@camstack/system 1.2.424 → 1.2.426

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B-NmfvVC.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-CGz9u2HD.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
-const require_composition_sources = require("../../composition-sources-BWNs-ZeH.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
+const require_composition_sources = require("../../composition-sources-60tuHQ9N.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as buildCapabilityLookup, Mr as hydrateSchema, Vn as validateComposition, Xn as composedDeviceRef, _n as replacedFieldKeys, bn as resolveCoreBlockEntry, cr as errMsg, ct as coreBlockComposition, d as CORE_BLOCKS_ADDON_ID, dt as coreBlocksCapability, f as CORE_BLOCK_ADDON_PREFIX, fn as planComposition, lr as BaseAddon, lt as coreBlockIdFromAddonId, m as CoreBlockSchema, on as normalizeCoreBlockWrite, ot as compositionSourceRefs, st as coreBlockAddonId, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey, u as COMPOSER_RUNNER_ID, ut as coreBlockSourceKind, x as DeclaredDevices, xn as resolveCoreBlockFiles, yt as describeComposableCaps } from "../../dist-B-NmfvVC.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-tRG7nKWK.mjs";
+import { $ as buildCapabilityLookup, Mr as hydrateSchema, Vn as validateComposition, Xn as composedDeviceRef, _n as replacedFieldKeys, bn as resolveCoreBlockEntry, cr as errMsg, ct as coreBlockComposition, d as CORE_BLOCKS_ADDON_ID, dt as coreBlocksCapability, f as CORE_BLOCK_ADDON_PREFIX, fn as planComposition, lr as BaseAddon, lt as coreBlockIdFromAddonId, m as CoreBlockSchema, on as normalizeCoreBlockWrite, ot as compositionSourceRefs, st as coreBlockAddonId, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey, u as COMPOSER_RUNNER_ID, ut as coreBlockSourceKind, x as DeclaredDevices, xn as resolveCoreBlockFiles, yt as describeComposableCaps } from "../../dist-CGz9u2HD.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-gxVpghXh.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-D62kN_hT.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-Dr2AyhsD.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { $r as toSecretFieldView, Ct as deviceStatusCapability, En as runtimeStatePolicyFor, Et as enumerateSchemaFields, Fr as isKeychainStoredField, Ir as isSecretClear, Kt as legacyAutoLinkIds, Lr as isSecretMarker, N as MINUTES_PER_DAY, Nr as isDeviceConfigCap, Pt as formatMinutes, R as STREAM_PROFILE_META, Rr as isSecretMarkerLike, S as DeviceStatusSchema, St as deviceStateCapability, T as FieldClaimSchema, Tt as enumerateItemArrayFields, Xt as locationIconKey, Yr as secretTreeFromPaths, Zr as sleep$1, _r as SECRET_CLEAR, _t as defineExtensionSlotProvider, ar as DeviceFeature, bt as deviceExtensionCapability, c as CAP_NAMES_WITH_STATUS, cr as errMsg, ei as transformSecretWrite, et as buildStreamParamsConfigSchema, ft as createDeviceExtensionProvider, j as LocationIconIdSchema, jn as siteZoneKey, kt as expandContainer, lr as BaseAddon, o as CAMERA_SWITCH_ORDER, or as DeviceRole, qr as resolveSecretMarkers, sn as normalizeUnit, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, ti as EventCategory, un as parseStreamParamsFormPatch, vr as WELL_KNOWN_TAB_MAP, w as FieldClaimModeSchema, wr as collectZodSecretPaths, xt as deviceManagerCapability, y as DAY_NAMES } from "../../dist-B-NmfvVC.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-DCGEI4Vi.mjs";
+import { $r as toSecretFieldView, Ct as deviceStatusCapability, En as runtimeStatePolicyFor, Et as enumerateSchemaFields, Fr as isKeychainStoredField, Ir as isSecretClear, Kt as legacyAutoLinkIds, Lr as isSecretMarker, N as MINUTES_PER_DAY, Nr as isDeviceConfigCap, Pt as formatMinutes, R as STREAM_PROFILE_META, Rr as isSecretMarkerLike, S as DeviceStatusSchema, St as deviceStateCapability, T as FieldClaimSchema, Tt as enumerateItemArrayFields, Xt as locationIconKey, Yr as secretTreeFromPaths, Zr as sleep$1, _r as SECRET_CLEAR, _t as defineExtensionSlotProvider, ar as DeviceFeature, bt as deviceExtensionCapability, c as CAP_NAMES_WITH_STATUS, cr as errMsg, ei as transformSecretWrite, et as buildStreamParamsConfigSchema, ft as createDeviceExtensionProvider, j as LocationIconIdSchema, jn as siteZoneKey, kt as expandContainer, lr as BaseAddon, o as CAMERA_SWITCH_ORDER, or as DeviceRole, qr as resolveSecretMarkers, sn as normalizeUnit, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, ti as EventCategory, un as parseStreamParamsFormPatch, vr as WELL_KNOWN_TAB_MAP, w as FieldClaimModeSchema, wr as collectZodSecretPaths, xt as deviceManagerCapability, y as DAY_NAMES } from "../../dist-CGz9u2HD.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-Dut6QWh6.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B-NmfvVC.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-CGz9u2HD.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
-const require_jwt_signing_key = require("../../jwt-signing-key-nwRpRgf_.js");
-const require_constants = require("../../constants-BBWZlnpQ.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
+const require_jwt_signing_key = require("../../jwt-signing-key-BdDy9ZJN.js");
+const require_constants = require("../../constants-CO5zpJQY.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { Gt as keychainCapability, O as KEYCHAIN_RESET_TRIGGER_ACTOR, Vr as normalizeSecretOwner, Wr as parseSecretRef, Wt as keychainAdminCapability, jr as formatSecretScope, lr as BaseAddon, ti as EventCategory } from "../../dist-B-NmfvVC.mjs";
-import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-CUpweD22.mjs";
-import { a as MESH_CA_KEY_REF, p as CLUSTER_SECRET_SETTINGS_KEY } from "../../constants-DHhhVjkt.mjs";
+import { Gt as keychainCapability, O as KEYCHAIN_RESET_TRIGGER_ACTOR, Vr as normalizeSecretOwner, Wr as parseSecretRef, Wt as keychainAdminCapability, jr as formatSecretScope, lr as BaseAddon, ti as EventCategory } from "../../dist-CGz9u2HD.mjs";
+import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-C_w5ielw.mjs";
+import { a as MESH_CA_KEY_REF, p as CLUSTER_SECRET_SETTINGS_KEY } from "../../constants-B6YTf0v2.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { F as RECORDING_SOURCE_CAMSTACK_ADDON, I as RecordingStatusSchema, Tr as createEvent, cr as errMsg, lr as BaseAddon, ti as EventCategory } from "../../dist-B-NmfvVC.mjs";
+import { F as RECORDING_SOURCE_CAMSTACK_ADDON, I as RecordingStatusSchema, Tr as createEvent, cr as errMsg, lr as BaseAddon, ti as EventCategory } from "../../dist-CGz9u2HD.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_jwt_signing_key = require("../../jwt-signing-key-nwRpRgf_.js");
+const require_jwt_signing_key = require("../../jwt-signing-key-BdDy9ZJN.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Bn as userManagementCapability, W as UserRecordSchema, Y as authProviderCapability, lr as BaseAddon, r as ApiKeyRecordSchema, z as ScopedTokenSchema } from "../../dist-B-NmfvVC.mjs";
+import { Bn as userManagementCapability, W as UserRecordSchema, Y as authProviderCapability, lr as BaseAddon, r as ApiKeyRecordSchema, z as ScopedTokenSchema } from "../../dist-CGz9u2HD.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { a as loadJwtSigningKey, i as getProcessJwtSigningKeyState, o as processJwtSigningKey, s as setProcessJwtSigningKey, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-CUpweD22.mjs";
+import { a as loadJwtSigningKey, i as getProcessJwtSigningKeyState, o as processJwtSigningKey, s as setProcessJwtSigningKey, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-C_w5ielw.mjs";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/address-book.d.ts

@@ -87,8 +87,29 @@ export interface AddressBookInputs {
 	readonly httpsPalette: readonly ConnectionEndpoint[];
 	readonly appLink: ConnectionEndpoint;
 	readonly appLinkHub: string | null;
+	/** Where the hub's listeners answer (see {@link buildListenerOrigins}). */
+	readonly listenerOrigins: readonly string[];
 }
 /** Every role's answer — the resolvers from `@camstack/types`, nothing else. */
 export declare function resolveRoles(state: AddressBookState, appPalette: readonly ConnectionEndpoint[], httpsPalette: readonly ConnectionEndpoint[]): HubAddressBook["roles"];
 /** The Addresses table: app link, detected rows, then custom-only rows. */
 export declare function buildAddressBook(state: AddressBookState, inputs: AddressBookInputs): HubAddressBook;
+export interface ListenerOriginInputs {
+	/** The palette as the HTTPS listener serves it (`https://<ip>:<httpsPort>`). */
+	readonly overHttps: readonly ConnectionEndpoint[];
+	/** The palette with the LAN HTTP listener on; empty while it is off. */
+	readonly overHttp: readonly ConnectionEndpoint[];
+	readonly custom: readonly CustomAddress[];
+	/** The local name when the hub serves it, over each listener. */
+	readonly localNameOrigins: readonly string[];
+}
+/**
+* Every origin a browser can really reach this hub at: the HTTPS listener's
+* `https://<lan>:<httpsPort>` AND, while the LAN HTTP listener is on,
+* `http://<lan>:<httpPort>`; plus the public and custom addresses. The rows
+* show `http://` only while LAN HTTP is on (native clients skip the private
+* certificate), so the https origin the admin UI is opened at is in no row —
+* a sign-in return (D794) matches against this list instead of falling back
+* to the public endpoint. Never loopback, never the app link.
+*/
+export declare function buildListenerOrigins(inputs: ListenerOriginInputs): readonly string[];

package/dist/builtins/local-network/local-network.addon.d.ts

@@ -119,6 +119,12 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
 	* list because ICE/WebRTC gathers it regardless.
 	*/
 	private buildAdvertisedEndpoints;
+	/**
+	* Where the listeners answer, whatever the rows advertise: the HTTPS
+	* listener's origin per allowlisted LAN address, the HTTP one while it is
+	* on (`http` is the palette that already carries those rows).
+	*/
+	private listenerOriginsNow;
 	/** The DETECTED palette from the cached interface/tunnel/mesh state. */
 	private endpointsNow;
 	protected onInitialize(): Promise<ProviderRegistration[]>;

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
 const require_tls = require("../../tls-BgImdxCO.js");
 let zod = require("zod");
 let node_net = require("node:net");
@@ -228,9 +228,31 @@ function buildAddressBook(state, inputs) {
 			...state.custom.filter((c) => !detectedUrls.has(c.baseUrl)).map((c) => row(customEndpoint(c), false))
 		],
 		roles,
-		appLinkHub: inputs.appLinkHub
+		appLinkHub: inputs.appLinkHub,
+		listenerOrigins: inputs.listenerOrigins
 	};
 }
+var ORIGIN_KINDS = new Set([
+	"lan-ipv4",
+	"lan-ipv6",
+	"public"
+]);
+/**
+* Every origin a browser can really reach this hub at: the HTTPS listener's
+* `https://<lan>:<httpsPort>` AND, while the LAN HTTP listener is on,
+* `http://<lan>:<httpPort>`; plus the public and custom addresses. The rows
+* show `http://` only while LAN HTTP is on (native clients skip the private
+* certificate), so the https origin the admin UI is opened at is in no row —
+* a sign-in return (D794) matches against this list instead of falling back
+* to the public endpoint. Never loopback, never the app link.
+*/
+function buildListenerOrigins(inputs) {
+	const out = /* @__PURE__ */ new Set();
+	for (const e of [...inputs.overHttps, ...inputs.overHttp]) if (ORIGIN_KINDS.has(e.kind)) out.add(e.baseUrl);
+	for (const c of inputs.custom) out.add(c.baseUrl);
+	for (const o of inputs.localNameOrigins) out.add(o);
+	return [...out];
+}
 //#endregion
 //#region src/builtins/local-network/ipv6-lan.ts
 /**
@@ -616,11 +638,14 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	/** `getAddresses`: the Addresses table and every role's answer. */
 	async addressBook(scheme) {
 		const { http, https } = await this.palettes();
-		return buildAddressBook(this.addressState([...http, ...https]), {
+		const state = this.addressState([...http, ...https]);
+		const httpsPort = (await this.resolveAdvertisedListenPort(null)).port;
+		return buildAddressBook(state, {
 			rowsPalette: scheme === "http" ? http : https,
 			httpsPalette: https,
 			appLink: appLinkEndpoint(),
-			appLinkHub: require_dist.pickAppLinkHub(https)
+			appLinkHub: require_dist.pickAppLinkHub(https),
+			listenerOrigins: this.listenerOriginsNow(state, http, httpsPort)
 		});
 	}
 	/**
@@ -711,17 +736,33 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		const detected = this.endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort);
 		return withAppConnectionCustomEndpoints(detected, this.addressState(detected));
 	}
+	/**
+	* Where the listeners answer, whatever the rows advertise: the HTTPS
+	* listener's origin per allowlisted LAN address, the HTTP one while it is
+	* on (`http` is the palette that already carries those rows).
+	*/
+	listenerOriginsNow(state, http, httpsPort) {
+		const httpListening = this.config.httpEnabled !== false && require_tls.readLanHttpState().listening;
+		const hostname = this.config.localHostname || null;
+		const localNameOrigins = hostname === null ? [] : [`https://${hostname}:${httpsPort}`, ...httpListening ? [`http://${hostname}:${this.resolvedHttpPort()}`] : []];
+		return buildListenerOrigins({
+			overHttps: this.endpointsNow(false, false, "https", httpsPort, false),
+			overHttp: httpListening ? http : [],
+			custom: state.custom,
+			localNameOrigins
+		});
+	}
 	/** The DETECTED palette from the cached interface/tunnel/mesh state. */
-	endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort) {
+	endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort, advertiseLanHttp = true) {
 		const interfaces = applyAllowlist(this.enumerate(), this.config.allowedAddresses);
 		const httpState = require_tls.readLanHttpState();
-		return buildEndpoints(interfaces, httpsPort, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, {
+		return buildEndpoints(interfaces, httpsPort, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, advertiseLanHttp ? {
 			enabled: this.config.httpEnabled !== false,
 			listening: httpState.listening,
 			httpPort: this.resolvedHttpPort(),
 			httpsPort,
 			localHostname: this.config.localHostname || null
-		});
+		} : null);
 	}
 	async onInitialize() {
 		if (!this.config.bootSeeded) {

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { D as HUB_MDNS_TXT_KEYS, E as HUB_MDNS_SERVICE_TYPE, Hn as validateCustomAddress, It as isAppLinkBase, Sn as resolveHubAddressRoles, Tn as resolveNotificationTapAddress, Yt as localNetworkCapability, dn as pickAppLinkHub, lr as BaseAddon, rt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, ti as EventCategory, vn as resolveAppConnections, zt as isDefaultAppConnectionEndpoint } from "../../dist-B-NmfvVC.mjs";
+import { D as HUB_MDNS_TXT_KEYS, E as HUB_MDNS_SERVICE_TYPE, Hn as validateCustomAddress, It as isAppLinkBase, Sn as resolveHubAddressRoles, Tn as resolveNotificationTapAddress, Yt as localNetworkCapability, dn as pickAppLinkHub, lr as BaseAddon, rt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, ti as EventCategory, vn as resolveAppConnections, zt as isDefaultAppConnectionEndpoint } from "../../dist-CGz9u2HD.mjs";
 import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-CaOLZ09W.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
@@ -226,9 +226,31 @@ function buildAddressBook(state, inputs) {
 			...state.custom.filter((c) => !detectedUrls.has(c.baseUrl)).map((c) => row(customEndpoint(c), false))
 		],
 		roles,
-		appLinkHub: inputs.appLinkHub
+		appLinkHub: inputs.appLinkHub,
+		listenerOrigins: inputs.listenerOrigins
 	};
 }
+var ORIGIN_KINDS = new Set([
+	"lan-ipv4",
+	"lan-ipv6",
+	"public"
+]);
+/**
+* Every origin a browser can really reach this hub at: the HTTPS listener's
+* `https://<lan>:<httpsPort>` AND, while the LAN HTTP listener is on,
+* `http://<lan>:<httpPort>`; plus the public and custom addresses. The rows
+* show `http://` only while LAN HTTP is on (native clients skip the private
+* certificate), so the https origin the admin UI is opened at is in no row —
+* a sign-in return (D794) matches against this list instead of falling back
+* to the public endpoint. Never loopback, never the app link.
+*/
+function buildListenerOrigins(inputs) {
+	const out = /* @__PURE__ */ new Set();
+	for (const e of [...inputs.overHttps, ...inputs.overHttp]) if (ORIGIN_KINDS.has(e.kind)) out.add(e.baseUrl);
+	for (const c of inputs.custom) out.add(c.baseUrl);
+	for (const o of inputs.localNameOrigins) out.add(o);
+	return [...out];
+}
 //#endregion
 //#region src/builtins/local-network/ipv6-lan.ts
 /**
@@ -614,11 +636,14 @@ var LocalNetworkAddon = class extends BaseAddon {
 	/** `getAddresses`: the Addresses table and every role's answer. */
 	async addressBook(scheme) {
 		const { http, https } = await this.palettes();
-		return buildAddressBook(this.addressState([...http, ...https]), {
+		const state = this.addressState([...http, ...https]);
+		const httpsPort = (await this.resolveAdvertisedListenPort(null)).port;
+		return buildAddressBook(state, {
 			rowsPalette: scheme === "http" ? http : https,
 			httpsPalette: https,
 			appLink: appLinkEndpoint(),
-			appLinkHub: pickAppLinkHub(https)
+			appLinkHub: pickAppLinkHub(https),
+			listenerOrigins: this.listenerOriginsNow(state, http, httpsPort)
 		});
 	}
 	/**
@@ -709,17 +734,33 @@ var LocalNetworkAddon = class extends BaseAddon {
 		const detected = this.endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort);
 		return withAppConnectionCustomEndpoints(detected, this.addressState(detected));
 	}
+	/**
+	* Where the listeners answer, whatever the rows advertise: the HTTPS
+	* listener's origin per allowlisted LAN address, the HTTP one while it is
+	* on (`http` is the palette that already carries those rows).
+	*/
+	listenerOriginsNow(state, http, httpsPort) {
+		const httpListening = this.config.httpEnabled !== false && readLanHttpState().listening;
+		const hostname = this.config.localHostname || null;
+		const localNameOrigins = hostname === null ? [] : [`https://${hostname}:${httpsPort}`, ...httpListening ? [`http://${hostname}:${this.resolvedHttpPort()}`] : []];
+		return buildListenerOrigins({
+			overHttps: this.endpointsNow(false, false, "https", httpsPort, false),
+			overHttp: httpListening ? http : [],
+			custom: state.custom,
+			localNameOrigins
+		});
+	}
 	/** The DETECTED palette from the cached interface/tunnel/mesh state. */
-	endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort) {
+	endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort, advertiseLanHttp = true) {
 		const interfaces = applyAllowlist(this.enumerate(), this.config.allowedAddresses);
 		const httpState = readLanHttpState();
-		return buildEndpoints(interfaces, httpsPort, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, {
+		return buildEndpoints(interfaces, httpsPort, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, advertiseLanHttp ? {
 			enabled: this.config.httpEnabled !== false,
 			listening: httpState.listening,
 			httpPort: this.resolvedHttpPort(),
 			httpsPort,
 			localHostname: this.config.localHostname || null
-		});
+		} : null);
 	}
 	async onInitialize() {
 		if (!this.config.bootSeeded) {

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B-NmfvVC.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-CGz9u2HD.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Nt as foldSnapshotByFunction, Tr as createEvent, cr as errMsg, gn as reducePoints, lr as BaseAddon, rn as metricsProviderCapability, ti as EventCategory, yn as resolveBucketMs } from "../../dist-B-NmfvVC.mjs";
+import { Nt as foldSnapshotByFunction, Tr as createEvent, cr as errMsg, gn as reducePoints, lr as BaseAddon, rn as metricsProviderCapability, ti as EventCategory, yn as resolveBucketMs } from "../../dist-CGz9u2HD.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";
 import { platform } from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { cr as errMsg, kn as scoreRuntimes, kr as emitReadiness, lr as BaseAddon, pn as platformProbeCapability, ti as EventCategory, wt as enumerateInferenceDevices } from "../../dist-B-NmfvVC.mjs";
+import { cr as errMsg, kn as scoreRuntimes, kr as emitReadiness, lr as BaseAddon, pn as platformProbeCapability, ti as EventCategory, wt as enumerateInferenceDevices } from "../../dist-CGz9u2HD.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { lr as BaseAddon, ti as EventCategory } from "../../dist-B-NmfvVC.mjs";
+import { lr as BaseAddon, ti as EventCategory } from "../../dist-CGz9u2HD.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Br as nodePin, Mn as snapshotCapability, Q as batteryCapability, Rn as streamQualityLabel, Z as bareAddonId, a as BatteryStatusSchema, ar as DeviceFeature, cr as errMsg, lr as BaseAddon, nn as memoizePinnedFfmpeg, sr as DeviceType, ti as EventCategory, vt as deriveBatteryPresence } from "../../dist-B-NmfvVC.mjs";
+import { Br as nodePin, Mn as snapshotCapability, Q as batteryCapability, Rn as streamQualityLabel, Z as bareAddonId, a as BatteryStatusSchema, ar as DeviceFeature, cr as errMsg, lr as BaseAddon, nn as memoizePinnedFfmpeg, sr as DeviceType, ti as EventCategory, vt as deriveBatteryPresence } from "../../dist-CGz9u2HD.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/database-snapshot-provider.d.ts

@@ -0,0 +1,18 @@
+import type { DatabaseSnapshotRequest, DatabaseSnapshotTargets, DatabaseSnapshotWritten, IDatabaseSnapshotProvider } from "@camstack/types";
+import type { OwnedSqliteFile } from "./owned-sqlite-file.js";
+/** What the provider needs from an owned file. */
+export type SnapshotableFile = Pick<OwnedSqliteFile, "databaseId" | "livePath" | "snapshot">;
+/** What the provider needs from the placement router. */
+export interface OpenFileSource {
+	openFiles(): readonly SnapshotableFile[];
+}
+export declare class DatabaseSnapshotProvider implements IDatabaseSnapshotProvider {
+	private readonly source;
+	/** Same database asked twice: the second call joins the first. */
+	private readonly inFlight;
+	/** Different databases run one after the other: the disk reserve check is per copy. */
+	private tail;
+	constructor(source: OpenFileSource);
+	listDatabases(): Promise<DatabaseSnapshotTargets>;
+	writeSnapshot(input: DatabaseSnapshotRequest): Promise<DatabaseSnapshotWritten>;
+}

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { In as storageProviderCapability, Mt as filesystemBrowseCapability, lr as BaseAddon } from "../../dist-B-NmfvVC.mjs";
+import { In as storageProviderCapability, Mt as filesystemBrowseCapability, lr as BaseAddon } from "../../dist-CGz9u2HD.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-BzdCQGjH.js");
+const require_wal_maintenance = require("../../wal-maintenance-Bzm3O2Nj.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-BlqNqaQ3.mjs";
+import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-BZhzoxqA.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CiUKtVkX.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-D62kN_hT.js");
-const require_wal_maintenance = require("../../wal-maintenance-BzdCQGjH.js");
+const require_dist = require("../../dist-K3WFop9Q.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-Dr2AyhsD.js");
+const require_wal_maintenance = require("../../wal-maintenance-Bzm3O2Nj.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");
@@ -969,6 +969,51 @@ async function openOwnedSqliteFile(spec, deps) {
 	return file;
 }
 //#endregion
+//#region src/builtins/sqlite-storage/database-snapshot-provider.ts
+/**
+* The `database-snapshot` provider of the SQLite engine: every owned database
+* file it has open is listed, and each is snapshotted through its OWN
+* connection (D679, D693) — never by copying files.
+*
+* The list is read from the router at CALL time, not at boot: a file created at
+* runtime (the first declaration that names `events` or `history`) is listed
+* from the moment it opens, so no backup can leave it out.
+*/
+var DatabaseSnapshotProvider = class {
+	source;
+	/** Same database asked twice: the second call joins the first. */
+	inFlight = /* @__PURE__ */ new Map();
+	/** Different databases run one after the other: the disk reserve check is per copy. */
+	tail = Promise.resolve();
+	constructor(source) {
+		this.source = source;
+	}
+	async listDatabases() {
+		return { databases: this.source.openFiles().map((file) => ({
+			databaseId: file.databaseId,
+			livePath: node_path.default.resolve(file.livePath)
+		})) };
+	}
+	writeSnapshot(input) {
+		const running = this.inFlight.get(input.databaseId);
+		if (running !== void 0) return running;
+		const file = this.source.openFiles().find((f) => f.databaseId === input.databaseId);
+		if (file === void 0) return Promise.reject(/* @__PURE__ */ new Error(`database snapshot refused: database "${input.databaseId}" is not open`));
+		const run = this.tail.catch(() => void 0).then(async () => {
+			return {
+				...await file.snapshot(),
+				databaseId: file.databaseId
+			};
+		});
+		this.tail = run;
+		const tracked = run.finally(() => {
+			this.inFlight.delete(input.databaseId);
+		});
+		this.inFlight.set(input.databaseId, tracked);
+		return tracked;
+	}
+};
+//#endregion
 //#region src/builtins/sqlite-storage/placement-router.ts
 function scopedName(namespace, collection) {
 	return namespace ? `${namespace}:${collection}` : collection;
@@ -1344,10 +1389,7 @@ var SqliteSettingsAddon = class extends require_dist.BaseAddon {
 			},
 			{
 				capability: require_dist.databaseSnapshotCapability,
-				provider: {
-					listDatabases: async () => ({ databases: [{ livePath: node_path.default.resolve(settings.livePath) }] }),
-					writeSnapshot: async () => settings.snapshot()
-				}
+				provider: new DatabaseSnapshotProvider(router)
 			}
 		];
 	}