@camstack/system 1.2.356 → 1.2.358

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,11 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { An as userManagementCapability, H as UserRecordSchema, L as ScopedTokenSchema, Qn as BaseAddon, q as authProviderCapability, r as ApiKeyRecordSchema } from "../../dist-B7WRgEZY.mjs";
+import { H as UserRecordSchema, L as ScopedTokenSchema, er as BaseAddon, jn as userManagementCapability, q as authProviderCapability, r as ApiKeyRecordSchema } from "../../dist-D3bhbMY3.mjs";
+import { z } from "zod";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
+import * as path$1 from "node:path";
+import * as fs from "node:fs";
 //#region src/auth/parse-record.ts
 function parseRecord(kind, schema, data) {
 	try {
@@ -6700,15 +6703,44 @@ var UserManager = class {
 			}
 		});
 	}
-	async ensureAdminExists() {
+	/**
+	* Seed the configured admin (`auth.adminUsername` / `auth.adminPassword`,
+	* i.e. `CAMSTACK_ADMIN_USER` / `CAMSTACK_ADMIN_PASS`) — on FIRST boot only.
+	*
+	* The configured password is a seed, never an authority. Once any admin
+	* exists, this never writes a password: the operator's own change in the
+	* admin UI is the truth from then on. This method used to compare the stored
+	* hash with the configured password on every boot and rewrite it when they
+	* differed, so a password changed in the UI went back to the configured one
+	* (`changeme` on a Mac hub and on any container without `CAMSTACK_ADMIN_PASS`)
+	* at the next restart.
+	*
+	* `resetPassword: true` is the one explicit exception — the operator's
+	* one-shot recovery request (see `admin-password-reset.ts`): the configured
+	* admin's password is set back to the configured one.
+	*/
+	async ensureAdminExists(options = {}) {
 		const adminUsername = this.config.get("auth.adminUsername");
 		const adminPassword = this.config.get("auth.adminPassword");
-		if (!adminUsername || !adminPassword) return;
+		if (!adminUsername || !adminPassword) return { kind: "not-configured" };
 		const existing = await this.findByUsername(adminUsername);
 		if (existing) {
-			if (!await this.auth.comparePassword(adminPassword, existing.passwordHash)) await this.resetPassword(existing.id, adminPassword);
-			return;
+			if (options.resetPassword === true) {
+				await this.resetPassword(existing.id, adminPassword);
+				return {
+					kind: "reset",
+					username: adminUsername
+				};
+			}
+			return {
+				kind: "exists",
+				username: adminUsername
+			};
 		}
+		if ((await this.listAll()).some((u) => u.isAdmin)) return {
+			kind: "other-admin-exists",
+			username: adminUsername
+		};
 		await this.create({
 			username: adminUsername,
 			password: adminPassword,
@@ -6716,6 +6748,19 @@ var UserManager = class {
 			allowedProviders: "*",
 			allowedDevices: {}
 		});
+		return {
+			kind: "seeded",
+			username: adminUsername
+		};
+	}
+	/**
+	* Does `username` still sign in with `password`? A hash comparison — the
+	* password is never logged or stored. `false` when the user does not exist.
+	*/
+	async hasPassword(username, password) {
+		const user = await this.findByUsername(username);
+		if (!user) return false;
+		return this.auth.comparePassword(password, user.passwordHash);
 	}
 }, i$2 = class extends Error {
 	constructor(e, t) {
@@ -7395,7 +7440,7 @@ function alphabet(letters) {
 /**
 * @__NO_SIDE_EFFECTS__
 */
-function join(separator = "") {
+function join$1(separator = "") {
 	astr("join", separator);
 	return {
 		encode: (from) => {
@@ -7505,7 +7550,7 @@ function unsafeWrapper(fn) {
 		} catch (e) {}
 	};
 }
-chain(radix2(4), alphabet("0123456789ABCDEF"), join(""));
+chain(radix2(4), alphabet("0123456789ABCDEF"), join$1(""));
 /**
 * base32 encoding from RFC 4648. Has padding.
 * RFC 4648 §6 Table 3 uses uppercase letters, and RFC 4648 §3.4 allows applications to choose
@@ -7520,17 +7565,17 @@ chain(radix2(4), alphabet("0123456789ABCDEF"), join(""));
 * // => Uint8Array.from([0x12, 0xab])
 * ```
 */
-var base32 = /* @__PURE__ */ Object.freeze(chain(radix2(5), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), padding(5), join("")));
-chain(radix2(5), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), join(""));
-chain(radix2(5), alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), padding(5), join(""));
-chain(radix2(5), alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), join(""));
-chain(radix2(5), alphabet("0123456789ABCDEFGHJKMNPQRSTVWXYZ"), join(""), normalize((s) => s.toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1")));
+var base32 = /* @__PURE__ */ Object.freeze(chain(radix2(5), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), padding(5), join$1("")));
+chain(radix2(5), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), join$1(""));
+chain(radix2(5), alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), padding(5), join$1(""));
+chain(radix2(5), alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), join$1(""));
+chain(radix2(5), alphabet("0123456789ABCDEFGHJKMNPQRSTVWXYZ"), join$1(""), normalize((s) => s.toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1")));
 var hasBase64Builtin = /* @__PURE__ */ (() => typeof Uint8Array.from([]).toBase64 === "function" && typeof Uint8Array.fromBase64 === "function")();
-hasBase64Builtin || chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), padding(6), join(""));
-chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), join(""));
-hasBase64Builtin || chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), padding(6), join(""));
-chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), join(""));
-var BECH_ALPHABET = chain(alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), join(""));
+hasBase64Builtin || chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), padding(6), join$1(""));
+chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), join$1(""));
+hasBase64Builtin || chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), padding(6), join$1(""));
+chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), join$1(""));
+var BECH_ALPHABET = chain(alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), join$1(""));
 var POLYMOD_GENERATORS = [
 	996825010,
 	642813549,
@@ -7624,7 +7669,7 @@ function genBech32(encoding) {
 }
 genBech32("bech32");
 genBech32("bech32m");
-/* @__PURE__ */ (() => typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function")() || chain(radix2(4), alphabet("0123456789abcdef"), join(""), normalize((s) => {
+/* @__PURE__ */ (() => typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function")() || chain(radix2(4), alphabet("0123456789abcdef"), join$1(""), normalize((s) => {
 	if (typeof s !== "string" || s.length % 2 !== 0) throw new TypeError(`hex.decode: expected string, got ${typeof s} with length ${s.length}`);
 	return s.toLowerCase();
 }));
@@ -9023,6 +9068,204 @@ var TotpManager = class {
 	}
 };
 //#endregion
+//#region src/kernel/config-schema.ts
+/** Default data directory — used when CAMSTACK_DATA env var is not set */
+var DEFAULT_DATA_PATH = "camstack-data";
+/**
+* A list of browser origins from config.yaml (a YAML list) or from the
+* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
+* only strings). Validation of each entry is the CORS policy's job
+* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
+* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
+*/
+var originListSchema = z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, z.array(z.string()));
+var serverSchema = z.object({
+	port: z.number().default(4443),
+	host: z.string().default("0.0.0.0"),
+	dataPath: z.string().default(DEFAULT_DATA_PATH),
+	/**
+	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
+	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
+	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
+	* who may read hub responses in a browser is a security decision, and the
+	* policy is live from the first request, before the settings store exists.
+	*/
+	corsOrigins: originListSchema.default([])
+});
+var authSchema = z.object({
+	jwtSecret: z.string().nullable().default(null),
+	adminUsername: z.string().default("admin"),
+	adminPassword: z.string().default("changeme")
+});
+var hubSchema = z.object({
+	url: z.string().default("ws://localhost:4443/agent"),
+	token: z.string().default("")
+});
+var agentSchema = z.object({
+	name: z.string().default(""),
+	/** Port for the agent status page (minimal HTML) */
+	statusPort: z.number().default(4444)
+});
+var tlsSchema = z.object({ 
+/**
+* Enable HTTPS (default: true). The certificate itself is never configured
+* here: the admin UI (Network → Local access) generates or uploads it
+* (D726), and boot serves whatever `tls/mode` says.
+*/
+enabled: z.boolean().default(true) });
+/**
+* Bootstrap-time addon configuration — read PURELY from YAML, before the
+* kernel can talk to the settings-store. This breaks the chicken-and-egg
+* where the settings store itself is implemented by an addon: the kernel
+* needs to know WHICH addon to load first to provide the store, and that
+* decision can't itself live in the store.
+*
+* Backward-compatible: every field is optional + defaults reproduce the
+* current hard-coded behavior. Existing config.yaml files keep working.
+*/
+var bootstrapAddonsSchema = z.object({
+	/**
+	* Addon implementing the `settings-store` capability. Loaded FIRST,
+	* before any other addon is enabled — every other addon's enable
+	* state, settings, and ordering lives in the store it provides.
+	*
+	* Default: '@camstack/addon-sqlite-storage' (the workspace's
+	* default SQLite-backed store). Future alternatives could swap this
+	* for postgres/redis without touching kernel code.
+	*/
+	settingsStoreAddon: z.string().default("@camstack/addon-sqlite-storage"),
+	/**
+	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
+	* on startup.
+	*
+	*   - `'npm'`     — pull from the npm registry (production default).
+	*   - `'local'`   — copy `packages/<X>/` from the workspace into
+	*                   `data/addons/<X>/`. Use for the Electron-
+	*                   packaged bundle and the e2e harness.
+	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
+	*                   dir via a directory symlink. Dev-only: a
+	*                   workspace rebuild (`npm run build -w <X>`) is
+	*                   immediately reflected at the next addon load,
+	*                   no copy step. Falls back to `'local'` on
+	*                   platforms that reject symlink creation (Windows
+	*                   without developer-mode).
+	*
+	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
+	* field. Leave undefined to keep the launcher's default behaviour
+	* (npm when no workspace, local when a bundled addons dir is
+	* present, …).
+	*/
+	installSource: z.enum([
+		"npm",
+		"local",
+		"symlink"
+	]).optional(),
+	/**
+	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
+	* Passing an array here REPLACES the default list entirely — useful
+	* for stripped-down deployments (only the bundle of addons the
+	* operator actually wants) and for forcing a different storage
+	* backend at first boot.
+	*
+	* Leave undefined to use the kernel-shipped defaults.
+	*/
+	requiredAddons: z.array(z.string()).optional(),
+	/**
+	* Disable list applied AFTER the settings-store reports the enabled
+	* set. Operator escape hatch — boot without a known-broken addon
+	* without having to mutate the store.
+	*/
+	forceDisable: z.array(z.string()).default([])
+});
+/** Bootstrap config -- loaded from config.yaml ONLY at startup.
+*  All other settings live in SQL (system_settings table). */
+var bootstrapSchema = z.object({
+	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
+	mode: z.enum(["hub", "agent"]).default("hub"),
+	server: serverSchema.default(serverSchema.parse({})),
+	auth: authSchema.default(authSchema.parse({})),
+	/** Hub connection config — only used when mode='agent' */
+	hub: hubSchema.default(hubSchema.parse({})),
+	/** Agent-specific config — only used when mode='agent' */
+	agent: agentSchema.default(agentSchema.parse({})),
+	/** TLS configuration */
+	tls: tlsSchema.default(tlsSchema.parse({})),
+	/**
+	* Addon bootstrap directives — minimum addon set needed before the
+	* kernel can reach the settings-store. See bootstrapAddonsSchema.
+	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
+	*/
+	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({}))
+});
+//#endregion
+//#region src/builtins/local-auth/admin-account-boot.ts
+/**
+* The admin account at boot: seed it once, reset it only on the operator's
+* explicit one-shot request, and say so when it still has the default password.
+*
+* ## Why a trigger FILE, not a variable
+*
+* The configured password (`CAMSTACK_ADMIN_PASS` / `auth.adminPassword`) seeds
+* the admin on first boot and is never applied again — a password the operator
+* changes in the admin UI survives every restart. Recovering a forgotten
+* password therefore needs an explicit request, and that request must be
+* ONE-SHOT: an environment flag stays set in a container template until someone
+* remembers to remove it, and while it is set it reverts the password on every
+* boot — the very defect this replaced. A file the hub DELETES after acting on
+* it cannot be left armed: create `RESET_ADMIN_PASSWORD` in the node's data
+* directory (`/data` in the container), restart, and the configured admin's
+* password is set back to the configured one, once.
+*/
+/** The trigger's name, at the root of the node's data directory. */
+var ADMIN_PASSWORD_RESET_TRIGGER = "RESET_ADMIN_PASSWORD";
+async function reconcileAdminAccountAtBoot(input) {
+	const { users, fs, logger } = input;
+	const triggerPath = path$1.join(input.dataDir, ADMIN_PASSWORD_RESET_TRIGGER);
+	const resetRequested = fs.exists(triggerPath);
+	const outcome = await users.ensureAdminExists({ resetPassword: resetRequested });
+	logOutcome(outcome, logger);
+	if (resetRequested) consumeTrigger(triggerPath, outcome, input);
+	const username = "username" in outcome ? outcome.username : null;
+	const usesDefaultPassword = username !== null && await users.hasPassword(username, "changeme");
+	if (usesDefaultPassword && username !== null) logger.warn("The admin account still uses the default password — change it in the admin UI (the first sign-in with it asks for a new one)", { meta: { username } });
+	return {
+		outcome,
+		usesDefaultPassword
+	};
+}
+function logOutcome(outcome, logger) {
+	switch (outcome.kind) {
+		case "seeded":
+			logger.info("Admin account seeded from the configured credentials (first boot)", { meta: { username: outcome.username } });
+			return;
+		case "reset":
+			logger.warn("Admin password reset to the configured password, as requested", { meta: { username: outcome.username } });
+			return;
+		case "other-admin-exists":
+			logger.info("Configured admin username not seeded: another admin account already exists", { meta: { username: outcome.username } });
+			return;
+		case "not-configured":
+			logger.warn("No admin username/password configured — no admin account seeded");
+			return;
+		case "exists": return;
+	}
+}
+/** Delete the trigger after acting on it — a reset must never repeat by itself. */
+function consumeTrigger(triggerPath, outcome, input) {
+	if (outcome.kind !== "reset") input.logger.warn("Admin password reset requested, but no configured admin account to reset", { meta: {
+		trigger: triggerPath,
+		outcome: outcome.kind
+	} });
+	try {
+		input.fs.remove(triggerPath);
+	} catch (err) {
+		input.logger.error("Could not delete the admin password reset trigger — delete it by hand, or every restart resets the admin password again", { meta: {
+			trigger: triggerPath,
+			error: err instanceof Error ? err.message : String(err)
+		} });
+	}
+}
+//#endregion
 //#region src/builtins/local-auth/auth-config-reader.ts
 /**
 * Every config path this reader can answer. Anything else resolves to
@@ -9058,8 +9301,9 @@ function narrow(value) {
 //#region src/builtins/local-auth/auth-schema.ts
 /**
 * @durable class=config owner=local-auth
-*   write="an operator creates a user, or `ensureAdminExists` seeds/re-syncs the
-*     configured admin at boot; updated on scope, isAdmin and password edits"
+*   write="an operator creates a user, or `ensureAdminExists` seeds the configured
+*     admin on first boot (or resets its password on the operator's one-shot
+*     RESET_ADMIN_PASSWORD trigger); updated on scope, isAdmin and password edits"
 *   retention="none — a row goes only when an operator deletes the user. A
 *     `declareCollection` that adds a PK/UNIQUE/NOT-NULL-without-default column
 *     REBUILDS the table: every account is wiped and only the configured admin
@@ -9667,6 +9911,23 @@ var OauthSessionManager = class {
 };
 //#endregion
 //#region src/builtins/local-auth/local-auth.addon.ts
+/**
+* Local Auth Addon — owns user accounts, API keys, scoped tokens,
+* and local password authentication.
+*
+* Capabilities registered:
+*   - `auth-provider` (collection) — local password authentication
+*   - `user-management` (singleton) — user CRUD, API keys, scoped tokens
+*
+* This addon owns the OAuth grant MACHINERY (codes, sessions, refresh) but
+* declares no `oauth-integration` client of its own, and must not start: which
+* clients exist is integration-specific knowledge and belongs to the addon that
+* owns the integration (D101). `homeassistant` moved to `homeassistant-export`;
+* `export-alexa` was always there.
+*
+* Extension: an OIDC addon can register another `auth-provider` entry.
+* The server's login flow iterates the `auth-provider` collection.
+*/
 /** How often the auth tables are swept for dead rows. */
 var AUTH_REAP_INTERVAL_MS = 24 * 36e5;
 /**
@@ -9724,7 +9985,15 @@ var LocalAuthAddon = class extends BaseAddon {
 			this.oauthSessionManager = new OauthSessionManager(store);
 			this.totpManager = new TotpManager(store);
 			try {
-				await this.userManager.ensureAdminExists();
+				await reconcileAdminAccountAtBoot({
+					users: this.userManager,
+					dataDir: this.ctx.nodeDataDir,
+					fs: {
+						exists: (filePath) => fs.existsSync(filePath),
+						remove: (filePath) => fs.rmSync(filePath, { force: true })
+					},
+					logger: this.ctx.logger
+				});
 				const liveUsers = await this.userManager.listAll();
 				const liveIds = new Set(liveUsers.map((u) => u.id));
 				const removed = await this.scopedTokenManager.cleanupOrphans(liveIds);
@@ -9976,4 +10245,4 @@ var LocalAuthAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { LocalAuthAddon, LocalAuthAddon as default, isSettingsReadUnavailable as a, ApiKeyManager as c, SettingsReadUnavailableError as i, ScopedTokenManager as n, require_ms as o, AuthManager as r, require_safe_buffer as s, UserManager as t };
+export { LocalAuthAddon, LocalAuthAddon as default, AuthManager as a, require_ms as c, ScopedTokenManager as i, require_safe_buffer as l, bootstrapSchema as n, SettingsReadUnavailableError as o, UserManager as r, isSettingsReadUnavailable as s, DEFAULT_DATA_PATH as t, ApiKeyManager as u };

package/dist/builtins/local-network/local-network.addon.d.ts

@@ -50,6 +50,19 @@ interface LocalNetworkConfig {
     readonly httpPort: number;
     /** Operator-declared DNS name advertised instead of the raw LAN IP. Empty = none. */
     readonly localHostname: string;
+    /**
+     * "Hub address for agents": the base URL agents pull addon bundles and
+     * models from, when auto-detection names one they cannot reach (Docker
+     * bridge networking, NAT, VPN). Empty = automatic. Validated on write
+     * (`validateHubAddressOverride`): http(s), never loopback.
+     */
+    readonly agentBaseUrl: string;
+    /**
+     * "Public address for sign-in links": magic-link e-mails, the OIDC
+     * callback, the WebAuthn relying party, OAuth2's hub URL. Empty =
+     * automatic. Same validation as `agentBaseUrl`.
+     */
+    readonly signInBaseUrl: string;
 }
 export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
     private pollTimer;
@@ -67,6 +80,12 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
      */
     private meshEndpoint;
     constructor();
+    /**
+     * Both audiences' hub address: the override when set, else the automatic
+     * pick over the HTTPS palette (`resolveHubAddress`). The one reading every
+     * consumer goes through — `getHubAddresses`.
+     */
+    private snapshotHubAddresses;
     /**
      * The effective flagged notification address: the operator's explicit
      * choice, else AUTO — the CamStack app link (D709, operator decision
@@ -120,6 +139,13 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
     private resolvedHttpPort;
     private tlsDataDir;
     private snapshotTls;
+    /**
+     * Hot-swap the HTTPS listener onto the pair now on disk. A failure is not
+     * thrown — the files are already written and the status reports
+     * `restartRequired` from the served-vs-disk fingerprints — but it is logged:
+     * a certificate change that did not reach the listener must say so.
+     */
+    private putCertificateOnListener;
     /**
      * Bind or unbind the LAN HTTP sibling from the addon's own settings, and
      * keep the leaf SAN in sync with `localHostname`. This is the settings

package/dist/builtins/local-network/local-network.addon.js

@@ -1,9 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CFVOy8VT.js");
-const require_tls = require("../../tls-ue_Xefmv.js");
-let node_fs_promises = require("node:fs/promises");
-let node_path = require("node:path");
+const require_dist = require("../../dist-DzAHit0a.js");
+const require_tls = require("../../tls-CCMX7MjX.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
@@ -203,10 +201,25 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			viewerBaseUrls: [],
 			httpEnabled: true,
 			httpPort: require_tls.DEFAULT_LAN_HTTP_PORT,
-			localHostname: ""
+			localHostname: "",
+			agentBaseUrl: "",
+			signInBaseUrl: ""
 		});
 	}
 	/**
+	* Both audiences' hub address: the override when set, else the automatic
+	* pick over the HTTPS palette (`resolveHubAddress`). The one reading every
+	* consumer goes through — `getHubAddresses`.
+	*/
+	async snapshotHubAddresses() {
+		const port = (await this.resolveAdvertisedListenPort(null)).port;
+		const palette = await this.buildAdvertisedEndpoints(false, false, "https", port);
+		return {
+			cluster: require_dist.resolveHubAddress(palette, "cluster", this.config.agentBaseUrl || null),
+			browser: require_dist.resolveHubAddress(palette, "browser", this.config.signInBaseUrl || null)
+		};
+	}
+	/**
 	* The effective flagged notification address: the operator's explicit
 	* choice, else AUTO — the CamStack app link (D709, operator decision
 	* 2026-10-06; before it AUTO was the tunnel, then the mesh). The app link is
@@ -296,6 +309,21 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 				this.ctx.logger.info("local-network: notification endpoint set", { meta: { baseUrl: baseUrl ?? "(auto)" } });
 				return this.notificationEndpointSnapshot();
 			},
+			getHubAddresses: async () => this.snapshotHubAddresses(),
+			setHubAddress: async ({ audience, baseUrl }) => {
+				let stored = "";
+				if (baseUrl !== null && baseUrl.trim() !== "") {
+					const check = require_dist.validateHubAddressOverride(baseUrl);
+					if (!check.ok) throw new Error(check.reason);
+					stored = check.baseUrl;
+				}
+				await this.updateGlobalSettings(audience === "cluster" ? { agentBaseUrl: stored } : { signInBaseUrl: stored });
+				this.ctx.logger.info("local-network: hub address override set", { meta: {
+					audience,
+					baseUrl: stored === "" ? "(auto)" : stored
+				} });
+				return this.snapshotHubAddresses();
+			},
 			getViewerEndpoints: async () => this.snapshotViewerEndpoints(),
 			setViewerEndpoints: async ({ baseUrls }) => {
 				const cleaned = [...new Set(baseUrls.filter((u) => u.length > 0))];
@@ -326,32 +354,30 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 				} });
 				return { success: true };
 			},
-			getTlsStatus: async () => this.snapshotTls(false),
+			getTlsStatus: async () => this.snapshotTls(),
 			regenerateCertificate: async (_input) => {
-				if (require_tls.readTlsMode(this.tlsDataDir()) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
 				const extraSans = [...require_tls.readExtraSans(this.tlsDataDir())];
-				await require_tls.reissueTlsLeaf(this.tlsDataDir(), { extraSans });
-				return this.snapshotTls(true);
+				await require_tls.regenerateCertificate(this.tlsDataDir(), { extraSans });
+				this.putCertificateOnListener("regenerate");
+				return this.snapshotTls();
 			},
 			uploadCertificate: async ({ certPem, keyPem, caPem }) => {
-				const valid = require_tls.validateUploadedTls(certPem, keyPem);
-				if (!valid.ok) throw new Error(valid.error);
-				const dir = (0, node_path.join)(this.tlsDataDir(), "tls");
-				await (0, node_fs_promises.mkdir)(dir, { recursive: true });
-				await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.crt"), certPem.endsWith("\n") ? certPem : `${certPem}\n`);
-				await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.key"), keyPem.endsWith("\n") ? keyPem : `${keyPem}\n`, { mode: 384 });
-				if (caPem && caPem.trim() !== "") await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack-ca.crt"), caPem.endsWith("\n") ? caPem : `${caPem}\n`);
-				require_tls.writeTlsMode(this.tlsDataDir(), "uploaded");
-				return this.snapshotTls(true);
+				await require_tls.storeUploadedCertificate(this.tlsDataDir(), {
+					certPem,
+					keyPem,
+					caPem
+				});
+				this.putCertificateOnListener("upload");
+				return this.snapshotTls();
 			},
 			downloadCa: async () => {
-				return { pem: this.snapshotTls(false).caCertPem ?? "" };
+				return { pem: this.snapshotTls().caCertPem ?? "" };
 			},
 			revertToGeneratedCertificate: async () => {
-				require_tls.writeTlsMode(this.tlsDataDir(), "generated");
 				const extraSans = [...require_tls.readExtraSans(this.tlsDataDir())];
-				await require_tls.ensureTlsCert(this.tlsDataDir(), { extraSans });
-				return this.snapshotTls(true);
+				await require_tls.revertToGeneratedCertificate(this.tlsDataDir(), { extraSans });
+				this.putCertificateOnListener("revert");
+				return this.snapshotTls();
 			}
 		};
 		this.lastSnapshotKey = snapshotKey(this.enumerate());
@@ -510,14 +536,35 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	tlsDataDir() {
 		return this.ctx.nodeDataDir ?? this.ctx.dataDir;
 	}
-	snapshotTls(restartRequired) {
-		const status = require_tls.readTlsAccessStatus(this.tlsDataDir(), restartRequired);
+	snapshotTls() {
+		const status = require_tls.readTlsAccessStatus(this.tlsDataDir(), require_tls.servedHttpsLeafFingerprint());
 		return {
 			...status,
 			sans: [...status.sans]
 		};
 	}
 	/**
+	* Hot-swap the HTTPS listener onto the pair now on disk. A failure is not
+	* thrown — the files are already written and the status reports
+	* `restartRequired` from the served-vs-disk fingerprints — but it is logged:
+	* a certificate change that did not reach the listener must say so.
+	*/
+	putCertificateOnListener(action) {
+		const outcome = require_tls.applyCertificateToListener(this.tlsDataDir());
+		if (outcome.kind === "reloaded") {
+			this.ctx.logger.info("local-network: HTTPS listener now serves the new certificate", { meta: {
+				action,
+				leafFingerprintSha256: outcome.servedLeafFingerprint
+			} });
+			return;
+		}
+		this.ctx.logger.warn("local-network: certificate changed on disk but NOT on the listener", { meta: {
+			action,
+			reason: outcome.kind,
+			...outcome.kind === "failed" ? { error: outcome.error } : {}
+		} });
+	}
+	/**
 	* Bind or unbind the LAN HTTP sibling from the addon's own settings, and
 	* keep the leaf SAN in sync with `localHostname`. This is the settings
 	* side-effect path — there is no second persist API.
@@ -536,7 +583,9 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		});
 		if (hostname !== "") {
 			require_tls.writeExtraSans(this.tlsDataDir(), [hostname]);
-			if (require_tls.readTlsMode(this.tlsDataDir()) === "generated") await require_tls.ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] });
+			if (require_tls.readTlsMode(this.tlsDataDir()) === "generated") {
+				if ((await require_tls.ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] })).generated) this.putCertificateOnListener("hostname");
+			}
 		} else require_tls.writeExtraSans(this.tlsDataDir(), []);
 	}
 	/**