@camstack/system 1.2.115 → 1.2.116

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-Cri60Jd0.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, v as addonPagesCapability, vt as errMsg, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { Gt as EventCategory, v as addonPagesCapability, vt as errMsg, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-Cri60Jd0.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, b as addonWidgetsCapability, vt as errMsg, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { Gt as EventCategory, b as addonWidgetsCapability, vt as errMsg, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-Cri60Jd0.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, n as AlertSchema, vt as errMsg, x as alertsCapability, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { Gt as EventCategory, Mt as createEvent, n as AlertSchema, vt as errMsg, x as alertsCapability, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-Cri60Jd0.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { C as backupCapability, Gt as EventCategory, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { C as backupCapability, Gt as EventCategory, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-Cri60Jd0.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-Cri60Jd0.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, vt as errMsg, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, vt as errMsg, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-OfhqQio4.js");
+const require_dist = require("../../dist-Cri60Jd0.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-BVAxT5XL.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-Drb54SZD.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-Dz5-7gjt.mjs";
+import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-BpzbLPel.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-SrxMH3OT.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-Cri60Jd0.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { G as isSameAddonId, Gt as EventCategory, I as doorbellCapability, Mt as createEvent, Tt as DeviceType, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { G as isSameAddonId, Gt as EventCategory, I as doorbellCapability, Mt as createEvent, Tt as DeviceType, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-Cri60Jd0.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-Cri60Jd0.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, vt as errMsg, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { Gt as EventCategory, Mt as createEvent, vt as errMsg, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-Cri60Jd0.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-hostname.d.ts

@@ -0,0 +1,15 @@
+export type ParseLocalHostnameResult = {
+    readonly ok: true;
+    readonly value: string | null;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * Parse the operator-typed local hostname.
+ *
+ * Empty / whitespace → `null` (advertise the raw LAN IP). A DNS name is
+ * lowercased. A URL, port suffix, path, or bare IP is rejected so it cannot
+ * leak into a SAN or a candidate URL.
+ */
+export declare function parseLocalHostname(raw: string): ParseLocalHostnameResult;

package/dist/builtins/local-network/local-network.addon.d.ts

@@ -37,6 +37,12 @@ interface LocalNetworkConfig {
      * different address after a reboot.
      */
     readonly notificationBaseUrl: string;
+    /** LAN HTTP listener. Default true — native apps skip the private cert. */
+    readonly httpEnabled: boolean;
+    /** Dedicated HTTP port. Must not equal the HTTPS listen port. */
+    readonly httpPort: number;
+    /** Operator-declared DNS name advertised instead of the raw LAN IP. Empty = none. */
+    readonly localHostname: string;
 }
 export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
     private pollTimer;
@@ -61,6 +67,8 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
      */
     private resolveNotificationEndpoint;
     protected onInitialize(): Promise<ProviderRegistration[]>;
+    protected globalSettingsSchema(): import('@camstack/types').ConfigUISchema;
+    protected onConfigChanged(): Promise<void>;
     protected onShutdown(): Promise<void>;
     /**
      * Other hub addons (e.g. cloudflare-tunnel) signal the active public
@@ -86,6 +94,15 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
      * not joined simply contributes nothing.
      */
     private reconcileMeshEndpoint;
+    private resolvedHttpPort;
+    private tlsDataDir;
+    private snapshotTls;
+    /**
+     * Bind or unbind the LAN HTTP sibling from the addon's own settings, and
+     * keep the leaf SAN in sync with `localHostname`. This is the settings
+     * side-effect path — there is no second persist API.
+     */
+    private applyLanAccessFromSettings;
     /**
      * The port this hub is actually listening on, plus the provenance of the
      * number. The boot loader merges the `CAMSTACK_PORT` env override into the
@@ -152,14 +169,21 @@ export declare function pickPreferred(interfaces: readonly LocalInterface[]): Lo
  * but above the IPv6 / loopback fallbacks — giving remote, mesh-joined
  * clients a working candidate when no public tunnel is up.
  *
- * `scheme` controls LAN + loopback URLs. Browsers running over HTTPS
- * block `http://` candidates as mixed content, so callers loaded over
- * HTTPS should pass `scheme: 'https'` even when probing a LAN IP — the
- * hub's cert manager already issues a SAN-multi cert covering local
- * interfaces. The public tunnel + mesh endpoint always emit `https://`
- * (the tunnel edge / the hub itself terminates TLS).
+ * `scheme` controls loopback URLs and, when LAN HTTP is off, LAN URLs.
+ * When {@link LanHttpAdvertisement} is enabled and listening, LAN (and
+ * the local-hostname alias) switch to `http://…:httpPort` so a native
+ * client can skip the private certificate. Public tunnel + mesh always
+ * emit `https://`. Loopback stays on `scheme`/`port` — it is not a LAN
+ * candidate.
  */
-export declare function buildEndpoints(interfaces: readonly LocalInterface[], port: number, includeLoopback: boolean, ipv4Only: boolean, publicHostname: string, scheme?: 'http' | 'https', meshEndpoint?: MeshEndpointCache | null): ConnectionEndpoint[];
+export interface LanHttpAdvertisement {
+    readonly enabled: boolean;
+    readonly listening: boolean;
+    readonly httpPort: number;
+    readonly httpsPort: number;
+    readonly localHostname: string | null;
+}
+export declare function buildEndpoints(interfaces: readonly LocalInterface[], port: number, includeLoopback: boolean, ipv4Only: boolean, publicHostname: string, scheme?: 'http' | 'https', meshEndpoint?: MeshEndpointCache | null, lanHttp?: LanHttpAdvertisement | null): ConnectionEndpoint[];
 /**
  * First-boot heuristic: which addresses should the allowlist start
  * with? Includes LAN + Wi-Fi IPv4 addresses + plausible IPv6:

package/dist/builtins/local-network/local-network.addon.js

@@ -1,8 +1,46 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-Cri60Jd0.js");
+const require_lan_http_bind = require("../../lan-http-bind-CZ4EBeD_.js");
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
+let node_net = require("node:net");
+//#region src/builtins/local-network/local-hostname.ts
+var DNS_NAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])$/;
+/**
+* Parse the operator-typed local hostname.
+*
+* Empty / whitespace → `null` (advertise the raw LAN IP). A DNS name is
+* lowercased. A URL, port suffix, path, or bare IP is rejected so it cannot
+* leak into a SAN or a candidate URL.
+*/
+function parseLocalHostname(raw) {
+	const trimmed = raw.trim();
+	if (trimmed === "") return {
+		ok: true,
+		value: null
+	};
+	if (/[\s/:?#]/.test(trimmed) || trimmed.includes("\\")) return {
+		ok: false,
+		error: "Enter a DNS name such as camstack.lan, without a scheme or port."
+	};
+	const lowered = trimmed.toLowerCase();
+	if ((0, node_net.isIP)(lowered) !== 0) return {
+		ok: false,
+		error: "Use the address allowlist for IPs — this field is a DNS name."
+	};
+	if (!DNS_NAME.test(lowered)) return {
+		ok: false,
+		error: "Enter a DNS name such as camstack.lan, without a scheme or port."
+	};
+	return {
+		ok: true,
+		value: lowered
+	};
+}
+//#endregion
 //#region src/builtins/local-network/local-network.addon.ts
 /**
 * local-network — hub-only system cap implementation.
@@ -51,7 +89,10 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		super({
 			allowedAddresses: [],
 			bootSeeded: false,
-			notificationBaseUrl: ""
+			notificationBaseUrl: "",
+			httpEnabled: true,
+			httpPort: require_lan_http_bind.DEFAULT_LAN_HTTP_PORT,
+			localHostname: ""
 		});
 	}
 	/**
@@ -97,8 +138,15 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 					source: localPort.source
 				} });
 				await this.reconcileMeshEndpoint();
+				const httpState = require_lan_http_bind.readLanHttpState();
 				return {
-					endpoints: buildEndpoints(interfaces, localPort.port, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint),
+					endpoints: buildEndpoints(interfaces, localPort.port, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, {
+						enabled: this.config.httpEnabled !== false,
+						listening: httpState.listening,
+						httpPort: this.resolvedHttpPort(),
+						httpsPort: localPort.port,
+						localHostname: this.config.localHostname || null
+					}),
 					localPort
 				};
 			},
@@ -133,6 +181,33 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 					dropped: addresses.length - cleaned.length
 				} });
 				return { success: true };
+			},
+			getTlsStatus: async () => this.snapshotTls(false),
+			regenerateCertificate: async (_input) => {
+				if (require_lan_http_bind.readTlsMode(this.tlsDataDir()) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
+				const extraSans = [...require_lan_http_bind.readExtraSans(this.tlsDataDir())];
+				await require_lan_http_bind.reissueTlsLeaf(this.tlsDataDir(), { extraSans });
+				return this.snapshotTls(true);
+			},
+			uploadCertificate: async ({ certPem, keyPem, caPem }) => {
+				const valid = require_lan_http_bind.validateUploadedTls(certPem, keyPem);
+				if (!valid.ok) throw new Error(valid.error);
+				const dir = (0, node_path.join)(this.tlsDataDir(), "tls");
+				await (0, node_fs_promises.mkdir)(dir, { recursive: true });
+				await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.crt"), certPem.endsWith("\n") ? certPem : `${certPem}\n`);
+				await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.key"), keyPem.endsWith("\n") ? keyPem : `${keyPem}\n`, { mode: 384 });
+				if (caPem && caPem.trim() !== "") await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack-ca.crt"), caPem.endsWith("\n") ? caPem : `${caPem}\n`);
+				require_lan_http_bind.writeTlsMode(this.tlsDataDir(), "uploaded");
+				return this.snapshotTls(true);
+			},
+			downloadCa: async () => {
+				return { pem: this.snapshotTls(false).caCertPem ?? "" };
+			},
+			revertToGeneratedCertificate: async () => {
+				require_lan_http_bind.writeTlsMode(this.tlsDataDir(), "generated");
+				const extraSans = [...require_lan_http_bind.readExtraSans(this.tlsDataDir())];
+				await require_lan_http_bind.ensureTlsCert(this.tlsDataDir(), { extraSans });
+				return this.snapshotTls(true);
 			}
 		};
 		this.lastSnapshotKey = snapshotKey(this.enumerate());
@@ -156,11 +231,58 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			} : null);
 		});
 		this.ctx.logger.info("local-network initialized", { meta: { interfaceCount: this.enumerate().length } });
+		try {
+			await this.applyLanAccessFromSettings();
+		} catch (err) {
+			this.ctx.logger.warn("local-network: LAN HTTP not applied at boot", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
 		return [{
 			capability: require_dist.localNetworkCapability,
 			provider
 		}];
 	}
+	globalSettingsSchema() {
+		return this.schema({ sections: [{
+			id: "local-access",
+			title: "LAN HTTP",
+			description: "Native apps on this Wi-Fi use http:// and skip the private certificate. The tunnel and this admin UI stay on HTTPS. Turn off once a publicly-trusted certificate covers the LAN name.",
+			columns: 1,
+			fields: [
+				this.field({
+					type: "boolean",
+					key: "httpEnabled",
+					label: "Enable HTTP on the LAN",
+					style: "switch",
+					default: true
+				}),
+				this.field({
+					type: "number",
+					key: "httpPort",
+					label: "HTTP port",
+					description: "Dedicated listener. Must not equal the HTTPS port (4443 by default).",
+					min: 1,
+					max: 65535,
+					step: 1,
+					default: require_lan_http_bind.DEFAULT_LAN_HTTP_PORT,
+					showWhen: {
+						field: "httpEnabled",
+						equals: true
+					}
+				}),
+				this.field({
+					type: "text",
+					key: "localHostname",
+					label: "Local hostname",
+					description: "Advertised to the viewer instead of the raw LAN IP, and added to the certificate SAN. Requires this name to resolve on the LAN (router DNS, mDNS, or a hosts file). Leave empty to keep using the IP.",
+					maxLength: 253,
+					placeholder: "camstack.lan"
+				})
+			]
+		}] });
+	}
+	async onConfigChanged() {
+		await this.applyLanAccessFromSettings();
+	}
 	async onShutdown() {
 		if (this.pollTimer) {
 			clearInterval(this.pollTimer);
@@ -229,6 +351,42 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			}
 		}
 	}
+	resolvedHttpPort() {
+		const port = this.config.httpPort;
+		return Number.isInteger(port) && port >= 1 && port <= 65535 ? port : require_lan_http_bind.DEFAULT_LAN_HTTP_PORT;
+	}
+	tlsDataDir() {
+		return this.ctx.nodeDataDir ?? this.ctx.dataDir;
+	}
+	snapshotTls(restartRequired) {
+		const status = require_lan_http_bind.readTlsAccessStatus(this.tlsDataDir(), restartRequired);
+		return {
+			...status,
+			sans: [...status.sans]
+		};
+	}
+	/**
+	* Bind or unbind the LAN HTTP sibling from the addon's own settings, and
+	* keep the leaf SAN in sync with `localHostname`. This is the settings
+	* side-effect path — there is no second persist API.
+	*/
+	async applyLanAccessFromSettings() {
+		const parsed = parseLocalHostname(this.config.localHostname ?? "");
+		if (!parsed.ok) throw new Error(parsed.error);
+		const hostname = parsed.value ?? "";
+		const httpsPort = (await this.resolveAdvertisedListenPort(null)).port;
+		const httpPort = this.resolvedHttpPort();
+		if (this.config.httpEnabled !== false && httpPort === httpsPort) throw new Error(`HTTP port ${httpPort} cannot equal the HTTPS listen port`);
+		await require_lan_http_bind.applyLanHttp({
+			enabled: this.config.httpEnabled !== false,
+			port: httpPort,
+			host: "0.0.0.0"
+		});
+		if (hostname !== "") {
+			require_lan_http_bind.writeExtraSans(this.tlsDataDir(), [hostname]);
+			if (require_lan_http_bind.readTlsMode(this.tlsDataDir()) === "generated") await require_lan_http_bind.ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] });
+		} else require_lan_http_bind.writeExtraSans(this.tlsDataDir(), []);
+	}
 	/**
 	* The port this hub is actually listening on, plus the provenance of the
 	* number. The boot loader merges the `CAMSTACK_PORT` env override into the
@@ -402,31 +560,13 @@ function pickPreferred(interfaces) {
 		return prefixLen(b.netmask) - prefixLen(a.netmask);
 	})[0] ?? null;
 }
-/**
-* Build the ordered candidate URL list. Priority schema:
-*   0       — preferred LAN IPv4
-*   10+     — other LAN IPv4
-*   100     — public tunnel hostname (always HTTPS)
-*   150     — mesh endpoint (Tailscale MagicDNS / 100.x, always HTTPS)
-*   200+    — LAN IPv6
-*   1000    — loopback (last resort)
-*
-* The mesh endpoint ranks just below a true public funnel (a Funnel is
-* reachable by ANY client; the mesh needs the peer on the same tailnet)
-* but above the IPv6 / loopback fallbacks — giving remote, mesh-joined
-* clients a working candidate when no public tunnel is up.
-*
-* `scheme` controls LAN + loopback URLs. Browsers running over HTTPS
-* block `http://` candidates as mixed content, so callers loaded over
-* HTTPS should pass `scheme: 'https'` even when probing a LAN IP — the
-* hub's cert manager already issues a SAN-multi cert covering local
-* interfaces. The public tunnel + mesh endpoint always emit `https://`
-* (the tunnel edge / the hub itself terminates TLS).
-*/
-function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostname, scheme = "http", meshEndpoint = null) {
+function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostname, scheme = "http", meshEndpoint = null, lanHttp = null) {
 	const out = [];
 	let priority = 0;
 	const preferred = pickPreferred(interfaces);
+	const httpLan = lanHttp?.enabled === true && lanHttp.listening === true;
+	const lanScheme = httpLan ? "http" : scheme;
+	const lanPort = httpLan ? lanHttp.httpPort : port;
 	const emit = (iface, kind, label, baseUrl, pri) => {
 		out.push({
 			label,
@@ -438,13 +578,22 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 			priority: pri
 		});
 	};
-	if (preferred) emit(preferred, "lan-ipv4", `${formatKind(preferred.kind)} — ${preferred.name}`, `${scheme}://${preferred.address}:${port}`, priority++);
+	if (httpLan && lanHttp.localHostname) out.push({
+		label: "Local name",
+		baseUrl: `${lanScheme}://${lanHttp.localHostname}:${lanPort}`,
+		kind: "lan-ipv4",
+		interfaceKind: "lan",
+		plausible: true,
+		plausibleReason: "",
+		priority: priority++
+	});
+	if (preferred) emit(preferred, "lan-ipv4", `${formatKind(preferred.kind)} — ${preferred.name}`, `${lanScheme}://${preferred.address}:${lanPort}`, priority++);
 	for (const iface of interfaces) {
 		if (iface.internal || iface.family !== "IPv4") continue;
 		if (iface.kind === "loopback") continue;
 		if (preferred && iface.name === preferred.name && iface.address === preferred.address) continue;
 		if (iface.address.startsWith("169.254.")) continue;
-		emit(iface, "lan-ipv4", `${formatKind(iface.kind)} — ${iface.name}`, `${scheme}://${iface.address}:${port}`, 10 + priority++);
+		emit(iface, "lan-ipv4", `${formatKind(iface.kind)} — ${iface.name}`, `${lanScheme}://${iface.address}:${lanPort}`, 10 + priority++);
 	}
 	if (publicHostname) out.push({
 		label: "Public tunnel",
@@ -470,7 +619,7 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 			if (iface.internal || iface.family !== "IPv6") continue;
 			if (iface.kind === "loopback") continue;
 			if (iface.address.startsWith("fe80:")) continue;
-			emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${scheme}://[${iface.address}]:${port}`, v6prio++);
+			emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, v6prio++);
 		}
 	}
 	if (includeLoopback) out.push({