@camstack/system 1.2.352 → 1.2.354

package/dist/{dist-DeGPW01G.js → dist-DePB7uwU.js}

@@ -7936,11 +7936,11 @@ var ModelVariantGroupSchema = zod.z.object({
 	/** Quantization axis. Omit ⇒ the fp32 base build. */
 	precision: zod.z.enum(["fp32", "int8"]).optional(),
 	/**
-	* Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
-	* latency-optimized export (e.g. ReLU-activation variant) — the slot the
-	* future performance variants plug into.
+	* Training / latency-variant axis. Omit ⇒ the standard build. `test` marks
+	* an alternate training of the same family (Scrypted `relu_test`); chip
+	* label is "Test".
 	*/
-	optimization: zod.z.enum(["standard", "fast"]).optional(),
+	optimization: zod.z.enum(["standard", "test"]).optional(),
 	/**
 	* Input-resolution axis (square input side, px). Omit ⇒ the family's native
 	* resolution (640 for yolo26). Reduced-input builds (320 / 256) are a big,
@@ -7994,9 +7994,10 @@ var ModelLicenseRecordSchema = zod.z.object({
 * are per upstream. A persisted custom-model row written when this field was a
 * string still parses — the string is lifted into `{ weights }`.
 *
-* Every licence surface (the admin "Models and licenses" page,
-* `THIRD_PARTY_MODELS.md`, the Hugging Face model table) is GENERATED from
-* these records by `scripts/gen-model-licenses.ts` (D661).
+* Every machine licence surface (`THIRD_PARTY_MODELS.md`, the Hugging Face
+* model table) is GENERATED from these records by
+* `scripts/gen-model-licenses.ts` (D661). Operator-facing docs live in
+* `camstack/docs` → `/docs/detection/models`.
 */
 var ModelLicenseSchema = zod.z.preprocess((value) => typeof value === "string" ? { weights: value } : value, ModelLicenseRecordSchema);
 var ModelCatalogEntrySchema = zod.z.object({
@@ -14168,7 +14169,7 @@ var detectionPipelineCapability = {
 * This matters here more than anywhere else in the repo, because every provider
 * that knows a device's host knows its PASSWORD too: `{ host, port, username,
 * password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
-* and `http://admin:hunter2@192.168.x.x/` is a URL a browser accepts. The
+* and `http://admin:hunter2@192.168.60.139/` is a URL a browser accepts. The
 * camera's own page will ask for its own login. That is correct, and pre-
 * filling it is the operator's business, not ours.
 *
@@ -18568,7 +18569,7 @@ var modelDistributorCapability = {
 	mode: "singleton",
 	internal: true,
 	methods: { distributeModel: method(zod.z.object({
-		nodeId: zod.z.string(),
+		targetNodeId: zod.z.string(),
 		modelId: zod.z.string(),
 		format: zod.z.enum(MODEL_FORMATS),
 		entry: ModelCatalogEntrySchema
@@ -21163,8 +21164,9 @@ var NcRuleSchema = NcRuleInputSchema.extend({
 	disabledTargetIds: zod.z.array(zod.z.string()).default([])
 });
 /**
-* The state-summary SECTIONS (D647 / D698): the D637 kind groups that report a
-* still-true state. `backups-exports` and `alarm` are not sections — a completed
+* The state-summary SECTIONS (D647 / D698 / D708): the D637 kind groups that
+* report a still-true state. `addons` is the crash-looped addons only and
+* `addon-updates` the addons that are behind (D708 split them). `backups-exports` and `alarm` are not sections — a completed
 * job is not an open state, and the alarm stays instant.
 */
 var NcStateSummarySectionIdSchema = zod.z.enum([
@@ -21176,6 +21178,7 @@ var NcStateSummarySectionIdSchema = zod.z.enum([
 	"detection-blind",
 	"nodes",
 	"addons",
+	"addon-updates",
 	"updates"
 ]);
 /** One section of a previewed state summary. `unavailable` = its state could not be read. */
@@ -21670,7 +21673,19 @@ var NcAlarmModeDelaysSchema = zod.z.object({
 	* When this mode may be armed. Absent / null = always allowed (same as a
 	* rule with no `schedule`). Evaluated with {@link isScheduleActive}.
 	*/
-	schedule: NcScheduleSchema.optional()
+	schedule: NcScheduleSchema.optional(),
+	/**
+	* D706: while this mode's ENTRY DELAY runs, do the alarm rules' own pushes go out (as an
+	* intrusion naming the locations)? Absent = false — the entry-delay notification is the
+	* only one, and the matches ride the triggered notification's mosaic (D705).
+	*/
+	notifyDuringEntryDelay: zod.z.boolean().optional(),
+	/**
+	* D706: notify "watched again" when a sensor this arm bypassed closes and opens again.
+	* Absent = false (logged, not sent). Even when true it is not sent when that same sensor
+	* is the one that starts the entry delay — the entry-delay notification already names it.
+	*/
+	notifySensorRewatched: zod.z.boolean().optional()
 });
 var NcAlarmModeDelaysListSchema = zod.z.array(NcAlarmModeDelaysSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
 /**
@@ -21685,7 +21700,11 @@ var NcAlarmModeDelaysEditSchema = zod.z.object({
 	triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional(),
 	postTriggeredAction: NcAlarmPostTriggeredActionSchema.nullable().optional(),
 	/** Set a schedule, or `null` to clear (mode always allowed again). */
-	schedule: NcScheduleSchema.nullable().optional()
+	schedule: NcScheduleSchema.nullable().optional(),
+	/** D706: set the switch, or `null` to clear it (back to the default, false). */
+	notifyDuringEntryDelay: zod.z.boolean().nullable().optional(),
+	/** D706: set the switch, or `null` to clear it (back to the default, false). */
+	notifySensorRewatched: zod.z.boolean().nullable().optional()
 });
 var NcAlarmModeDelaysEditListSchema = zod.z.array(NcAlarmModeDelaysEditSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
 /** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
@@ -22864,39 +22883,19 @@ Object.freeze(Object.fromEntries([{
 	label: "Face recognition model",
 	defaultModelId: "auraface-r100",
 	indexName: "the enrolled face gallery",
-	options: [
-		{
-			id: "auraface-r100",
-			label: "AuraFace R100"
-		},
-		{
-			id: "arcface-r100",
-			label: "ArcFace (ResNet34)"
-		},
-		{
-			id: "inception-resnet-v1",
-			label: "Inception ResNet V1"
-		}
-	]
+	options: [{
+		id: "auraface-r100",
+		label: "AuraFace R100"
+	}]
 }, {
 	stepId: "clip-embedding",
 	label: "Semantic search model",
-	defaultModelId: "mobileclip-s1",
+	defaultModelId: "siglip2-b16-224",
 	indexName: "the object semantic-search index",
-	options: [
-		{
-			id: "mobileclip-s1",
-			label: "MobileCLIP S1"
-		},
-		{
-			id: "mobileclip-s2",
-			label: "MobileCLIP S2"
-		},
-		{
-			id: "siglip2-b16-224",
-			label: "SigLIP2 B/16 (Apache-2.0)"
-		}
-	]
+	options: [{
+		id: "siglip2-b16-224",
+		label: "SigLIP2 B/16 (Apache-2.0)"
+	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 var CLUSTER_STEP_SETTING_FIELDS = [{
 	stepId: "face-embedding",
@@ -26649,6 +26648,22 @@ var MotionSourceEnum = zod.z.enum([
 	"device-activity"
 ]);
 /**
+* What opened an on-motion detection SESSION: the motion source that passed the
+* camera's `motionSources` gate, and what raised it (the camera itself, or a
+* sensor the operator attached — D672). `sensorName` is the attached sensor's
+* device name as the orchestrator's camera-sensors resolution last read it;
+* absent when unknown or when the camera itself triggered.
+*
+* Carried on the session attach ONLY so the runner's `DetectionPhaseTransition`
+* can say what started the session (D672 rule 11, amended 2026-10-06). The
+* runner never decides anything on it.
+*/
+var SessionTriggerSchema = zod.z.object({
+	source: MotionSourceEnum,
+	triggeredBy: MotionTriggeredBySchema,
+	sensorName: zod.z.string().optional()
+});
+/**
 * List of motion sources active on a camera. Empty array is valid:
 * "no source" — happens for battery cams without firmware motion when
 * the operator hasn't opted into the SW analyzer (would hold the
@@ -26900,6 +26915,14 @@ var RunnerCameraConfigSchema = zod.z.object({
 	*/
 	motionSources: MotionSourcesSchema.default(["analyzer"]),
 	/**
+	* What opened this attach, on a SESSION attach only (see
+	* {@link SessionTriggerSchema}). OPTIONAL with no default: absent on a
+	* standing attach, an occupancy burst, a re-dispatch with no motion event
+	* behind it, and every attach from an orchestrator older than the field — the
+	* runner then names no source on the phase event.
+	*/
+	sessionTrigger: SessionTriggerSchema.optional(),
+	/**
 	* WHICH root detector runs for this camera. The detection counterpart of
 	* {@link motionSources}, same shape and same discipline: a per-camera list
 	* of sources the system understands, vendor-agnostic, owned here.
@@ -31464,6 +31487,50 @@ var videoclipsCapability = {
 		})
 	}
 };
+/** The central link domain the viewer app claims (Universal Links / App Links). */
+var CAMSTACK_APP_LINK_ORIGIN = "https://camstack.zentik.app";
+/**
+* Reduce a base URL to the bare origin the central page accepts as `hub=`,
+* or `null` when it cannot be one: not http(s), carries credentials, or does
+* not parse. A path/query/fragment is dropped — the central page mounts the
+* viewer under the origin itself.
+*/
+function toAppLinkHubOrigin(baseUrl) {
+	let parsed;
+	try {
+		parsed = new URL(baseUrl);
+	} catch {
+		return null;
+	}
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+	if (parsed.username !== "" || parsed.password !== "") return null;
+	if (parsed.hostname === "") return null;
+	return parsed.origin;
+}
+/**
+* The hub address an app link carries as `hub=`, chosen from the hub's OWN
+* advertised palette so it always agrees with what the Network page lists:
+* the public tunnel first, then the mesh (Tailscale MagicDNS) — HTTPS only,
+* because the app and the hosted viewer reach it from off the LAN. `null`
+* when the hub advertises neither.
+*/
+function pickAppLinkHub(endpoints) {
+	const rank = (e) => {
+		if (e.kind !== "public" || !e.baseUrl.startsWith("https://")) return null;
+		if (e.interfaceKind === "public") return 0;
+		if (e.interfaceKind === "vpn") return 1;
+		return null;
+	};
+	return endpoints.flatMap((e) => {
+		const r = rank(e);
+		const origin = toAppLinkHubOrigin(e.baseUrl);
+		return r === null || origin === null ? [] : [{
+			r,
+			p: e.priority,
+			origin
+		}];
+	}).toSorted((a, b) => a.r - b.r || a.p - b.p)[0]?.origin ?? null;
+}
 /**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
@@ -36167,7 +36234,7 @@ var LocalInterfaceSchema = zod.z.object({
 	name: zod.z.string(),
 	family: zod.z.enum(["IPv4", "IPv6"]),
 	address: zod.z.string(),
-	/** CIDR shorthand (e.g. `192.168.x.x/24`). Empty when OS doesn't expose. */
+	/** CIDR shorthand (e.g. `192.168.10.10/24`). Empty when OS doesn't expose. */
 	cidr: zod.z.string(),
 	/** OS netmask. Stable across calls so the SDK can hash on it. */
 	netmask: zod.z.string(),
@@ -36221,7 +36288,8 @@ var ConnectionEndpointSchema = zod.z.object({
 		"lan-ipv4",
 		"lan-ipv6",
 		"public",
-		"loopback"
+		"loopback",
+		"app-link"
 	]),
 	/**
 	* Originating-interface kind — `lan`/`wifi`/`docker`/`vpn`/`other`/
@@ -36290,15 +36358,27 @@ var GetConnectionEndpointsResultSchema = zod.z.object({
 	localPort: AdvertisedLocalPortSchema
 });
 /**
-* The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
-* AUTO (resolved from the candidate ranking at send time); `resolved` reports
-* what AUTO currently picks, so the UI can show the effective value either way.
+* The address flagged for notification links. `baseUrl: null` = AUTO, which
+* since D709 is the CamStack app link; `resolved` reports the effective value,
+* so the UI can show it either way.
 */
 var NotificationEndpointSchema = zod.z.object({
 	/** The operator's explicit choice, or null for AUTO. */
 	baseUrl: zod.z.string().nullable(),
-	/** What the ranking currently resolves to (null when nothing is reachable). */
-	resolved: zod.z.string().nullable()
+	/**
+	* The effective flagged address: the explicit choice, else (AUTO) the
+	* CamStack app link `https://camstack.zentik.app` (D709). A pre-D709 hub
+	* answered the public tunnel / mesh here, or null.
+	*/
+	resolved: zod.z.string().nullable(),
+	/**
+	* The hub origin an app link carries as `hub=` (D709): the hub's best
+	* public HTTPS address — the tunnel, then the mesh (Tailscale MagicDNS) —
+	* picked from this cap's own palette by `pickAppLinkHub`. `null` when the
+	* hub advertises neither; the app link is then minted without `hub=`.
+	* Absent on a pre-D709 hub.
+	*/
+	appLinkHub: zod.z.string().nullable()
 });
 /**
 * The URLs the SDK / viewer should race for API access. `baseUrls` empty =
@@ -36366,7 +36446,7 @@ var localNetworkCapability = {
 		* every client a second authority on a socket only the hub binds. A viewer
 		* configured with a port-less public URL (`https://camstack.example.top`)
 		* infers 443 from the scheme, asks with 443, and was handed
-		* `https://192.168.x.x:443` for a hub listening on 4443. That candidate
+		* `https://192.168.10.9:443` for a hub listening on 4443. That candidate
 		* cannot ever answer, and losing its race reads in the log exactly like
 		* "the LAN was tried and it was slower" — so an operator sitting on his own
 		* WiFi stayed on the public tunnel for weeks, with the LAN candidate born
@@ -36399,13 +36479,21 @@ var localNetworkCapability = {
 			*  Pass `'https'` when the caller is itself loaded over HTTPS
 			*  to avoid mixed-content blocks in the browser. The public
 			*  tunnel always emits `https://` regardless. */
-			scheme: zod.z.enum(["http", "https"]).optional()
+			scheme: zod.z.enum(["http", "https"]).optional(),
+			/** Append the CamStack app link entry (`kind: 'app-link'`, D709) —
+			*  an address notification links can be flagged with, not a hub
+			*  route. Default `false`: racers and rankers never see it. */
+			includeAppLink: zod.z.boolean().optional()
 		}), GetConnectionEndpointsResultSchema),
 		/**
-		* The endpoint OUTBOUND artifacts must be addressed by — notification
-		* attachment links and deep links. `baseUrl: null` means AUTO: the first
-		* public candidate (a configured origin, then a connected tunnel, then the
-		* LAN), never loopback.
+		* The address notification links are flagged with. `baseUrl: null` means
+		* AUTO, which is the CamStack app link (D709): viewer taps go through
+		* `https://camstack.zentik.app/…?hub=<appLinkHub>` and open the app. Any
+		* hub address the palette lists can be flagged instead; then viewer taps,
+		* attachment links and action buttons all use it. Signed media and
+		* buttons never use the app link — with it flagged (or AUTO) they keep
+		* the ranked hub ladder (a configured origin, a connected tunnel, then
+		* the LAN), never loopback.
 		*
 		* Why an explicit marker: the automatic ranking cannot know which of
 		* several reachable addresses the RECIPIENT can actually open. A link is
@@ -36819,7 +36907,7 @@ var MeshPeerSchema = zod.z.object({
 	tags: zod.z.array(zod.z.string()).readonly(),
 	/** True when the peer advertises itself as an exit-node candidate. */
 	exitNodeOption: zod.z.boolean(),
-	/** Subnet routes the peer advertises (e.g. `["192.168.x.x/24"]`). */
+	/** Subnet routes the peer advertises (e.g. `["192.168.10.0/24"]`). */
 	advertisedRoutes: zod.z.array(zod.z.string()).readonly(),
 	/** Owner account login (e.g. `foo@example.com`). Null for tagged peers. */
 	userLogin: zod.z.string().nullable(),
@@ -38300,7 +38388,13 @@ var OsdOverlaySchema = zod.z.object({
 	*/
 	availablePositions: zod.z.array(OsdPositionEnum).readonly(),
 	/** Firmware does not allow editing the `text` field (e.g. timestamp). */
-	readOnly: zod.z.boolean().optional()
+	readOnly: zod.z.boolean().optional(),
+	/**
+	* Firmware text ceiling for this overlay. Absent = no known limit.
+	* The OSD manager truncates here on every write — never stores its own
+	* copy on the binding.
+	*/
+	maxCharacters: zod.z.number().int().positive().optional()
 });
 var OsdStatusSchema = zod.z.object({ overlays: zod.z.array(OsdOverlaySchema).readonly() });
 var OsdOverlayPatchSchema = zod.z.object({
@@ -38398,7 +38492,9 @@ var OsdTemplateBindingSchema = zod.z.object({
 	valuePath: zod.z.string().min(1).max(64),
 	/** Convert TO this unit at render (`tryConvertUnit`). Absent = source unit. */
 	displayUnit: zod.z.string().max(16).optional(),
-	maxDecimals: zod.z.number().int().min(0).max(4).default(1)
+	maxDecimals: zod.z.number().int().min(0).max(4).default(1),
+	/** Raw value → display text (same shape as slot binding). Empty string hides. */
+	valueMap: zod.z.record(zod.z.string(), zod.z.string()).optional()
 });
 /**
 * A named template: bindings (alias → leaf field) + a parser that
@@ -38448,18 +38544,11 @@ var OsdSlotBindingSchema = zod.z.object({
 	source: OsdSourceSchema,
 	/** `${value}` and `${unit}` are substituted; every occurrence. */
 	template: zod.z.string().max(96).default("${value}"),
-	/** Truncate with an ellipsis past this length. Absent = no limit. */
-	maxCharacters: zod.z.number().int().min(4).max(64).optional(),
 	/**
 	* Decimal places for a numeric value. `0` yields an integer — the
 	* documented workaround for firmwares that reject `.` in overlay text.
 	*/
 	maxDecimals: zod.z.number().int().min(0).max(4).default(1),
-	/**
-	* Appended via `${unit}` when no unit conversion produces a label.
-	* Prefer `source.displayUnit` for converted device-state values.
-	*/
-	unitLabel: zod.z.string().max(8).optional(),
 	/** Raw value → display text, e.g. `{"true":"MOTION","false":""}`. */
 	valueMap: zod.z.record(zod.z.string(), zod.z.string()).optional(),
 	/** Time windows in which the slot is shown. Absent = always. */
@@ -38468,9 +38557,7 @@ var OsdSlotBindingSchema = zod.z.object({
 	* Display gate, in the notification centre's condition vocabulary.
 	* Only the keys reported by `getConditionSupport` are accepted.
 	*/
-	conditions: NcConditionsSchema.optional(),
-	/** Rendered when the gate is closed or the value unreadable. Empty = hide. */
-	fallbackText: zod.z.string().max(64).default("")
+	conditions: NcConditionsSchema.optional()
 });
 /** One camera slot, as the operator sees it: firmware truth + our binding. */
 var OsdSlotViewSchema = zod.z.object({
@@ -58637,12 +58724,14 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 	{
 		id: "addons",
 		family: "system",
-		label: "Addons",
-		kinds: [
-			"addon-crash-loop",
-			"addon-update-available",
-			"addon-updated"
-		]
+		label: "Addons stopped",
+		kinds: ["addon-crash-loop"]
+	},
+	{
+		id: "addon-updates",
+		family: "system",
+		label: "Addon updates",
+		kinds: ["addon-update-available", "addon-updated"]
 	},
 	{
 		id: "updates",
@@ -58802,13 +58891,15 @@ var STATE_SUMMARY_SECTION_VARS = [
 	},
 	{
 		name: "summaryAddons",
-		label: "Summary: addons",
-		example: "@camstack/addon-recorder 1.2.3 → 1.2.4",
-		kinds: [
-			"addon-crash-loop",
-			"addon-update-available",
-			"addon-updated"
-		]
+		label: "Summary: addons stopped",
+		example: "hub — recorder stopped after repeated crashes",
+		kinds: ["addon-crash-loop"]
+	},
+	{
+		name: "summaryAddonUpdates",
+		label: "Summary: addon updates",
+		example: "hub:\n• @camstack/addon-recorder 1.2.3 → 1.2.4",
+		kinds: ["addon-update-available", "addon-updated"]
 	},
 	{
 		name: "summaryUpdates",
@@ -58892,6 +58983,7 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_BODY_ONLY],
 	[...RULE_TEXT],
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
+	([...RULE_TEXT], [...COMBINED_ALARM]),
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
 	([...RULE_TEXT], [...BATTERY, ...CONSUMABLE]),
 	([...RULE_TEXT], [...CONSUMABLE]),
@@ -58932,6 +59024,8 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
 	...STATE_SUMMARY_VARS
 ];
 new Set([
@@ -59657,6 +59751,12 @@ Object.defineProperty(exports, "CAMERA_SWITCH_ORDER", {
 		return CAMERA_SWITCH_ORDER;
 	}
 });
+Object.defineProperty(exports, "CAMSTACK_APP_LINK_ORIGIN", {
+	enumerable: true,
+	get: function() {
+		return CAMSTACK_APP_LINK_ORIGIN;
+	}
+});
 Object.defineProperty(exports, "CAP_NAMES_WITH_STATUS", {
 	enumerable: true,
 	get: function() {
@@ -60491,6 +60591,12 @@ Object.defineProperty(exports, "parseStreamParamsFormPatch", {
 		return parseStreamParamsFormPatch;
 	}
 });
+Object.defineProperty(exports, "pickAppLinkHub", {
+	enumerable: true,
+	get: function() {
+		return pickAppLinkHub;
+	}
+});
 Object.defineProperty(exports, "planComposition", {
 	enumerable: true,
 	get: function() {

package/dist/http/reverse-proxy.d.ts

@@ -1,4 +1,4 @@
-import { IncomingMessage, ServerResponse } from 'node:http';
+import { IncomingMessage, ServerResponse, OutgoingHttpHeaders } from 'node:http';
 export interface ReverseProxyOptions {
     /** Addon listener base, e.g. `http://127.0.0.1:54123`. */
     readonly baseUrl: string;
@@ -14,6 +14,16 @@ export interface ReverseProxyOptions {
      */
     readonly replayBody?: Buffer;
 }
+/**
+ * The upstream's response headers, minus the CORS policy, which belongs to the
+ * EDGE (D707). The hub stamps its allowlist verdict on `clientRes` with
+ * `setHeader` before hijacking, and Node merges those into `writeHead` — so an
+ * upstream `access-control-*` header would OVERRIDE the hub's answer: the
+ * authenticated file-server's `*` reached a refused origin this way. `Vary` is
+ * merged rather than replaced, so the edge's `Origin` survives an upstream
+ * `Accept-Encoding`.
+ */
+export declare function edgeOwnedResponseHeaders(upRes: IncomingMessage, clientRes: ServerResponse): OutgoingHttpHeaders;
 /** Reverse-proxy one request to an addon data-plane listener. Fire-and-forget:
  *  the caller must `reply.hijack()` (or otherwise stop the framework from also
  *  responding) before calling this, since we drive `clientRes` directly. */

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DeGPW01G.js");
+const require_dist = require("./dist-DePB7uwU.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -31,7 +31,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-ey4mbofz.js");
 const require_tls$1 = require("./tls-ue_Xefmv.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-B_0-zpI6.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-CRqYKHAb.js");
 const require_resource_monitor = require("./resource-monitor-BgWGRxN5.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");
@@ -410,6 +410,38 @@ function canServeDataPlane(state) {
 * headers + body), so `Content-Range`, backpressure and client-disconnect are all
 * native. No bytes are buffered; nothing crosses the cap channel.
 */
+/**
+* The upstream's response headers, minus the CORS policy, which belongs to the
+* EDGE (D707). The hub stamps its allowlist verdict on `clientRes` with
+* `setHeader` before hijacking, and Node merges those into `writeHead` — so an
+* upstream `access-control-*` header would OVERRIDE the hub's answer: the
+* authenticated file-server's `*` reached a refused origin this way. `Vary` is
+* merged rather than replaced, so the edge's `Origin` survives an upstream
+* `Accept-Encoding`.
+*/
+function edgeOwnedResponseHeaders(upRes, clientRes) {
+	const out = {};
+	for (const [name, value] of Object.entries(upRes.headers)) {
+		if (value === void 0) continue;
+		const lower = name.toLowerCase();
+		if (lower.startsWith("access-control-")) continue;
+		out[lower] = value;
+	}
+	const edgeVary = clientRes.getHeader("vary");
+	const upVary = out["vary"];
+	if (typeof edgeVary === "string" && edgeVary.length > 0 && upVary !== void 0) {
+		const tokens = /* @__PURE__ */ new Set();
+		const merged = [];
+		for (const part of [edgeVary, String(upVary)].join(",").split(",")) {
+			const token = part.trim();
+			if (token.length === 0 || tokens.has(token.toLowerCase())) continue;
+			tokens.add(token.toLowerCase());
+			merged.push(token);
+		}
+		out["vary"] = merged.join(", ");
+	}
+	return out;
+}
 /** Reverse-proxy one request to an addon data-plane listener. Fire-and-forget:
 *  the caller must `reply.hijack()` (or otherwise stop the framework from also
 *  responding) before calling this, since we drive `clientRes` directly. */
@@ -430,17 +462,11 @@ function proxyToUpstream(opts) {
 		path: upstreamPath,
 		headers
 	}, (upRes) => {
-		clientRes.writeHead(upRes.statusCode ?? 502, {
-			"access-control-allow-origin": "*",
-			...upRes.headers
-		});
+		clientRes.writeHead(upRes.statusCode ?? 502, edgeOwnedResponseHeaders(upRes, clientRes));
 		upRes.pipe(clientRes);
 	});
 	upstream.on("error", (err) => {
-		if (!clientRes.headersSent) clientRes.writeHead(502, {
-			"content-type": "application/json",
-			"access-control-allow-origin": "*"
-		});
+		if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "application/json" });
 		clientRes.end(JSON.stringify({
 			error: "data-plane upstream error",
 			detail: String(err)
@@ -7746,10 +7772,26 @@ function createDoorSettingsView(addonId, door, sections) {
 //#region src/kernel/config-schema.ts
 /** Default data directory — used when CAMSTACK_DATA env var is not set */
 var DEFAULT_DATA_PATH = "camstack-data";
+/**
+* A list of browser origins from config.yaml (a YAML list) or from the
+* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
+* only strings). Validation of each entry is the CORS policy's job
+* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
+* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
+*/
+var originListSchema = zod.z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, zod.z.array(zod.z.string()));
 var serverSchema = zod.z.object({
 	port: zod.z.number().default(4443),
 	host: zod.z.string().default("0.0.0.0"),
-	dataPath: zod.z.string().default(DEFAULT_DATA_PATH)
+	dataPath: zod.z.string().default(DEFAULT_DATA_PATH),
+	/**
+	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
+	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
+	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
+	* who may read hub responses in a browser is a security decision, and the
+	* policy is live from the first request, before the settings store exists.
+	*/
+	corsOrigins: originListSchema.default([])
 });
 var authSchema = zod.z.object({
 	jwtSecret: zod.z.string().nullable().default(null),
@@ -10214,7 +10256,8 @@ var ENV_VAR_MAP = {
 	CAMSTACK_DATA: "server.dataPath",
 	CAMSTACK_JWT_SECRET: "auth.jwtSecret",
 	CAMSTACK_ADMIN_USER: "auth.adminUsername",
-	CAMSTACK_ADMIN_PASS: "auth.adminPassword"
+	CAMSTACK_ADMIN_PASS: "auth.adminPassword",
+	CAMSTACK_CORS_ORIGINS: "server.corsOrigins"
 };
 /** config.yaml, env overrides applied, parsed. */
 function loadBootstrapConfig(configPath) {