@camstack/system 1.2.353 → 1.2.355

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CXVXFdJX.js");
+const require_dist = require("./dist-BWicEEVA.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -31,7 +31,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-ey4mbofz.js");
 const require_tls$1 = require("./tls-ue_Xefmv.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-CvYlCq60.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-CqV-7-QZ.js");
 const require_resource_monitor = require("./resource-monitor-BgWGRxN5.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");
@@ -410,6 +410,38 @@ function canServeDataPlane(state) {
 * headers + body), so `Content-Range`, backpressure and client-disconnect are all
 * native. No bytes are buffered; nothing crosses the cap channel.
 */
+/**
+* The upstream's response headers, minus the CORS policy, which belongs to the
+* EDGE (D707). The hub stamps its allowlist verdict on `clientRes` with
+* `setHeader` before hijacking, and Node merges those into `writeHead` — so an
+* upstream `access-control-*` header would OVERRIDE the hub's answer: the
+* authenticated file-server's `*` reached a refused origin this way. `Vary` is
+* merged rather than replaced, so the edge's `Origin` survives an upstream
+* `Accept-Encoding`.
+*/
+function edgeOwnedResponseHeaders(upRes, clientRes) {
+	const out = {};
+	for (const [name, value] of Object.entries(upRes.headers)) {
+		if (value === void 0) continue;
+		const lower = name.toLowerCase();
+		if (lower.startsWith("access-control-")) continue;
+		out[lower] = value;
+	}
+	const edgeVary = clientRes.getHeader("vary");
+	const upVary = out["vary"];
+	if (typeof edgeVary === "string" && edgeVary.length > 0 && upVary !== void 0) {
+		const tokens = /* @__PURE__ */ new Set();
+		const merged = [];
+		for (const part of [edgeVary, String(upVary)].join(",").split(",")) {
+			const token = part.trim();
+			if (token.length === 0 || tokens.has(token.toLowerCase())) continue;
+			tokens.add(token.toLowerCase());
+			merged.push(token);
+		}
+		out["vary"] = merged.join(", ");
+	}
+	return out;
+}
 /** Reverse-proxy one request to an addon data-plane listener. Fire-and-forget:
 *  the caller must `reply.hijack()` (or otherwise stop the framework from also
 *  responding) before calling this, since we drive `clientRes` directly. */
@@ -430,17 +462,11 @@ function proxyToUpstream(opts) {
 		path: upstreamPath,
 		headers
 	}, (upRes) => {
-		clientRes.writeHead(upRes.statusCode ?? 502, {
-			"access-control-allow-origin": "*",
-			...upRes.headers
-		});
+		clientRes.writeHead(upRes.statusCode ?? 502, edgeOwnedResponseHeaders(upRes, clientRes));
 		upRes.pipe(clientRes);
 	});
 	upstream.on("error", (err) => {
-		if (!clientRes.headersSent) clientRes.writeHead(502, {
-			"content-type": "application/json",
-			"access-control-allow-origin": "*"
-		});
+		if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "application/json" });
 		clientRes.end(JSON.stringify({
 			error: "data-plane upstream error",
 			detail: String(err)
@@ -3211,8 +3237,7 @@ async function copyDirRecursive(src, dest) {
 * `addons/` stays node_modules-free, which is what lets the backup tar the whole
 * folder with no exclusion list (see ADR-0027). An addon that genuinely needs an
 * un-bundleable runtime dep declares it explicitly in
-* `camstack.runtimeDependencies`; the debug escape hatch
-* `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy install-everything path.
+* `camstack.runtimeDependencies`.
 *
 * (Historically this mirrored the build preset's COMMON_NATIVE_DEPS and
 * per-addon-installed node-av/sharp/onnxruntime-node/ssh2/werift/systeminformation
@@ -3243,13 +3268,9 @@ function readRuntimeDependencies(pkg) {
 * `dependencies` so `--omit=peer` installs can't drop them (pipeline's
 * patched `werift`).
 *
-* Escape hatch: `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy behaviour
-* (strip only @camstack/*) for debugging a suspected undeclared runtime dep.
-*
 * Returns a new object (immutable).
 */
 function stripBundledDeps(pkg) {
-	if (process.env.CAMSTACK_INSTALL_FULL_DEPS === "1") return stripCamstackDeps(pkg);
 	const camstack = pkg.camstack;
 	if (camstack !== null && typeof camstack === "object" && !Array.isArray(camstack) && camstack.system === true) return stripCamstackDeps(pkg);
 	const keep = new Set([...RUNTIME_NATIVE_KEEP, ...readRuntimeDependencies(pkg)]);
@@ -7746,10 +7767,26 @@ function createDoorSettingsView(addonId, door, sections) {
 //#region src/kernel/config-schema.ts
 /** Default data directory — used when CAMSTACK_DATA env var is not set */
 var DEFAULT_DATA_PATH = "camstack-data";
+/**
+* A list of browser origins from config.yaml (a YAML list) or from the
+* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
+* only strings). Validation of each entry is the CORS policy's job
+* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
+* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
+*/
+var originListSchema = zod.z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, zod.z.array(zod.z.string()));
 var serverSchema = zod.z.object({
 	port: zod.z.number().default(4443),
 	host: zod.z.string().default("0.0.0.0"),
-	dataPath: zod.z.string().default(DEFAULT_DATA_PATH)
+	dataPath: zod.z.string().default(DEFAULT_DATA_PATH),
+	/**
+	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
+	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
+	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
+	* who may read hub responses in a browser is a security decision, and the
+	* policy is live from the first request, before the settings store exists.
+	*/
+	corsOrigins: originListSchema.default([])
 });
 var authSchema = zod.z.object({
 	jwtSecret: zod.z.string().nullable().default(null),
@@ -10214,7 +10251,8 @@ var ENV_VAR_MAP = {
 	CAMSTACK_DATA: "server.dataPath",
 	CAMSTACK_JWT_SECRET: "auth.jwtSecret",
 	CAMSTACK_ADMIN_USER: "auth.adminUsername",
-	CAMSTACK_ADMIN_PASS: "auth.adminPassword"
+	CAMSTACK_ADMIN_PASS: "auth.adminPassword",
+	CAMSTACK_CORS_ORIGINS: "server.corsOrigins"
 };
 /** config.yaml, env overrides applied, parsed. */
 function loadBootstrapConfig(configPath) {
@@ -94366,9 +94404,8 @@ function resolveUseHostname() {
 function createBroker(config) {
 	const { nodeID, mode, hubAddress, logLevel = "warn", secret, tcpPort = DEFAULT_HUB_TCP_PORT, udpPort = DEFAULT_UDP_PORT } = config;
 	const useHostname = resolveUseHostname();
-	const moleculerDebug = process.env["CAMSTACK_MOLECULER_DEBUG"] === "1" || process.env["CAMSTACK_MOLECULER_DEBUG"] === "true";
-	const infraLevel = moleculerDebug ? "debug" : "error";
-	const wildcardLevel = moleculerDebug ? "debug" : logLevel;
+	const infraLevel = "error";
+	const wildcardLevel = logLevel;
 	if (mode === "test") return new ServiceBroker({
 		nodeID,
 		transporter: "Fake",
@@ -94398,7 +94435,7 @@ function createBroker(config) {
 				udpDiscovery: true,
 				udpPort,
 				udpPeriod: 5,
-				debug: moleculerDebug
+				debug: false
 			}
 		},
 		logger: {
@@ -94418,7 +94455,7 @@ function createBroker(config) {
 		maxPacketSize: 10 * 1024 * 1024,
 		port: config.agentListenPort ?? deriveAgentListenPort(nodeID),
 		useHostname,
-		debug: moleculerDebug
+		debug: false
 	};
 	if (hubAddress) {
 		tcpOptions.urls = normalizeHubUrl(hubAddress, tcpPort);
@@ -95226,26 +95263,16 @@ var CrashSupervisor = class {
 *      restores the glibc/sharp defaults. Recoverable without a rebuild.
 *   2. A value the operator already put in the environment (`MALLOC_ARENA_MAX`,
 *      `VIPS_CONCURRENCY`) — inherited verbatim, never overwritten.
-*   3. `CAMSTACK_RUNNER_MALLOC_ARENA_MAX` — the CamStack override.
-*   4. The defaults above.
-*
-* A nonsense override falls back to the default rather than being passed through:
-* glibc reads `MALLOC_ARENA_MAX=0` as "unbounded", which is the very state this
-* exists to leave.
+*   3. The defaults above.
 */
 function runnerNativeAllocatorEnv(parentEnv, platform = process.platform) {
 	if (platform !== "linux") return {};
 	if (parentEnv["CAMSTACK_RUNNER_NATIVE_ALLOCATOR"] === "off") return {};
 	return {
-		MALLOC_ARENA_MAX: parentEnv["MALLOC_ARENA_MAX"] ?? String(positiveInt(parentEnv["CAMSTACK_RUNNER_MALLOC_ARENA_MAX"], 2)),
+		MALLOC_ARENA_MAX: parentEnv["MALLOC_ARENA_MAX"] ?? String(2),
 		VIPS_CONCURRENCY: parentEnv["VIPS_CONCURRENCY"] ?? String(1)
 	};
 }
-function positiveInt(raw, fallback) {
-	if (raw === void 0) return fallback;
-	const n = Number.parseInt(raw, 10);
-	return Number.isFinite(n) && n > 0 ? n : fallback;
-}
 /**
 * The child's environment, with the allocator pair applied or REMOVED.
 *
@@ -95454,6 +95481,8 @@ function isHeavyRunner(addons) {
 * Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
 */
 var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
+/** Light runners' young-generation semi-space, in MB. */
+var LIGHT_SEMI_SPACE_MB = 2;
 /**
 * The runner's old-space ceiling in MB, or 0 for "uncapped".
 *
@@ -95463,7 +95492,7 @@ var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
 * the cap for the whole runner, which is the intended escape hatch.
 */
 function runnerMaxOldSpaceMb(addons, heavy) {
-	const envDefault = heavy ? positiveIntEnv("CAMSTACK_RUNNER_HEAVY_MAX_OLD_MB", HEAVY_MAX_OLD_MB_DEFAULT) : positiveIntEnv("CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB", 0);
+	const envDefault = heavy ? HEAVY_MAX_OLD_MB_DEFAULT : 0;
 	const declared = addons.map((a) => readAddonHeapDeclaration(a).maxOldSpaceMb).filter((mb) => mb !== void 0);
 	if (declared.length === 0) return envDefault;
 	if (declared.includes(0)) return 0;
@@ -95490,38 +95519,25 @@ function runnerRssBudgetMb(addons) {
 * (`--max-semi-space-size`) to reclaim V8's over-reservation — a measured ~15 MB/runner win — bound
 * V8's platform thread pool (`--v8-pool-size`, see {@link LIGHT_V8_POOL_SIZE_DEFAULT}: a measured
 * ~58 threads across the hub's 29 light runners, against a cgroup `pids.max` this host has already
-* hit) and keep an opt-in old-space cap (`CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB`, unset = uncapped). HEAVY
+* hit) and carry no old-space cap unless a manifest declares one. HEAVY
 * runners keep V8's default young generation but ALWAYS carry an old-space ceiling; see
 * {@link HEAVY_MAX_OLD_MB_DEFAULT} for why, and how a runner declares its own.
 *
-* Kill-switch: `CAMSTACK_RUNNER_HEAP_TUNING=off` disables all flags (recover without a rebuild).
-* Overrides: `CAMSTACK_RUNNER_LIGHT_SEMI_SPACE_MB` (default 2),
-* `CAMSTACK_RUNNER_LIGHT_V8_POOL_SIZE` (default {@link LIGHT_V8_POOL_SIZE_DEFAULT}; below 1 omits
-* the flag — `0` means "size from the CPU count" to V8, not "off"),
-* `CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB`
-* (default unset = no old-space cap), `CAMSTACK_RUNNER_HEAVY_MAX_OLD_MB`
-* (default {@link HEAVY_MAX_OLD_MB_DEFAULT}; `0` restores the old uncapped behaviour).
+* The per-addon override is the manifest's declared `maxOldSpaceMb` (`0` = uncapped); the
+* environment overrides and the `CAMSTACK_RUNNER_HEAP_TUNING=off` kill switch were removed on
+* 2026-10-06 — nothing had set them since the rollout.
 */
 function runnerHeapFlags(addons) {
-	if (process.env["CAMSTACK_RUNNER_HEAP_TUNING"] === "off") return [];
 	const heavy = isHeavyRunner(addons);
 	const flags = [];
 	if (!heavy) {
-		const semiMb = positiveIntEnv("CAMSTACK_RUNNER_LIGHT_SEMI_SPACE_MB", 2);
-		if (semiMb > 0) flags.push(`--max-semi-space-size=${semiMb}`);
-		const v8Pool = positiveIntEnv("CAMSTACK_RUNNER_LIGHT_V8_POOL_SIZE", 2);
-		if (v8Pool > 0) flags.push(`--v8-pool-size=${v8Pool}`);
+		flags.push(`--max-semi-space-size=${LIGHT_SEMI_SPACE_MB}`);
+		flags.push(`--v8-pool-size=2`);
 	}
 	const oldMb = runnerMaxOldSpaceMb(addons, heavy);
 	if (oldMb > 0) flags.push(`--max-old-space-size=${oldMb}`);
 	return flags;
 }
-function positiveIntEnv(name, fallback) {
-	const raw = process.env[name];
-	if (raw === void 0) return fallback;
-	const n = Number.parseInt(raw, 10);
-	return Number.isFinite(n) && n >= 0 ? n : fallback;
-}
 var MAX_BACKOFF_MS = 3e4;
 var CRASH_WINDOW_MS = 6e4;
 var MAX_CRASHES_IN_WINDOW = 5;
@@ -96821,7 +96837,6 @@ exports.quarantineAddonResidue = quarantineAddonResidue;
 exports.readExtraSans = require_tls$1.readExtraSans;
 exports.readHeapSpaces = require_child_cap_dispatch.readHeapSpaces;
 exports.readLanHttpState = require_tls$1.readLanHttpState;
-exports.readMoleculerFanoutMode = require_child_cap_dispatch.readMoleculerFanoutMode;
 exports.readPendingRestart = readPendingRestart;
 exports.readSocketQueues = require_child_cap_dispatch.readSocketQueues;
 exports.readTlsAccessStatus = require_tls$1.readTlsAccessStatus;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $n as ReadinessRegistry, Bt as lifecycleJobSchema, D as METHOD_ACCESS_MAP, Dt as extractNestedAddonId, Ft as isObjectInput, Gt as looseSchema, It as isVoidInput, Jn as errMsg$1, Lt as kebabToCamel, M as RUNTIME_DEFAULTS, Mt as isArrayOutputSchema, Nt as isCollectionArrayMethod, Qn as DEVICE_STATUS_METHOD, U as addonSettingsCapability, Wt as logLevelAtMost, Xn as DATAPLANE_SECRET_HEADER$1, Zn as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _r as scopeKey, an as procedureAuthKey, ar as createEvent, br as EventCategory$1, cr as expandCapMethods, en as objectInputDeclaresAddonId, er as ReadinessTimeoutError, gn as scopesAllowDeviceCap, gr as resolveCapMount, hn as scopesAllowAddon, hr as readinessKey, ir as asString$1, mr as parseJsonUnknown, nr as asJsonObject$1, or as emitDownForOwnedCaps, pn as resolveMethodAuth, pr as parseJsonObject, rr as asNumber, t as ALL_CAPABILITY_DEFINITIONS, tn as objectInputDeclaresRequiredDeviceId, w as LOG_LEVEL_RANK } from "./dist-Cm556q2j.mjs";
+import { $n as DATAPLANE_SECRET_HEADER$1, Cr as EventCategory$1, Ft as isCollectionArrayMethod, Ht as lifecycleJobSchema, Kt as logLevelAtMost, Lt as isObjectInput, N as RUNTIME_DEFAULTS, O as METHOD_ACCESS_MAP, Pt as isArrayOutputSchema, Rt as isVoidInput, T as LOG_LEVEL_RANK, W as addonSettingsCapability, Zn as errMsg$1, _r as parseJsonUnknown, ar as asJsonObject$1, br as scopeKey, cn as procedureAuthKey, cr as createEvent, dr as expandCapMethods, er as DEVICE_SETTINGS_CONTRIBUTION_METHODS, gn as resolveMethodAuth, gr as parseJsonObject, kt as extractNestedAddonId, lr as emitDownForOwnedCaps, nn as objectInputDeclaresAddonId, nr as ReadinessRegistry, or as asNumber, qt as looseSchema, rn as objectInputDeclaresRequiredDeviceId, rr as ReadinessTimeoutError, sr as asString$1, t as ALL_CAPABILITY_DEFINITIONS, tr as DEVICE_STATUS_METHOD, vn as scopesAllowAddon, vr as readinessKey, yn as scopesAllowDeviceCap, yr as resolveCapMount, zt as kebabToCamel } from "./dist-OCi0K-iM.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -30,7 +30,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as ensureModel, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, g as downloadModel, h as downloadFile, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as deleteModelFromDisk, n as STALL_TICK_MS, o as contentTypeFor, p as collectModelFiles, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as fetchJson, x as isModelDownloaded, y as getModelFilePath } from "./event-loop-stall-monitor-EXjzIxDz.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DTlVWwAI.mjs";
-import { $ as CapRouteError, $n as CAP_ACTION_UNLABELLED, $t as RUNNER_HEAP_WATCH_INTERVAL_MS, A as resolveHwAccel, An as OUTBOUND_QUEUE_COOLDOWN_MS, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as SOCKET_QUEUE_TOP_N, Bt as createAddonPeerBytesFacility, C as getBrokerEventBus, Cn as DECISIVE_HEAP_SPACES, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as heapSpaceField, Dt as capServiceName, E as setNodeEventInterest, En as formatHeapSpaces, Et as capBareAction, F as ipcParentLink, Fn as MESH_QUEUE_TOP_N, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as readSocketQueues, Gt as HEAP_RECLAIM_TRIGGER_MB, H as createUdsLoggerWithControl, Hn as createSocketPlaneReader, Ht as createAddonDataPlaneFacility, I as localProviderLink, In as createMeshQueueReader, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as recordSocketFrame, Jt as HUB_MAIN_HEAP_WATCH_LABEL, K as afterWorkerOnlineAnnounce, Kn as EMPTY_SOCKET_DIRECTION, Kt as HEAP_WATCH_INTERVAL_MS, L as createParentUnownedCallHandler, Ln as formatMeshQueue, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, Mt as CapabilityHandle, N as buildLinkChain, Nn as createOutboundQueueGate, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as readHeapSpaces, Ot as parseCapAction, P as deviceCapResolverLink, Pn as formatOutboundQueueVerdict, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as CAP_ACTION_OVERFLOW_LABEL, Qt as RSS_BUDGET_RELEASE_RATIO, R as createUdsEventBridge, Rn as EMPTY_SOCKET_PLANE_BASELINE, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as isArrayBufferCensusReport, St as validateProviderRegistrations, T as registerEventBusService, Tn as emitHeapDiagnosticReport, Tt as capActionSuffix, U as LocalChildClient, Un as diffSocketPlane, Ut as HEAP_RECLAIM_MIN_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneMeter, Vt as hostNodeIdOf, W as LocalChildRegistry, Wn as formatSocketPlane, Wt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionBytes, Xt as HUB_RSS_BUDGET_ENV, Y as deviceOfGetStatus, Yn as sampleSocketDirection, Yt as HUB_MAIN_RSS_BUDGET_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as socketDirectionMessages, Zt as RSS_BUDGET_REANNOUNCE_MIN_MS, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, a as reapProcessGroup, an as createV8Reclaimer, ar as EVENT_PLANE_TOP_N, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as createInspectorArrayBufferCensus, c as runnerOwnsProcessGroup, cn as nextRssBudgetState, cr as diffEventPlane, ct as UdsLocalTransportClient, d as summarizeMembers, dn as shouldReclaim, dt as PeerAnsweredError, en as RUNNER_RSS_BUDGET_ENV, er as EMPTY_CAP_ACTION_READING, et as classifyCapRoute, f as installManifestSystemDeps, fn as startHeapWatch, ft as localEndpointPath, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ht as buildNativeCapProxy, in as createLoopDelayMeter, ir as diffCapActionCensus, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as OUTBOUND_QUEUE_SUSTAIN_MS, jt as DeviceRegistry, k as createKernelHwAccel, kn as selectReportedSpaces, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as parseRssBudgetMb, lr as formatEventPlane, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as strandedMb, mt as encodeFrame, nn as buildHeapSample, nr as capActionLabel, nt as readMoleculerFanoutMode, o as registerRunnerGroup, on as describeRss, or as createEventPlaneMeter, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as startRunnerHeapWatch, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as createSocketDirectionCounters, qt as HEAP_WATCH_WARN_RATIO, r as defaultProcessGroupOps, rn as createDeferredHeapWatchSink, rr as createCapActionCensus, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as hubMainRssBudget, sr as createEventPlaneReader, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as ZERO_LOOP_DELAY, tr as MAX_CAP_ACTIONS_PER_PEER, tt as callWithServiceDiscovery, un as reclaimIntervalMs, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, w as getMoleculerEventStats, wn as HEAP_SPACE_REPORT_MIN_MB, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as formatArrayBufferCensus, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as createArrayBufferCensusGate, yt as mountNativeCapService, z as createUdsEventBus, zn as SOCKET_PLANE_TOP_N, zt as runNpm } from "./child-cap-dispatch-C6IpRb4P.mjs";
+import { $ as CapRouteError, $n as EMPTY_CAP_ACTION_READING, $t as RUNNER_RSS_BUDGET_ENV, A as resolveHwAccel, An as OUTBOUND_QUEUE_SUSTAIN_MS, At as DeviceRegistry, B as udsChildLogToWorkerEntry, Bn as createSocketPlaneMeter, Bt as hostNodeIdOf, C as getBrokerEventBus, Cn as HEAP_SPACE_REPORT_MIN_MB, Ct as capActionName, D as subscribePassthrough, Dn as readHeapSpaces, Dt as parseCapAction, E as setNodeEventInterest, En as heapSpaceField, Et as capServiceName, F as ipcParentLink, Fn as createMeshQueueReader, Ft as resolveAddonClass, G as UDS_NO_ROUTE_PREFIX, Gn as EMPTY_SOCKET_DIRECTION, Gt as HEAP_WATCH_INTERVAL_MS, H as createUdsLoggerWithControl, Hn as diffSocketPlane, Ht as HEAP_RECLAIM_MIN_INTERVAL_MS, I as localProviderLink, In as formatMeshQueue, It as buildNpmChildEnv, J as answerClaimedGetStatus, Jn as sampleSocketDirection, Jt as HUB_MAIN_RSS_BUDGET_MB, K as afterWorkerOnlineAnnounce, Kn as createSocketDirectionCounters, Kt as HEAP_WATCH_WARN_RATIO, L as createParentUnownedCallHandler, Ln as EMPTY_SOCKET_PLANE_BASELINE, Lt as resolveNpmInvocation, M as brokerTransportLink, Mn as createOutboundQueueGate, Mt as CapabilityUnavailableError, N as buildLinkChain, Nn as formatOutboundQueueVerdict, Nt as copyBundledNativeModules, O as AddonDepsManager, On as selectReportedSpaces, Ot as deserializeTypedArrays, P as deviceCapResolverLink, Pn as MESH_QUEUE_TOP_N, Pt as installManifestNativeDeps, Q as CapRouteResolver, Qn as CAP_ACTION_UNLABELLED, Qt as RUNNER_HEAP_WATCH_INTERVAL_MS, R as createUdsEventBridge, Rn as SOCKET_PLANE_TOP_N, Rt as runNpm, S as clusterEventTopic, Sn as DECISIVE_HEAP_SPACES, St as NATIVE_PROVIDER_SERVICE_INFIX, T as registerEventBusService, Tn as formatHeapSpaces, Tt as capBareAction, U as LocalChildClient, Un as formatSocketPlane, Ut as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneReader, Vt as createAddonDataPlaneFacility, W as LocalChildRegistry, Wn as readSocketQueues, Wt as HEAP_RECLAIM_TRIGGER_MB, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionMessages, Xt as RSS_BUDGET_REANNOUNCE_MIN_MS, Y as deviceOfGetStatus, Yn as socketDirectionBytes, Yt as HUB_RSS_BUDGET_ENV, Z as AGENT_CAP_FWD_SERVICE, Zn as CAP_ACTION_OVERFLOW_LABEL, Zt as RSS_BUDGET_RELEASE_RATIO, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, a as reapProcessGroup, an as describeRss, ar as createEventPlaneMeter, at as getCapUsageRegistry, b as setHubConnected, bn as formatArrayBufferCensus, bt as createAddonService, c as runnerOwnsProcessGroup, cn as parseRssBudgetMb, cr as formatEventPlane, ct as UdsLocalTransportServer, d as summarizeMembers, dn as startHeapWatch, dt as localEndpointPath, en as ZERO_LOOP_DELAY, er as MAX_CAP_ACTIONS_PER_PEER, et as classifyCapRoute, f as installManifestSystemDeps, fn as startRunnerHeapWatch, ft as FrameDecoder, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ht as createBrokerDeviceManagerApi, in as createV8Reclaimer, ir as EVENT_PLANE_TOP_N, it as __resetCapUsageRegistryForTests, j as brokerCallForCap, jn as OUTBOUND_QUEUE_THRESHOLD_BYTES, jt as CapabilityHandle, k as createKernelHwAccel, kn as OUTBOUND_QUEUE_COOLDOWN_MS, kt as serializeTypedArrays, l as signalAllRunnerGroups, ln as reclaimIntervalMs, lt as SocketChannel, m as adaptBrokerToCluster, mn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, mt as buildNativeCapProxy, nn as createDeferredHeapWatchSink, nr as createCapActionCensus, nt as CapUsageRegistry, o as registerRunnerGroup, on as hubMainRssBudget, or as createEventPlaneReader, ot as createLocalTransport, p as installManifestPythonDeps, pn as strandedMb, pt as encodeFrame, q as GET_STATUS_METHOD, qn as recordSocketFrame, qt as HUB_MAIN_HEAP_WATCH_LABEL, r as defaultProcessGroupOps, rn as createLoopDelayMeter, rr as diffCapActionCensus, rt as PARENT_ROUTED_PROVIDER_ADDON_ID, s as releaseRunnerGroup, sn as nextRssBudgetState, sr as diffEventPlane, st as UdsLocalTransportClient, t as CAP_METHOD_NOT_IMPLEMENTED, tn as buildHeapSample, tr as capActionLabel, tt as callWithServiceDiscovery, un as shouldReclaim, ut as PeerAnsweredError, v as getOrInitReadinessRegistry, vn as createArrayBufferCensusGate, vt as mountNativeCapService, w as getMoleculerEventStats, wn as emitHeapDiagnosticReport, wt as capActionSuffix, x as EVENT_TOPIC_PREFIX, xn as isArrayBufferCensusReport, xt as validateProviderRegistrations, y as getOrInitReadinessRegistryForClient, yn as createInspectorArrayBufferCensus, z as createUdsEventBus, zn as SOCKET_QUEUE_TOP_N, zt as createAddonPeerBytesFacility } from "./child-cap-dispatch-DMx2axev.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";
@@ -403,6 +403,38 @@ function canServeDataPlane(state) {
 * headers + body), so `Content-Range`, backpressure and client-disconnect are all
 * native. No bytes are buffered; nothing crosses the cap channel.
 */
+/**
+* The upstream's response headers, minus the CORS policy, which belongs to the
+* EDGE (D707). The hub stamps its allowlist verdict on `clientRes` with
+* `setHeader` before hijacking, and Node merges those into `writeHead` — so an
+* upstream `access-control-*` header would OVERRIDE the hub's answer: the
+* authenticated file-server's `*` reached a refused origin this way. `Vary` is
+* merged rather than replaced, so the edge's `Origin` survives an upstream
+* `Accept-Encoding`.
+*/
+function edgeOwnedResponseHeaders(upRes, clientRes) {
+	const out = {};
+	for (const [name, value] of Object.entries(upRes.headers)) {
+		if (value === void 0) continue;
+		const lower = name.toLowerCase();
+		if (lower.startsWith("access-control-")) continue;
+		out[lower] = value;
+	}
+	const edgeVary = clientRes.getHeader("vary");
+	const upVary = out["vary"];
+	if (typeof edgeVary === "string" && edgeVary.length > 0 && upVary !== void 0) {
+		const tokens = /* @__PURE__ */ new Set();
+		const merged = [];
+		for (const part of [edgeVary, String(upVary)].join(",").split(",")) {
+			const token = part.trim();
+			if (token.length === 0 || tokens.has(token.toLowerCase())) continue;
+			tokens.add(token.toLowerCase());
+			merged.push(token);
+		}
+		out["vary"] = merged.join(", ");
+	}
+	return out;
+}
 /** Reverse-proxy one request to an addon data-plane listener. Fire-and-forget:
 *  the caller must `reply.hijack()` (or otherwise stop the framework from also
 *  responding) before calling this, since we drive `clientRes` directly. */
@@ -423,17 +455,11 @@ function proxyToUpstream(opts) {
 		path: upstreamPath,
 		headers
 	}, (upRes) => {
-		clientRes.writeHead(upRes.statusCode ?? 502, {
-			"access-control-allow-origin": "*",
-			...upRes.headers
-		});
+		clientRes.writeHead(upRes.statusCode ?? 502, edgeOwnedResponseHeaders(upRes, clientRes));
 		upRes.pipe(clientRes);
 	});
 	upstream.on("error", (err) => {
-		if (!clientRes.headersSent) clientRes.writeHead(502, {
-			"content-type": "application/json",
-			"access-control-allow-origin": "*"
-		});
+		if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "application/json" });
 		clientRes.end(JSON.stringify({
 			error: "data-plane upstream error",
 			detail: String(err)
@@ -3204,8 +3230,7 @@ async function copyDirRecursive(src, dest) {
 * `addons/` stays node_modules-free, which is what lets the backup tar the whole
 * folder with no exclusion list (see ADR-0027). An addon that genuinely needs an
 * un-bundleable runtime dep declares it explicitly in
-* `camstack.runtimeDependencies`; the debug escape hatch
-* `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy install-everything path.
+* `camstack.runtimeDependencies`.
 *
 * (Historically this mirrored the build preset's COMMON_NATIVE_DEPS and
 * per-addon-installed node-av/sharp/onnxruntime-node/ssh2/werift/systeminformation
@@ -3236,13 +3261,9 @@ function readRuntimeDependencies(pkg) {
 * `dependencies` so `--omit=peer` installs can't drop them (pipeline's
 * patched `werift`).
 *
-* Escape hatch: `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy behaviour
-* (strip only @camstack/*) for debugging a suspected undeclared runtime dep.
-*
 * Returns a new object (immutable).
 */
 function stripBundledDeps(pkg) {
-	if (process.env.CAMSTACK_INSTALL_FULL_DEPS === "1") return stripCamstackDeps(pkg);
 	const camstack = pkg.camstack;
 	if (camstack !== null && typeof camstack === "object" && !Array.isArray(camstack) && camstack.system === true) return stripCamstackDeps(pkg);
 	const keep = new Set([...RUNTIME_NATIVE_KEEP, ...readRuntimeDependencies(pkg)]);
@@ -7739,10 +7760,26 @@ function createDoorSettingsView(addonId, door, sections) {
 //#region src/kernel/config-schema.ts
 /** Default data directory — used when CAMSTACK_DATA env var is not set */
 var DEFAULT_DATA_PATH = "camstack-data";
+/**
+* A list of browser origins from config.yaml (a YAML list) or from the
+* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
+* only strings). Validation of each entry is the CORS policy's job
+* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
+* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
+*/
+var originListSchema = z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, z.array(z.string()));
 var serverSchema = z.object({
 	port: z.number().default(4443),
 	host: z.string().default("0.0.0.0"),
-	dataPath: z.string().default(DEFAULT_DATA_PATH)
+	dataPath: z.string().default(DEFAULT_DATA_PATH),
+	/**
+	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
+	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
+	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
+	* who may read hub responses in a browser is a security decision, and the
+	* policy is live from the first request, before the settings store exists.
+	*/
+	corsOrigins: originListSchema.default([])
 });
 var authSchema = z.object({
 	jwtSecret: z.string().nullable().default(null),
@@ -10207,7 +10244,8 @@ var ENV_VAR_MAP = {
 	CAMSTACK_DATA: "server.dataPath",
 	CAMSTACK_JWT_SECRET: "auth.jwtSecret",
 	CAMSTACK_ADMIN_USER: "auth.adminUsername",
-	CAMSTACK_ADMIN_PASS: "auth.adminPassword"
+	CAMSTACK_ADMIN_PASS: "auth.adminPassword",
+	CAMSTACK_CORS_ORIGINS: "server.corsOrigins"
 };
 /** config.yaml, env overrides applied, parsed. */
 function loadBootstrapConfig(configPath) {
@@ -94359,9 +94397,8 @@ function resolveUseHostname() {
 function createBroker(config) {
 	const { nodeID, mode, hubAddress, logLevel = "warn", secret, tcpPort = DEFAULT_HUB_TCP_PORT, udpPort = DEFAULT_UDP_PORT } = config;
 	const useHostname = resolveUseHostname();
-	const moleculerDebug = process.env["CAMSTACK_MOLECULER_DEBUG"] === "1" || process.env["CAMSTACK_MOLECULER_DEBUG"] === "true";
-	const infraLevel = moleculerDebug ? "debug" : "error";
-	const wildcardLevel = moleculerDebug ? "debug" : logLevel;
+	const infraLevel = "error";
+	const wildcardLevel = logLevel;
 	if (mode === "test") return new ServiceBroker({
 		nodeID,
 		transporter: "Fake",
@@ -94391,7 +94428,7 @@ function createBroker(config) {
 				udpDiscovery: true,
 				udpPort,
 				udpPeriod: 5,
-				debug: moleculerDebug
+				debug: false
 			}
 		},
 		logger: {
@@ -94411,7 +94448,7 @@ function createBroker(config) {
 		maxPacketSize: 10 * 1024 * 1024,
 		port: config.agentListenPort ?? deriveAgentListenPort(nodeID),
 		useHostname,
-		debug: moleculerDebug
+		debug: false
 	};
 	if (hubAddress) {
 		tcpOptions.urls = normalizeHubUrl(hubAddress, tcpPort);
@@ -95219,26 +95256,16 @@ var CrashSupervisor = class {
 *      restores the glibc/sharp defaults. Recoverable without a rebuild.
 *   2. A value the operator already put in the environment (`MALLOC_ARENA_MAX`,
 *      `VIPS_CONCURRENCY`) — inherited verbatim, never overwritten.
-*   3. `CAMSTACK_RUNNER_MALLOC_ARENA_MAX` — the CamStack override.
-*   4. The defaults above.
-*
-* A nonsense override falls back to the default rather than being passed through:
-* glibc reads `MALLOC_ARENA_MAX=0` as "unbounded", which is the very state this
-* exists to leave.
+*   3. The defaults above.
 */
 function runnerNativeAllocatorEnv(parentEnv, platform = process.platform) {
 	if (platform !== "linux") return {};
 	if (parentEnv["CAMSTACK_RUNNER_NATIVE_ALLOCATOR"] === "off") return {};
 	return {
-		MALLOC_ARENA_MAX: parentEnv["MALLOC_ARENA_MAX"] ?? String(positiveInt(parentEnv["CAMSTACK_RUNNER_MALLOC_ARENA_MAX"], 2)),
+		MALLOC_ARENA_MAX: parentEnv["MALLOC_ARENA_MAX"] ?? String(2),
 		VIPS_CONCURRENCY: parentEnv["VIPS_CONCURRENCY"] ?? String(1)
 	};
 }
-function positiveInt(raw, fallback) {
-	if (raw === void 0) return fallback;
-	const n = Number.parseInt(raw, 10);
-	return Number.isFinite(n) && n > 0 ? n : fallback;
-}
 /**
 * The child's environment, with the allocator pair applied or REMOVED.
 *
@@ -95447,6 +95474,8 @@ function isHeavyRunner(addons) {
 * Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
 */
 var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
+/** Light runners' young-generation semi-space, in MB. */
+var LIGHT_SEMI_SPACE_MB = 2;
 /**
 * The runner's old-space ceiling in MB, or 0 for "uncapped".
 *
@@ -95456,7 +95485,7 @@ var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
 * the cap for the whole runner, which is the intended escape hatch.
 */
 function runnerMaxOldSpaceMb(addons, heavy) {
-	const envDefault = heavy ? positiveIntEnv("CAMSTACK_RUNNER_HEAVY_MAX_OLD_MB", HEAVY_MAX_OLD_MB_DEFAULT) : positiveIntEnv("CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB", 0);
+	const envDefault = heavy ? HEAVY_MAX_OLD_MB_DEFAULT : 0;
 	const declared = addons.map((a) => readAddonHeapDeclaration(a).maxOldSpaceMb).filter((mb) => mb !== void 0);
 	if (declared.length === 0) return envDefault;
 	if (declared.includes(0)) return 0;
@@ -95483,38 +95512,25 @@ function runnerRssBudgetMb(addons) {
 * (`--max-semi-space-size`) to reclaim V8's over-reservation — a measured ~15 MB/runner win — bound
 * V8's platform thread pool (`--v8-pool-size`, see {@link LIGHT_V8_POOL_SIZE_DEFAULT}: a measured
 * ~58 threads across the hub's 29 light runners, against a cgroup `pids.max` this host has already
-* hit) and keep an opt-in old-space cap (`CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB`, unset = uncapped). HEAVY
+* hit) and carry no old-space cap unless a manifest declares one. HEAVY
 * runners keep V8's default young generation but ALWAYS carry an old-space ceiling; see
 * {@link HEAVY_MAX_OLD_MB_DEFAULT} for why, and how a runner declares its own.
 *
-* Kill-switch: `CAMSTACK_RUNNER_HEAP_TUNING=off` disables all flags (recover without a rebuild).
-* Overrides: `CAMSTACK_RUNNER_LIGHT_SEMI_SPACE_MB` (default 2),
-* `CAMSTACK_RUNNER_LIGHT_V8_POOL_SIZE` (default {@link LIGHT_V8_POOL_SIZE_DEFAULT}; below 1 omits
-* the flag — `0` means "size from the CPU count" to V8, not "off"),
-* `CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB`
-* (default unset = no old-space cap), `CAMSTACK_RUNNER_HEAVY_MAX_OLD_MB`
-* (default {@link HEAVY_MAX_OLD_MB_DEFAULT}; `0` restores the old uncapped behaviour).
+* The per-addon override is the manifest's declared `maxOldSpaceMb` (`0` = uncapped); the
+* environment overrides and the `CAMSTACK_RUNNER_HEAP_TUNING=off` kill switch were removed on
+* 2026-10-06 — nothing had set them since the rollout.
 */
 function runnerHeapFlags(addons) {
-	if (process.env["CAMSTACK_RUNNER_HEAP_TUNING"] === "off") return [];
 	const heavy = isHeavyRunner(addons);
 	const flags = [];
 	if (!heavy) {
-		const semiMb = positiveIntEnv("CAMSTACK_RUNNER_LIGHT_SEMI_SPACE_MB", 2);
-		if (semiMb > 0) flags.push(`--max-semi-space-size=${semiMb}`);
-		const v8Pool = positiveIntEnv("CAMSTACK_RUNNER_LIGHT_V8_POOL_SIZE", 2);
-		if (v8Pool > 0) flags.push(`--v8-pool-size=${v8Pool}`);
+		flags.push(`--max-semi-space-size=${LIGHT_SEMI_SPACE_MB}`);
+		flags.push(`--v8-pool-size=2`);
 	}
 	const oldMb = runnerMaxOldSpaceMb(addons, heavy);
 	if (oldMb > 0) flags.push(`--max-old-space-size=${oldMb}`);
 	return flags;
 }
-function positiveIntEnv(name, fallback) {
-	const raw = process.env[name];
-	if (raw === void 0) return fallback;
-	const n = Number.parseInt(raw, 10);
-	return Number.isFinite(n) && n >= 0 ? n : fallback;
-}
 var MAX_BACKOFF_MS = 3e4;
 var CRASH_WINDOW_MS = 6e4;
 var MAX_CRASHES_IN_WINDOW = 5;
@@ -96430,4 +96446,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/config-schema.d.ts

@@ -12,6 +12,7 @@ export declare const bootstrapSchema: z.ZodObject<{
         port: z.ZodDefault<z.ZodNumber>;
         host: z.ZodDefault<z.ZodString>;
         dataPath: z.ZodDefault<z.ZodString>;
+        corsOrigins: z.ZodDefault<z.ZodPreprocess<z.ZodArray<z.ZodString>>>;
     }, z.core.$strip>>;
     auth: z.ZodDefault<z.ZodObject<{
         jwtSecret: z.ZodDefault<z.ZodNullable<z.ZodString>>;