@camstack/system 1.2.356 → 1.2.358

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CFVOy8VT.js");
+const require_dist = require("./dist-DzAHit0a.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -30,8 +30,8 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-ey4mbofz.js");
-const require_tls$1 = require("./tls-ue_Xefmv.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-wbIQJctP.js");
+const require_tls$1 = require("./tls-CCMX7MjX.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-BWk99kmA.js");
 const require_resource_monitor = require("./resource-monitor-BgWGRxN5.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");
@@ -7764,137 +7764,6 @@ function createDoorSettingsView(addonId, door, sections) {
 	};
 }
 //#endregion
-//#region src/kernel/config-schema.ts
-/** Default data directory — used when CAMSTACK_DATA env var is not set */
-var DEFAULT_DATA_PATH = "camstack-data";
-/**
-* A list of browser origins from config.yaml (a YAML list) or from the
-* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
-* only strings). Validation of each entry is the CORS policy's job
-* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
-* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
-*/
-var originListSchema = zod.z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, zod.z.array(zod.z.string()));
-var serverSchema = zod.z.object({
-	port: zod.z.number().default(4443),
-	host: zod.z.string().default("0.0.0.0"),
-	dataPath: zod.z.string().default(DEFAULT_DATA_PATH),
-	/**
-	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
-	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
-	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
-	* who may read hub responses in a browser is a security decision, and the
-	* policy is live from the first request, before the settings store exists.
-	*/
-	corsOrigins: originListSchema.default([])
-});
-var authSchema = zod.z.object({
-	jwtSecret: zod.z.string().nullable().default(null),
-	adminUsername: zod.z.string().default("admin"),
-	adminPassword: zod.z.string().default("changeme")
-});
-var hubSchema = zod.z.object({
-	url: zod.z.string().default("ws://localhost:4443/agent"),
-	token: zod.z.string().default("")
-});
-var agentSchema = zod.z.object({
-	name: zod.z.string().default(""),
-	/** Port for the agent status page (minimal HTML) */
-	statusPort: zod.z.number().default(4444)
-});
-var tlsSchema = zod.z.object({
-	/** Enable HTTPS (default: true) */
-	enabled: zod.z.boolean().default(true),
-	/** Path to custom cert file (PEM). If not set, auto-generates self-signed. */
-	certPath: zod.z.string().optional(),
-	/** Path to custom key file (PEM). Required if certPath is set. */
-	keyPath: zod.z.string().optional()
-});
-/**
-* Bootstrap-time addon configuration — read PURELY from YAML, before the
-* kernel can talk to the settings-store. This breaks the chicken-and-egg
-* where the settings store itself is implemented by an addon: the kernel
-* needs to know WHICH addon to load first to provide the store, and that
-* decision can't itself live in the store.
-*
-* Backward-compatible: every field is optional + defaults reproduce the
-* current hard-coded behavior. Existing config.yaml files keep working.
-*/
-var bootstrapAddonsSchema = zod.z.object({
-	/**
-	* Addon implementing the `settings-store` capability. Loaded FIRST,
-	* before any other addon is enabled — every other addon's enable
-	* state, settings, and ordering lives in the store it provides.
-	*
-	* Default: '@camstack/addon-sqlite-storage' (the workspace's
-	* default SQLite-backed store). Future alternatives could swap this
-	* for postgres/redis without touching kernel code.
-	*/
-	settingsStoreAddon: zod.z.string().default("@camstack/addon-sqlite-storage"),
-	/**
-	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
-	* on startup.
-	*
-	*   - `'npm'`     — pull from the npm registry (production default).
-	*   - `'local'`   — copy `packages/<X>/` from the workspace into
-	*                   `data/addons/<X>/`. Use for the Electron-
-	*                   packaged bundle and the e2e harness.
-	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
-	*                   dir via a directory symlink. Dev-only: a
-	*                   workspace rebuild (`npm run build -w <X>`) is
-	*                   immediately reflected at the next addon load,
-	*                   no copy step. Falls back to `'local'` on
-	*                   platforms that reject symlink creation (Windows
-	*                   without developer-mode).
-	*
-	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
-	* field. Leave undefined to keep the launcher's default behaviour
-	* (npm when no workspace, local when a bundled addons dir is
-	* present, …).
-	*/
-	installSource: zod.z.enum([
-		"npm",
-		"local",
-		"symlink"
-	]).optional(),
-	/**
-	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
-	* Passing an array here REPLACES the default list entirely — useful
-	* for stripped-down deployments (only the bundle of addons the
-	* operator actually wants) and for forcing a different storage
-	* backend at first boot.
-	*
-	* Leave undefined to use the kernel-shipped defaults.
-	*/
-	requiredAddons: zod.z.array(zod.z.string()).optional(),
-	/**
-	* Disable list applied AFTER the settings-store reports the enabled
-	* set. Operator escape hatch — boot without a known-broken addon
-	* without having to mutate the store.
-	*/
-	forceDisable: zod.z.array(zod.z.string()).default([])
-});
-/** Bootstrap config -- loaded from config.yaml ONLY at startup.
-*  All other settings live in SQL (system_settings table). */
-var bootstrapSchema = zod.z.object({
-	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
-	mode: zod.z.enum(["hub", "agent"]).default("hub"),
-	server: serverSchema.default(serverSchema.parse({})),
-	auth: authSchema.default(authSchema.parse({})),
-	/** Hub connection config — only used when mode='agent' */
-	hub: hubSchema.default(hubSchema.parse({})),
-	/** Agent-specific config — only used when mode='agent' */
-	agent: agentSchema.default(agentSchema.parse({})),
-	/** TLS configuration */
-	tls: tlsSchema.default(tlsSchema.parse({})),
-	/**
-	* Addon bootstrap directives — minimum addon set needed before the
-	* kernel can reach the settings-store. See bootstrapAddonsSchema.
-	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
-	*/
-	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({}))
-});
-//#endregion
 //#region ../../node_modules/js-yaml/dist/js-yaml.mjs
 /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */
 var __create = Object.create;
@@ -10257,9 +10126,7 @@ var ENV_VAR_MAP = {
 /** config.yaml, env overrides applied, parsed. */
 function loadBootstrapConfig(configPath) {
 	const merged = applyEnvOverrides((0, _camstack_types_addon.asJsonObject)(loadYaml(configPath)) ?? {});
-	const config = bootstrapSchema.parse(merged);
-	warnDefaultCredentials(config);
-	return config;
+	return require_builtins_local_auth_local_auth_addon.bootstrapSchema.parse(merged);
 }
 function writeBootstrapSection(configPath, section, data) {
 	if (!BOOTSTRAP_SECTIONS.has(section)) throw new Error(`[ConfigManager] Section "${section}" is a runtime setting — use setSection() to persist via the settings-store, not update() which writes to config.yaml`);
@@ -10270,7 +10137,7 @@ function writeBootstrapSection(configPath, section, data) {
 		...existing,
 		...data
 	};
-	const validation = bootstrapSchema.safeParse(raw);
+	const validation = require_builtins_local_auth_local_auth_addon.bootstrapSchema.safeParse(raw);
 	if (!validation.success) throw new Error(`[ConfigManager] Invalid config update for section "${section}": ${validation.error.message}`);
 	const tmpPath = `${configPath}.tmp`;
 	node_fs.writeFileSync(tmpPath, dump(raw, {
@@ -10357,9 +10224,6 @@ function loadYaml(configPath) {
 	console.log(`[ConfigManager] Loaded config from: ${configPath}`);
 	return parsed;
 }
-function warnDefaultCredentials(config) {
-	if (config.auth.adminPassword === "changeme") console.warn("[ConfigManager] Warning: Using default admin password \"changeme\". Set auth.adminPassword in your config.yaml or the CAMSTACK_ADMIN_PASS env var.");
-}
 //#endregion
 //#region src/kernel/store-settings-view.ts
 function createStoreSettingsView(addonId, cm) {
@@ -96495,7 +96359,7 @@ exports.ConsoleLoggingAddon = require_builtins_console_logging_index.ConsoleLogg
 exports.CoreBlocksAddon = require_builtins_core_blocks_core_blocks_addon.CoreBlocksAddon;
 exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
 exports.DECISIVE_HEAP_SPACES = require_child_cap_dispatch.DECISIVE_HEAP_SPACES;
-exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
+exports.DEFAULT_DATA_PATH = require_builtins_local_auth_local_auth_addon.DEFAULT_DATA_PATH;
 exports.DEFAULT_LAN_HTTP_PORT = require_tls$1.DEFAULT_LAN_HTTP_PORT;
 exports.DEFAULT_LOG_LEVEL = DEFAULT_LOG_LEVEL;
 exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_dist.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
@@ -96609,6 +96473,7 @@ exports.TRADITIONAL_NATIVE_PACKAGES = TRADITIONAL_NATIVE_PACKAGES;
 exports.ToastService = ToastService;
 exports.UDS_NO_ROUTE_PREFIX = require_child_cap_dispatch.UDS_NO_ROUTE_PREFIX;
 exports.UNCLAIMED = UNCLAIMED;
+exports.UPLOADED_CA_FILE = require_tls$1.UPLOADED_CA_FILE;
 exports.UdsLocalTransportClient = require_child_cap_dispatch.UdsLocalTransportClient;
 exports.UdsLocalTransportServer = require_child_cap_dispatch.UdsLocalTransportServer;
 exports.UserManager = require_builtins_local_auth_local_auth_addon.UserManager;
@@ -96622,10 +96487,11 @@ exports.addonSettingsCapability = require_dist.addonSettingsCapability;
 exports.afterWorkerOnlineAnnounce = require_child_cap_dispatch.afterWorkerOnlineAnnounce;
 exports.allFamiliesListenHost = require_tls$1.allFamiliesListenHost;
 exports.answerClaimedGetStatus = require_child_cap_dispatch.answerClaimedGetStatus;
+exports.applyCertificateToListener = require_tls$1.applyCertificateToListener;
 exports.applyLanHttp = require_tls$1.applyLanHttp;
 exports.attributeStall = require_event_loop_stall_monitor.attributeStall;
 exports.bindPendingLanHttp = require_tls$1.bindPendingLanHttp;
-exports.bootstrapSchema = bootstrapSchema;
+exports.bootstrapSchema = require_builtins_local_auth_local_auth_addon.bootstrapSchema;
 exports.brokerCallForCap = require_child_cap_dispatch.brokerCallForCap;
 exports.brokerTransportLink = require_child_cap_dispatch.brokerTransportLink;
 Object.defineProperty(exports, "buildBinaryPath", {
@@ -96652,6 +96518,7 @@ exports.capBareAction = require_child_cap_dispatch.capBareAction;
 exports.capServiceName = require_child_cap_dispatch.capServiceName;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = require_child_cap_dispatch.classifyCapRoute;
+exports.clearHttpsListener = require_tls$1.clearHttpsListener;
 exports.clearPendingRestart = clearPendingRestart;
 exports.closeLanHttp = require_tls$1.closeLanHttp;
 exports.clusterEventTopic = require_child_cap_dispatch.clusterEventTopic;
@@ -96821,6 +96688,7 @@ exports.isModelDownloaded = require_event_loop_stall_monitor.isModelDownloaded;
 exports.isSettingsReadUnavailable = require_builtins_local_auth_local_auth_addon.isSettingsReadUnavailable;
 exports.isSourceNewer = isSourceNewer;
 exports.isolatedBuiltinPhase = isolatedBuiltinPhase;
+exports.leafFingerprintOf = require_tls$1.leafFingerprintOf;
 exports.loadTlsCert = require_tls$1.loadTlsCert;
 exports.localEndpointPath = require_child_cap_dispatch.localEndpointPath;
 exports.localProviderLink = require_child_cap_dispatch.localProviderLink;
@@ -96832,6 +96700,7 @@ exports.parseRangeHeader = require_event_loop_stall_monitor.parseRangeHeader;
 exports.parseRssBudgetMb = require_child_cap_dispatch.parseRssBudgetMb;
 exports.parseTokenizedUrl = require_event_loop_stall_monitor.parseTokenizedUrl;
 exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
+exports.prepareBootTls = require_tls$1.prepareBootTls;
 exports.proxyToUpstream = proxyToUpstream;
 exports.quarantineAddonResidue = quarantineAddonResidue;
 exports.readExtraSans = require_tls$1.readExtraSans;
@@ -96844,12 +96713,16 @@ exports.readTlsMode = require_tls$1.readTlsMode;
 exports.readinessKey = require_dist.readinessKey;
 exports.reclaimIntervalMs = require_child_cap_dispatch.reclaimIntervalMs;
 exports.recordSocketFrame = require_child_cap_dispatch.recordSocketFrame;
+exports.regenerateCertificate = require_tls$1.regenerateCertificate;
 exports.registerEventBusService = require_child_cap_dispatch.registerEventBusService;
+exports.registerHttpsListener = require_tls$1.registerHttpsListener;
 exports.registerLanHttpHandler = require_tls$1.registerLanHttpHandler;
 exports.reissueTlsLeaf = require_tls$1.reissueTlsLeaf;
+exports.reloadHttpsListener = require_tls$1.reloadHttpsListener;
 exports.resolveFilePath = require_event_loop_stall_monitor.resolveFilePath;
 exports.resolveHwAccel = require_child_cap_dispatch.resolveHwAccel;
 exports.resolveNpmInvocation = require_child_cap_dispatch.resolveNpmInvocation;
+exports.revertToGeneratedCertificate = require_tls$1.revertToGeneratedCertificate;
 exports.runHubAddonBoot = runHubAddonBoot;
 exports.runNpm = require_child_cap_dispatch.runNpm;
 exports.sampleSocketDirection = require_child_cap_dispatch.sampleSocketDirection;
@@ -96860,6 +96733,7 @@ exports.scopesAllowDeviceCap = require_dist.scopesAllowDeviceCap;
 exports.selectAddonResidue = selectAddonResidue;
 exports.selectReportedSpaces = require_child_cap_dispatch.selectReportedSpaces;
 exports.serializeTypedArrays = require_child_cap_dispatch.serializeTypedArrays;
+exports.servedHttpsLeafFingerprint = require_tls$1.servedHttpsLeafFingerprint;
 exports.setHubConnected = require_child_cap_dispatch.setHubConnected;
 exports.setNodeEventInterest = require_child_cap_dispatch.setNodeEventInterest;
 exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;
@@ -96867,10 +96741,12 @@ exports.shouldReclaim = require_child_cap_dispatch.shouldReclaim;
 exports.signalAllRunnerGroups = require_child_cap_dispatch.signalAllRunnerGroups;
 exports.socketDirectionBytes = require_child_cap_dispatch.socketDirectionBytes;
 exports.socketDirectionMessages = require_child_cap_dispatch.socketDirectionMessages;
+exports.splitPemCertificates = require_tls$1.splitPemCertificates;
 exports.startEventLoopStallMonitor = require_event_loop_stall_monitor.startEventLoopStallMonitor;
 exports.startHeapWatch = require_child_cap_dispatch.startHeapWatch;
 exports.startRunnerHeapWatch = require_child_cap_dispatch.startRunnerHeapWatch;
 exports.storeMayAnswer = storeMayAnswer;
+exports.storeUploadedCertificate = require_tls$1.storeUploadedCertificate;
 exports.strandedMb = require_child_cap_dispatch.strandedMb;
 exports.stripCamstackDeps = stripCamstackDeps;
 exports.subscribePassthrough = require_child_cap_dispatch.subscribePassthrough;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $n as DATAPLANE_SECRET_HEADER$1, Cr as EventCategory$1, Ft as isCollectionArrayMethod, Ht as lifecycleJobSchema, Kt as logLevelAtMost, Lt as isObjectInput, N as RUNTIME_DEFAULTS, O as METHOD_ACCESS_MAP, Pt as isArrayOutputSchema, Rt as isVoidInput, T as LOG_LEVEL_RANK, W as addonSettingsCapability, Zn as errMsg$1, _r as parseJsonUnknown, ar as asJsonObject$1, br as scopeKey, cn as procedureAuthKey, cr as createEvent, dr as expandCapMethods, er as DEVICE_SETTINGS_CONTRIBUTION_METHODS, gn as resolveMethodAuth, gr as parseJsonObject, kt as extractNestedAddonId, lr as emitDownForOwnedCaps, nn as objectInputDeclaresAddonId, nr as ReadinessRegistry, or as asNumber, qt as looseSchema, rn as objectInputDeclaresRequiredDeviceId, rr as ReadinessTimeoutError, sr as asString$1, t as ALL_CAPABILITY_DEFINITIONS, tr as DEVICE_STATUS_METHOD, vn as scopesAllowAddon, vr as readinessKey, yn as scopesAllowDeviceCap, yr as resolveCapMount, zt as kebabToCamel } from "./dist-B7WRgEZY.mjs";
+import { $n as errMsg$1, Ft as isCollectionArrayMethod, Ht as lifecycleJobSchema, Kt as logLevelAtMost, Lt as isObjectInput, N as RUNTIME_DEFAULTS, O as METHOD_ACCESS_MAP, Pt as isArrayOutputSchema, Rt as isVoidInput, Sr as scopeKey, T as LOG_LEVEL_RANK, Tr as EventCategory$1, W as addonSettingsCapability, _n as resolveMethodAuth, ar as ReadinessTimeoutError, bn as scopesAllowDeviceCap, br as readinessKey, cn as procedureAuthKey, cr as asNumber, dr as emitDownForOwnedCaps, ir as ReadinessRegistry, kt as extractNestedAddonId, lr as asString$1, nn as objectInputDeclaresAddonId, nr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, pr as expandCapMethods, qt as looseSchema, rn as objectInputDeclaresRequiredDeviceId, rr as DEVICE_STATUS_METHOD, sr as asJsonObject$1, t as ALL_CAPABILITY_DEFINITIONS, tr as DATAPLANE_SECRET_HEADER$1, ur as createEvent, vr as parseJsonObject, xr as resolveCapMount, yn as scopesAllowAddon, yr as parseJsonUnknown, zt as kebabToCamel } from "./dist-D3bhbMY3.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -15,7 +15,7 @@ import "./builtins/device-manager/index.mjs";
 import { HubForwarderAddon, HubForwarderDestination } from "./builtins/hub-forwarder/index.mjs";
 import { LivenessMonitorAddon } from "./builtins/liveness-monitor/liveness-monitor.addon.mjs";
 import "./builtins/liveness-monitor/index.mjs";
-import { LocalAuthAddon, a as isSettingsReadUnavailable, c as ApiKeyManager, i as SettingsReadUnavailableError, n as ScopedTokenManager, o as require_ms, r as AuthManager, s as require_safe_buffer, t as UserManager } from "./builtins/local-auth/local-auth.addon.mjs";
+import { LocalAuthAddon, a as AuthManager, c as require_ms, i as ScopedTokenManager, l as require_safe_buffer, n as bootstrapSchema, o as SettingsReadUnavailableError, r as UserManager, s as isSettingsReadUnavailable, t as DEFAULT_DATA_PATH, u as ApiKeyManager } from "./builtins/local-auth/local-auth.addon.mjs";
 import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { t as NativeMetricsProvider } from "./builtins/native-metrics/native-metrics.addon.mjs";
@@ -29,8 +29,8 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as ensureModel, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, g as downloadModel, h as downloadFile, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as deleteModelFromDisk, n as STALL_TICK_MS, o as contentTypeFor, p as collectModelFiles, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as fetchJson, x as isModelDownloaded, y as getModelFilePath } from "./event-loop-stall-monitor-EXjzIxDz.mjs";
-import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DTlVWwAI.mjs";
-import { $ as CapRouteError, $n as EMPTY_CAP_ACTION_READING, $t as RUNNER_RSS_BUDGET_ENV, A as resolveHwAccel, An as OUTBOUND_QUEUE_SUSTAIN_MS, At as DeviceRegistry, B as udsChildLogToWorkerEntry, Bn as createSocketPlaneMeter, Bt as hostNodeIdOf, C as getBrokerEventBus, Cn as HEAP_SPACE_REPORT_MIN_MB, Ct as capActionName, D as subscribePassthrough, Dn as readHeapSpaces, Dt as parseCapAction, E as setNodeEventInterest, En as heapSpaceField, Et as capServiceName, F as ipcParentLink, Fn as createMeshQueueReader, Ft as resolveAddonClass, G as UDS_NO_ROUTE_PREFIX, Gn as EMPTY_SOCKET_DIRECTION, Gt as HEAP_WATCH_INTERVAL_MS, H as createUdsLoggerWithControl, Hn as diffSocketPlane, Ht as HEAP_RECLAIM_MIN_INTERVAL_MS, I as localProviderLink, In as formatMeshQueue, It as buildNpmChildEnv, J as answerClaimedGetStatus, Jn as sampleSocketDirection, Jt as HUB_MAIN_RSS_BUDGET_MB, K as afterWorkerOnlineAnnounce, Kn as createSocketDirectionCounters, Kt as HEAP_WATCH_WARN_RATIO, L as createParentUnownedCallHandler, Ln as EMPTY_SOCKET_PLANE_BASELINE, Lt as resolveNpmInvocation, M as brokerTransportLink, Mn as createOutboundQueueGate, Mt as CapabilityUnavailableError, N as buildLinkChain, Nn as formatOutboundQueueVerdict, Nt as copyBundledNativeModules, O as AddonDepsManager, On as selectReportedSpaces, Ot as deserializeTypedArrays, P as deviceCapResolverLink, Pn as MESH_QUEUE_TOP_N, Pt as installManifestNativeDeps, Q as CapRouteResolver, Qn as CAP_ACTION_UNLABELLED, Qt as RUNNER_HEAP_WATCH_INTERVAL_MS, R as createUdsEventBridge, Rn as SOCKET_PLANE_TOP_N, Rt as runNpm, S as clusterEventTopic, Sn as DECISIVE_HEAP_SPACES, St as NATIVE_PROVIDER_SERVICE_INFIX, T as registerEventBusService, Tn as formatHeapSpaces, Tt as capBareAction, U as LocalChildClient, Un as formatSocketPlane, Ut as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneReader, Vt as createAddonDataPlaneFacility, W as LocalChildRegistry, Wn as readSocketQueues, Wt as HEAP_RECLAIM_TRIGGER_MB, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionMessages, Xt as RSS_BUDGET_REANNOUNCE_MIN_MS, Y as deviceOfGetStatus, Yn as socketDirectionBytes, Yt as HUB_RSS_BUDGET_ENV, Z as AGENT_CAP_FWD_SERVICE, Zn as CAP_ACTION_OVERFLOW_LABEL, Zt as RSS_BUDGET_RELEASE_RATIO, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, a as reapProcessGroup, an as describeRss, ar as createEventPlaneMeter, at as getCapUsageRegistry, b as setHubConnected, bn as formatArrayBufferCensus, bt as createAddonService, c as runnerOwnsProcessGroup, cn as parseRssBudgetMb, cr as formatEventPlane, ct as UdsLocalTransportServer, d as summarizeMembers, dn as startHeapWatch, dt as localEndpointPath, en as ZERO_LOOP_DELAY, er as MAX_CAP_ACTIONS_PER_PEER, et as classifyCapRoute, f as installManifestSystemDeps, fn as startRunnerHeapWatch, ft as FrameDecoder, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ht as createBrokerDeviceManagerApi, in as createV8Reclaimer, ir as EVENT_PLANE_TOP_N, it as __resetCapUsageRegistryForTests, j as brokerCallForCap, jn as OUTBOUND_QUEUE_THRESHOLD_BYTES, jt as CapabilityHandle, k as createKernelHwAccel, kn as OUTBOUND_QUEUE_COOLDOWN_MS, kt as serializeTypedArrays, l as signalAllRunnerGroups, ln as reclaimIntervalMs, lt as SocketChannel, m as adaptBrokerToCluster, mn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, mt as buildNativeCapProxy, nn as createDeferredHeapWatchSink, nr as createCapActionCensus, nt as CapUsageRegistry, o as registerRunnerGroup, on as hubMainRssBudget, or as createEventPlaneReader, ot as createLocalTransport, p as installManifestPythonDeps, pn as strandedMb, pt as encodeFrame, q as GET_STATUS_METHOD, qn as recordSocketFrame, qt as HUB_MAIN_HEAP_WATCH_LABEL, r as defaultProcessGroupOps, rn as createLoopDelayMeter, rr as diffCapActionCensus, rt as PARENT_ROUTED_PROVIDER_ADDON_ID, s as releaseRunnerGroup, sn as nextRssBudgetState, sr as diffEventPlane, st as UdsLocalTransportClient, t as CAP_METHOD_NOT_IMPLEMENTED, tn as buildHeapSample, tr as capActionLabel, tt as callWithServiceDiscovery, un as shouldReclaim, ut as PeerAnsweredError, v as getOrInitReadinessRegistry, vn as createArrayBufferCensusGate, vt as mountNativeCapService, w as getMoleculerEventStats, wn as emitHeapDiagnosticReport, wt as capActionSuffix, x as EVENT_TOPIC_PREFIX, xn as isArrayBufferCensusReport, xt as validateProviderRegistrations, y as getOrInitReadinessRegistryForClient, yn as createInspectorArrayBufferCensus, z as createUdsEventBus, zn as SOCKET_QUEUE_TOP_N, zt as createAddonPeerBytesFacility } from "./child-cap-dispatch-BcRHQBKW.mjs";
+import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-CJHogwTl.mjs";
+import { $ as CapRouteError, $n as EMPTY_CAP_ACTION_READING, $t as RUNNER_RSS_BUDGET_ENV, A as resolveHwAccel, An as OUTBOUND_QUEUE_SUSTAIN_MS, At as DeviceRegistry, B as udsChildLogToWorkerEntry, Bn as createSocketPlaneMeter, Bt as hostNodeIdOf, C as getBrokerEventBus, Cn as HEAP_SPACE_REPORT_MIN_MB, Ct as capActionName, D as subscribePassthrough, Dn as readHeapSpaces, Dt as parseCapAction, E as setNodeEventInterest, En as heapSpaceField, Et as capServiceName, F as ipcParentLink, Fn as createMeshQueueReader, Ft as resolveAddonClass, G as UDS_NO_ROUTE_PREFIX, Gn as EMPTY_SOCKET_DIRECTION, Gt as HEAP_WATCH_INTERVAL_MS, H as createUdsLoggerWithControl, Hn as diffSocketPlane, Ht as HEAP_RECLAIM_MIN_INTERVAL_MS, I as localProviderLink, In as formatMeshQueue, It as buildNpmChildEnv, J as answerClaimedGetStatus, Jn as sampleSocketDirection, Jt as HUB_MAIN_RSS_BUDGET_MB, K as afterWorkerOnlineAnnounce, Kn as createSocketDirectionCounters, Kt as HEAP_WATCH_WARN_RATIO, L as createParentUnownedCallHandler, Ln as EMPTY_SOCKET_PLANE_BASELINE, Lt as resolveNpmInvocation, M as brokerTransportLink, Mn as createOutboundQueueGate, Mt as CapabilityUnavailableError, N as buildLinkChain, Nn as formatOutboundQueueVerdict, Nt as copyBundledNativeModules, O as AddonDepsManager, On as selectReportedSpaces, Ot as deserializeTypedArrays, P as deviceCapResolverLink, Pn as MESH_QUEUE_TOP_N, Pt as installManifestNativeDeps, Q as CapRouteResolver, Qn as CAP_ACTION_UNLABELLED, Qt as RUNNER_HEAP_WATCH_INTERVAL_MS, R as createUdsEventBridge, Rn as SOCKET_PLANE_TOP_N, Rt as runNpm, S as clusterEventTopic, Sn as DECISIVE_HEAP_SPACES, St as NATIVE_PROVIDER_SERVICE_INFIX, T as registerEventBusService, Tn as formatHeapSpaces, Tt as capBareAction, U as LocalChildClient, Un as formatSocketPlane, Ut as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneReader, Vt as createAddonDataPlaneFacility, W as LocalChildRegistry, Wn as readSocketQueues, Wt as HEAP_RECLAIM_TRIGGER_MB, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionMessages, Xt as RSS_BUDGET_REANNOUNCE_MIN_MS, Y as deviceOfGetStatus, Yn as socketDirectionBytes, Yt as HUB_RSS_BUDGET_ENV, Z as AGENT_CAP_FWD_SERVICE, Zn as CAP_ACTION_OVERFLOW_LABEL, Zt as RSS_BUDGET_RELEASE_RATIO, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, a as reapProcessGroup, an as describeRss, ar as createEventPlaneMeter, at as getCapUsageRegistry, b as setHubConnected, bn as formatArrayBufferCensus, bt as createAddonService, c as runnerOwnsProcessGroup, cn as parseRssBudgetMb, cr as formatEventPlane, ct as UdsLocalTransportServer, d as summarizeMembers, dn as startHeapWatch, dt as localEndpointPath, en as ZERO_LOOP_DELAY, er as MAX_CAP_ACTIONS_PER_PEER, et as classifyCapRoute, f as installManifestSystemDeps, fn as startRunnerHeapWatch, ft as FrameDecoder, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ht as createBrokerDeviceManagerApi, in as createV8Reclaimer, ir as EVENT_PLANE_TOP_N, it as __resetCapUsageRegistryForTests, j as brokerCallForCap, jn as OUTBOUND_QUEUE_THRESHOLD_BYTES, jt as CapabilityHandle, k as createKernelHwAccel, kn as OUTBOUND_QUEUE_COOLDOWN_MS, kt as serializeTypedArrays, l as signalAllRunnerGroups, ln as reclaimIntervalMs, lt as SocketChannel, m as adaptBrokerToCluster, mn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, mt as buildNativeCapProxy, nn as createDeferredHeapWatchSink, nr as createCapActionCensus, nt as CapUsageRegistry, o as registerRunnerGroup, on as hubMainRssBudget, or as createEventPlaneReader, ot as createLocalTransport, p as installManifestPythonDeps, pn as strandedMb, pt as encodeFrame, q as GET_STATUS_METHOD, qn as recordSocketFrame, qt as HUB_MAIN_HEAP_WATCH_LABEL, r as defaultProcessGroupOps, rn as createLoopDelayMeter, rr as diffCapActionCensus, rt as PARENT_ROUTED_PROVIDER_ADDON_ID, s as releaseRunnerGroup, sn as nextRssBudgetState, sr as diffEventPlane, st as UdsLocalTransportClient, t as CAP_METHOD_NOT_IMPLEMENTED, tn as buildHeapSample, tr as capActionLabel, tt as callWithServiceDiscovery, un as shouldReclaim, ut as PeerAnsweredError, v as getOrInitReadinessRegistry, vn as createArrayBufferCensusGate, vt as mountNativeCapService, w as getMoleculerEventStats, wn as emitHeapDiagnosticReport, wt as capActionSuffix, x as EVENT_TOPIC_PREFIX, xn as isArrayBufferCensusReport, xt as validateProviderRegistrations, y as getOrInitReadinessRegistryForClient, yn as createInspectorArrayBufferCensus, z as createUdsEventBus, zn as SOCKET_QUEUE_TOP_N, zt as createAddonPeerBytesFacility } from "./child-cap-dispatch-C2dFiu87.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";
@@ -7757,137 +7757,6 @@ function createDoorSettingsView(addonId, door, sections) {
 	};
 }
 //#endregion
-//#region src/kernel/config-schema.ts
-/** Default data directory — used when CAMSTACK_DATA env var is not set */
-var DEFAULT_DATA_PATH = "camstack-data";
-/**
-* A list of browser origins from config.yaml (a YAML list) or from the
-* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
-* only strings). Validation of each entry is the CORS policy's job
-* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
-* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
-*/
-var originListSchema = z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, z.array(z.string()));
-var serverSchema = z.object({
-	port: z.number().default(4443),
-	host: z.string().default("0.0.0.0"),
-	dataPath: z.string().default(DEFAULT_DATA_PATH),
-	/**
-	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
-	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
-	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
-	* who may read hub responses in a browser is a security decision, and the
-	* policy is live from the first request, before the settings store exists.
-	*/
-	corsOrigins: originListSchema.default([])
-});
-var authSchema = z.object({
-	jwtSecret: z.string().nullable().default(null),
-	adminUsername: z.string().default("admin"),
-	adminPassword: z.string().default("changeme")
-});
-var hubSchema = z.object({
-	url: z.string().default("ws://localhost:4443/agent"),
-	token: z.string().default("")
-});
-var agentSchema = z.object({
-	name: z.string().default(""),
-	/** Port for the agent status page (minimal HTML) */
-	statusPort: z.number().default(4444)
-});
-var tlsSchema = z.object({
-	/** Enable HTTPS (default: true) */
-	enabled: z.boolean().default(true),
-	/** Path to custom cert file (PEM). If not set, auto-generates self-signed. */
-	certPath: z.string().optional(),
-	/** Path to custom key file (PEM). Required if certPath is set. */
-	keyPath: z.string().optional()
-});
-/**
-* Bootstrap-time addon configuration — read PURELY from YAML, before the
-* kernel can talk to the settings-store. This breaks the chicken-and-egg
-* where the settings store itself is implemented by an addon: the kernel
-* needs to know WHICH addon to load first to provide the store, and that
-* decision can't itself live in the store.
-*
-* Backward-compatible: every field is optional + defaults reproduce the
-* current hard-coded behavior. Existing config.yaml files keep working.
-*/
-var bootstrapAddonsSchema = z.object({
-	/**
-	* Addon implementing the `settings-store` capability. Loaded FIRST,
-	* before any other addon is enabled — every other addon's enable
-	* state, settings, and ordering lives in the store it provides.
-	*
-	* Default: '@camstack/addon-sqlite-storage' (the workspace's
-	* default SQLite-backed store). Future alternatives could swap this
-	* for postgres/redis without touching kernel code.
-	*/
-	settingsStoreAddon: z.string().default("@camstack/addon-sqlite-storage"),
-	/**
-	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
-	* on startup.
-	*
-	*   - `'npm'`     — pull from the npm registry (production default).
-	*   - `'local'`   — copy `packages/<X>/` from the workspace into
-	*                   `data/addons/<X>/`. Use for the Electron-
-	*                   packaged bundle and the e2e harness.
-	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
-	*                   dir via a directory symlink. Dev-only: a
-	*                   workspace rebuild (`npm run build -w <X>`) is
-	*                   immediately reflected at the next addon load,
-	*                   no copy step. Falls back to `'local'` on
-	*                   platforms that reject symlink creation (Windows
-	*                   without developer-mode).
-	*
-	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
-	* field. Leave undefined to keep the launcher's default behaviour
-	* (npm when no workspace, local when a bundled addons dir is
-	* present, …).
-	*/
-	installSource: z.enum([
-		"npm",
-		"local",
-		"symlink"
-	]).optional(),
-	/**
-	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
-	* Passing an array here REPLACES the default list entirely — useful
-	* for stripped-down deployments (only the bundle of addons the
-	* operator actually wants) and for forcing a different storage
-	* backend at first boot.
-	*
-	* Leave undefined to use the kernel-shipped defaults.
-	*/
-	requiredAddons: z.array(z.string()).optional(),
-	/**
-	* Disable list applied AFTER the settings-store reports the enabled
-	* set. Operator escape hatch — boot without a known-broken addon
-	* without having to mutate the store.
-	*/
-	forceDisable: z.array(z.string()).default([])
-});
-/** Bootstrap config -- loaded from config.yaml ONLY at startup.
-*  All other settings live in SQL (system_settings table). */
-var bootstrapSchema = z.object({
-	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
-	mode: z.enum(["hub", "agent"]).default("hub"),
-	server: serverSchema.default(serverSchema.parse({})),
-	auth: authSchema.default(authSchema.parse({})),
-	/** Hub connection config — only used when mode='agent' */
-	hub: hubSchema.default(hubSchema.parse({})),
-	/** Agent-specific config — only used when mode='agent' */
-	agent: agentSchema.default(agentSchema.parse({})),
-	/** TLS configuration */
-	tls: tlsSchema.default(tlsSchema.parse({})),
-	/**
-	* Addon bootstrap directives — minimum addon set needed before the
-	* kernel can reach the settings-store. See bootstrapAddonsSchema.
-	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
-	*/
-	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({}))
-});
-//#endregion
 //#region ../../node_modules/js-yaml/dist/js-yaml.mjs
 /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */
 var __create = Object.create;
@@ -10250,9 +10119,7 @@ var ENV_VAR_MAP = {
 /** config.yaml, env overrides applied, parsed. */
 function loadBootstrapConfig(configPath) {
 	const merged = applyEnvOverrides(asJsonObject(loadYaml(configPath)) ?? {});
-	const config = bootstrapSchema.parse(merged);
-	warnDefaultCredentials(config);
-	return config;
+	return bootstrapSchema.parse(merged);
 }
 function writeBootstrapSection(configPath, section, data) {
 	if (!BOOTSTRAP_SECTIONS.has(section)) throw new Error(`[ConfigManager] Section "${section}" is a runtime setting — use setSection() to persist via the settings-store, not update() which writes to config.yaml`);
@@ -10350,9 +10217,6 @@ function loadYaml(configPath) {
 	console.log(`[ConfigManager] Loaded config from: ${configPath}`);
 	return parsed;
 }
-function warnDefaultCredentials(config) {
-	if (config.auth.adminPassword === "changeme") console.warn("[ConfigManager] Warning: Using default admin password \"changeme\". Set auth.adminPassword in your config.yaml or the CAMSTACK_ADMIN_PASS env var.");
-}
 //#endregion
 //#region src/kernel/store-settings-view.ts
 function createStoreSettingsView(addonId, cm) {
@@ -96446,4 +96310,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, leafFingerprintOf, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, resolveFilePath, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/config-manager.d.ts

@@ -1,5 +1,5 @@
-import { AppConfig } from './config-schema.js';
 import { FeatureManifest, ISettingsStoreProvider } from '@camstack/types';
+import { AppConfig } from './config-schema.js';
 import { ISettingsStore, KernelAddonSettingsView } from './settings-view-types.js';
 import { SystemSettingsPreload } from './system-settings-mirror.js';
 export type { AddonSettingsView, ISettingsStore, KernelAddonSettingsView, SettingsViewBackend, } from './settings-view-types.js';

package/dist/kernel/config-schema.d.ts

@@ -1,6 +1,11 @@
 import { z } from 'zod';
 /** Default data directory — used when CAMSTACK_DATA env var is not set */
 export declare const DEFAULT_DATA_PATH = "camstack-data";
+/**
+ * The admin password seeded on first boot when none is configured. A SEED
+ * only: it never overwrites an existing account's password (`ensureAdminExists`).
+ */
+export declare const DEFAULT_ADMIN_PASSWORD = "changeme";
 /** Bootstrap config -- loaded from config.yaml ONLY at startup.
  *  All other settings live in SQL (system_settings table). */
 export declare const bootstrapSchema: z.ZodObject<{
@@ -29,14 +34,12 @@ export declare const bootstrapSchema: z.ZodObject<{
     }, z.core.$strip>>;
     tls: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
-        certPath: z.ZodOptional<z.ZodString>;
-        keyPath: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     bootstrap: z.ZodDefault<z.ZodObject<{
         settingsStoreAddon: z.ZodDefault<z.ZodString>;
         installSource: z.ZodOptional<z.ZodEnum<{
-            local: "local";
             npm: "npm";
+            local: "local";
             symlink: "symlink";
         }>>;
         requiredAddons: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/{retired-settings-keys-DKRjfz0U.mjs → retired-settings-keys-B6AFmtlO.mjs}

@@ -1,4 +1,4 @@
-import { ar as asJsonObject } from "./dist-B7WRgEZY.mjs";
+import { sr as asJsonObject } from "./dist-D3bhbMY3.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-CRlTzxaS.js → retired-settings-keys-CkXoPjKy.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CFVOy8VT.js");
+const require_dist = require("./dist-DzAHit0a.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/tls/boot-tls.d.ts

@@ -0,0 +1,29 @@
+import { CertOptions, EnsureTlsResult, TlsCertPair } from './cert-manager.js';
+/** The certificate source a booting listener serves. */
+export type BootTlsMode = 'generated' | 'uploaded';
+export interface BootTls {
+    readonly mode: BootTlsMode;
+    readonly pair: TlsCertPair;
+    /**
+     * The `ensureTlsCert` outcome — present only for a generated certificate,
+     * so a reissue reaches the operator as an alert. `undefined` when an
+     * uploaded certificate is served: the hub never evaluates, let alone
+     * reissues, a certificate the operator supplied.
+     */
+    readonly ensured: EnsureTlsResult | undefined;
+    /**
+     * True when the mode marker said `uploaded` but the files were gone, so
+     * the node fell back to its generated certificate. The caller logs it:
+     * a certificate source that changed under the operator is never silent.
+     */
+    readonly uploadedMissing: boolean;
+}
+/**
+ * Decide what the listener serves at boot. The admin UI (Network → Local
+ * access) is the only way to set a certificate (D726): it either leaves the
+ * hub on its generated local-CA leaf (D227) or uploads one, recorded by the
+ * `tls/mode` marker. An uploaded certificate is served verbatim — running it
+ * through `ensureTlsCert` would replace it on the first restart, because a
+ * leaf the local root did not issue is one of that rule's reissue triggers.
+ */
+export declare function prepareBootTls(dataDir: string, options?: CertOptions): Promise<BootTls>;

package/dist/tls/https-listener.d.ts

@@ -0,0 +1,30 @@
+import { Server as TlsServer } from 'node:tls';
+import { TlsCertPair } from './cert-manager.js';
+export type HttpsReloadOutcome = {
+    readonly kind: 'reloaded';
+    readonly servedLeafFingerprint: string;
+} | {
+    readonly kind: 'no-listener';
+} | {
+    readonly kind: 'failed';
+    readonly error: string;
+};
+/** SHA-256 fingerprint of the first certificate (the leaf) in a PEM chain. */
+export declare function leafFingerprintOf(chain: Buffer | string): string;
+/**
+ * Called once by the server after its HTTPS listener is up, with the pair it
+ * was started on. From here on a certificate action swaps the served
+ * certificate in place (`setSecureContext`) — new handshakes get the new
+ * leaf, open connections keep theirs, nothing restarts.
+ */
+export declare function registerHttpsListener(server: TlsServer, pair: TlsCertPair): void;
+/** Forget the listener — on shutdown, and between specs. */
+export declare function clearHttpsListener(): void;
+/**
+ * The leaf the HTTPS listener serves now, or `null` when this process has no
+ * registered listener (TLS off, or a process that does not own one) — in
+ * which case nobody can say, and `null` is the honest answer.
+ */
+export declare function servedHttpsLeafFingerprint(): string | null;
+/** Serve `pair` from now on. Never throws: the outcome says what happened. */
+export declare function reloadHttpsListener(pair: TlsCertPair): HttpsReloadOutcome;