camstack 1.2.38 → 1.2.39

package/dist/{launcher-SCKDFMNR.js → launcher-ZGFW4X34.js}

@@ -23631,9 +23631,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-iAwSA2_f.js
-var require_dist_iAwSA2_f = __commonJS({
-  "../system/dist/dist-iAwSA2_f.js"(exports) {
+// ../system/dist/dist-C2_1HCpW.js
+var require_dist_C2_1HCpW = __commonJS({
+  "../system/dist/dist-C2_1HCpW.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -26256,6 +26256,15 @@ var require_dist_iAwSA2_f = __commonJS({
       description: zod.z.string().optional(),
       icon: zod.z.string().optional()
     });
+    var ClassMapDefinitionSchema = zod.z.object({
+      mapping: zod.z.record(zod.z.string(), zod.z.enum([
+        "person",
+        "vehicle",
+        "animal",
+        "package"
+      ])),
+      preserveOriginal: zod.z.boolean()
+    });
     var MODEL_FORMATS = [
       "onnx",
       "coreml",
@@ -26404,7 +26413,13 @@ var require_dist_iAwSA2_f = __commonJS({
       * `id` stays the source of truth for resolution/download/persistence; grouping
       * is a presentation overlay resolved back to an `id`.
       */
-      group: ModelVariantGroupSchema.optional()
+      group: ModelVariantGroupSchema.optional(),
+      /**
+      * Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+      * applies (Frigate / COCO public catalog). Set on a custom model whose raw
+      * labels already ARE the CamStack macros (Scrypted identity map).
+      */
+      classMap: ClassMapDefinitionSchema.optional()
     });
     var ConvertTargetSchema = zod.z.discriminatedUnion("format", [zod.z.object({
       format: zod.z.literal("openvino"),
@@ -26433,7 +26448,8 @@ var require_dist_iAwSA2_f = __commonJS({
         "ocr",
         "segmentation"
       ]),
-      faceAlignment: zod.z.boolean().optional()
+      faceAlignment: zod.z.boolean().optional(),
+      classMap: ClassMapDefinitionSchema.optional()
     });
     var ConvertArtifactSchema = zod.z.object({
       format: zod.z.enum(MODEL_FORMATS),
@@ -35797,6 +35813,33 @@ var require_dist_iAwSA2_f = __commonJS({
         h: zod.z.number()
       })
     });
+    zod.z.object({
+      crop: zod.z.object({
+        left: zod.z.number(),
+        top: zod.z.number(),
+        width: zod.z.number().positive(),
+        height: zod.z.number().positive()
+      }).optional(),
+      content: zod.z.object({
+        width: zod.z.number().int().positive(),
+        height: zod.z.number().int().positive()
+      }),
+      fit: zod.z.enum(["stretch", "contain"]),
+      format: zod.z.enum([
+        "rgb",
+        "gray",
+        "jpeg"
+      ])
+    });
+    var FrameRefSchema = zod.z.object({
+      registryId: zod.z.string().min(1),
+      id: zod.z.string().min(1),
+      width: zod.z.number().int().positive(),
+      height: zod.z.number().int().positive(),
+      format: zod.z.enum(["rgb", "gray"]),
+      timestamp: zod.z.number(),
+      capturedAt: zod.z.number().optional()
+    });
     var ModelFormatSchema$1 = zod.z.enum([
       "onnx",
       "coreml",
@@ -36096,7 +36139,7 @@ var require_dist_iAwSA2_f = __commonJS({
         * legacy call shape used by existing benchmark code; once all
         * callers pass it explicitly we make it required.
         *
-        * Exactly one of `frame`, `frameHandle`, `imageBase64`,
+        * Exactly one of `frame`, `frameRef`, `frameHandle`, `imageBase64`,
         * `referenceImage` must be provided:
         *  - `frame`: runtime dispatch path (runner → decoded broker frame).
         *    Carries the raw buffer, dimensions, and format; the executor
@@ -36118,6 +36161,12 @@ var require_dist_iAwSA2_f = __commonJS({
           steps: zod.z.array(PipelineStepInputSchema).min(1),
           frame: FrameInputSchema.optional(),
           /**
+          * Process-local lazy frame. Valid only when caller and provider resolve
+          * in the same execution-group process; split/cross-node callers use
+          * `frame`/`image` inline compatibility instead.
+          */
+          frameRef: FrameRefSchema.optional(),
+          /**
           * CB5 shm passthrough — a `FrameHandle` naming the same ring slot
           * the decoded pixels live in. One more member of the one-of
           * frame/frameHandle/image/imageBase64/referenceImage group.
@@ -36420,7 +36469,10 @@ var require_dist_iAwSA2_f = __commonJS({
       * Which source served this crop, so a quality-sensitive consumer (the native
       * `keyFrame`) can reject a degraded fallback:
       * - `native` — cut from the decode worker's retained NATIVE surface (the
-      *   quality path).
+      *   quality path). A subject-tile serve is also native-resolution and stays
+      *   `native` here: the public enum cannot name `tile` without a breaking cap
+      *   change. Runner telemetry distinguishes lease vs tile via `source` on the
+      *   internal crop result (`nativeHits` vs `tileHits`).
       * - `ram-fullframe` — the native surface MISSED but the request was full-frame,
       *   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
       *   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -36780,12 +36832,41 @@ var require_dist_iAwSA2_f = __commonJS({
         cpuCores: zod.z.number().optional()
       })
     });
+    var FrameLazyCountersSchema = zod.z.object({
+      framesDecoded: zod.z.number(),
+      framesAdmitted: zod.z.number(),
+      framesDroppedPixelFree: zod.z.number(),
+      viewsMaterialized: zod.z.number(),
+      viewsSkipped: zod.z.number(),
+      workerToRunnerBytes: zod.z.number(),
+      runnerToPoolRawBytes: zod.z.number(),
+      runnerToPoolJpegBytes: zod.z.number(),
+      onDemandFullFrameRequests: zod.z.number(),
+      onDemandCropRequests: zod.z.number(),
+      nativeHits: zod.z.number(),
+      nativeMisses: zod.z.number(),
+      tileHits: zod.z.number(),
+      tileMisses: zod.z.number(),
+      fallbackHits: zod.z.number(),
+      fallbackMisses: zod.z.number(),
+      retainedWritesAvoided: zod.z.number(),
+      residentRefs: zod.z.number(),
+      residentBytes: zod.z.number(),
+      releases: zod.z.number(),
+      evictions: zod.z.number(),
+      staleMisses: zod.z.number()
+    });
+    var FrameLazyMetricsSchema = zod.z.object({
+      node: FrameLazyCountersSchema,
+      cameras: zod.z.array(FrameLazyCountersSchema.extend({ deviceId: zod.z.number() }))
+    });
     var RunnerLocalMetricsSchema = zod.z.object({
       nodeId: zod.z.string(),
       activeCameras: zod.z.number(),
       throttledCameras: zod.z.number(),
       avgInferenceTimeMs: zod.z.number(),
-      queueDepth: zod.z.number()
+      queueDepth: zod.z.number(),
+      frameLazy: FrameLazyMetricsSchema.optional()
     });
     var pipelineRunnerCapability = {
       name: "pipeline-runner",
@@ -38570,6 +38651,8 @@ var require_dist_iAwSA2_f = __commonJS({
         endDownload: method(EndDownloadInputSchema, zod.z.void(), { kind: "mutation" })
       }
     };
+    var ProfileSettingsSchemaBridge = zod.z.unknown().nullable();
+    var ProfileSettingsBagSchema = zod.z.record(zod.z.string(), zod.z.unknown());
     var TerminalSessionInfoSchema = zod.z.object({
       /** Opaque session id minted by the provider on `openSession`. */
       sessionId: zod.z.string(),
@@ -38585,7 +38668,14 @@ var require_dist_iAwSA2_f = __commonJS({
     var TerminalProfileInfoSchema = zod.z.object({
       profileId: zod.z.string(),
       label: zod.z.string(),
-      description: zod.z.string().optional()
+      description: zod.z.string().optional(),
+      /** Spawn defaults the instance form copies on create. */
+      executable: zod.z.string().optional(),
+      args: zod.z.array(zod.z.string()).readonly().optional(),
+      cwd: zod.z.string().optional(),
+      environment: zod.z.array(zod.z.string()).readonly().optional(),
+      /** ConfigUISchema for instance knobs, or null when the profile has none. */
+      settingsSchema: ProfileSettingsSchemaBridge.optional()
     });
     var TerminalInstanceInfoSchema = zod.z.object({
       instanceId: zod.z.string(),
@@ -38594,7 +38684,12 @@ var require_dist_iAwSA2_f = __commonJS({
       profileId: zod.z.string(),
       profileLabel: zod.z.string(),
       name: zod.z.string(),
-      enabled: zod.z.boolean()
+      enabled: zod.z.boolean(),
+      executable: zod.z.string(),
+      args: zod.z.array(zod.z.string()).readonly(),
+      cwd: zod.z.string(),
+      environment: zod.z.array(zod.z.string()).readonly(),
+      profileSettings: ProfileSettingsBagSchema
     });
     var TerminalLegacyCameraSchema = zod.z.object({
       stableId: zod.z.string(),
@@ -38633,7 +38728,24 @@ var require_dist_iAwSA2_f = __commonJS({
         createInstance: method(zod.z.object({
           targetNodeId: zod.z.string().min(1),
           profileId: zod.z.string().min(1),
-          name: zod.z.string().trim().min(1).max(160).optional()
+          name: zod.z.string().trim().min(1).max(160).optional(),
+          executable: zod.z.string().max(1024).optional(),
+          args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+          cwd: zod.z.string().max(1024).optional(),
+          environment: zod.z.array(zod.z.string().max(4096)).max(64).optional(),
+          profileSettings: ProfileSettingsBagSchema.optional()
+        }), TerminalInstanceInfoSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        updateInstance: method(zod.z.object({
+          instanceId: zod.z.string().min(1),
+          name: zod.z.string().trim().min(1).max(160).optional(),
+          executable: zod.z.string().max(1024).optional(),
+          args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+          cwd: zod.z.string().max(1024).optional(),
+          environment: zod.z.array(zod.z.string().max(4096)).max(64).optional(),
+          profileSettings: ProfileSettingsBagSchema.optional()
         }), TerminalInstanceInfoSchema, {
           kind: "mutation",
           auth: "admin"
@@ -38668,7 +38780,11 @@ var require_dist_iAwSA2_f = __commonJS({
         openSession: method(zod.z.object({
           profileId: zod.z.string(),
           cols: zod.z.number().int().positive(),
-          rows: zod.z.number().int().positive()
+          rows: zod.z.number().int().positive(),
+          executable: zod.z.string().max(1024).optional(),
+          args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+          cwd: zod.z.string().max(1024).optional(),
+          environment: zod.z.array(zod.z.string().max(4096)).max(64).optional()
         }), TerminalSessionInfoSchema, {
           kind: "mutation",
           auth: "admin"
@@ -42391,6 +42507,12 @@ var require_dist_iAwSA2_f = __commonJS({
       /** What the ranking currently resolves to (null when nothing is reachable). */
       resolved: zod.z.string().nullable()
     });
+    var ViewerEndpointsSchema = zod.z.object({
+      /** The operator's explicit race set, or empty for AUTO. */
+      baseUrls: zod.z.array(zod.z.string()).readonly(),
+      /** What the ranking currently resolves to (may be empty if nothing is up). */
+      resolved: zod.z.array(zod.z.string()).readonly()
+    });
     var AllowedAddressesSchema = zod.z.object({
       /**
       * Allowlist of interface addresses operators have explicitly opted
@@ -42400,6 +42522,20 @@ var require_dist_iAwSA2_f = __commonJS({
       */
       addresses: zod.z.array(zod.z.string()).readonly()
     });
+    var TlsStatusSchema = zod.z.object({
+      mode: zod.z.enum([
+        "generated",
+        "uploaded",
+        "disabled"
+      ]),
+      leafFingerprintSha256: zod.z.string().nullable(),
+      caFingerprintSha256: zod.z.string().nullable(),
+      validTo: zod.z.string().nullable(),
+      sans: zod.z.array(zod.z.string()),
+      caCertPem: zod.z.string().nullable(),
+      reissueError: zod.z.string().nullable(),
+      restartRequired: zod.z.boolean()
+    });
     var localNetworkCapability = {
       name: "local-network",
       scope: "system",
@@ -42419,13 +42555,13 @@ var require_dist_iAwSA2_f = __commonJS({
         */
         getPreferred: method(zod.z.void(), PreferredSchema),
         /**
-        * Ordered candidate base URLs the SDK should try on connect.
-        * Includes LAN IPs (one per non-internal interface), the public
-        * tunnel hostname (when active), and loopback as a last-resort
-        * fallback. Filterable by `includeLoopback` / `ipv4Only`.
-        * Honours `getAllowedAddresses()` when set — addresses outside
-        * the allowlist are dropped (the public tunnel + loopback are
-        * always included as escape hatches).
+        * Ordered candidate base URLs (the palette the Network tab shows).
+        * Includes LAN IPv4, stable LAN IPv6, the public tunnel, and mesh when
+        * joined. Loopback is off by default. The SDK races the subset from
+        * `getViewerEndpoints`, not this full list — IPv6 stays here because
+        * WebRTC ICE gathers dual-stack regardless of the HTTP race. Honours
+        * `getAllowedAddresses()` when set — addresses outside the allowlist
+        * are dropped (the public tunnel is still included as an escape hatch).
         *
         * **The port is the hub's, not the caller's** (D62 — a function's fact
         * belongs to whoever already owns it). This method used to take a `port`
@@ -42456,10 +42592,11 @@ var require_dist_iAwSA2_f = __commonJS({
           */
           port: zod.z.number().int().min(1).max(65535).optional(),
           /** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-          *  candidate. Default `true`. */
+          *  candidate. Default `false` — loopback is not a client route. */
           includeLoopback: zod.z.boolean().optional(),
-          /** Skip IPv6 entries. Some legacy clients can't parse them.
-          *  Default `false`. */
+          /** Skip IPv6 entries. Default `false` — the palette includes stable
+          *  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+          *  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
           ipv4Only: zod.z.boolean().optional(),
           /** Scheme to emit for LAN/loopback URLs. Default `'http'`.
           *  Pass `'https'` when the caller is itself loaded over HTTPS
@@ -42488,6 +42625,19 @@ var require_dist_iAwSA2_f = __commonJS({
         */
         setNotificationEndpoint: method(zod.z.object({ baseUrl: zod.z.string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }),
         /**
+        * The endpoints the SDK / viewer races for API access. Empty `baseUrls`
+        * means AUTO: every LAN IPv4 address plus the public tunnel, never IPv6,
+        * never mesh, never loopback. `resolved` is that set (or the operator's
+        * explicit subset) as it stands right now.
+        */
+        getViewerEndpoints: method(zod.z.void(), ViewerEndpointsSchema),
+        /**
+        * Replace the viewer race set. Empty `baseUrls` restores AUTO. Stored
+        * verbatim (not indices) so a temporarily-down tunnel is not silently
+        * dropped from the operator's choice.
+        */
+        setViewerEndpoints: method(zod.z.object({ baseUrls: zod.z.array(zod.z.string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }),
+        /**
         * Read the operator's allowlist. Empty = "auto" (no filter). Used
         * by the admin UI's address selector to seed its checkbox state.
         */
@@ -42505,7 +42655,34 @@ var require_dist_iAwSA2_f = __commonJS({
         * when the operator wants to wipe their manual edits and start
         * over from the auto-detected best matches.
         */
-        resetAllowlistToBestMatch: method(zod.z.void(), AllowedAddressesSchema, { kind: "mutation" })
+        resetAllowlistToBestMatch: method(zod.z.void(), AllowedAddressesSchema, { kind: "mutation" }),
+        /**
+        * Live TLS material for the Network → Local access certificate card.
+        * LAN HTTP / hostname are addon settings (`globalSettingsSchema`), not
+        * a second store — this query is status, not configuration.
+        */
+        getTlsStatus: method(zod.z.void(), TlsStatusSchema),
+        /** Issue a new leaf under the existing local CA. Disabled in uploaded mode. */
+        regenerateCertificate: method(zod.z.object({ reason: zod.z.string().optional() }), TlsStatusSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /** Replace the served material with operator-supplied PEMs. */
+        uploadCertificate: method(zod.z.object({
+          certPem: zod.z.string().min(1),
+          keyPem: zod.z.string().min(1),
+          caPem: zod.z.string().optional()
+        }), TlsStatusSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /** The local CA PEM, or empty when there is none to download. */
+        downloadCa: method(zod.z.void(), zod.z.object({ pem: zod.z.string() })),
+        /** Drop uploaded material and return to the generated local CA. */
+        revertToGeneratedCertificate: method(zod.z.void(), TlsStatusSchema, {
+          kind: "mutation",
+          auth: "admin"
+        })
       },
       /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
       mount: { kind: "hub-only" }
@@ -49869,6 +50046,12 @@ var require_dist_iAwSA2_f = __commonJS({
         addonId: null,
         access: "create"
       },
+      "localNetwork.downloadCa": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "localNetwork.getAllowedAddresses": {
         capName: "local-network",
         capScope: "system",
@@ -49893,18 +50076,42 @@ var require_dist_iAwSA2_f = __commonJS({
         addonId: null,
         access: "view"
       },
+      "localNetwork.getTlsStatus": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
+      "localNetwork.getViewerEndpoints": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "localNetwork.list": {
         capName: "local-network",
         capScope: "system",
         addonId: null,
         access: "view"
       },
+      "localNetwork.regenerateCertificate": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "localNetwork.resetAllowlistToBestMatch": {
         capName: "local-network",
         capScope: "system",
         addonId: null,
         access: "delete"
       },
+      "localNetwork.revertToGeneratedCertificate": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "localNetwork.setAllowedAddresses": {
         capName: "local-network",
         capScope: "system",
@@ -49917,6 +50124,18 @@ var require_dist_iAwSA2_f = __commonJS({
         addonId: null,
         access: "create"
       },
+      "localNetwork.setViewerEndpoints": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
+      "localNetwork.uploadCertificate": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "lockControl.lock": {
         capName: "lock-control",
         capScope: "device",
@@ -52797,6 +53016,12 @@ var require_dist_iAwSA2_f = __commonJS({
         addonId: null,
         access: "create"
       },
+      "terminalSession.updateInstance": {
+        capName: "terminal-session",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "terminalSession.writeInput": {
         capName: "terminal-session",
         capScope: "system",
@@ -55425,6 +55650,35 @@ var require_dist_iAwSA2_f = __commonJS({
       }]
     }].map((s) => [s.stepId, s.defaultModelId])));
     zod.z.string().min(1);
+    var CLUSTER_STEP_SETTING_FIELDS = [{
+      stepId: "face-embedding",
+      key: "minLandmarkFaceSize",
+      label: "Min face size for recognition (detection px)",
+      description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node \u2014 the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+      type: "slider",
+      min: 0,
+      max: 64,
+      step: 2,
+      default: 24
+    }];
+    function clusterStepSettingKey(stepId, fieldKey) {
+      return `clusterStepSetting:${stepId}:${fieldKey}`;
+    }
+    var ClusterSettingNumberSchema = zod.z.number().finite();
+    function readClusterStepSettings(config) {
+      const out = {};
+      for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+        const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+        const value = parsed.success ? parsed.data : field.default;
+        const existing = out[field.stepId] ?? {};
+        out[field.stepId] = {
+          ...existing,
+          [field.key]: value
+        };
+      }
+      return out;
+    }
+    readClusterStepSettings({});
     zod.z.object({
       /**
       * Fraction of the box's own size added on EACH side before cutting.
@@ -56256,7 +56510,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -57075,7 +57329,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -57169,7 +57423,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -58066,11 +58320,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-OfhqQio4.js
-var require_retired_settings_keys_OfhqQio4 = __commonJS({
-  "../system/dist/retired-settings-keys-OfhqQio4.js"(exports) {
+// ../system/dist/retired-settings-keys-DHRXLMPn.js
+var require_retired_settings_keys_DHRXLMPn = __commonJS({
+  "../system/dist/retired-settings-keys-DHRXLMPn.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -60113,8 +60367,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
-    var require_retired_settings_keys = require_retired_settings_keys_OfhqQio4();
+    var require_dist10 = require_dist_C2_1HCpW();
+    var require_retired_settings_keys = require_retired_settings_keys_DHRXLMPn();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -64441,7 +64695,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -64578,7 +64832,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -64768,7 +65022,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -72452,7 +72706,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -73017,7 +73271,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     var node_child_process = __require("child_process");
     var node_util = __require("util");
     var node_os = __require("os");
@@ -73959,7 +74213,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -75075,8 +75329,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
-    var require_retired_settings_keys = require_retired_settings_keys_OfhqQio4();
+    var require_dist10 = require_dist_C2_1HCpW();
+    var require_retired_settings_keys = require_retired_settings_keys_DHRXLMPn();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -76620,7 +76874,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -78499,7 +78753,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -96560,7 +96814,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -96697,9 +96951,9 @@ var require_winston_logging = __commonJS({
   }
 });
 
-// ../system/dist/file-data-plane-DUHPHa-Y.js
-var require_file_data_plane_DUHPHa_Y = __commonJS({
-  "../system/dist/file-data-plane-DUHPHa-Y.js"(exports) {
+// ../system/dist/file-data-plane-DO8KbxCe.js
+var require_file_data_plane_DO8KbxCe = __commonJS({
+  "../system/dist/file-data-plane-DO8KbxCe.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
     var node_crypto = __require("crypto");
@@ -96732,15 +96986,56 @@ var require_file_data_plane_DUHPHa_Y = __commonJS({
       if (hfToken && url.includes("huggingface.co")) headers["Authorization"] = `Bearer ${hfToken}`;
       return headers;
     }
-    async function downloadFile(url, destPath, onProgress) {
+    var DEFAULT_MAX_REDIRECTS = 5;
+    function normalizeDownloadOptions(third) {
+      if (typeof third === "function") return { onProgress: third };
+      return third ?? {};
+    }
+    function isRedirectStatus(status) {
+      return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+    }
+    function resolveRedirectUrl(current, location) {
+      return new URL(location, current);
+    }
+    async function downloadFile(url, destPath, onProgressOrOptions) {
       if (node_fs.existsSync(destPath)) return destPath;
+      const opts = normalizeDownloadOptions(onProgressOrOptions);
+      const fetchImpl = opts.fetchImpl ?? fetch;
+      const maxRedirects = opts.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
       node_fs.mkdirSync(node_path.dirname(destPath), { recursive: true });
       const tmpPath = destPath + ".downloading";
       try {
-        const response = await fetch(url, {
-          redirect: "follow",
-          headers: buildHeaders(url)
-        });
+        let current = url;
+        const seen = /* @__PURE__ */ new Set();
+        let response;
+        const manual = opts.redirectPolicy !== void 0;
+        for (let hop = 0; hop <= maxRedirects; hop++) {
+          const parsed = new URL(current);
+          if (opts.redirectPolicy) opts.redirectPolicy(parsed, hop);
+          if (seen.has(parsed.href)) throw new Error(`Redirect loop detected at ${parsed.href}`);
+          seen.add(parsed.href);
+          const controller = opts.timeoutMs !== void 0 ? new AbortController() : void 0;
+          const timer = controller && opts.timeoutMs !== void 0 ? setTimeout(() => controller.abort(), opts.timeoutMs) : void 0;
+          try {
+            response = await fetchImpl(current, {
+              redirect: manual ? "manual" : "follow",
+              headers: buildHeaders(current),
+              ...controller ? { signal: controller.signal } : {}
+            });
+          } finally {
+            if (timer) clearTimeout(timer);
+          }
+          if (manual && isRedirectStatus(response.status)) {
+            const location = response.headers.get("location");
+            if (!location) throw new Error(`Redirect ${response.status} missing Location header`);
+            if (hop >= maxRedirects) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
+            current = resolveRedirectUrl(current, location).href;
+            continue;
+          }
+          break;
+        }
+        if (!response) throw new Error(`No response downloading ${url}`);
+        if (manual && isRedirectStatus(response.status)) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
         if (!response.ok) throw new Error(`HTTP ${response.status} downloading ${url}`);
         if (!response.body) throw new Error(`No response body from ${url}`);
         const total = parseInt(response.headers.get("content-length") ?? "0", 10);
@@ -96751,9 +97046,10 @@ var require_file_data_plane_DUHPHa_Y = __commonJS({
           for (; ; ) {
             const { done, value } = await reader.read();
             if (done || !value) break;
-            fileStream.write(value);
             downloaded += value.length;
-            onProgress?.(downloaded, total);
+            if (opts.maxBytes !== void 0 && downloaded > opts.maxBytes) throw new Error(`Downloaded ${downloaded} bytes exceeds the ${opts.maxBytes}-byte limit`);
+            fileStream.write(value);
+            opts.onProgress?.(downloaded, total);
           }
         } finally {
           fileStream.end();
@@ -115038,6 +115334,752 @@ var require_manifest_python_deps_CwBbX4Ut = __commonJS({
   }
 });
 
+// ../system/dist/lan-http-bind-DmgpFP6_.js
+var require_lan_http_bind_DmgpFP6 = __commonJS({
+  "../system/dist/lan-http-bind-DmgpFP6_.js"(exports) {
+    "use strict";
+    var require_chunk = require_chunk_Cek0wNdY();
+    var node_crypto = __require("crypto");
+    var node_fs_promises = __require("fs/promises");
+    var node_path = __require("path");
+    var node_child_process = __require("child_process");
+    var node_util = __require("util");
+    var node_os = __require("os");
+    node_os = require_chunk.__toESM(node_os);
+    var node_fs = __require("fs");
+    var node_http = __require("http");
+    var node_net = __require("net");
+    var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+    var MAX_LEAF_VALIDITY_DAYS = 397;
+    var LEAF_RENEWAL_WINDOW_DAYS = 30;
+    var CA_VALIDITY_DAYS = 3650;
+    var MS_PER_DAY = 864e5;
+    var REASONS_REQUIRING_NEW_CA = [
+      "missing",
+      "unreadable",
+      "no-local-ca",
+      "ca-expiring"
+    ];
+    function reasonRequiresNewCa(reason) {
+      return REASONS_REQUIRING_NEW_CA.includes(reason);
+    }
+    function parse4(pem) {
+      try {
+        return new node_crypto.X509Certificate(pem);
+      } catch {
+        return null;
+      }
+    }
+    function daysBetween(from, to) {
+      return (to.getTime() - from.getTime()) / MS_PER_DAY;
+    }
+    function hasServerAuthEku(leaf) {
+      const eku = leaf.keyUsage;
+      return eku !== void 0 && eku.length === 1 && eku[0] === "1.3.6.1.5.5.7.3.1";
+    }
+    function keyMatches(leaf, keyPem) {
+      try {
+        return leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem));
+      } catch {
+        return false;
+      }
+    }
+    function coversIdentity(leaf, identity) {
+      for (const name of identity.requiredDnsNames) if (leaf.checkHost(name) === void 0) return false;
+      for (const ip of identity.requiredIpAddresses) if (leaf.checkIP(ip) === void 0) return false;
+      return true;
+    }
+    function evaluateExistingCert(input) {
+      const leaf = parse4(input.chainPem);
+      const ca = parse4(input.caPem);
+      if (leaf === null || ca === null) return "unreadable";
+      if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
+      if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
+      if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
+      if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
+      if (leaf.ca || !leaf.checkIssued(ca) || !leaf.verify(ca.publicKey)) return "not-issued-by-local-ca";
+      if (daysBetween(new Date(leaf.validFrom), new Date(leaf.validTo)) > 398) return "validity-too-long";
+      if (!coversIdentity(leaf, input.identity)) return "san-coverage-gap";
+      return null;
+    }
+    var VOLATILE_INTERFACE_PREFIXES = [
+      "docker",
+      "br-",
+      "veth",
+      "virbr",
+      "cni",
+      "flannel",
+      "tun",
+      "utun",
+      "tap",
+      "wg",
+      "zt",
+      "tailscale",
+      "ppp",
+      "awdl",
+      "llw"
+    ];
+    var DNS_NAME_PATTERN = /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+    function isIpv4(value) {
+      return (0, node_net.isIP)(value) === 4;
+    }
+    function isIpv6(value) {
+      return (0, node_net.isIP)(value) === 6;
+    }
+    function isLinkLocal(value) {
+      if (isIpv4(value)) return value.startsWith("169.254.");
+      if (!isIpv6(value)) return false;
+      const firstGroup = value.split(":")[0] ?? "";
+      if (firstGroup === "") return false;
+      const parsed = Number.parseInt(firstGroup, 16);
+      return Number.isFinite(parsed) && (parsed & 65472) === 65152;
+    }
+    function isUniqueLocalIpv6(value) {
+      if (!isIpv6(value)) return false;
+      const firstGroup = value.split(":")[0] ?? "";
+      const parsed = Number.parseInt(firstGroup, 16);
+      return Number.isFinite(parsed) && (parsed & 65024) === 64512;
+    }
+    function isVolatileInterface(name) {
+      const lower = name.toLowerCase();
+      return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
+    }
+    function isStableGateAddress(address) {
+      if (isLinkLocal(address)) return false;
+      if (isIpv4(address)) return true;
+      return isUniqueLocalIpv6(address);
+    }
+    function addSan(dns, ips, value) {
+      const trimmed = value.trim();
+      if (trimmed === "") return;
+      if ((0, node_net.isIP)(trimmed) !== 0) {
+        if (!isLinkLocal(trimmed)) ips.add(trimmed);
+        return;
+      }
+      if (DNS_NAME_PATTERN.test(trimmed)) dns.add(trimmed);
+    }
+    function collectCertIdentity(options) {
+      const dnsNames = /* @__PURE__ */ new Set();
+      const ipAddresses = /* @__PURE__ */ new Set(["127.0.0.1", "::1"]);
+      const requiredDnsNames = /* @__PURE__ */ new Set();
+      const requiredIpAddresses = /* @__PURE__ */ new Set(["127.0.0.1"]);
+      for (const name of [
+        "localhost",
+        options.commonName,
+        node_os.hostname()
+      ]) {
+        addSan(dnsNames, ipAddresses, name);
+        addSan(requiredDnsNames, requiredIpAddresses, name);
+      }
+      for (const [ifaceName, addrs] of Object.entries(node_os.networkInterfaces())) for (const addr of addrs ?? []) {
+        if (addr.internal) continue;
+        if (isLinkLocal(addr.address)) continue;
+        ipAddresses.add(addr.address);
+        if (isVolatileInterface(ifaceName)) continue;
+        if (isStableGateAddress(addr.address)) requiredIpAddresses.add(addr.address);
+      }
+      for (const san of options.extraSans) {
+        addSan(dnsNames, ipAddresses, san);
+        addSan(requiredDnsNames, requiredIpAddresses, san);
+      }
+      return {
+        dnsNames: [...dnsNames],
+        ipAddresses: [...ipAddresses],
+        requiredDnsNames: [...requiredDnsNames],
+        requiredIpAddresses: [...requiredIpAddresses]
+      };
+    }
+    var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+    var CA_COMMON_NAME = "CamStack Local CA";
+    function sanValue(identity) {
+      const parts = [];
+      for (const dns of identity.dnsNames) parts.push(`DNS:${dns}`);
+      for (const ip of identity.ipAddresses) if ((0, node_net.isIP)(ip) !== 0) parts.push(`IP:${ip}`);
+      return parts.join(",");
+    }
+    async function generateCa(tmpDir) {
+      const caCertPath = (0, node_path.join)(tmpDir, "ca.crt");
+      const caKeyPath = (0, node_path.join)(tmpDir, "ca.key");
+      await execFileAsync("openssl", [
+        "req",
+        "-x509",
+        "-newkey",
+        "rsa:2048",
+        "-nodes",
+        "-sha256",
+        "-days",
+        String(CA_VALIDITY_DAYS),
+        "-keyout",
+        caKeyPath,
+        "-out",
+        caCertPath,
+        "-subj",
+        `/CN=${CA_COMMON_NAME}`,
+        "-addext",
+        "basicConstraints=critical,CA:TRUE,pathlen:0",
+        "-addext",
+        "keyUsage=critical,keyCertSign,cRLSign",
+        "-addext",
+        "subjectKeyIdentifier=hash"
+      ]);
+      await (0, node_fs_promises.chmod)(caKeyPath, 384);
+      return {
+        caCertPath,
+        caKeyPath
+      };
+    }
+    async function issueLeaf(tmpDir, ca, identity, commonName, validDays) {
+      const keyPath = (0, node_path.join)(tmpDir, "leaf.key");
+      const csrPath = (0, node_path.join)(tmpDir, "leaf.csr");
+      const certPath = (0, node_path.join)(tmpDir, "leaf.crt");
+      const extPath = (0, node_path.join)(tmpDir, "leaf.ext");
+      await (0, node_fs_promises.writeFile)(extPath, [
+        "basicConstraints=critical,CA:FALSE",
+        "keyUsage=critical,digitalSignature,keyEncipherment",
+        "extendedKeyUsage=serverAuth",
+        "subjectKeyIdentifier=hash",
+        "authorityKeyIdentifier=keyid,issuer",
+        `subjectAltName=${sanValue(identity)}`,
+        ""
+      ].join("\n"), "utf-8");
+      await execFileAsync("openssl", [
+        "req",
+        "-new",
+        "-newkey",
+        "rsa:2048",
+        "-nodes",
+        "-sha256",
+        "-keyout",
+        keyPath,
+        "-out",
+        csrPath,
+        "-subj",
+        `/CN=${commonName}`
+      ]);
+      await execFileAsync("openssl", [
+        "x509",
+        "-req",
+        "-in",
+        csrPath,
+        "-CA",
+        ca.caCertPath,
+        "-CAkey",
+        ca.caKeyPath,
+        "-set_serial",
+        `0x00${(0, node_crypto.randomBytes)(16).toString("hex")}`,
+        "-days",
+        String(validDays),
+        "-sha256",
+        "-extfile",
+        extPath,
+        "-out",
+        certPath
+      ]);
+      await (0, node_fs_promises.chmod)(keyPath, 384);
+      await (0, node_fs_promises.rm)(csrPath, { force: true });
+      await (0, node_fs_promises.rm)(extPath, { force: true });
+      return {
+        certPath,
+        keyPath
+      };
+    }
+    var DEFAULT_COMMON_NAME = "camstack.local";
+    async function ensureTlsCert(dataDir, options) {
+      const tlsDir2 = (0, node_path.join)(dataDir, "tls");
+      const paths = {
+        certPath: (0, node_path.join)(tlsDir2, "camstack.crt"),
+        keyPath: (0, node_path.join)(tlsDir2, "camstack.key"),
+        caCertPath: (0, node_path.join)(tlsDir2, "camstack-ca.crt"),
+        caKeyPath: (0, node_path.join)(tlsDir2, "camstack-ca.key")
+      };
+      const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+      const validDays = Math.min(options?.validDays ?? 397, 397);
+      const identity = collectCertIdentity({
+        commonName,
+        extraSans: options?.extraSans ?? []
+      });
+      const reason = decideRegeneration(paths, identity);
+      if (reason === null) return describe(paths, false, null, false, null, null);
+      const previousFingerprint = readFingerprint(paths.certPath);
+      const caRotated = reasonRequiresNewCa(reason);
+      (0, node_fs.mkdirSync)(tlsDir2, { recursive: true });
+      try {
+        await regenerate(paths, identity, commonName, validDays, caRotated);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (!canKeepServing(paths)) throw err;
+        return describe(paths, false, null, false, null, message);
+      }
+      return describe(paths, true, reason, caRotated, previousFingerprint, null);
+    }
+    async function reissueTlsLeaf(dataDir, options) {
+      const tlsDir2 = (0, node_path.join)(dataDir, "tls");
+      const paths = {
+        certPath: (0, node_path.join)(tlsDir2, "camstack.crt"),
+        keyPath: (0, node_path.join)(tlsDir2, "camstack.key"),
+        caCertPath: (0, node_path.join)(tlsDir2, "camstack-ca.crt"),
+        caKeyPath: (0, node_path.join)(tlsDir2, "camstack-ca.key")
+      };
+      if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return ensureTlsCert(dataDir, options);
+      const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
+      const validDays = Math.min(options?.validDays ?? 397, 397);
+      const identity = collectCertIdentity({
+        commonName,
+        extraSans: options?.extraSans ?? []
+      });
+      const previousFingerprint = readFingerprint(paths.certPath);
+      (0, node_fs.mkdirSync)(tlsDir2, { recursive: true });
+      await regenerate(paths, identity, commonName, validDays, false);
+      return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null);
+    }
+    function canKeepServing(paths) {
+      if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return false;
+      if (!(0, node_fs.existsSync)(paths.caCertPath)) return false;
+      return readFingerprint(paths.certPath) !== null;
+    }
+    function readFingerprint(certPath) {
+      try {
+        return new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath)).fingerprint256;
+      } catch {
+        return null;
+      }
+    }
+    function decideRegeneration(paths, identity) {
+      if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return "missing";
+      if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return "no-local-ca";
+      try {
+        return evaluateExistingCert({
+          chainPem: (0, node_fs.readFileSync)(paths.certPath, "utf-8"),
+          keyPem: (0, node_fs.readFileSync)(paths.keyPath, "utf-8"),
+          caPem: (0, node_fs.readFileSync)(paths.caCertPath, "utf-8"),
+          identity,
+          now: /* @__PURE__ */ new Date()
+        });
+      } catch {
+        return "unreadable";
+      }
+    }
+    async function regenerate(paths, identity, commonName, validDays, newCa) {
+      const scratch = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "camstack-tls-"));
+      try {
+        const ca = newCa ? await generateCa(scratch) : {
+          caCertPath: paths.caCertPath,
+          caKeyPath: paths.caKeyPath
+        };
+        const leaf = await issueLeaf(scratch, ca, identity, commonName, validDays);
+        const chainPath = (0, node_path.join)(scratch, "chain.crt");
+        await (0, node_fs_promises.writeFile)(chainPath, `${(0, node_fs.readFileSync)(leaf.certPath, "utf-8").trimEnd()}
+${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
+`, "utf-8");
+        if (newCa) {
+          await (0, node_fs_promises.copyFile)(ca.caCertPath, `${paths.caCertPath}.new`);
+          await (0, node_fs_promises.copyFile)(ca.caKeyPath, `${paths.caKeyPath}.new`);
+          (0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
+          (0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
+          await (0, node_fs_promises.chmod)(paths.caKeyPath, 384);
+        }
+        await (0, node_fs_promises.copyFile)(leaf.keyPath, `${paths.keyPath}.new`);
+        await (0, node_fs_promises.copyFile)(chainPath, `${paths.certPath}.new`);
+        (0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
+        (0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
+        await (0, node_fs_promises.chmod)(paths.keyPath, 384);
+      } finally {
+        await (0, node_fs_promises.rm)(scratch, {
+          recursive: true,
+          force: true
+        });
+      }
+    }
+    function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
+      const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
+      const ca = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath));
+      const san = leaf.subjectAltName ?? "";
+      return {
+        ...paths,
+        generated,
+        reason,
+        caRotated,
+        fingerprintSha256: leaf.fingerprint256,
+        previousFingerprintSha256,
+        caFingerprintSha256: ca.fingerprint256,
+        validTo: new Date(leaf.validTo).toISOString(),
+        sans: san === "" ? [] : san.split(", "),
+        reissueError
+      };
+    }
+    function loadTlsCert(certPath, keyPath) {
+      return {
+        cert: (0, node_fs.readFileSync)(certPath),
+        key: (0, node_fs.readFileSync)(keyPath)
+      };
+    }
+    function validateUploadedTls(certPem, keyPem) {
+      let leaf;
+      try {
+        leaf = new node_crypto.X509Certificate(certPem);
+      } catch {
+        return {
+          ok: false,
+          error: "Certificate PEM could not be parsed."
+        };
+      }
+      try {
+        if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem))) return {
+          ok: false,
+          error: "Private key does not match the certificate."
+        };
+      } catch {
+        return {
+          ok: false,
+          error: "Private key PEM could not be parsed."
+        };
+      }
+      const eku = leaf.keyUsage;
+      if (eku === void 0 || !eku.includes("1.3.6.1.5.5.7.3.1")) return {
+        ok: false,
+        error: "Certificate is missing extendedKeyUsage = serverAuth."
+      };
+      return {
+        ok: true,
+        fingerprintSha256: leaf.fingerprint256,
+        validTo: new Date(leaf.validTo).toISOString()
+      };
+    }
+    function tlsDir(dataDir) {
+      return (0, node_path.join)(dataDir, "tls");
+    }
+    function readTlsMode(dataDir) {
+      const marker = (0, node_path.join)(tlsDir(dataDir), "mode");
+      if ((0, node_fs.existsSync)(marker)) {
+        const raw = (0, node_fs.readFileSync)(marker, "utf-8").trim();
+        if (raw === "uploaded") return "uploaded";
+        if (raw === "disabled") return "disabled";
+      }
+      return (0, node_fs.existsSync)((0, node_path.join)(tlsDir(dataDir), "camstack.crt")) ? "generated" : "disabled";
+    }
+    function writeTlsMode(dataDir, mode) {
+      (0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
+      (0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "mode"), `${mode}
+`, "utf-8");
+    }
+    function readExtraSans(dataDir) {
+      const path = (0, node_path.join)(tlsDir(dataDir), "extra-sans.json");
+      if (!(0, node_fs.existsSync)(path)) return [];
+      try {
+        const parsed = JSON.parse((0, node_fs.readFileSync)(path, "utf-8"));
+        if (!Array.isArray(parsed)) return [];
+        return parsed.filter((entry) => typeof entry === "string" && entry.length > 0);
+      } catch {
+        return [];
+      }
+    }
+    function writeExtraSans(dataDir, sans) {
+      (0, node_fs.mkdirSync)(tlsDir(dataDir), { recursive: true });
+      (0, node_fs.writeFileSync)((0, node_path.join)(tlsDir(dataDir), "extra-sans.json"), `${JSON.stringify(sans)}
+`, "utf-8");
+    }
+    function readTlsAccessStatus(dataDir, restartRequired = false) {
+      const dir = tlsDir(dataDir);
+      const certPath = (0, node_path.join)(dir, "camstack.crt");
+      const caPath = (0, node_path.join)(dir, "camstack-ca.crt");
+      const mode = readTlsMode(dataDir);
+      if (!(0, node_fs.existsSync)(certPath)) return {
+        mode: "disabled",
+        leafFingerprintSha256: null,
+        caFingerprintSha256: null,
+        validTo: null,
+        sans: [],
+        caCertPem: (0, node_fs.existsSync)(caPath) ? (0, node_fs.readFileSync)(caPath, "utf-8") : null,
+        reissueError: null,
+        restartRequired
+      };
+      try {
+        const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath));
+        const caPem = (0, node_fs.existsSync)(caPath) ? (0, node_fs.readFileSync)(caPath, "utf-8") : null;
+        const ca = caPem !== null ? new node_crypto.X509Certificate(caPem) : null;
+        const san = leaf.subjectAltName ?? "";
+        return {
+          mode,
+          leafFingerprintSha256: leaf.fingerprint256,
+          caFingerprintSha256: ca?.fingerprint256 ?? null,
+          validTo: new Date(leaf.validTo).toISOString(),
+          sans: san === "" ? [] : san.split(", "),
+          caCertPem: caPem,
+          reissueError: null,
+          restartRequired
+        };
+      } catch {
+        return {
+          mode,
+          leafFingerprintSha256: null,
+          caFingerprintSha256: null,
+          validTo: null,
+          sans: [],
+          caCertPem: null,
+          reissueError: "Certificate on disk could not be parsed.",
+          restartRequired
+        };
+      }
+    }
+    var DEFAULT_HTTP_PORT = 4480;
+    var handlers = null;
+    var server = null;
+    var pending = null;
+    var state = {
+      listening: false,
+      error: null,
+      port: DEFAULT_HTTP_PORT
+    };
+    var boundRequestedHost = null;
+    var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
+    function allFamiliesListenHost(host) {
+      if (host === "0.0.0.0" || host === "*" || host === "") return {
+        host: "::",
+        ipv6Only: false
+      };
+      return {
+        host,
+        ipv6Only: false
+      };
+    }
+    function registerLanHttpHandler(next) {
+      handlers = next;
+    }
+    function readLanHttpState() {
+      return state;
+    }
+    async function applyLanHttp(options) {
+      pending = options;
+      if (!options.enabled) {
+        await closeLanHttp();
+        state = {
+          listening: false,
+          error: null,
+          port: options.port
+        };
+        return state;
+      }
+      if (handlers === null) {
+        state = {
+          listening: false,
+          error: "HTTP listener is not registered yet",
+          port: options.port
+        };
+        return state;
+      }
+      if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
+      await closeLanHttp();
+      try {
+        const bound = await listenHttp(options.port, options.host, handlers);
+        server = bound;
+        boundRequestedHost = options.host;
+        const addr = bound.address();
+        state = {
+          listening: true,
+          error: null,
+          port: typeof addr === "object" && addr !== null ? addr.port : options.port
+        };
+        return state;
+      } catch (err) {
+        server = null;
+        state = {
+          listening: false,
+          error: err instanceof Error ? err.message : String(err),
+          port: options.port
+        };
+        return state;
+      }
+    }
+    async function bindPendingLanHttp() {
+      if (pending === null) return applyLanHttp({
+        enabled: true,
+        port: DEFAULT_HTTP_PORT,
+        host: "0.0.0.0"
+      });
+      return applyLanHttp(pending);
+    }
+    async function closeLanHttp() {
+      const current = server;
+      server = null;
+      boundRequestedHost = null;
+      if (current === null) return;
+      await new Promise((resolve) => {
+        current.close(() => resolve());
+      });
+    }
+    function listenHttp(port, host, next) {
+      const resolved = allFamiliesListenHost(host);
+      return listenOn(port, resolved, next).catch((err) => {
+        if (resolved.host === "::" && host !== "::") return listenOn(port, {
+          host: "0.0.0.0",
+          ipv6Only: false
+        }, next);
+        throw err;
+      });
+    }
+    function listenOn(port, bind, next) {
+      return new Promise((resolve, reject) => {
+        const created = (0, node_http.createServer)(next.onRequest);
+        created.on("upgrade", next.onUpgrade);
+        const onError = (err) => {
+          created.off("listening", onListening);
+          created.close();
+          reject(err);
+        };
+        const onListening = () => {
+          created.off("error", onError);
+          resolve(created);
+        };
+        created.once("error", onError);
+        created.once("listening", onListening);
+        created.listen({
+          port,
+          host: bind.host,
+          ipv6Only: bind.ipv6Only
+        });
+      });
+    }
+    Object.defineProperty(exports, "CA_COMMON_NAME", {
+      enumerable: true,
+      get: function() {
+        return CA_COMMON_NAME;
+      }
+    });
+    Object.defineProperty(exports, "CA_VALIDITY_DAYS", {
+      enumerable: true,
+      get: function() {
+        return CA_VALIDITY_DAYS;
+      }
+    });
+    Object.defineProperty(exports, "DEFAULT_LAN_HTTP_PORT", {
+      enumerable: true,
+      get: function() {
+        return DEFAULT_LAN_HTTP_PORT;
+      }
+    });
+    Object.defineProperty(exports, "LEAF_RENEWAL_WINDOW_DAYS", {
+      enumerable: true,
+      get: function() {
+        return LEAF_RENEWAL_WINDOW_DAYS;
+      }
+    });
+    Object.defineProperty(exports, "MAX_LEAF_VALIDITY_DAYS", {
+      enumerable: true,
+      get: function() {
+        return MAX_LEAF_VALIDITY_DAYS;
+      }
+    });
+    Object.defineProperty(exports, "SERVER_AUTH_OID", {
+      enumerable: true,
+      get: function() {
+        return SERVER_AUTH_OID;
+      }
+    });
+    Object.defineProperty(exports, "allFamiliesListenHost", {
+      enumerable: true,
+      get: function() {
+        return allFamiliesListenHost;
+      }
+    });
+    Object.defineProperty(exports, "applyLanHttp", {
+      enumerable: true,
+      get: function() {
+        return applyLanHttp;
+      }
+    });
+    Object.defineProperty(exports, "bindPendingLanHttp", {
+      enumerable: true,
+      get: function() {
+        return bindPendingLanHttp;
+      }
+    });
+    Object.defineProperty(exports, "closeLanHttp", {
+      enumerable: true,
+      get: function() {
+        return closeLanHttp;
+      }
+    });
+    Object.defineProperty(exports, "collectCertIdentity", {
+      enumerable: true,
+      get: function() {
+        return collectCertIdentity;
+      }
+    });
+    Object.defineProperty(exports, "ensureTlsCert", {
+      enumerable: true,
+      get: function() {
+        return ensureTlsCert;
+      }
+    });
+    Object.defineProperty(exports, "evaluateExistingCert", {
+      enumerable: true,
+      get: function() {
+        return evaluateExistingCert;
+      }
+    });
+    Object.defineProperty(exports, "loadTlsCert", {
+      enumerable: true,
+      get: function() {
+        return loadTlsCert;
+      }
+    });
+    Object.defineProperty(exports, "readExtraSans", {
+      enumerable: true,
+      get: function() {
+        return readExtraSans;
+      }
+    });
+    Object.defineProperty(exports, "readLanHttpState", {
+      enumerable: true,
+      get: function() {
+        return readLanHttpState;
+      }
+    });
+    Object.defineProperty(exports, "readTlsAccessStatus", {
+      enumerable: true,
+      get: function() {
+        return readTlsAccessStatus;
+      }
+    });
+    Object.defineProperty(exports, "readTlsMode", {
+      enumerable: true,
+      get: function() {
+        return readTlsMode;
+      }
+    });
+    Object.defineProperty(exports, "registerLanHttpHandler", {
+      enumerable: true,
+      get: function() {
+        return registerLanHttpHandler;
+      }
+    });
+    Object.defineProperty(exports, "reissueTlsLeaf", {
+      enumerable: true,
+      get: function() {
+        return reissueTlsLeaf;
+      }
+    });
+    Object.defineProperty(exports, "validateUploadedTls", {
+      enumerable: true,
+      get: function() {
+        return validateUploadedTls;
+      }
+    });
+    Object.defineProperty(exports, "writeExtraSans", {
+      enumerable: true,
+      get: function() {
+        return writeExtraSans;
+      }
+    });
+    Object.defineProperty(exports, "writeTlsMode", {
+      enumerable: true,
+      get: function() {
+        return writeTlsMode;
+      }
+    });
+  }
+});
+
 // ../system/dist/custom-action-registry-jY0NOZK8.js
 var require_custom_action_registry_jY0NOZK8 = __commonJS({
   "../system/dist/custom-action-registry-jY0NOZK8.js"(exports) {
@@ -118837,7 +119879,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_iAwSA2_f();
+    var require_dist10 = require_dist_C2_1HCpW();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -118861,9 +119903,10 @@ var require_dist3 = __commonJS({
     var require_builtins_system_config_system_config_addon = require_system_config_addon();
     require_system_config();
     var require_builtins_winston_logging_index = require_winston_logging();
-    var require_file_data_plane = require_file_data_plane_DUHPHa_Y();
+    var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_manifest_python_deps = require_manifest_python_deps_CwBbX4Ut();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
+    var require_lan_http_bind = require_lan_http_bind_DmgpFP6();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -118883,7 +119926,6 @@ var require_dist3 = __commonJS({
     var node_vm = __require("vm");
     node_vm = require_chunk.__toESM(node_vm);
     var _camstack_types_addon = require_addon();
-    var node_net = __require("net");
     var node_url = __require("url");
     var node_events = __require("events");
     var node_stream = __require("stream");
@@ -120169,7 +121211,7 @@ var require_dist3 = __commonJS({
         if (node.children) for (const child of node.children) this.validateNode(child, errors, warnings);
       }
     };
-    var execFileAsync$4 = (0, node_util.promisify)(node_child_process.execFile);
+    var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
     var PythonEnvManager = class {
       venvPath;
       cachedProbe = null;
@@ -120179,12 +121221,12 @@ var require_dist3 = __commonJS({
       async probe() {
         if (this.cachedProbe) return this.cachedProbe;
         for (const cmd of ["python3", "python"]) try {
-          const { stdout } = await execFileAsync$4(cmd, ["--version"]);
+          const { stdout } = await execFileAsync$3(cmd, ["--version"]);
           const version2 = stdout.trim().replace("Python ", "");
           const major = parseInt(version2.split(".")[0] ?? "0", 10);
           const minor = parseInt(version2.split(".")[1] ?? "0", 10);
           if (major < 3 || major === 3 && minor < 10) continue;
-          const { stdout: pathOut } = await execFileAsync$4(cmd, ["-c", "import sys; print(sys.executable)"]);
+          const { stdout: pathOut } = await execFileAsync$3(cmd, ["-c", "import sys; print(sys.executable)"]);
           this.cachedProbe = {
             available: true,
             version: version2,
@@ -120200,13 +121242,13 @@ var require_dist3 = __commonJS({
       async ensure(options) {
         const probe = await this.probe();
         if (!probe.available || !probe.path) throw new Error("Python 3.10+ is required but not found on this system");
-        if (!node_fs.existsSync(node_path.join(this.venvPath, "bin", "python"))) await execFileAsync$4(probe.path, [
+        if (!node_fs.existsSync(node_path.join(this.venvPath, "bin", "python"))) await execFileAsync$3(probe.path, [
           "-m",
           "venv",
           this.venvPath
         ]);
         const venvPython = node_path.join(this.venvPath, "bin", "python");
-        if (options.packages.length > 0) await execFileAsync$4(venvPython, [
+        if (options.packages.length > 0) await execFileAsync$3(venvPython, [
           "-m",
           "pip",
           "install",
@@ -120648,338 +121690,6 @@ var require_dist3 = __commonJS({
         };
       }
     };
-    var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
-    var MAX_LEAF_VALIDITY_DAYS = 397;
-    var LEAF_RENEWAL_WINDOW_DAYS = 30;
-    var CA_VALIDITY_DAYS = 3650;
-    var MS_PER_DAY = 864e5;
-    var REASONS_REQUIRING_NEW_CA = [
-      "missing",
-      "unreadable",
-      "no-local-ca",
-      "ca-expiring"
-    ];
-    function reasonRequiresNewCa(reason) {
-      return REASONS_REQUIRING_NEW_CA.includes(reason);
-    }
-    function parse$1(pem) {
-      try {
-        return new node_crypto.X509Certificate(pem);
-      } catch {
-        return null;
-      }
-    }
-    function daysBetween(from, to) {
-      return (to.getTime() - from.getTime()) / MS_PER_DAY;
-    }
-    function hasServerAuthEku(leaf) {
-      const eku = leaf.keyUsage;
-      return eku !== void 0 && eku.length === 1 && eku[0] === "1.3.6.1.5.5.7.3.1";
-    }
-    function keyMatches(leaf, keyPem) {
-      try {
-        return leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem));
-      } catch {
-        return false;
-      }
-    }
-    function coversIdentity(leaf, identity) {
-      for (const name2 of identity.requiredDnsNames) if (leaf.checkHost(name2) === void 0) return false;
-      for (const ip of identity.requiredIpAddresses) if (leaf.checkIP(ip) === void 0) return false;
-      return true;
-    }
-    function evaluateExistingCert(input) {
-      const leaf = parse$1(input.chainPem);
-      const ca = parse$1(input.caPem);
-      if (leaf === null || ca === null) return "unreadable";
-      if (daysBetween(input.now, new Date(ca.validTo)) < 427) return "ca-expiring";
-      if (!keyMatches(leaf, input.keyPem)) return "key-mismatch";
-      if (daysBetween(input.now, new Date(leaf.validTo)) < 30) return "expiring";
-      if (!hasServerAuthEku(leaf)) return "missing-server-auth-eku";
-      if (leaf.ca || !leaf.checkIssued(ca) || !leaf.verify(ca.publicKey)) return "not-issued-by-local-ca";
-      if (daysBetween(new Date(leaf.validFrom), new Date(leaf.validTo)) > 398) return "validity-too-long";
-      if (!coversIdentity(leaf, input.identity)) return "san-coverage-gap";
-      return null;
-    }
-    var VOLATILE_INTERFACE_PREFIXES = [
-      "docker",
-      "br-",
-      "veth",
-      "virbr",
-      "cni",
-      "flannel",
-      "tun",
-      "utun",
-      "tap",
-      "wg",
-      "zt",
-      "tailscale",
-      "ppp",
-      "awdl",
-      "llw"
-    ];
-    var DNS_NAME_PATTERN = /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/;
-    function isIpv4(value) {
-      return (0, node_net.isIP)(value) === 4;
-    }
-    function isIpv6(value) {
-      return (0, node_net.isIP)(value) === 6;
-    }
-    function isLinkLocal(value) {
-      if (isIpv4(value)) return value.startsWith("169.254.");
-      if (!isIpv6(value)) return false;
-      const firstGroup = value.split(":")[0] ?? "";
-      if (firstGroup === "") return false;
-      const parsed = Number.parseInt(firstGroup, 16);
-      return Number.isFinite(parsed) && (parsed & 65472) === 65152;
-    }
-    function isUniqueLocalIpv6(value) {
-      if (!isIpv6(value)) return false;
-      const firstGroup = value.split(":")[0] ?? "";
-      const parsed = Number.parseInt(firstGroup, 16);
-      return Number.isFinite(parsed) && (parsed & 65024) === 64512;
-    }
-    function isVolatileInterface(name2) {
-      const lower = name2.toLowerCase();
-      return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
-    }
-    function isStableGateAddress(address) {
-      if (isLinkLocal(address)) return false;
-      if (isIpv4(address)) return true;
-      return isUniqueLocalIpv6(address);
-    }
-    function addSan(dns, ips, value) {
-      const trimmed = value.trim();
-      if (trimmed === "") return;
-      if ((0, node_net.isIP)(trimmed) !== 0) {
-        if (!isLinkLocal(trimmed)) ips.add(trimmed);
-        return;
-      }
-      if (DNS_NAME_PATTERN.test(trimmed)) dns.add(trimmed);
-    }
-    function collectCertIdentity(options) {
-      const dnsNames = /* @__PURE__ */ new Set();
-      const ipAddresses = /* @__PURE__ */ new Set(["127.0.0.1", "::1"]);
-      const requiredDnsNames = /* @__PURE__ */ new Set();
-      const requiredIpAddresses = /* @__PURE__ */ new Set(["127.0.0.1"]);
-      for (const name2 of [
-        "localhost",
-        options.commonName,
-        node_os.hostname()
-      ]) {
-        addSan(dnsNames, ipAddresses, name2);
-        addSan(requiredDnsNames, requiredIpAddresses, name2);
-      }
-      for (const [ifaceName, addrs] of Object.entries(node_os.networkInterfaces())) for (const addr of addrs ?? []) {
-        if (addr.internal) continue;
-        if (isLinkLocal(addr.address)) continue;
-        ipAddresses.add(addr.address);
-        if (isVolatileInterface(ifaceName)) continue;
-        if (isStableGateAddress(addr.address)) requiredIpAddresses.add(addr.address);
-      }
-      for (const san of options.extraSans) {
-        addSan(dnsNames, ipAddresses, san);
-        addSan(requiredDnsNames, requiredIpAddresses, san);
-      }
-      return {
-        dnsNames: [...dnsNames],
-        ipAddresses: [...ipAddresses],
-        requiredDnsNames: [...requiredDnsNames],
-        requiredIpAddresses: [...requiredIpAddresses]
-      };
-    }
-    var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
-    var CA_COMMON_NAME = "CamStack Local CA";
-    function sanValue(identity) {
-      const parts = [];
-      for (const dns of identity.dnsNames) parts.push(`DNS:${dns}`);
-      for (const ip of identity.ipAddresses) if ((0, node_net.isIP)(ip) !== 0) parts.push(`IP:${ip}`);
-      return parts.join(",");
-    }
-    async function generateCa(tmpDir) {
-      const caCertPath = (0, node_path.join)(tmpDir, "ca.crt");
-      const caKeyPath = (0, node_path.join)(tmpDir, "ca.key");
-      await execFileAsync$3("openssl", [
-        "req",
-        "-x509",
-        "-newkey",
-        "rsa:2048",
-        "-nodes",
-        "-sha256",
-        "-days",
-        String(CA_VALIDITY_DAYS),
-        "-keyout",
-        caKeyPath,
-        "-out",
-        caCertPath,
-        "-subj",
-        `/CN=${CA_COMMON_NAME}`,
-        "-addext",
-        "basicConstraints=critical,CA:TRUE,pathlen:0",
-        "-addext",
-        "keyUsage=critical,keyCertSign,cRLSign",
-        "-addext",
-        "subjectKeyIdentifier=hash"
-      ]);
-      await (0, node_fs_promises.chmod)(caKeyPath, 384);
-      return {
-        caCertPath,
-        caKeyPath
-      };
-    }
-    async function issueLeaf(tmpDir, ca, identity, commonName, validDays) {
-      const keyPath = (0, node_path.join)(tmpDir, "leaf.key");
-      const csrPath = (0, node_path.join)(tmpDir, "leaf.csr");
-      const certPath = (0, node_path.join)(tmpDir, "leaf.crt");
-      const extPath = (0, node_path.join)(tmpDir, "leaf.ext");
-      await (0, node_fs_promises.writeFile)(extPath, [
-        "basicConstraints=critical,CA:FALSE",
-        "keyUsage=critical,digitalSignature,keyEncipherment",
-        "extendedKeyUsage=serverAuth",
-        "subjectKeyIdentifier=hash",
-        "authorityKeyIdentifier=keyid,issuer",
-        `subjectAltName=${sanValue(identity)}`,
-        ""
-      ].join("\n"), "utf-8");
-      await execFileAsync$3("openssl", [
-        "req",
-        "-new",
-        "-newkey",
-        "rsa:2048",
-        "-nodes",
-        "-sha256",
-        "-keyout",
-        keyPath,
-        "-out",
-        csrPath,
-        "-subj",
-        `/CN=${commonName}`
-      ]);
-      await execFileAsync$3("openssl", [
-        "x509",
-        "-req",
-        "-in",
-        csrPath,
-        "-CA",
-        ca.caCertPath,
-        "-CAkey",
-        ca.caKeyPath,
-        "-set_serial",
-        `0x00${(0, node_crypto.randomBytes)(16).toString("hex")}`,
-        "-days",
-        String(validDays),
-        "-sha256",
-        "-extfile",
-        extPath,
-        "-out",
-        certPath
-      ]);
-      await (0, node_fs_promises.chmod)(keyPath, 384);
-      await (0, node_fs_promises.rm)(csrPath, { force: true });
-      await (0, node_fs_promises.rm)(extPath, { force: true });
-      return {
-        certPath,
-        keyPath
-      };
-    }
-    var DEFAULT_COMMON_NAME = "camstack.local";
-    async function ensureTlsCert(dataDir, options) {
-      const tlsDir = (0, node_path.join)(dataDir, "tls");
-      const paths = {
-        certPath: (0, node_path.join)(tlsDir, "camstack.crt"),
-        keyPath: (0, node_path.join)(tlsDir, "camstack.key"),
-        caCertPath: (0, node_path.join)(tlsDir, "camstack-ca.crt"),
-        caKeyPath: (0, node_path.join)(tlsDir, "camstack-ca.key")
-      };
-      const commonName = options?.commonName ?? DEFAULT_COMMON_NAME;
-      const validDays = Math.min(options?.validDays ?? 397, 397);
-      const identity = collectCertIdentity({
-        commonName,
-        extraSans: options?.extraSans ?? []
-      });
-      const reason = decideRegeneration(paths, identity);
-      if (reason === null) return describe(paths, false, null, false, null);
-      const previousFingerprint = readFingerprint(paths.certPath);
-      const caRotated = reasonRequiresNewCa(reason);
-      (0, node_fs.mkdirSync)(tlsDir, { recursive: true });
-      await regenerate(paths, identity, commonName, validDays, caRotated);
-      return describe(paths, true, reason, caRotated, previousFingerprint);
-    }
-    function readFingerprint(certPath) {
-      try {
-        return new node_crypto.X509Certificate((0, node_fs.readFileSync)(certPath)).fingerprint256;
-      } catch {
-        return null;
-      }
-    }
-    function decideRegeneration(paths, identity) {
-      if (!(0, node_fs.existsSync)(paths.certPath) || !(0, node_fs.existsSync)(paths.keyPath)) return "missing";
-      if (!(0, node_fs.existsSync)(paths.caCertPath) || !(0, node_fs.existsSync)(paths.caKeyPath)) return "no-local-ca";
-      try {
-        return evaluateExistingCert({
-          chainPem: (0, node_fs.readFileSync)(paths.certPath, "utf-8"),
-          keyPem: (0, node_fs.readFileSync)(paths.keyPath, "utf-8"),
-          caPem: (0, node_fs.readFileSync)(paths.caCertPath, "utf-8"),
-          identity,
-          now: /* @__PURE__ */ new Date()
-        });
-      } catch {
-        return "unreadable";
-      }
-    }
-    async function regenerate(paths, identity, commonName, validDays, newCa) {
-      const scratch = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "camstack-tls-"));
-      try {
-        const ca = newCa ? await generateCa(scratch) : {
-          caCertPath: paths.caCertPath,
-          caKeyPath: paths.caKeyPath
-        };
-        const leaf = await issueLeaf(scratch, ca, identity, commonName, validDays);
-        const chainPath = (0, node_path.join)(scratch, "chain.crt");
-        await (0, node_fs_promises.writeFile)(chainPath, `${(0, node_fs.readFileSync)(leaf.certPath, "utf-8").trimEnd()}
-${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
-`, "utf-8");
-        if (newCa) {
-          await (0, node_fs_promises.copyFile)(ca.caCertPath, `${paths.caCertPath}.new`);
-          await (0, node_fs_promises.copyFile)(ca.caKeyPath, `${paths.caKeyPath}.new`);
-          (0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
-          (0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
-          await (0, node_fs_promises.chmod)(paths.caKeyPath, 384);
-        }
-        await (0, node_fs_promises.copyFile)(leaf.keyPath, `${paths.keyPath}.new`);
-        await (0, node_fs_promises.copyFile)(chainPath, `${paths.certPath}.new`);
-        (0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
-        (0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
-        await (0, node_fs_promises.chmod)(paths.keyPath, 384);
-      } finally {
-        await (0, node_fs_promises.rm)(scratch, {
-          recursive: true,
-          force: true
-        });
-      }
-    }
-    function describe(paths, generated, reason, caRotated, previousFingerprintSha256) {
-      const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
-      const ca = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.caCertPath));
-      const san = leaf.subjectAltName ?? "";
-      return {
-        ...paths,
-        generated,
-        reason,
-        caRotated,
-        fingerprintSha256: leaf.fingerprint256,
-        previousFingerprintSha256,
-        caFingerprintSha256: ca.fingerprint256,
-        validTo: new Date(leaf.validTo).toISOString(),
-        sans: san === "" ? [] : san.split(", ")
-      };
-    }
-    function loadTlsCert(certPath, keyPath) {
-      return {
-        cert: (0, node_fs.readFileSync)(certPath),
-        key: (0, node_fs.readFileSync)(keyPath)
-      };
-    }
     function serializeSetting(value) {
       if (typeof value === "number") return {
         value: String(value),
@@ -199251,8 +199961,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.AlertCenterAddon = require_builtins_alerts_alerts_addon.AlertCenterAddon;
     exports.ApiKeyManager = require_builtins_local_auth_local_auth_addon.ApiKeyManager;
     exports.AuthManager = require_builtins_local_auth_local_auth_addon.AuthManager;
-    exports.CA_COMMON_NAME = CA_COMMON_NAME;
-    exports.CA_VALIDITY_DAYS = CA_VALIDITY_DAYS;
+    exports.CA_COMMON_NAME = require_lan_http_bind.CA_COMMON_NAME;
+    exports.CA_VALIDITY_DAYS = require_lan_http_bind.CA_VALIDITY_DAYS;
     exports.CLUSTER_SECRET_MISMATCH_TYPE = CLUSTER_SECRET_MISMATCH_TYPE;
     exports.CLUSTER_SECRET_REJECTED_EXIT_CODE = CLUSTER_SECRET_REJECTED_EXIT_CODE;
     exports.CORE_CAP_SERVICE_NAME = CORE_CAP_SERVICE_NAME;
@@ -199269,6 +199979,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.CoreBlocksAddon = require_builtins_core_blocks_core_blocks_addon.CoreBlocksAddon;
     exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
     exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
+    exports.DEFAULT_LAN_HTTP_PORT = require_lan_http_bind.DEFAULT_LAN_HTTP_PORT;
     exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_dist10.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
     exports.DEVICE_STATUS_METHOD = require_dist10.DEVICE_STATUS_METHOD;
     exports.DataPlaneRegistry = DataPlaneRegistry;
@@ -199299,7 +200010,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.INFRA_CAPABILITIES = INFRA_CAPABILITIES;
     exports.IntegrationRegistry = IntegrationRegistry;
     exports.JobJournal = JobJournal;
-    exports.LEAF_RENEWAL_WINDOW_DAYS = LEAF_RENEWAL_WINDOW_DAYS;
+    exports.LEAF_RENEWAL_WINDOW_DAYS = require_lan_http_bind.LEAF_RENEWAL_WINDOW_DAYS;
     exports.LifecycleJobEngine = LifecycleJobEngine;
     exports.LifecycleStateMachine = LifecycleStateMachine;
     exports.LivenessMonitorAddon = require_builtins_liveness_monitor_liveness_monitor_addon.LivenessMonitorAddon;
@@ -199310,7 +200021,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.LogRingBuffer = LogRingBuffer;
     exports.LokiDestination = require_builtins_loki_logging_index.LokiDestination$1;
     exports.LokiLoggingAddon = require_builtins_loki_logging_index.LokiLoggingAddon$1;
-    exports.MAX_LEAF_VALIDITY_DAYS = MAX_LEAF_VALIDITY_DAYS;
+    exports.MAX_LEAF_VALIDITY_DAYS = require_lan_http_bind.MAX_LEAF_VALIDITY_DAYS;
     exports.METHOD_ACCESS_MAP = require_dist10.METHOD_ACCESS_MAP;
     exports.ModelDownloadService = require_file_data_plane.ModelDownloadService;
     exports.NATIVE_PROVIDER_SERVICE_INFIX = require_manifest_python_deps.NATIVE_PROVIDER_SERVICE_INFIX;
@@ -199336,7 +200047,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.ReadinessTimeoutError = require_dist10.ReadinessTimeoutError;
     exports.ReplEngine = ReplEngine;
     exports.RingBuffer = RingBuffer;
-    exports.SERVER_AUTH_OID = SERVER_AUTH_OID;
+    exports.SERVER_AUTH_OID = require_lan_http_bind.SERVER_AUTH_OID;
     exports.ScopedLogger = ScopedLogger;
     exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
     exports.SocketChannel = require_manifest_python_deps.SocketChannel;
@@ -199360,6 +200071,9 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.__resetCapUsageRegistryForTests = require_manifest_python_deps.__resetCapUsageRegistryForTests;
     exports.adaptBrokerToCluster = require_manifest_python_deps.adaptBrokerToCluster;
     exports.addonSettingsCapability = require_dist10.addonSettingsCapability;
+    exports.allFamiliesListenHost = require_lan_http_bind.allFamiliesListenHost;
+    exports.applyLanHttp = require_lan_http_bind.applyLanHttp;
+    exports.bindPendingLanHttp = require_lan_http_bind.bindPendingLanHttp;
     exports.bootstrapSchema = bootstrapSchema;
     exports.brokerCallForCap = require_manifest_python_deps.brokerCallForCap;
     exports.brokerTransportLink = require_manifest_python_deps.brokerTransportLink;
@@ -199386,9 +200100,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.classifyAddonDir = classifyAddonDir;
     exports.classifyCapRoute = require_manifest_python_deps.classifyCapRoute;
     exports.clearPendingRestart = clearPendingRestart;
+    exports.closeLanHttp = require_lan_http_bind.closeLanHttp;
     exports.clusterEventTopic = require_manifest_python_deps.clusterEventTopic;
     exports.clusterSecretMatches = clusterSecretMatches;
-    exports.collectCertIdentity = collectCertIdentity;
+    exports.collectCertIdentity = require_lan_http_bind.collectCertIdentity;
     exports.collectModelFiles = require_file_data_plane.collectModelFiles;
     exports.contentTypeFor = require_file_data_plane.contentTypeFor;
     exports.copyDirRecursive = copyDirRecursive;
@@ -199454,8 +200169,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         return _camstack_types_node.ensurePython;
       }
     });
-    exports.ensureTlsCert = ensureTlsCert;
-    exports.evaluateExistingCert = evaluateExistingCert;
+    exports.ensureTlsCert = require_lan_http_bind.ensureTlsCert;
+    exports.evaluateExistingCert = require_lan_http_bind.evaluateExistingCert;
     exports.expandCapMethods = require_dist10.expandCapMethods;
     exports.fetchJson = require_file_data_plane.fetchJson;
     Object.defineProperty(exports, "findInPath", {
@@ -199519,7 +200234,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.isInfraCapability = isInfraCapability;
     exports.isModelDownloaded = require_file_data_plane.isModelDownloaded;
     exports.isSourceNewer = isSourceNewer;
-    exports.loadTlsCert = loadTlsCert;
+    exports.loadTlsCert = require_lan_http_bind.loadTlsCert;
     exports.localEndpointPath = require_manifest_python_deps.localEndpointPath;
     exports.localProviderLink = require_manifest_python_deps.localProviderLink;
     exports.mountNativeCapService = require_manifest_python_deps.mountNativeCapService;
@@ -199528,9 +200243,15 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.parseTokenizedUrl = require_file_data_plane.parseTokenizedUrl;
     exports.proxyToUpstream = proxyToUpstream;
     exports.quarantineAddonResidue = quarantineAddonResidue;
+    exports.readExtraSans = require_lan_http_bind.readExtraSans;
+    exports.readLanHttpState = require_lan_http_bind.readLanHttpState;
     exports.readPendingRestart = readPendingRestart;
+    exports.readTlsAccessStatus = require_lan_http_bind.readTlsAccessStatus;
+    exports.readTlsMode = require_lan_http_bind.readTlsMode;
     exports.readinessKey = require_dist10.readinessKey;
     exports.registerEventBusService = require_manifest_python_deps.registerEventBusService;
+    exports.registerLanHttpHandler = require_lan_http_bind.registerLanHttpHandler;
+    exports.reissueTlsLeaf = require_lan_http_bind.reissueTlsLeaf;
     exports.resolveFilePath = require_file_data_plane.resolveFilePath;
     exports.resolveHwAccel = require_manifest_python_deps.resolveHwAccel;
     exports.resolveNpmInvocation = require_manifest_python_deps.resolveNpmInvocation;
@@ -199551,7 +200272,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.subscribePassthrough = require_manifest_python_deps.subscribePassthrough;
     exports.udsChildLogToWorkerEntry = require_manifest_python_deps.udsChildLogToWorkerEntry;
     exports.validateProviderRegistrations = require_manifest_python_deps.validateProviderRegistrations;
+    exports.validateUploadedTls = require_lan_http_bind.validateUploadedTls;
+    exports.writeExtraSans = require_lan_http_bind.writeExtraSans;
     exports.writePendingRestart = writePendingRestart;
+    exports.writeTlsMode = require_lan_http_bind.writeTlsMode;
   }
 });
 
@@ -239766,6 +240490,16 @@ var require_dist9 = __commonJS({
       description: zod.z.string().optional(),
       icon: zod.z.string().optional()
     });
+    var CLASS_MAP_MACRO_TARGETS = [
+      "person",
+      "vehicle",
+      "animal",
+      "package"
+    ];
+    var ClassMapDefinitionSchema = zod.z.object({
+      mapping: zod.z.record(zod.z.string(), zod.z.enum(CLASS_MAP_MACRO_TARGETS)),
+      preserveOriginal: zod.z.boolean()
+    });
     var FORMAT_KEYS = [
       "onnx",
       "coreml",
@@ -240034,7 +240768,13 @@ var require_dist9 = __commonJS({
       * `id` stays the source of truth for resolution/download/persistence; grouping
       * is a presentation overlay resolved back to an `id`.
       */
-      group: ModelVariantGroupSchema.optional()
+      group: ModelVariantGroupSchema.optional(),
+      /**
+      * Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+      * applies (Frigate / COCO public catalog). Set on a custom model whose raw
+      * labels already ARE the CamStack macros (Scrypted identity map).
+      */
+      classMap: ClassMapDefinitionSchema.optional()
     });
     var ConvertTargetSchema = zod.z.discriminatedUnion("format", [zod.z.object({
       format: zod.z.literal("openvino"),
@@ -240063,7 +240803,8 @@ var require_dist9 = __commonJS({
         "ocr",
         "segmentation"
       ]),
-      faceAlignment: zod.z.boolean().optional()
+      faceAlignment: zod.z.boolean().optional(),
+      classMap: ClassMapDefinitionSchema.optional()
     });
     var ConvertArtifactSchema = zod.z.object({
       format: zod.z.enum(MODEL_FORMATS),
@@ -250963,6 +251704,33 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         h: zod.z.number()
       })
     });
+    zod.z.object({
+      crop: zod.z.object({
+        left: zod.z.number(),
+        top: zod.z.number(),
+        width: zod.z.number().positive(),
+        height: zod.z.number().positive()
+      }).optional(),
+      content: zod.z.object({
+        width: zod.z.number().int().positive(),
+        height: zod.z.number().int().positive()
+      }),
+      fit: zod.z.enum(["stretch", "contain"]),
+      format: zod.z.enum([
+        "rgb",
+        "gray",
+        "jpeg"
+      ])
+    });
+    var FrameRefSchema = zod.z.object({
+      registryId: zod.z.string().min(1),
+      id: zod.z.string().min(1),
+      width: zod.z.number().int().positive(),
+      height: zod.z.number().int().positive(),
+      format: zod.z.enum(["rgb", "gray"]),
+      timestamp: zod.z.number(),
+      capturedAt: zod.z.number().optional()
+    });
     var ModelFormatSchema$1 = zod.z.enum([
       "onnx",
       "coreml",
@@ -251262,7 +252030,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * legacy call shape used by existing benchmark code; once all
         * callers pass it explicitly we make it required.
         *
-        * Exactly one of `frame`, `frameHandle`, `imageBase64`,
+        * Exactly one of `frame`, `frameRef`, `frameHandle`, `imageBase64`,
         * `referenceImage` must be provided:
         *  - `frame`: runtime dispatch path (runner → decoded broker frame).
         *    Carries the raw buffer, dimensions, and format; the executor
@@ -251284,6 +252052,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           steps: zod.z.array(PipelineStepInputSchema).min(1),
           frame: FrameInputSchema.optional(),
           /**
+          * Process-local lazy frame. Valid only when caller and provider resolve
+          * in the same execution-group process; split/cross-node callers use
+          * `frame`/`image` inline compatibility instead.
+          */
+          frameRef: FrameRefSchema.optional(),
+          /**
           * CB5 shm passthrough — a `FrameHandle` naming the same ring slot
           * the decoded pixels live in. One more member of the one-of
           * frame/frameHandle/image/imageBase64/referenceImage group.
@@ -251586,7 +252360,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Which source served this crop, so a quality-sensitive consumer (the native
       * `keyFrame`) can reject a degraded fallback:
       * - `native` — cut from the decode worker's retained NATIVE surface (the
-      *   quality path).
+      *   quality path). A subject-tile serve is also native-resolution and stays
+      *   `native` here: the public enum cannot name `tile` without a breaking cap
+      *   change. Runner telemetry distinguishes lease vs tile via `source` on the
+      *   internal crop result (`nativeHits` vs `tileHits`).
       * - `ram-fullframe` — the native surface MISSED but the request was full-frame,
       *   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
       *   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -252089,12 +252866,41 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         cpuCores: zod.z.number().optional()
       })
     });
+    var FrameLazyCountersSchema = zod.z.object({
+      framesDecoded: zod.z.number(),
+      framesAdmitted: zod.z.number(),
+      framesDroppedPixelFree: zod.z.number(),
+      viewsMaterialized: zod.z.number(),
+      viewsSkipped: zod.z.number(),
+      workerToRunnerBytes: zod.z.number(),
+      runnerToPoolRawBytes: zod.z.number(),
+      runnerToPoolJpegBytes: zod.z.number(),
+      onDemandFullFrameRequests: zod.z.number(),
+      onDemandCropRequests: zod.z.number(),
+      nativeHits: zod.z.number(),
+      nativeMisses: zod.z.number(),
+      tileHits: zod.z.number(),
+      tileMisses: zod.z.number(),
+      fallbackHits: zod.z.number(),
+      fallbackMisses: zod.z.number(),
+      retainedWritesAvoided: zod.z.number(),
+      residentRefs: zod.z.number(),
+      residentBytes: zod.z.number(),
+      releases: zod.z.number(),
+      evictions: zod.z.number(),
+      staleMisses: zod.z.number()
+    });
+    var FrameLazyMetricsSchema = zod.z.object({
+      node: FrameLazyCountersSchema,
+      cameras: zod.z.array(FrameLazyCountersSchema.extend({ deviceId: zod.z.number() }))
+    });
     var RunnerLocalMetricsSchema = zod.z.object({
       nodeId: zod.z.string(),
       activeCameras: zod.z.number(),
       throttledCameras: zod.z.number(),
       avgInferenceTimeMs: zod.z.number(),
-      queueDepth: zod.z.number()
+      queueDepth: zod.z.number(),
+      frameLazy: FrameLazyMetricsSchema.optional()
     });
     var pipelineRunnerCapability = {
       name: "pipeline-runner",
@@ -253900,6 +254706,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         endDownload: require_sleep.method(EndDownloadInputSchema, zod.z.void(), { kind: "mutation" })
       }
     };
+    var ProfileSettingsSchemaBridge = zod.z.unknown().nullable();
+    var ProfileSettingsBagSchema = zod.z.record(zod.z.string(), zod.z.unknown());
     var TerminalSessionInfoSchema = zod.z.object({
       /** Opaque session id minted by the provider on `openSession`. */
       sessionId: zod.z.string(),
@@ -253915,7 +254723,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var TerminalProfileInfoSchema = zod.z.object({
       profileId: zod.z.string(),
       label: zod.z.string(),
-      description: zod.z.string().optional()
+      description: zod.z.string().optional(),
+      /** Spawn defaults the instance form copies on create. */
+      executable: zod.z.string().optional(),
+      args: zod.z.array(zod.z.string()).readonly().optional(),
+      cwd: zod.z.string().optional(),
+      environment: zod.z.array(zod.z.string()).readonly().optional(),
+      /** ConfigUISchema for instance knobs, or null when the profile has none. */
+      settingsSchema: ProfileSettingsSchemaBridge.optional()
     });
     var TerminalInstanceInfoSchema = zod.z.object({
       instanceId: zod.z.string(),
@@ -253924,7 +254739,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       profileId: zod.z.string(),
       profileLabel: zod.z.string(),
       name: zod.z.string(),
-      enabled: zod.z.boolean()
+      enabled: zod.z.boolean(),
+      executable: zod.z.string(),
+      args: zod.z.array(zod.z.string()).readonly(),
+      cwd: zod.z.string(),
+      environment: zod.z.array(zod.z.string()).readonly(),
+      profileSettings: ProfileSettingsBagSchema
     });
     var TerminalLegacyCameraSchema = zod.z.object({
       stableId: zod.z.string(),
@@ -253963,7 +254783,24 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         createInstance: require_sleep.method(zod.z.object({
           targetNodeId: zod.z.string().min(1),
           profileId: zod.z.string().min(1),
-          name: zod.z.string().trim().min(1).max(160).optional()
+          name: zod.z.string().trim().min(1).max(160).optional(),
+          executable: zod.z.string().max(1024).optional(),
+          args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+          cwd: zod.z.string().max(1024).optional(),
+          environment: zod.z.array(zod.z.string().max(4096)).max(64).optional(),
+          profileSettings: ProfileSettingsBagSchema.optional()
+        }), TerminalInstanceInfoSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        updateInstance: require_sleep.method(zod.z.object({
+          instanceId: zod.z.string().min(1),
+          name: zod.z.string().trim().min(1).max(160).optional(),
+          executable: zod.z.string().max(1024).optional(),
+          args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+          cwd: zod.z.string().max(1024).optional(),
+          environment: zod.z.array(zod.z.string().max(4096)).max(64).optional(),
+          profileSettings: ProfileSettingsBagSchema.optional()
         }), TerminalInstanceInfoSchema, {
           kind: "mutation",
           auth: "admin"
@@ -253998,7 +254835,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         openSession: require_sleep.method(zod.z.object({
           profileId: zod.z.string(),
           cols: zod.z.number().int().positive(),
-          rows: zod.z.number().int().positive()
+          rows: zod.z.number().int().positive(),
+          executable: zod.z.string().max(1024).optional(),
+          args: zod.z.array(zod.z.string().max(2048)).max(64).optional(),
+          cwd: zod.z.string().max(1024).optional(),
+          environment: zod.z.array(zod.z.string().max(4096)).max(64).optional()
         }), TerminalSessionInfoSchema, {
           kind: "mutation",
           auth: "admin"
@@ -257724,6 +258565,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** What the ranking currently resolves to (null when nothing is reachable). */
       resolved: zod.z.string().nullable()
     });
+    var ViewerEndpointsSchema = zod.z.object({
+      /** The operator's explicit race set, or empty for AUTO. */
+      baseUrls: zod.z.array(zod.z.string()).readonly(),
+      /** What the ranking currently resolves to (may be empty if nothing is up). */
+      resolved: zod.z.array(zod.z.string()).readonly()
+    });
     var AllowedAddressesSchema = zod.z.object({
       /**
       * Allowlist of interface addresses operators have explicitly opted
@@ -257733,6 +258580,20 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       addresses: zod.z.array(zod.z.string()).readonly()
     });
+    var TlsStatusSchema = zod.z.object({
+      mode: zod.z.enum([
+        "generated",
+        "uploaded",
+        "disabled"
+      ]),
+      leafFingerprintSha256: zod.z.string().nullable(),
+      caFingerprintSha256: zod.z.string().nullable(),
+      validTo: zod.z.string().nullable(),
+      sans: zod.z.array(zod.z.string()),
+      caCertPem: zod.z.string().nullable(),
+      reissueError: zod.z.string().nullable(),
+      restartRequired: zod.z.boolean()
+    });
     var localNetworkCapability = {
       name: "local-network",
       scope: "system",
@@ -257752,13 +258613,13 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         */
         getPreferred: require_sleep.method(zod.z.void(), PreferredSchema),
         /**
-        * Ordered candidate base URLs the SDK should try on connect.
-        * Includes LAN IPs (one per non-internal interface), the public
-        * tunnel hostname (when active), and loopback as a last-resort
-        * fallback. Filterable by `includeLoopback` / `ipv4Only`.
-        * Honours `getAllowedAddresses()` when set — addresses outside
-        * the allowlist are dropped (the public tunnel + loopback are
-        * always included as escape hatches).
+        * Ordered candidate base URLs (the palette the Network tab shows).
+        * Includes LAN IPv4, stable LAN IPv6, the public tunnel, and mesh when
+        * joined. Loopback is off by default. The SDK races the subset from
+        * `getViewerEndpoints`, not this full list — IPv6 stays here because
+        * WebRTC ICE gathers dual-stack regardless of the HTTP race. Honours
+        * `getAllowedAddresses()` when set — addresses outside the allowlist
+        * are dropped (the public tunnel is still included as an escape hatch).
         *
         * **The port is the hub's, not the caller's** (D62 — a function's fact
         * belongs to whoever already owns it). This method used to take a `port`
@@ -257789,10 +258650,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           */
           port: zod.z.number().int().min(1).max(65535).optional(),
           /** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-          *  candidate. Default `true`. */
+          *  candidate. Default `false` — loopback is not a client route. */
           includeLoopback: zod.z.boolean().optional(),
-          /** Skip IPv6 entries. Some legacy clients can't parse them.
-          *  Default `false`. */
+          /** Skip IPv6 entries. Default `false` — the palette includes stable
+          *  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+          *  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
           ipv4Only: zod.z.boolean().optional(),
           /** Scheme to emit for LAN/loopback URLs. Default `'http'`.
           *  Pass `'https'` when the caller is itself loaded over HTTPS
@@ -257821,6 +258683,19 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         */
         setNotificationEndpoint: require_sleep.method(zod.z.object({ baseUrl: zod.z.string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }),
         /**
+        * The endpoints the SDK / viewer races for API access. Empty `baseUrls`
+        * means AUTO: every LAN IPv4 address plus the public tunnel, never IPv6,
+        * never mesh, never loopback. `resolved` is that set (or the operator's
+        * explicit subset) as it stands right now.
+        */
+        getViewerEndpoints: require_sleep.method(zod.z.void(), ViewerEndpointsSchema),
+        /**
+        * Replace the viewer race set. Empty `baseUrls` restores AUTO. Stored
+        * verbatim (not indices) so a temporarily-down tunnel is not silently
+        * dropped from the operator's choice.
+        */
+        setViewerEndpoints: require_sleep.method(zod.z.object({ baseUrls: zod.z.array(zod.z.string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }),
+        /**
         * Read the operator's allowlist. Empty = "auto" (no filter). Used
         * by the admin UI's address selector to seed its checkbox state.
         */
@@ -257838,7 +258713,34 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * when the operator wants to wipe their manual edits and start
         * over from the auto-detected best matches.
         */
-        resetAllowlistToBestMatch: require_sleep.method(zod.z.void(), AllowedAddressesSchema, { kind: "mutation" })
+        resetAllowlistToBestMatch: require_sleep.method(zod.z.void(), AllowedAddressesSchema, { kind: "mutation" }),
+        /**
+        * Live TLS material for the Network → Local access certificate card.
+        * LAN HTTP / hostname are addon settings (`globalSettingsSchema`), not
+        * a second store — this query is status, not configuration.
+        */
+        getTlsStatus: require_sleep.method(zod.z.void(), TlsStatusSchema),
+        /** Issue a new leaf under the existing local CA. Disabled in uploaded mode. */
+        regenerateCertificate: require_sleep.method(zod.z.object({ reason: zod.z.string().optional() }), TlsStatusSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /** Replace the served material with operator-supplied PEMs. */
+        uploadCertificate: require_sleep.method(zod.z.object({
+          certPem: zod.z.string().min(1),
+          keyPem: zod.z.string().min(1),
+          caPem: zod.z.string().optional()
+        }), TlsStatusSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /** The local CA PEM, or empty when there is none to download. */
+        downloadCa: require_sleep.method(zod.z.void(), zod.z.object({ pem: zod.z.string() })),
+        /** Drop uploaded material and return to the generated local CA. */
+        revertToGeneratedCertificate: require_sleep.method(zod.z.void(), TlsStatusSchema, {
+          kind: "mutation",
+          auth: "admin"
+        })
       },
       /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
       mount: { kind: "hub-only" }
@@ -268127,6 +269029,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "localNetwork.downloadCa": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "localNetwork.getAllowedAddresses": {
         capName: "local-network",
         capScope: "system",
@@ -268151,18 +269059,42 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "localNetwork.getTlsStatus": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
+      "localNetwork.getViewerEndpoints": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "localNetwork.list": {
         capName: "local-network",
         capScope: "system",
         addonId: null,
         access: "view"
       },
+      "localNetwork.regenerateCertificate": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "localNetwork.resetAllowlistToBestMatch": {
         capName: "local-network",
         capScope: "system",
         addonId: null,
         access: "delete"
       },
+      "localNetwork.revertToGeneratedCertificate": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "localNetwork.setAllowedAddresses": {
         capName: "local-network",
         capScope: "system",
@@ -268175,6 +269107,18 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "localNetwork.setViewerEndpoints": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
+      "localNetwork.uploadCertificate": {
+        capName: "local-network",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "lockControl.lock": {
         capName: "lock-control",
         capScope: "device",
@@ -271055,6 +271999,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "terminalSession.updateInstance": {
+        capName: "terminal-session",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "terminalSession.writeInput": {
         capName: "terminal-session",
         capScope: "system",
@@ -274313,9 +275263,16 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           getConnectionEndpoints: (input) => dispatch("localNetwork", "getConnectionEndpoints", "query", input),
           getNotificationEndpoint: (input) => dispatch("localNetwork", "getNotificationEndpoint", "query", input),
           setNotificationEndpoint: (input) => dispatch("localNetwork", "setNotificationEndpoint", "mutation", input),
+          getViewerEndpoints: (input) => dispatch("localNetwork", "getViewerEndpoints", "query", input),
+          setViewerEndpoints: (input) => dispatch("localNetwork", "setViewerEndpoints", "mutation", input),
           getAllowedAddresses: (input) => dispatch("localNetwork", "getAllowedAddresses", "query", input),
           setAllowedAddresses: (input) => dispatch("localNetwork", "setAllowedAddresses", "mutation", input),
-          resetAllowlistToBestMatch: (input) => dispatch("localNetwork", "resetAllowlistToBestMatch", "mutation", input)
+          resetAllowlistToBestMatch: (input) => dispatch("localNetwork", "resetAllowlistToBestMatch", "mutation", input),
+          getTlsStatus: (input) => dispatch("localNetwork", "getTlsStatus", "query", input),
+          regenerateCertificate: (input) => dispatch("localNetwork", "regenerateCertificate", "mutation", input),
+          uploadCertificate: (input) => dispatch("localNetwork", "uploadCertificate", "mutation", input),
+          downloadCa: (input) => dispatch("localNetwork", "downloadCa", "query", input),
+          revertToGeneratedCertificate: (input) => dispatch("localNetwork", "revertToGeneratedCertificate", "mutation", input)
         },
         meshNetwork: {
           getStatus: (input) => dispatch("meshNetwork", "getStatus", "query", input),
@@ -274597,6 +275554,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           listProfiles: (input) => dispatch("terminalSession", "listProfiles", "query", input),
           listInstances: (input) => dispatch("terminalSession", "listInstances", "query", input),
           createInstance: (input) => dispatch("terminalSession", "createInstance", "mutation", input),
+          updateInstance: (input) => dispatch("terminalSession", "updateInstance", "mutation", input),
           deleteInstance: (input) => dispatch("terminalSession", "deleteInstance", "mutation", input),
           setInstanceEnabled: (input) => dispatch("terminalSession", "setInstanceEnabled", "mutation", input),
           listLegacyCameras: (input) => dispatch("terminalSession", "listLegacyCameras", "query", input),
@@ -275511,6 +276469,58 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       const chosen = models[stepId];
       return chosen !== void 0 && chosen !== "" ? chosen : step2.defaultModelId;
     }
+    var DEFAULT_MIN_LANDMARK_FACE_SIZE_PX = 24;
+    var CLUSTER_STEP_SETTING_FIELDS = [{
+      stepId: "face-embedding",
+      key: "minLandmarkFaceSize",
+      label: "Min face size for recognition (detection px)",
+      description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node \u2014 the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+      type: "slider",
+      min: 0,
+      max: 64,
+      step: 2,
+      default: 24
+    }];
+    function clusterStepSettingKey(stepId, fieldKey) {
+      return `clusterStepSetting:${stepId}:${fieldKey}`;
+    }
+    function clusterStepSettingFieldsFor(stepId) {
+      return CLUSTER_STEP_SETTING_FIELDS.filter((field) => field.stepId === stepId);
+    }
+    var ClusterSettingNumberSchema = zod.z.number().finite();
+    function readClusterStepSettings(config) {
+      const out = {};
+      for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+        const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+        const value = parsed.success ? parsed.data : field.default;
+        const existing = out[field.stepId] ?? {};
+        out[field.stepId] = {
+          ...existing,
+          [field.key]: value
+        };
+      }
+      return out;
+    }
+    var DEFAULT_CLUSTER_STEP_SETTINGS = readClusterStepSettings({});
+    function pickClusterStepSettings(view) {
+      if (view === null) return DEFAULT_CLUSTER_STEP_SETTINGS;
+      const flat = {};
+      const wanted = new Set(CLUSTER_STEP_SETTING_FIELDS.map((field) => clusterStepSettingKey(field.stepId, field.key)));
+      for (const section of view.sections) for (const entry of section.fields) {
+        if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
+        if (wanted.has(entry.key)) flat[entry.key] = entry.value;
+      }
+      return readClusterStepSettings(flat);
+    }
+    function overlayClusterStepSettings(stepId, deviceSettings, cluster) {
+      const overlay = cluster[stepId];
+      if (overlay === void 0 || Object.keys(overlay).length === 0) return deviceSettings === void 0 ? void 0 : { ...deviceSettings };
+      if (deviceSettings === void 0) return { ...overlay };
+      return {
+        ...deviceSettings,
+        ...overlay
+      };
+    }
     var DETAIL_CROP_SECTION_ID = "detail-crop";
     var DETAIL_CROP_PADDING_KEY = "detailCropPaddingRatio";
     var DETAIL_CROP_SQUARE_KEY = "detailCropSquare";
@@ -277299,8 +278309,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.CAP_NAMES_WITH_STATUS = CAP_NAMES_WITH_STATUS;
     exports.CAP_NODE_PIN_CONTEXT_KEY = require_sleep.CAP_NODE_PIN_CONTEXT_KEY;
     exports.CAP_PROVIDER_KIND_MAP = CAP_PROVIDER_KIND_MAP;
+    exports.CLASS_MAP_MACRO_TARGETS = CLASS_MAP_MACRO_TARGETS;
     exports.CLUSTER_MODEL_SCOPED_STEPS = CLUSTER_MODEL_SCOPED_STEPS;
     exports.CLUSTER_MODEL_SECTION_ID = CLUSTER_MODEL_SECTION_ID;
+    exports.CLUSTER_STEP_SETTING_FIELDS = CLUSTER_STEP_SETTING_FIELDS;
     exports.COCO_80_LABELS = COCO_80_LABELS;
     exports.COCO_TO_MACRO = COCO_TO_MACRO;
     exports.CONNECTION_TEST_TIMEOUT_MS = CONNECTION_TEST_TIMEOUT_MS;
@@ -277344,6 +278356,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.CapabilityBindingsSchema = CapabilityBindingsSchema;
     exports.CarbonMonoxideStatusSchema = CarbonMonoxideStatusSchema;
     exports.ChargingStatus = require_sleep.ChargingStatus;
+    exports.ClassMapDefinitionSchema = ClassMapDefinitionSchema;
     exports.ClientNetworkStatsSchema = ClientNetworkStatsSchema;
     exports.ClimateControlStatusSchema = ClimateControlStatusSchema;
     exports.ClipPlaybackSchema = ClipPlaybackSchema;
@@ -277389,11 +278402,13 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.DEFAULT_ADDON_PLACEMENT = DEFAULT_ADDON_PLACEMENT;
     exports.DEFAULT_AUDIO_ANALYZER_CONFIG = DEFAULT_AUDIO_ANALYZER_CONFIG;
     exports.DEFAULT_CLUSTER_STEP_MODELS = DEFAULT_CLUSTER_STEP_MODELS;
+    exports.DEFAULT_CLUSTER_STEP_SETTINGS = DEFAULT_CLUSTER_STEP_SETTINGS;
     exports.DEFAULT_DECODER_HWACCEL_CONFIG = DEFAULT_DECODER_HWACCEL_CONFIG;
     exports.DEFAULT_DETAIL_CROP_CONVENTION = DEFAULT_DETAIL_CROP_CONVENTION;
     exports.DEFAULT_EVENTS_BAND_BUFFER_SEC = DEFAULT_EVENTS_BAND_BUFFER_SEC;
     exports.DEFAULT_EVENT_COLOR = DEFAULT_EVENT_COLOR;
     exports.DEFAULT_FEATURES = DEFAULT_FEATURES;
+    exports.DEFAULT_MIN_LANDMARK_FACE_SIZE_PX = DEFAULT_MIN_LANDMARK_FACE_SIZE_PX;
     exports.DEFAULT_NATIVE_LEASE_SETTINGS = DEFAULT_NATIVE_LEASE_SETTINGS;
     exports.DEFAULT_POOL_MEMORY_POLICY = DEFAULT_POOL_MEMORY_POLICY;
     exports.DEFAULT_RECORDING_PROFILES = DEFAULT_RECORDING_PROFILES;
@@ -277517,6 +278532,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.FrameHandleFormatSchema = require_sleep.FrameHandleFormatSchema;
     exports.FrameHandleSchema = require_sleep.FrameHandleSchema;
     exports.FrameInputSchema = FrameInputSchema;
+    exports.FrameLazyCountersSchema = FrameLazyCountersSchema;
+    exports.FrameLazyMetricsSchema = FrameLazyMetricsSchema;
     exports.GasStatusSchema = GasStatusSchema;
     exports.GetStreamWithCodecInputSchema = GetStreamWithCodecInputSchema;
     exports.GlobalMetricsSchema = GlobalMetricsSchema;
@@ -278171,6 +279188,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.classifyStreams = classifyStreams;
     exports.climateControlCapability = climateControlCapability;
     exports.clusterModelSettingKey = clusterModelSettingKey;
+    exports.clusterStepSettingFieldsFor = clusterStepSettingFieldsFor;
+    exports.clusterStepSettingKey = clusterStepSettingKey;
     exports.collectHydratedFieldEntries = require_sleep.collectHydratedFieldEntries;
     exports.collectHydratedFieldValues = require_sleep.collectHydratedFieldValues;
     exports.colorCapability = colorCapability;
@@ -278361,6 +279380,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.objectInputDeclaresAddonId = objectInputDeclaresAddonId;
     exports.osdCapability = osdCapability;
     exports.osdManagerCapability = osdManagerCapability;
+    exports.overlayClusterStepSettings = overlayClusterStepSettings;
     exports.parseCameraStreamConfig = parseCameraStreamConfig;
     exports.parseExpression = parseExpression;
     exports.parseJsonArray = require_sleep.parseJsonArray;
@@ -278374,6 +279394,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.petFeederCapability = petFeederCapability;
     exports.pickAccessoryControl = pickAccessoryControl;
     exports.pickClusterStepModels = pickClusterStepModels;
+    exports.pickClusterStepSettings = pickClusterStepSettings;
     exports.pickDetailCropConvention = pickDetailCropConvention;
     exports.pickNativeLeaseOverride = pickNativeLeaseOverride;
     exports.pickPreferredRtspEntry = pickPreferredRtspEntry;
@@ -278398,6 +279419,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.ptzCapability = ptzCapability;
     exports.pythonScriptForBackend = pythonScriptForBackend;
     exports.readClusterStepModels = readClusterStepModels;
+    exports.readClusterStepSettings = readClusterStepSettings;
     exports.readDetailCropConvention = readDetailCropConvention;
     exports.readDeviceStateFrom = readDeviceStateFrom;
     exports.readNativeLeaseOverride = readNativeLeaseOverride;
@@ -394926,18 +395948,26 @@ var require_session_cookie = __commonJS({
     exports.isEmbedRedirectTarget = isEmbedRedirectTarget;
     exports.isSessionGradeJwtPayload = isSessionGradeJwtPayload;
     exports.SESSION_COOKIE = "camstack_session";
-    function buildSessionCookie(token2, ttlSec) {
+    function buildSessionCookie(token2, ttlSec, opts = {}) {
       return {
         name: exports.SESSION_COOKIE,
         value: token2,
-        options: { httpOnly: true, sameSite: "lax", secure: true, path: "/", maxAge: ttlSec }
+        options: {
+          httpOnly: true,
+          sameSite: "lax",
+          // Secure cookies are invisible on the LAN HTTP sibling (plain http://).
+          // Default stays true so HTTPS callers do not regress.
+          secure: opts.secure ?? true,
+          path: "/",
+          maxAge: ttlSec
+        }
       };
     }
-    function clearSessionCookie() {
+    function clearSessionCookie(opts = {}) {
       return {
         name: exports.SESSION_COOKIE,
         value: "",
-        options: { httpOnly: true, sameSite: "lax", secure: true, path: "/", maxAge: 0 }
+        options: { httpOnly: true, sameSite: "lax", secure: opts.secure ?? true, path: "/", maxAge: 0 }
       };
     }
     function readSessionCookieFromHeader(header) {
@@ -395102,6 +396132,25 @@ var require_health_routes = __commonJS({
   }
 });
 
+// ../../server/backend/dist/api/health/adaptive-probe.routes.js
+var require_adaptive_probe_routes = __commonJS({
+  "../../server/backend/dist/api/health/adaptive-probe.routes.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ADAPTIVE_PROBE_BYTES = void 0;
+    exports.registerAdaptiveProbeRoute = registerAdaptiveProbeRoute;
+    exports.ADAPTIVE_PROBE_BYTES = 128 * 1024;
+    var BODY = Buffer.alloc(exports.ADAPTIVE_PROBE_BYTES, 97);
+    function registerAdaptiveProbeRoute(fastify) {
+      fastify.get("/adaptive-probe", async (_req, reply) => {
+        reply.header("cache-control", "no-store");
+        reply.header("content-type", "application/octet-stream");
+        return reply.send(BODY);
+      });
+    }
+  }
+});
+
 // ../../server/backend/dist/api/model-distributor.js
 var require_model_distributor = __commonJS({
   "../../server/backend/dist/api/model-distributor.js"(exports) {
@@ -402068,19 +403117,8 @@ var require_trpc_router = __commonJS({
       const relayOnly = FORCE_RELAY_REMOTE ? (0, client_ip_js_1.deriveRelayOnly)(clientClass) : false;
       return { ...input, relayOnly };
     }
-    var REMOTE_INITIAL_ADAPTIVE_TIER = "low";
-    function enrichHintsWithClientClass(input, clientClass) {
-      if (clientClass !== "remote")
-        return input;
-      const isAdaptive = input.target === void 0 || input.target.kind === "adaptive";
-      if (!isAdaptive)
-        return input;
-      if (input.hints?.prefersTier !== void 0)
-        return input;
-      return {
-        ...input,
-        hints: { ...input.hints, prefersTier: REMOTE_INITIAL_ADAPTIVE_TIER }
-      };
+    function enrichHintsWithClientClass(input, _clientClass) {
+      return input;
     }
     function wrapWebrtcSessionProviderWithRelay(provider, ctx) {
       const userAgent = (0, client_ip_js_1.extractUserAgent)(ctx.req);
@@ -402418,7 +403456,8 @@ var require_boot_config = __commonJS({
           const pair = loadTlsCert(config.tls.certPath, config.tls.keyPath);
           tlsOptions = { key: pair.key, cert: pair.cert };
         } else {
-          const tlsResult = await ensureTlsCert(dataPath);
+          const extraSans = [...core.readExtraSans?.(dataPath) ?? []];
+          const tlsResult = await ensureTlsCert(dataPath, extraSans.length > 0 ? { extraSans } : void 0);
           tlsCert = tlsResult;
           logTlsCert(tlsResult);
           const pair = loadTlsCert(tlsResult.certPath, tlsResult.keyPath);
@@ -409742,7 +410781,13 @@ var require_manual_boot = __commonJS({
           });
         },
         async listen(port, host) {
-          await fastify.listen({ port, host });
+          await fastify.listen({
+            port,
+            host,
+            // Dual-stack when binding `::`. Positional listen() drops this and
+            // on macOS/BSD `IPV6_V6ONLY` defaults to 1 — IPv4 clients die.
+            ipv6Only: host === "::" ? false : void 0
+          });
         },
         close
       };
@@ -409807,6 +410852,7 @@ var require_main4 = __commonJS({
     var addon_upload_1 = require_addon_upload();
     var auth_whoami_1 = require_auth_whoami();
     var health_routes_1 = require_health_routes();
+    var adaptive_probe_routes_1 = require_adaptive_probe_routes();
     var model_distributor_js_1 = require_model_distributor();
     var oauth2_routes_js_1 = require_oauth2_routes();
     var server_upload_1 = require_server_upload();
@@ -410044,6 +411090,7 @@ var require_main4 = __commonJS({
           verifyToken: (token2) => app.get(auth_service_1.AuthService).verifyToken(token2)
         });
         console.log(`[bootstrap] Health routes registered (hub v${hubVersion})`);
+        (0, adaptive_probe_routes_1.registerAdaptiveProbeRoute)(fastify);
       } catch (err) {
         console.warn("[bootstrap] Failed to register health routes:", err);
       }
@@ -410281,12 +411328,12 @@ var require_main4 = __commonJS({
           } catch {
             return reply.status(401).send({ error: "invalid token" });
           }
-          const c = (0, session_cookie_js_1.buildSessionCookie)(token2, ttlSec);
+          const c = (0, session_cookie_js_1.buildSessionCookie)(token2, ttlSec, { secure: request.protocol === "https" });
           reply.setCookie(c.name, c.value, c.options);
           return reply.send({ ok: true });
         });
-        fastify.delete("/api/auth/session", async (_request, reply) => {
-          const c = (0, session_cookie_js_1.clearSessionCookie)();
+        fastify.delete("/api/auth/session", async (request, reply) => {
+          const c = (0, session_cookie_js_1.clearSessionCookie)({ secure: request.protocol === "https" });
           reply.setCookie(c.name, c.value, c.options);
           return reply.send({ ok: true });
         });
@@ -410306,7 +411353,7 @@ var require_main4 = __commonJS({
           } catch {
             return reply.status(401).send({ error: "invalid token" });
           }
-          const c = (0, session_cookie_js_1.buildSessionCookie)(token2, ttlSec);
+          const c = (0, session_cookie_js_1.buildSessionCookie)(token2, ttlSec, { secure: request.protocol === "https" });
           reply.setCookie(c.name, c.value, c.options);
           return reply.redirect(next);
         });
@@ -410571,7 +411618,7 @@ var require_main4 = __commonJS({
         const url = request.url;
         if ((0, spa_static_1.isRetiredPublicPath)(url))
           return reply.callNotFound();
-        if (url.startsWith("/trpc") || url.startsWith("/api/") || url.startsWith("/agent") || url.startsWith("/health") || url.startsWith("/viewer")) {
+        if (url.startsWith("/trpc") || url.startsWith("/api/") || url.startsWith("/agent") || url.startsWith("/health") || url.startsWith("/adaptive-probe") || url.startsWith("/viewer")) {
           return reply.callNotFound();
         }
         const { staticDir, indexPath } = adminUiState;
@@ -410661,7 +411708,16 @@ var require_main4 = __commonJS({
         }
       };
       try {
-        await app.listen(port, host);
+        const listenHost = (0, system_1.allFamiliesListenHost)(host).host;
+        try {
+          await app.listen(port, listenHost);
+        } catch (listenErr) {
+          if (listenHost === "::" && host !== "::") {
+            await app.listen(port, "0.0.0.0");
+          } else {
+            throw listenErr;
+          }
+        }
       } catch (listenErr) {
         if (listenErr !== null && typeof listenErr === "object" && "code" in listenErr && listenErr.code === "EADDRINUSE") {
           console.error(`[bootstrap] FATAL: Port ${port} is already in use. Stop the other process or change server.port in config.yaml.`);
@@ -410672,6 +411728,26 @@ var require_main4 = __commonJS({
       const logger = app.get(logging_service_1.LoggingService).createLogger("System");
       const protocol = tlsOptions ? "https" : "http";
       logger.info("CamStack server listening", { meta: { protocol, host, port, trpcRegistered } });
+      (0, system_1.registerLanHttpHandler)({
+        onRequest: (req, res) => {
+          fastify.server.emit("request", req, res);
+        },
+        onUpgrade: (req, socket, head) => {
+          fastify.server.emit("upgrade", req, socket, head);
+        }
+      });
+      try {
+        const lanHttp = await (0, system_1.bindPendingLanHttp)();
+        if (lanHttp.listening) {
+          logger.info("LAN HTTP listening", { meta: { port: lanHttp.port } });
+        } else if (lanHttp.error) {
+          logger.warn("LAN HTTP not bound", { meta: { error: lanHttp.error, port: lanHttp.port } });
+        }
+      } catch (err) {
+        logger.warn("LAN HTTP bind failed", {
+          meta: { error: err instanceof Error ? err.message : String(err) }
+        });
+      }
       void Promise.all([resolveAdminUi(), resolveViewerUi()]);
       const postBoot = app.get(post_boot_service_1.PostBootService);
       await postBoot.run({ port, host, dataPath, trpcRegistered, tlsCert });