@camstack/system 1.2.273 → 1.2.275

package/dist/{dist-D5ONNqL6.js → dist-CYXhwfDf.js}

@@ -4239,6 +4239,7 @@ var CameraSwitchIdSchema = zod.z.enum([
 	"device-audio",
 	"broker-audio",
 	"audio-analysis",
+	"event-saving",
 	"recording",
 	"notifications"
 ]);
@@ -4265,6 +4266,7 @@ var CAMERA_SWITCH_ORDER = [
 	"device-audio",
 	"broker-audio",
 	"audio-analysis",
+	"event-saving",
 	"recording",
 	"notifications"
 ];
@@ -4848,11 +4850,31 @@ var RecordingBandTriggersSchema = RecordingTriggersSchema;
 * band engine's `applies` rule). `start`/`end` are `HH:MM`; an `end <= start`
 * span wraps past midnight (handled by the band engine).
 */
+/**
+* Whether a band's footage carries sound.
+*
+* The recorder has always attached with `audio: 'aac'`, so every band of every
+* camera recorded sound whether anyone wanted it or not. The broker already
+* serves the other answer — `audio: 'none'` takes the video-only `/muted`
+* restream — so this was a choice the product could always have offered.
+*
+* It belongs on the BAND rather than the camera because one camera can want
+* both: silent across the shop floor during opening hours, sound overnight.
+* And it applies to BOTH modes — an events band firing on motion has the same
+* question to answer as a continuous one.
+*/
+var RecordingBandAudioSchema = zod.z.enum(["on", "muted"]);
 var RecordingBandSchema = zod.z.object({
 	days: zod.z.array(RecordingWeekdaySchema),
 	start: zod.z.string().regex(HHMM),
 	end: zod.z.string().regex(HHMM),
 	mode: RecordingBandModeSchema,
+	/**
+	* Sound, or silence. OPTIONAL and absent-means-`on`: every recording
+	* written before this existed carried sound, and a band whose key is
+	* missing must keep meaning what it meant. See {@link RecordingBandAudioSchema}.
+	*/
+	audio: RecordingBandAudioSchema.optional(),
 	triggers: RecordingBandTriggersSchema.optional(),
 	/**
 	* RETIRED (D381). A band no longer carries a pre-buffer of its own.
@@ -23976,10 +23998,9 @@ var ServerBootModeSchema = zod.z.enum([
 *  - `idle` / `checking` / `staging` — steady / in-flight registry work.
 *  - `pending-restart` — a version is staged and the node has NOT yet
 *    restarted onto it (still running the OLD version).
-*  - `awaiting-confirmation` — the node HAS restarted onto the staged version
-*    (it is the active probation boot) and is waiting to confirm boot-health.
-*    Apply/rollback are refused in this state and the node must NOT be
-*    manually restarted, or the probation boot auto-rolls-back.
+*  - `awaiting-confirmation` — RETIRED with the probation boot (single-copy
+*    collapse, 2026-07-18). Kept in the enum so an older client still parses;
+*    no provider emits it.
 */
 var ServerUpdateStateSchema = zod.z.enum([
 	"idle",
@@ -24136,12 +24157,35 @@ var ServerRollbackInfoSchema = zod.z.object({
 var ServerPackageStatusSchema = zod.z.object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: zod.z.string(),
-	/** Version of the code the running process ACTUALLY loaded. */
+	/**
+	* Version of the code THIS PROCESS loaded — captured once, at boot, from the
+	* package.json of the copy the code was loaded from, and never re-read. A
+	* copy replaced on disk under a live process must not move this number;
+	* that divergence is what `installedVersion` is for. Before 2026-09-20 this
+	* was a lazy disk read that would have followed such a swap silently.
+	*/
 	runningVersion: zod.z.string().nullable(),
 	/** Node.js runtime version the node's process runs on (`process.versions.node`). */
 	nodeRuntimeVersion: zod.z.string().nullable(),
 	/** Active data-dir root version; null when booted from seed/workspace. */
 	activeVersion: zod.z.string().nullable(),
+	/**
+	* Version of the root package in the data-root `current/` copy RIGHT NOW —
+	* what the next boot would load if nothing is staged. Normally equal to
+	* `runningVersion`; differs only when the copy on disk changed under the
+	* live process. `null` when there is no data-root copy (baked seed or
+	* workspace boot). Optional for version skew: an older provider omits it.
+	*/
+	installedVersion: zod.z.string().nullable().optional(),
+	/**
+	* True when the code that would run after a restart is NOT the code running
+	* now: a version is staged (`pendingVersion`), or `installedVersion` differs
+	* from `runningVersion`. Derived on every read, never stored. This is the
+	* one field that lets an operator or a script say "1.2.353 is installed and
+	* will run after a restart" instead of reading it off a number that means
+	* "installed". Optional for version skew.
+	*/
+	restartRequired: zod.z.boolean().optional(),
 	/** N-1 version kept for rollback; null when no previous version exists. */
 	previousVersion: zod.z.string().nullable(),
 	/** Version of the immutable baked seed closure (image fallback). */
@@ -24176,19 +24220,71 @@ var ServerPackageStatusSchema = zod.z.object({
 });
 var ServerUpdateCheckResultSchema = zod.z.object({
 	packageName: zod.z.string(),
+	/** Same meaning as on the status payload: what THIS process loaded. */
 	runningVersion: zod.z.string().nullable(),
 	latestVersion: zod.z.string().nullable(),
+	/**
+	* `latestVersion` is newer than `runningVersion` AND is not the version
+	* already staged on this node. A staged-and-waiting version is not "an
+	* update available" — applying it again is refused (`already-staged`), and
+	* a button that announced "updating…" on this boolean then got refused
+	* would be lying. It is reported through `pendingVersion` instead.
+	*/
 	updateAvailable: zod.z.boolean(),
 	checkedAtMs: zod.z.number(),
 	/** Non-null when the registry lookup failed (offline, bad registry, …). */
-	error: zod.z.string().nullable()
+	error: zod.z.string().nullable(),
+	/**
+	* Version staged on this node and awaiting its restart, when one is. Before
+	* 2026-09-20 a check answered `{runningVersion, updateAvailable:false}` for a
+	* node whose staged closure had never booted, and the caller had no way to
+	* see the difference. Optional for version skew.
+	*/
+	pendingVersion: zod.z.string().nullable().optional(),
+	/** See the status payload: staged, or installed-on-disk ≠ running. Optional for skew. */
+	restartRequired: zod.z.boolean().optional()
 });
+/**
+* What an action DID — the discriminant `accepted` cannot carry. Before
+* 2026-09-20 `applyServerUpdate` answered `accepted:false` both for a refusal
+* where nothing was wrong (already current, already staged) and for a staging
+* install that died on `npm error code ECONNRESET`; the only difference was
+* prose in `message`, and an operator restarted a container on the strength of
+* it, booting the previous version.
+*
+*  - `staged`            — the closure is installed and validated; the node
+*                          restarts to apply it (`restarting:true`). NOTHING
+*                          runs the new code until that restart completes.
+*  - `restart-scheduled` — a plain, version-preserving restart was accepted.
+*  - `already-current`   — the target IS the running version; nothing done.
+*  - `refused`           — dropped by a gate; `reason` names which.
+*  - `failed`            — attempted and did not land; `error` says why.
+*/
+var ServerUpdateOutcomeSchema = zod.z.enum([
+	"staged",
+	"restart-scheduled",
+	"already-current",
+	"refused",
+	"failed"
+]);
 var ServerUpdateActionResultSchema = zod.z.object({
 	accepted: zod.z.boolean(),
 	targetVersion: zod.z.string().nullable(),
 	/** True when a graceful restart was scheduled to apply the change. */
 	restarting: zod.z.boolean(),
-	message: zod.z.string()
+	message: zod.z.string(),
+	/** See {@link ServerUpdateOutcomeSchema}. Optional for version skew. */
+	outcome: ServerUpdateOutcomeSchema.optional(),
+	/**
+	* Stable, greppable cause for `refused` / `failed` (the engine's
+	* `UpdateRefusalReason`, `staging-failed`, …). `null` on success.
+	*/
+	reason: zod.z.string().nullable().optional(),
+	/**
+	* The failure itself, verbatim enough to act on (the npm output for a
+	* staging install). Non-null only for `failed`.
+	*/
+	error: zod.z.string().nullable().optional()
 });
 var serverManagementCapability = {
 	name: "server-management",

package/dist/{dist-DrLhdcwI.mjs → dist-DWSJVcZe.mjs}

@@ -4239,6 +4239,7 @@ var CameraSwitchIdSchema = z.enum([
 	"device-audio",
 	"broker-audio",
 	"audio-analysis",
+	"event-saving",
 	"recording",
 	"notifications"
 ]);
@@ -4265,6 +4266,7 @@ var CAMERA_SWITCH_ORDER = [
 	"device-audio",
 	"broker-audio",
 	"audio-analysis",
+	"event-saving",
 	"recording",
 	"notifications"
 ];
@@ -4848,11 +4850,31 @@ var RecordingBandTriggersSchema = RecordingTriggersSchema;
 * band engine's `applies` rule). `start`/`end` are `HH:MM`; an `end <= start`
 * span wraps past midnight (handled by the band engine).
 */
+/**
+* Whether a band's footage carries sound.
+*
+* The recorder has always attached with `audio: 'aac'`, so every band of every
+* camera recorded sound whether anyone wanted it or not. The broker already
+* serves the other answer — `audio: 'none'` takes the video-only `/muted`
+* restream — so this was a choice the product could always have offered.
+*
+* It belongs on the BAND rather than the camera because one camera can want
+* both: silent across the shop floor during opening hours, sound overnight.
+* And it applies to BOTH modes — an events band firing on motion has the same
+* question to answer as a continuous one.
+*/
+var RecordingBandAudioSchema = z.enum(["on", "muted"]);
 var RecordingBandSchema = z.object({
 	days: z.array(RecordingWeekdaySchema),
 	start: z.string().regex(HHMM),
 	end: z.string().regex(HHMM),
 	mode: RecordingBandModeSchema,
+	/**
+	* Sound, or silence. OPTIONAL and absent-means-`on`: every recording
+	* written before this existed carried sound, and a band whose key is
+	* missing must keep meaning what it meant. See {@link RecordingBandAudioSchema}.
+	*/
+	audio: RecordingBandAudioSchema.optional(),
 	triggers: RecordingBandTriggersSchema.optional(),
 	/**
 	* RETIRED (D381). A band no longer carries a pre-buffer of its own.
@@ -23976,10 +23998,9 @@ var ServerBootModeSchema = z.enum([
 *  - `idle` / `checking` / `staging` — steady / in-flight registry work.
 *  - `pending-restart` — a version is staged and the node has NOT yet
 *    restarted onto it (still running the OLD version).
-*  - `awaiting-confirmation` — the node HAS restarted onto the staged version
-*    (it is the active probation boot) and is waiting to confirm boot-health.
-*    Apply/rollback are refused in this state and the node must NOT be
-*    manually restarted, or the probation boot auto-rolls-back.
+*  - `awaiting-confirmation` — RETIRED with the probation boot (single-copy
+*    collapse, 2026-07-18). Kept in the enum so an older client still parses;
+*    no provider emits it.
 */
 var ServerUpdateStateSchema = z.enum([
 	"idle",
@@ -24136,12 +24157,35 @@ var ServerRollbackInfoSchema = z.object({
 var ServerPackageStatusSchema = z.object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: z.string(),
-	/** Version of the code the running process ACTUALLY loaded. */
+	/**
+	* Version of the code THIS PROCESS loaded — captured once, at boot, from the
+	* package.json of the copy the code was loaded from, and never re-read. A
+	* copy replaced on disk under a live process must not move this number;
+	* that divergence is what `installedVersion` is for. Before 2026-09-20 this
+	* was a lazy disk read that would have followed such a swap silently.
+	*/
 	runningVersion: z.string().nullable(),
 	/** Node.js runtime version the node's process runs on (`process.versions.node`). */
 	nodeRuntimeVersion: z.string().nullable(),
 	/** Active data-dir root version; null when booted from seed/workspace. */
 	activeVersion: z.string().nullable(),
+	/**
+	* Version of the root package in the data-root `current/` copy RIGHT NOW —
+	* what the next boot would load if nothing is staged. Normally equal to
+	* `runningVersion`; differs only when the copy on disk changed under the
+	* live process. `null` when there is no data-root copy (baked seed or
+	* workspace boot). Optional for version skew: an older provider omits it.
+	*/
+	installedVersion: z.string().nullable().optional(),
+	/**
+	* True when the code that would run after a restart is NOT the code running
+	* now: a version is staged (`pendingVersion`), or `installedVersion` differs
+	* from `runningVersion`. Derived on every read, never stored. This is the
+	* one field that lets an operator or a script say "1.2.353 is installed and
+	* will run after a restart" instead of reading it off a number that means
+	* "installed". Optional for version skew.
+	*/
+	restartRequired: z.boolean().optional(),
 	/** N-1 version kept for rollback; null when no previous version exists. */
 	previousVersion: z.string().nullable(),
 	/** Version of the immutable baked seed closure (image fallback). */
@@ -24176,19 +24220,71 @@ var ServerPackageStatusSchema = z.object({
 });
 var ServerUpdateCheckResultSchema = z.object({
 	packageName: z.string(),
+	/** Same meaning as on the status payload: what THIS process loaded. */
 	runningVersion: z.string().nullable(),
 	latestVersion: z.string().nullable(),
+	/**
+	* `latestVersion` is newer than `runningVersion` AND is not the version
+	* already staged on this node. A staged-and-waiting version is not "an
+	* update available" — applying it again is refused (`already-staged`), and
+	* a button that announced "updating…" on this boolean then got refused
+	* would be lying. It is reported through `pendingVersion` instead.
+	*/
 	updateAvailable: z.boolean(),
 	checkedAtMs: z.number(),
 	/** Non-null when the registry lookup failed (offline, bad registry, …). */
-	error: z.string().nullable()
+	error: z.string().nullable(),
+	/**
+	* Version staged on this node and awaiting its restart, when one is. Before
+	* 2026-09-20 a check answered `{runningVersion, updateAvailable:false}` for a
+	* node whose staged closure had never booted, and the caller had no way to
+	* see the difference. Optional for version skew.
+	*/
+	pendingVersion: z.string().nullable().optional(),
+	/** See the status payload: staged, or installed-on-disk ≠ running. Optional for skew. */
+	restartRequired: z.boolean().optional()
 });
+/**
+* What an action DID — the discriminant `accepted` cannot carry. Before
+* 2026-09-20 `applyServerUpdate` answered `accepted:false` both for a refusal
+* where nothing was wrong (already current, already staged) and for a staging
+* install that died on `npm error code ECONNRESET`; the only difference was
+* prose in `message`, and an operator restarted a container on the strength of
+* it, booting the previous version.
+*
+*  - `staged`            — the closure is installed and validated; the node
+*                          restarts to apply it (`restarting:true`). NOTHING
+*                          runs the new code until that restart completes.
+*  - `restart-scheduled` — a plain, version-preserving restart was accepted.
+*  - `already-current`   — the target IS the running version; nothing done.
+*  - `refused`           — dropped by a gate; `reason` names which.
+*  - `failed`            — attempted and did not land; `error` says why.
+*/
+var ServerUpdateOutcomeSchema = z.enum([
+	"staged",
+	"restart-scheduled",
+	"already-current",
+	"refused",
+	"failed"
+]);
 var ServerUpdateActionResultSchema = z.object({
 	accepted: z.boolean(),
 	targetVersion: z.string().nullable(),
 	/** True when a graceful restart was scheduled to apply the change. */
 	restarting: z.boolean(),
-	message: z.string()
+	message: z.string(),
+	/** See {@link ServerUpdateOutcomeSchema}. Optional for version skew. */
+	outcome: ServerUpdateOutcomeSchema.optional(),
+	/**
+	* Stable, greppable cause for `refused` / `failed` (the engine's
+	* `UpdateRefusalReason`, `staging-failed`, …). `null` on success.
+	*/
+	reason: z.string().nullable().optional(),
+	/**
+	* The failure itself, verbatim enough to act on (the npm output for a
+	* staging install). Non-null only for `failed`.
+	*/
+	error: z.string().nullable().optional()
 });
 var serverManagementCapability = {
 	name: "server-management",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-D5ONNqL6.js");
+const require_dist = require("./dist-CYXhwfDf.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -26,7 +26,7 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CAsHdMwP.js");
-const require_tls$1 = require("./tls-BFs4PzoW.js");
+const require_tls$1 = require("./tls-D_wUeOTD.js");
 const require_manifest_system_deps = require("./manifest-system-deps-CfVyUKLU.js");
 const require_resource_monitor = require("./resource-monitor-LVE1BoLs.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { An as readinessKey, Cn as expandCapMethods, F as addonSettingsCapability, Ft as procedureAuthKey, Mn as scopeKey, Mt as objectInputDeclaresAddonId, On as parseJsonObject, Pn as EventCategory$1, S as RUNTIME_DEFAULTS, Tt as looseSchema, Ut as scopesAllowAddon, Vt as resolveMethodAuth, Wt as scopesAllowDeviceCap, _n as asJsonObject$1, _t as isVoidInput, an as errMsg$1, bn as createEvent, bt as lifecycleJobSchema, cn as DATAPLANE_SECRET_HEADER$1, dt as isArrayOutputSchema, ft as isCollectionArrayMethod, g as LOG_LEVEL_RANK, hn as ReadinessTimeoutError, jn as resolveCapMount, kn as parseJsonUnknown, ln as DEVICE_SETTINGS_CONTRIBUTION_METHODS, mn as ReadinessRegistry, mt as isObjectInput, st as extractNestedAddonId, t as ALL_CAPABILITY_DEFINITIONS, un as DEVICE_STATUS_METHOD, vn as asNumber, vt as kebabToCamel, wt as logLevelAtMost, xn as emitDownForOwnedCaps, y as METHOD_ACCESS_MAP, yn as asString$1 } from "./dist-DrLhdcwI.mjs";
+import { An as readinessKey, Cn as expandCapMethods, F as addonSettingsCapability, Ft as procedureAuthKey, Mn as scopeKey, Mt as objectInputDeclaresAddonId, On as parseJsonObject, Pn as EventCategory$1, S as RUNTIME_DEFAULTS, Tt as looseSchema, Ut as scopesAllowAddon, Vt as resolveMethodAuth, Wt as scopesAllowDeviceCap, _n as asJsonObject$1, _t as isVoidInput, an as errMsg$1, bn as createEvent, bt as lifecycleJobSchema, cn as DATAPLANE_SECRET_HEADER$1, dt as isArrayOutputSchema, ft as isCollectionArrayMethod, g as LOG_LEVEL_RANK, hn as ReadinessTimeoutError, jn as resolveCapMount, kn as parseJsonUnknown, ln as DEVICE_SETTINGS_CONTRIBUTION_METHODS, mn as ReadinessRegistry, mt as isObjectInput, st as extractNestedAddonId, t as ALL_CAPABILITY_DEFINITIONS, un as DEVICE_STATUS_METHOD, vn as asNumber, vt as kebabToCamel, wt as logLevelAtMost, xn as emitDownForOwnedCaps, y as METHOD_ACCESS_MAP, yn as asString$1 } from "./dist-DWSJVcZe.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -25,7 +25,7 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as fetchJson, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, f as collectModelFiles, g as ensureModel, h as downloadModel, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as downloadFile, n as STALL_TICK_MS, o as contentTypeFor, p as deleteModelFromDisk, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as getModelFilePath, y as isModelDownloaded } from "./event-loop-stall-monitor-GPrVvx14.mjs";
-import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-2xbgg78V.mjs";
+import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-IM-v7JV4.mjs";
 import { $ as buildNativeCapProxy, $t as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, A as createUdsLogger, An as createSocketDirectionCounters, At as HEAP_WATCH_WARN_RATIO, B as UDS_NO_ROUTE_PREFIX, Bn as createCapActionCensus, Bt as createDeferredHeapWatchSink, C as deviceCapResolverLink, Cn as SOCKET_QUEUE_TOP_N, Ct as resolveNpmInvocation, D as createUdsEventBridge, Dn as formatSocketPlane, Dt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, E as createParentUnownedCallHandler, En as diffSocketPlane, Et as HEAP_RECLAIM_MIN_INTERVAL_MS, F as callWithServiceDiscovery, Fn as CAP_ACTION_OVERFLOW_LABEL, Ft as RSS_BUDGET_RELEASE_RATIO, G as getCapUsageRegistry, Gn as diffEventPlane, Gt as nextRssBudgetState, H as CapUsageRegistry, Hn as EVENT_PLANE_TOP_N, Ht as createV8Reclaimer, I as CapRouteError, In as CAP_ACTION_UNLABELLED, It as RUNNER_HEAP_WATCH_INTERVAL_MS, J as UdsLocalTransportServer, Jt as shouldReclaim, K as createLocalTransport, Kn as formatEventPlane, Kt as parseRssBudgetMb, L as classifyCapRoute, Ln as EMPTY_CAP_ACTION_READING, Lt as RUNNER_RSS_BUDGET_ENV, M as AGENT_CAP_FWD_ACTION, Mn as sampleSocketDirection, Mt as HUB_MAIN_RSS_BUDGET_MB, N as AGENT_CAP_FWD_SERVICE, Nn as socketDirectionBytes, Nt as HUB_RSS_BUDGET_ENV, O as createUdsEventBus, On as readSocketQueues, Ot as HEAP_RECLAIM_TRIGGER_MB, P as CapRouteResolver, Pn as socketDirectionMessages, Pt as RSS_BUDGET_REANNOUNCE_MIN_MS, Q as encodeFrame, Qt as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, R as LocalChildClient, Rn as MAX_CAP_ACTIONS_PER_PEER, Rt as ZERO_LOOP_DELAY, S as buildLinkChain, Sn as SOCKET_PLANE_TOP_N, St as buildNpmChildEnv, T as localProviderLink, Tn as createSocketPlaneReader, Tt as createAddonDataPlaneFacility, U as PARENT_ROUTED_PROVIDER_ADDON_ID, Un as createEventPlaneMeter, Ut as describeRss, V as readMoleculerFanoutMode, Vn as diffCapActionCensus, Vt as createLoopDelayMeter, W as __resetCapUsageRegistryForTests, Wn as createEventPlaneReader, Wt as hubMainRssBudget, X as localEndpointPath, Xt as startRunnerHeapWatch, Y as SocketChannel, Yt as startHeapWatch, Z as FrameDecoder, Zt as strandedMb, _ as AddonDepsManager, _n as formatOutboundQueueVerdict, _t as CapabilityHandle, a as createUdsAddonContext, an as isArrayBufferCensusReport, b as brokerCallForCap, bn as formatMeshQueue, bt as installManifestNativeDeps, c as getOrInitReadinessRegistryForClient, cn as emitHeapDiagnosticReport, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as clusterEventTopic, dn as readHeapSpaces, dt as capBareAction, en as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, et as buildUdsNativeCapProxy, f as getBrokerEventBus, fn as selectReportedSpaces, ft as capServiceName, g as subscribePassthrough, gn as createOutboundQueueGate, gt as DeviceRegistry, h as setNodeEventInterest, hn as OUTBOUND_QUEUE_THRESHOLD_BYTES, ht as serializeTypedArrays, i as createAddonContext, in as formatArrayBufferCensus, it as mountNativeCapService, j as createUdsLoggerWithControl, jn as recordSocketFrame, jt as HUB_MAIN_HEAP_WATCH_LABEL, k as udsChildLogToWorkerEntry, kn as EMPTY_SOCKET_DIRECTION, kt as HEAP_WATCH_INTERVAL_MS, l as setHubConnected, ln as formatHeapSpaces, lt as capActionName, m as registerEventBusService, mn as OUTBOUND_QUEUE_SUSTAIN_MS, mt as deserializeTypedArrays, n as installManifestPythonDeps, nn as createArrayBufferCensusGate, o as getWorkerDeviceRegistry, on as DECISIVE_HEAP_SPACES, ot as createAddonService, p as getMoleculerEventStats, pn as OUTBOUND_QUEUE_COOLDOWN_MS, pt as parseCapAction, q as UdsLocalTransportClient, qt as reclaimIntervalMs, r as adaptBrokerToCluster, rn as createInspectorArrayBufferCensus, s as getOrInitReadinessRegistry, sn as HEAP_SPACE_REPORT_MIN_MB, st as validateProviderRegistrations, t as installManifestSystemDeps, tn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, tt as createBrokerDeviceManagerApi, u as EVENT_TOPIC_PREFIX, un as heapSpaceField, ut as capActionSuffix, v as createKernelHwAccel, vn as MESH_QUEUE_TOP_N, vt as CapabilityUnavailableError, w as ipcParentLink, wn as createSocketPlaneMeter, wt as runNpm, x as brokerTransportLink, xn as EMPTY_SOCKET_PLANE_BASELINE, xt as resolveAddonClass, y as resolveHwAccel, yn as createMeshQueueReader, yt as copyBundledNativeModules, z as LocalChildRegistry, zn as capActionLabel, zt as buildHeapSample } from "./manifest-system-deps-BXf-Ouqx.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Vp0bPV3U.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";

package/dist/{retired-settings-keys-Du_0qedo.mjs → retired-settings-keys-BHGnCLW0.mjs}

@@ -1,4 +1,4 @@
-import { _n as asJsonObject } from "./dist-DrLhdcwI.mjs";
+import { _n as asJsonObject } from "./dist-DWSJVcZe.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-1686ou3s.js → retired-settings-keys-DEFtUH8o.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-D5ONNqL6.js");
+const require_dist = require("./dist-CYXhwfDf.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/tls/cert-identity.d.ts

@@ -1,3 +1,23 @@
+/** One address on one interface — the slice of `os.NetworkInterfaceInfo` this uses. */
+export interface HostInterfaceAddress {
+    readonly address: string;
+    readonly internal: boolean;
+}
+/**
+ * What the certificate needs to know about the machine it identifies.
+ *
+ * Injected rather than read, for the same reason `evaluateExistingCert`
+ * takes `now` instead of calling `Date.now()`: a rule whose inputs are
+ * ambient cannot be stated in a test, and a spec that reads the real
+ * `os.hostname()` is a statement about the machine running it. The CI
+ * runner and this laptop disagreed about both halves (D551).
+ */
+export interface HostFacts {
+    readonly hostname: string;
+    readonly networkInterfaces: Readonly<Record<string, readonly HostInterfaceAddress[] | undefined>>;
+}
+/** The real machine. The only place in `tls/` that touches `os`. */
+export declare function systemHostFacts(): HostFacts;
 /**
  * Names/addresses that go INTO the certificate, and the subset whose
  * absence forces a reissue.
@@ -17,6 +37,8 @@ export interface CertIdentity {
 export interface CertIdentityOptions {
     readonly commonName: string;
     readonly extraSans: readonly string[];
+    /** The machine being certified. Defaults to {@link systemHostFacts}. */
+    readonly hostFacts?: HostFacts;
 }
 export declare function isIpv4(value: string): boolean;
 export declare function isIpv6(value: string): boolean;

package/dist/tls/cert-issue.d.ts

@@ -0,0 +1,31 @@
+import { webcrypto as WebCrypto } from 'node:crypto';
+import { X509Certificate as PeculiarCertificate } from '@peculiar/x509';
+import { CertIdentity } from './cert-identity.js';
+/** Subject of the local root. Distinct from the leaf's CN by construction. */
+export declare const CA_COMMON_NAME = "CamStack Local CA";
+/** A PEM-encoded certificate and the PKCS#8 PEM of its private key. */
+export interface CertMaterial {
+    readonly certPem: string;
+    readonly keyPem: string;
+}
+/** An issuing root: its PEM, and the live key handle needed to sign with it. */
+export interface CaSigner {
+    readonly certPem: string;
+    readonly keyPem: string;
+    readonly cert: PeculiarCertificate;
+    readonly privateKey: WebCrypto.CryptoKey;
+}
+/**
+ * A local root: 10 years, `pathlen:0` so it can sign leaves and nothing
+ * else, and **no EKU** — Apple rejects an anchor asserting
+ * `anyExtendedKeyUsage`, and a root with no EKU constrains nothing.
+ */
+export declare function generateCa(now: Date): Promise<CaSigner>;
+/** Re-open a root already on disk so a leaf can be issued under it. */
+export declare function loadCa(certPem: string, keyPem: string): Promise<CaSigner>;
+/**
+ * A server leaf signed by the local root: `CA:FALSE`, and
+ * `extendedKeyUsage=serverAuth` — not `anyExtendedKeyUsage`, which
+ * Apple's `testAppTrustRoot_AnyEKU_AfterJul2019` asserts must fail.
+ */
+export declare function issueLeaf(ca: CaSigner, identity: CertIdentity, commonName: string, validDays: number, now: Date): Promise<CertMaterial>;

package/dist/tls/cert-manager.d.ts

@@ -1,5 +1,5 @@
 import { CertRegenerationReason, evaluateExistingCert, MAX_LEAF_VALIDITY_DAYS } from './cert-evaluation.js';
-import { CertIdentity, collectCertIdentity } from './cert-identity.js';
+import { CertIdentity, HostFacts, collectCertIdentity } from './cert-identity.js';
 export interface TlsCertPair {
     readonly cert: Buffer;
     readonly key: Buffer;
@@ -38,6 +38,12 @@ export interface CertOptions {
     readonly validDays?: number;
     /** Additional SANs (DNS names or IPs). Required coverage by definition. */
     readonly extraSans?: readonly string[];
+    /**
+     * The machine being certified. Defaults to the real one; injected by the
+     * spec so the regeneration rule can be stated without reference to
+     * whichever box happens to run it (D551).
+     */
+    readonly hostFacts?: HostFacts;
 }
 /**
  * Ensure the hub has a usable TLS identity under `<dataDir>/tls`, made of
@@ -87,5 +93,5 @@ export declare function reissueTlsLeaf(dataDir: string, options?: CertOptions):
  * root alongside the leaf.
  */
 export declare function loadTlsCert(certPath: string, keyPath: string): TlsCertPair;
-export type { CertIdentity, CertRegenerationReason };
+export type { CertIdentity, CertRegenerationReason, HostFacts };
 export { collectCertIdentity, evaluateExistingCert, MAX_LEAF_VALIDITY_DAYS };

package/dist/tls/index.d.ts

@@ -1,5 +1,5 @@
 export { CA_VALIDITY_DAYS, type CertEvaluationInput, LEAF_RENEWAL_WINDOW_DAYS, SERVER_AUTH_OID, } from './cert-evaluation.js';
-export { type CertIdentity, type CertOptions, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair, } from './cert-manager.js';
-export { CA_COMMON_NAME } from './cert-openssl.js';
+export { type CertIdentity, type CertOptions, type HostFacts, type CertRegenerationReason, collectCertIdentity, type EnsureTlsResult, ensureTlsCert, reissueTlsLeaf, evaluateExistingCert, loadTlsCert, MAX_LEAF_VALIDITY_DAYS, type TlsCertPair, } from './cert-manager.js';
+export { CA_COMMON_NAME } from './cert-issue.js';
 export { validateUploadedTls, type UploadedTlsValidation } from './uploaded-cert.js';
 export { type TlsAccessStatus, readTlsAccessStatus, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans, } from './tls-status.js';