@camstack/system 1.2.114 → 1.2.116

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-C1Aea3c6.js");
+const require_dist = require("./dist-Cri60Jd0.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -25,8 +25,9 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DUHPHa-Y.js");
-const require_manifest_python_deps = require("./manifest-python-deps-MA_BZGBz.js");
+const require_manifest_python_deps = require("./manifest-python-deps-CwBbX4Ut.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
+const require_lan_http_bind = require("./lan-http-bind-CZ4EBeD_.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -1515,7 +1516,7 @@ var PipelineValidator = class {
 };
 //#endregion
 //#region src/python/python-env-manager.ts
-var execFileAsync$4 = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
 var PythonEnvManager = class {
 	venvPath;
 	cachedProbe = null;
@@ -1525,12 +1526,12 @@ var PythonEnvManager = class {
 	async probe() {
 		if (this.cachedProbe) return this.cachedProbe;
 		for (const cmd of ["python3", "python"]) try {
-			const { stdout } = await execFileAsync$4(cmd, ["--version"]);
+			const { stdout } = await execFileAsync$3(cmd, ["--version"]);
 			const version = stdout.trim().replace("Python ", "");
 			const major = parseInt(version.split(".")[0] ?? "0", 10);
 			const minor = parseInt(version.split(".")[1] ?? "0", 10);
 			if (major < 3 || major === 3 && minor < 10) continue;
-			const { stdout: pathOut } = await execFileAsync$4(cmd, ["-c", "import sys; print(sys.executable)"]);
+			const { stdout: pathOut } = await execFileAsync$3(cmd, ["-c", "import sys; print(sys.executable)"]);
 			this.cachedProbe = {
 				available: true,
 				version,
@@ -1546,13 +1547,13 @@ var PythonEnvManager = class {
 	async ensure(options) {
 		const probe = await this.probe();
 		if (!probe.available || !probe.path) throw new Error("Python 3.10+ is required but not found on this system");
-		if (!node_fs.existsSync(node_path.join(this.venvPath, "bin", "python"))) await execFileAsync$4(probe.path, [
+		if (!node_fs.existsSync(node_path.join(this.venvPath, "bin", "python"))) await execFileAsync$3(probe.path, [
 			"-m",
 			"venv",
 			this.venvPath
 		]);
 		const venvPython = node_path.join(this.venvPath, "bin", "python");
-		if (options.packages.length > 0) await execFileAsync$4(venvPython, [
+		if (options.packages.length > 0) await execFileAsync$3(venvPython, [
 			"-m",
 			"pip",
 			"install",
@@ -2017,79 +2018,6 @@ var StorageManager = class {
 	}
 };
 //#endregion
-//#region src/tls/cert-manager.ts
-var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
-/**
-* Ensure a self-signed TLS certificate exists in the given directory.
-* Generates one if missing. Returns paths to cert and key files.
-*/
-async function ensureTlsCert(dataDir, options) {
-	const tlsDir = (0, node_path.join)(dataDir, "tls");
-	const certPath = (0, node_path.join)(tlsDir, "camstack.crt");
-	const keyPath = (0, node_path.join)(tlsDir, "camstack.key");
-	if ((0, node_fs.existsSync)(certPath) && (0, node_fs.existsSync)(keyPath)) try {
-		const x509 = new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath));
-		if (new Date(x509.validTo) > /* @__PURE__ */ new Date()) return {
-			certPath,
-			keyPath,
-			generated: false
-		};
-	} catch {}
-	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
-	const cn = options?.commonName ?? "camstack.local";
-	const validDays = options?.validDays ?? 825;
-	const sanDns = new Set([
-		"localhost",
-		cn,
-		node_os.hostname()
-	]);
-	const sanIps = new Set(["127.0.0.1", "::1"]);
-	const interfaces = node_os.networkInterfaces();
-	for (const addrs of Object.values(interfaces)) {
-		if (!addrs) continue;
-		for (const addr of addrs) if (!addr.internal) sanIps.add(addr.address);
-	}
-	for (const san of options?.extraSans ?? []) if (san.match(/^\d+\.\d+\.\d+\.\d+$/) || san.includes(":")) sanIps.add(san);
-	else sanDns.add(san);
-	const sanParts = [];
-	for (const dns of sanDns) sanParts.push(`DNS:${dns}`);
-	for (const ip of sanIps) sanParts.push(`IP:${ip}`);
-	const sanString = sanParts.join(",");
-	await execFileAsync$3("openssl", [
-		"req",
-		"-x509",
-		"-newkey",
-		"rsa:2048",
-		"-keyout",
-		keyPath,
-		"-out",
-		certPath,
-		"-days",
-		String(validDays),
-		"-nodes",
-		"-subj",
-		`/CN=${cn}`,
-		"-addext",
-		`subjectAltName=${sanString}`
-	]);
-	const { chmod } = await import("node:fs/promises");
-	await chmod(keyPath, 384);
-	return {
-		certPath,
-		keyPath,
-		generated: true
-	};
-}
-/**
-* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS options.
-*/
-function loadTlsCert(certPath, keyPath) {
-	return {
-		cert: (0, node_fs.readFileSync)(certPath),
-		key: (0, node_fs.readFileSync)(keyPath)
-	};
-}
-//#endregion
 //#region src/builtins/sqlite-storage/integration-registry.ts
 function serializeSetting(value) {
 	if (typeof value === "number") return {
@@ -94910,6 +94838,8 @@ exports.AddonRouteRegistry = AddonRouteRegistry;
 exports.AlertCenterAddon = require_builtins_alerts_alerts_addon.AlertCenterAddon;
 exports.ApiKeyManager = require_builtins_local_auth_local_auth_addon.ApiKeyManager;
 exports.AuthManager = require_builtins_local_auth_local_auth_addon.AuthManager;
+exports.CA_COMMON_NAME = require_lan_http_bind.CA_COMMON_NAME;
+exports.CA_VALIDITY_DAYS = require_lan_http_bind.CA_VALIDITY_DAYS;
 exports.CLUSTER_SECRET_MISMATCH_TYPE = CLUSTER_SECRET_MISMATCH_TYPE;
 exports.CLUSTER_SECRET_REJECTED_EXIT_CODE = CLUSTER_SECRET_REJECTED_EXIT_CODE;
 exports.CORE_CAP_SERVICE_NAME = CORE_CAP_SERVICE_NAME;
@@ -94926,6 +94856,7 @@ exports.ConsoleLoggingAddon = require_builtins_console_logging_index.ConsoleLogg
 exports.CoreBlocksAddon = require_builtins_core_blocks_core_blocks_addon.CoreBlocksAddon;
 exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
 exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
+exports.DEFAULT_LAN_HTTP_PORT = require_lan_http_bind.DEFAULT_LAN_HTTP_PORT;
 exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_dist.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
 exports.DEVICE_STATUS_METHOD = require_dist.DEVICE_STATUS_METHOD;
 exports.DataPlaneRegistry = DataPlaneRegistry;
@@ -94956,6 +94887,7 @@ exports.HubNodeRegistry = HubNodeRegistry;
 exports.INFRA_CAPABILITIES = INFRA_CAPABILITIES;
 exports.IntegrationRegistry = IntegrationRegistry;
 exports.JobJournal = JobJournal;
+exports.LEAF_RENEWAL_WINDOW_DAYS = require_lan_http_bind.LEAF_RENEWAL_WINDOW_DAYS;
 exports.LifecycleJobEngine = LifecycleJobEngine;
 exports.LifecycleStateMachine = LifecycleStateMachine;
 exports.LivenessMonitorAddon = require_builtins_liveness_monitor_liveness_monitor_addon.LivenessMonitorAddon;
@@ -94966,6 +94898,7 @@ exports.LogManager = LogManager;
 exports.LogRingBuffer = LogRingBuffer;
 exports.LokiDestination = require_builtins_loki_logging_index.LokiDestination$1;
 exports.LokiLoggingAddon = require_builtins_loki_logging_index.LokiLoggingAddon$1;
+exports.MAX_LEAF_VALIDITY_DAYS = require_lan_http_bind.MAX_LEAF_VALIDITY_DAYS;
 exports.METHOD_ACCESS_MAP = require_dist.METHOD_ACCESS_MAP;
 exports.ModelDownloadService = require_file_data_plane.ModelDownloadService;
 exports.NATIVE_PROVIDER_SERVICE_INFIX = require_manifest_python_deps.NATIVE_PROVIDER_SERVICE_INFIX;
@@ -94991,6 +94924,7 @@ exports.ReadinessRegistry = require_dist.ReadinessRegistry;
 exports.ReadinessTimeoutError = require_dist.ReadinessTimeoutError;
 exports.ReplEngine = ReplEngine;
 exports.RingBuffer = RingBuffer;
+exports.SERVER_AUTH_OID = require_lan_http_bind.SERVER_AUTH_OID;
 exports.ScopedLogger = ScopedLogger;
 exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
 exports.SocketChannel = require_manifest_python_deps.SocketChannel;
@@ -95014,6 +94948,8 @@ exports.WinstonLoggingAddon = require_builtins_winston_logging_index.WinstonLogg
 exports.__resetCapUsageRegistryForTests = require_manifest_python_deps.__resetCapUsageRegistryForTests;
 exports.adaptBrokerToCluster = require_manifest_python_deps.adaptBrokerToCluster;
 exports.addonSettingsCapability = require_dist.addonSettingsCapability;
+exports.applyLanHttp = require_lan_http_bind.applyLanHttp;
+exports.bindPendingLanHttp = require_lan_http_bind.bindPendingLanHttp;
 exports.bootstrapSchema = bootstrapSchema;
 exports.brokerCallForCap = require_manifest_python_deps.brokerCallForCap;
 exports.brokerTransportLink = require_manifest_python_deps.brokerTransportLink;
@@ -95040,8 +94976,10 @@ exports.capServiceName = require_manifest_python_deps.capServiceName;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = require_manifest_python_deps.classifyCapRoute;
 exports.clearPendingRestart = clearPendingRestart;
+exports.closeLanHttp = require_lan_http_bind.closeLanHttp;
 exports.clusterEventTopic = require_manifest_python_deps.clusterEventTopic;
 exports.clusterSecretMatches = clusterSecretMatches;
+exports.collectCertIdentity = require_lan_http_bind.collectCertIdentity;
 exports.collectModelFiles = require_file_data_plane.collectModelFiles;
 exports.contentTypeFor = require_file_data_plane.contentTypeFor;
 exports.copyDirRecursive = copyDirRecursive;
@@ -95107,7 +95045,8 @@ Object.defineProperty(exports, "ensurePython", {
 		return _camstack_types_node.ensurePython;
 	}
 });
-exports.ensureTlsCert = ensureTlsCert;
+exports.ensureTlsCert = require_lan_http_bind.ensureTlsCert;
+exports.evaluateExistingCert = require_lan_http_bind.evaluateExistingCert;
 exports.expandCapMethods = require_dist.expandCapMethods;
 exports.fetchJson = require_file_data_plane.fetchJson;
 Object.defineProperty(exports, "findInPath", {
@@ -95171,7 +95110,7 @@ exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
 exports.isInfraCapability = isInfraCapability;
 exports.isModelDownloaded = require_file_data_plane.isModelDownloaded;
 exports.isSourceNewer = isSourceNewer;
-exports.loadTlsCert = loadTlsCert;
+exports.loadTlsCert = require_lan_http_bind.loadTlsCert;
 exports.localEndpointPath = require_manifest_python_deps.localEndpointPath;
 exports.localProviderLink = require_manifest_python_deps.localProviderLink;
 exports.mountNativeCapService = require_manifest_python_deps.mountNativeCapService;
@@ -95180,9 +95119,15 @@ exports.parseRangeHeader = require_file_data_plane.parseRangeHeader;
 exports.parseTokenizedUrl = require_file_data_plane.parseTokenizedUrl;
 exports.proxyToUpstream = proxyToUpstream;
 exports.quarantineAddonResidue = quarantineAddonResidue;
+exports.readExtraSans = require_lan_http_bind.readExtraSans;
+exports.readLanHttpState = require_lan_http_bind.readLanHttpState;
 exports.readPendingRestart = readPendingRestart;
+exports.readTlsAccessStatus = require_lan_http_bind.readTlsAccessStatus;
+exports.readTlsMode = require_lan_http_bind.readTlsMode;
 exports.readinessKey = require_dist.readinessKey;
 exports.registerEventBusService = require_manifest_python_deps.registerEventBusService;
+exports.registerLanHttpHandler = require_lan_http_bind.registerLanHttpHandler;
+exports.reissueTlsLeaf = require_lan_http_bind.reissueTlsLeaf;
 exports.resolveFilePath = require_file_data_plane.resolveFilePath;
 exports.resolveHwAccel = require_manifest_python_deps.resolveHwAccel;
 exports.resolveNpmInvocation = require_manifest_python_deps.resolveNpmInvocation;
@@ -95203,4 +95148,7 @@ exports.stripCamstackDeps = stripCamstackDeps;
 exports.subscribePassthrough = require_manifest_python_deps.subscribePassthrough;
 exports.udsChildLogToWorkerEntry = require_manifest_python_deps.udsChildLogToWorkerEntry;
 exports.validateProviderRegistrations = require_manifest_python_deps.validateProviderRegistrations;
+exports.validateUploadedTls = require_lan_http_bind.validateUploadedTls;
+exports.writeExtraSans = require_lan_http_bind.writeExtraSans;
 exports.writePendingRestart = writePendingRestart;
+exports.writeTlsMode = require_lan_http_bind.writeTlsMode;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-CJ8RRSvQ.mjs";
+import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-BpzbLPel.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -24,11 +24,12 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-CuE_hBli.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Cb1ANt3i.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-SGdbr9D5.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
+import { S as evaluateExistingCert, _ as collectCertIdentity, a as readLanHttpState, b as MAX_LEAF_VALIDITY_DAYS, c as readTlsAccessStatus, d as writeTlsMode, f as validateUploadedTls, g as CA_COMMON_NAME, h as reissueTlsLeaf, i as closeLanHttp, l as readTlsMode, m as loadTlsCert, n as applyLanHttp, o as registerLanHttpHandler, p as ensureTlsCert, r as bindPendingLanHttp, s as readExtraSans, t as DEFAULT_LAN_HTTP_PORT, u as writeExtraSans, v as CA_VALIDITY_DAYS, x as SERVER_AUTH_OID, y as LEAF_RENEWAL_WINDOW_DAYS } from "./lan-http-bind-BDJm4d-K.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
-import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { lstat, readdir, readlink, realpath } from "node:fs/promises";
 import * as path$39 from "node:path";
@@ -38,7 +39,7 @@ import * as util$10 from "node:util";
 import { promisify } from "node:util";
 import * as os$18 from "node:os";
 import * as fs$17 from "node:fs";
-import { accessSync, constants, existsSync, mkdirSync, readFileSync } from "node:fs";
+import { accessSync, constants, existsSync } from "node:fs";
 import { request } from "node:http";
 import * as vm from "node:vm";
 import { asJsonObject, errMsg, parseJsonUnknown } from "@camstack/types/addon";
@@ -1508,7 +1509,7 @@ var PipelineValidator = class {
 };
 //#endregion
 //#region src/python/python-env-manager.ts
-var execFileAsync$4 = promisify(execFile);
+var execFileAsync$3 = promisify(execFile);
 var PythonEnvManager = class {
 	venvPath;
 	cachedProbe = null;
@@ -1518,12 +1519,12 @@ var PythonEnvManager = class {
 	async probe() {
 		if (this.cachedProbe) return this.cachedProbe;
 		for (const cmd of ["python3", "python"]) try {
-			const { stdout } = await execFileAsync$4(cmd, ["--version"]);
+			const { stdout } = await execFileAsync$3(cmd, ["--version"]);
 			const version = stdout.trim().replace("Python ", "");
 			const major = parseInt(version.split(".")[0] ?? "0", 10);
 			const minor = parseInt(version.split(".")[1] ?? "0", 10);
 			if (major < 3 || major === 3 && minor < 10) continue;
-			const { stdout: pathOut } = await execFileAsync$4(cmd, ["-c", "import sys; print(sys.executable)"]);
+			const { stdout: pathOut } = await execFileAsync$3(cmd, ["-c", "import sys; print(sys.executable)"]);
 			this.cachedProbe = {
 				available: true,
 				version,
@@ -1539,13 +1540,13 @@ var PythonEnvManager = class {
 	async ensure(options) {
 		const probe = await this.probe();
 		if (!probe.available || !probe.path) throw new Error("Python 3.10+ is required but not found on this system");
-		if (!fs$17.existsSync(path$39.join(this.venvPath, "bin", "python"))) await execFileAsync$4(probe.path, [
+		if (!fs$17.existsSync(path$39.join(this.venvPath, "bin", "python"))) await execFileAsync$3(probe.path, [
 			"-m",
 			"venv",
 			this.venvPath
 		]);
 		const venvPython = path$39.join(this.venvPath, "bin", "python");
-		if (options.packages.length > 0) await execFileAsync$4(venvPython, [
+		if (options.packages.length > 0) await execFileAsync$3(venvPython, [
 			"-m",
 			"pip",
 			"install",
@@ -2010,79 +2011,6 @@ var StorageManager = class {
 	}
 };
 //#endregion
-//#region src/tls/cert-manager.ts
-var execFileAsync$3 = promisify(execFile);
-/**
-* Ensure a self-signed TLS certificate exists in the given directory.
-* Generates one if missing. Returns paths to cert and key files.
-*/
-async function ensureTlsCert(dataDir, options) {
-	const tlsDir = join(dataDir, "tls");
-	const certPath = join(tlsDir, "camstack.crt");
-	const keyPath = join(tlsDir, "camstack.key");
-	if (existsSync(certPath) && existsSync(keyPath)) try {
-		const x509 = new X509Certificate(readFileSync(certPath));
-		if (new Date(x509.validTo) > /* @__PURE__ */ new Date()) return {
-			certPath,
-			keyPath,
-			generated: false
-		};
-	} catch {}
-	mkdirSync(tlsDir, { recursive: true });
-	const cn = options?.commonName ?? "camstack.local";
-	const validDays = options?.validDays ?? 825;
-	const sanDns = new Set([
-		"localhost",
-		cn,
-		os$18.hostname()
-	]);
-	const sanIps = new Set(["127.0.0.1", "::1"]);
-	const interfaces = os$18.networkInterfaces();
-	for (const addrs of Object.values(interfaces)) {
-		if (!addrs) continue;
-		for (const addr of addrs) if (!addr.internal) sanIps.add(addr.address);
-	}
-	for (const san of options?.extraSans ?? []) if (san.match(/^\d+\.\d+\.\d+\.\d+$/) || san.includes(":")) sanIps.add(san);
-	else sanDns.add(san);
-	const sanParts = [];
-	for (const dns of sanDns) sanParts.push(`DNS:${dns}`);
-	for (const ip of sanIps) sanParts.push(`IP:${ip}`);
-	const sanString = sanParts.join(",");
-	await execFileAsync$3("openssl", [
-		"req",
-		"-x509",
-		"-newkey",
-		"rsa:2048",
-		"-keyout",
-		keyPath,
-		"-out",
-		certPath,
-		"-days",
-		String(validDays),
-		"-nodes",
-		"-subj",
-		`/CN=${cn}`,
-		"-addext",
-		`subjectAltName=${sanString}`
-	]);
-	const { chmod } = await import("node:fs/promises");
-	await chmod(keyPath, 384);
-	return {
-		certPath,
-		keyPath,
-		generated: true
-	};
-}
-/**
-* Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS options.
-*/
-function loadTlsCert(certPath, keyPath) {
-	return {
-		cert: readFileSync(certPath),
-		key: readFileSync(keyPath)
-	};
-}
-//#endregion
 //#region src/builtins/sqlite-storage/integration-registry.ts
 function serializeSetting(value) {
 	if (typeof value === "number") return {
@@ -94888,4 +94816,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LokiDestination, LokiLoggingAddon, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, addonSettingsCapability, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, clusterEventTopic, clusterSecretMatches, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, quarantineAddonResidue, readPendingRestart, readinessKey, registerEventBusService, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, writePendingRestart };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, addonSettingsCapability, applyLanHttp, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, quarantineAddonResidue, readExtraSans, readLanHttpState, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, writeExtraSans, writePendingRestart, writeTlsMode };