@camstack/system 1.2.115 → 1.2.117

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { V as filesystemBrowseCapability, pt as storageProviderCapability, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { V as filesystemBrowseCapability, pt as storageProviderCapability, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-OfhqQio4.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-DET4YkAU.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_module = require("node:module");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,5 +1,5 @@
-import { A as dataStoreProviderCapability, Bt as parseJsonUnknown, _t as vectorStoreCapability, f as RUNTIME_DEFAULTS, gt as vectorDimFromBase64, j as decodeVectorBase64, kt as asJsonObject, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
-import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-Dz5-7gjt.mjs";
+import { A as dataStoreProviderCapability, Bt as parseJsonUnknown, _t as vectorStoreCapability, f as RUNTIME_DEFAULTS, gt as vectorDimFromBase64, j as decodeVectorBase64, kt as asJsonObject, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys--aM_vGF9.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { dt as storageCapability, ft as storageMigrationCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as settingsStoreCapability, yt as BaseAddon, zt as parseJsonObject } from "../../dist-Drb54SZD.mjs";
+import { dt as storageCapability, ft as storageMigrationCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as settingsStoreCapability, yt as BaseAddon, zt as parseJsonObject } from "../../dist-D4Vmj8iw.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { It as hydrateSchema, vt as errMsg, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { It as hydrateSchema, vt as errMsg, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-Drb54SZD.mjs → dist-D4Vmj8iw.mjs}

@@ -19197,6 +19197,9 @@ var storageProviderCapability = {
 		endDownload: method(EndDownloadInputSchema, z.void(), { kind: "mutation" })
 	}
 };
+/** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
+var ProfileSettingsSchemaBridge = z.unknown().nullable();
+var ProfileSettingsBagSchema = z.record(z.string(), z.unknown());
 /**
 * A live terminal session hosted by the provider addon. Output and input do
 * NOT flow through the capability — they use the addon data plane
@@ -19226,7 +19229,14 @@ var TerminalSessionInfoSchema = z.object({
 var TerminalProfileInfoSchema = z.object({
 	profileId: z.string(),
 	label: z.string(),
-	description: z.string().optional()
+	description: z.string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: z.string().optional(),
+	args: z.array(z.string()).readonly().optional(),
+	cwd: z.string().optional(),
+	environment: z.array(z.string()).readonly().optional(),
+	/** ConfigUISchema for instance knobs, or null when the profile has none. */
+	settingsSchema: ProfileSettingsSchemaBridge.optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -19239,7 +19249,12 @@ var TerminalInstanceInfoSchema = z.object({
 	profileId: z.string(),
 	profileLabel: z.string(),
 	name: z.string(),
-	enabled: z.boolean()
+	enabled: z.boolean(),
+	executable: z.string(),
+	args: z.array(z.string()).readonly(),
+	cwd: z.string(),
+	environment: z.array(z.string()).readonly(),
+	profileSettings: ProfileSettingsBagSchema
 });
 var TerminalLegacyCameraSchema = z.object({
 	stableId: z.string(),
@@ -19285,7 +19300,24 @@ var terminalSessionCapability = {
 		createInstance: method(z.object({
 			targetNodeId: z.string().min(1),
 			profileId: z.string().min(1),
-			name: z.string().trim().min(1).max(160).optional()
+			name: z.string().trim().min(1).max(160).optional(),
+			executable: z.string().max(1024).optional(),
+			args: z.array(z.string().max(2048)).max(64).optional(),
+			cwd: z.string().max(1024).optional(),
+			environment: z.array(z.string().max(4096)).max(64).optional(),
+			profileSettings: ProfileSettingsBagSchema.optional()
+		}), TerminalInstanceInfoSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateInstance: method(z.object({
+			instanceId: z.string().min(1),
+			name: z.string().trim().min(1).max(160).optional(),
+			executable: z.string().max(1024).optional(),
+			args: z.array(z.string().max(2048)).max(64).optional(),
+			cwd: z.string().max(1024).optional(),
+			environment: z.array(z.string().max(4096)).max(64).optional(),
+			profileSettings: ProfileSettingsBagSchema.optional()
 		}), TerminalInstanceInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -19320,7 +19352,11 @@ var terminalSessionCapability = {
 		openSession: method(z.object({
 			profileId: z.string(),
 			cols: z.number().int().positive(),
-			rows: z.number().int().positive()
+			rows: z.number().int().positive(),
+			executable: z.string().max(1024).optional(),
+			args: z.array(z.string().max(2048)).max(64).optional(),
+			cwd: z.string().max(1024).optional(),
+			environment: z.array(z.string().max(4096)).max(64).optional()
 		}), TerminalSessionInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -23753,10 +23789,10 @@ var lawnMowerControlCapability = {
 *
 *  • The SDK (mobile / web client) consumes `getConnectionEndpoints()`
 *    to receive an ordered list of candidate base URLs it should race
-*    on connect — LAN IPv4 first (lowest latency when on same network),
-*    then public hostname (if a tunnel is up), then IPv6. The SDK can
-*    race them with short timeouts and stick with the winner for the
-*    session.
+*    on connect — LAN IPv4 and stable LAN IPv6 first (lowest latency
+*    when on the same network), then public hostname (if a tunnel is
+*    up). The SDK can race them with short timeouts and stick with the
+*    winner for the session.
 *
 * Why hub-only: agents are not directly addressable by the operator's
 * clients — they reverse-connect to the hub. Exposing their interfaces
@@ -23919,6 +23955,20 @@ var AllowedAddressesSchema = z.object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: z.array(z.string()).readonly() });
+var TlsStatusSchema = z.object({
+	mode: z.enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: z.string().nullable(),
+	caFingerprintSha256: z.string().nullable(),
+	validTo: z.string().nullable(),
+	sans: z.array(z.string()),
+	caCertPem: z.string().nullable(),
+	reissueError: z.string().nullable(),
+	restartRequired: z.boolean()
+});
 var localNetworkCapability = {
 	name: "local-network",
 	scope: "system",
@@ -24024,7 +24074,34 @@ var localNetworkCapability = {
 		* when the operator wants to wipe their manual edits and start
 		* over from the auto-detected best matches.
 		*/
-		resetAllowlistToBestMatch: method(z.void(), AllowedAddressesSchema, { kind: "mutation" })
+		resetAllowlistToBestMatch: method(z.void(), AllowedAddressesSchema, { kind: "mutation" }),
+		/**
+		* Live TLS material for the Network → Local access certificate card.
+		* LAN HTTP / hostname are addon settings (`globalSettingsSchema`), not
+		* a second store — this query is status, not configuration.
+		*/
+		getTlsStatus: method(z.void(), TlsStatusSchema),
+		/** Issue a new leaf under the existing local CA. Disabled in uploaded mode. */
+		regenerateCertificate: method(z.object({ reason: z.string().optional() }), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Replace the served material with operator-supplied PEMs. */
+		uploadCertificate: method(z.object({
+			certPem: z.string().min(1),
+			keyPem: z.string().min(1),
+			caPem: z.string().optional()
+		}), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The local CA PEM, or empty when there is none to download. */
+		downloadCa: method(z.void(), z.object({ pem: z.string() })),
+		/** Drop uploaded material and return to the generated local CA. */
+		revertToGeneratedCertificate: method(z.void(), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
 	mount: { kind: "hub-only" }
@@ -32478,6 +32555,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -32502,18 +32585,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -32526,6 +32627,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -35406,6 +35513,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -38173,6 +38286,35 @@ Object.freeze(Object.fromEntries([{
 	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 z.string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = z.number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 z.object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.

package/dist/{dist-iAwSA2_f.js → dist-DMEGlqg6.js}

@@ -19197,6 +19197,9 @@ var storageProviderCapability = {
 		endDownload: method(EndDownloadInputSchema, zod.z.void(), { kind: "mutation" })
 	}
 };
+/** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
+var ProfileSettingsSchemaBridge = zod.z.unknown().nullable();
+var ProfileSettingsBagSchema = zod.z.record(zod.z.string(), zod.z.unknown());
 /**
 * A live terminal session hosted by the provider addon. Output and input do
 * NOT flow through the capability — they use the addon data plane
@@ -19226,7 +19229,14 @@ var TerminalSessionInfoSchema = zod.z.object({
 var TerminalProfileInfoSchema = zod.z.object({
 	profileId: zod.z.string(),
 	label: zod.z.string(),
-	description: zod.z.string().optional()
+	description: zod.z.string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: zod.z.string().optional(),
+	args: zod.z.array(zod.z.string()).readonly().optional(),
+	cwd: zod.z.string().optional(),
+	environment: zod.z.array(zod.z.string()).readonly().optional(),
+	/** ConfigUISchema for instance knobs, or null when the profile has none. */
+	settingsSchema: ProfileSettingsSchemaBridge.optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -19239,7 +19249,12 @@ var TerminalInstanceInfoSchema = zod.z.object({
 	profileId: zod.z.string(),
 	profileLabel: zod.z.string(),
 	name: zod.z.string(),
-	enabled: zod.z.boolean()
+	enabled: zod.z.boolean(),
+	executable: zod.z.string(),
+	args: zod.z.array(zod.z.string()).readonly(),
+	cwd: zod.z.string(),
+	environment: zod.z.array(zod.z.string()).readonly(),
+	profileSettings: ProfileSettingsBagSchema
 });
 var TerminalLegacyCameraSchema = zod.z.object({
 	stableId: zod.z.string(),
@@ -19285,7 +19300,24 @@ var terminalSessionCapability = {
 		createInstance: method(zod.z.object({
 			targetNodeId: zod.z.string().min(1),
 			profileId: zod.z.string().min(1),
-			name: zod.z.string().trim().min(1).max(160).optional()
+			name: zod.z.string().trim().min(1).max(160).optional(),
+			executable: zod.z.string().max(1024).optional(),
+			args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+			cwd: zod.z.string().max(1024).optional(),
+			environment: zod.z.array(zod.z.string().max(4096)).max(64).optional(),
+			profileSettings: ProfileSettingsBagSchema.optional()
+		}), TerminalInstanceInfoSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateInstance: method(zod.z.object({
+			instanceId: zod.z.string().min(1),
+			name: zod.z.string().trim().min(1).max(160).optional(),
+			executable: zod.z.string().max(1024).optional(),
+			args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+			cwd: zod.z.string().max(1024).optional(),
+			environment: zod.z.array(zod.z.string().max(4096)).max(64).optional(),
+			profileSettings: ProfileSettingsBagSchema.optional()
 		}), TerminalInstanceInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -19320,7 +19352,11 @@ var terminalSessionCapability = {
 		openSession: method(zod.z.object({
 			profileId: zod.z.string(),
 			cols: zod.z.number().int().positive(),
-			rows: zod.z.number().int().positive()
+			rows: zod.z.number().int().positive(),
+			executable: zod.z.string().max(1024).optional(),
+			args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+			cwd: zod.z.string().max(1024).optional(),
+			environment: zod.z.array(zod.z.string().max(4096)).max(64).optional()
 		}), TerminalSessionInfoSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -23753,10 +23789,10 @@ var lawnMowerControlCapability = {
 *
 *  • The SDK (mobile / web client) consumes `getConnectionEndpoints()`
 *    to receive an ordered list of candidate base URLs it should race
-*    on connect — LAN IPv4 first (lowest latency when on same network),
-*    then public hostname (if a tunnel is up), then IPv6. The SDK can
-*    race them with short timeouts and stick with the winner for the
-*    session.
+*    on connect — LAN IPv4 and stable LAN IPv6 first (lowest latency
+*    when on the same network), then public hostname (if a tunnel is
+*    up). The SDK can race them with short timeouts and stick with the
+*    winner for the session.
 *
 * Why hub-only: agents are not directly addressable by the operator's
 * clients — they reverse-connect to the hub. Exposing their interfaces
@@ -23919,6 +23955,20 @@ var AllowedAddressesSchema = zod.z.object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: zod.z.array(zod.z.string()).readonly() });
+var TlsStatusSchema = zod.z.object({
+	mode: zod.z.enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: zod.z.string().nullable(),
+	caFingerprintSha256: zod.z.string().nullable(),
+	validTo: zod.z.string().nullable(),
+	sans: zod.z.array(zod.z.string()),
+	caCertPem: zod.z.string().nullable(),
+	reissueError: zod.z.string().nullable(),
+	restartRequired: zod.z.boolean()
+});
 var localNetworkCapability = {
 	name: "local-network",
 	scope: "system",
@@ -24024,7 +24074,34 @@ var localNetworkCapability = {
 		* when the operator wants to wipe their manual edits and start
 		* over from the auto-detected best matches.
 		*/
-		resetAllowlistToBestMatch: method(zod.z.void(), AllowedAddressesSchema, { kind: "mutation" })
+		resetAllowlistToBestMatch: method(zod.z.void(), AllowedAddressesSchema, { kind: "mutation" }),
+		/**
+		* Live TLS material for the Network → Local access certificate card.
+		* LAN HTTP / hostname are addon settings (`globalSettingsSchema`), not
+		* a second store — this query is status, not configuration.
+		*/
+		getTlsStatus: method(zod.z.void(), TlsStatusSchema),
+		/** Issue a new leaf under the existing local CA. Disabled in uploaded mode. */
+		regenerateCertificate: method(zod.z.object({ reason: zod.z.string().optional() }), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Replace the served material with operator-supplied PEMs. */
+		uploadCertificate: method(zod.z.object({
+			certPem: zod.z.string().min(1),
+			keyPem: zod.z.string().min(1),
+			caPem: zod.z.string().optional()
+		}), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The local CA PEM, or empty when there is none to download. */
+		downloadCa: method(zod.z.void(), zod.z.object({ pem: zod.z.string() })),
+		/** Drop uploaded material and return to the generated local CA. */
+		revertToGeneratedCertificate: method(zod.z.void(), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
 	mount: { kind: "hub-only" }
@@ -32478,6 +32555,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -32502,18 +32585,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -32526,6 +32627,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -35406,6 +35513,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -38173,6 +38286,35 @@ Object.freeze(Object.fromEntries([{
 	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 zod.z.string().min(1);
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = zod.z.number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 zod.z.object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.

package/dist/http/lan-http-bind.d.ts

@@ -0,0 +1,30 @@
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { Duplex } from 'node:stream';
+export interface LanHttpBindOptions {
+    readonly enabled: boolean;
+    readonly port: number;
+    readonly host: string;
+}
+export interface LanHttpBindResult {
+    readonly listening: boolean;
+    readonly error: string | null;
+    readonly port: number;
+}
+export type LanHttpRequestHandler = (req: IncomingMessage, res: ServerResponse) => void;
+export type LanHttpUpgradeHandler = (req: IncomingMessage, socket: Duplex, head: Buffer) => void;
+export interface LanHttpHandlers {
+    readonly onRequest: LanHttpRequestHandler;
+    readonly onUpgrade: LanHttpUpgradeHandler;
+}
+export declare const DEFAULT_LAN_HTTP_PORT = 4480;
+/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
+export declare function allFamiliesListenHost(host: string): {
+    host: string;
+    ipv6Only: boolean;
+};
+export declare function registerLanHttpHandler(next: LanHttpHandlers | null): void;
+export declare function readLanHttpState(): LanHttpBindResult;
+export declare function applyLanHttp(options: LanHttpBindOptions): Promise<LanHttpBindResult>;
+/** After the hub registers the Fastify request handler, bind whatever was pending. */
+export declare function bindPendingLanHttp(): Promise<LanHttpBindResult>;
+export declare function closeLanHttp(): Promise<void>;

package/dist/index.d.ts

@@ -80,6 +80,7 @@ export { StorageLocationManager } from './storage/storage-location-manager.js';
 export type { IFileStorage, IStorageLocation, IStorageProvider as ICoreStorageProvider, IStructuredStorage, QueryFilter, StorageRecord, } from './storage/storage-manager.js';
 export { StorageManager } from './storage/storage-manager.js';
 export * from './tls/index.js';
+export { applyLanHttp, allFamiliesListenHost, bindPendingLanHttp, closeLanHttp, DEFAULT_LAN_HTTP_PORT, readLanHttpState, registerLanHttpHandler, } from './http/lan-http-bind.js';
 export { IntegrationRegistry } from './builtins/sqlite-storage/integration-registry.js';
 export { type EnsureAddonNativePrebuildsOptions, ensureAddonNativePrebuilds, type NativeEnsureOutcome, type NativeEnsureResult, } from './kernel/deps/ensure-addon-natives.js';
 export { type EnsureNativePrebuildsOptions, ensureNativePrebuilds, hasDotNode, NATIVE_SCAN_DEPTH, type PrebuildFetchFn, type PrebuildTarget, TRADITIONAL_NATIVE_PACKAGES, } from './kernel/deps/ensure-native-prebuilds.js';