@camstack/system 1.2.113 → 1.2.114

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, v as addonPagesCapability, vt as errMsg, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { Gt as EventCategory, v as addonPagesCapability, vt as errMsg, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, b as addonWidgetsCapability, vt as errMsg, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { Gt as EventCategory, b as addonWidgetsCapability, vt as errMsg, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, n as AlertSchema, vt as errMsg, x as alertsCapability, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { Gt as EventCategory, Mt as createEvent, n as AlertSchema, vt as errMsg, x as alertsCapability, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { C as backupCapability, Gt as EventCategory, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { C as backupCapability, Gt as EventCategory, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, vt as errMsg, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, vt as errMsg, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-CYDGGkyM.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-B52KsNz8.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-Duz_uJSQ.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-BtVT2f6O.mjs";
+import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-CJ8RRSvQ.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-C1efPfyW.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { G as isSameAddonId, Gt as EventCategory, I as doorbellCapability, Mt as createEvent, Tt as DeviceType, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { G as isSameAddonId, Gt as EventCategory, I as doorbellCapability, Mt as createEvent, Tt as DeviceType, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, vt as errMsg, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { Gt as EventCategory, Mt as createEvent, vt as errMsg, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.d.ts

@@ -1,4 +1,4 @@
-import { ProviderRegistration, LocalInterface, ConnectionEndpoint, BaseAddon } from '@camstack/types';
+import { ProviderRegistration, LocalInterface, ConnectionEndpoint, AdvertisedLocalPort, BaseAddon } from '@camstack/types';
 /**
  * Cached mesh-reachable endpoint, learned from the `mesh-network`
  * provider via the `MeshNetworkChanged` event-tail + pull-reconcile.
@@ -10,6 +10,15 @@ interface MeshEndpointCache {
     /** Hub HTTPS port the mesh endpoint targets. */
     readonly port: number;
 }
+/** The three places a hub listen port can be learned, most authoritative first. */
+export interface ListenPortSources {
+    /** `server.port` from the hub's live config section; null when unreadable. */
+    readonly configured: number | null;
+    /** `CAMSTACK_PORT` off the environment; null when unset / unparseable. */
+    readonly env: number | null;
+    /** The port the CALLER passed. A guess about our socket, not a fact. */
+    readonly callerHint: number | null;
+}
 interface LocalNetworkConfig {
     /** Empty = "auto" (every non-loopback / non-link-local address
      *  participates). Non-empty restricts the candidate set to only
@@ -77,9 +86,32 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
      * not joined simply contributes nothing.
      */
     private reconcileMeshEndpoint;
+    /**
+     * The port this hub is actually listening on, plus the provenance of the
+     * number. The boot loader merges the `CAMSTACK_PORT` env override into the
+     * persisted `server` section (`server/backend/src/boot/boot-config.ts`), so
+     * reading that section gives the authoritative live port — no new setting,
+     * and the same source `tailscale-client` already stamps its mesh endpoints
+     * from, so the two cannot drift.
+     */
+    private resolveAdvertisedListenPort;
+    /** `server.port` from the live config section, or null when unreadable. */
+    private readConfiguredPort;
     private enumerate;
     private detectChanges;
 }
+/**
+ * Pick the port to advertise, and say where it came from.
+ *
+ * The caller's hint ranks BELOW everything the hub knows about itself and above
+ * nothing but the compiled default — it is kept only so a client written
+ * against the old echoing contract behaves exactly as it did before, and it is
+ * labelled `caller-hint` so that client's successor can refuse to trust it.
+ * Values outside the valid port range are dropped rather than advertised: a
+ * malformed `server.port` must fall through to the next source, not produce a
+ * URL nothing can bind.
+ */
+export declare function resolveAdvertisedPort(sources: ListenPortSources): AdvertisedLocalPort;
 /**
  * Lift `os.networkInterfaces()` into our `LocalInterface[]` shape with
  * kind classification + preferred flag. Pure — takes the raw result so

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts
@@ -28,6 +28,12 @@ node_os = require_chunk.__toESM(node_os);
 */
 var MESH_PROVIDER_ADDON_IDS = ["tailscale-client"];
 var POLL_INTERVAL_MS = 3e4;
+/**
+* Compiled-in boot default — mirrors `CONFIG_DEFAULTS.server.port` in
+* `server/backend/src/boot/boot-config.ts`. Used only when neither the live
+* config section, the env, nor the caller says anything.
+*/
+var DEFAULT_HUB_PORT = 4443;
 var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	pollTimer = null;
 	lastSnapshotKey = "";
@@ -84,8 +90,17 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 				const scheme = input.scheme ?? "http";
 				const allow = this.config.allowedAddresses;
 				const interfaces = applyAllowlist(this.enumerate(), allow);
+				const localPort = await this.resolveAdvertisedListenPort(input.port ?? null);
+				if (input.port !== void 0 && input.port !== localPort.port) this.ctx.logger.info("local-network: caller port hint overridden", { meta: {
+					hint: input.port,
+					advertised: localPort.port,
+					source: localPort.source
+				} });
 				await this.reconcileMeshEndpoint();
-				return { endpoints: buildEndpoints(interfaces, input.port, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint) };
+				return {
+					endpoints: buildEndpoints(interfaces, localPort.port, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint),
+					localPort
+				};
 			},
 			getNotificationEndpoint: async () => ({
 				baseUrl: this.config.notificationBaseUrl === "" ? null : this.config.notificationBaseUrl,
@@ -214,6 +229,39 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			}
 		}
 	}
+	/**
+	* The port this hub is actually listening on, plus the provenance of the
+	* number. The boot loader merges the `CAMSTACK_PORT` env override into the
+	* persisted `server` section (`server/backend/src/boot/boot-config.ts`), so
+	* reading that section gives the authoritative live port — no new setting,
+	* and the same source `tailscale-client` already stamps its mesh endpoints
+	* from, so the two cannot drift.
+	*/
+	async resolveAdvertisedListenPort(callerHint) {
+		const envRaw = Number.parseInt(process.env["CAMSTACK_PORT"] ?? "", 10);
+		return resolveAdvertisedPort({
+			configured: await this.readConfiguredPort(),
+			env: Number.isNaN(envRaw) ? null : envRaw,
+			callerHint
+		});
+	}
+	/** `server.port` from the live config section, or null when unreadable. */
+	async readConfiguredPort() {
+		const settings = this.ctx.settings;
+		if (!settings) return null;
+		try {
+			const raw = (await settings.getSection("server"))["port"];
+			if (typeof raw === "number") return raw;
+			if (typeof raw === "string") {
+				const parsed = Number.parseInt(raw, 10);
+				return Number.isNaN(parsed) ? null : parsed;
+			}
+			return null;
+		} catch (err) {
+			this.ctx.logger.warn("local-network: could not read server.port", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return null;
+		}
+	}
 	enumerate() {
 		return enumerateOsInterfaces(node_os.networkInterfaces());
 	}
@@ -238,6 +286,42 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		});
 	}
 };
+/**
+* Pick the port to advertise, and say where it came from.
+*
+* The caller's hint ranks BELOW everything the hub knows about itself and above
+* nothing but the compiled default — it is kept only so a client written
+* against the old echoing contract behaves exactly as it did before, and it is
+* labelled `caller-hint` so that client's successor can refuse to trust it.
+* Values outside the valid port range are dropped rather than advertised: a
+* malformed `server.port` must fall through to the next source, not produce a
+* URL nothing can bind.
+*/
+function resolveAdvertisedPort(sources) {
+	const configured = validPort(sources.configured);
+	if (configured !== null) return {
+		port: configured,
+		source: "server-config"
+	};
+	const env = validPort(sources.env);
+	if (env !== null) return {
+		port: env,
+		source: "server-env"
+	};
+	const hint = validPort(sources.callerHint);
+	if (hint !== null) return {
+		port: hint,
+		source: "caller-hint"
+	};
+	return {
+		port: DEFAULT_HUB_PORT,
+		source: "default"
+	};
+}
+function validPort(value) {
+	if (value === null) return null;
+	return Number.isInteger(value) && value >= 1 && value <= 65535 ? value : null;
+}
 function enumerateOsInterfaces(ifaces) {
 	const raw = [];
 	for (const [name, addrs] of Object.entries(ifaces)) {
@@ -515,3 +599,4 @@ exports.explainNonPlausible = explainNonPlausible;
 exports.isPlausibleAutoSeed = isPlausibleAutoSeed;
 exports.pickPreferred = pickPreferred;
 exports.prefixLen = prefixLen;
+exports.resolveAdvertisedPort = resolveAdvertisedPort;

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**
@@ -25,6 +25,12 @@ import * as os from "node:os";
 */
 var MESH_PROVIDER_ADDON_IDS = ["tailscale-client"];
 var POLL_INTERVAL_MS = 3e4;
+/**
+* Compiled-in boot default — mirrors `CONFIG_DEFAULTS.server.port` in
+* `server/backend/src/boot/boot-config.ts`. Used only when neither the live
+* config section, the env, nor the caller says anything.
+*/
+var DEFAULT_HUB_PORT = 4443;
 var LocalNetworkAddon = class extends BaseAddon {
 	pollTimer = null;
 	lastSnapshotKey = "";
@@ -81,8 +87,17 @@ var LocalNetworkAddon = class extends BaseAddon {
 				const scheme = input.scheme ?? "http";
 				const allow = this.config.allowedAddresses;
 				const interfaces = applyAllowlist(this.enumerate(), allow);
+				const localPort = await this.resolveAdvertisedListenPort(input.port ?? null);
+				if (input.port !== void 0 && input.port !== localPort.port) this.ctx.logger.info("local-network: caller port hint overridden", { meta: {
+					hint: input.port,
+					advertised: localPort.port,
+					source: localPort.source
+				} });
 				await this.reconcileMeshEndpoint();
-				return { endpoints: buildEndpoints(interfaces, input.port, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint) };
+				return {
+					endpoints: buildEndpoints(interfaces, localPort.port, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint),
+					localPort
+				};
 			},
 			getNotificationEndpoint: async () => ({
 				baseUrl: this.config.notificationBaseUrl === "" ? null : this.config.notificationBaseUrl,
@@ -211,6 +226,39 @@ var LocalNetworkAddon = class extends BaseAddon {
 			}
 		}
 	}
+	/**
+	* The port this hub is actually listening on, plus the provenance of the
+	* number. The boot loader merges the `CAMSTACK_PORT` env override into the
+	* persisted `server` section (`server/backend/src/boot/boot-config.ts`), so
+	* reading that section gives the authoritative live port — no new setting,
+	* and the same source `tailscale-client` already stamps its mesh endpoints
+	* from, so the two cannot drift.
+	*/
+	async resolveAdvertisedListenPort(callerHint) {
+		const envRaw = Number.parseInt(process.env["CAMSTACK_PORT"] ?? "", 10);
+		return resolveAdvertisedPort({
+			configured: await this.readConfiguredPort(),
+			env: Number.isNaN(envRaw) ? null : envRaw,
+			callerHint
+		});
+	}
+	/** `server.port` from the live config section, or null when unreadable. */
+	async readConfiguredPort() {
+		const settings = this.ctx.settings;
+		if (!settings) return null;
+		try {
+			const raw = (await settings.getSection("server"))["port"];
+			if (typeof raw === "number") return raw;
+			if (typeof raw === "string") {
+				const parsed = Number.parseInt(raw, 10);
+				return Number.isNaN(parsed) ? null : parsed;
+			}
+			return null;
+		} catch (err) {
+			this.ctx.logger.warn("local-network: could not read server.port", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return null;
+		}
+	}
 	enumerate() {
 		return enumerateOsInterfaces(os.networkInterfaces());
 	}
@@ -235,6 +283,42 @@ var LocalNetworkAddon = class extends BaseAddon {
 		});
 	}
 };
+/**
+* Pick the port to advertise, and say where it came from.
+*
+* The caller's hint ranks BELOW everything the hub knows about itself and above
+* nothing but the compiled default — it is kept only so a client written
+* against the old echoing contract behaves exactly as it did before, and it is
+* labelled `caller-hint` so that client's successor can refuse to trust it.
+* Values outside the valid port range are dropped rather than advertised: a
+* malformed `server.port` must fall through to the next source, not produce a
+* URL nothing can bind.
+*/
+function resolveAdvertisedPort(sources) {
+	const configured = validPort(sources.configured);
+	if (configured !== null) return {
+		port: configured,
+		source: "server-config"
+	};
+	const env = validPort(sources.env);
+	if (env !== null) return {
+		port: env,
+		source: "server-env"
+	};
+	const hint = validPort(sources.callerHint);
+	if (hint !== null) return {
+		port: hint,
+		source: "caller-hint"
+	};
+	return {
+		port: DEFAULT_HUB_PORT,
+		source: "default"
+	};
+}
+function validPort(value) {
+	if (value === null) return null;
+	return Number.isInteger(value) && value >= 1 && value <= 65535 ? value : null;
+}
 function enumerateOsInterfaces(ifaces) {
 	const raw = [];
 	for (const [name, addrs] of Object.entries(ifaces)) {
@@ -502,4 +586,4 @@ function formatKind(kind) {
 	}
 }
 //#endregion
-export { LocalNetworkAddon, applyAllowlist, autoSeedAllowlist, buildEndpoints, classifyKind, enumerateOsInterfaces, explainNonPlausible, isPlausibleAutoSeed, pickPreferred, prefixLen };
+export { LocalNetworkAddon, applyAllowlist, autoSeedAllowlist, buildEndpoints, classifyKind, enumerateOsInterfaces, explainNonPlausible, isPlausibleAutoSeed, pickPreferred, prefixLen, resolveAdvertisedPort };

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as metricsProviderCapability, Gt as EventCategory, Mt as createEvent, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { $ as metricsProviderCapability, Gt as EventCategory, Mt as createEvent, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Gt as EventCategory, L as enumerateInferenceDevices, Pt as emitReadiness, ct as scoreRuntimes, rt as platformProbeCapability, vt as errMsg, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { Gt as EventCategory, L as enumerateInferenceDevices, Pt as emitReadiness, ct as scoreRuntimes, rt as platformProbeCapability, vt as errMsg, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { Gt as EventCategory, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Ct as DeviceFeature, Gt as EventCategory, M as deriveBatteryPresence, Rt as nodePin, T as batteryCapability, Tt as DeviceType, i as BatteryStatusSchema, mt as streamQualityLabel, ut as snapshotCapability, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { Ct as DeviceFeature, Gt as EventCategory, M as deriveBatteryPresence, Rt as nodePin, T as batteryCapability, Tt as DeviceType, i as BatteryStatusSchema, mt as streamQualityLabel, ut as snapshotCapability, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { V as filesystemBrowseCapability, pt as storageProviderCapability, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { V as filesystemBrowseCapability, pt as storageProviderCapability, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-CYDGGkyM.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-B52KsNz8.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_module = require("node:module");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,5 +1,5 @@
-import { A as dataStoreProviderCapability, Bt as parseJsonUnknown, _t as vectorStoreCapability, f as RUNTIME_DEFAULTS, gt as vectorDimFromBase64, j as decodeVectorBase64, kt as asJsonObject, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
-import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-BtVT2f6O.mjs";
+import { A as dataStoreProviderCapability, Bt as parseJsonUnknown, _t as vectorStoreCapability, f as RUNTIME_DEFAULTS, gt as vectorDimFromBase64, j as decodeVectorBase64, kt as asJsonObject, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-C1efPfyW.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { dt as storageCapability, ft as storageMigrationCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as settingsStoreCapability, yt as BaseAddon, zt as parseJsonObject } from "../../dist-Duz_uJSQ.mjs";
+import { dt as storageCapability, ft as storageMigrationCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as settingsStoreCapability, yt as BaseAddon, zt as parseJsonObject } from "../../dist-CJ8RRSvQ.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { It as hydrateSchema, vt as errMsg, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { It as hydrateSchema, vt as errMsg, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B2CtwVW2.js");
+const require_dist = require("../../dist-C1Aea3c6.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Duz_uJSQ.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-CJ8RRSvQ.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-B2CtwVW2.js → dist-C1Aea3c6.js}

@@ -17709,6 +17709,12 @@ var CameraStatusSchema = zod.z.object({
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: zod.z.number()
 });
+var InferenceDeviceExclusionReasonSchema = zod.z.enum([
+	"disabled",
+	"unavailable",
+	"cannot-host-camera-root",
+	"accelerator-preferred"
+]);
 var NodeInferenceDeviceSchema = zod.z.object({
 	/** Stable per-node device key, e.g. `openvino:npu`, `edgetpu:usb`, `cpu`. */
 	key: zod.z.string(),
@@ -17739,7 +17745,17 @@ var NodeInferenceDeviceSchema = zod.z.object({
 	* available per format; this is the stored selection that becomes the
 	* default for EVERY camera landing on this accelerator.
 	*/
-	steps: zod.z.record(zod.z.string(), DeviceStepConfigSchema).optional()
+	steps: zod.z.record(zod.z.string(), DeviceStepConfigSchema).optional(),
+	/**
+	* `null` when the device IS a camera-root candidate on this node; otherwise
+	* the reason the dispatcher drops it. Computed by the SAME
+	* `resolveInferenceDeviceEligibility` the dispatcher runs, so this view can
+	* never disagree with the election — deriving it in the UI from
+	* `enabled`/`available` would silently miss `cannot-host-camera-root` (needs
+	* the node's model catalog) and `accelerator-preferred` (needs the node-wide
+	* "an accelerator is serving" predicate).
+	*/
+	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
 var NodeInferenceDevicesSchema = zod.z.object({
 	nodeId: zod.z.string(),
@@ -23840,7 +23856,41 @@ var ConnectionEndpointSchema = zod.z.object({
 	*/
 	priority: zod.z.number()
 });
-var GetConnectionEndpointsResultSchema = zod.z.object({ endpoints: zod.z.array(ConnectionEndpointSchema).readonly() });
+/**
+* Where the advertised local port came from. Ordered most → least
+* authoritative, and the whole point of returning it: a client must be able to
+* tell a FACT about the hub's socket from an echo of its own guess.
+*/
+var LocalPortSourceEnum = zod.z.enum([
+	"server-config",
+	"server-env",
+	"caller-hint",
+	"default"
+]);
+/** The port every LAN/loopback `baseUrl` in the same result was built with. */
+var AdvertisedLocalPortSchema = zod.z.object({
+	port: zod.z.number().int().min(1).max(65535),
+	source: LocalPortSourceEnum
+});
+var GetConnectionEndpointsResultSchema = zod.z.object({
+	endpoints: zod.z.array(ConnectionEndpointSchema).readonly(),
+	/**
+	* The port the hub built the LAN/loopback URLs with, and where that number
+	* came from.
+	*
+	* Returned rather than merely applied, because "the URL is right" and "the
+	* client can KNOW the URL is right" are different properties. A client that
+	* only sees a corrected URL cannot distinguish a hub that fixed the port from
+	* a hub that echoed the port the client sent, so it cannot decide whether to
+	* race the candidate or discard it. With `source` it can: anything but
+	* `caller-hint` is the hub's own socket.
+	*
+	* Absent on hubs predating this field — a client that finds it missing is
+	* talking to an echoing hub and must degrade exactly as it does for
+	* `caller-hint`.
+	*/
+	localPort: AdvertisedLocalPortSchema
+});
 /**
 * The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
 * AUTO (resolved from the candidate ranking at send time); `resolved` reports
@@ -23886,10 +23936,35 @@ var localNetworkCapability = {
 		* Honours `getAllowedAddresses()` when set — addresses outside
 		* the allowlist are dropped (the public tunnel + loopback are
 		* always included as escape hatches).
+		*
+		* **The port is the hub's, not the caller's** (D62 — a function's fact
+		* belongs to whoever already owns it). This method used to take a `port`
+		* and echo it onto every LAN and loopback URL it advertised, which made
+		* every client a second authority on a socket only the hub binds. A viewer
+		* configured with a port-less public URL (`https://camstack.example.top`)
+		* infers 443 from the scheme, asks with 443, and was handed
+		* `https://192.168.1.9:443` for a hub listening on 4443. That candidate
+		* cannot ever answer, and losing its race reads in the log exactly like
+		* "the LAN was tried and it was slower" — so an operator sitting on his own
+		* WiFi stayed on the public tunnel for weeks, with the LAN candidate born
+		* dead on every single connect.
+		*
+		* The hub now resolves its own listen port and reports it as `localPort`,
+		* with the SOURCE of the number, so a client can tell a fact from an echo.
+		*
+		* Out of scope on purpose: a LAN URL that is not the hub's own socket (a
+		* reverse proxy in front of it on another port) is not this method's to
+		* invent either — pin it with `setNotificationEndpoint` / a configured
+		* origin, which is an operator statement rather than a guess.
 		*/
 		getConnectionEndpoints: method(zod.z.object({
-			/** Local hub HTTP port to use in base URLs. */
-			port: zod.z.number().int().min(1).max(65535),
+			/**
+			* LEGACY HINT — do not send from new code. Kept optional so clients
+			* written against the echoing contract keep working; the hub uses it
+			* only when it cannot read its own port, and says so via
+			* `localPort.source === 'caller-hint'`.
+			*/
+			port: zod.z.number().int().min(1).max(65535).optional(),
 			/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
 			*  candidate. Default `true`. */
 			includeLoopback: zod.z.boolean().optional(),

package/dist/{dist-Duz_uJSQ.mjs → dist-CJ8RRSvQ.mjs}

@@ -17709,6 +17709,12 @@ var CameraStatusSchema = z.object({
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: z.number()
 });
+var InferenceDeviceExclusionReasonSchema = z.enum([
+	"disabled",
+	"unavailable",
+	"cannot-host-camera-root",
+	"accelerator-preferred"
+]);
 var NodeInferenceDeviceSchema = z.object({
 	/** Stable per-node device key, e.g. `openvino:npu`, `edgetpu:usb`, `cpu`. */
 	key: z.string(),
@@ -17739,7 +17745,17 @@ var NodeInferenceDeviceSchema = z.object({
 	* available per format; this is the stored selection that becomes the
 	* default for EVERY camera landing on this accelerator.
 	*/
-	steps: z.record(z.string(), DeviceStepConfigSchema).optional()
+	steps: z.record(z.string(), DeviceStepConfigSchema).optional(),
+	/**
+	* `null` when the device IS a camera-root candidate on this node; otherwise
+	* the reason the dispatcher drops it. Computed by the SAME
+	* `resolveInferenceDeviceEligibility` the dispatcher runs, so this view can
+	* never disagree with the election — deriving it in the UI from
+	* `enabled`/`available` would silently miss `cannot-host-camera-root` (needs
+	* the node's model catalog) and `accelerator-preferred` (needs the node-wide
+	* "an accelerator is serving" predicate).
+	*/
+	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
 var NodeInferenceDevicesSchema = z.object({
 	nodeId: z.string(),
@@ -23840,7 +23856,41 @@ var ConnectionEndpointSchema = z.object({
 	*/
 	priority: z.number()
 });
-var GetConnectionEndpointsResultSchema = z.object({ endpoints: z.array(ConnectionEndpointSchema).readonly() });
+/**
+* Where the advertised local port came from. Ordered most → least
+* authoritative, and the whole point of returning it: a client must be able to
+* tell a FACT about the hub's socket from an echo of its own guess.
+*/
+var LocalPortSourceEnum = z.enum([
+	"server-config",
+	"server-env",
+	"caller-hint",
+	"default"
+]);
+/** The port every LAN/loopback `baseUrl` in the same result was built with. */
+var AdvertisedLocalPortSchema = z.object({
+	port: z.number().int().min(1).max(65535),
+	source: LocalPortSourceEnum
+});
+var GetConnectionEndpointsResultSchema = z.object({
+	endpoints: z.array(ConnectionEndpointSchema).readonly(),
+	/**
+	* The port the hub built the LAN/loopback URLs with, and where that number
+	* came from.
+	*
+	* Returned rather than merely applied, because "the URL is right" and "the
+	* client can KNOW the URL is right" are different properties. A client that
+	* only sees a corrected URL cannot distinguish a hub that fixed the port from
+	* a hub that echoed the port the client sent, so it cannot decide whether to
+	* race the candidate or discard it. With `source` it can: anything but
+	* `caller-hint` is the hub's own socket.
+	*
+	* Absent on hubs predating this field — a client that finds it missing is
+	* talking to an echoing hub and must degrade exactly as it does for
+	* `caller-hint`.
+	*/
+	localPort: AdvertisedLocalPortSchema
+});
 /**
 * The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
 * AUTO (resolved from the candidate ranking at send time); `resolved` reports
@@ -23886,10 +23936,35 @@ var localNetworkCapability = {
 		* Honours `getAllowedAddresses()` when set — addresses outside
 		* the allowlist are dropped (the public tunnel + loopback are
 		* always included as escape hatches).
+		*
+		* **The port is the hub's, not the caller's** (D62 — a function's fact
+		* belongs to whoever already owns it). This method used to take a `port`
+		* and echo it onto every LAN and loopback URL it advertised, which made
+		* every client a second authority on a socket only the hub binds. A viewer
+		* configured with a port-less public URL (`https://camstack.example.top`)
+		* infers 443 from the scheme, asks with 443, and was handed
+		* `https://192.168.1.9:443` for a hub listening on 4443. That candidate
+		* cannot ever answer, and losing its race reads in the log exactly like
+		* "the LAN was tried and it was slower" — so an operator sitting on his own
+		* WiFi stayed on the public tunnel for weeks, with the LAN candidate born
+		* dead on every single connect.
+		*
+		* The hub now resolves its own listen port and reports it as `localPort`,
+		* with the SOURCE of the number, so a client can tell a fact from an echo.
+		*
+		* Out of scope on purpose: a LAN URL that is not the hub's own socket (a
+		* reverse proxy in front of it on another port) is not this method's to
+		* invent either — pin it with `setNotificationEndpoint` / a configured
+		* origin, which is an operator statement rather than a guess.
 		*/
 		getConnectionEndpoints: method(z.object({
-			/** Local hub HTTP port to use in base URLs. */
-			port: z.number().int().min(1).max(65535),
+			/**
+			* LEGACY HINT — do not send from new code. Kept optional so clients
+			* written against the echoing contract keep working; the hub uses it
+			* only when it cannot read its own port, and says so via
+			* `localPort.source === 'caller-hint'`.
+			*/
+			port: z.number().int().min(1).max(65535).optional(),
 			/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
 			*  candidate. Default `true`. */
 			includeLoopback: z.boolean().optional(),

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-B2CtwVW2.js");
+const require_dist = require("./dist-C1Aea3c6.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-Duz_uJSQ.mjs";
+import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-CJ8RRSvQ.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";

package/dist/{retired-settings-keys-CYDGGkyM.js → retired-settings-keys-B52KsNz8.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-B2CtwVW2.js");
+const require_dist = require("./dist-C1Aea3c6.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-BtVT2f6O.mjs → retired-settings-keys-C1efPfyW.mjs}

@@ -1,4 +1,4 @@
-import { kt as asJsonObject } from "./dist-Duz_uJSQ.mjs";
+import { kt as asJsonObject } from "./dist-CJ8RRSvQ.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.113",
+  "version": "1.2.114",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",