@camstack/system 1.2.131 → 1.2.132

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
 const require_dist = require("../../dist-DqcaE-k1.js");
-const require_lan_http_bind = require("../../lan-http-bind-DmgpFP6_.js");
+const require_tls = require("../../tls-u8QCJCFE.js");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 let node_os = require("node:os");
@@ -202,7 +202,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			notificationBaseUrl: "",
 			viewerBaseUrls: [],
 			httpEnabled: true,
-			httpPort: require_lan_http_bind.DEFAULT_LAN_HTTP_PORT,
+			httpPort: require_tls.DEFAULT_LAN_HTTP_PORT,
 			localHostname: ""
 		});
 	}
@@ -237,7 +237,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		const allow = this.config.allowedAddresses;
 		const interfaces = applyAllowlist(this.enumerate(), allow);
 		await this.reconcileMeshEndpoint();
-		const httpState = require_lan_http_bind.readLanHttpState();
+		const httpState = require_tls.readLanHttpState();
 		return buildEndpoints(interfaces, httpsPort, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, {
 			enabled: this.config.httpEnabled !== false,
 			listening: httpState.listening,
@@ -320,29 +320,29 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			},
 			getTlsStatus: async () => this.snapshotTls(false),
 			regenerateCertificate: async (_input) => {
-				if (require_lan_http_bind.readTlsMode(this.tlsDataDir()) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
-				const extraSans = [...require_lan_http_bind.readExtraSans(this.tlsDataDir())];
-				await require_lan_http_bind.reissueTlsLeaf(this.tlsDataDir(), { extraSans });
+				if (require_tls.readTlsMode(this.tlsDataDir()) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
+				const extraSans = [...require_tls.readExtraSans(this.tlsDataDir())];
+				await require_tls.reissueTlsLeaf(this.tlsDataDir(), { extraSans });
 				return this.snapshotTls(true);
 			},
 			uploadCertificate: async ({ certPem, keyPem, caPem }) => {
-				const valid = require_lan_http_bind.validateUploadedTls(certPem, keyPem);
+				const valid = require_tls.validateUploadedTls(certPem, keyPem);
 				if (!valid.ok) throw new Error(valid.error);
 				const dir = (0, node_path.join)(this.tlsDataDir(), "tls");
 				await (0, node_fs_promises.mkdir)(dir, { recursive: true });
 				await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.crt"), certPem.endsWith("\n") ? certPem : `${certPem}\n`);
 				await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.key"), keyPem.endsWith("\n") ? keyPem : `${keyPem}\n`, { mode: 384 });
 				if (caPem && caPem.trim() !== "") await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack-ca.crt"), caPem.endsWith("\n") ? caPem : `${caPem}\n`);
-				require_lan_http_bind.writeTlsMode(this.tlsDataDir(), "uploaded");
+				require_tls.writeTlsMode(this.tlsDataDir(), "uploaded");
 				return this.snapshotTls(true);
 			},
 			downloadCa: async () => {
 				return { pem: this.snapshotTls(false).caCertPem ?? "" };
 			},
 			revertToGeneratedCertificate: async () => {
-				require_lan_http_bind.writeTlsMode(this.tlsDataDir(), "generated");
-				const extraSans = [...require_lan_http_bind.readExtraSans(this.tlsDataDir())];
-				await require_lan_http_bind.ensureTlsCert(this.tlsDataDir(), { extraSans });
+				require_tls.writeTlsMode(this.tlsDataDir(), "generated");
+				const extraSans = [...require_tls.readExtraSans(this.tlsDataDir())];
+				await require_tls.ensureTlsCert(this.tlsDataDir(), { extraSans });
 				return this.snapshotTls(true);
 			}
 		};
@@ -403,7 +403,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 					min: 1,
 					max: 65535,
 					step: 1,
-					default: require_lan_http_bind.DEFAULT_LAN_HTTP_PORT,
+					default: require_tls.DEFAULT_LAN_HTTP_PORT,
 					showWhen: {
 						field: "httpEnabled",
 						equals: true
@@ -497,13 +497,13 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	}
 	resolvedHttpPort() {
 		const port = this.config.httpPort;
-		return Number.isInteger(port) && port >= 1 && port <= 65535 ? port : require_lan_http_bind.DEFAULT_LAN_HTTP_PORT;
+		return Number.isInteger(port) && port >= 1 && port <= 65535 ? port : require_tls.DEFAULT_LAN_HTTP_PORT;
 	}
 	tlsDataDir() {
 		return this.ctx.nodeDataDir ?? this.ctx.dataDir;
 	}
 	snapshotTls(restartRequired) {
-		const status = require_lan_http_bind.readTlsAccessStatus(this.tlsDataDir(), restartRequired);
+		const status = require_tls.readTlsAccessStatus(this.tlsDataDir(), restartRequired);
 		return {
 			...status,
 			sans: [...status.sans]
@@ -521,15 +521,15 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		const httpsPort = (await this.resolveAdvertisedListenPort(null)).port;
 		const httpPort = this.resolvedHttpPort();
 		if (this.config.httpEnabled !== false && httpPort === httpsPort) throw new Error(`HTTP port ${httpPort} cannot equal the HTTPS listen port`);
-		await require_lan_http_bind.applyLanHttp({
+		await require_tls.applyLanHttp({
 			enabled: this.config.httpEnabled !== false,
 			port: httpPort,
 			host: "0.0.0.0"
 		});
 		if (hostname !== "") {
-			require_lan_http_bind.writeExtraSans(this.tlsDataDir(), [hostname]);
-			if (require_lan_http_bind.readTlsMode(this.tlsDataDir()) === "generated") await require_lan_http_bind.ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] });
-		} else require_lan_http_bind.writeExtraSans(this.tlsDataDir(), []);
+			require_tls.writeExtraSans(this.tlsDataDir(), [hostname]);
+			if (require_tls.readTlsMode(this.tlsDataDir()) === "generated") await require_tls.ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] });
+		} else require_tls.writeExtraSans(this.tlsDataDir(), []);
 	}
 	/**
 	* The port this hub is actually listening on, plus the provenance of the

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
 import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-BUEU7B1V.mjs";
-import { c as readExtraSans, d as writeExtraSans, f as writeTlsMode, g as reissueTlsLeaf, l as readTlsAccessStatus, m as ensureTlsCert, o as readLanHttpState, p as validateUploadedTls, r as applyLanHttp, t as DEFAULT_LAN_HTTP_PORT, u as readTlsMode } from "../../lan-http-bind-jKrj6OjQ.mjs";
+import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-CQhPGSJm.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import * as os from "node:os";

package/dist/http/data-plane-registry.d.ts

@@ -21,3 +21,28 @@ export declare class DataPlaneRegistry {
      */
     match(addonId: string, subPath: string): DataPlaneMatch | null;
 }
+/** What the hub knows about an addon when it re-evaluates its data-planes. */
+export interface DataPlaneEligibility {
+    /** The addon still has an entry in the registry service. */
+    readonly hasEntry: boolean;
+    /** That entry is a FORKED addon — the only kind that serves a data-plane today. */
+    readonly isForked: boolean;
+    /** The child process is currently known to the child registry. */
+    readonly childKnown: boolean;
+}
+/**
+ * Whether an addon can serve a data-plane RIGHT NOW.
+ *
+ * Extracted as a predicate because the three ways of answering "no" used to be
+ * three early `return`s inside the mount path, and every one of them left the
+ * PREVIOUS registration standing. The registry then held a `baseUrl` pointing
+ * at the port of a process that no longer existed, and `/addon/:addonId/*` kept
+ * reverse-proxying to it — a 502 per request until a replacement child finished
+ * handshaking, and forever for an addon removed from disk. `unregisterAddon`
+ * existed for exactly this and had no call site anywhere in the repo.
+ *
+ * A `false` here means UNREGISTER, never "leave it alone". Dropping is the safe
+ * direction: an absent data-plane falls through to the control-route path,
+ * while a stale one sends live traffic at a dead socket.
+ */
+export declare function canServeDataPlane(state: DataPlaneEligibility): boolean;

package/dist/index.d.ts

@@ -39,10 +39,11 @@ export type { FeatureConfigReader, FeatureFlag, FeatureManifest, } from './featu
 export { FeatureManager } from './feature/feature-manager.js';
 export type { AuthenticatedFileServerOptions, ByteRange, FileResolveResult, FileServerHandle, FileServerTokenVerifier, } from './http/authenticated-file-server.js';
 export { contentTypeFor, createAuthenticatedFileServer, parseRangeHeader, parseTokenizedUrl, resolveFilePath, } from './http/authenticated-file-server.js';
-export type { DataPlaneMatch } from './http/data-plane-registry.js';
-export { DataPlaneRegistry } from './http/data-plane-registry.js';
+export type { DataPlaneEligibility, DataPlaneMatch } from './http/data-plane-registry.js';
+export { canServeDataPlane, DataPlaneRegistry } from './http/data-plane-registry.js';
 export type { FileDataPlaneOptions } from './http/file-data-plane.js';
 export { createFileDataPlaneHandler } from './http/file-data-plane.js';
+export { allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, closeLanHttp, DEFAULT_LAN_HTTP_PORT, readLanHttpState, registerLanHttpHandler, } from './http/lan-http-bind.js';
 export type { ReverseProxyOptions } from './http/reverse-proxy.js';
 export { proxyToUpstream } from './http/reverse-proxy.js';
 export type { HeapReclaimer, HeapReclaimOptions, HeapSample, HeapWatchSink, RunnerHeapWatchOptions, } from './kernel/heap-watch.js';
@@ -80,7 +81,6 @@ export { StorageLocationManager } from './storage/storage-location-manager.js';
 export type { IFileStorage, IStorageLocation, IStorageProvider as ICoreStorageProvider, IStructuredStorage, QueryFilter, StorageRecord, } from './storage/storage-manager.js';
 export { StorageManager } from './storage/storage-manager.js';
 export * from './tls/index.js';
-export { applyLanHttp, allFamiliesListenHost, bindPendingLanHttp, closeLanHttp, DEFAULT_LAN_HTTP_PORT, readLanHttpState, registerLanHttpHandler, } from './http/lan-http-bind.js';
 export { IntegrationRegistry } from './builtins/sqlite-storage/integration-registry.js';
 export { type EnsureAddonNativePrebuildsOptions, ensureAddonNativePrebuilds, type NativeEnsureOutcome, type NativeEnsureResult, } from './kernel/deps/ensure-addon-natives.js';
 export { type EnsureNativePrebuildsOptions, ensureNativePrebuilds, hasDotNode, NATIVE_SCAN_DEPTH, type PrebuildFetchFn, type PrebuildTarget, TRADITIONAL_NATIVE_PACKAGES, } from './kernel/deps/ensure-native-prebuilds.js';

package/dist/index.js

@@ -25,9 +25,9 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
+const require_tls$1 = require("./tls-u8QCJCFE.js");
 const require_manifest_python_deps = require("./manifest-python-deps-BTkFwAk_.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
-const require_lan_http_bind = require("./lan-http-bind-DmgpFP6_.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -373,6 +373,24 @@ var DataPlaneRegistry = class {
 		};
 	}
 };
+/**
+* Whether an addon can serve a data-plane RIGHT NOW.
+*
+* Extracted as a predicate because the three ways of answering "no" used to be
+* three early `return`s inside the mount path, and every one of them left the
+* PREVIOUS registration standing. The registry then held a `baseUrl` pointing
+* at the port of a process that no longer existed, and `/addon/:addonId/*` kept
+* reverse-proxying to it — a 502 per request until a replacement child finished
+* handshaking, and forever for an addon removed from disk. `unregisterAddon`
+* existed for exactly this and had no call site anywhere in the repo.
+*
+* A `false` here means UNREGISTER, never "leave it alone". Dropping is the safe
+* direction: an absent data-plane falls through to the control-route path,
+* while a stale one sends live traffic at a dead socket.
+*/
+function canServeDataPlane(state) {
+	return state.hasEntry && state.isForked && state.childKnown;
+}
 //#endregion
 //#region src/http/reverse-proxy.ts
 /**
@@ -95060,8 +95078,8 @@ exports.AddonRouteRegistry = AddonRouteRegistry;
 exports.AlertCenterAddon = require_builtins_alerts_alerts_addon.AlertCenterAddon;
 exports.ApiKeyManager = require_builtins_local_auth_local_auth_addon.ApiKeyManager;
 exports.AuthManager = require_builtins_local_auth_local_auth_addon.AuthManager;
-exports.CA_COMMON_NAME = require_lan_http_bind.CA_COMMON_NAME;
-exports.CA_VALIDITY_DAYS = require_lan_http_bind.CA_VALIDITY_DAYS;
+exports.CA_COMMON_NAME = require_tls$1.CA_COMMON_NAME;
+exports.CA_VALIDITY_DAYS = require_tls$1.CA_VALIDITY_DAYS;
 exports.CLUSTER_SECRET_MISMATCH_TYPE = CLUSTER_SECRET_MISMATCH_TYPE;
 exports.CLUSTER_SECRET_REJECTED_EXIT_CODE = CLUSTER_SECRET_REJECTED_EXIT_CODE;
 exports.CORE_CAP_SERVICE_NAME = CORE_CAP_SERVICE_NAME;
@@ -95078,7 +95096,7 @@ exports.ConsoleLoggingAddon = require_builtins_console_logging_index.ConsoleLogg
 exports.CoreBlocksAddon = require_builtins_core_blocks_core_blocks_addon.CoreBlocksAddon;
 exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
 exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
-exports.DEFAULT_LAN_HTTP_PORT = require_lan_http_bind.DEFAULT_LAN_HTTP_PORT;
+exports.DEFAULT_LAN_HTTP_PORT = require_tls$1.DEFAULT_LAN_HTTP_PORT;
 exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_dist.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
 exports.DEVICE_STATUS_METHOD = require_dist.DEVICE_STATUS_METHOD;
 exports.DataPlaneRegistry = DataPlaneRegistry;
@@ -95109,7 +95127,7 @@ exports.HubNodeRegistry = HubNodeRegistry;
 exports.INFRA_CAPABILITIES = INFRA_CAPABILITIES;
 exports.IntegrationRegistry = IntegrationRegistry;
 exports.JobJournal = JobJournal;
-exports.LEAF_RENEWAL_WINDOW_DAYS = require_lan_http_bind.LEAF_RENEWAL_WINDOW_DAYS;
+exports.LEAF_RENEWAL_WINDOW_DAYS = require_tls$1.LEAF_RENEWAL_WINDOW_DAYS;
 exports.LifecycleJobEngine = LifecycleJobEngine;
 exports.LifecycleStateMachine = LifecycleStateMachine;
 exports.LivenessMonitorAddon = require_builtins_liveness_monitor_liveness_monitor_addon.LivenessMonitorAddon;
@@ -95120,7 +95138,7 @@ exports.LogManager = LogManager;
 exports.LogRingBuffer = LogRingBuffer;
 exports.LokiDestination = require_builtins_loki_logging_index.LokiDestination$1;
 exports.LokiLoggingAddon = require_builtins_loki_logging_index.LokiLoggingAddon$1;
-exports.MAX_LEAF_VALIDITY_DAYS = require_lan_http_bind.MAX_LEAF_VALIDITY_DAYS;
+exports.MAX_LEAF_VALIDITY_DAYS = require_tls$1.MAX_LEAF_VALIDITY_DAYS;
 exports.METHOD_ACCESS_MAP = require_dist.METHOD_ACCESS_MAP;
 exports.ModelDownloadService = require_file_data_plane.ModelDownloadService;
 exports.NATIVE_PROVIDER_SERVICE_INFIX = require_manifest_python_deps.NATIVE_PROVIDER_SERVICE_INFIX;
@@ -95146,7 +95164,7 @@ exports.ReadinessRegistry = require_dist.ReadinessRegistry;
 exports.ReadinessTimeoutError = require_dist.ReadinessTimeoutError;
 exports.ReplEngine = ReplEngine;
 exports.RingBuffer = RingBuffer;
-exports.SERVER_AUTH_OID = require_lan_http_bind.SERVER_AUTH_OID;
+exports.SERVER_AUTH_OID = require_tls$1.SERVER_AUTH_OID;
 exports.ScopedLogger = ScopedLogger;
 exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
 exports.SocketChannel = require_manifest_python_deps.SocketChannel;
@@ -95170,9 +95188,9 @@ exports.WinstonLoggingAddon = require_builtins_winston_logging_index.WinstonLogg
 exports.__resetCapUsageRegistryForTests = require_manifest_python_deps.__resetCapUsageRegistryForTests;
 exports.adaptBrokerToCluster = require_manifest_python_deps.adaptBrokerToCluster;
 exports.addonSettingsCapability = require_dist.addonSettingsCapability;
-exports.allFamiliesListenHost = require_lan_http_bind.allFamiliesListenHost;
-exports.applyLanHttp = require_lan_http_bind.applyLanHttp;
-exports.bindPendingLanHttp = require_lan_http_bind.bindPendingLanHttp;
+exports.allFamiliesListenHost = require_tls$1.allFamiliesListenHost;
+exports.applyLanHttp = require_tls$1.applyLanHttp;
+exports.bindPendingLanHttp = require_tls$1.bindPendingLanHttp;
 exports.bootstrapSchema = bootstrapSchema;
 exports.brokerCallForCap = require_manifest_python_deps.brokerCallForCap;
 exports.brokerTransportLink = require_manifest_python_deps.brokerTransportLink;
@@ -95192,6 +95210,7 @@ exports.buildUdsNativeCapProxy = require_manifest_python_deps.buildUdsNativeCapP
 exports.builderMountedCapNames = builderMountedCapNames;
 exports.callRegisterNodeWithRetry = callRegisterNodeWithRetry;
 exports.callWithServiceDiscovery = require_manifest_python_deps.callWithServiceDiscovery;
+exports.canServeDataPlane = canServeDataPlane;
 exports.capActionName = require_manifest_python_deps.capActionName;
 exports.capActionSuffix = require_manifest_python_deps.capActionSuffix;
 exports.capBareAction = require_manifest_python_deps.capBareAction;
@@ -95199,10 +95218,10 @@ exports.capServiceName = require_manifest_python_deps.capServiceName;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = require_manifest_python_deps.classifyCapRoute;
 exports.clearPendingRestart = clearPendingRestart;
-exports.closeLanHttp = require_lan_http_bind.closeLanHttp;
+exports.closeLanHttp = require_tls$1.closeLanHttp;
 exports.clusterEventTopic = require_manifest_python_deps.clusterEventTopic;
 exports.clusterSecretMatches = clusterSecretMatches;
-exports.collectCertIdentity = require_lan_http_bind.collectCertIdentity;
+exports.collectCertIdentity = require_tls$1.collectCertIdentity;
 exports.collectModelFiles = require_file_data_plane.collectModelFiles;
 exports.contentTypeFor = require_file_data_plane.contentTypeFor;
 exports.copyDirRecursive = copyDirRecursive;
@@ -95269,8 +95288,8 @@ Object.defineProperty(exports, "ensurePython", {
 		return _camstack_types_node.ensurePython;
 	}
 });
-exports.ensureTlsCert = require_lan_http_bind.ensureTlsCert;
-exports.evaluateExistingCert = require_lan_http_bind.evaluateExistingCert;
+exports.ensureTlsCert = require_tls$1.ensureTlsCert;
+exports.evaluateExistingCert = require_tls$1.evaluateExistingCert;
 exports.expandCapMethods = require_dist.expandCapMethods;
 exports.fetchJson = require_file_data_plane.fetchJson;
 Object.defineProperty(exports, "findInPath", {
@@ -95335,7 +95354,7 @@ exports.isInfraCapability = isInfraCapability;
 exports.isModelDownloaded = require_file_data_plane.isModelDownloaded;
 exports.isSourceNewer = isSourceNewer;
 exports.isolatedBuiltinPhase = isolatedBuiltinPhase;
-exports.loadTlsCert = require_lan_http_bind.loadTlsCert;
+exports.loadTlsCert = require_tls$1.loadTlsCert;
 exports.localEndpointPath = require_manifest_python_deps.localEndpointPath;
 exports.localProviderLink = require_manifest_python_deps.localProviderLink;
 exports.mountNativeCapService = require_manifest_python_deps.mountNativeCapService;
@@ -95345,15 +95364,15 @@ exports.parseTokenizedUrl = require_file_data_plane.parseTokenizedUrl;
 exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
 exports.proxyToUpstream = proxyToUpstream;
 exports.quarantineAddonResidue = quarantineAddonResidue;
-exports.readExtraSans = require_lan_http_bind.readExtraSans;
-exports.readLanHttpState = require_lan_http_bind.readLanHttpState;
+exports.readExtraSans = require_tls$1.readExtraSans;
+exports.readLanHttpState = require_tls$1.readLanHttpState;
 exports.readPendingRestart = readPendingRestart;
-exports.readTlsAccessStatus = require_lan_http_bind.readTlsAccessStatus;
-exports.readTlsMode = require_lan_http_bind.readTlsMode;
+exports.readTlsAccessStatus = require_tls$1.readTlsAccessStatus;
+exports.readTlsMode = require_tls$1.readTlsMode;
 exports.readinessKey = require_dist.readinessKey;
 exports.registerEventBusService = require_manifest_python_deps.registerEventBusService;
-exports.registerLanHttpHandler = require_lan_http_bind.registerLanHttpHandler;
-exports.reissueTlsLeaf = require_lan_http_bind.reissueTlsLeaf;
+exports.registerLanHttpHandler = require_tls$1.registerLanHttpHandler;
+exports.reissueTlsLeaf = require_tls$1.reissueTlsLeaf;
 exports.resolveFilePath = require_file_data_plane.resolveFilePath;
 exports.resolveHwAccel = require_manifest_python_deps.resolveHwAccel;
 exports.resolveNpmInvocation = require_manifest_python_deps.resolveNpmInvocation;
@@ -95375,8 +95394,8 @@ exports.stripCamstackDeps = stripCamstackDeps;
 exports.subscribePassthrough = require_manifest_python_deps.subscribePassthrough;
 exports.udsChildLogToWorkerEntry = require_manifest_python_deps.udsChildLogToWorkerEntry;
 exports.validateProviderRegistrations = require_manifest_python_deps.validateProviderRegistrations;
-exports.validateUploadedTls = require_lan_http_bind.validateUploadedTls;
+exports.validateUploadedTls = require_tls$1.validateUploadedTls;
 exports.waitUntilReady = waitUntilReady;
-exports.writeExtraSans = require_lan_http_bind.writeExtraSans;
+exports.writeExtraSans = require_tls$1.writeExtraSans;
 exports.writePendingRestart = writePendingRestart;
-exports.writeTlsMode = require_lan_http_bind.writeTlsMode;
+exports.writeTlsMode = require_tls$1.writeTlsMode;

package/dist/index.mjs

@@ -24,9 +24,9 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
+import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-CQhPGSJm.mjs";
 import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Dmcnb287.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
-import { C as evaluateExistingCert, S as SERVER_AUTH_OID, _ as CA_COMMON_NAME, a as closeLanHttp, b as LEAF_RENEWAL_WINDOW_DAYS, c as readExtraSans, d as writeExtraSans, f as writeTlsMode, g as reissueTlsLeaf, h as loadTlsCert, i as bindPendingLanHttp, l as readTlsAccessStatus, m as ensureTlsCert, n as allFamiliesListenHost, o as readLanHttpState, p as validateUploadedTls, r as applyLanHttp, s as registerLanHttpHandler, t as DEFAULT_LAN_HTTP_PORT, u as readTlsMode, v as collectCertIdentity, x as MAX_LEAF_VALIDITY_DAYS, y as CA_VALIDITY_DAYS } from "./lan-http-bind-jKrj6OjQ.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
@@ -366,6 +366,24 @@ var DataPlaneRegistry = class {
 		};
 	}
 };
+/**
+* Whether an addon can serve a data-plane RIGHT NOW.
+*
+* Extracted as a predicate because the three ways of answering "no" used to be
+* three early `return`s inside the mount path, and every one of them left the
+* PREVIOUS registration standing. The registry then held a `baseUrl` pointing
+* at the port of a process that no longer existed, and `/addon/:addonId/*` kept
+* reverse-proxying to it — a 502 per request until a replacement child finished
+* handshaking, and forever for an addon removed from disk. `unregisterAddon`
+* existed for exactly this and had no call site anywhere in the repo.
+*
+* A `false` here means UNREGISTER, never "leave it alone". Dropping is the safe
+* direction: an absent data-plane falls through to the control-route path,
+* while a stale one sends live traffic at a dead socket.
+*/
+function canServeDataPlane(state) {
+	return state.hasEntry && state.isForked && state.childKnown;
+}
 //#endregion
 //#region src/http/reverse-proxy.ts
 /**
@@ -95038,4 +95056,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDoorSettingsView, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readLanHttpState, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDoorSettingsView, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readLanHttpState, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/{lan-http-bind-jKrj6OjQ.mjs → tls-CQhPGSJm.mjs}

@@ -8,6 +8,139 @@ import { tmpdir } from "node:os";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
+//#region src/http/lan-http-bind.ts
+/**
+* Second HTTP listener that shares the hub's existing request handler.
+*
+* Fastify is one protocol per instance; HTTPS stays on :4443 and this
+* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
+* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
+*
+* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
+* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
+* hangs because nobody handles the upgrade on this socket.
+*/
+var DEFAULT_HTTP_PORT = 4480;
+var handlers = null;
+var server = null;
+var pending = null;
+var state = {
+	listening: false,
+	error: null,
+	port: DEFAULT_HTTP_PORT
+};
+var boundRequestedHost = null;
+var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
+/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
+function allFamiliesListenHost(host) {
+	if (host === "0.0.0.0" || host === "*" || host === "") return {
+		host: "::",
+		ipv6Only: false
+	};
+	return {
+		host,
+		ipv6Only: false
+	};
+}
+function registerLanHttpHandler(next) {
+	handlers = next;
+}
+function readLanHttpState() {
+	return state;
+}
+async function applyLanHttp(options) {
+	pending = options;
+	if (!options.enabled) {
+		await closeLanHttp();
+		state = {
+			listening: false,
+			error: null,
+			port: options.port
+		};
+		return state;
+	}
+	if (handlers === null) {
+		state = {
+			listening: false,
+			error: "HTTP listener is not registered yet",
+			port: options.port
+		};
+		return state;
+	}
+	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
+	await closeLanHttp();
+	try {
+		const bound = await listenHttp(options.port, options.host, handlers);
+		server = bound;
+		boundRequestedHost = options.host;
+		const addr = bound.address();
+		state = {
+			listening: true,
+			error: null,
+			port: typeof addr === "object" && addr !== null ? addr.port : options.port
+		};
+		return state;
+	} catch (err) {
+		server = null;
+		state = {
+			listening: false,
+			error: err instanceof Error ? err.message : String(err),
+			port: options.port
+		};
+		return state;
+	}
+}
+/** After the hub registers the Fastify request handler, bind whatever was pending. */
+async function bindPendingLanHttp() {
+	if (pending === null) return applyLanHttp({
+		enabled: true,
+		port: DEFAULT_HTTP_PORT,
+		host: "0.0.0.0"
+	});
+	return applyLanHttp(pending);
+}
+async function closeLanHttp() {
+	const current = server;
+	server = null;
+	boundRequestedHost = null;
+	if (current === null) return;
+	await new Promise((resolve) => {
+		current.close(() => resolve());
+	});
+}
+function listenHttp(port, host, next) {
+	const resolved = allFamiliesListenHost(host);
+	return listenOn(port, resolved, next).catch((err) => {
+		if (resolved.host === "::" && host !== "::") return listenOn(port, {
+			host: "0.0.0.0",
+			ipv6Only: false
+		}, next);
+		throw err;
+	});
+}
+function listenOn(port, bind, next) {
+	return new Promise((resolve, reject) => {
+		const created = createServer(next.onRequest);
+		created.on("upgrade", next.onUpgrade);
+		const onError = (err) => {
+			created.off("listening", onListening);
+			created.close();
+			reject(err);
+		};
+		const onListening = () => {
+			created.off("error", onError);
+			resolve(created);
+		};
+		created.once("error", onError);
+		created.once("listening", onListening);
+		created.listen({
+			port,
+			host: bind.host,
+			ipv6Only: bind.ipv6Only
+		});
+	});
+}
+//#endregion
 //#region src/tls/cert-evaluation.ts
 /**
 * The regeneration rule (D227), as a pure function.
@@ -616,137 +749,4 @@ function readTlsAccessStatus(dataDir, restartRequired = false) {
 	}
 }
 //#endregion
-//#region src/http/lan-http-bind.ts
-/**
-* Second HTTP listener that shares the hub's existing request handler.
-*
-* Fastify is one protocol per instance; HTTPS stays on :4443 and this
-* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
-* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
-*
-* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
-* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
-* hangs because nobody handles the upgrade on this socket.
-*/
-var DEFAULT_HTTP_PORT = 4480;
-var handlers = null;
-var server = null;
-var pending = null;
-var state = {
-	listening: false,
-	error: null,
-	port: DEFAULT_HTTP_PORT
-};
-var boundRequestedHost = null;
-var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
-/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
-function allFamiliesListenHost(host) {
-	if (host === "0.0.0.0" || host === "*" || host === "") return {
-		host: "::",
-		ipv6Only: false
-	};
-	return {
-		host,
-		ipv6Only: false
-	};
-}
-function registerLanHttpHandler(next) {
-	handlers = next;
-}
-function readLanHttpState() {
-	return state;
-}
-async function applyLanHttp(options) {
-	pending = options;
-	if (!options.enabled) {
-		await closeLanHttp();
-		state = {
-			listening: false,
-			error: null,
-			port: options.port
-		};
-		return state;
-	}
-	if (handlers === null) {
-		state = {
-			listening: false,
-			error: "HTTP listener is not registered yet",
-			port: options.port
-		};
-		return state;
-	}
-	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
-	await closeLanHttp();
-	try {
-		const bound = await listenHttp(options.port, options.host, handlers);
-		server = bound;
-		boundRequestedHost = options.host;
-		const addr = bound.address();
-		state = {
-			listening: true,
-			error: null,
-			port: typeof addr === "object" && addr !== null ? addr.port : options.port
-		};
-		return state;
-	} catch (err) {
-		server = null;
-		state = {
-			listening: false,
-			error: err instanceof Error ? err.message : String(err),
-			port: options.port
-		};
-		return state;
-	}
-}
-/** After the hub registers the Fastify request handler, bind whatever was pending. */
-async function bindPendingLanHttp() {
-	if (pending === null) return applyLanHttp({
-		enabled: true,
-		port: DEFAULT_HTTP_PORT,
-		host: "0.0.0.0"
-	});
-	return applyLanHttp(pending);
-}
-async function closeLanHttp() {
-	const current = server;
-	server = null;
-	boundRequestedHost = null;
-	if (current === null) return;
-	await new Promise((resolve) => {
-		current.close(() => resolve());
-	});
-}
-function listenHttp(port, host, next) {
-	const resolved = allFamiliesListenHost(host);
-	return listenOn(port, resolved, next).catch((err) => {
-		if (resolved.host === "::" && host !== "::") return listenOn(port, {
-			host: "0.0.0.0",
-			ipv6Only: false
-		}, next);
-		throw err;
-	});
-}
-function listenOn(port, bind, next) {
-	return new Promise((resolve, reject) => {
-		const created = createServer(next.onRequest);
-		created.on("upgrade", next.onUpgrade);
-		const onError = (err) => {
-			created.off("listening", onListening);
-			created.close();
-			reject(err);
-		};
-		const onListening = () => {
-			created.off("error", onError);
-			resolve(created);
-		};
-		created.once("error", onError);
-		created.once("listening", onListening);
-		created.listen({
-			port,
-			host: bind.host,
-			ipv6Only: bind.ipv6Only
-		});
-	});
-}
-//#endregion
-export { evaluateExistingCert as C, SERVER_AUTH_OID as S, CA_COMMON_NAME as _, closeLanHttp as a, LEAF_RENEWAL_WINDOW_DAYS as b, readExtraSans as c, writeExtraSans as d, writeTlsMode as f, reissueTlsLeaf as g, loadTlsCert as h, bindPendingLanHttp as i, readTlsAccessStatus as l, ensureTlsCert as m, allFamiliesListenHost as n, readLanHttpState as o, validateUploadedTls as p, applyLanHttp as r, registerLanHttpHandler as s, DEFAULT_LAN_HTTP_PORT as t, readTlsMode as u, collectCertIdentity as v, MAX_LEAF_VALIDITY_DAYS as x, CA_VALIDITY_DAYS as y };
+export { registerLanHttpHandler as C, readLanHttpState as S, DEFAULT_LAN_HTTP_PORT as _, writeTlsMode as a, bindPendingLanHttp as b, loadTlsCert as c, collectCertIdentity as d, CA_VALIDITY_DAYS as f, evaluateExistingCert as g, SERVER_AUTH_OID as h, writeExtraSans as i, reissueTlsLeaf as l, MAX_LEAF_VALIDITY_DAYS as m, readTlsAccessStatus as n, validateUploadedTls as o, LEAF_RENEWAL_WINDOW_DAYS as p, readTlsMode as r, ensureTlsCert as s, readExtraSans as t, CA_COMMON_NAME as u, allFamiliesListenHost as v, closeLanHttp as x, applyLanHttp as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.131",
+  "version": "1.2.132",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",

package/dist/{lan-http-bind-DmgpFP6_.js → tls-u8QCJCFE.js}

@@ -9,6 +9,139 @@ node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
 let node_http = require("node:http");
 let node_net = require("node:net");
+//#region src/http/lan-http-bind.ts
+/**
+* Second HTTP listener that shares the hub's existing request handler.
+*
+* Fastify is one protocol per instance; HTTPS stays on :4443 and this
+* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
+* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
+*
+* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
+* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
+* hangs because nobody handles the upgrade on this socket.
+*/
+var DEFAULT_HTTP_PORT = 4480;
+var handlers = null;
+var server = null;
+var pending = null;
+var state = {
+	listening: false,
+	error: null,
+	port: DEFAULT_HTTP_PORT
+};
+var boundRequestedHost = null;
+var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
+/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
+function allFamiliesListenHost(host) {
+	if (host === "0.0.0.0" || host === "*" || host === "") return {
+		host: "::",
+		ipv6Only: false
+	};
+	return {
+		host,
+		ipv6Only: false
+	};
+}
+function registerLanHttpHandler(next) {
+	handlers = next;
+}
+function readLanHttpState() {
+	return state;
+}
+async function applyLanHttp(options) {
+	pending = options;
+	if (!options.enabled) {
+		await closeLanHttp();
+		state = {
+			listening: false,
+			error: null,
+			port: options.port
+		};
+		return state;
+	}
+	if (handlers === null) {
+		state = {
+			listening: false,
+			error: "HTTP listener is not registered yet",
+			port: options.port
+		};
+		return state;
+	}
+	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
+	await closeLanHttp();
+	try {
+		const bound = await listenHttp(options.port, options.host, handlers);
+		server = bound;
+		boundRequestedHost = options.host;
+		const addr = bound.address();
+		state = {
+			listening: true,
+			error: null,
+			port: typeof addr === "object" && addr !== null ? addr.port : options.port
+		};
+		return state;
+	} catch (err) {
+		server = null;
+		state = {
+			listening: false,
+			error: err instanceof Error ? err.message : String(err),
+			port: options.port
+		};
+		return state;
+	}
+}
+/** After the hub registers the Fastify request handler, bind whatever was pending. */
+async function bindPendingLanHttp() {
+	if (pending === null) return applyLanHttp({
+		enabled: true,
+		port: DEFAULT_HTTP_PORT,
+		host: "0.0.0.0"
+	});
+	return applyLanHttp(pending);
+}
+async function closeLanHttp() {
+	const current = server;
+	server = null;
+	boundRequestedHost = null;
+	if (current === null) return;
+	await new Promise((resolve) => {
+		current.close(() => resolve());
+	});
+}
+function listenHttp(port, host, next) {
+	const resolved = allFamiliesListenHost(host);
+	return listenOn(port, resolved, next).catch((err) => {
+		if (resolved.host === "::" && host !== "::") return listenOn(port, {
+			host: "0.0.0.0",
+			ipv6Only: false
+		}, next);
+		throw err;
+	});
+}
+function listenOn(port, bind, next) {
+	return new Promise((resolve, reject) => {
+		const created = (0, node_http.createServer)(next.onRequest);
+		created.on("upgrade", next.onUpgrade);
+		const onError = (err) => {
+			created.off("listening", onListening);
+			created.close();
+			reject(err);
+		};
+		const onListening = () => {
+			created.off("error", onError);
+			resolve(created);
+		};
+		created.once("error", onError);
+		created.once("listening", onListening);
+		created.listen({
+			port,
+			host: bind.host,
+			ipv6Only: bind.ipv6Only
+		});
+	});
+}
+//#endregion
 //#region src/tls/cert-evaluation.ts
 /**
 * The regeneration rule (D227), as a pure function.
@@ -617,139 +750,6 @@ function readTlsAccessStatus(dataDir, restartRequired = false) {
 	}
 }
 //#endregion
-//#region src/http/lan-http-bind.ts
-/**
-* Second HTTP listener that shares the hub's existing request handler.
-*
-* Fastify is one protocol per instance; HTTPS stays on :4443 and this
-* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
-* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
-*
-* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
-* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
-* hangs because nobody handles the upgrade on this socket.
-*/
-var DEFAULT_HTTP_PORT = 4480;
-var handlers = null;
-var server = null;
-var pending = null;
-var state = {
-	listening: false,
-	error: null,
-	port: DEFAULT_HTTP_PORT
-};
-var boundRequestedHost = null;
-var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
-/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
-function allFamiliesListenHost(host) {
-	if (host === "0.0.0.0" || host === "*" || host === "") return {
-		host: "::",
-		ipv6Only: false
-	};
-	return {
-		host,
-		ipv6Only: false
-	};
-}
-function registerLanHttpHandler(next) {
-	handlers = next;
-}
-function readLanHttpState() {
-	return state;
-}
-async function applyLanHttp(options) {
-	pending = options;
-	if (!options.enabled) {
-		await closeLanHttp();
-		state = {
-			listening: false,
-			error: null,
-			port: options.port
-		};
-		return state;
-	}
-	if (handlers === null) {
-		state = {
-			listening: false,
-			error: "HTTP listener is not registered yet",
-			port: options.port
-		};
-		return state;
-	}
-	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
-	await closeLanHttp();
-	try {
-		const bound = await listenHttp(options.port, options.host, handlers);
-		server = bound;
-		boundRequestedHost = options.host;
-		const addr = bound.address();
-		state = {
-			listening: true,
-			error: null,
-			port: typeof addr === "object" && addr !== null ? addr.port : options.port
-		};
-		return state;
-	} catch (err) {
-		server = null;
-		state = {
-			listening: false,
-			error: err instanceof Error ? err.message : String(err),
-			port: options.port
-		};
-		return state;
-	}
-}
-/** After the hub registers the Fastify request handler, bind whatever was pending. */
-async function bindPendingLanHttp() {
-	if (pending === null) return applyLanHttp({
-		enabled: true,
-		port: DEFAULT_HTTP_PORT,
-		host: "0.0.0.0"
-	});
-	return applyLanHttp(pending);
-}
-async function closeLanHttp() {
-	const current = server;
-	server = null;
-	boundRequestedHost = null;
-	if (current === null) return;
-	await new Promise((resolve) => {
-		current.close(() => resolve());
-	});
-}
-function listenHttp(port, host, next) {
-	const resolved = allFamiliesListenHost(host);
-	return listenOn(port, resolved, next).catch((err) => {
-		if (resolved.host === "::" && host !== "::") return listenOn(port, {
-			host: "0.0.0.0",
-			ipv6Only: false
-		}, next);
-		throw err;
-	});
-}
-function listenOn(port, bind, next) {
-	return new Promise((resolve, reject) => {
-		const created = (0, node_http.createServer)(next.onRequest);
-		created.on("upgrade", next.onUpgrade);
-		const onError = (err) => {
-			created.off("listening", onListening);
-			created.close();
-			reject(err);
-		};
-		const onListening = () => {
-			created.off("error", onError);
-			resolve(created);
-		};
-		created.once("error", onError);
-		created.once("listening", onListening);
-		created.listen({
-			port,
-			host: bind.host,
-			ipv6Only: bind.ipv6Only
-		});
-	});
-}
-//#endregion
 Object.defineProperty(exports, "CA_COMMON_NAME", {
 	enumerable: true,
 	get: function() {