@camstack/system 1.2.381 → 1.2.383

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BugrtARh.js");
+const require_dist = require("../../dist-CUNGH0fs.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
+import { Qt as logDestinationCapability, ur as BaseAddon } from "../../dist-osl3bkF0.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{child-cap-dispatch-hf-Gce_4.js → child-cap-dispatch-BD8fhJ1b.js}

@@ -1,10 +1,11 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BugrtARh.js");
+const require_dist = require("./dist-CUNGH0fs.js");
 const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
-require("./hub-cap-forward-COCmYaup.js");
+require("./hub-cap-forward-W8oEm4ME.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let _camstack_types_node = require("@camstack/types/node");
+let node_net = require("node:net");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
@@ -14,6 +15,7 @@ let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
+let node_events = require("node:events");
 let node_http = require("node:http");
 let node_v8 = require("node:v8");
 node_v8 = require_chunk.__toESM(node_v8);
@@ -22,8 +24,6 @@ let node_perf_hooks = require("node:perf_hooks");
 let node_vm = require("node:vm");
 node_vm = require_chunk.__toESM(node_vm);
 let _camstack_types_addon = require("@camstack/types/addon");
-let node_events = require("node:events");
-let node_net = require("node:net");
 let _trpc_client = require("@trpc/client");
 //#region src/kernel/event-plane-report.ts
 /**
@@ -3223,11 +3223,14 @@ function isCredentialKeyName(key) {
 	return SECRET_KEY_SUBSTRINGS.some((needle) => lower.includes(needle));
 }
 var URL_IN_TEXT = /\b[a-z][a-z0-9+.-]*:\/\/[^\s"'<>`]+/gi;
+/** A root-relative path WITH a query, as request logs print it. */
+var RELATIVE_URL_IN_TEXT = /(^|[\s"'(=])(\/[^\s"'<>`?]*\?[^\s"'<>`]+)/g;
 var CREDENTIAL_FLAG = /(--(?:token|auth-?key|password|passwd|pass|secret|api-?key|access-?token|refresh-?token)(?:=|\s+))(\S+)/gi;
 /** Redact one free-form string. */
 function redactLogText(text) {
 	let out = require_dist.scrubKnownSecrets(text);
 	if (out.includes("://")) out = out.replace(URL_IN_TEXT, (url) => require_dist.maskUrlCredentials(url));
+	if (out.includes("/") && out.includes("?") && out.includes("=")) out = out.replace(RELATIVE_URL_IN_TEXT, (_m, lead, path) => `${lead}${require_dist.maskUrlCredentials(path)}`);
 	if (out.includes("--")) out = out.replace(CREDENTIAL_FLAG, (_m, flag, value) => value.startsWith("‹secret:") ? `${flag}${value}` : `${flag}${REDACTED}`);
 	return out;
 }

package/dist/{child-cap-dispatch-BTe4eKep.mjs → child-cap-dispatch-C68N2a6Y.mjs}

@@ -1,9 +1,10 @@
-import { Gr as scrubKnownSecrets, Qr as EventCategory$1, en as maskUrlCredentials, wr as createEvent } from "./dist-BC0GnGeg.mjs";
+import { Tr as createEvent, Yr as scrubKnownSecrets, ni as EventCategory$1, tn as maskUrlCredentials } from "./dist-osl3bkF0.mjs";
 import { a as parseProcStat, i as nodeProcReader } from "./proc-stat-CbC55Kqi.mjs";
-import "./hub-cap-forward-CH6_VWVO.mjs";
+import "./hub-cap-forward-CDiN1p98.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomBytes, randomUUID } from "node:crypto";
 import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
+import { connect, createConnection, createServer } from "node:net";
 import { mkdir, rm, stat, unlink } from "node:fs/promises";
 import * as path$1 from "node:path";
 import { dirname, isAbsolute, join } from "node:path";
@@ -13,14 +14,13 @@ import * as fs from "node:fs";
 import { createReadStream, createWriteStream, existsSync, readFileSync, readdirSync } from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { createServer, request } from "node:http";
+import { once } from "node:events";
+import { createServer as createServer$1, request } from "node:http";
 import * as v8 from "node:v8";
 import { Session } from "node:inspector/promises";
 import { monitorEventLoopDelay } from "node:perf_hooks";
 import * as vm from "node:vm";
 import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry, asJsonObject, asString, collectZodSecretPaths, createDeviceProxy, createEventBusSliceSource, createSecretsAccess, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, readNodePin, scopeKey, sleep, withCapInputDefaults } from "@camstack/types/addon";
-import { once } from "node:events";
-import { connect, createConnection, createServer as createServer$1 } from "node:net";
 import { TRPCClientError, createTRPCClient } from "@trpc/client";
 //#region src/kernel/event-plane-report.ts
 /**
@@ -2545,7 +2545,7 @@ function createAddonDataPlaneFacility(args) {
 	};
 	const ensureServer = async () => {
 		if (server) return;
-		const s = createServer((req, res) => route(req, res));
+		const s = createServer$1((req, res) => route(req, res));
 		await new Promise((resolve, reject) => {
 			s.once("error", reject);
 			s.listen(0, bindHost, () => resolve());
@@ -2764,7 +2764,7 @@ function createAddonPeerBytesFacility(args) {
 	const listen = () => {
 		if (listening !== null) return listening;
 		listening = new Promise((resolve, reject) => {
-			const created = createServer((req, res) => {
+			const created = createServer$1((req, res) => {
 				route(req, res);
 			});
 			created.on("error", (err) => {
@@ -3220,11 +3220,14 @@ function isCredentialKeyName(key) {
 	return SECRET_KEY_SUBSTRINGS.some((needle) => lower.includes(needle));
 }
 var URL_IN_TEXT = /\b[a-z][a-z0-9+.-]*:\/\/[^\s"'<>`]+/gi;
+/** A root-relative path WITH a query, as request logs print it. */
+var RELATIVE_URL_IN_TEXT = /(^|[\s"'(=])(\/[^\s"'<>`?]*\?[^\s"'<>`]+)/g;
 var CREDENTIAL_FLAG = /(--(?:token|auth-?key|password|passwd|pass|secret|api-?key|access-?token|refresh-?token)(?:=|\s+))(\S+)/gi;
 /** Redact one free-form string. */
 function redactLogText(text) {
 	let out = scrubKnownSecrets(text);
 	if (out.includes("://")) out = out.replace(URL_IN_TEXT, (url) => maskUrlCredentials(url));
+	if (out.includes("/") && out.includes("?") && out.includes("=")) out = out.replace(RELATIVE_URL_IN_TEXT, (_m, lead, path) => `${lead}${maskUrlCredentials(path)}`);
 	if (out.includes("--")) out = out.replace(CREDENTIAL_FLAG, (_m, flag, value) => value.startsWith("‹secret:") ? `${flag}${value}` : `${flag}${REDACTED}`);
 	return out;
 }
@@ -7459,7 +7462,7 @@ var UdsLocalTransportServer = class {
 			await unlink(this.path);
 		} catch {}
 		await new Promise((resolve, reject) => {
-			const srv = createServer$1((socket) => {
+			const srv = createServer((socket) => {
 				const ch = new SocketChannel(socket);
 				this.channels.add(ch);
 				ch.onClose(() => this.channels.delete(ch));

package/dist/{composition-sources-4SmsP0O4.js → composition-sources-ChpT_Yw4.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BugrtARh.js");
+const require_dist = require("./dist-CUNGH0fs.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-CgOQVIwa.mjs → composition-sources-DM7Ft_tp.mjs}

@@ -1,4 +1,4 @@
-import { cr as errMsg, tr as compositionSourceKey } from "./dist-BC0GnGeg.mjs";
+import { lr as errMsg, nr as compositionSourceKey } from "./dist-osl3bkF0.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{cluster-secret-BUiG8DCo.js → constants-CDpry1_T.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BugrtARh.js");
+const require_dist = require("./dist-CUNGH0fs.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**
@@ -79,7 +79,34 @@ function getProcessClusterSecretGate() {
 	const value = Reflect.get(globalThis, GATE_SLOT);
 	return isGate(value) ? value : NOT_LOADED;
 }
+/** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
+var MESH_CA_KEY_REF = require_dist.buildSecretRef({
+	owner: "system",
+	scope: { kind: "global" },
+	fieldPath: "meshCaKey"
+});
+/** `system-settings` key holding the public CA certificate PEM. */
+var MESH_CA_SETTINGS_KEY = "cluster.meshCa";
+/** Field inside the `cluster` section (same row as the secret). */
+var MESH_CA_FIELD = "meshCa";
+/** Join-token / leaf lifetimes. */
+var MESH_JOIN_TOKEN_MAX_TTL_SEC = 3600;
+var MESH_CA_VALIDITY_DAYS = 3650;
+/** Hub clear TCP (existing) and TLS dual-listen port (Release A). */
+var DEFAULT_HUB_TCP_PORT = 6e3;
+var DEFAULT_HUB_TLS_TCP_PORT = 6443;
+/** Subject of the mesh root. Distinct from the HTTPS local CA. */
+var MESH_CA_COMMON_NAME = "CamStack Mesh CA";
+/** Client + server auth EKU OIDs (mutual TLS). */
+var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
 //#endregion
+Object.defineProperty(exports, "CLIENT_AUTH_OID", {
+	enumerable: true,
+	get: function() {
+		return CLIENT_AUTH_OID;
+	}
+});
 Object.defineProperty(exports, "CLUSTER_SECRET_MISMATCH_TYPE", {
 	enumerable: true,
 	get: function() {
@@ -110,6 +137,60 @@ Object.defineProperty(exports, "CLUSTER_SECRET_UNAVAILABLE_TYPE", {
 		return CLUSTER_SECRET_UNAVAILABLE_TYPE;
 	}
 });
+Object.defineProperty(exports, "DEFAULT_HUB_TCP_PORT", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_HUB_TCP_PORT;
+	}
+});
+Object.defineProperty(exports, "DEFAULT_HUB_TLS_TCP_PORT", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_HUB_TLS_TCP_PORT;
+	}
+});
+Object.defineProperty(exports, "MESH_CA_COMMON_NAME", {
+	enumerable: true,
+	get: function() {
+		return MESH_CA_COMMON_NAME;
+	}
+});
+Object.defineProperty(exports, "MESH_CA_FIELD", {
+	enumerable: true,
+	get: function() {
+		return MESH_CA_FIELD;
+	}
+});
+Object.defineProperty(exports, "MESH_CA_KEY_REF", {
+	enumerable: true,
+	get: function() {
+		return MESH_CA_KEY_REF;
+	}
+});
+Object.defineProperty(exports, "MESH_CA_SETTINGS_KEY", {
+	enumerable: true,
+	get: function() {
+		return MESH_CA_SETTINGS_KEY;
+	}
+});
+Object.defineProperty(exports, "MESH_CA_VALIDITY_DAYS", {
+	enumerable: true,
+	get: function() {
+		return MESH_CA_VALIDITY_DAYS;
+	}
+});
+Object.defineProperty(exports, "MESH_JOIN_TOKEN_MAX_TTL_SEC", {
+	enumerable: true,
+	get: function() {
+		return MESH_JOIN_TOKEN_MAX_TTL_SEC;
+	}
+});
+Object.defineProperty(exports, "SERVER_AUTH_OID", {
+	enumerable: true,
+	get: function() {
+		return SERVER_AUTH_OID;
+	}
+});
 Object.defineProperty(exports, "checkClusterSecret", {
 	enumerable: true,
 	get: function() {

package/dist/{cluster-secret-DgJTZ4qY.mjs → constants-e3mCa1jG.mjs}

@@ -1,4 +1,4 @@
-import { xr as buildSecretRef } from "./dist-BC0GnGeg.mjs";
+import { Sr as buildSecretRef } from "./dist-osl3bkF0.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**
@@ -79,5 +79,26 @@ function getProcessClusterSecretGate() {
 	const value = Reflect.get(globalThis, GATE_SLOT);
 	return isGate(value) ? value : NOT_LOADED;
 }
+/** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
+var MESH_CA_KEY_REF = buildSecretRef({
+	owner: "system",
+	scope: { kind: "global" },
+	fieldPath: "meshCaKey"
+});
+/** `system-settings` key holding the public CA certificate PEM. */
+var MESH_CA_SETTINGS_KEY = "cluster.meshCa";
+/** Field inside the `cluster` section (same row as the secret). */
+var MESH_CA_FIELD = "meshCa";
+/** Join-token / leaf lifetimes. */
+var MESH_JOIN_TOKEN_MAX_TTL_SEC = 3600;
+var MESH_CA_VALIDITY_DAYS = 3650;
+/** Hub clear TCP (existing) and TLS dual-listen port (Release A). */
+var DEFAULT_HUB_TCP_PORT = 6e3;
+var DEFAULT_HUB_TLS_TCP_PORT = 6443;
+/** Subject of the mesh root. Distinct from the HTTPS local CA. */
+var MESH_CA_COMMON_NAME = "CamStack Mesh CA";
+/** Client + server auth EKU OIDs (mutual TLS). */
+var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
 //#endregion
-export { CLUSTER_SECRET_UNAVAILABLE_TYPE as a, getProcessClusterSecretGate as c, setProcessClusterSecretGate as d, CLUSTER_SECRET_SETTINGS_KEY as i, hashClusterSecret as l, CLUSTER_SECRET_REF as n, checkClusterSecret as o, CLUSTER_SECRET_REJECTED_EXIT_CODE as r, clusterSecretMatches as s, CLUSTER_SECRET_MISMATCH_TYPE as t, isClusterSecretMismatchError as u };
+export { clusterSecretMatches as _, MESH_CA_FIELD as a, isClusterSecretMismatchError as b, MESH_CA_VALIDITY_DAYS as c, CLUSTER_SECRET_MISMATCH_TYPE as d, CLUSTER_SECRET_REF as f, checkClusterSecret as g, CLUSTER_SECRET_UNAVAILABLE_TYPE as h, MESH_CA_COMMON_NAME as i, MESH_JOIN_TOKEN_MAX_TTL_SEC as l, CLUSTER_SECRET_SETTINGS_KEY as m, DEFAULT_HUB_TCP_PORT as n, MESH_CA_KEY_REF as o, CLUSTER_SECRET_REJECTED_EXIT_CODE as p, DEFAULT_HUB_TLS_TCP_PORT as r, MESH_CA_SETTINGS_KEY as s, CLIENT_AUTH_OID as t, SERVER_AUTH_OID as u, getProcessClusterSecretGate as v, setProcessClusterSecretGate as x, hashClusterSecret as y };