@camstack/system 1.2.345 → 1.2.346

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
 const require_dist = require("../../dist-CqafgUSr.js");
-const require_tls = require("../../tls-D_wUeOTD.js");
+const require_tls = require("../../tls-DEjOOARt.js");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 let node_fs = require("node:fs");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
 import { Bt as localNetworkCapability, Gn as BaseAddon, gr as EventCategory } from "../../dist-0zO6jHkf.mjs";
-import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-IM-v7JV4.mjs";
+import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-DAtaKVUT.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { readFileSync } from "node:fs";

package/dist/index.js

@@ -30,7 +30,7 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-ey4mbofz.js");
-const require_tls$1 = require("./tls-D_wUeOTD.js");
+const require_tls$1 = require("./tls-DEjOOARt.js");
 const require_child_cap_dispatch = require("./child-cap-dispatch-Bm4Kpo7v.js");
 const require_resource_monitor = require("./resource-monitor-DzNn_IZK.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");

package/dist/index.mjs

@@ -29,7 +29,7 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as ensureModel, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, g as downloadModel, h as downloadFile, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as deleteModelFromDisk, n as STALL_TICK_MS, o as contentTypeFor, p as collectModelFiles, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as fetchJson, x as isModelDownloaded, y as getModelFilePath } from "./event-loop-stall-monitor-EXjzIxDz.mjs";
-import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-IM-v7JV4.mjs";
+import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DAtaKVUT.mjs";
 import { $ as CapRouteError, $n as CAP_ACTION_UNLABELLED, $t as RUNNER_HEAP_WATCH_INTERVAL_MS, A as resolveHwAccel, An as OUTBOUND_QUEUE_COOLDOWN_MS, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as SOCKET_QUEUE_TOP_N, Bt as createAddonPeerBytesFacility, C as getBrokerEventBus, Cn as DECISIVE_HEAP_SPACES, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as heapSpaceField, Dt as capServiceName, E as setNodeEventInterest, En as formatHeapSpaces, Et as capBareAction, F as ipcParentLink, Fn as MESH_QUEUE_TOP_N, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as readSocketQueues, Gt as HEAP_RECLAIM_TRIGGER_MB, H as createUdsLoggerWithControl, Hn as createSocketPlaneReader, Ht as createAddonDataPlaneFacility, I as localProviderLink, In as createMeshQueueReader, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as recordSocketFrame, Jt as HUB_MAIN_HEAP_WATCH_LABEL, K as afterWorkerOnlineAnnounce, Kn as EMPTY_SOCKET_DIRECTION, Kt as HEAP_WATCH_INTERVAL_MS, L as createParentUnownedCallHandler, Ln as formatMeshQueue, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, Mt as CapabilityHandle, N as buildLinkChain, Nn as createOutboundQueueGate, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as readHeapSpaces, Ot as parseCapAction, P as deviceCapResolverLink, Pn as formatOutboundQueueVerdict, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as CAP_ACTION_OVERFLOW_LABEL, Qt as RSS_BUDGET_RELEASE_RATIO, R as createUdsEventBridge, Rn as EMPTY_SOCKET_PLANE_BASELINE, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as isArrayBufferCensusReport, St as validateProviderRegistrations, T as registerEventBusService, Tn as emitHeapDiagnosticReport, Tt as capActionSuffix, U as LocalChildClient, Un as diffSocketPlane, Ut as HEAP_RECLAIM_MIN_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneMeter, Vt as hostNodeIdOf, W as LocalChildRegistry, Wn as formatSocketPlane, Wt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionBytes, Xt as HUB_RSS_BUDGET_ENV, Y as deviceOfGetStatus, Yn as sampleSocketDirection, Yt as HUB_MAIN_RSS_BUDGET_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as socketDirectionMessages, Zt as RSS_BUDGET_REANNOUNCE_MIN_MS, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, a as reapProcessGroup, an as createV8Reclaimer, ar as EVENT_PLANE_TOP_N, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as createInspectorArrayBufferCensus, c as runnerOwnsProcessGroup, cn as nextRssBudgetState, cr as diffEventPlane, ct as UdsLocalTransportClient, d as summarizeMembers, dn as shouldReclaim, dt as PeerAnsweredError, en as RUNNER_RSS_BUDGET_ENV, er as EMPTY_CAP_ACTION_READING, et as classifyCapRoute, f as installManifestSystemDeps, fn as startHeapWatch, ft as localEndpointPath, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ht as buildNativeCapProxy, in as createLoopDelayMeter, ir as diffCapActionCensus, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as OUTBOUND_QUEUE_SUSTAIN_MS, jt as DeviceRegistry, k as createKernelHwAccel, kn as selectReportedSpaces, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as parseRssBudgetMb, lr as formatEventPlane, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as strandedMb, mt as encodeFrame, nn as buildHeapSample, nr as capActionLabel, nt as readMoleculerFanoutMode, o as registerRunnerGroup, on as describeRss, or as createEventPlaneMeter, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as startRunnerHeapWatch, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as createSocketDirectionCounters, qt as HEAP_WATCH_WARN_RATIO, r as defaultProcessGroupOps, rn as createDeferredHeapWatchSink, rr as createCapActionCensus, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as hubMainRssBudget, sr as createEventPlaneReader, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as ZERO_LOOP_DELAY, tr as MAX_CAP_ACTIONS_PER_PEER, tt as callWithServiceDiscovery, un as reclaimIntervalMs, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, w as getMoleculerEventStats, wn as HEAP_SPACE_REPORT_MIN_MB, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as formatArrayBufferCensus, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as createArrayBufferCensusGate, yt as mountNativeCapService, z as createUdsEventBus, zn as SOCKET_PLANE_TOP_N, zt as runNpm } from "./child-cap-dispatch-B52e2Bcw.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B1v6E07R.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";

package/dist/tls/cert-identity.d.ts

@@ -24,9 +24,10 @@ export declare function systemHostFacts(): HostFacts;
  *
  * The two are deliberately different sizes. Everything plausible is
  * certified — costs nothing. Only a **stable** identity gates
- * regeneration, because a gate that fires on a rotating address rewrites
- * the certificate on every boot, which is a worse bug than the one the
- * gate exists to fix.
+ * regeneration (IPv4 + DNS + operator `extraSans`), because a gate that
+ * fires on a rotating address rewrites the certificate on every boot,
+ * which is a worse bug than the one the gate exists to fix. IPv6 never
+ * gates — ULA proved as unstable as global SLAAC on the live hub.
  */
 export interface CertIdentity {
     readonly dnsNames: readonly string[];

package/dist/tls/cert-manager.d.ts

@@ -68,8 +68,9 @@ export interface CertOptions {
  *
  * And explicitly NOT when: the certificate names an address the machine
  * no longer has (a superset still works — the check is one-directional),
- * a volatile interface (docker/VPN/mesh) or a global-scope IPv6 address
- * changed (SLAAC privacy addresses rotate daily), or a new build shipped.
+ * a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
+ * (global and ULA both rotate under privacy extensions / interface-id
+ * churn — `os` cannot tell temporary from permanent), or a new build shipped.
  *
  * Every trigger is derived from the files plus the machine, so once a
  * reissue clears them it clears them for good: the next boot returns

package/dist/{tls-IM-v7JV4.mjs → tls-DAtaKVUT.mjs}

@@ -277,27 +277,21 @@ function isLinkLocal(value) {
 	const parsed = Number.parseInt(firstGroup, 16);
 	return Number.isFinite(parsed) && (parsed & 65472) === 65152;
 }
-/** `fc00::/7` — the IPv6 range that behaves like RFC 1918 does for v4. */
-function isUniqueLocalIpv6(value) {
-	if (!isIpv6(value)) return false;
-	const firstGroup = value.split(":")[0] ?? "";
-	const parsed = Number.parseInt(firstGroup, 16);
-	return Number.isFinite(parsed) && (parsed & 65024) === 64512;
-}
 function isVolatileInterface(name) {
 	const lower = name.toLowerCase();
 	return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
 }
 /**
-* A global-scope IPv6 address is NOT a stable identity: SLAAC privacy
-* extensions rotate temporary addresses roughly daily, and `os` gives us
-* no way to tell a temporary address from a permanent one. Gating on
-* one would reissue the certificate every day.
+* Only IPv4 gates a reissue. Every IPv6 address we see — global **or**
+* ULA — is certified but never required: `os` cannot tell a temporary
+* address from a permanent one, and the live hub's ULA interface-id
+* rotated on every restart (eight leaf reissues in one day under
+* `san-coverage-gap`). Gating on ULA reproduced the churn D227 exists
+* to prevent. Operators who need a fixed IPv6 declare it via `extraSans`.
 */
 function isStableGateAddress(address) {
 	if (isLinkLocal(address)) return false;
-	if (isIpv4(address)) return true;
-	return isUniqueLocalIpv6(address);
+	return isIpv4(address);
 }
 function addSan(dns, ips, value) {
 	const trimmed = value.trim();
@@ -11711,8 +11705,9 @@ var DEFAULT_COMMON_NAME = "camstack.local";
 *
 * And explicitly NOT when: the certificate names an address the machine
 * no longer has (a superset still works — the check is one-directional),
-* a volatile interface (docker/VPN/mesh) or a global-scope IPv6 address
-* changed (SLAAC privacy addresses rotate daily), or a new build shipped.
+* a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
+* (global and ULA both rotate under privacy extensions / interface-id
+* churn — `os` cannot tell temporary from permanent), or a new build shipped.
 *
 * Every trigger is derived from the files plus the machine, so once a
 * reissue clears them it clears them for good: the next boot returns

package/dist/{tls-D_wUeOTD.js → tls-DEjOOARt.js}

@@ -278,27 +278,21 @@ function isLinkLocal(value) {
 	const parsed = Number.parseInt(firstGroup, 16);
 	return Number.isFinite(parsed) && (parsed & 65472) === 65152;
 }
-/** `fc00::/7` — the IPv6 range that behaves like RFC 1918 does for v4. */
-function isUniqueLocalIpv6(value) {
-	if (!isIpv6(value)) return false;
-	const firstGroup = value.split(":")[0] ?? "";
-	const parsed = Number.parseInt(firstGroup, 16);
-	return Number.isFinite(parsed) && (parsed & 65024) === 64512;
-}
 function isVolatileInterface(name) {
 	const lower = name.toLowerCase();
 	return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
 }
 /**
-* A global-scope IPv6 address is NOT a stable identity: SLAAC privacy
-* extensions rotate temporary addresses roughly daily, and `os` gives us
-* no way to tell a temporary address from a permanent one. Gating on
-* one would reissue the certificate every day.
+* Only IPv4 gates a reissue. Every IPv6 address we see — global **or**
+* ULA — is certified but never required: `os` cannot tell a temporary
+* address from a permanent one, and the live hub's ULA interface-id
+* rotated on every restart (eight leaf reissues in one day under
+* `san-coverage-gap`). Gating on ULA reproduced the churn D227 exists
+* to prevent. Operators who need a fixed IPv6 declare it via `extraSans`.
 */
 function isStableGateAddress(address) {
 	if (isLinkLocal(address)) return false;
-	if (isIpv4(address)) return true;
-	return isUniqueLocalIpv6(address);
+	return isIpv4(address);
 }
 function addSan(dns, ips, value) {
 	const trimmed = value.trim();
@@ -11712,8 +11706,9 @@ var DEFAULT_COMMON_NAME = "camstack.local";
 *
 * And explicitly NOT when: the certificate names an address the machine
 * no longer has (a superset still works — the check is one-directional),
-* a volatile interface (docker/VPN/mesh) or a global-scope IPv6 address
-* changed (SLAAC privacy addresses rotate daily), or a new build shipped.
+* a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
+* (global and ULA both rotate under privacy extensions / interface-id
+* churn — `os` cannot tell temporary from permanent), or a new build shipped.
 *
 * Every trigger is derived from the files plus the machine, so once a
 * reissue clears them it clears them for good: the next boot returns

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.345",
+  "version": "1.2.346",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",