@camstack/system 1.2.356 → 1.2.358

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,7 +1,5 @@
-import { Cr as EventCategory, Qn as BaseAddon, Ut as localNetworkCapability, an as pickAppLinkHub, s as CAMSTACK_APP_LINK_ORIGIN } from "../../dist-B7WRgEZY.mjs";
-import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-DTlVWwAI.mjs";
-import { mkdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { Nn as validateHubAddressOverride, Tr as EventCategory, Ut as localNetworkCapability, an as pickAppLinkHub, er as BaseAddon, hn as resolveHubAddress, s as CAMSTACK_APP_LINK_ORIGIN } from "../../dist-D3bhbMY3.mjs";
+import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-CJHogwTl.mjs";
 import * as os from "node:os";
 import { readFileSync } from "node:fs";
 import { isIP } from "node:net";
@@ -200,10 +198,25 @@ var LocalNetworkAddon = class extends BaseAddon {
 			viewerBaseUrls: [],
 			httpEnabled: true,
 			httpPort: DEFAULT_LAN_HTTP_PORT,
-			localHostname: ""
+			localHostname: "",
+			agentBaseUrl: "",
+			signInBaseUrl: ""
 		});
 	}
 	/**
+	* Both audiences' hub address: the override when set, else the automatic
+	* pick over the HTTPS palette (`resolveHubAddress`). The one reading every
+	* consumer goes through — `getHubAddresses`.
+	*/
+	async snapshotHubAddresses() {
+		const port = (await this.resolveAdvertisedListenPort(null)).port;
+		const palette = await this.buildAdvertisedEndpoints(false, false, "https", port);
+		return {
+			cluster: resolveHubAddress(palette, "cluster", this.config.agentBaseUrl || null),
+			browser: resolveHubAddress(palette, "browser", this.config.signInBaseUrl || null)
+		};
+	}
+	/**
 	* The effective flagged notification address: the operator's explicit
 	* choice, else AUTO — the CamStack app link (D709, operator decision
 	* 2026-10-06; before it AUTO was the tunnel, then the mesh). The app link is
@@ -293,6 +306,21 @@ var LocalNetworkAddon = class extends BaseAddon {
 				this.ctx.logger.info("local-network: notification endpoint set", { meta: { baseUrl: baseUrl ?? "(auto)" } });
 				return this.notificationEndpointSnapshot();
 			},
+			getHubAddresses: async () => this.snapshotHubAddresses(),
+			setHubAddress: async ({ audience, baseUrl }) => {
+				let stored = "";
+				if (baseUrl !== null && baseUrl.trim() !== "") {
+					const check = validateHubAddressOverride(baseUrl);
+					if (!check.ok) throw new Error(check.reason);
+					stored = check.baseUrl;
+				}
+				await this.updateGlobalSettings(audience === "cluster" ? { agentBaseUrl: stored } : { signInBaseUrl: stored });
+				this.ctx.logger.info("local-network: hub address override set", { meta: {
+					audience,
+					baseUrl: stored === "" ? "(auto)" : stored
+				} });
+				return this.snapshotHubAddresses();
+			},
 			getViewerEndpoints: async () => this.snapshotViewerEndpoints(),
 			setViewerEndpoints: async ({ baseUrls }) => {
 				const cleaned = [...new Set(baseUrls.filter((u) => u.length > 0))];
@@ -323,32 +351,30 @@ var LocalNetworkAddon = class extends BaseAddon {
 				} });
 				return { success: true };
 			},
-			getTlsStatus: async () => this.snapshotTls(false),
+			getTlsStatus: async () => this.snapshotTls(),
 			regenerateCertificate: async (_input) => {
-				if (readTlsMode(this.tlsDataDir()) === "uploaded") throw new Error("Cannot regenerate an uploaded certificate — revert to generated first.");
 				const extraSans = [...readExtraSans(this.tlsDataDir())];
-				await reissueTlsLeaf(this.tlsDataDir(), { extraSans });
-				return this.snapshotTls(true);
+				await regenerateCertificate(this.tlsDataDir(), { extraSans });
+				this.putCertificateOnListener("regenerate");
+				return this.snapshotTls();
 			},
 			uploadCertificate: async ({ certPem, keyPem, caPem }) => {
-				const valid = validateUploadedTls(certPem, keyPem);
-				if (!valid.ok) throw new Error(valid.error);
-				const dir = join(this.tlsDataDir(), "tls");
-				await mkdir(dir, { recursive: true });
-				await writeFile(join(dir, "camstack.crt"), certPem.endsWith("\n") ? certPem : `${certPem}\n`);
-				await writeFile(join(dir, "camstack.key"), keyPem.endsWith("\n") ? keyPem : `${keyPem}\n`, { mode: 384 });
-				if (caPem && caPem.trim() !== "") await writeFile(join(dir, "camstack-ca.crt"), caPem.endsWith("\n") ? caPem : `${caPem}\n`);
-				writeTlsMode(this.tlsDataDir(), "uploaded");
-				return this.snapshotTls(true);
+				await storeUploadedCertificate(this.tlsDataDir(), {
+					certPem,
+					keyPem,
+					caPem
+				});
+				this.putCertificateOnListener("upload");
+				return this.snapshotTls();
 			},
 			downloadCa: async () => {
-				return { pem: this.snapshotTls(false).caCertPem ?? "" };
+				return { pem: this.snapshotTls().caCertPem ?? "" };
 			},
 			revertToGeneratedCertificate: async () => {
-				writeTlsMode(this.tlsDataDir(), "generated");
 				const extraSans = [...readExtraSans(this.tlsDataDir())];
-				await ensureTlsCert(this.tlsDataDir(), { extraSans });
-				return this.snapshotTls(true);
+				await revertToGeneratedCertificate(this.tlsDataDir(), { extraSans });
+				this.putCertificateOnListener("revert");
+				return this.snapshotTls();
 			}
 		};
 		this.lastSnapshotKey = snapshotKey(this.enumerate());
@@ -507,14 +533,35 @@ var LocalNetworkAddon = class extends BaseAddon {
 	tlsDataDir() {
 		return this.ctx.nodeDataDir ?? this.ctx.dataDir;
 	}
-	snapshotTls(restartRequired) {
-		const status = readTlsAccessStatus(this.tlsDataDir(), restartRequired);
+	snapshotTls() {
+		const status = readTlsAccessStatus(this.tlsDataDir(), servedHttpsLeafFingerprint());
 		return {
 			...status,
 			sans: [...status.sans]
 		};
 	}
 	/**
+	* Hot-swap the HTTPS listener onto the pair now on disk. A failure is not
+	* thrown — the files are already written and the status reports
+	* `restartRequired` from the served-vs-disk fingerprints — but it is logged:
+	* a certificate change that did not reach the listener must say so.
+	*/
+	putCertificateOnListener(action) {
+		const outcome = applyCertificateToListener(this.tlsDataDir());
+		if (outcome.kind === "reloaded") {
+			this.ctx.logger.info("local-network: HTTPS listener now serves the new certificate", { meta: {
+				action,
+				leafFingerprintSha256: outcome.servedLeafFingerprint
+			} });
+			return;
+		}
+		this.ctx.logger.warn("local-network: certificate changed on disk but NOT on the listener", { meta: {
+			action,
+			reason: outcome.kind,
+			...outcome.kind === "failed" ? { error: outcome.error } : {}
+		} });
+	}
+	/**
 	* Bind or unbind the LAN HTTP sibling from the addon's own settings, and
 	* keep the leaf SAN in sync with `localHostname`. This is the settings
 	* side-effect path — there is no second persist API.
@@ -533,7 +580,9 @@ var LocalNetworkAddon = class extends BaseAddon {
 		});
 		if (hostname !== "") {
 			writeExtraSans(this.tlsDataDir(), [hostname]);
-			if (readTlsMode(this.tlsDataDir()) === "generated") await ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] });
+			if (readTlsMode(this.tlsDataDir()) === "generated") {
+				if ((await ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] })).generated) this.putCertificateOnListener("hostname");
+			}
 		} else writeExtraSans(this.tlsDataDir(), []);
 	}
 	/**

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CFVOy8VT.js");
+const require_dist = require("../../dist-DzAHit0a.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Gt as logDestinationCapability, Qn as BaseAddon } from "../../dist-B7WRgEZY.mjs";
+import { Gt as logDestinationCapability, er as BaseAddon } from "../../dist-D3bhbMY3.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CFVOy8VT.js");
+const require_dist = require("../../dist-DzAHit0a.js");
 const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as EventCategory, Qn as BaseAddon, Zn as errMsg, Zt as metricsProviderCapability, cr as createEvent, fn as resolveBucketMs, jt as foldSnapshotByFunction, un as reducePoints } from "../../dist-B7WRgEZY.mjs";
+import { $n as errMsg, Tr as EventCategory, Zt as metricsProviderCapability, er as BaseAddon, fn as resolveBucketMs, jt as foldSnapshotByFunction, un as reducePoints, ur as createEvent } from "../../dist-D3bhbMY3.mjs";
 import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CFVOy8VT.js");
+const require_dist = require("../../dist-DzAHit0a.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Cr as EventCategory, Qn as BaseAddon, St as enumerateInferenceDevices, Zn as errMsg, bn as scoreRuntimes, sn as platformProbeCapability, ur as emitReadiness } from "../../dist-B7WRgEZY.mjs";
+import { $n as errMsg, St as enumerateInferenceDevices, Tr as EventCategory, er as BaseAddon, fr as emitReadiness, sn as platformProbeCapability, xn as scoreRuntimes } from "../../dist-D3bhbMY3.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CFVOy8VT.js");
+const require_dist = require("../../dist-DzAHit0a.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as EventCategory, Qn as BaseAddon } from "../../dist-B7WRgEZY.mjs";
+import { Tr as EventCategory, er as BaseAddon } from "../../dist-D3bhbMY3.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CFVOy8VT.js");
+const require_dist = require("../../dist-DzAHit0a.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Cn as snapshotCapability, Cr as EventCategory, Jn as DeviceFeature, Qn as BaseAddon, X as batteryCapability, Xn as DeviceType, Xt as memoizePinnedFfmpeg, Y as bareAddonId, Zn as errMsg, a as BatteryStatusSchema, gt as deriveBatteryPresence, hr as nodePin, kn as streamQualityLabel } from "../../dist-B7WRgEZY.mjs";
+import { $n as errMsg, An as streamQualityLabel, Qn as DeviceType, Tr as EventCategory, X as batteryCapability, Xn as DeviceFeature, Xt as memoizePinnedFfmpeg, Y as bareAddonId, _r as nodePin, a as BatteryStatusSchema, er as BaseAddon, gt as deriveBatteryPresence, wn as snapshotCapability } from "../../dist-D3bhbMY3.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CFVOy8VT.js");
+const require_dist = require("../../dist-DzAHit0a.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { At as filesystemBrowseCapability, Dn as storageProviderCapability, Qn as BaseAddon } from "../../dist-B7WRgEZY.mjs";
+import { At as filesystemBrowseCapability, On as storageProviderCapability, er as BaseAddon } from "../../dist-D3bhbMY3.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CFVOy8VT.js");
+const require_dist = require("../../dist-DzAHit0a.js");
 const require_hub_cap_forward = require("../../hub-cap-forward-DmHNjbB0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { B as StorageLocationTypeSchema, Cr as EventCategory, E as LegacyStorageLocationDefaultSchema, Et as evictionPolicyOfLocation, Fn as withLocationMode, It as isLocationEnabled, Jt as mayReadLocation, M as REDACTED_SECRET, Nt as gbToBytes, Qn as BaseAddon, Qt as modeMayWrite, R as StorageCleanupJobSchema, Tn as storageMigrationCapability, V as StorageMigrationJobSchema, Vt as legacyModeOf, Yt as mayWriteToLocation, gr as parseJsonObject, hn as resolveLocationMode, tt as collectSecretConfigKeys, wn as storageCapability, xn as settingsStoreCapability, z as StorageLocationModeSchema } from "../../dist-B7WRgEZY.mjs";
+import { B as StorageLocationTypeSchema, E as LegacyStorageLocationDefaultSchema, En as storageMigrationCapability, Et as evictionPolicyOfLocation, It as isLocationEnabled, Jt as mayReadLocation, Ln as withLocationMode, M as REDACTED_SECRET, Nt as gbToBytes, Qt as modeMayWrite, R as StorageCleanupJobSchema, Sn as settingsStoreCapability, Tn as storageCapability, Tr as EventCategory, V as StorageMigrationJobSchema, Vt as legacyModeOf, Yt as mayWriteToLocation, er as BaseAddon, gn as resolveLocationMode, tt as collectSecretConfigKeys, vr as parseJsonObject, z as StorageLocationModeSchema } from "../../dist-D3bhbMY3.mjs";
 import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-BdT320dq.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CFVOy8VT.js");
+const require_dist = require("../../dist-DzAHit0a.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Qn as BaseAddon, Zn as errMsg, fr as hydrateSchema } from "../../dist-B7WRgEZY.mjs";
+import { $n as errMsg, er as BaseAddon, mr as hydrateSchema } from "../../dist-D3bhbMY3.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CFVOy8VT.js");
+const require_dist = require("../../dist-DzAHit0a.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Gt as logDestinationCapability, Qn as BaseAddon } from "../../dist-B7WRgEZY.mjs";
+import { Gt as logDestinationCapability, er as BaseAddon } from "../../dist-D3bhbMY3.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{child-cap-dispatch-wbIQJctP.js → child-cap-dispatch-BWk99kmA.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CFVOy8VT.js");
+const require_dist = require("./dist-DzAHit0a.js");
 const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
 require("./hub-cap-forward-DmHNjbB0.js");
 let node_crypto = require("node:crypto");
@@ -4418,7 +4418,7 @@ function createChildrenBatchLoader(opts) {
 var RuntimeStateLoadError = class extends Error {
 	deviceId;
 	constructor(deviceId, reason, options) {
-		super(`runtime state of device ${deviceId} could not be loaded (${reason}) — the device is not built from an empty state (D677)`, options);
+		super(`runtime state of device ${deviceId} could not be loaded (${reason}) — the device is not built from an empty state`, options);
 		this.deviceId = deviceId;
 		this.name = "RuntimeStateLoadError";
 	}

package/dist/{child-cap-dispatch-BcRHQBKW.mjs → child-cap-dispatch-C2dFiu87.mjs}

@@ -1,4 +1,4 @@
-import { Cr as EventCategory$1, cr as createEvent } from "./dist-B7WRgEZY.mjs";
+import { Tr as EventCategory$1, ur as createEvent } from "./dist-D3bhbMY3.mjs";
 import { a as parseProcStat, i as nodeProcReader } from "./proc-stat-CbC55Kqi.mjs";
 import "./hub-cap-forward-BdT320dq.mjs";
 import * as crypto$1 from "node:crypto";
@@ -4415,7 +4415,7 @@ function createChildrenBatchLoader(opts) {
 var RuntimeStateLoadError = class extends Error {
 	deviceId;
 	constructor(deviceId, reason, options) {
-		super(`runtime state of device ${deviceId} could not be loaded (${reason}) — the device is not built from an empty state (D677)`, options);
+		super(`runtime state of device ${deviceId} could not be loaded (${reason}) — the device is not built from an empty state`, options);
 		this.deviceId = deviceId;
 		this.name = "RuntimeStateLoadError";
 	}

package/dist/{composition-sources-CeO0K2cl.js → composition-sources-BaHPH661.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CFVOy8VT.js");
+const require_dist = require("./dist-DzAHit0a.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-BBfqepyT.mjs → composition-sources-D8Hapyav.mjs}

@@ -1,4 +1,4 @@
-import { Wn as compositionSourceKey, Zn as errMsg } from "./dist-B7WRgEZY.mjs";
+import { $n as errMsg, Kn as compositionSourceKey } from "./dist-D3bhbMY3.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation