@camstack/system 1.2.381 → 1.2.383

package/dist/builtins/local-network/local-network.addon.js

@@ -1,12 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BugrtARh.js");
-const require_tls = require("../../tls-CCMX7MjX.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
+const require_tls = require("../../tls-BWpwU-d5.js");
 let zod = require("zod");
+let node_net = require("node:net");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
-let node_net = require("node:net");
 //#region src/builtins/local-network/address-book.ts
 /**
 * The Network page's address book, as pure functions: custom addresses plus

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,9 +1,9 @@
-import { Cn as resolveHubAddressRoles, En as resolveNotificationTapAddress, Hn as validateCustomAddress, It as isAppLinkBase, Qr as EventCategory, Yt as localNetworkCapability, fn as pickAppLinkHub, lr as BaseAddon, nt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, yn as resolveAppConnections, zt as isDefaultAppConnectionEndpoint } from "../../dist-BC0GnGeg.mjs";
-import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-CJHogwTl.mjs";
+import { Bt as isDefaultAppConnectionEndpoint, Dn as resolveNotificationTapAddress, Lt as isAppLinkBase, Un as validateCustomAddress, Xt as localNetworkCapability, bn as resolveAppConnections, ni as EventCategory, pn as pickAppLinkHub, rt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, ur as BaseAddon, wn as resolveHubAddressRoles } from "../../dist-osl3bkF0.mjs";
+import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-C2NT-Orr.mjs";
 import { z } from "zod";
+import { isIP } from "node:net";
 import * as os from "node:os";
 import { readFileSync } from "node:fs";
-import { isIP } from "node:net";
 //#region src/builtins/local-network/address-book.ts
 /**
 * The Network page's address book, as pure functions: custom addresses plus

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BugrtARh.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label
@@ -293,10 +293,52 @@ var LokiDestination = class {
 	}
 };
 //#endregion
+//#region src/builtins/loki-logging/retire-enabled-flag.ts
+/** The retired settings key. */
+var RETIRED_ENABLED_KEY = "enabled";
+/** Store key marking the retirement as done. Not a schema field. Pre-D777 name kept. */
+var RETIREMENT_MARKER_KEY = "migratedEnabled";
+function deferred(reason) {
+	return {
+		kind: "deferred",
+		reason
+	};
+}
+function isMarked(read) {
+	return read.kind === "present" && read.value === true;
+}
+async function retireEnabledFlag(deps) {
+	const marker = await deps.readStoredKey(RETIREMENT_MARKER_KEY);
+	if (marker.kind === "unreadable") return deferred("settings store unreadable (marker)");
+	if (isMarked(marker)) return { kind: "already-retired" };
+	const flag = await deps.readStoredKey(RETIRED_ENABLED_KEY);
+	if (flag.kind === "unreadable") return deferred("settings store unreadable (enabled)");
+	const wasOff = flag.kind === "present" && flag.value === false;
+	if (wasOff) try {
+		await deps.disableAtCapability();
+	} catch (err) {
+		return deferred(`capability toggle refused: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	await deps.commit();
+	if (!isMarked(await deps.readStoredKey("migratedEnabled"))) return deferred("retirement write did not land");
+	return {
+		kind: "retired",
+		capDisabled: wasOff
+	};
+}
+//#endregion
 //#region src/builtins/loki-logging/loki-logging.addon.ts
+/** Backoff between retirement attempts — the first ones are refused until the
+*  provider registration reaches the hub. After the last, the next boot retries. */
+var RETIREMENT_RETRY_DELAYS_MS = [
+	1e3,
+	2e3,
+	5e3,
+	1e4,
+	3e4,
+	6e4
+];
 var DEFAULTS = {
-	enabled: true,
-	migratedEnabled: false,
 	url: "",
 	job: "camstack",
 	level: "info",
@@ -310,6 +352,8 @@ var DEFAULTS = {
 };
 var LokiLoggingAddon = class extends require_dist.BaseAddon {
 	destination = null;
+	retirementTimer = null;
+	shuttingDown = false;
 	constructor() {
 		super({ ...DEFAULTS });
 	}
@@ -317,48 +361,72 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 		this.destination = new LokiDestination();
 		await this.destination.initialize(this.destinationConfig());
 		this.ctx.logger.info(this.config.url.length > 0 ? `Loki logging initialized → ${this.config.url}` : "Loki logging registered but inactive (no URL set)");
-		await this.migrateRetiredEnabledFlag();
+		this.shuttingDown = false;
+		this.attemptEnabledFlagRetirement(0);
 		return [{
 			capability: require_dist.logDestinationCapability,
 			provider: this.destination
 		}];
 	}
-	/**
-	* ONE-SHOT: carry a stored `enabled: false` over to the orchestrator's
-	* per-destination toggle, then never look at the flag again.
-	*
-	* Without this, retiring the private setting would silently RE-ENABLE Loki
-	* for every operator who had turned it off — shipping their logs to a host
-	* they may no longer control. Best-effort: if the toggle call fails the
-	* migration is simply retried next boot (the flag is only cleared on
-	* success).
-	*/
-	async migrateRetiredEnabledFlag() {
-		if (this.config.migratedEnabled) return;
+	/** One attempt of the D777 carry-over; reschedules itself while deferred. */
+	async attemptEnabledFlagRetirement(attempt) {
+		if (this.shuttingDown) return;
+		let outcome;
 		try {
-			if (!this.config.enabled) {
-				await this.ctx.api.addons.setCapabilityProviderEnabled.mutate({
-					capName: "log-destination",
-					addonId: this.ctx.id,
-					enabled: false
-				});
-				this.ctx.logger.info("Loki logging: the retired `enabled: false` setting was carried over to the per-destination toggle — re-enable it there if you want Loki shipping again.");
-			}
-			await this.updateGlobalSettings({ migratedEnabled: true });
+			outcome = await retireEnabledFlag({
+				readStoredKey: (key) => this.readStoredGlobalKey(key),
+				disableAtCapability: async () => {
+					await this.ctx.api.addons.setCapabilityProviderEnabled.mutate({
+						capName: require_dist.logDestinationCapability.name,
+						addonId: this.ctx.id,
+						enabled: false
+					});
+				},
+				commit: async () => {
+					const patch = {
+						[RETIRED_ENABLED_KEY]: void 0,
+						[RETIREMENT_MARKER_KEY]: true
+					};
+					await this.updateGlobalSettings(patch);
+				}
+			});
 		} catch (err) {
-			this.ctx.logger.warn("Loki logging: enablement migration deferred to next boot", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			outcome = {
+				kind: "deferred",
+				reason: err instanceof Error ? err.message : String(err)
+			};
+		}
+		if (outcome.kind === "retired" && outcome.capDisabled) this.ctx.logger.info("Loki logging: the retired `enabled: false` setting was carried over to the per-destination toggle — re-enable it there if you want Loki shipping again.");
+		if (outcome.kind !== "deferred") return;
+		const delay = RETIREMENT_RETRY_DELAYS_MS[attempt];
+		if (delay === void 0) {
+			this.ctx.logger.warn("Loki logging: enablement carry-over deferred to next boot", { meta: { reason: outcome.reason } });
+			return;
 		}
+		this.ctx.logger.debug("Loki logging: enablement carry-over deferred", { meta: {
+			reason: outcome.reason,
+			attempt,
+			retryInMs: delay
+		} });
+		this.retirementTimer = setTimeout(() => {
+			this.retirementTimer = null;
+			this.attemptEnabledFlagRetirement(attempt + 1);
+		}, delay);
+		this.retirementTimer.unref?.();
 	}
 	async onShutdown() {
+		this.shuttingDown = true;
+		if (this.retirementTimer !== null) clearTimeout(this.retirementTimer);
+		this.retirementTimer = null;
 		await this.destination?.shutdown();
 		this.destination = null;
 	}
 	/**
-	* React to a settings change (enable/disable, URL, level, batching) without a
+	* React to a settings change (URL, level, batching) without a
 	* restart — the contract this addon advertises. `BaseAddon` has already
 	* reloaded `this.config` by the time this runs; re-apply it to the live
-	* destination so toggling `enabled` on actually starts pushing (and off stops
-	* it). Without this the destination keeps its boot-time config forever.
+	* destination so setting or clearing the URL actually starts (or stops)
+	* pushing. Without this the destination keeps its boot-time config forever.
 	*/
 	async onConfigChanged() {
 		await this.destination?.reconfigure(this.destinationConfig());

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
+import { Qt as logDestinationCapability, ur as BaseAddon } from "../../dist-osl3bkF0.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label
@@ -288,10 +288,52 @@ var LokiDestination = class {
 	}
 };
 //#endregion
+//#region src/builtins/loki-logging/retire-enabled-flag.ts
+/** The retired settings key. */
+var RETIRED_ENABLED_KEY = "enabled";
+/** Store key marking the retirement as done. Not a schema field. Pre-D777 name kept. */
+var RETIREMENT_MARKER_KEY = "migratedEnabled";
+function deferred(reason) {
+	return {
+		kind: "deferred",
+		reason
+	};
+}
+function isMarked(read) {
+	return read.kind === "present" && read.value === true;
+}
+async function retireEnabledFlag(deps) {
+	const marker = await deps.readStoredKey(RETIREMENT_MARKER_KEY);
+	if (marker.kind === "unreadable") return deferred("settings store unreadable (marker)");
+	if (isMarked(marker)) return { kind: "already-retired" };
+	const flag = await deps.readStoredKey(RETIRED_ENABLED_KEY);
+	if (flag.kind === "unreadable") return deferred("settings store unreadable (enabled)");
+	const wasOff = flag.kind === "present" && flag.value === false;
+	if (wasOff) try {
+		await deps.disableAtCapability();
+	} catch (err) {
+		return deferred(`capability toggle refused: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	await deps.commit();
+	if (!isMarked(await deps.readStoredKey("migratedEnabled"))) return deferred("retirement write did not land");
+	return {
+		kind: "retired",
+		capDisabled: wasOff
+	};
+}
+//#endregion
 //#region src/builtins/loki-logging/loki-logging.addon.ts
+/** Backoff between retirement attempts — the first ones are refused until the
+*  provider registration reaches the hub. After the last, the next boot retries. */
+var RETIREMENT_RETRY_DELAYS_MS = [
+	1e3,
+	2e3,
+	5e3,
+	1e4,
+	3e4,
+	6e4
+];
 var DEFAULTS = {
-	enabled: true,
-	migratedEnabled: false,
 	url: "",
 	job: "camstack",
 	level: "info",
@@ -305,6 +347,8 @@ var DEFAULTS = {
 };
 var LokiLoggingAddon = class extends BaseAddon {
 	destination = null;
+	retirementTimer = null;
+	shuttingDown = false;
 	constructor() {
 		super({ ...DEFAULTS });
 	}
@@ -312,48 +356,72 @@ var LokiLoggingAddon = class extends BaseAddon {
 		this.destination = new LokiDestination();
 		await this.destination.initialize(this.destinationConfig());
 		this.ctx.logger.info(this.config.url.length > 0 ? `Loki logging initialized → ${this.config.url}` : "Loki logging registered but inactive (no URL set)");
-		await this.migrateRetiredEnabledFlag();
+		this.shuttingDown = false;
+		this.attemptEnabledFlagRetirement(0);
 		return [{
 			capability: logDestinationCapability,
 			provider: this.destination
 		}];
 	}
-	/**
-	* ONE-SHOT: carry a stored `enabled: false` over to the orchestrator's
-	* per-destination toggle, then never look at the flag again.
-	*
-	* Without this, retiring the private setting would silently RE-ENABLE Loki
-	* for every operator who had turned it off — shipping their logs to a host
-	* they may no longer control. Best-effort: if the toggle call fails the
-	* migration is simply retried next boot (the flag is only cleared on
-	* success).
-	*/
-	async migrateRetiredEnabledFlag() {
-		if (this.config.migratedEnabled) return;
+	/** One attempt of the D777 carry-over; reschedules itself while deferred. */
+	async attemptEnabledFlagRetirement(attempt) {
+		if (this.shuttingDown) return;
+		let outcome;
 		try {
-			if (!this.config.enabled) {
-				await this.ctx.api.addons.setCapabilityProviderEnabled.mutate({
-					capName: "log-destination",
-					addonId: this.ctx.id,
-					enabled: false
-				});
-				this.ctx.logger.info("Loki logging: the retired `enabled: false` setting was carried over to the per-destination toggle — re-enable it there if you want Loki shipping again.");
-			}
-			await this.updateGlobalSettings({ migratedEnabled: true });
+			outcome = await retireEnabledFlag({
+				readStoredKey: (key) => this.readStoredGlobalKey(key),
+				disableAtCapability: async () => {
+					await this.ctx.api.addons.setCapabilityProviderEnabled.mutate({
+						capName: logDestinationCapability.name,
+						addonId: this.ctx.id,
+						enabled: false
+					});
+				},
+				commit: async () => {
+					const patch = {
+						[RETIRED_ENABLED_KEY]: void 0,
+						[RETIREMENT_MARKER_KEY]: true
+					};
+					await this.updateGlobalSettings(patch);
+				}
+			});
 		} catch (err) {
-			this.ctx.logger.warn("Loki logging: enablement migration deferred to next boot", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			outcome = {
+				kind: "deferred",
+				reason: err instanceof Error ? err.message : String(err)
+			};
+		}
+		if (outcome.kind === "retired" && outcome.capDisabled) this.ctx.logger.info("Loki logging: the retired `enabled: false` setting was carried over to the per-destination toggle — re-enable it there if you want Loki shipping again.");
+		if (outcome.kind !== "deferred") return;
+		const delay = RETIREMENT_RETRY_DELAYS_MS[attempt];
+		if (delay === void 0) {
+			this.ctx.logger.warn("Loki logging: enablement carry-over deferred to next boot", { meta: { reason: outcome.reason } });
+			return;
 		}
+		this.ctx.logger.debug("Loki logging: enablement carry-over deferred", { meta: {
+			reason: outcome.reason,
+			attempt,
+			retryInMs: delay
+		} });
+		this.retirementTimer = setTimeout(() => {
+			this.retirementTimer = null;
+			this.attemptEnabledFlagRetirement(attempt + 1);
+		}, delay);
+		this.retirementTimer.unref?.();
 	}
 	async onShutdown() {
+		this.shuttingDown = true;
+		if (this.retirementTimer !== null) clearTimeout(this.retirementTimer);
+		this.retirementTimer = null;
 		await this.destination?.shutdown();
 		this.destination = null;
 	}
 	/**
-	* React to a settings change (enable/disable, URL, level, batching) without a
+	* React to a settings change (URL, level, batching) without a
 	* restart — the contract this addon advertises. `BaseAddon` has already
 	* reloaded `this.config` by the time this runs; re-apply it to the live
-	* destination so toggling `enabled` on actually starts pushing (and off stops
-	* it). Without this the destination keeps its boot-time config forever.
+	* destination so setting or clearing the URL actually starts (or stops)
+	* pushing. Without this the destination keeps its boot-time config forever.
 	*/
 	async onConfigChanged() {
 		await this.destination?.reconfigure(this.destinationConfig());

package/dist/builtins/loki-logging/loki-logging.addon.d.ts

@@ -1,15 +1,6 @@
 import { LogLevel, ProviderRegistration, BaseAddon } from '@camstack/types';
 import { LokiDestination } from './loki-destination.js';
 interface LokiAddonConfig {
-    /**
-     * RETIRED (2026-07-30). Enablement is the orchestrator's per-destination
-     * toggle now — the ONE truth for every log destination. Kept only so a
-     * stored `false` can be migrated ONCE into a registry disable: without that,
-     * an operator who had Loki off would silently start shipping logs after this
-     * update. `migratedEnabled` marks the migration done; the field is then dead.
-     */
-    readonly enabled: boolean;
-    readonly migratedEnabled: boolean;
     readonly url: string;
     readonly job: string;
     readonly level: LogLevel;
@@ -23,26 +14,19 @@ interface LokiAddonConfig {
 }
 export declare class LokiLoggingAddon extends BaseAddon<LokiAddonConfig> {
     private destination;
+    private retirementTimer;
+    private shuttingDown;
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
-    /**
-     * ONE-SHOT: carry a stored `enabled: false` over to the orchestrator's
-     * per-destination toggle, then never look at the flag again.
-     *
-     * Without this, retiring the private setting would silently RE-ENABLE Loki
-     * for every operator who had turned it off — shipping their logs to a host
-     * they may no longer control. Best-effort: if the toggle call fails the
-     * migration is simply retried next boot (the flag is only cleared on
-     * success).
-     */
-    private migrateRetiredEnabledFlag;
+    /** One attempt of the D777 carry-over; reschedules itself while deferred. */
+    private attemptEnabledFlagRetirement;
     protected onShutdown(): Promise<void>;
     /**
-     * React to a settings change (enable/disable, URL, level, batching) without a
+     * React to a settings change (URL, level, batching) without a
      * restart — the contract this addon advertises. `BaseAddon` has already
      * reloaded `this.config` by the time this runs; re-apply it to the live
-     * destination so toggling `enabled` on actually starts pushing (and off stops
-     * it). Without this the destination keeps its boot-time config forever.
+     * destination so setting or clearing the URL actually starts (or stops)
+     * pushing. Without this the destination keeps its boot-time config forever.
      */
     protected onConfigChanged(): Promise<void>;
     /**

package/dist/builtins/loki-logging/retire-enabled-flag.d.ts

@@ -0,0 +1,23 @@
+import { StoredKeyRead } from '@camstack/types';
+/** The retired settings key. */
+export declare const RETIRED_ENABLED_KEY = "enabled";
+/** Store key marking the retirement as done. Not a schema field. Pre-D777 name kept. */
+export declare const RETIREMENT_MARKER_KEY = "migratedEnabled";
+export type RetirementOutcome = {
+    readonly kind: 'already-retired';
+} | {
+    readonly kind: 'retired';
+    readonly capDisabled: boolean;
+} | {
+    readonly kind: 'deferred';
+    readonly reason: string;
+};
+export interface RetireEnabledFlagDeps {
+    /** Three-way read of one key of the addon's own store. */
+    readStoredKey(key: string): Promise<StoredKeyRead>;
+    /** Disable this addon at the `log-destination` toggle. Throws when refused. */
+    disableAtCapability(): Promise<void>;
+    /** ONE store write: strip {@link RETIRED_ENABLED_KEY} and set {@link RETIREMENT_MARKER_KEY}. */
+    commit(): Promise<void>;
+}
+export declare function retireEnabledFlag(deps: RetireEnabledFlagDeps): Promise<RetirementOutcome>;

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BugrtARh.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as foldSnapshotByFunction, Qr as EventCategory, _n as reducePoints, bn as resolveBucketMs, cr as errMsg, in as metricsProviderCapability, lr as BaseAddon, wr as createEvent } from "../../dist-BC0GnGeg.mjs";
+import { Nt as foldSnapshotByFunction, Tr as createEvent, an as metricsProviderCapability, lr as errMsg, ni as EventCategory, ur as BaseAddon, vn as reducePoints, xn as resolveBucketMs } from "../../dist-osl3bkF0.mjs";
 import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BugrtARh.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { An as scoreRuntimes, Ct as enumerateInferenceDevices, Er as emitReadiness, Qr as EventCategory, cr as errMsg, lr as BaseAddon, mn as platformProbeCapability } from "../../dist-BC0GnGeg.mjs";
+import { hn as platformProbeCapability, jn as scoreRuntimes, kr as emitReadiness, lr as errMsg, ni as EventCategory, ur as BaseAddon, wt as enumerateInferenceDevices } from "../../dist-osl3bkF0.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BugrtARh.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Qr as EventCategory, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
+import { ni as EventCategory, ur as BaseAddon } from "../../dist-osl3bkF0.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BugrtARh.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Ir as nodePin, Nn as snapshotCapability, Qr as EventCategory, X as bareAddonId, Z as batteryCapability, _t as deriveBatteryPresence, a as BatteryStatusSchema, ar as DeviceFeature, cr as errMsg, lr as BaseAddon, rn as memoizePinnedFfmpeg, sr as DeviceType, zn as streamQualityLabel } from "../../dist-BC0GnGeg.mjs";
+import { Bn as streamQualityLabel, Br as nodePin, Pn as snapshotCapability, Q as batteryCapability, Z as bareAddonId, a as BatteryStatusSchema, cr as DeviceType, in as memoizePinnedFfmpeg, lr as errMsg, ni as EventCategory, or as DeviceFeature, ur as BaseAddon, vt as deriveBatteryPresence } from "../../dist-osl3bkF0.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BugrtARh.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Ln as storageProviderCapability, jt as filesystemBrowseCapability, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
+import { Mt as filesystemBrowseCapability, Rn as storageProviderCapability, ur as BaseAddon } from "../../dist-osl3bkF0.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BugrtARh.js");
-const require_hub_cap_forward = require("../../hub-cap-forward-COCmYaup.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
+const require_hub_cap_forward = require("../../hub-cap-forward-W8oEm4ME.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
-import { B as StorageLocationModeSchema, Bt as isLocationEnabled, D as LegacyStorageLocationDefaultSchema, Dt as evictionPolicyOfLocation, Fn as storageMigrationCapability, H as StorageMigrationJobSchema, Kn as withLocationMode, Kr as secretTreeFromPaths, Pn as storageCapability, Pr as isSecretMarker, Pt as gbToBytes, Qr as EventCategory, Rr as parseJsonObject, Sr as collectSecretConfigKeys, Ur as resolveSecretMarkers, V as StorageLocationTypeSchema, Zr as transformSecretWrite, an as modeMayWrite, jn as settingsStoreCapability, lr as BaseAddon, nn as mayWriteToLocation, pr as REDACTED_SECRET, qt as legacyModeOf, tn as mayReadLocation, wn as resolveLocationMode, z as StorageCleanupJobSchema } from "../../dist-BC0GnGeg.mjs";
-import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-CH6_VWVO.mjs";
+import { B as StorageCleanupJobSchema, Cr as collectSecretConfigKeys, Fn as storageCapability, Ft as gbToBytes, H as StorageLocationTypeSchema, Hr as parseJsonObject, In as storageMigrationCapability, Jt as legacyModeOf, Lr as isSecretMarker, Mn as settingsStoreCapability, O as LegacyStorageLocationDefaultSchema, Ot as evictionPolicyOfLocation, Tn as resolveLocationMode, U as StorageMigrationJobSchema, V as StorageLocationModeSchema, Vt as isLocationEnabled, Xr as secretTreeFromPaths, mr as REDACTED_SECRET, ni as EventCategory, nn as mayReadLocation, on as modeMayWrite, qn as withLocationMode, qr as resolveSecretMarkers, rn as mayWriteToLocation, ti as transformSecretWrite, ur as BaseAddon } from "../../dist-osl3bkF0.mjs";
+import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-CDiN1p98.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";

package/dist/builtins/system-backup/backup-encryption.d.ts

@@ -0,0 +1,57 @@
+import { KeyObject } from 'node:crypto';
+import { Transform } from 'node:stream';
+export declare const BACKUP_ENCRYPTION_SCHEME = "x25519-hkdf-aes256gcm-stream-v1";
+export declare const ENCRYPTED_BACKUP_SUFFIX = ".csbk";
+export declare const BACKUP_ENCRYPTION_HEADER_BYTES: number;
+export declare const DEFAULT_BACKUP_CHUNK_BYTES: number;
+/** A key string that is not a backup key, or was mistyped. */
+export declare class BackupKeyFormatError extends Error {
+    constructor(message: string);
+}
+/** The archive was encrypted to another backup key. */
+export declare class BackupKeyMismatchError extends Error {
+    readonly archiveKeyId: string;
+    readonly givenKeyId: string;
+    constructor(archiveKeyId: string, givenKeyId: string);
+}
+/** The archive is damaged, truncated or tampered with. */
+export declare class BackupDecryptError extends Error {
+    constructor(message: string);
+}
+export interface BackupKeyPair {
+    /** Shown ONCE to the operator; never stored on the hub. */
+    readonly secretKey: string;
+    /** What the hub keeps to encrypt. */
+    readonly publicKey: string;
+    /** 16 hex chars — names the key in the UI and in every archive header. */
+    readonly keyId: string;
+}
+export declare function generateBackupKeyPair(): BackupKeyPair;
+export interface ParsedPublicKey {
+    readonly raw: Buffer;
+    readonly keyId: string;
+}
+export interface ParsedSecretKey {
+    readonly key: KeyObject;
+    readonly publicRaw: Buffer;
+    readonly keyId: string;
+}
+export declare function parseBackupPublicKey(text: string): ParsedPublicKey;
+export declare function parseBackupSecretKey(text: string): ParsedSecretKey;
+/** Encrypt a byte stream to the holder of `publicKey`'s secret key. */
+export declare function createBackupEncryptStream(publicKey: string, opts?: {
+    readonly chunkBytes?: number;
+}): Transform;
+/** Decrypt a stream produced by {@link createBackupEncryptStream}. */
+export declare function createBackupDecryptStream(secretKey: string): Transform;
+/** The key id an encrypted archive names, or `null` for a plain (pre-encryption) archive. */
+export declare function readBackupEncryptionHeader(file: string): Promise<{
+    readonly keyId: string;
+} | null>;
+/** File → file. Used by tests and the offline path; the hub streams in its pipeline. */
+export declare function encryptBackupFile(input: string, output: string, publicKey: string): Promise<void>;
+/**
+ * File → file. A failure of any kind removes the partial output: a restore
+ * must never find half a tar where the archive should be.
+ */
+export declare function decryptBackupFile(input: string, output: string, secretKey: string): Promise<void>;