@camstack/system 1.2.114 → 1.2.116

package/dist/{dist-CJ8RRSvQ.mjs → dist-BpzbLPel.mjs}

@@ -1,5 +1,5 @@
 import { z } from "zod";
-//#region ../types/dist/event-category-XfKNtfCc.mjs
+//#region ../types/dist/event-category-CIa_iT6b.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -15,6 +15,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
+	* The hub reissued its own TLS certificate at boot (`ensureTlsCert`).
+	* Emitted only when the material on disk actually changed, so an
+	* operator who trusted the old certificate by hand is told rather than
+	* discovering it as a browser error. Payload `TlsCertChangedPayload`.
+	*
+	* Rule: docs/decisions/adr-0227-*.md
+	*/
+	EventCategory["SystemTlsCertChanged"] = "system.tls-cert-changed";
+	/**
 	* A newer addon or server-root package version was found by the
 	* authoritative registry check. Emitted once when any observed
 	* `latestVersion` changes (or a package/node first appears behind);
@@ -19217,7 +19226,12 @@ var TerminalSessionInfoSchema = z.object({
 var TerminalProfileInfoSchema = z.object({
 	profileId: z.string(),
 	label: z.string(),
-	description: z.string().optional()
+	description: z.string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: z.string().optional(),
+	args: z.array(z.string()).readonly().optional(),
+	cwd: z.string().optional(),
+	environment: z.array(z.string()).readonly().optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -19230,7 +19244,11 @@ var TerminalInstanceInfoSchema = z.object({
 	profileId: z.string(),
 	profileLabel: z.string(),
 	name: z.string(),
-	enabled: z.boolean()
+	enabled: z.boolean(),
+	executable: z.string(),
+	args: z.array(z.string()).readonly(),
+	cwd: z.string(),
+	environment: z.array(z.string()).readonly()
 });
 var TerminalLegacyCameraSchema = z.object({
 	stableId: z.string(),
@@ -19276,7 +19294,22 @@ var terminalSessionCapability = {
 		createInstance: method(z.object({
 			targetNodeId: z.string().min(1),
 			profileId: z.string().min(1),
-			name: z.string().trim().min(1).max(160).optional()
+			name: z.string().trim().min(1).max(160).optional(),
+			executable: z.string().max(1024).optional(),
+			args: z.array(z.string().max(2048)).max(64).optional(),
+			cwd: z.string().max(1024).optional(),
+			environment: z.array(z.string().max(4096)).max(64).optional()
+		}), TerminalInstanceInfoSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateInstance: method(z.object({
+			instanceId: z.string().min(1),
+			name: z.string().trim().min(1).max(160).optional(),
+			executable: z.string().max(1024).optional(),
+			args: z.array(z.string().max(2048)).max(64).optional(),
+			cwd: z.string().max(1024).optional(),
+			environment: z.array(z.string().max(4096)).max(64).optional()
 		}), TerminalInstanceInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -19311,7 +19344,11 @@ var terminalSessionCapability = {
 		openSession: method(z.object({
 			profileId: z.string(),
 			cols: z.number().int().positive(),
-			rows: z.number().int().positive()
+			rows: z.number().int().positive(),
+			executable: z.string().max(1024).optional(),
+			args: z.array(z.string().max(2048)).max(64).optional(),
+			cwd: z.string().max(1024).optional(),
+			environment: z.array(z.string().max(4096)).max(64).optional()
 		}), TerminalSessionInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -23910,6 +23947,20 @@ var AllowedAddressesSchema = z.object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: z.array(z.string()).readonly() });
+var TlsStatusSchema = z.object({
+	mode: z.enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: z.string().nullable(),
+	caFingerprintSha256: z.string().nullable(),
+	validTo: z.string().nullable(),
+	sans: z.array(z.string()),
+	caCertPem: z.string().nullable(),
+	reissueError: z.string().nullable(),
+	restartRequired: z.boolean()
+});
 var localNetworkCapability = {
 	name: "local-network",
 	scope: "system",
@@ -24015,7 +24066,34 @@ var localNetworkCapability = {
 		* when the operator wants to wipe their manual edits and start
 		* over from the auto-detected best matches.
 		*/
-		resetAllowlistToBestMatch: method(z.void(), AllowedAddressesSchema, { kind: "mutation" })
+		resetAllowlistToBestMatch: method(z.void(), AllowedAddressesSchema, { kind: "mutation" }),
+		/**
+		* Live TLS material for the Network → Local access certificate card.
+		* LAN HTTP / hostname are addon settings (`globalSettingsSchema`), not
+		* a second store — this query is status, not configuration.
+		*/
+		getTlsStatus: method(z.void(), TlsStatusSchema),
+		/** Issue a new leaf under the existing local CA. Disabled in uploaded mode. */
+		regenerateCertificate: method(z.object({ reason: z.string().optional() }), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Replace the served material with operator-supplied PEMs. */
+		uploadCertificate: method(z.object({
+			certPem: z.string().min(1),
+			keyPem: z.string().min(1),
+			caPem: z.string().optional()
+		}), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The local CA PEM, or empty when there is none to download. */
+		downloadCa: method(z.void(), z.object({ pem: z.string() })),
+		/** Drop uploaded material and return to the generated local CA. */
+		revertToGeneratedCertificate: method(z.void(), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
 	mount: { kind: "hub-only" }
@@ -32469,6 +32547,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -32493,18 +32577,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -32517,6 +32619,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -35397,6 +35505,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -38164,6 +38278,35 @@ Object.freeze(Object.fromEntries([{
 	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 z.string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = z.number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 z.object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.

package/dist/{dist-C1Aea3c6.js → dist-Cri60Jd0.js}

@@ -1,5 +1,5 @@
 let zod = require("zod");
-//#region ../types/dist/event-category-XfKNtfCc.mjs
+//#region ../types/dist/event-category-CIa_iT6b.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -15,6 +15,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
+	* The hub reissued its own TLS certificate at boot (`ensureTlsCert`).
+	* Emitted only when the material on disk actually changed, so an
+	* operator who trusted the old certificate by hand is told rather than
+	* discovering it as a browser error. Payload `TlsCertChangedPayload`.
+	*
+	* Rule: docs/decisions/adr-0227-*.md
+	*/
+	EventCategory["SystemTlsCertChanged"] = "system.tls-cert-changed";
+	/**
 	* A newer addon or server-root package version was found by the
 	* authoritative registry check. Emitted once when any observed
 	* `latestVersion` changes (or a package/node first appears behind);
@@ -19217,7 +19226,12 @@ var TerminalSessionInfoSchema = zod.z.object({
 var TerminalProfileInfoSchema = zod.z.object({
 	profileId: zod.z.string(),
 	label: zod.z.string(),
-	description: zod.z.string().optional()
+	description: zod.z.string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: zod.z.string().optional(),
+	args: zod.z.array(zod.z.string()).readonly().optional(),
+	cwd: zod.z.string().optional(),
+	environment: zod.z.array(zod.z.string()).readonly().optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -19230,7 +19244,11 @@ var TerminalInstanceInfoSchema = zod.z.object({
 	profileId: zod.z.string(),
 	profileLabel: zod.z.string(),
 	name: zod.z.string(),
-	enabled: zod.z.boolean()
+	enabled: zod.z.boolean(),
+	executable: zod.z.string(),
+	args: zod.z.array(zod.z.string()).readonly(),
+	cwd: zod.z.string(),
+	environment: zod.z.array(zod.z.string()).readonly()
 });
 var TerminalLegacyCameraSchema = zod.z.object({
 	stableId: zod.z.string(),
@@ -19276,7 +19294,22 @@ var terminalSessionCapability = {
 		createInstance: method(zod.z.object({
 			targetNodeId: zod.z.string().min(1),
 			profileId: zod.z.string().min(1),
-			name: zod.z.string().trim().min(1).max(160).optional()
+			name: zod.z.string().trim().min(1).max(160).optional(),
+			executable: zod.z.string().max(1024).optional(),
+			args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+			cwd: zod.z.string().max(1024).optional(),
+			environment: zod.z.array(zod.z.string().max(4096)).max(64).optional()
+		}), TerminalInstanceInfoSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateInstance: method(zod.z.object({
+			instanceId: zod.z.string().min(1),
+			name: zod.z.string().trim().min(1).max(160).optional(),
+			executable: zod.z.string().max(1024).optional(),
+			args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+			cwd: zod.z.string().max(1024).optional(),
+			environment: zod.z.array(zod.z.string().max(4096)).max(64).optional()
 		}), TerminalInstanceInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -19311,7 +19344,11 @@ var terminalSessionCapability = {
 		openSession: method(zod.z.object({
 			profileId: zod.z.string(),
 			cols: zod.z.number().int().positive(),
-			rows: zod.z.number().int().positive()
+			rows: zod.z.number().int().positive(),
+			executable: zod.z.string().max(1024).optional(),
+			args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+			cwd: zod.z.string().max(1024).optional(),
+			environment: zod.z.array(zod.z.string().max(4096)).max(64).optional()
 		}), TerminalSessionInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -23910,6 +23947,20 @@ var AllowedAddressesSchema = zod.z.object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: zod.z.array(zod.z.string()).readonly() });
+var TlsStatusSchema = zod.z.object({
+	mode: zod.z.enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: zod.z.string().nullable(),
+	caFingerprintSha256: zod.z.string().nullable(),
+	validTo: zod.z.string().nullable(),
+	sans: zod.z.array(zod.z.string()),
+	caCertPem: zod.z.string().nullable(),
+	reissueError: zod.z.string().nullable(),
+	restartRequired: zod.z.boolean()
+});
 var localNetworkCapability = {
 	name: "local-network",
 	scope: "system",
@@ -24015,7 +24066,34 @@ var localNetworkCapability = {
 		* when the operator wants to wipe their manual edits and start
 		* over from the auto-detected best matches.
 		*/
-		resetAllowlistToBestMatch: method(zod.z.void(), AllowedAddressesSchema, { kind: "mutation" })
+		resetAllowlistToBestMatch: method(zod.z.void(), AllowedAddressesSchema, { kind: "mutation" }),
+		/**
+		* Live TLS material for the Network → Local access certificate card.
+		* LAN HTTP / hostname are addon settings (`globalSettingsSchema`), not
+		* a second store — this query is status, not configuration.
+		*/
+		getTlsStatus: method(zod.z.void(), TlsStatusSchema),
+		/** Issue a new leaf under the existing local CA. Disabled in uploaded mode. */
+		regenerateCertificate: method(zod.z.object({ reason: zod.z.string().optional() }), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Replace the served material with operator-supplied PEMs. */
+		uploadCertificate: method(zod.z.object({
+			certPem: zod.z.string().min(1),
+			keyPem: zod.z.string().min(1),
+			caPem: zod.z.string().optional()
+		}), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The local CA PEM, or empty when there is none to download. */
+		downloadCa: method(zod.z.void(), zod.z.object({ pem: zod.z.string() })),
+		/** Drop uploaded material and return to the generated local CA. */
+		revertToGeneratedCertificate: method(zod.z.void(), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
 	mount: { kind: "hub-only" }
@@ -32469,6 +32547,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -32493,18 +32577,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -32517,6 +32619,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -35397,6 +35505,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -38164,6 +38278,35 @@ Object.freeze(Object.fromEntries([{
 	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 zod.z.string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = zod.z.number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 zod.z.object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.

package/dist/http/lan-http-bind.d.ts

@@ -0,0 +1,19 @@
+import { IncomingMessage, ServerResponse } from 'node:http';
+export interface LanHttpBindOptions {
+    readonly enabled: boolean;
+    readonly port: number;
+    readonly host: string;
+}
+export interface LanHttpBindResult {
+    readonly listening: boolean;
+    readonly error: string | null;
+    readonly port: number;
+}
+export type LanHttpRequestHandler = (req: IncomingMessage, res: ServerResponse) => void;
+export declare const DEFAULT_LAN_HTTP_PORT = 4480;
+export declare function registerLanHttpHandler(next: LanHttpRequestHandler | null): void;
+export declare function readLanHttpState(): LanHttpBindResult;
+export declare function applyLanHttp(options: LanHttpBindOptions): Promise<LanHttpBindResult>;
+/** After the hub registers the Fastify request handler, bind whatever was pending. */
+export declare function bindPendingLanHttp(): Promise<LanHttpBindResult>;
+export declare function closeLanHttp(): Promise<void>;

package/dist/index.d.ts

@@ -80,6 +80,7 @@ export { StorageLocationManager } from './storage/storage-location-manager.js';
 export type { IFileStorage, IStorageLocation, IStorageProvider as ICoreStorageProvider, IStructuredStorage, QueryFilter, StorageRecord, } from './storage/storage-manager.js';
 export { StorageManager } from './storage/storage-manager.js';
 export * from './tls/index.js';
+export { applyLanHttp, bindPendingLanHttp, closeLanHttp, DEFAULT_LAN_HTTP_PORT, readLanHttpState, registerLanHttpHandler, } from './http/lan-http-bind.js';
 export { IntegrationRegistry } from './builtins/sqlite-storage/integration-registry.js';
 export { type EnsureAddonNativePrebuildsOptions, ensureAddonNativePrebuilds, type NativeEnsureOutcome, type NativeEnsureResult, } from './kernel/deps/ensure-addon-natives.js';
 export { type EnsureNativePrebuildsOptions, ensureNativePrebuilds, hasDotNode, NATIVE_SCAN_DEPTH, type PrebuildFetchFn, type PrebuildTarget, TRADITIONAL_NATIVE_PACKAGES, } from './kernel/deps/ensure-native-prebuilds.js';