@camstack/system 1.2.353 → 1.2.354

package/dist/http/reverse-proxy.d.ts

@@ -1,4 +1,4 @@
-import { IncomingMessage, ServerResponse } from 'node:http';
+import { IncomingMessage, ServerResponse, OutgoingHttpHeaders } from 'node:http';
 export interface ReverseProxyOptions {
     /** Addon listener base, e.g. `http://127.0.0.1:54123`. */
     readonly baseUrl: string;
@@ -14,6 +14,16 @@ export interface ReverseProxyOptions {
      */
     readonly replayBody?: Buffer;
 }
+/**
+ * The upstream's response headers, minus the CORS policy, which belongs to the
+ * EDGE (D707). The hub stamps its allowlist verdict on `clientRes` with
+ * `setHeader` before hijacking, and Node merges those into `writeHead` — so an
+ * upstream `access-control-*` header would OVERRIDE the hub's answer: the
+ * authenticated file-server's `*` reached a refused origin this way. `Vary` is
+ * merged rather than replaced, so the edge's `Origin` survives an upstream
+ * `Accept-Encoding`.
+ */
+export declare function edgeOwnedResponseHeaders(upRes: IncomingMessage, clientRes: ServerResponse): OutgoingHttpHeaders;
 /** Reverse-proxy one request to an addon data-plane listener. Fire-and-forget:
  *  the caller must `reply.hijack()` (or otherwise stop the framework from also
  *  responding) before calling this, since we drive `clientRes` directly. */

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CXVXFdJX.js");
+const require_dist = require("./dist-DePB7uwU.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -31,7 +31,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-ey4mbofz.js");
 const require_tls$1 = require("./tls-ue_Xefmv.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-CvYlCq60.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-CRqYKHAb.js");
 const require_resource_monitor = require("./resource-monitor-BgWGRxN5.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");
@@ -410,6 +410,38 @@ function canServeDataPlane(state) {
 * headers + body), so `Content-Range`, backpressure and client-disconnect are all
 * native. No bytes are buffered; nothing crosses the cap channel.
 */
+/**
+* The upstream's response headers, minus the CORS policy, which belongs to the
+* EDGE (D707). The hub stamps its allowlist verdict on `clientRes` with
+* `setHeader` before hijacking, and Node merges those into `writeHead` — so an
+* upstream `access-control-*` header would OVERRIDE the hub's answer: the
+* authenticated file-server's `*` reached a refused origin this way. `Vary` is
+* merged rather than replaced, so the edge's `Origin` survives an upstream
+* `Accept-Encoding`.
+*/
+function edgeOwnedResponseHeaders(upRes, clientRes) {
+	const out = {};
+	for (const [name, value] of Object.entries(upRes.headers)) {
+		if (value === void 0) continue;
+		const lower = name.toLowerCase();
+		if (lower.startsWith("access-control-")) continue;
+		out[lower] = value;
+	}
+	const edgeVary = clientRes.getHeader("vary");
+	const upVary = out["vary"];
+	if (typeof edgeVary === "string" && edgeVary.length > 0 && upVary !== void 0) {
+		const tokens = /* @__PURE__ */ new Set();
+		const merged = [];
+		for (const part of [edgeVary, String(upVary)].join(",").split(",")) {
+			const token = part.trim();
+			if (token.length === 0 || tokens.has(token.toLowerCase())) continue;
+			tokens.add(token.toLowerCase());
+			merged.push(token);
+		}
+		out["vary"] = merged.join(", ");
+	}
+	return out;
+}
 /** Reverse-proxy one request to an addon data-plane listener. Fire-and-forget:
 *  the caller must `reply.hijack()` (or otherwise stop the framework from also
 *  responding) before calling this, since we drive `clientRes` directly. */
@@ -430,17 +462,11 @@ function proxyToUpstream(opts) {
 		path: upstreamPath,
 		headers
 	}, (upRes) => {
-		clientRes.writeHead(upRes.statusCode ?? 502, {
-			"access-control-allow-origin": "*",
-			...upRes.headers
-		});
+		clientRes.writeHead(upRes.statusCode ?? 502, edgeOwnedResponseHeaders(upRes, clientRes));
 		upRes.pipe(clientRes);
 	});
 	upstream.on("error", (err) => {
-		if (!clientRes.headersSent) clientRes.writeHead(502, {
-			"content-type": "application/json",
-			"access-control-allow-origin": "*"
-		});
+		if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "application/json" });
 		clientRes.end(JSON.stringify({
 			error: "data-plane upstream error",
 			detail: String(err)
@@ -7746,10 +7772,26 @@ function createDoorSettingsView(addonId, door, sections) {
 //#region src/kernel/config-schema.ts
 /** Default data directory — used when CAMSTACK_DATA env var is not set */
 var DEFAULT_DATA_PATH = "camstack-data";
+/**
+* A list of browser origins from config.yaml (a YAML list) or from the
+* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
+* only strings). Validation of each entry is the CORS policy's job
+* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
+* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
+*/
+var originListSchema = zod.z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, zod.z.array(zod.z.string()));
 var serverSchema = zod.z.object({
 	port: zod.z.number().default(4443),
 	host: zod.z.string().default("0.0.0.0"),
-	dataPath: zod.z.string().default(DEFAULT_DATA_PATH)
+	dataPath: zod.z.string().default(DEFAULT_DATA_PATH),
+	/**
+	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
+	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
+	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
+	* who may read hub responses in a browser is a security decision, and the
+	* policy is live from the first request, before the settings store exists.
+	*/
+	corsOrigins: originListSchema.default([])
 });
 var authSchema = zod.z.object({
 	jwtSecret: zod.z.string().nullable().default(null),
@@ -10214,7 +10256,8 @@ var ENV_VAR_MAP = {
 	CAMSTACK_DATA: "server.dataPath",
 	CAMSTACK_JWT_SECRET: "auth.jwtSecret",
 	CAMSTACK_ADMIN_USER: "auth.adminUsername",
-	CAMSTACK_ADMIN_PASS: "auth.adminPassword"
+	CAMSTACK_ADMIN_PASS: "auth.adminPassword",
+	CAMSTACK_CORS_ORIGINS: "server.corsOrigins"
 };
 /** config.yaml, env overrides applied, parsed. */
 function loadBootstrapConfig(configPath) {

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $n as ReadinessRegistry, Bt as lifecycleJobSchema, D as METHOD_ACCESS_MAP, Dt as extractNestedAddonId, Ft as isObjectInput, Gt as looseSchema, It as isVoidInput, Jn as errMsg$1, Lt as kebabToCamel, M as RUNTIME_DEFAULTS, Mt as isArrayOutputSchema, Nt as isCollectionArrayMethod, Qn as DEVICE_STATUS_METHOD, U as addonSettingsCapability, Wt as logLevelAtMost, Xn as DATAPLANE_SECRET_HEADER$1, Zn as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _r as scopeKey, an as procedureAuthKey, ar as createEvent, br as EventCategory$1, cr as expandCapMethods, en as objectInputDeclaresAddonId, er as ReadinessTimeoutError, gn as scopesAllowDeviceCap, gr as resolveCapMount, hn as scopesAllowAddon, hr as readinessKey, ir as asString$1, mr as parseJsonUnknown, nr as asJsonObject$1, or as emitDownForOwnedCaps, pn as resolveMethodAuth, pr as parseJsonObject, rr as asNumber, t as ALL_CAPABILITY_DEFINITIONS, tn as objectInputDeclaresRequiredDeviceId, w as LOG_LEVEL_RANK } from "./dist-Cm556q2j.mjs";
+import { $n as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Gt as logLevelAtMost, It as isObjectInput, Kt as looseSchema, Lt as isVoidInput, N as RUNTIME_DEFAULTS, Nt as isArrayOutputSchema, O as METHOD_ACCESS_MAP, Ot as extractNestedAddonId, Pt as isCollectionArrayMethod, Qn as DATAPLANE_SECRET_HEADER$1, Rt as kebabToCamel, Sr as EventCategory$1, T as LOG_LEVEL_RANK, Vt as lifecycleJobSchema, W as addonSettingsCapability, Xn as errMsg$1, _n as scopesAllowAddon, _r as readinessKey, ar as asNumber, cr as emitDownForOwnedCaps, er as DEVICE_STATUS_METHOD, gr as parseJsonUnknown, hn as resolveMethodAuth, hr as parseJsonObject, ir as asJsonObject$1, nn as objectInputDeclaresRequiredDeviceId, nr as ReadinessTimeoutError, or as asString$1, sn as procedureAuthKey, sr as createEvent, t as ALL_CAPABILITY_DEFINITIONS, tn as objectInputDeclaresAddonId, tr as ReadinessRegistry, ur as expandCapMethods, vn as scopesAllowDeviceCap, vr as resolveCapMount, yr as scopeKey } from "./dist-DVyXxn41.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -30,7 +30,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as ensureModel, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, g as downloadModel, h as downloadFile, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as deleteModelFromDisk, n as STALL_TICK_MS, o as contentTypeFor, p as collectModelFiles, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as fetchJson, x as isModelDownloaded, y as getModelFilePath } from "./event-loop-stall-monitor-EXjzIxDz.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DTlVWwAI.mjs";
-import { $ as CapRouteError, $n as CAP_ACTION_UNLABELLED, $t as RUNNER_HEAP_WATCH_INTERVAL_MS, A as resolveHwAccel, An as OUTBOUND_QUEUE_COOLDOWN_MS, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as SOCKET_QUEUE_TOP_N, Bt as createAddonPeerBytesFacility, C as getBrokerEventBus, Cn as DECISIVE_HEAP_SPACES, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as heapSpaceField, Dt as capServiceName, E as setNodeEventInterest, En as formatHeapSpaces, Et as capBareAction, F as ipcParentLink, Fn as MESH_QUEUE_TOP_N, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as readSocketQueues, Gt as HEAP_RECLAIM_TRIGGER_MB, H as createUdsLoggerWithControl, Hn as createSocketPlaneReader, Ht as createAddonDataPlaneFacility, I as localProviderLink, In as createMeshQueueReader, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as recordSocketFrame, Jt as HUB_MAIN_HEAP_WATCH_LABEL, K as afterWorkerOnlineAnnounce, Kn as EMPTY_SOCKET_DIRECTION, Kt as HEAP_WATCH_INTERVAL_MS, L as createParentUnownedCallHandler, Ln as formatMeshQueue, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, Mt as CapabilityHandle, N as buildLinkChain, Nn as createOutboundQueueGate, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as readHeapSpaces, Ot as parseCapAction, P as deviceCapResolverLink, Pn as formatOutboundQueueVerdict, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as CAP_ACTION_OVERFLOW_LABEL, Qt as RSS_BUDGET_RELEASE_RATIO, R as createUdsEventBridge, Rn as EMPTY_SOCKET_PLANE_BASELINE, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as isArrayBufferCensusReport, St as validateProviderRegistrations, T as registerEventBusService, Tn as emitHeapDiagnosticReport, Tt as capActionSuffix, U as LocalChildClient, Un as diffSocketPlane, Ut as HEAP_RECLAIM_MIN_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneMeter, Vt as hostNodeIdOf, W as LocalChildRegistry, Wn as formatSocketPlane, Wt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionBytes, Xt as HUB_RSS_BUDGET_ENV, Y as deviceOfGetStatus, Yn as sampleSocketDirection, Yt as HUB_MAIN_RSS_BUDGET_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as socketDirectionMessages, Zt as RSS_BUDGET_REANNOUNCE_MIN_MS, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, a as reapProcessGroup, an as createV8Reclaimer, ar as EVENT_PLANE_TOP_N, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as createInspectorArrayBufferCensus, c as runnerOwnsProcessGroup, cn as nextRssBudgetState, cr as diffEventPlane, ct as UdsLocalTransportClient, d as summarizeMembers, dn as shouldReclaim, dt as PeerAnsweredError, en as RUNNER_RSS_BUDGET_ENV, er as EMPTY_CAP_ACTION_READING, et as classifyCapRoute, f as installManifestSystemDeps, fn as startHeapWatch, ft as localEndpointPath, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ht as buildNativeCapProxy, in as createLoopDelayMeter, ir as diffCapActionCensus, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as OUTBOUND_QUEUE_SUSTAIN_MS, jt as DeviceRegistry, k as createKernelHwAccel, kn as selectReportedSpaces, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as parseRssBudgetMb, lr as formatEventPlane, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as strandedMb, mt as encodeFrame, nn as buildHeapSample, nr as capActionLabel, nt as readMoleculerFanoutMode, o as registerRunnerGroup, on as describeRss, or as createEventPlaneMeter, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as startRunnerHeapWatch, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as createSocketDirectionCounters, qt as HEAP_WATCH_WARN_RATIO, r as defaultProcessGroupOps, rn as createDeferredHeapWatchSink, rr as createCapActionCensus, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as hubMainRssBudget, sr as createEventPlaneReader, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as ZERO_LOOP_DELAY, tr as MAX_CAP_ACTIONS_PER_PEER, tt as callWithServiceDiscovery, un as reclaimIntervalMs, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, w as getMoleculerEventStats, wn as HEAP_SPACE_REPORT_MIN_MB, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as formatArrayBufferCensus, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as createArrayBufferCensusGate, yt as mountNativeCapService, z as createUdsEventBus, zn as SOCKET_PLANE_TOP_N, zt as runNpm } from "./child-cap-dispatch-C6IpRb4P.mjs";
+import { $ as CapRouteError, $n as CAP_ACTION_UNLABELLED, $t as RUNNER_HEAP_WATCH_INTERVAL_MS, A as resolveHwAccel, An as OUTBOUND_QUEUE_COOLDOWN_MS, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as SOCKET_QUEUE_TOP_N, Bt as createAddonPeerBytesFacility, C as getBrokerEventBus, Cn as DECISIVE_HEAP_SPACES, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as heapSpaceField, Dt as capServiceName, E as setNodeEventInterest, En as formatHeapSpaces, Et as capBareAction, F as ipcParentLink, Fn as MESH_QUEUE_TOP_N, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as readSocketQueues, Gt as HEAP_RECLAIM_TRIGGER_MB, H as createUdsLoggerWithControl, Hn as createSocketPlaneReader, Ht as createAddonDataPlaneFacility, I as localProviderLink, In as createMeshQueueReader, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as recordSocketFrame, Jt as HUB_MAIN_HEAP_WATCH_LABEL, K as afterWorkerOnlineAnnounce, Kn as EMPTY_SOCKET_DIRECTION, Kt as HEAP_WATCH_INTERVAL_MS, L as createParentUnownedCallHandler, Ln as formatMeshQueue, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, Mt as CapabilityHandle, N as buildLinkChain, Nn as createOutboundQueueGate, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as readHeapSpaces, Ot as parseCapAction, P as deviceCapResolverLink, Pn as formatOutboundQueueVerdict, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as CAP_ACTION_OVERFLOW_LABEL, Qt as RSS_BUDGET_RELEASE_RATIO, R as createUdsEventBridge, Rn as EMPTY_SOCKET_PLANE_BASELINE, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as isArrayBufferCensusReport, St as validateProviderRegistrations, T as registerEventBusService, Tn as emitHeapDiagnosticReport, Tt as capActionSuffix, U as LocalChildClient, Un as diffSocketPlane, Ut as HEAP_RECLAIM_MIN_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneMeter, Vt as hostNodeIdOf, W as LocalChildRegistry, Wn as formatSocketPlane, Wt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionBytes, Xt as HUB_RSS_BUDGET_ENV, Y as deviceOfGetStatus, Yn as sampleSocketDirection, Yt as HUB_MAIN_RSS_BUDGET_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as socketDirectionMessages, Zt as RSS_BUDGET_REANNOUNCE_MIN_MS, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, a as reapProcessGroup, an as createV8Reclaimer, ar as EVENT_PLANE_TOP_N, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as createInspectorArrayBufferCensus, c as runnerOwnsProcessGroup, cn as nextRssBudgetState, cr as diffEventPlane, ct as UdsLocalTransportClient, d as summarizeMembers, dn as shouldReclaim, dt as PeerAnsweredError, en as RUNNER_RSS_BUDGET_ENV, er as EMPTY_CAP_ACTION_READING, et as classifyCapRoute, f as installManifestSystemDeps, fn as startHeapWatch, ft as localEndpointPath, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ht as buildNativeCapProxy, in as createLoopDelayMeter, ir as diffCapActionCensus, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as OUTBOUND_QUEUE_SUSTAIN_MS, jt as DeviceRegistry, k as createKernelHwAccel, kn as selectReportedSpaces, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as parseRssBudgetMb, lr as formatEventPlane, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as strandedMb, mt as encodeFrame, nn as buildHeapSample, nr as capActionLabel, nt as readMoleculerFanoutMode, o as registerRunnerGroup, on as describeRss, or as createEventPlaneMeter, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as startRunnerHeapWatch, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as createSocketDirectionCounters, qt as HEAP_WATCH_WARN_RATIO, r as defaultProcessGroupOps, rn as createDeferredHeapWatchSink, rr as createCapActionCensus, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as hubMainRssBudget, sr as createEventPlaneReader, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as ZERO_LOOP_DELAY, tr as MAX_CAP_ACTIONS_PER_PEER, tt as callWithServiceDiscovery, un as reclaimIntervalMs, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, w as getMoleculerEventStats, wn as HEAP_SPACE_REPORT_MIN_MB, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as formatArrayBufferCensus, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as createArrayBufferCensusGate, yt as mountNativeCapService, z as createUdsEventBus, zn as SOCKET_PLANE_TOP_N, zt as runNpm } from "./child-cap-dispatch-C1x1kNJK.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";
@@ -403,6 +403,38 @@ function canServeDataPlane(state) {
 * headers + body), so `Content-Range`, backpressure and client-disconnect are all
 * native. No bytes are buffered; nothing crosses the cap channel.
 */
+/**
+* The upstream's response headers, minus the CORS policy, which belongs to the
+* EDGE (D707). The hub stamps its allowlist verdict on `clientRes` with
+* `setHeader` before hijacking, and Node merges those into `writeHead` — so an
+* upstream `access-control-*` header would OVERRIDE the hub's answer: the
+* authenticated file-server's `*` reached a refused origin this way. `Vary` is
+* merged rather than replaced, so the edge's `Origin` survives an upstream
+* `Accept-Encoding`.
+*/
+function edgeOwnedResponseHeaders(upRes, clientRes) {
+	const out = {};
+	for (const [name, value] of Object.entries(upRes.headers)) {
+		if (value === void 0) continue;
+		const lower = name.toLowerCase();
+		if (lower.startsWith("access-control-")) continue;
+		out[lower] = value;
+	}
+	const edgeVary = clientRes.getHeader("vary");
+	const upVary = out["vary"];
+	if (typeof edgeVary === "string" && edgeVary.length > 0 && upVary !== void 0) {
+		const tokens = /* @__PURE__ */ new Set();
+		const merged = [];
+		for (const part of [edgeVary, String(upVary)].join(",").split(",")) {
+			const token = part.trim();
+			if (token.length === 0 || tokens.has(token.toLowerCase())) continue;
+			tokens.add(token.toLowerCase());
+			merged.push(token);
+		}
+		out["vary"] = merged.join(", ");
+	}
+	return out;
+}
 /** Reverse-proxy one request to an addon data-plane listener. Fire-and-forget:
 *  the caller must `reply.hijack()` (or otherwise stop the framework from also
 *  responding) before calling this, since we drive `clientRes` directly. */
@@ -423,17 +455,11 @@ function proxyToUpstream(opts) {
 		path: upstreamPath,
 		headers
 	}, (upRes) => {
-		clientRes.writeHead(upRes.statusCode ?? 502, {
-			"access-control-allow-origin": "*",
-			...upRes.headers
-		});
+		clientRes.writeHead(upRes.statusCode ?? 502, edgeOwnedResponseHeaders(upRes, clientRes));
 		upRes.pipe(clientRes);
 	});
 	upstream.on("error", (err) => {
-		if (!clientRes.headersSent) clientRes.writeHead(502, {
-			"content-type": "application/json",
-			"access-control-allow-origin": "*"
-		});
+		if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "application/json" });
 		clientRes.end(JSON.stringify({
 			error: "data-plane upstream error",
 			detail: String(err)
@@ -7739,10 +7765,26 @@ function createDoorSettingsView(addonId, door, sections) {
 //#region src/kernel/config-schema.ts
 /** Default data directory — used when CAMSTACK_DATA env var is not set */
 var DEFAULT_DATA_PATH = "camstack-data";
+/**
+* A list of browser origins from config.yaml (a YAML list) or from the
+* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
+* only strings). Validation of each entry is the CORS policy's job
+* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
+* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
+*/
+var originListSchema = z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, z.array(z.string()));
 var serverSchema = z.object({
 	port: z.number().default(4443),
 	host: z.string().default("0.0.0.0"),
-	dataPath: z.string().default(DEFAULT_DATA_PATH)
+	dataPath: z.string().default(DEFAULT_DATA_PATH),
+	/**
+	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
+	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
+	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
+	* who may read hub responses in a browser is a security decision, and the
+	* policy is live from the first request, before the settings store exists.
+	*/
+	corsOrigins: originListSchema.default([])
 });
 var authSchema = z.object({
 	jwtSecret: z.string().nullable().default(null),
@@ -10207,7 +10249,8 @@ var ENV_VAR_MAP = {
 	CAMSTACK_DATA: "server.dataPath",
 	CAMSTACK_JWT_SECRET: "auth.jwtSecret",
 	CAMSTACK_ADMIN_USER: "auth.adminUsername",
-	CAMSTACK_ADMIN_PASS: "auth.adminPassword"
+	CAMSTACK_ADMIN_PASS: "auth.adminPassword",
+	CAMSTACK_CORS_ORIGINS: "server.corsOrigins"
 };
 /** config.yaml, env overrides applied, parsed. */
 function loadBootstrapConfig(configPath) {

package/dist/kernel/config-schema.d.ts

@@ -12,6 +12,7 @@ export declare const bootstrapSchema: z.ZodObject<{
         port: z.ZodDefault<z.ZodNumber>;
         host: z.ZodDefault<z.ZodString>;
         dataPath: z.ZodDefault<z.ZodString>;
+        corsOrigins: z.ZodDefault<z.ZodPreprocess<z.ZodArray<z.ZodString>>>;
     }, z.core.$strip>>;
     auth: z.ZodDefault<z.ZodObject<{
         jwtSecret: z.ZodDefault<z.ZodNullable<z.ZodString>>;

package/dist/{retired-settings-keys-D24IW4qo.js → retired-settings-keys-BTKZdPn6.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CXVXFdJX.js");
+const require_dist = require("./dist-DePB7uwU.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-DzkSqnH0.mjs → retired-settings-keys-DFur4hJF.mjs}

@@ -1,4 +1,4 @@
-import { nr as asJsonObject } from "./dist-Cm556q2j.mjs";
+import { ir as asJsonObject } from "./dist-DVyXxn41.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.353",
+  "version": "1.2.354",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",