_ORIGIN_ENV} from this container.`,
-    };
-}
-/**
- * Apply the resolution to a process environment: the survivor is set (or left
- * unset), the retired name is removed. Returns the warning to log once a
- * logger exists. Called once, first thing in the hub's bootstrap, before any
- * addon runner is forked.
- */
-function applyHubPublicUrl(env) {
-    const { url, warning } = resolveHubPublicUrl(env);
-    if (url === undefined)
-        delete env[exports.HUB_PUBLIC_URL_ENV];
-    else
-        env[exports.HUB_PUBLIC_URL_ENV] = url;
-    delete env[exports.RETIRED_PUBLIC_ORIGIN_ENV];
-    return warning;
-}