@camstack/system 1.2.356 → 1.2.357

package/dist/builtins/local-network/local-network.addon.d.ts

@@ -120,6 +120,13 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
     private resolvedHttpPort;
     private tlsDataDir;
     private snapshotTls;
+    /**
+     * Hot-swap the HTTPS listener onto the pair now on disk. A failure is not
+     * thrown — the files are already written and the status reports
+     * `restartRequired` from the served-vs-disk fingerprints — but it is logged:
+     * a certificate change that did not reach the listener must say so.
+     */
+    private putCertificateOnListener;
     /**
      * Bind or unbind the LAN HTTP sibling from the addon's own settings, and
      * keep the leaf SAN in sync with `localHostname`. This is the settings

package/dist/builtins/local-network/local-network.addon.js

@@ -1,9 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
 const require_dist = require("../../dist-CFVOy8VT.js");
-const require_tls = require("../../tls-ue_Xefmv.js");
-let node_fs_promises = require("node:fs/promises");
-let node_path = require("node:path");
+const require_tls = require("../../tls-CCMX7MjX.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
@@ -326,32 +324,30 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 				} });
 				return { success: true };
 			},
-			getTlsStatus: async () => this.snapshotTls(false),
+			getTlsStatus: async () => this.snapshotTls(),
 			regenerateCertificate: async (_input) => {
-				if (require_tls.readTlsMode(this.tlsDataDir()) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
 				const extraSans = [...require_tls.readExtraSans(this.tlsDataDir())];
-				await require_tls.reissueTlsLeaf(this.tlsDataDir(), { extraSans });
-				return this.snapshotTls(true);
+				await require_tls.regenerateCertificate(this.tlsDataDir(), { extraSans });
+				this.putCertificateOnListener("regenerate");
+				return this.snapshotTls();
 			},
 			uploadCertificate: async ({ certPem, keyPem, caPem }) => {
-				const valid = require_tls.validateUploadedTls(certPem, keyPem);
-				if (!valid.ok) throw new Error(valid.error);
-				const dir = (0, node_path.join)(this.tlsDataDir(), "tls");
-				await (0, node_fs_promises.mkdir)(dir, { recursive: true });
-				await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.crt"), certPem.endsWith("\n") ? certPem : `${certPem}\n`);
-				await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.key"), keyPem.endsWith("\n") ? keyPem : `${keyPem}\n`, { mode: 384 });
-				if (caPem && caPem.trim() !== "") await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack-ca.crt"), caPem.endsWith("\n") ? caPem : `${caPem}\n`);
-				require_tls.writeTlsMode(this.tlsDataDir(), "uploaded");
-				return this.snapshotTls(true);
+				await require_tls.storeUploadedCertificate(this.tlsDataDir(), {
+					certPem,
+					keyPem,
+					caPem
+				});
+				this.putCertificateOnListener("upload");
+				return this.snapshotTls();
 			},
 			downloadCa: async () => {
-				return { pem: this.snapshotTls(false).caCertPem ?? "" };
+				return { pem: this.snapshotTls().caCertPem ?? "" };
 			},
 			revertToGeneratedCertificate: async () => {
-				require_tls.writeTlsMode(this.tlsDataDir(), "generated");
 				const extraSans = [...require_tls.readExtraSans(this.tlsDataDir())];
-				await require_tls.ensureTlsCert(this.tlsDataDir(), { extraSans });
-				return this.snapshotTls(true);
+				await require_tls.revertToGeneratedCertificate(this.tlsDataDir(), { extraSans });
+				this.putCertificateOnListener("revert");
+				return this.snapshotTls();
 			}
 		};
 		this.lastSnapshotKey = snapshotKey(this.enumerate());
@@ -510,14 +506,35 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	tlsDataDir() {
 		return this.ctx.nodeDataDir ?? this.ctx.dataDir;
 	}
-	snapshotTls(restartRequired) {
-		const status = require_tls.readTlsAccessStatus(this.tlsDataDir(), restartRequired);
+	snapshotTls() {
+		const status = require_tls.readTlsAccessStatus(this.tlsDataDir(), require_tls.servedHttpsLeafFingerprint());
 		return {
 			...status,
 			sans: [...status.sans]
 		};
 	}
 	/**
+	* Hot-swap the HTTPS listener onto the pair now on disk. A failure is not
+	* thrown — the files are already written and the status reports
+	* `restartRequired` from the served-vs-disk fingerprints — but it is logged:
+	* a certificate change that did not reach the listener must say so.
+	*/
+	putCertificateOnListener(action) {
+		const outcome = require_tls.applyCertificateToListener(this.tlsDataDir());
+		if (outcome.kind === "reloaded") {
+			this.ctx.logger.info("local-network: HTTPS listener now serves the new certificate", { meta: {
+				action,
+				leafFingerprintSha256: outcome.servedLeafFingerprint
+			} });
+			return;
+		}
+		this.ctx.logger.warn("local-network: certificate changed on disk but NOT on the listener", { meta: {
+			action,
+			reason: outcome.kind,
+			...outcome.kind === "failed" ? { error: outcome.error } : {}
+		} });
+	}
+	/**
 	* Bind or unbind the LAN HTTP sibling from the addon's own settings, and
 	* keep the leaf SAN in sync with `localHostname`. This is the settings
 	* side-effect path — there is no second persist API.
@@ -536,7 +553,9 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		});
 		if (hostname !== "") {
 			require_tls.writeExtraSans(this.tlsDataDir(), [hostname]);
-			if (require_tls.readTlsMode(this.tlsDataDir()) === "generated") await require_tls.ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] });
+			if (require_tls.readTlsMode(this.tlsDataDir()) === "generated") {
+				if ((await require_tls.ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] })).generated) this.putCertificateOnListener("hostname");
+			}
 		} else require_tls.writeExtraSans(this.tlsDataDir(), []);
 	}
 	/**

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,7 +1,5 @@
 import { Cr as EventCategory, Qn as BaseAddon, Ut as localNetworkCapability, an as pickAppLinkHub, s as CAMSTACK_APP_LINK_ORIGIN } from "../../dist-B7WRgEZY.mjs";
-import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-DTlVWwAI.mjs";
-import { mkdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-CJHogwTl.mjs";
 import * as os from "node:os";
 import { readFileSync } from "node:fs";
 import { isIP } from "node:net";
@@ -323,32 +321,30 @@ var LocalNetworkAddon = class extends BaseAddon {
 				} });
 				return { success: true };
 			},
-			getTlsStatus: async () => this.snapshotTls(false),
+			getTlsStatus: async () => this.snapshotTls(),
 			regenerateCertificate: async (_input) => {
-				if (readTlsMode(this.tlsDataDir()) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
 				const extraSans = [...readExtraSans(this.tlsDataDir())];
-				await reissueTlsLeaf(this.tlsDataDir(), { extraSans });
-				return this.snapshotTls(true);
+				await regenerateCertificate(this.tlsDataDir(), { extraSans });
+				this.putCertificateOnListener("regenerate");
+				return this.snapshotTls();
 			},
 			uploadCertificate: async ({ certPem, keyPem, caPem }) => {
-				const valid = validateUploadedTls(certPem, keyPem);
-				if (!valid.ok) throw new Error(valid.error);
-				const dir = join(this.tlsDataDir(), "tls");
-				await mkdir(dir, { recursive: true });
-				await writeFile(join(dir, "camstack.crt"), certPem.endsWith("\n") ? certPem : `${certPem}\n`);
-				await writeFile(join(dir, "camstack.key"), keyPem.endsWith("\n") ? keyPem : `${keyPem}\n`, { mode: 384 });
-				if (caPem && caPem.trim() !== "") await writeFile(join(dir, "camstack-ca.crt"), caPem.endsWith("\n") ? caPem : `${caPem}\n`);
-				writeTlsMode(this.tlsDataDir(), "uploaded");
-				return this.snapshotTls(true);
+				await storeUploadedCertificate(this.tlsDataDir(), {
+					certPem,
+					keyPem,
+					caPem
+				});
+				this.putCertificateOnListener("upload");
+				return this.snapshotTls();
 			},
 			downloadCa: async () => {
-				return { pem: this.snapshotTls(false).caCertPem ?? "" };
+				return { pem: this.snapshotTls().caCertPem ?? "" };
 			},
 			revertToGeneratedCertificate: async () => {
-				writeTlsMode(this.tlsDataDir(), "generated");
 				const extraSans = [...readExtraSans(this.tlsDataDir())];
-				await ensureTlsCert(this.tlsDataDir(), { extraSans });
-				return this.snapshotTls(true);
+				await revertToGeneratedCertificate(this.tlsDataDir(), { extraSans });
+				this.putCertificateOnListener("revert");
+				return this.snapshotTls();
 			}
 		};
 		this.lastSnapshotKey = snapshotKey(this.enumerate());
@@ -507,14 +503,35 @@ var LocalNetworkAddon = class extends BaseAddon {
 	tlsDataDir() {
 		return this.ctx.nodeDataDir ?? this.ctx.dataDir;
 	}
-	snapshotTls(restartRequired) {
-		const status = readTlsAccessStatus(this.tlsDataDir(), restartRequired);
+	snapshotTls() {
+		const status = readTlsAccessStatus(this.tlsDataDir(), servedHttpsLeafFingerprint());
 		return {
 			...status,
 			sans: [...status.sans]
 		};
 	}
 	/**
+	* Hot-swap the HTTPS listener onto the pair now on disk. A failure is not
+	* thrown — the files are already written and the status reports
+	* `restartRequired` from the served-vs-disk fingerprints — but it is logged:
+	* a certificate change that did not reach the listener must say so.
+	*/
+	putCertificateOnListener(action) {
+		const outcome = applyCertificateToListener(this.tlsDataDir());
+		if (outcome.kind === "reloaded") {
+			this.ctx.logger.info("local-network: HTTPS listener now serves the new certificate", { meta: {
+				action,
+				leafFingerprintSha256: outcome.servedLeafFingerprint
+			} });
+			return;
+		}
+		this.ctx.logger.warn("local-network: certificate changed on disk but NOT on the listener", { meta: {
+			action,
+			reason: outcome.kind,
+			...outcome.kind === "failed" ? { error: outcome.error } : {}
+		} });
+	}
+	/**
 	* Bind or unbind the LAN HTTP sibling from the addon's own settings, and
 	* keep the leaf SAN in sync with `localHostname`. This is the settings
 	* side-effect path — there is no second persist API.
@@ -533,7 +550,9 @@ var LocalNetworkAddon = class extends BaseAddon {
 		});
 		if (hostname !== "") {
 			writeExtraSans(this.tlsDataDir(), [hostname]);
-			if (readTlsMode(this.tlsDataDir()) === "generated") await ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] });
+			if (readTlsMode(this.tlsDataDir()) === "generated") {
+				if ((await ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] })).generated) this.putCertificateOnListener("hostname");
+			}
 		} else writeExtraSans(this.tlsDataDir(), []);
 	}
 	/**

package/dist/index.js

@@ -30,7 +30,7 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-ey4mbofz.js");
-const require_tls$1 = require("./tls-ue_Xefmv.js");
+const require_tls$1 = require("./tls-CCMX7MjX.js");
 const require_child_cap_dispatch = require("./child-cap-dispatch-wbIQJctP.js");
 const require_resource_monitor = require("./resource-monitor-BgWGRxN5.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
@@ -7802,14 +7802,13 @@ var agentSchema = zod.z.object({
 	/** Port for the agent status page (minimal HTML) */
 	statusPort: zod.z.number().default(4444)
 });
-var tlsSchema = zod.z.object({
-	/** Enable HTTPS (default: true) */
-	enabled: zod.z.boolean().default(true),
-	/** Path to custom cert file (PEM). If not set, auto-generates self-signed. */
-	certPath: zod.z.string().optional(),
-	/** Path to custom key file (PEM). Required if certPath is set. */
-	keyPath: zod.z.string().optional()
-});
+var tlsSchema = zod.z.object({ 
+/**
+* Enable HTTPS (default: true). The certificate itself is never configured
+* here: the admin UI (Network → Local access) generates or uploads it
+* (D726), and boot serves whatever `tls/mode` says.
+*/
+enabled: zod.z.boolean().default(true) });
 /**
 * Bootstrap-time addon configuration — read PURELY from YAML, before the
 * kernel can talk to the settings-store. This breaks the chicken-and-egg
@@ -96609,6 +96608,7 @@ exports.TRADITIONAL_NATIVE_PACKAGES = TRADITIONAL_NATIVE_PACKAGES;
 exports.ToastService = ToastService;
 exports.UDS_NO_ROUTE_PREFIX = require_child_cap_dispatch.UDS_NO_ROUTE_PREFIX;
 exports.UNCLAIMED = UNCLAIMED;
+exports.UPLOADED_CA_FILE = require_tls$1.UPLOADED_CA_FILE;
 exports.UdsLocalTransportClient = require_child_cap_dispatch.UdsLocalTransportClient;
 exports.UdsLocalTransportServer = require_child_cap_dispatch.UdsLocalTransportServer;
 exports.UserManager = require_builtins_local_auth_local_auth_addon.UserManager;
@@ -96622,6 +96622,7 @@ exports.addonSettingsCapability = require_dist.addonSettingsCapability;
 exports.afterWorkerOnlineAnnounce = require_child_cap_dispatch.afterWorkerOnlineAnnounce;
 exports.allFamiliesListenHost = require_tls$1.allFamiliesListenHost;
 exports.answerClaimedGetStatus = require_child_cap_dispatch.answerClaimedGetStatus;
+exports.applyCertificateToListener = require_tls$1.applyCertificateToListener;
 exports.applyLanHttp = require_tls$1.applyLanHttp;
 exports.attributeStall = require_event_loop_stall_monitor.attributeStall;
 exports.bindPendingLanHttp = require_tls$1.bindPendingLanHttp;
@@ -96652,6 +96653,7 @@ exports.capBareAction = require_child_cap_dispatch.capBareAction;
 exports.capServiceName = require_child_cap_dispatch.capServiceName;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = require_child_cap_dispatch.classifyCapRoute;
+exports.clearHttpsListener = require_tls$1.clearHttpsListener;
 exports.clearPendingRestart = clearPendingRestart;
 exports.closeLanHttp = require_tls$1.closeLanHttp;
 exports.clusterEventTopic = require_child_cap_dispatch.clusterEventTopic;
@@ -96821,6 +96823,7 @@ exports.isModelDownloaded = require_event_loop_stall_monitor.isModelDownloaded;
 exports.isSettingsReadUnavailable = require_builtins_local_auth_local_auth_addon.isSettingsReadUnavailable;
 exports.isSourceNewer = isSourceNewer;
 exports.isolatedBuiltinPhase = isolatedBuiltinPhase;
+exports.leafFingerprintOf = require_tls$1.leafFingerprintOf;
 exports.loadTlsCert = require_tls$1.loadTlsCert;
 exports.localEndpointPath = require_child_cap_dispatch.localEndpointPath;
 exports.localProviderLink = require_child_cap_dispatch.localProviderLink;
@@ -96832,6 +96835,7 @@ exports.parseRangeHeader = require_event_loop_stall_monitor.parseRangeHeader;
 exports.parseRssBudgetMb = require_child_cap_dispatch.parseRssBudgetMb;
 exports.parseTokenizedUrl = require_event_loop_stall_monitor.parseTokenizedUrl;
 exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
+exports.prepareBootTls = require_tls$1.prepareBootTls;
 exports.proxyToUpstream = proxyToUpstream;
 exports.quarantineAddonResidue = quarantineAddonResidue;
 exports.readExtraSans = require_tls$1.readExtraSans;
@@ -96844,12 +96848,16 @@ exports.readTlsMode = require_tls$1.readTlsMode;
 exports.readinessKey = require_dist.readinessKey;
 exports.reclaimIntervalMs = require_child_cap_dispatch.reclaimIntervalMs;
 exports.recordSocketFrame = require_child_cap_dispatch.recordSocketFrame;
+exports.regenerateCertificate = require_tls$1.regenerateCertificate;
 exports.registerEventBusService = require_child_cap_dispatch.registerEventBusService;
+exports.registerHttpsListener = require_tls$1.registerHttpsListener;
 exports.registerLanHttpHandler = require_tls$1.registerLanHttpHandler;
 exports.reissueTlsLeaf = require_tls$1.reissueTlsLeaf;
+exports.reloadHttpsListener = require_tls$1.reloadHttpsListener;
 exports.resolveFilePath = require_event_loop_stall_monitor.resolveFilePath;
 exports.resolveHwAccel = require_child_cap_dispatch.resolveHwAccel;
 exports.resolveNpmInvocation = require_child_cap_dispatch.resolveNpmInvocation;
+exports.revertToGeneratedCertificate = require_tls$1.revertToGeneratedCertificate;
 exports.runHubAddonBoot = runHubAddonBoot;
 exports.runNpm = require_child_cap_dispatch.runNpm;
 exports.sampleSocketDirection = require_child_cap_dispatch.sampleSocketDirection;
@@ -96860,6 +96868,7 @@ exports.scopesAllowDeviceCap = require_dist.scopesAllowDeviceCap;
 exports.selectAddonResidue = selectAddonResidue;
 exports.selectReportedSpaces = require_child_cap_dispatch.selectReportedSpaces;
 exports.serializeTypedArrays = require_child_cap_dispatch.serializeTypedArrays;
+exports.servedHttpsLeafFingerprint = require_tls$1.servedHttpsLeafFingerprint;
 exports.setHubConnected = require_child_cap_dispatch.setHubConnected;
 exports.setNodeEventInterest = require_child_cap_dispatch.setNodeEventInterest;
 exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;
@@ -96867,10 +96876,12 @@ exports.shouldReclaim = require_child_cap_dispatch.shouldReclaim;
 exports.signalAllRunnerGroups = require_child_cap_dispatch.signalAllRunnerGroups;
 exports.socketDirectionBytes = require_child_cap_dispatch.socketDirectionBytes;
 exports.socketDirectionMessages = require_child_cap_dispatch.socketDirectionMessages;
+exports.splitPemCertificates = require_tls$1.splitPemCertificates;
 exports.startEventLoopStallMonitor = require_event_loop_stall_monitor.startEventLoopStallMonitor;
 exports.startHeapWatch = require_child_cap_dispatch.startHeapWatch;
 exports.startRunnerHeapWatch = require_child_cap_dispatch.startRunnerHeapWatch;
 exports.storeMayAnswer = storeMayAnswer;
+exports.storeUploadedCertificate = require_tls$1.storeUploadedCertificate;
 exports.strandedMb = require_child_cap_dispatch.strandedMb;
 exports.stripCamstackDeps = stripCamstackDeps;
 exports.subscribePassthrough = require_child_cap_dispatch.subscribePassthrough;

package/dist/index.mjs

@@ -29,7 +29,7 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as ensureModel, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, g as downloadModel, h as downloadFile, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as deleteModelFromDisk, n as STALL_TICK_MS, o as contentTypeFor, p as collectModelFiles, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as fetchJson, x as isModelDownloaded, y as getModelFilePath } from "./event-loop-stall-monitor-EXjzIxDz.mjs";
-import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DTlVWwAI.mjs";
+import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-CJHogwTl.mjs";
 import { $ as CapRouteError, $n as EMPTY_CAP_ACTION_READING, $t as RUNNER_RSS_BUDGET_ENV, A as resolveHwAccel, An as OUTBOUND_QUEUE_SUSTAIN_MS, At as DeviceRegistry, B as udsChildLogToWorkerEntry, Bn as createSocketPlaneMeter, Bt as hostNodeIdOf, C as getBrokerEventBus, Cn as HEAP_SPACE_REPORT_MIN_MB, Ct as capActionName, D as subscribePassthrough, Dn as readHeapSpaces, Dt as parseCapAction, E as setNodeEventInterest, En as heapSpaceField, Et as capServiceName, F as ipcParentLink, Fn as createMeshQueueReader, Ft as resolveAddonClass, G as UDS_NO_ROUTE_PREFIX, Gn as EMPTY_SOCKET_DIRECTION, Gt as HEAP_WATCH_INTERVAL_MS, H as createUdsLoggerWithControl, Hn as diffSocketPlane, Ht as HEAP_RECLAIM_MIN_INTERVAL_MS, I as localProviderLink, In as formatMeshQueue, It as buildNpmChildEnv, J as answerClaimedGetStatus, Jn as sampleSocketDirection, Jt as HUB_MAIN_RSS_BUDGET_MB, K as afterWorkerOnlineAnnounce, Kn as createSocketDirectionCounters, Kt as HEAP_WATCH_WARN_RATIO, L as createParentUnownedCallHandler, Ln as EMPTY_SOCKET_PLANE_BASELINE, Lt as resolveNpmInvocation, M as brokerTransportLink, Mn as createOutboundQueueGate, Mt as CapabilityUnavailableError, N as buildLinkChain, Nn as formatOutboundQueueVerdict, Nt as copyBundledNativeModules, O as AddonDepsManager, On as selectReportedSpaces, Ot as deserializeTypedArrays, P as deviceCapResolverLink, Pn as MESH_QUEUE_TOP_N, Pt as installManifestNativeDeps, Q as CapRouteResolver, Qn as CAP_ACTION_UNLABELLED, Qt as RUNNER_HEAP_WATCH_INTERVAL_MS, R as createUdsEventBridge, Rn as SOCKET_PLANE_TOP_N, Rt as runNpm, S as clusterEventTopic, Sn as DECISIVE_HEAP_SPACES, St as NATIVE_PROVIDER_SERVICE_INFIX, T as registerEventBusService, Tn as formatHeapSpaces, Tt as capBareAction, U as LocalChildClient, Un as formatSocketPlane, Ut as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneReader, Vt as createAddonDataPlaneFacility, W as LocalChildRegistry, Wn as readSocketQueues, Wt as HEAP_RECLAIM_TRIGGER_MB, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionMessages, Xt as RSS_BUDGET_REANNOUNCE_MIN_MS, Y as deviceOfGetStatus, Yn as socketDirectionBytes, Yt as HUB_RSS_BUDGET_ENV, Z as AGENT_CAP_FWD_SERVICE, Zn as CAP_ACTION_OVERFLOW_LABEL, Zt as RSS_BUDGET_RELEASE_RATIO, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, a as reapProcessGroup, an as describeRss, ar as createEventPlaneMeter, at as getCapUsageRegistry, b as setHubConnected, bn as formatArrayBufferCensus, bt as createAddonService, c as runnerOwnsProcessGroup, cn as parseRssBudgetMb, cr as formatEventPlane, ct as UdsLocalTransportServer, d as summarizeMembers, dn as startHeapWatch, dt as localEndpointPath, en as ZERO_LOOP_DELAY, er as MAX_CAP_ACTIONS_PER_PEER, et as classifyCapRoute, f as installManifestSystemDeps, fn as startRunnerHeapWatch, ft as FrameDecoder, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ht as createBrokerDeviceManagerApi, in as createV8Reclaimer, ir as EVENT_PLANE_TOP_N, it as __resetCapUsageRegistryForTests, j as brokerCallForCap, jn as OUTBOUND_QUEUE_THRESHOLD_BYTES, jt as CapabilityHandle, k as createKernelHwAccel, kn as OUTBOUND_QUEUE_COOLDOWN_MS, kt as serializeTypedArrays, l as signalAllRunnerGroups, ln as reclaimIntervalMs, lt as SocketChannel, m as adaptBrokerToCluster, mn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, mt as buildNativeCapProxy, nn as createDeferredHeapWatchSink, nr as createCapActionCensus, nt as CapUsageRegistry, o as registerRunnerGroup, on as hubMainRssBudget, or as createEventPlaneReader, ot as createLocalTransport, p as installManifestPythonDeps, pn as strandedMb, pt as encodeFrame, q as GET_STATUS_METHOD, qn as recordSocketFrame, qt as HUB_MAIN_HEAP_WATCH_LABEL, r as defaultProcessGroupOps, rn as createLoopDelayMeter, rr as diffCapActionCensus, rt as PARENT_ROUTED_PROVIDER_ADDON_ID, s as releaseRunnerGroup, sn as nextRssBudgetState, sr as diffEventPlane, st as UdsLocalTransportClient, t as CAP_METHOD_NOT_IMPLEMENTED, tn as buildHeapSample, tr as capActionLabel, tt as callWithServiceDiscovery, un as shouldReclaim, ut as PeerAnsweredError, v as getOrInitReadinessRegistry, vn as createArrayBufferCensusGate, vt as mountNativeCapService, w as getMoleculerEventStats, wn as emitHeapDiagnosticReport, wt as capActionSuffix, x as EVENT_TOPIC_PREFIX, xn as isArrayBufferCensusReport, xt as validateProviderRegistrations, y as getOrInitReadinessRegistryForClient, yn as createInspectorArrayBufferCensus, z as createUdsEventBus, zn as SOCKET_QUEUE_TOP_N, zt as createAddonPeerBytesFacility } from "./child-cap-dispatch-BcRHQBKW.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
@@ -7795,14 +7795,13 @@ var agentSchema = z.object({
 	/** Port for the agent status page (minimal HTML) */
 	statusPort: z.number().default(4444)
 });
-var tlsSchema = z.object({
-	/** Enable HTTPS (default: true) */
-	enabled: z.boolean().default(true),
-	/** Path to custom cert file (PEM). If not set, auto-generates self-signed. */
-	certPath: z.string().optional(),
-	/** Path to custom key file (PEM). Required if certPath is set. */
-	keyPath: z.string().optional()
-});
+var tlsSchema = z.object({ 
+/**
+* Enable HTTPS (default: true). The certificate itself is never configured
+* here: the admin UI (Network → Local access) generates or uploads it
+* (D726), and boot serves whatever `tls/mode` says.
+*/
+enabled: z.boolean().default(true) });
 /**
 * Bootstrap-time addon configuration — read PURELY from YAML, before the
 * kernel can talk to the settings-store. This breaks the chicken-and-egg
@@ -96446,4 +96445,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, leafFingerprintOf, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, resolveFilePath, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/config-schema.d.ts

@@ -29,8 +29,6 @@ export declare const bootstrapSchema: z.ZodObject<{
     }, z.core.$strip>>;
     tls: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
-        certPath: z.ZodOptional<z.ZodString>;
-        keyPath: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     bootstrap: z.ZodDefault<z.ZodObject<{
         settingsStoreAddon: z.ZodDefault<z.ZodString>;

package/dist/tls/boot-tls.d.ts

@@ -0,0 +1,29 @@
+import { CertOptions, EnsureTlsResult, TlsCertPair } from './cert-manager.js';
+/** The certificate source a booting listener serves. */
+export type BootTlsMode = 'generated' | 'uploaded';
+export interface BootTls {
+    readonly mode: BootTlsMode;
+    readonly pair: TlsCertPair;
+    /**
+     * The `ensureTlsCert` outcome — present only for a generated certificate,
+     * so a reissue reaches the operator as an alert. `undefined` when an
+     * uploaded certificate is served: the hub never evaluates, let alone
+     * reissues, a certificate the operator supplied.
+     */
+    readonly ensured: EnsureTlsResult | undefined;
+    /**
+     * True when the mode marker said `uploaded` but the files were gone, so
+     * the node fell back to its generated certificate. The caller logs it:
+     * a certificate source that changed under the operator is never silent.
+     */
+    readonly uploadedMissing: boolean;
+}
+/**
+ * Decide what the listener serves at boot. The admin UI (Network → Local
+ * access) is the only way to set a certificate (D726): it either leaves the
+ * hub on its generated local-CA leaf (D227) or uploads one, recorded by the
+ * `tls/mode` marker. An uploaded certificate is served verbatim — running it
+ * through `ensureTlsCert` would replace it on the first restart, because a
+ * leaf the local root did not issue is one of that rule's reissue triggers.
+ */
+export declare function prepareBootTls(dataDir: string, options?: CertOptions): Promise<BootTls>;

package/dist/tls/https-listener.d.ts

@@ -0,0 +1,30 @@
+import { Server as TlsServer } from 'node:tls';
+import { TlsCertPair } from './cert-manager.js';
+export type HttpsReloadOutcome = {
+    readonly kind: 'reloaded';
+    readonly servedLeafFingerprint: string;
+} | {
+    readonly kind: 'no-listener';
+} | {
+    readonly kind: 'failed';
+    readonly error: string;
+};
+/** SHA-256 fingerprint of the first certificate (the leaf) in a PEM chain. */
+export declare function leafFingerprintOf(chain: Buffer | string): string;
+/**
+ * Called once by the server after its HTTPS listener is up, with the pair it
+ * was started on. From here on a certificate action swaps the served
+ * certificate in place (`setSecureContext`) — new handshakes get the new
+ * leaf, open connections keep theirs, nothing restarts.
+ */
+export declare function registerHttpsListener(server: TlsServer, pair: TlsCertPair): void;
+/** Forget the listener — on shutdown, and between specs. */
+export declare function clearHttpsListener(): void;
+/**
+ * The leaf the HTTPS listener serves now, or `null` when this process has no
+ * registered listener (TLS off, or a process that does not own one) — in
+ * which case nobody can say, and `null` is the honest answer.
+ */
+export declare function servedHttpsLeafFingerprint(): string | null;
+/** Serve `pair` from now on. Never throws: the outcome says what happened. */
+export declare function reloadHttpsListener(pair: TlsCertPair): HttpsReloadOutcome;

package/dist/tls/index.d.ts

@@ -1,5 +1,8 @@
 export { CA_VALIDITY_DAYS, type CertEvaluationInput, LEAF_RENEWAL_WINDOW_DAYS, SERVER_AUTH_OID, } from './cert-evaluation.js';
 export { type CertIdentity, type CertOptions, type HostFacts, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair, } from './cert-manager.js';
+export { type BootTls, type BootTlsMode, prepareBootTls } from './boot-tls.js';
+export { clearHttpsListener, type HttpsReloadOutcome, leafFingerprintOf, registerHttpsListener, reloadHttpsListener, servedHttpsLeafFingerprint, } from './https-listener.js';
+export { applyCertificateToListener, regenerateCertificate, revertToGeneratedCertificate, storeUploadedCertificate, type UploadCertificateInput, } from './tls-actions.js';
 export { CA_COMMON_NAME } from './cert-issue.js';
 export { validateUploadedTls, type UploadedTlsValidation } from './uploaded-cert.js';
-export { type TlsAccessStatus, readTlsAccessStatus, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans, } from './tls-status.js';
+export { type TlsAccessStatus, readTlsAccessStatus, splitPemCertificates, UPLOADED_CA_FILE, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans, } from './tls-status.js';

package/dist/tls/tls-actions.d.ts

@@ -0,0 +1,29 @@
+import { CertOptions } from './cert-manager.js';
+import { HttpsReloadOutcome } from './https-listener.js';
+/**
+ * The certificate actions of Network → Local access (D726). Each one changes
+ * the files under `<dataDir>/tls` and then puts them on the listener, so the
+ * certificate the status reports is the certificate a client is served.
+ */
+export interface UploadCertificateInput {
+    readonly certPem: string;
+    readonly keyPem: string;
+    readonly caPem?: string | undefined;
+}
+/**
+ * Store an operator's certificate. The leaf (or chain) and key replace the
+ * served pair; a CA, when given, goes to its own file. The local CA
+ * (`camstack-ca.crt` + key) is never touched — it did not sign the upload,
+ * and it is what "Revert to generated" and every device that trusts it
+ * still need.
+ */
+export declare function storeUploadedCertificate(dataDir: string, input: UploadCertificateInput): Promise<void>;
+/** Issue a new generated leaf under the local CA. Refused while an upload is served. */
+export declare function regenerateCertificate(dataDir: string, options: CertOptions): Promise<void>;
+/** Drop the upload and serve the generated local-CA leaf again (D227). */
+export declare function revertToGeneratedCertificate(dataDir: string, options: CertOptions): Promise<void>;
+/**
+ * Put the pair on disk on the HTTPS listener. Called after every action, so
+ * "the certificate changed" and "clients see it" are the same moment.
+ */
+export declare function applyCertificateToListener(dataDir: string): HttpsReloadOutcome;

package/dist/tls/tls-status.d.ts

@@ -13,4 +13,15 @@ export declare function readTlsMode(dataDir: string): TlsMode;
 export declare function writeTlsMode(dataDir: string, mode: TlsMode): void;
 export declare function readExtraSans(dataDir: string): readonly string[];
 export declare function writeExtraSans(dataDir: string, sans: readonly string[]): void;
-export declare function readTlsAccessStatus(dataDir: string, restartRequired?: boolean): TlsAccessStatus;
+/** Where an upload's own CA is kept — never over the local CA's `camstack-ca.crt`. */
+export declare const UPLOADED_CA_FILE = "uploaded-ca.crt";
+/** Every certificate in a PEM bundle, in order. */
+export declare function splitPemCertificates(pem: string): readonly string[];
+/**
+ * What the node's certificate is, and whether the listener serves it.
+ * `servedLeafFingerprint` is the leaf the HTTPS listener presents right now
+ * (`servedHttpsLeafFingerprint()`), or `null` when unknown; a restart is
+ * required exactly when the listener serves a different leaf than the one
+ * on disk — a measured fact, not a flag a mutation remembered to set.
+ */
+export declare function readTlsAccessStatus(dataDir: string, servedLeafFingerprint: string | null): TlsAccessStatus;