@camstack/system 1.2.355 → 1.2.357

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BWicEEVA.js");
+const require_dist = require("../../dist-CFVOy8VT.js");
 const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as EventCategory, Qn as BaseAddon, Zn as errMsg, Zt as metricsProviderCapability, cr as createEvent, fn as resolveBucketMs, jt as foldSnapshotByFunction, un as reducePoints } from "../../dist-OCi0K-iM.mjs";
+import { Cr as EventCategory, Qn as BaseAddon, Zn as errMsg, Zt as metricsProviderCapability, cr as createEvent, fn as resolveBucketMs, jt as foldSnapshotByFunction, un as reducePoints } from "../../dist-B7WRgEZY.mjs";
 import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BWicEEVA.js");
+const require_dist = require("../../dist-CFVOy8VT.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Cr as EventCategory, Qn as BaseAddon, St as enumerateInferenceDevices, Zn as errMsg, bn as scoreRuntimes, sn as platformProbeCapability, ur as emitReadiness } from "../../dist-OCi0K-iM.mjs";
+import { Cr as EventCategory, Qn as BaseAddon, St as enumerateInferenceDevices, Zn as errMsg, bn as scoreRuntimes, sn as platformProbeCapability, ur as emitReadiness } from "../../dist-B7WRgEZY.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BWicEEVA.js");
+const require_dist = require("../../dist-CFVOy8VT.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as EventCategory, Qn as BaseAddon } from "../../dist-OCi0K-iM.mjs";
+import { Cr as EventCategory, Qn as BaseAddon } from "../../dist-B7WRgEZY.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BWicEEVA.js");
+const require_dist = require("../../dist-CFVOy8VT.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Cn as snapshotCapability, Cr as EventCategory, Jn as DeviceFeature, Qn as BaseAddon, X as batteryCapability, Xn as DeviceType, Xt as memoizePinnedFfmpeg, Y as bareAddonId, Zn as errMsg, a as BatteryStatusSchema, gt as deriveBatteryPresence, hr as nodePin, kn as streamQualityLabel } from "../../dist-OCi0K-iM.mjs";
+import { Cn as snapshotCapability, Cr as EventCategory, Jn as DeviceFeature, Qn as BaseAddon, X as batteryCapability, Xn as DeviceType, Xt as memoizePinnedFfmpeg, Y as bareAddonId, Zn as errMsg, a as BatteryStatusSchema, gt as deriveBatteryPresence, hr as nodePin, kn as streamQualityLabel } from "../../dist-B7WRgEZY.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BWicEEVA.js");
+const require_dist = require("../../dist-CFVOy8VT.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { At as filesystemBrowseCapability, Dn as storageProviderCapability, Qn as BaseAddon } from "../../dist-OCi0K-iM.mjs";
+import { At as filesystemBrowseCapability, Dn as storageProviderCapability, Qn as BaseAddon } from "../../dist-B7WRgEZY.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BWicEEVA.js");
+const require_dist = require("../../dist-CFVOy8VT.js");
 const require_hub_cap_forward = require("../../hub-cap-forward-DmHNjbB0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { B as StorageLocationTypeSchema, Cr as EventCategory, E as LegacyStorageLocationDefaultSchema, Et as evictionPolicyOfLocation, Fn as withLocationMode, It as isLocationEnabled, Jt as mayReadLocation, M as REDACTED_SECRET, Nt as gbToBytes, Qn as BaseAddon, Qt as modeMayWrite, R as StorageCleanupJobSchema, Tn as storageMigrationCapability, V as StorageMigrationJobSchema, Vt as legacyModeOf, Yt as mayWriteToLocation, gr as parseJsonObject, hn as resolveLocationMode, tt as collectSecretConfigKeys, wn as storageCapability, xn as settingsStoreCapability, z as StorageLocationModeSchema } from "../../dist-OCi0K-iM.mjs";
+import { B as StorageLocationTypeSchema, Cr as EventCategory, E as LegacyStorageLocationDefaultSchema, Et as evictionPolicyOfLocation, Fn as withLocationMode, It as isLocationEnabled, Jt as mayReadLocation, M as REDACTED_SECRET, Nt as gbToBytes, Qn as BaseAddon, Qt as modeMayWrite, R as StorageCleanupJobSchema, Tn as storageMigrationCapability, V as StorageMigrationJobSchema, Vt as legacyModeOf, Yt as mayWriteToLocation, gr as parseJsonObject, hn as resolveLocationMode, tt as collectSecretConfigKeys, wn as storageCapability, xn as settingsStoreCapability, z as StorageLocationModeSchema } from "../../dist-B7WRgEZY.mjs";
 import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-BdT320dq.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BWicEEVA.js");
+const require_dist = require("../../dist-CFVOy8VT.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Qn as BaseAddon, Zn as errMsg, fr as hydrateSchema } from "../../dist-OCi0K-iM.mjs";
+import { Qn as BaseAddon, Zn as errMsg, fr as hydrateSchema } from "../../dist-B7WRgEZY.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BWicEEVA.js");
+const require_dist = require("../../dist-CFVOy8VT.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Gt as logDestinationCapability, Qn as BaseAddon } from "../../dist-OCi0K-iM.mjs";
+import { Gt as logDestinationCapability, Qn as BaseAddon } from "../../dist-B7WRgEZY.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{child-cap-dispatch-DMx2axev.mjs → child-cap-dispatch-BcRHQBKW.mjs}

@@ -1,4 +1,4 @@
-import { Cr as EventCategory$1, cr as createEvent } from "./dist-OCi0K-iM.mjs";
+import { Cr as EventCategory$1, cr as createEvent } from "./dist-B7WRgEZY.mjs";
 import { a as parseProcStat, i as nodeProcReader } from "./proc-stat-CbC55Kqi.mjs";
 import "./hub-cap-forward-BdT320dq.mjs";
 import * as crypto$1 from "node:crypto";

package/dist/{child-cap-dispatch-CqV-7-QZ.js → child-cap-dispatch-wbIQJctP.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BWicEEVA.js");
+const require_dist = require("./dist-CFVOy8VT.js");
 const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
 require("./hub-cap-forward-DmHNjbB0.js");
 let node_crypto = require("node:crypto");

package/dist/{composition-sources-Dpl1G0Gr.mjs → composition-sources-BBfqepyT.mjs}

@@ -1,4 +1,4 @@
-import { Wn as compositionSourceKey, Zn as errMsg } from "./dist-OCi0K-iM.mjs";
+import { Wn as compositionSourceKey, Zn as errMsg } from "./dist-B7WRgEZY.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-Bk-MjK1D.js → composition-sources-CeO0K2cl.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BWicEEVA.js");
+const require_dist = require("./dist-CFVOy8VT.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{dist-OCi0K-iM.mjs → dist-B7WRgEZY.mjs}

@@ -20077,6 +20077,8 @@ var NcSystemEventKindSchema = z.enum([
 	"stream-offline",
 	"node-online",
 	"node-offline",
+	"node-restarting",
+	"node-updating",
 	"node-inference-unavailable",
 	"detection-blind",
 	"addon-crash-loop",
@@ -37146,7 +37148,8 @@ var MotionStatusSchema = z.object({
 	*   writes this slice (not even a boot seed), and neither does the runner's
 	*   phase machine: its phase is "a session is attached" for every on-motion
 	*   session, not motion, and it now has its own `DetectionPhaseTransition`.
-	*   A provider's `isDetected` answers from the hub's slice.
+	*   A provider's `isDetected` and `getStatus` answer from the hub's slice
+	*   (`hubMotionNativeProvider`).
 	* - **Sensors** (Home Assistant binary sensors, Homematic, Matter, Alexa
 	*   imports) — the provider pushes both edges itself, from the upstream
 	*   system's own state change. That is the sensor's own fact.
@@ -58665,6 +58668,8 @@ new Map(Object.entries({
 	"detection-blind": "device-events",
 	"node-online": "system",
 	"node-offline": "system",
+	"node-restarting": "system",
+	"node-updating": "system",
 	"node-inference-unavailable": "system",
 	"addon-crash-loop": "system",
 	"addon-update-available": "system",
@@ -58742,6 +58747,7 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 		kinds: [
 			"node-offline",
 			"node-online",
+			"node-restarting",
 			"node-inference-unavailable"
 		]
 	},
@@ -58763,6 +58769,7 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 		label: "Server & container updates",
 		kinds: [
 			"server-update-available",
+			"node-updating",
 			"server-updated",
 			"wrapper-update-available"
 		]
@@ -58910,6 +58917,7 @@ var STATE_SUMMARY_SECTION_VARS = [
 		kinds: [
 			"node-offline",
 			"node-online",
+			"node-restarting",
 			"node-inference-unavailable"
 		]
 	},
@@ -58931,6 +58939,7 @@ var STATE_SUMMARY_SECTION_VARS = [
 		example: "server 1.2.377 → 1.2.378",
 		kinds: [
 			"server-update-available",
+			"node-updating",
 			"server-updated",
 			"wrapper-update-available"
 		]

package/dist/{dist-BWicEEVA.js → dist-CFVOy8VT.js}

@@ -20077,6 +20077,8 @@ var NcSystemEventKindSchema = zod.z.enum([
 	"stream-offline",
 	"node-online",
 	"node-offline",
+	"node-restarting",
+	"node-updating",
 	"node-inference-unavailable",
 	"detection-blind",
 	"addon-crash-loop",
@@ -37146,7 +37148,8 @@ var MotionStatusSchema = zod.z.object({
 	*   writes this slice (not even a boot seed), and neither does the runner's
 	*   phase machine: its phase is "a session is attached" for every on-motion
 	*   session, not motion, and it now has its own `DetectionPhaseTransition`.
-	*   A provider's `isDetected` answers from the hub's slice.
+	*   A provider's `isDetected` and `getStatus` answer from the hub's slice
+	*   (`hubMotionNativeProvider`).
 	* - **Sensors** (Home Assistant binary sensors, Homematic, Matter, Alexa
 	*   imports) — the provider pushes both edges itself, from the upstream
 	*   system's own state change. That is the sensor's own fact.
@@ -58665,6 +58668,8 @@ new Map(Object.entries({
 	"detection-blind": "device-events",
 	"node-online": "system",
 	"node-offline": "system",
+	"node-restarting": "system",
+	"node-updating": "system",
 	"node-inference-unavailable": "system",
 	"addon-crash-loop": "system",
 	"addon-update-available": "system",
@@ -58742,6 +58747,7 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 		kinds: [
 			"node-offline",
 			"node-online",
+			"node-restarting",
 			"node-inference-unavailable"
 		]
 	},
@@ -58763,6 +58769,7 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 		label: "Server & container updates",
 		kinds: [
 			"server-update-available",
+			"node-updating",
 			"server-updated",
 			"wrapper-update-available"
 		]
@@ -58910,6 +58917,7 @@ var STATE_SUMMARY_SECTION_VARS = [
 		kinds: [
 			"node-offline",
 			"node-online",
+			"node-restarting",
 			"node-inference-unavailable"
 		]
 	},
@@ -58931,6 +58939,7 @@ var STATE_SUMMARY_SECTION_VARS = [
 		example: "server 1.2.377 → 1.2.378",
 		kinds: [
 			"server-update-available",
+			"node-updating",
 			"server-updated",
 			"wrapper-update-available"
 		]

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BWicEEVA.js");
+const require_dist = require("./dist-CFVOy8VT.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -30,8 +30,8 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-ey4mbofz.js");
-const require_tls$1 = require("./tls-ue_Xefmv.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-CqV-7-QZ.js");
+const require_tls$1 = require("./tls-CCMX7MjX.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-wbIQJctP.js");
 const require_resource_monitor = require("./resource-monitor-BgWGRxN5.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");
@@ -7802,14 +7802,13 @@ var agentSchema = zod.z.object({
 	/** Port for the agent status page (minimal HTML) */
 	statusPort: zod.z.number().default(4444)
 });
-var tlsSchema = zod.z.object({
-	/** Enable HTTPS (default: true) */
-	enabled: zod.z.boolean().default(true),
-	/** Path to custom cert file (PEM). If not set, auto-generates self-signed. */
-	certPath: zod.z.string().optional(),
-	/** Path to custom key file (PEM). Required if certPath is set. */
-	keyPath: zod.z.string().optional()
-});
+var tlsSchema = zod.z.object({ 
+/**
+* Enable HTTPS (default: true). The certificate itself is never configured
+* here: the admin UI (Network → Local access) generates or uploads it
+* (D726), and boot serves whatever `tls/mode` says.
+*/
+enabled: zod.z.boolean().default(true) });
 /**
 * Bootstrap-time addon configuration — read PURELY from YAML, before the
 * kernel can talk to the settings-store. This breaks the chicken-and-egg
@@ -96609,6 +96608,7 @@ exports.TRADITIONAL_NATIVE_PACKAGES = TRADITIONAL_NATIVE_PACKAGES;
 exports.ToastService = ToastService;
 exports.UDS_NO_ROUTE_PREFIX = require_child_cap_dispatch.UDS_NO_ROUTE_PREFIX;
 exports.UNCLAIMED = UNCLAIMED;
+exports.UPLOADED_CA_FILE = require_tls$1.UPLOADED_CA_FILE;
 exports.UdsLocalTransportClient = require_child_cap_dispatch.UdsLocalTransportClient;
 exports.UdsLocalTransportServer = require_child_cap_dispatch.UdsLocalTransportServer;
 exports.UserManager = require_builtins_local_auth_local_auth_addon.UserManager;
@@ -96622,6 +96622,7 @@ exports.addonSettingsCapability = require_dist.addonSettingsCapability;
 exports.afterWorkerOnlineAnnounce = require_child_cap_dispatch.afterWorkerOnlineAnnounce;
 exports.allFamiliesListenHost = require_tls$1.allFamiliesListenHost;
 exports.answerClaimedGetStatus = require_child_cap_dispatch.answerClaimedGetStatus;
+exports.applyCertificateToListener = require_tls$1.applyCertificateToListener;
 exports.applyLanHttp = require_tls$1.applyLanHttp;
 exports.attributeStall = require_event_loop_stall_monitor.attributeStall;
 exports.bindPendingLanHttp = require_tls$1.bindPendingLanHttp;
@@ -96652,6 +96653,7 @@ exports.capBareAction = require_child_cap_dispatch.capBareAction;
 exports.capServiceName = require_child_cap_dispatch.capServiceName;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = require_child_cap_dispatch.classifyCapRoute;
+exports.clearHttpsListener = require_tls$1.clearHttpsListener;
 exports.clearPendingRestart = clearPendingRestart;
 exports.closeLanHttp = require_tls$1.closeLanHttp;
 exports.clusterEventTopic = require_child_cap_dispatch.clusterEventTopic;
@@ -96821,6 +96823,7 @@ exports.isModelDownloaded = require_event_loop_stall_monitor.isModelDownloaded;
 exports.isSettingsReadUnavailable = require_builtins_local_auth_local_auth_addon.isSettingsReadUnavailable;
 exports.isSourceNewer = isSourceNewer;
 exports.isolatedBuiltinPhase = isolatedBuiltinPhase;
+exports.leafFingerprintOf = require_tls$1.leafFingerprintOf;
 exports.loadTlsCert = require_tls$1.loadTlsCert;
 exports.localEndpointPath = require_child_cap_dispatch.localEndpointPath;
 exports.localProviderLink = require_child_cap_dispatch.localProviderLink;
@@ -96832,6 +96835,7 @@ exports.parseRangeHeader = require_event_loop_stall_monitor.parseRangeHeader;
 exports.parseRssBudgetMb = require_child_cap_dispatch.parseRssBudgetMb;
 exports.parseTokenizedUrl = require_event_loop_stall_monitor.parseTokenizedUrl;
 exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
+exports.prepareBootTls = require_tls$1.prepareBootTls;
 exports.proxyToUpstream = proxyToUpstream;
 exports.quarantineAddonResidue = quarantineAddonResidue;
 exports.readExtraSans = require_tls$1.readExtraSans;
@@ -96844,12 +96848,16 @@ exports.readTlsMode = require_tls$1.readTlsMode;
 exports.readinessKey = require_dist.readinessKey;
 exports.reclaimIntervalMs = require_child_cap_dispatch.reclaimIntervalMs;
 exports.recordSocketFrame = require_child_cap_dispatch.recordSocketFrame;
+exports.regenerateCertificate = require_tls$1.regenerateCertificate;
 exports.registerEventBusService = require_child_cap_dispatch.registerEventBusService;
+exports.registerHttpsListener = require_tls$1.registerHttpsListener;
 exports.registerLanHttpHandler = require_tls$1.registerLanHttpHandler;
 exports.reissueTlsLeaf = require_tls$1.reissueTlsLeaf;
+exports.reloadHttpsListener = require_tls$1.reloadHttpsListener;
 exports.resolveFilePath = require_event_loop_stall_monitor.resolveFilePath;
 exports.resolveHwAccel = require_child_cap_dispatch.resolveHwAccel;
 exports.resolveNpmInvocation = require_child_cap_dispatch.resolveNpmInvocation;
+exports.revertToGeneratedCertificate = require_tls$1.revertToGeneratedCertificate;
 exports.runHubAddonBoot = runHubAddonBoot;
 exports.runNpm = require_child_cap_dispatch.runNpm;
 exports.sampleSocketDirection = require_child_cap_dispatch.sampleSocketDirection;
@@ -96860,6 +96868,7 @@ exports.scopesAllowDeviceCap = require_dist.scopesAllowDeviceCap;
 exports.selectAddonResidue = selectAddonResidue;
 exports.selectReportedSpaces = require_child_cap_dispatch.selectReportedSpaces;
 exports.serializeTypedArrays = require_child_cap_dispatch.serializeTypedArrays;
+exports.servedHttpsLeafFingerprint = require_tls$1.servedHttpsLeafFingerprint;
 exports.setHubConnected = require_child_cap_dispatch.setHubConnected;
 exports.setNodeEventInterest = require_child_cap_dispatch.setNodeEventInterest;
 exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;
@@ -96867,10 +96876,12 @@ exports.shouldReclaim = require_child_cap_dispatch.shouldReclaim;
 exports.signalAllRunnerGroups = require_child_cap_dispatch.signalAllRunnerGroups;
 exports.socketDirectionBytes = require_child_cap_dispatch.socketDirectionBytes;
 exports.socketDirectionMessages = require_child_cap_dispatch.socketDirectionMessages;
+exports.splitPemCertificates = require_tls$1.splitPemCertificates;
 exports.startEventLoopStallMonitor = require_event_loop_stall_monitor.startEventLoopStallMonitor;
 exports.startHeapWatch = require_child_cap_dispatch.startHeapWatch;
 exports.startRunnerHeapWatch = require_child_cap_dispatch.startRunnerHeapWatch;
 exports.storeMayAnswer = storeMayAnswer;
+exports.storeUploadedCertificate = require_tls$1.storeUploadedCertificate;
 exports.strandedMb = require_child_cap_dispatch.strandedMb;
 exports.stripCamstackDeps = stripCamstackDeps;
 exports.subscribePassthrough = require_child_cap_dispatch.subscribePassthrough;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $n as DATAPLANE_SECRET_HEADER$1, Cr as EventCategory$1, Ft as isCollectionArrayMethod, Ht as lifecycleJobSchema, Kt as logLevelAtMost, Lt as isObjectInput, N as RUNTIME_DEFAULTS, O as METHOD_ACCESS_MAP, Pt as isArrayOutputSchema, Rt as isVoidInput, T as LOG_LEVEL_RANK, W as addonSettingsCapability, Zn as errMsg$1, _r as parseJsonUnknown, ar as asJsonObject$1, br as scopeKey, cn as procedureAuthKey, cr as createEvent, dr as expandCapMethods, er as DEVICE_SETTINGS_CONTRIBUTION_METHODS, gn as resolveMethodAuth, gr as parseJsonObject, kt as extractNestedAddonId, lr as emitDownForOwnedCaps, nn as objectInputDeclaresAddonId, nr as ReadinessRegistry, or as asNumber, qt as looseSchema, rn as objectInputDeclaresRequiredDeviceId, rr as ReadinessTimeoutError, sr as asString$1, t as ALL_CAPABILITY_DEFINITIONS, tr as DEVICE_STATUS_METHOD, vn as scopesAllowAddon, vr as readinessKey, yn as scopesAllowDeviceCap, yr as resolveCapMount, zt as kebabToCamel } from "./dist-OCi0K-iM.mjs";
+import { $n as DATAPLANE_SECRET_HEADER$1, Cr as EventCategory$1, Ft as isCollectionArrayMethod, Ht as lifecycleJobSchema, Kt as logLevelAtMost, Lt as isObjectInput, N as RUNTIME_DEFAULTS, O as METHOD_ACCESS_MAP, Pt as isArrayOutputSchema, Rt as isVoidInput, T as LOG_LEVEL_RANK, W as addonSettingsCapability, Zn as errMsg$1, _r as parseJsonUnknown, ar as asJsonObject$1, br as scopeKey, cn as procedureAuthKey, cr as createEvent, dr as expandCapMethods, er as DEVICE_SETTINGS_CONTRIBUTION_METHODS, gn as resolveMethodAuth, gr as parseJsonObject, kt as extractNestedAddonId, lr as emitDownForOwnedCaps, nn as objectInputDeclaresAddonId, nr as ReadinessRegistry, or as asNumber, qt as looseSchema, rn as objectInputDeclaresRequiredDeviceId, rr as ReadinessTimeoutError, sr as asString$1, t as ALL_CAPABILITY_DEFINITIONS, tr as DEVICE_STATUS_METHOD, vn as scopesAllowAddon, vr as readinessKey, yn as scopesAllowDeviceCap, yr as resolveCapMount, zt as kebabToCamel } from "./dist-B7WRgEZY.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -29,8 +29,8 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as ensureModel, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, g as downloadModel, h as downloadFile, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as deleteModelFromDisk, n as STALL_TICK_MS, o as contentTypeFor, p as collectModelFiles, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as fetchJson, x as isModelDownloaded, y as getModelFilePath } from "./event-loop-stall-monitor-EXjzIxDz.mjs";
-import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DTlVWwAI.mjs";
-import { $ as CapRouteError, $n as EMPTY_CAP_ACTION_READING, $t as RUNNER_RSS_BUDGET_ENV, A as resolveHwAccel, An as OUTBOUND_QUEUE_SUSTAIN_MS, At as DeviceRegistry, B as udsChildLogToWorkerEntry, Bn as createSocketPlaneMeter, Bt as hostNodeIdOf, C as getBrokerEventBus, Cn as HEAP_SPACE_REPORT_MIN_MB, Ct as capActionName, D as subscribePassthrough, Dn as readHeapSpaces, Dt as parseCapAction, E as setNodeEventInterest, En as heapSpaceField, Et as capServiceName, F as ipcParentLink, Fn as createMeshQueueReader, Ft as resolveAddonClass, G as UDS_NO_ROUTE_PREFIX, Gn as EMPTY_SOCKET_DIRECTION, Gt as HEAP_WATCH_INTERVAL_MS, H as createUdsLoggerWithControl, Hn as diffSocketPlane, Ht as HEAP_RECLAIM_MIN_INTERVAL_MS, I as localProviderLink, In as formatMeshQueue, It as buildNpmChildEnv, J as answerClaimedGetStatus, Jn as sampleSocketDirection, Jt as HUB_MAIN_RSS_BUDGET_MB, K as afterWorkerOnlineAnnounce, Kn as createSocketDirectionCounters, Kt as HEAP_WATCH_WARN_RATIO, L as createParentUnownedCallHandler, Ln as EMPTY_SOCKET_PLANE_BASELINE, Lt as resolveNpmInvocation, M as brokerTransportLink, Mn as createOutboundQueueGate, Mt as CapabilityUnavailableError, N as buildLinkChain, Nn as formatOutboundQueueVerdict, Nt as copyBundledNativeModules, O as AddonDepsManager, On as selectReportedSpaces, Ot as deserializeTypedArrays, P as deviceCapResolverLink, Pn as MESH_QUEUE_TOP_N, Pt as installManifestNativeDeps, Q as CapRouteResolver, Qn as CAP_ACTION_UNLABELLED, Qt as RUNNER_HEAP_WATCH_INTERVAL_MS, R as createUdsEventBridge, Rn as SOCKET_PLANE_TOP_N, Rt as runNpm, S as clusterEventTopic, Sn as DECISIVE_HEAP_SPACES, St as NATIVE_PROVIDER_SERVICE_INFIX, T as registerEventBusService, Tn as formatHeapSpaces, Tt as capBareAction, U as LocalChildClient, Un as formatSocketPlane, Ut as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneReader, Vt as createAddonDataPlaneFacility, W as LocalChildRegistry, Wn as readSocketQueues, Wt as HEAP_RECLAIM_TRIGGER_MB, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionMessages, Xt as RSS_BUDGET_REANNOUNCE_MIN_MS, Y as deviceOfGetStatus, Yn as socketDirectionBytes, Yt as HUB_RSS_BUDGET_ENV, Z as AGENT_CAP_FWD_SERVICE, Zn as CAP_ACTION_OVERFLOW_LABEL, Zt as RSS_BUDGET_RELEASE_RATIO, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, a as reapProcessGroup, an as describeRss, ar as createEventPlaneMeter, at as getCapUsageRegistry, b as setHubConnected, bn as formatArrayBufferCensus, bt as createAddonService, c as runnerOwnsProcessGroup, cn as parseRssBudgetMb, cr as formatEventPlane, ct as UdsLocalTransportServer, d as summarizeMembers, dn as startHeapWatch, dt as localEndpointPath, en as ZERO_LOOP_DELAY, er as MAX_CAP_ACTIONS_PER_PEER, et as classifyCapRoute, f as installManifestSystemDeps, fn as startRunnerHeapWatch, ft as FrameDecoder, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ht as createBrokerDeviceManagerApi, in as createV8Reclaimer, ir as EVENT_PLANE_TOP_N, it as __resetCapUsageRegistryForTests, j as brokerCallForCap, jn as OUTBOUND_QUEUE_THRESHOLD_BYTES, jt as CapabilityHandle, k as createKernelHwAccel, kn as OUTBOUND_QUEUE_COOLDOWN_MS, kt as serializeTypedArrays, l as signalAllRunnerGroups, ln as reclaimIntervalMs, lt as SocketChannel, m as adaptBrokerToCluster, mn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, mt as buildNativeCapProxy, nn as createDeferredHeapWatchSink, nr as createCapActionCensus, nt as CapUsageRegistry, o as registerRunnerGroup, on as hubMainRssBudget, or as createEventPlaneReader, ot as createLocalTransport, p as installManifestPythonDeps, pn as strandedMb, pt as encodeFrame, q as GET_STATUS_METHOD, qn as recordSocketFrame, qt as HUB_MAIN_HEAP_WATCH_LABEL, r as defaultProcessGroupOps, rn as createLoopDelayMeter, rr as diffCapActionCensus, rt as PARENT_ROUTED_PROVIDER_ADDON_ID, s as releaseRunnerGroup, sn as nextRssBudgetState, sr as diffEventPlane, st as UdsLocalTransportClient, t as CAP_METHOD_NOT_IMPLEMENTED, tn as buildHeapSample, tr as capActionLabel, tt as callWithServiceDiscovery, un as shouldReclaim, ut as PeerAnsweredError, v as getOrInitReadinessRegistry, vn as createArrayBufferCensusGate, vt as mountNativeCapService, w as getMoleculerEventStats, wn as emitHeapDiagnosticReport, wt as capActionSuffix, x as EVENT_TOPIC_PREFIX, xn as isArrayBufferCensusReport, xt as validateProviderRegistrations, y as getOrInitReadinessRegistryForClient, yn as createInspectorArrayBufferCensus, z as createUdsEventBus, zn as SOCKET_QUEUE_TOP_N, zt as createAddonPeerBytesFacility } from "./child-cap-dispatch-DMx2axev.mjs";
+import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-CJHogwTl.mjs";
+import { $ as CapRouteError, $n as EMPTY_CAP_ACTION_READING, $t as RUNNER_RSS_BUDGET_ENV, A as resolveHwAccel, An as OUTBOUND_QUEUE_SUSTAIN_MS, At as DeviceRegistry, B as udsChildLogToWorkerEntry, Bn as createSocketPlaneMeter, Bt as hostNodeIdOf, C as getBrokerEventBus, Cn as HEAP_SPACE_REPORT_MIN_MB, Ct as capActionName, D as subscribePassthrough, Dn as readHeapSpaces, Dt as parseCapAction, E as setNodeEventInterest, En as heapSpaceField, Et as capServiceName, F as ipcParentLink, Fn as createMeshQueueReader, Ft as resolveAddonClass, G as UDS_NO_ROUTE_PREFIX, Gn as EMPTY_SOCKET_DIRECTION, Gt as HEAP_WATCH_INTERVAL_MS, H as createUdsLoggerWithControl, Hn as diffSocketPlane, Ht as HEAP_RECLAIM_MIN_INTERVAL_MS, I as localProviderLink, In as formatMeshQueue, It as buildNpmChildEnv, J as answerClaimedGetStatus, Jn as sampleSocketDirection, Jt as HUB_MAIN_RSS_BUDGET_MB, K as afterWorkerOnlineAnnounce, Kn as createSocketDirectionCounters, Kt as HEAP_WATCH_WARN_RATIO, L as createParentUnownedCallHandler, Ln as EMPTY_SOCKET_PLANE_BASELINE, Lt as resolveNpmInvocation, M as brokerTransportLink, Mn as createOutboundQueueGate, Mt as CapabilityUnavailableError, N as buildLinkChain, Nn as formatOutboundQueueVerdict, Nt as copyBundledNativeModules, O as AddonDepsManager, On as selectReportedSpaces, Ot as deserializeTypedArrays, P as deviceCapResolverLink, Pn as MESH_QUEUE_TOP_N, Pt as installManifestNativeDeps, Q as CapRouteResolver, Qn as CAP_ACTION_UNLABELLED, Qt as RUNNER_HEAP_WATCH_INTERVAL_MS, R as createUdsEventBridge, Rn as SOCKET_PLANE_TOP_N, Rt as runNpm, S as clusterEventTopic, Sn as DECISIVE_HEAP_SPACES, St as NATIVE_PROVIDER_SERVICE_INFIX, T as registerEventBusService, Tn as formatHeapSpaces, Tt as capBareAction, U as LocalChildClient, Un as formatSocketPlane, Ut as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneReader, Vt as createAddonDataPlaneFacility, W as LocalChildRegistry, Wn as readSocketQueues, Wt as HEAP_RECLAIM_TRIGGER_MB, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionMessages, Xt as RSS_BUDGET_REANNOUNCE_MIN_MS, Y as deviceOfGetStatus, Yn as socketDirectionBytes, Yt as HUB_RSS_BUDGET_ENV, Z as AGENT_CAP_FWD_SERVICE, Zn as CAP_ACTION_OVERFLOW_LABEL, Zt as RSS_BUDGET_RELEASE_RATIO, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, a as reapProcessGroup, an as describeRss, ar as createEventPlaneMeter, at as getCapUsageRegistry, b as setHubConnected, bn as formatArrayBufferCensus, bt as createAddonService, c as runnerOwnsProcessGroup, cn as parseRssBudgetMb, cr as formatEventPlane, ct as UdsLocalTransportServer, d as summarizeMembers, dn as startHeapWatch, dt as localEndpointPath, en as ZERO_LOOP_DELAY, er as MAX_CAP_ACTIONS_PER_PEER, et as classifyCapRoute, f as installManifestSystemDeps, fn as startRunnerHeapWatch, ft as FrameDecoder, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ht as createBrokerDeviceManagerApi, in as createV8Reclaimer, ir as EVENT_PLANE_TOP_N, it as __resetCapUsageRegistryForTests, j as brokerCallForCap, jn as OUTBOUND_QUEUE_THRESHOLD_BYTES, jt as CapabilityHandle, k as createKernelHwAccel, kn as OUTBOUND_QUEUE_COOLDOWN_MS, kt as serializeTypedArrays, l as signalAllRunnerGroups, ln as reclaimIntervalMs, lt as SocketChannel, m as adaptBrokerToCluster, mn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, mt as buildNativeCapProxy, nn as createDeferredHeapWatchSink, nr as createCapActionCensus, nt as CapUsageRegistry, o as registerRunnerGroup, on as hubMainRssBudget, or as createEventPlaneReader, ot as createLocalTransport, p as installManifestPythonDeps, pn as strandedMb, pt as encodeFrame, q as GET_STATUS_METHOD, qn as recordSocketFrame, qt as HUB_MAIN_HEAP_WATCH_LABEL, r as defaultProcessGroupOps, rn as createLoopDelayMeter, rr as diffCapActionCensus, rt as PARENT_ROUTED_PROVIDER_ADDON_ID, s as releaseRunnerGroup, sn as nextRssBudgetState, sr as diffEventPlane, st as UdsLocalTransportClient, t as CAP_METHOD_NOT_IMPLEMENTED, tn as buildHeapSample, tr as capActionLabel, tt as callWithServiceDiscovery, un as shouldReclaim, ut as PeerAnsweredError, v as getOrInitReadinessRegistry, vn as createArrayBufferCensusGate, vt as mountNativeCapService, w as getMoleculerEventStats, wn as emitHeapDiagnosticReport, wt as capActionSuffix, x as EVENT_TOPIC_PREFIX, xn as isArrayBufferCensusReport, xt as validateProviderRegistrations, y as getOrInitReadinessRegistryForClient, yn as createInspectorArrayBufferCensus, z as createUdsEventBus, zn as SOCKET_QUEUE_TOP_N, zt as createAddonPeerBytesFacility } from "./child-cap-dispatch-BcRHQBKW.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";
@@ -7795,14 +7795,13 @@ var agentSchema = z.object({
 	/** Port for the agent status page (minimal HTML) */
 	statusPort: z.number().default(4444)
 });
-var tlsSchema = z.object({
-	/** Enable HTTPS (default: true) */
-	enabled: z.boolean().default(true),
-	/** Path to custom cert file (PEM). If not set, auto-generates self-signed. */
-	certPath: z.string().optional(),
-	/** Path to custom key file (PEM). Required if certPath is set. */
-	keyPath: z.string().optional()
-});
+var tlsSchema = z.object({ 
+/**
+* Enable HTTPS (default: true). The certificate itself is never configured
+* here: the admin UI (Network → Local access) generates or uploads it
+* (D726), and boot serves whatever `tls/mode` says.
+*/
+enabled: z.boolean().default(true) });
 /**
 * Bootstrap-time addon configuration — read PURELY from YAML, before the
 * kernel can talk to the settings-store. This breaks the chicken-and-egg
@@ -96446,4 +96445,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, leafFingerprintOf, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, resolveFilePath, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/config-schema.d.ts

@@ -29,8 +29,6 @@ export declare const bootstrapSchema: z.ZodObject<{
     }, z.core.$strip>>;
     tls: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
-        certPath: z.ZodOptional<z.ZodString>;
-        keyPath: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     bootstrap: z.ZodDefault<z.ZodObject<{
         settingsStoreAddon: z.ZodDefault<z.ZodString>;

package/dist/{retired-settings-keys-DLJ7MvIB.js → retired-settings-keys-CRlTzxaS.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BWicEEVA.js");
+const require_dist = require("./dist-CFVOy8VT.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-TDzxE6GA.mjs → retired-settings-keys-DKRjfz0U.mjs}

@@ -1,4 +1,4 @@
-import { ar as asJsonObject } from "./dist-OCi0K-iM.mjs";
+import { ar as asJsonObject } from "./dist-B7WRgEZY.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/tls/boot-tls.d.ts

@@ -0,0 +1,29 @@
+import { CertOptions, EnsureTlsResult, TlsCertPair } from './cert-manager.js';
+/** The certificate source a booting listener serves. */
+export type BootTlsMode = 'generated' | 'uploaded';
+export interface BootTls {
+    readonly mode: BootTlsMode;
+    readonly pair: TlsCertPair;
+    /**
+     * The `ensureTlsCert` outcome — present only for a generated certificate,
+     * so a reissue reaches the operator as an alert. `undefined` when an
+     * uploaded certificate is served: the hub never evaluates, let alone
+     * reissues, a certificate the operator supplied.
+     */
+    readonly ensured: EnsureTlsResult | undefined;
+    /**
+     * True when the mode marker said `uploaded` but the files were gone, so
+     * the node fell back to its generated certificate. The caller logs it:
+     * a certificate source that changed under the operator is never silent.
+     */
+    readonly uploadedMissing: boolean;
+}
+/**
+ * Decide what the listener serves at boot. The admin UI (Network → Local
+ * access) is the only way to set a certificate (D726): it either leaves the
+ * hub on its generated local-CA leaf (D227) or uploads one, recorded by the
+ * `tls/mode` marker. An uploaded certificate is served verbatim — running it
+ * through `ensureTlsCert` would replace it on the first restart, because a
+ * leaf the local root did not issue is one of that rule's reissue triggers.
+ */
+export declare function prepareBootTls(dataDir: string, options?: CertOptions): Promise<BootTls>;

package/dist/tls/https-listener.d.ts

@@ -0,0 +1,30 @@
+import { Server as TlsServer } from 'node:tls';
+import { TlsCertPair } from './cert-manager.js';
+export type HttpsReloadOutcome = {
+    readonly kind: 'reloaded';
+    readonly servedLeafFingerprint: string;
+} | {
+    readonly kind: 'no-listener';
+} | {
+    readonly kind: 'failed';
+    readonly error: string;
+};
+/** SHA-256 fingerprint of the first certificate (the leaf) in a PEM chain. */
+export declare function leafFingerprintOf(chain: Buffer | string): string;
+/**
+ * Called once by the server after its HTTPS listener is up, with the pair it
+ * was started on. From here on a certificate action swaps the served
+ * certificate in place (`setSecureContext`) — new handshakes get the new
+ * leaf, open connections keep theirs, nothing restarts.
+ */
+export declare function registerHttpsListener(server: TlsServer, pair: TlsCertPair): void;
+/** Forget the listener — on shutdown, and between specs. */
+export declare function clearHttpsListener(): void;
+/**
+ * The leaf the HTTPS listener serves now, or `null` when this process has no
+ * registered listener (TLS off, or a process that does not own one) — in
+ * which case nobody can say, and `null` is the honest answer.
+ */
+export declare function servedHttpsLeafFingerprint(): string | null;
+/** Serve `pair` from now on. Never throws: the outcome says what happened. */
+export declare function reloadHttpsListener(pair: TlsCertPair): HttpsReloadOutcome;