camstack 1.2.36 → 1.2.38

package/dist/{chunk-V75HN7AE.js → chunk-UYHYTS5M.js}

@@ -14522,7 +14522,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-zMxKWD0M.mjs
+// ../types/dist/sleep-B8EIZt4h.mjs
 var WELL_KNOWN_TABS = [
   {
     id: "overview",
@@ -27017,6 +27017,13 @@ var CameraStatusSchema = external_exports.object({
   /** Unix timestamp (ms) when this snapshot was composed server-side. */
   fetchedAt: external_exports.number()
 });
+var INFERENCE_DEVICE_EXCLUSION_REASONS = [
+  "disabled",
+  "unavailable",
+  "cannot-host-camera-root",
+  "accelerator-preferred"
+];
+var InferenceDeviceExclusionReasonSchema = external_exports.enum(INFERENCE_DEVICE_EXCLUSION_REASONS);
 var NodeInferenceDeviceSchema = external_exports.object({
   /** Stable per-node device key, e.g. `openvino:npu`, `edgetpu:usb`, `cpu`. */
   key: external_exports.string(),
@@ -27047,7 +27054,17 @@ var NodeInferenceDeviceSchema = external_exports.object({
   * available per format; this is the stored selection that becomes the
   * default for EVERY camera landing on this accelerator.
   */
-  steps: external_exports.record(external_exports.string(), DeviceStepConfigSchema).optional()
+  steps: external_exports.record(external_exports.string(), DeviceStepConfigSchema).optional(),
+  /**
+  * `null` when the device IS a camera-root candidate on this node; otherwise
+  * the reason the dispatcher drops it. Computed by the SAME
+  * `resolveInferenceDeviceEligibility` the dispatcher runs, so this view can
+  * never disagree with the election — deriving it in the UI from
+  * `enabled`/`available` would silently miss `cannot-host-camera-root` (needs
+  * the node's model catalog) and `accelerator-preferred` (needs the node-wide
+  * "an accelerator is serving" predicate).
+  */
+  exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
 var NodeInferenceDevicesSchema = external_exports.object({
   nodeId: external_exports.string(),
@@ -32057,7 +32074,35 @@ var ConnectionEndpointSchema = external_exports.object({
   */
   priority: external_exports.number()
 });
-var GetConnectionEndpointsResultSchema = external_exports.object({ endpoints: external_exports.array(ConnectionEndpointSchema).readonly() });
+var LocalPortSourceEnum = external_exports.enum([
+  "server-config",
+  "server-env",
+  "caller-hint",
+  "default"
+]);
+var AdvertisedLocalPortSchema = external_exports.object({
+  port: external_exports.number().int().min(1).max(65535),
+  source: LocalPortSourceEnum
+});
+var GetConnectionEndpointsResultSchema = external_exports.object({
+  endpoints: external_exports.array(ConnectionEndpointSchema).readonly(),
+  /**
+  * The port the hub built the LAN/loopback URLs with, and where that number
+  * came from.
+  *
+  * Returned rather than merely applied, because "the URL is right" and "the
+  * client can KNOW the URL is right" are different properties. A client that
+  * only sees a corrected URL cannot distinguish a hub that fixed the port from
+  * a hub that echoed the port the client sent, so it cannot decide whether to
+  * race the candidate or discard it. With `source` it can: anything but
+  * `caller-hint` is the hub's own socket.
+  *
+  * Absent on hubs predating this field — a client that finds it missing is
+  * talking to an echoing hub and must degrade exactly as it does for
+  * `caller-hint`.
+  */
+  localPort: AdvertisedLocalPortSchema
+});
 var NotificationEndpointSchema = external_exports.object({
   /** The operator's explicit choice, or null for AUTO. */
   baseUrl: external_exports.string().nullable(),
@@ -32099,10 +32144,35 @@ var localNetworkCapability = {
     * Honours `getAllowedAddresses()` when set — addresses outside
     * the allowlist are dropped (the public tunnel + loopback are
     * always included as escape hatches).
+    *
+    * **The port is the hub's, not the caller's** (D62 — a function's fact
+    * belongs to whoever already owns it). This method used to take a `port`
+    * and echo it onto every LAN and loopback URL it advertised, which made
+    * every client a second authority on a socket only the hub binds. A viewer
+    * configured with a port-less public URL (`https://camstack.example.top`)
+    * infers 443 from the scheme, asks with 443, and was handed
+    * `https://192.168.1.9:443` for a hub listening on 4443. That candidate
+    * cannot ever answer, and losing its race reads in the log exactly like
+    * "the LAN was tried and it was slower" — so an operator sitting on his own
+    * WiFi stayed on the public tunnel for weeks, with the LAN candidate born
+    * dead on every single connect.
+    *
+    * The hub now resolves its own listen port and reports it as `localPort`,
+    * with the SOURCE of the number, so a client can tell a fact from an echo.
+    *
+    * Out of scope on purpose: a LAN URL that is not the hub's own socket (a
+    * reverse proxy in front of it on another port) is not this method's to
+    * invent either — pin it with `setNotificationEndpoint` / a configured
+    * origin, which is an operator statement rather than a guess.
     */
     getConnectionEndpoints: method(external_exports.object({
-      /** Local hub HTTP port to use in base URLs. */
-      port: external_exports.number().int().min(1).max(65535),
+      /**
+      * LEGACY HINT — do not send from new code. Kept optional so clients
+      * written against the echoing contract keep working; the hub uses it
+      * only when it cannot read its own port, and says so via
+      * `localPort.source === 'caller-hint'`.
+      */
+      port: external_exports.number().int().min(1).max(65535).optional(),
       /** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
       *  candidate. Default `true`. */
       includeLoopback: external_exports.boolean().optional(),
@@ -36593,6 +36663,7 @@ var BATTERY_DEVICE_PROFILE = {
   settings: {}
 };
 var BATTERY_UNREACHABLE_AFTER_MS = 360 * 6e4;
+var OPERATOR_WRITTEN_STALE_MS = 10 * 6e4;
 var METHOD_ACCESS_MAP = Object.freeze({
   "accessories.setChildHidden": {
     capName: "accessories",

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runDiscover
-} from "./chunk-V75HN7AE.js";
+} from "./chunk-UYHYTS5M.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/cli.ts
@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-OXQ3W5WV.js");
+  await import("./launcher-SCKDFMNR.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-OXQ3W5WV.js");
+  await import("./launcher-SCKDFMNR.js");
 }
 
 // src/commands/setup.ts
@@ -1130,7 +1130,7 @@ function isUnknown(_value) {
   return true;
 }
 async function resolveServerInteractive(presetNamespace) {
-  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-FXX2XNDX.js");
+  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-5NNX7OG3.js");
   if (presetNamespace) {
     const spinner4 = clack.spinner();
     spinner4.start(`Discovering hub on LAN (namespace "${presetNamespace}")`);

package/dist/{discover-FXX2XNDX.js → discover-5NNX7OG3.js}

@@ -5,7 +5,7 @@ import {
   filterHubNodes,
   resolveHubFromDiscovered,
   runDiscover
-} from "./chunk-V75HN7AE.js";
+} from "./chunk-UYHYTS5M.js";
 import "./chunk-LMMQX4CK.js";
 export {
   DEFAULT_HUB_HTTPS_PORT,

package/dist/{launcher-OXQ3W5WV.js → launcher-SCKDFMNR.js}

@@ -23631,9 +23631,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-B2CtwVW2.js
-var require_dist_B2CtwVW2 = __commonJS({
-  "../system/dist/dist-B2CtwVW2.js"(exports) {
+// ../system/dist/dist-iAwSA2_f.js
+var require_dist_iAwSA2_f = __commonJS({
+  "../system/dist/dist-iAwSA2_f.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -23641,6 +23641,7 @@ var require_dist_B2CtwVW2 = __commonJS({
       EventCategory2["SystemAddonsReady"] = "system.addons-ready";
       EventCategory2["SystemRestarting"] = "system.restarting";
       EventCategory2["SystemRestartCompleted"] = "system.restart-completed";
+      EventCategory2["SystemTlsCertChanged"] = "system.tls-cert-changed";
       EventCategory2["UpdateAvailable"] = "update.available";
       EventCategory2["SystemReadyState"] = "system.ready-state";
       EventCategory2["AddonStarted"] = "addon.started";
@@ -37300,6 +37301,12 @@ var require_dist_B2CtwVW2 = __commonJS({
       /** Unix timestamp (ms) when this snapshot was composed server-side. */
       fetchedAt: zod.z.number()
     });
+    var InferenceDeviceExclusionReasonSchema = zod.z.enum([
+      "disabled",
+      "unavailable",
+      "cannot-host-camera-root",
+      "accelerator-preferred"
+    ]);
     var NodeInferenceDeviceSchema = zod.z.object({
       /** Stable per-node device key, e.g. `openvino:npu`, `edgetpu:usb`, `cpu`. */
       key: zod.z.string(),
@@ -37330,7 +37337,17 @@ var require_dist_B2CtwVW2 = __commonJS({
       * available per format; this is the stored selection that becomes the
       * default for EVERY camera landing on this accelerator.
       */
-      steps: zod.z.record(zod.z.string(), DeviceStepConfigSchema).optional()
+      steps: zod.z.record(zod.z.string(), DeviceStepConfigSchema).optional(),
+      /**
+      * `null` when the device IS a camera-root candidate on this node; otherwise
+      * the reason the dispatcher drops it. Computed by the SAME
+      * `resolveInferenceDeviceEligibility` the dispatcher runs, so this view can
+      * never disagree with the election — deriving it in the UI from
+      * `enabled`/`available` would silently miss `cannot-host-camera-root` (needs
+      * the node's model catalog) and `accelerator-preferred` (needs the node-wide
+      * "an accelerator is serving" predicate).
+      */
+      exclusion: InferenceDeviceExclusionReasonSchema.nullable()
     });
     var NodeInferenceDevicesSchema = zod.z.object({
       nodeId: zod.z.string(),
@@ -42339,7 +42356,35 @@ var require_dist_B2CtwVW2 = __commonJS({
       */
       priority: zod.z.number()
     });
-    var GetConnectionEndpointsResultSchema = zod.z.object({ endpoints: zod.z.array(ConnectionEndpointSchema).readonly() });
+    var LocalPortSourceEnum = zod.z.enum([
+      "server-config",
+      "server-env",
+      "caller-hint",
+      "default"
+    ]);
+    var AdvertisedLocalPortSchema = zod.z.object({
+      port: zod.z.number().int().min(1).max(65535),
+      source: LocalPortSourceEnum
+    });
+    var GetConnectionEndpointsResultSchema = zod.z.object({
+      endpoints: zod.z.array(ConnectionEndpointSchema).readonly(),
+      /**
+      * The port the hub built the LAN/loopback URLs with, and where that number
+      * came from.
+      *
+      * Returned rather than merely applied, because "the URL is right" and "the
+      * client can KNOW the URL is right" are different properties. A client that
+      * only sees a corrected URL cannot distinguish a hub that fixed the port from
+      * a hub that echoed the port the client sent, so it cannot decide whether to
+      * race the candidate or discard it. With `source` it can: anything but
+      * `caller-hint` is the hub's own socket.
+      *
+      * Absent on hubs predating this field — a client that finds it missing is
+      * talking to an echoing hub and must degrade exactly as it does for
+      * `caller-hint`.
+      */
+      localPort: AdvertisedLocalPortSchema
+    });
     var NotificationEndpointSchema = zod.z.object({
       /** The operator's explicit choice, or null for AUTO. */
       baseUrl: zod.z.string().nullable(),
@@ -42381,10 +42426,35 @@ var require_dist_B2CtwVW2 = __commonJS({
         * Honours `getAllowedAddresses()` when set — addresses outside
         * the allowlist are dropped (the public tunnel + loopback are
         * always included as escape hatches).
+        *
+        * **The port is the hub's, not the caller's** (D62 — a function's fact
+        * belongs to whoever already owns it). This method used to take a `port`
+        * and echo it onto every LAN and loopback URL it advertised, which made
+        * every client a second authority on a socket only the hub binds. A viewer
+        * configured with a port-less public URL (`https://camstack.example.top`)
+        * infers 443 from the scheme, asks with 443, and was handed
+        * `https://192.168.1.9:443` for a hub listening on 4443. That candidate
+        * cannot ever answer, and losing its race reads in the log exactly like
+        * "the LAN was tried and it was slower" — so an operator sitting on his own
+        * WiFi stayed on the public tunnel for weeks, with the LAN candidate born
+        * dead on every single connect.
+        *
+        * The hub now resolves its own listen port and reports it as `localPort`,
+        * with the SOURCE of the number, so a client can tell a fact from an echo.
+        *
+        * Out of scope on purpose: a LAN URL that is not the hub's own socket (a
+        * reverse proxy in front of it on another port) is not this method's to
+        * invent either — pin it with `setNotificationEndpoint` / a configured
+        * origin, which is an operator statement rather than a guess.
         */
         getConnectionEndpoints: method(zod.z.object({
-          /** Local hub HTTP port to use in base URLs. */
-          port: zod.z.number().int().min(1).max(65535),
+          /**
+          * LEGACY HINT — do not send from new code. Kept optional so clients
+          * written against the echoing contract keep working; the hub uses it
+          * only when it cannot read its own port, and says so via
+          * `localPort.source === 'caller-hint'`.
+          */
+          port: zod.z.number().int().min(1).max(65535).optional(),
           /** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
           *  candidate. Default `true`. */
           includeLoopback: zod.z.boolean().optional(),
@@ -56186,7 +56256,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -56238,6 +56308,10 @@ var require_alerts_addon = __commonJS({
         severity: "warning",
         titleTemplate: "System restarting"
       },
+      "system.tls-cert-changed": {
+        severity: "warning",
+        titleTemplate: "TLS certificate changed"
+      },
       "device.registered": {
         severity: "info",
         titleTemplate: "Device registered"
@@ -56726,6 +56800,8 @@ var require_alerts_addon = __commonJS({
             return `Storage critical for device "${deviceId ?? "unknown"}"`;
           case "system.boot":
             return `System booted in "${data.mode ?? "unknown"}" mode`;
+          case "system.tls-cert-changed":
+            return data.caRotated === true ? `TLS certificate reissued (${String(data.reason)}) \u2014 the local CA also changed. Re-install ${String(data.caCertPath)} on any device that trusted the old one.` : `TLS certificate reissued (${String(data.reason)}) \u2014 the local CA is unchanged, previously trusted devices keep working.`;
           case "process.crashed":
             return `Process "${processId ?? "unknown"}" crashed`;
           default:
@@ -56999,7 +57075,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -57093,7 +57169,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -57990,11 +58066,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-CYDGGkyM.js
-var require_retired_settings_keys_CYDGGkyM = __commonJS({
-  "../system/dist/retired-settings-keys-CYDGGkyM.js"(exports) {
+// ../system/dist/retired-settings-keys-OfhqQio4.js
+var require_retired_settings_keys_OfhqQio4 = __commonJS({
+  "../system/dist/retired-settings-keys-OfhqQio4.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -60037,8 +60113,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
-    var require_retired_settings_keys = require_retired_settings_keys_CYDGGkyM();
+    var require_dist10 = require_dist_iAwSA2_f();
+    var require_retired_settings_keys = require_retired_settings_keys_OfhqQio4();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -64365,7 +64441,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -64502,7 +64578,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -64692,7 +64768,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -72376,7 +72452,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -72941,7 +73017,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     var node_child_process = __require("child_process");
     var node_util = __require("util");
     var node_os = __require("os");
@@ -73883,7 +73959,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -74999,8 +75075,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
-    var require_retired_settings_keys = require_retired_settings_keys_CYDGGkyM();
+    var require_dist10 = require_dist_iAwSA2_f();
+    var require_retired_settings_keys = require_retired_settings_keys_OfhqQio4();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -76544,7 +76620,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -78423,7 +78499,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -96484,7 +96560,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -97472,15 +97548,16 @@ var require_file_data_plane_DUHPHa_Y = __commonJS({
   }
 });
 
-// ../types/dist/event-category-CRPORAAz.js
-var require_event_category_CRPORAAz = __commonJS({
-  "../types/dist/event-category-CRPORAAz.js"(exports) {
+// ../types/dist/event-category-EY0GNjV9.js
+var require_event_category_EY0GNjV9 = __commonJS({
+  "../types/dist/event-category-EY0GNjV9.js"(exports) {
     "use strict";
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
       EventCategory2["SystemBoot"] = "system.boot";
       EventCategory2["SystemAddonsReady"] = "system.addons-ready";
       EventCategory2["SystemRestarting"] = "system.restarting";
       EventCategory2["SystemRestartCompleted"] = "system.restart-completed";
+      EventCategory2["SystemTlsCertChanged"] = "system.tls-cert-changed";
       EventCategory2["UpdateAvailable"] = "update.available";
       EventCategory2["SystemReadyState"] = "system.ready-state";
       EventCategory2["AddonStarted"] = "addon.started";
@@ -97638,11 +97715,11 @@ var require_event_category_CRPORAAz = __commonJS({
   }
 });
 
-// ../types/dist/sleep-CMRLJj2e.js
-var require_sleep_CMRLJj2e = __commonJS({
-  "../types/dist/sleep-CMRLJj2e.js"(exports) {
+// ../types/dist/sleep-C2XhJhkd.js
+var require_sleep_C2XhJhkd = __commonJS({
+  "../types/dist/sleep-C2XhJhkd.js"(exports) {
     "use strict";
-    var require_event_category = require_event_category_CRPORAAz();
+    var require_event_category = require_event_category_EY0GNjV9();
     var zod = require_zod();
     var WELL_KNOWN_TABS = [
       {
@@ -101079,8 +101156,8 @@ var require_addon = __commonJS({
   "../types/dist/addon.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_CRPORAAz();
-    var require_sleep = require_sleep_CMRLJj2e();
+    var require_event_category = require_event_category_EY0GNjV9();
+    var require_sleep = require_sleep_C2XhJhkd();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -107954,9 +108031,9 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-MA_BZGBz.js
-var require_manifest_python_deps_MA_BZGBz = __commonJS({
-  "../system/dist/manifest-python-deps-MA_BZGBz.js"(exports) {
+// ../system/dist/manifest-python-deps-CwBbX4Ut.js
+var require_manifest_python_deps_CwBbX4Ut = __commonJS({
+  "../system/dist/manifest-python-deps-CwBbX4Ut.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
     var node_crypto = __require("crypto");
@@ -107977,8 +108054,8 @@ var require_manifest_python_deps_MA_BZGBz = __commonJS({
     var node_vm = __require("vm");
     node_vm = require_chunk.__toESM(node_vm);
     var _camstack_types_addon = require_addon();
-    var _trpc_client = require_dist2();
     var node_net = __require("net");
+    var _trpc_client = require_dist2();
     var HEAP_WATCH_INTERVAL_MS = 6e4;
     var HEAP_WATCH_WARN_RATIO = 0.8;
     var HEAP_WATCH_ESCALATE_RATIO = 0.7;
@@ -118760,7 +118837,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_B2CtwVW2();
+    var require_dist10 = require_dist_iAwSA2_f();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -118785,7 +118862,7 @@ var require_dist3 = __commonJS({
     require_system_config();
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DUHPHa_Y();
-    var require_manifest_python_deps = require_manifest_python_deps_MA_BZGBz();
+    var require_manifest_python_deps = require_manifest_python_deps_CwBbX4Ut();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -118806,6 +118883,7 @@ var require_dist3 = __commonJS({
     var node_vm = __require("vm");
     node_vm = require_chunk.__toESM(node_vm);
     var _camstack_types_addon = require_addon();
+    var node_net = __require("net");
     var node_url = __require("url");
     var node_events = __require("events");
     var node_stream = __require("stream");
@@ -120570,63 +120648,330 @@ var require_dist3 = __commonJS({
         };
       }
     };
-    var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
-    async function ensureTlsCert(dataDir, options) {
-      const tlsDir = (0, node_path.join)(dataDir, "tls");
-      const certPath = (0, node_path.join)(tlsDir, "camstack.crt");
-      const keyPath = (0, node_path.join)(tlsDir, "camstack.key");
-      if ((0, node_fs.existsSync)(certPath) && (0, node_fs.existsSync)(keyPath)) try {
-        const x509 = new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath));
-        if (new Date(x509.validTo) > /* @__PURE__ */ new Date()) return {
-          certPath,
-          keyPath,
-          generated: false
-        };
+    var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+    var MAX_LEAF_VALIDITY_DAYS = 397;
+    var LEAF_RENEWAL_WINDOW_DAYS = 30;
+    var CA_VALIDITY_DAYS = 3650;
+    var MS_PER_DAY = 864e5;
+    var REASONS_REQUIRING_NEW_CA = [
+      "missing",
+      "unreadable",
+      "no-local-ca",
+      "ca-expiring"
+    ];
+    function reasonRequiresNewCa(reason) {
+      return REASONS_REQUIRING_NEW_CA.includes(reason);
+    }
+    function parse$1(pem) {
+      try {
+        return new node_crypto.X509Certificate(pem);
       } catch {
+        return null;
       }
-      (0, node_fs.mkdirSync)(tlsDir, { recursive: true });
-      const cn = options?.commonName ?? "camstack.local";
-      const validDays = options?.validDays ?? 825;
-      const sanDns = /* @__PURE__ */ new Set([
+    }
+    function daysBetween(from, to) {
+      return (to.getTime() - from.getTime()) / MS_PER_DAY;
+    }
+    function hasServerAuthEku(leaf) {
+      const eku = leaf.keyUsage;
+      return eku !== void 0 && eku.length === 1 && eku[0] === "1.3.6.1.5.5.7.3.1";
+    }
+    function keyMatches(leaf, keyPem) {
+      try {
+        return leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem));
+      } catch {
+        return false;
+      }
+    }
+    function coversIdentity(leaf, identity) {
+      for (const name2 of identity.requiredDnsNames) if (leaf.checkHost(name2) === void 0) return false;
+      for (const ip of identity.requiredIpAddresses) if (leaf.checkIP(ip) === void 0) return false;
+      return true;
+    }
+    function evaluateExistingCert(input) {
+      const leaf = parse$1(input.chainPem);
+      const ca = parse$1(input.caPem);
+      if (leaf === null || ca === null) return "unreadable";
+      if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
+      if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
+      if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
+      if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
+      if (leaf.ca || !leaf.checkIssued(ca) || !leaf.verify(ca.publicKey)) return "not-issued-by-local-ca";
+      if (daysBetween(new Date(leaf.validFrom), new Date(leaf.validTo)) > 398) return "validity-too-long";
+      if (!coversIdentity(leaf, input.identity)) return "san-coverage-gap";
+      return null;
+    }
+    var VOLATILE_INTERFACE_PREFIXES = [
+      "docker",
+      "br-",
+      "veth",
+      "virbr",
+      "cni",
+      "flannel",
+      "tun",
+      "utun",
+      "tap",
+      "wg",
+      "zt",
+      "tailscale",
+      "ppp",
+      "awdl",
+      "llw"
+    ];
+    var DNS_NAME_PATTERN = /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+    function isIpv4(value) {
+      return (0, node_net.isIP)(value) === 4;
+    }
+    function isIpv6(value) {
+      return (0, node_net.isIP)(value) === 6;
+    }
+    function isLinkLocal(value) {
+      if (isIpv4(value)) return value.startsWith("169.254.");
+      if (!isIpv6(value)) return false;
+      const firstGroup = value.split(":")[0] ?? "";
+      if (firstGroup === "") return false;
+      const parsed = Number.parseInt(firstGroup, 16);
+      return Number.isFinite(parsed) && (parsed & 65472) === 65152;
+    }
+    function isUniqueLocalIpv6(value) {
+      if (!isIpv6(value)) return false;
+      const firstGroup = value.split(":")[0] ?? "";
+      const parsed = Number.parseInt(firstGroup, 16);
+      return Number.isFinite(parsed) && (parsed & 65024) === 64512;
+    }
+    function isVolatileInterface(name2) {
+      const lower = name2.toLowerCase();
+      return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
+    }
+    function isStableGateAddress(address) {
+      if (isLinkLocal(address)) return false;
+      if (isIpv4(address)) return true;
+      return isUniqueLocalIpv6(address);
+    }
+    function addSan(dns, ips, value) {
+      const trimmed = value.trim();
+      if (trimmed === "") return;
+      if ((0, node_net.isIP)(trimmed) !== 0) {
+        if (!isLinkLocal(trimmed)) ips.add(trimmed);
+        return;
+      }
+      if (DNS_NAME_PATTERN.test(trimmed)) dns.add(trimmed);
+    }
+    function collectCertIdentity(options) {
+      const dnsNames = /* @__PURE__ */ new Set();
+      const ipAddresses = /* @__PURE__ */ new Set(["127.0.0.1", "::1"]);
+      const requiredDnsNames = /* @__PURE__ */ new Set();
+      const requiredIpAddresses = /* @__PURE__ */ new Set(["127.0.0.1"]);
+      for (const name2 of [
         "localhost",
-        cn,
+        options.commonName,
         node_os.hostname()
-      ]);
-      const sanIps = /* @__PURE__ */ new Set(["127.0.0.1", "::1"]);
-      const interfaces = node_os.networkInterfaces();
-      for (const addrs of Object.values(interfaces)) {
-        if (!addrs) continue;
-        for (const addr of addrs) if (!addr.internal) sanIps.add(addr.address);
-      }
-      for (const san of options?.extraSans ?? []) if (san.match(/^\d+\.\d+\.\d+\.\d+$/) || san.includes(":")) sanIps.add(san);
-      else sanDns.add(san);
-      const sanParts = [];
-      for (const dns of sanDns) sanParts.push(`DNS:${dns}`);
-      for (const ip of sanIps) sanParts.push(`IP:${ip}`);
-      const sanString = sanParts.join(",");
+      ]) {
+        addSan(dnsNames, ipAddresses, name2);
+        addSan(requiredDnsNames, requiredIpAddresses, name2);
+      }
+      for (const [ifaceName, addrs] of Object.entries(node_os.networkInterfaces())) for (const addr of addrs ?? []) {
+        if (addr.internal) continue;
+        if (isLinkLocal(addr.address)) continue;
+        ipAddresses.add(addr.address);
+        if (isVolatileInterface(ifaceName)) continue;
+        if (isStableGateAddress(addr.address)) requiredIpAddresses.add(addr.address);
+      }
+      for (const san of options.extraSans) {
+        addSan(dnsNames, ipAddresses, san);
+        addSan(requiredDnsNames, requiredIpAddresses, san);
+      }
+      return {
+        dnsNames: [...dnsNames],
+        ipAddresses: [...ipAddresses],
+        requiredDnsNames: [...requiredDnsNames],
+        requiredIpAddresses: [...requiredIpAddresses]
+      };
+    }
+    var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
+    var CA_COMMON_NAME = "CamStack Local CA";
+    function sanValue(identity) {
+      const parts = [];
+      for (const dns of identity.dnsNames) parts.push(`DNS:${dns}`);
+      for (const ip of identity.ipAddresses) if ((0, node_net.isIP)(ip) !== 0) parts.push(`IP:${ip}`);
+      return parts.join(",");
+    }
+    async function generateCa(tmpDir) {
+      const caCertPath = (0, node_path.join)(tmpDir, "ca.crt");
+      const caKeyPath = (0, node_path.join)(tmpDir, "ca.key");
       await execFileAsync$3("openssl", [
         "req",
         "-x509",
         "-newkey",
         "rsa:2048",
+        "-nodes",
+        "-sha256",
+        "-days",
+        String(CA_VALIDITY_DAYS),
+        "-keyout",
+        caKeyPath,
+        "-out",
+        caCertPath,
+        "-subj",
+        `/CN=${CA_COMMON_NAME}`,
+        "-addext",
+        "basicConstraints=critical,CA:TRUE,pathlen:0",
+        "-addext",
+        "keyUsage=critical,keyCertSign,cRLSign",
+        "-addext",
+        "subjectKeyIdentifier=hash"
+      ]);
+      await (0, node_fs_promises.chmod)(caKeyPath, 384);
+      return {
+        caCertPath,
+        caKeyPath
+      };
+    }
+    async function issueLeaf(tmpDir, ca, identity, commonName, validDays) {
+      const keyPath = (0, node_path.join)(tmpDir, "leaf.key");
+      const csrPath = (0, node_path.join)(tmpDir, "leaf.csr");
+      const certPath = (0, node_path.join)(tmpDir, "leaf.crt");
+      const extPath = (0, node_path.join)(tmpDir, "leaf.ext");
+      await (0, node_fs_promises.writeFile)(extPath, [
+        "basicConstraints=critical,CA:FALSE",
+        "keyUsage=critical,digitalSignature,keyEncipherment",
+        "extendedKeyUsage=serverAuth",
+        "subjectKeyIdentifier=hash",
+        "authorityKeyIdentifier=keyid,issuer",
+        `subjectAltName=${sanValue(identity)}`,
+        ""
+      ].join("\n"), "utf-8");
+      await execFileAsync$3("openssl", [
+        "req",
+        "-new",
+        "-newkey",
+        "rsa:2048",
+        "-nodes",
+        "-sha256",
         "-keyout",
         keyPath,
         "-out",
-        certPath,
+        csrPath,
+        "-subj",
+        `/CN=${commonName}`
+      ]);
+      await execFileAsync$3("openssl", [
+        "x509",
+        "-req",
+        "-in",
+        csrPath,
+        "-CA",
+        ca.caCertPath,
+        "-CAkey",
+        ca.caKeyPath,
+        "-set_serial",
+        `0x00${(0, node_crypto.randomBytes)(16).toString("hex")}`,
         "-days",
         String(validDays),
-        "-nodes",
-        "-subj",
-        `/CN=${cn}`,
-        "-addext",
-        `subjectAltName=${sanString}`
+        "-sha256",
+        "-extfile",
+        extPath,
+        "-out",
+        certPath
       ]);
-      const { chmod } = await import("fs/promises");
-      await chmod(keyPath, 384);
+      await (0, node_fs_promises.chmod)(keyPath, 384);
+      await (0, node_fs_promises.rm)(csrPath, { force: true });
+      await (0, node_fs_promises.rm)(extPath, { force: true });
       return {
         certPath,
-        keyPath,
-        generated: true
+        keyPath
+      };
+    }
+    var DEFAULT_COMMON_NAME = "camstack.local";
+    async function ensureTlsCert(dataDir, options) {
+      const tlsDir = (0, node_path.join)(dataDir, "tls");
+      const paths = {
+        certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
+        keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
+        caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
+        caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
+      };
+      const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+      const validDays = Math.min(options?.validDays ?? 397, 397);
+      const identity = collectCertIdentity({
+        commonName,
+        extraSans: options?.extraSans ?? []
+      });
+      const reason = decideRegeneration(paths, identity);
+      if (reason === null) return describe(paths, false, null, false, null);
+      const previousFingerprint = readFingerprint(paths.certPath);
+      const caRotated = reasonRequiresNewCa(reason);
+      (0, node_fs.mkdirSync)(tlsDir, { recursive: true });
+      await regenerate(paths, identity, commonName, validDays, caRotated);
+      return describe(paths, true, reason, caRotated, previousFingerprint);
+    }
+    function readFingerprint(certPath) {
+      try {
+        return new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath)).fingerprint256;
+      } catch {
+        return null;
+      }
+    }
+    function decideRegeneration(paths, identity) {
+      if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return "missing";
+      if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return "no-local-ca";
+      try {
+        return evaluateExistingCert({
+          chainPem: (0, node_fs.readFileSync)(paths.certPath, "utf-8"),
+          keyPem: (0, node_fs.readFileSync)(paths.keyPath, "utf-8"),
+          caPem: (0, node_fs.readFileSync)(paths.caCertPath, "utf-8"),
+          identity,
+          now: /* @__PURE__ */ new Date()
+        });
+      } catch {
+        return "unreadable";
+      }
+    }
+    async function regenerate(paths, identity, commonName, validDays, newCa) {
+      const scratch = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "camstack-tls-"));
+      try {
+        const ca = newCa ? await generateCa(scratch) : {
+          caCertPath: paths.caCertPath,
+          caKeyPath: paths.caKeyPath
+        };
+        const leaf = await issueLeaf(scratch, ca, identity, commonName, validDays);
+        const chainPath = (0, node_path.join)(scratch, "chain.crt");
+        await (0, node_fs_promises.writeFile)(chainPath, `${(0, node_fs.readFileSync)(leaf.certPath, "utf-8").trimEnd()}
+${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
+`, "utf-8");
+        if (newCa) {
+          await (0, node_fs_promises.copyFile)(ca.caCertPath, `${paths.caCertPath}.new`);
+          await (0, node_fs_promises.copyFile)(ca.caKeyPath, `${paths.caKeyPath}.new`);
+          (0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
+          (0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
+          await (0, node_fs_promises.chmod)(paths.caKeyPath, 384);
+        }
+        await (0, node_fs_promises.copyFile)(leaf.keyPath, `${paths.keyPath}.new`);
+        await (0, node_fs_promises.copyFile)(chainPath, `${paths.certPath}.new`);
+        (0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
+        (0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
+        await (0, node_fs_promises.chmod)(paths.keyPath, 384);
+      } finally {
+        await (0, node_fs_promises.rm)(scratch, {
+          recursive: true,
+          force: true
+        });
+      }
+    }
+    function describe(paths, generated, reason, caRotated, previousFingerprintSha256) {
+      const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
+      const ca = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath));
+      const san = leaf.subjectAltName ?? "";
+      return {
+        ...paths,
+        generated,
+        reason,
+        caRotated,
+        fingerprintSha256: leaf.fingerprint256,
+        previousFingerprintSha256,
+        caFingerprintSha256: ca.fingerprint256,
+        validTo: new Date(leaf.validTo).toISOString(),
+        sans: san === "" ? [] : san.split(", ")
       };
     }
     function loadTlsCert(certPath, keyPath) {
@@ -198906,6 +199251,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.AlertCenterAddon = require_builtins_alerts_alerts_addon.AlertCenterAddon;
     exports.ApiKeyManager = require_builtins_local_auth_local_auth_addon.ApiKeyManager;
     exports.AuthManager = require_builtins_local_auth_local_auth_addon.AuthManager;
+    exports.CA_COMMON_NAME = CA_COMMON_NAME;
+    exports.CA_VALIDITY_DAYS = CA_VALIDITY_DAYS;
     exports.CLUSTER_SECRET_MISMATCH_TYPE = CLUSTER_SECRET_MISMATCH_TYPE;
     exports.CLUSTER_SECRET_REJECTED_EXIT_CODE = CLUSTER_SECRET_REJECTED_EXIT_CODE;
     exports.CORE_CAP_SERVICE_NAME = CORE_CAP_SERVICE_NAME;
@@ -198952,6 +199299,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.INFRA_CAPABILITIES = INFRA_CAPABILITIES;
     exports.IntegrationRegistry = IntegrationRegistry;
     exports.JobJournal = JobJournal;
+    exports.LEAF_RENEWAL_WINDOW_DAYS = LEAF_RENEWAL_WINDOW_DAYS;
     exports.LifecycleJobEngine = LifecycleJobEngine;
     exports.LifecycleStateMachine = LifecycleStateMachine;
     exports.LivenessMonitorAddon = require_builtins_liveness_monitor_liveness_monitor_addon.LivenessMonitorAddon;
@@ -198962,6 +199310,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.LogRingBuffer = LogRingBuffer;
     exports.LokiDestination = require_builtins_loki_logging_index.LokiDestination$1;
     exports.LokiLoggingAddon = require_builtins_loki_logging_index.LokiLoggingAddon$1;
+    exports.MAX_LEAF_VALIDITY_DAYS = MAX_LEAF_VALIDITY_DAYS;
     exports.METHOD_ACCESS_MAP = require_dist10.METHOD_ACCESS_MAP;
     exports.ModelDownloadService = require_file_data_plane.ModelDownloadService;
     exports.NATIVE_PROVIDER_SERVICE_INFIX = require_manifest_python_deps.NATIVE_PROVIDER_SERVICE_INFIX;
@@ -198987,6 +199336,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.ReadinessTimeoutError = require_dist10.ReadinessTimeoutError;
     exports.ReplEngine = ReplEngine;
     exports.RingBuffer = RingBuffer;
+    exports.SERVER_AUTH_OID = SERVER_AUTH_OID;
     exports.ScopedLogger = ScopedLogger;
     exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
     exports.SocketChannel = require_manifest_python_deps.SocketChannel;
@@ -199038,6 +199388,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.clearPendingRestart = clearPendingRestart;
     exports.clusterEventTopic = require_manifest_python_deps.clusterEventTopic;
     exports.clusterSecretMatches = clusterSecretMatches;
+    exports.collectCertIdentity = collectCertIdentity;
     exports.collectModelFiles = require_file_data_plane.collectModelFiles;
     exports.contentTypeFor = require_file_data_plane.contentTypeFor;
     exports.copyDirRecursive = copyDirRecursive;
@@ -199104,6 +199455,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       }
     });
     exports.ensureTlsCert = ensureTlsCert;
+    exports.evaluateExistingCert = evaluateExistingCert;
     exports.expandCapMethods = require_dist10.expandCapMethods;
     exports.fetchJson = require_file_data_plane.fetchJson;
     Object.defineProperty(exports, "findInPath", {
@@ -237867,7 +238219,7 @@ var require_enums = __commonJS({
   "../types/dist/enums.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_CRPORAAz();
+    var require_event_category = require_event_category_EY0GNjV9();
     var EventSourceType = /* @__PURE__ */ (function(EventSourceType2) {
       EventSourceType2["Addon"] = "addon";
       EventSourceType2["Core"] = "core";
@@ -237887,8 +238239,8 @@ var require_dist9 = __commonJS({
   "../types/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_CRPORAAz();
-    var require_sleep = require_sleep_CMRLJj2e();
+    var require_event_category = require_event_category_EY0GNjV9();
+    var require_sleep = require_sleep_C2XhJhkd();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -252258,6 +252610,13 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** Unix timestamp (ms) when this snapshot was composed server-side. */
       fetchedAt: zod.z.number()
     });
+    var INFERENCE_DEVICE_EXCLUSION_REASONS = [
+      "disabled",
+      "unavailable",
+      "cannot-host-camera-root",
+      "accelerator-preferred"
+    ];
+    var InferenceDeviceExclusionReasonSchema = zod.z.enum(INFERENCE_DEVICE_EXCLUSION_REASONS);
     var NodeInferenceDeviceSchema = zod.z.object({
       /** Stable per-node device key, e.g. `openvino:npu`, `edgetpu:usb`, `cpu`. */
       key: zod.z.string(),
@@ -252288,7 +252647,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * available per format; this is the stored selection that becomes the
       * default for EVERY camera landing on this accelerator.
       */
-      steps: zod.z.record(zod.z.string(), DeviceStepConfigSchema).optional()
+      steps: zod.z.record(zod.z.string(), DeviceStepConfigSchema).optional(),
+      /**
+      * `null` when the device IS a camera-root candidate on this node; otherwise
+      * the reason the dispatcher drops it. Computed by the SAME
+      * `resolveInferenceDeviceEligibility` the dispatcher runs, so this view can
+      * never disagree with the election — deriving it in the UI from
+      * `enabled`/`available` would silently miss `cannot-host-camera-root` (needs
+      * the node's model catalog) and `accelerator-preferred` (needs the node-wide
+      * "an accelerator is serving" predicate).
+      */
+      exclusion: InferenceDeviceExclusionReasonSchema.nullable()
     });
     var NodeInferenceDevicesSchema = zod.z.object({
       nodeId: zod.z.string(),
@@ -257320,7 +257689,35 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       priority: zod.z.number()
     });
-    var GetConnectionEndpointsResultSchema = zod.z.object({ endpoints: zod.z.array(ConnectionEndpointSchema).readonly() });
+    var LocalPortSourceEnum = zod.z.enum([
+      "server-config",
+      "server-env",
+      "caller-hint",
+      "default"
+    ]);
+    var AdvertisedLocalPortSchema = zod.z.object({
+      port: zod.z.number().int().min(1).max(65535),
+      source: LocalPortSourceEnum
+    });
+    var GetConnectionEndpointsResultSchema = zod.z.object({
+      endpoints: zod.z.array(ConnectionEndpointSchema).readonly(),
+      /**
+      * The port the hub built the LAN/loopback URLs with, and where that number
+      * came from.
+      *
+      * Returned rather than merely applied, because "the URL is right" and "the
+      * client can KNOW the URL is right" are different properties. A client that
+      * only sees a corrected URL cannot distinguish a hub that fixed the port from
+      * a hub that echoed the port the client sent, so it cannot decide whether to
+      * race the candidate or discard it. With `source` it can: anything but
+      * `caller-hint` is the hub's own socket.
+      *
+      * Absent on hubs predating this field — a client that finds it missing is
+      * talking to an echoing hub and must degrade exactly as it does for
+      * `caller-hint`.
+      */
+      localPort: AdvertisedLocalPortSchema
+    });
     var NotificationEndpointSchema = zod.z.object({
       /** The operator's explicit choice, or null for AUTO. */
       baseUrl: zod.z.string().nullable(),
@@ -257362,10 +257759,35 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * Honours `getAllowedAddresses()` when set — addresses outside
         * the allowlist are dropped (the public tunnel + loopback are
         * always included as escape hatches).
+        *
+        * **The port is the hub's, not the caller's** (D62 — a function's fact
+        * belongs to whoever already owns it). This method used to take a `port`
+        * and echo it onto every LAN and loopback URL it advertised, which made
+        * every client a second authority on a socket only the hub binds. A viewer
+        * configured with a port-less public URL (`https://camstack.example.top`)
+        * infers 443 from the scheme, asks with 443, and was handed
+        * `https://192.168.1.9:443` for a hub listening on 4443. That candidate
+        * cannot ever answer, and losing its race reads in the log exactly like
+        * "the LAN was tried and it was slower" — so an operator sitting on his own
+        * WiFi stayed on the public tunnel for weeks, with the LAN candidate born
+        * dead on every single connect.
+        *
+        * The hub now resolves its own listen port and reports it as `localPort`,
+        * with the SOURCE of the number, so a client can tell a fact from an echo.
+        *
+        * Out of scope on purpose: a LAN URL that is not the hub's own socket (a
+        * reverse proxy in front of it on another port) is not this method's to
+        * invent either — pin it with `setNotificationEndpoint` / a configured
+        * origin, which is an operator statement rather than a guess.
         */
         getConnectionEndpoints: require_sleep.method(zod.z.object({
-          /** Local hub HTTP port to use in base URLs. */
-          port: zod.z.number().int().min(1).max(65535),
+          /**
+          * LEGACY HINT — do not send from new code. Kept optional so clients
+          * written against the echoing contract keep working; the hub uses it
+          * only when it cannot read its own port, and says so via
+          * `localPort.source === 'caller-hint'`.
+          */
+          port: zod.z.number().int().min(1).max(65535).optional(),
           /** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
           *  candidate. Default `true`. */
           includeLoopback: zod.z.boolean().optional(),
@@ -263609,10 +264031,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       } };
     }
     var LAST_FETCHED_FIELD = "lastFetchedAt";
+    var RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS = 6e4;
+    var OPERATOR_WRITTEN_STALE_MS = 10 * 6e4;
     function createRuntimeStateBridge(params) {
       const { runtimeState, cap, ownDeviceId, refresh, staleMs, empty, logger } = params;
       const missCooldownMs = params.refreshMissCooldownMs ?? 6e4;
+      const staleRead = params.staleRead ?? "await-refresh";
       let missCooldownUntil = 0;
+      let refreshInFlight = null;
       const readFetchedAt = () => {
         const value = runtimeState.getCapState(cap.name)?.[LAST_FETCHED_FIELD];
         return typeof value === "number" ? value : 0;
@@ -263627,14 +264053,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           }
         });
       };
-      const ensureFresh = async () => {
-        const slice = runtimeState.getCapState(cap.name);
-        const fetchedAt = readFetchedAt();
-        if (slice && Date.now() - fetchedAt <= staleMs) {
-          missCooldownUntil = 0;
-          return;
-        }
-        if (Date.now() < missCooldownUntil) return;
+      const runRefresh = async (fetchedAt) => {
         try {
           await refresh();
         } catch (err) {
@@ -263650,6 +264069,34 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         }
         openMissCooldown(void 0);
       };
+      const startRefresh = (fetchedAt) => {
+        const existing = refreshInFlight;
+        if (existing !== null) return existing;
+        const started = runRefresh(fetchedAt).catch(() => void 0).finally(() => {
+          refreshInFlight = null;
+        });
+        refreshInFlight = started;
+        return started;
+      };
+      const ensureFresh = async () => {
+        const slice = runtimeState.getCapState(cap.name);
+        const fetchedAt = readFetchedAt();
+        if (slice && Date.now() - fetchedAt <= staleMs) {
+          missCooldownUntil = 0;
+          return;
+        }
+        if (Date.now() < missCooldownUntil) return;
+        if (staleRead === "serve-and-revalidate") {
+          if (refreshInFlight !== null) return;
+          if (slice && fetchedAt > 0) {
+            startRefresh(fetchedAt);
+            return;
+          }
+          await startRefresh(fetchedAt);
+          return;
+        }
+        await runRefresh(fetchedAt);
+      };
       const projectStatus = () => {
         const slice = runtimeState.getCapState(cap.name);
         if (!slice) return empty();
@@ -277087,6 +277534,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.HumidifierStatusSchema = HumidifierStatusSchema;
     exports.HumiditySensorStatusSchema = HumiditySensorStatusSchema;
     exports.HvacModeSchema = HvacModeSchema;
+    exports.INFERENCE_DEVICE_EXCLUSION_REASONS = INFERENCE_DEVICE_EXCLUSION_REASONS;
     exports.ImageContractSchema = ImageContractSchema;
     exports.ImageContractStateSchema = ImageContractStateSchema;
     exports.ImageRotateSchema = ImageRotateSchema;
@@ -277094,6 +277542,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.ImageSettingsPatchSchema = ImageSettingsPatchSchema;
     exports.ImageSettingsStatusSchema = ImageSettingsStatusSchema;
     exports.ImageStatusSchema = ImageStatusSchema;
+    exports.InferenceDeviceExclusionReasonSchema = InferenceDeviceExclusionReasonSchema;
     exports.IngestOwnerSchema = IngestOwnerSchema;
     exports.InstalledPackageSchema = InstalledPackageSchema;
     exports.IntegrationLiteSchema = IntegrationLiteSchema;
@@ -277306,6 +277755,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.NotificationSchema = NotificationSchema;
     exports.NotifierStatusSchema = NotifierStatusSchema;
     exports.NumericSensorStatusSchema = NumericSensorStatusSchema;
+    exports.OPERATOR_WRITTEN_STALE_MS = OPERATOR_WRITTEN_STALE_MS;
     exports.OPS_LOG_DEFAULT_LIMIT = OPS_LOG_DEFAULT_LIMIT;
     exports.OPS_LOG_RING_DEFAULT_MAX = OPS_LOG_RING_DEFAULT_MAX;
     exports.OauthIntegrationDescriptorSchema = OauthIntegrationDescriptorSchema;
@@ -277388,6 +277838,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.RESTORED_CAP_NAMES = RESTORED_CAP_NAMES;
     exports.RUNTIME_DEFAULTS = RUNTIME_DEFAULTS;
     exports.RUNTIME_STATE_POLICY = RUNTIME_STATE_POLICY;
+    exports.RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS = RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS;
     exports.RUNTIME_TO_FORMAT = RUNTIME_TO_FORMAT;
     exports.RawStateResultSchema = require_sleep.RawStateResultSchema;
     exports.ReadGopBytesResultSchema = ReadGopBytesResultSchema;
@@ -399226,7 +399677,7 @@ var require_post_boot_service = __commonJS({
         return entry.payload;
       }
       async run(context) {
-        const { port, host, dataPath, trpcRegistered } = context;
+        const { port, host, dataPath, trpcRegistered, tlsCert } = context;
         this.eventBus.emit({
           id: (0, node_crypto_1.randomUUID)(),
           timestamp: /* @__PURE__ */ new Date(),
@@ -399235,6 +399686,7 @@ var require_post_boot_service = __commonJS({
           data: { port, host, trpcRegistered, dataPath }
         });
         this.emitRestartCompletedIfPending(dataPath);
+        this.emitTlsCertChangedIfReissued(tlsCert);
         await this.reconcileLifecycleJobsIfAny();
       }
       async reconcileLifecycleJobsIfAny() {
@@ -399243,6 +399695,27 @@ var require_post_boot_service = __commonJS({
           this.logger.info("Lifecycle jobs reconciled at boot", { meta: { resumed, failed } });
         }
       }
+      emitTlsCertChangedIfReissued(tlsCert) {
+        if (tlsCert === void 0 || !tlsCert.generated)
+          return;
+        const payload = {
+          reason: tlsCert.reason ?? "unknown",
+          fingerprintSha256: tlsCert.fingerprintSha256,
+          caFingerprintSha256: tlsCert.caFingerprintSha256,
+          caRotated: tlsCert.caRotated,
+          caCertPath: tlsCert.caCertPath,
+          validTo: tlsCert.validTo,
+          sans: tlsCert.sans
+        };
+        this.logger.warn("TLS certificate reissued", { meta: payload });
+        this.eventBus.emit({
+          id: (0, node_crypto_1.randomUUID)(),
+          timestamp: /* @__PURE__ */ new Date(),
+          source: { type: "core", id: "system" },
+          category: types_1.EventCategory.SystemTlsCertChanged,
+          data: payload
+        });
+      }
       emitRestartCompletedIfPending(dataDir) {
         const marker = (0, system_1.readPendingRestart)(dataDir);
         if (marker === null)
@@ -401812,11 +402285,11 @@ var require_boot_config = __commonJS({
     exports.loadBootstrapConfig = loadBootstrapConfig;
     exports.autoGenerateJwtSecret = autoGenerateJwtSecret;
     exports.setupInfra = setupInfra;
+    var node_crypto_1 = __require("crypto");
     var fs = __importStar(__require("fs"));
     var path = __importStar(__require("path"));
-    var yaml = __importStar(require_js_yaml());
-    var node_crypto_1 = __require("crypto");
     var types_1 = require_dist9();
+    var yaml = __importStar(require_js_yaml());
     var config_schema_1 = require_config_schema();
     var storage_location_manager_1 = require_storage_location_manager();
     var CONFIG_DEFAULTS = {
@@ -401936,6 +402409,7 @@ var require_boot_config = __commonJS({
         console.log(`[Phase2] Location "${name}": ${available ? "OK" : "UNAVAILABLE"} \u2192 ${locPath}`);
       }
       let tlsOptions;
+      let tlsCert;
       if (config.tls.enabled) {
         const core = require_dist3();
         const { ensureTlsCert, loadTlsCert } = core;
@@ -401945,11 +402419,8 @@ var require_boot_config = __commonJS({
           tlsOptions = { key: pair.key, cert: pair.cert };
         } else {
           const tlsResult = await ensureTlsCert(dataPath);
-          if (tlsResult.generated) {
-            console.log(`[Phase2c] Generated self-signed TLS cert at ${tlsResult.certPath}`);
-          } else {
-            console.log(`[Phase2c] Using existing TLS cert at ${tlsResult.certPath}`);
-          }
+          tlsCert = tlsResult;
+          logTlsCert(tlsResult);
           const pair = loadTlsCert(tlsResult.certPath, tlsResult.keyPath);
           tlsOptions = { key: pair.key, cert: pair.cert };
         }
@@ -401958,9 +402429,20 @@ var require_boot_config = __commonJS({
         bootstrapConfig: config,
         dataPath,
         locationManager,
-        tlsOptions
+        tlsOptions,
+        tlsCert
       };
     }
+    function logTlsCert(result) {
+      if (!result.generated) {
+        console.log(`[Phase2c] TLS cert unchanged \u2014 ${result.certPath} (leaf ${result.fingerprintSha256}, valid to ${result.validTo})`);
+        return;
+      }
+      console.log(`[Phase2c] TLS CERTIFICATE REISSUED \u2014 reason=${result.reason}, caRotated=${result.caRotated}`);
+      console.log(`[Phase2c]   leaf ${result.previousFingerprintSha256 ?? "(none)"} \u2192 ${result.fingerprintSha256}`);
+      console.log(`[Phase2c]   valid to ${result.validTo}, names: ${result.sans.join(", ")}`);
+      console.log(result.caRotated ? `[Phase2c]   ACTION REQUIRED: the local CA changed. Install ${result.caCertPath} (SHA-256 ${result.caFingerprintSha256}) on every device that trusted the previous certificate.` : `[Phase2c]   Local CA unchanged (${result.caFingerprintSha256}) \u2014 devices that trust ${result.caCertPath} keep working.`);
+    }
   }
 });
 
@@ -409443,7 +409925,7 @@ var require_main4 = __commonJS({
       const configPath = process.env.CONFIG_PATH ?? path.join(process.env.CAMSTACK_DATA ?? path.join(process.cwd(), "camstack-data"), "config.yaml");
       const bootstrapConfig = (0, boot_config_1.loadBootstrapConfig)(configPath);
       const infra = await (0, boot_config_1.setupInfra)(configPath, bootstrapConfig);
-      const { dataPath, tlsOptions } = infra;
+      const { dataPath, tlsOptions, tlsCert } = infra;
       const port = infra.bootstrapConfig.server.port;
       const host = infra.bootstrapConfig.server.host;
       const fastifyOpts = tlsOptions ? { https: tlsOptions } : {};
@@ -410192,7 +410674,7 @@ var require_main4 = __commonJS({
       logger.info("CamStack server listening", { meta: { protocol, host, port, trpcRegistered } });
       void Promise.all([resolveAdminUi(), resolveViewerUi()]);
       const postBoot = app.get(post_boot_service_1.PostBootService);
-      await postBoot.run({ port, host, dataPath, trpcRegistered });
+      await postBoot.run({ port, host, dataPath, trpcRegistered, tlsCert });
       try {
         const confirm = app.get(server_update_service_1.ServerUpdateService).confirmBootHealthy();
         if (confirm.promoted !== null) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "camstack",
-  "version": "1.2.36",
+  "version": "1.2.38",
   "description": "CLI tool for managing and running CamStack server",
   "keywords": [
     "camstack",