@camstack/system 1.2.416 → 1.2.418

package/dist/{jwt-signing-key-DLbjTIuA.mjs → jwt-signing-key-CGg61A5v.mjs}

@@ -1,4 +1,4 @@
-import { Tr as buildSecretRef } from "./dist-DwE9yHdk.mjs";
+import { xr as buildSecretRef } from "./dist-DlmdESNT.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{jwt-signing-key-CsC-FxSm.js → jwt-signing-key-Jyu81jZR.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DxiDI8hZ.js");
+const require_dist = require("./dist-DVUg8e1T.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/kernel/moleculer/broker-factory.d.ts

@@ -7,8 +7,8 @@ interface BrokerConfig {
 	readonly logLevel?: string;
 	/**
 	* TCP port the hub listens on for cluster traffic.
-	* Agents need a deterministic port to connect via `urls: 'hub@host:port'`
-	* when UDP multicast discovery is disabled.
+	* Agents connect to it via `urls: 'hub@host:port'` — there is no UDP
+	* discovery (D826, D843).
 	*/
 	readonly tcpPort?: number;
 	/**
@@ -16,8 +16,6 @@ interface BrokerConfig {
 	* Clear traffic stays on {@link tcpPort}; enrolled agents dial this.
 	*/
 	readonly tlsPort?: number;
-	/** UDP port for cluster discovery (default: 4445). */
-	readonly udpPort?: number;
 	/**
 	* Explicit TCP port for the agent's own Moleculer reader to bind.
 	* When omitted, the port is derived deterministically from `nodeID`

package/dist/kernel/transport/local-child-registry.d.ts

@@ -1,4 +1,4 @@
-import { type IReadinessRegistryRecord, type SystemEvent } from "@camstack/types";
+import type { IReadinessRegistryRecord, SystemEvent } from "@camstack/types";
 import type { CapUsageCallRecord } from "../moleculer/cap-usage-registry.js";
 import { type CapActionReading } from "./cap-action-census.js";
 import { type CapRoutingHints } from "./cap-routing-hints.js";

package/dist/logging/log-redactor.d.ts

@@ -19,7 +19,7 @@
 * Hot path: a line with no meta, no `://`, no `--` and no registered values
 * costs a few `includes` checks.
 */
-import { type LogEntry } from "@camstack/types";
+import type { LogEntry } from "@camstack/types";
 /** True when a meta key names a credential. */
 export declare function isCredentialKeyName(key: string): boolean;
 /** Redact one free-form string. */

package/dist/{resource-monitor-B2WZ8_q9.mjs → resource-monitor-Di9daRwI.mjs}

@@ -1,5 +1,5 @@
 import { r as __exportAll } from "./chunk-CNf5ZN-e.mjs";
-import { a as parseProcStat, i as nodeProcReader, o as parseProcStatusRss, r as lifetimeCpuPercent } from "./proc-stat-CbC55Kqi.mjs";
+import { i as parseProcStatusRss, n as nodeProcReader, r as parseProcStat, t as lifetimeCpuPercent } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { platform } from "node:os";
 import { execFile } from "node:child_process";
 //#region src/process/resource-monitor.ts

package/dist/{resource-monitor-BgWGRxN5.js → resource-monitor-mio9dSCT.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
+const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 let node_os = require("node:os");
 let node_child_process = require("node:child_process");
 //#region src/process/resource-monitor.ts
@@ -22,7 +22,7 @@ function execPsForPids(pids) {
 }
 var defaultDeps = {
 	platform: (0, node_os.platform)(),
-	reader: require_proc_stat.nodeProcReader,
+	reader: require_builtins_native_metrics_native_metrics_addon.nodeProcReader,
 	spawnPs: execPsForPids
 };
 function parsePsOutput(stdout) {
@@ -52,12 +52,12 @@ async function readProcPidStats(pid, uptimeSec, reader) {
 	} catch {
 		return null;
 	}
-	const parsed = require_proc_stat.parseProcStat(stat);
+	const parsed = require_builtins_native_metrics_native_metrics_addon.parseProcStat(stat);
 	if (parsed === null) return null;
-	const rss = require_proc_stat.parseProcStatusRss(status);
+	const rss = require_builtins_native_metrics_native_metrics_addon.parseProcStatusRss(status);
 	if (rss.rssBytes === void 0) return null;
 	return {
-		cpu: require_proc_stat.lifetimeCpuPercent({
+		cpu: require_builtins_native_metrics_native_metrics_addon.lifetimeCpuPercent({
 			ticks: parsed.ticks,
 			startTicks: parsed.startTicks,
 			uptimeSec

package/dist/{restore-archive-BtKjaVua.js → restore-archive-Bq5PpQ-H.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DxiDI8hZ.js");
+const require_dist = require("./dist-DVUg8e1T.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{restore-archive-CImzbuRo.mjs → restore-archive-DVo5ooBt.mjs}

@@ -1,4 +1,4 @@
-import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-DwE9yHdk.mjs";
+import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-DlmdESNT.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{retired-settings-keys-Cl1tnkmq.js → retired-settings-keys-CihMX6h9.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DxiDI8hZ.js");
+const require_dist = require("./dist-DVUg8e1T.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-D1WsCdUY.mjs → retired-settings-keys-k_XuC-Mt.mjs}

@@ -1,4 +1,4 @@
-import { Sr as asJsonObject } from "./dist-DwE9yHdk.mjs";
+import { vr as asJsonObject } from "./dist-DlmdESNT.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{tls-C0TRPfqc.js → tls-BgImdxCO.js}

@@ -1,6 +1,7 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
 const require_x509_es = require("./x509.es-Dzl0BbmG.js");
 let node_crypto = require("node:crypto");
+let _camstack_types_node = require("@camstack/types/node");
 let node_net = require("node:net");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
@@ -594,22 +595,14 @@ async function regenerate(paths, identity, commonName, validDays, newCa) {
 	const chainPem = `${leaf.certPem.trimEnd()}\n${ca.certPem.trimEnd()}\n`;
 	if (newCa) {
 		await (0, node_fs_promises.writeFile)(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
-		await (0, node_fs_promises.writeFile)(`${paths.caKeyPath}.new`, ca.keyPem, {
-			encoding: "utf-8",
-			mode: 384
-		});
+		(0, _camstack_types_node.writeOwnerOnlyFileSync)(`${paths.caKeyPath}.new`, ca.keyPem);
 		(0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
 		(0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
-		await (0, node_fs_promises.chmod)(paths.caKeyPath, 384);
 	}
-	await (0, node_fs_promises.writeFile)(`${paths.keyPath}.new`, leaf.keyPem, {
-		encoding: "utf-8",
-		mode: 384
-	});
+	(0, _camstack_types_node.writeOwnerOnlyFileSync)(`${paths.keyPath}.new`, leaf.keyPem);
 	await (0, node_fs_promises.writeFile)(`${paths.certPath}.new`, chainPem, "utf-8");
 	(0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
 	(0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
-	await (0, node_fs_promises.chmod)(paths.keyPath, 384);
 }
 function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
 	const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
@@ -917,7 +910,7 @@ async function storeUploadedCertificate(dataDir, input) {
 	const dir = (0, node_path.join)(dataDir, "tls");
 	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
 	await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.crt"), withNewline(input.certPem));
-	await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.key"), withNewline(input.keyPem), { mode: 384 });
+	(0, _camstack_types_node.writeOwnerOnlyFileSync)((0, node_path.join)(dir, "camstack.key"), withNewline(input.keyPem));
 	const caPath = (0, node_path.join)(dir, UPLOADED_CA_FILE);
 	if (input.caPem !== void 0 && input.caPem.trim() !== "") await (0, node_fs_promises.writeFile)(caPath, withNewline(input.caPem));
 	else (0, node_fs.rmSync)(caPath, { force: true });

package/dist/{tls-D-2dPY-5.mjs → tls-CaOLZ09W.mjs}

@@ -1,7 +1,8 @@
 import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CAjSsrkk.mjs";
 import { X509Certificate, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
+import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { isIP } from "node:net";
-import { chmod, mkdir, writeFile } from "node:fs/promises";
+import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import * as os from "node:os";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
@@ -592,22 +593,14 @@ async function regenerate(paths, identity, commonName, validDays, newCa) {
 	const chainPem = `${leaf.certPem.trimEnd()}\n${ca.certPem.trimEnd()}\n`;
 	if (newCa) {
 		await writeFile(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
-		await writeFile(`${paths.caKeyPath}.new`, ca.keyPem, {
-			encoding: "utf-8",
-			mode: 384
-		});
+		writeOwnerOnlyFileSync(`${paths.caKeyPath}.new`, ca.keyPem);
 		renameSync(`${paths.caCertPath}.new`, paths.caCertPath);
 		renameSync(`${paths.caKeyPath}.new`, paths.caKeyPath);
-		await chmod(paths.caKeyPath, 384);
 	}
-	await writeFile(`${paths.keyPath}.new`, leaf.keyPem, {
-		encoding: "utf-8",
-		mode: 384
-	});
+	writeOwnerOnlyFileSync(`${paths.keyPath}.new`, leaf.keyPem);
 	await writeFile(`${paths.certPath}.new`, chainPem, "utf-8");
 	renameSync(`${paths.keyPath}.new`, paths.keyPath);
 	renameSync(`${paths.certPath}.new`, paths.certPath);
-	await chmod(paths.keyPath, 384);
 }
 function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
 	const leaf = new X509Certificate(readFileSync(paths.certPath));
@@ -915,7 +908,7 @@ async function storeUploadedCertificate(dataDir, input) {
 	const dir = join(dataDir, "tls");
 	await mkdir(dir, { recursive: true });
 	await writeFile(join(dir, "camstack.crt"), withNewline(input.certPem));
-	await writeFile(join(dir, "camstack.key"), withNewline(input.keyPem), { mode: 384 });
+	writeOwnerOnlyFileSync(join(dir, "camstack.key"), withNewline(input.keyPem));
 	const caPath = join(dir, UPLOADED_CA_FILE);
 	if (input.caPem !== void 0 && input.caPem.trim() !== "") await writeFile(caPath, withNewline(input.caPem));
 	else rmSync(caPath, { force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.416",
+  "version": "1.2.418",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -475,7 +475,7 @@
   ],
   "scripts": {
     "copy:hook": "node -e \"const fs=require('fs'),p=require('path');const dst=p.join('dist');fs.mkdirSync(dst,{recursive:true});fs.copyFileSync(p.join('src','kernel','moleculer','framework-resolver-hook.mjs'),p.join(dst,'framework-resolver-hook.mjs'));console.log('copied framework-resolver-hook.mjs ->',dst)\"",
-    "build": "vite build && npx tsx ../../scripts/emit-isolated-dts.ts --root . --src src --out dist && npm run copy:hook",
+    "build": "vite build && vite build -c vite.runner.config.ts && npx tsx ../../scripts/emit-isolated-dts.ts --root . --src src --out dist && npm run copy:hook",
     "dev": "tsup --watch",
     "typecheck": "tsc --noEmit -p tsconfig.spec.json",
     "test": "vitest run",

package/dist/amd-npu-B-QyyMyF.js

@@ -1,53 +0,0 @@
-require("./chunk-Cek0wNdY.js");
-//#region src/builtins/platform-probe/amd-npu.ts
-var ACCEL_CLASS = "/sys/class/accel";
-var ACCEL_DEV = "/dev/accel";
-var AMD_PCI_VENDOR = "0x1022";
-/** Phoenix / Hawk Point XDNA1. */
-var XDNA1_DEVICES = new Set(["0x1502"]);
-/** Strix / Krackan XDNA2. */
-var XDNA2_DEVICES = new Set(["0x17f0"]);
-function normalizePciId(raw) {
-	const t = raw.trim().toLowerCase();
-	if (t.startsWith("0x")) return t;
-	if (t.length > 0 && [...t].every((c) => "0123456789abcdef".includes(c))) return "0x" + t;
-	return t;
-}
-function hasAccelCharDevice(fsx) {
-	if (fsx.listDir(ACCEL_DEV).some((n) => n.startsWith("accel"))) return true;
-	return fsx.exists("/dev/accel/accel0");
-}
-/**
-* Detect an AMD XDNA NPU and report it as **present only**.
-*
-* Inference is NOT offered until P2 (Ryzen AI on Linux is Strix-first;
-* Phoenix is not a production path today). The probe still names the
-* generation so the UI and fleet census can show the hardware.
-*/
-function classifyAmdNpu(ctx, fsx) {
-	if (ctx.platform !== "linux" || ctx.arch !== "x64" || !ctx.amdPresent) return null;
-	if (!hasAccelCharDevice(fsx)) return null;
-	for (const name of fsx.listDir(ACCEL_CLASS)) {
-		if (!name.startsWith("accel")) continue;
-		const vendor = normalizePciId(fsx.readFile("/sys/class/accel/" + name + "/device/vendor"));
-		const device = normalizePciId(fsx.readFile("/sys/class/accel/" + name + "/device/device"));
-		if (vendor !== AMD_PCI_VENDOR) continue;
-		if (XDNA1_DEVICES.has(device)) return {
-			type: "amd-xdna",
-			name: "AMD XDNA1 NPU",
-			generation: "xdna1"
-		};
-		if (XDNA2_DEVICES.has(device)) return {
-			type: "amd-xdna",
-			name: "AMD XDNA2 NPU",
-			generation: "xdna2"
-		};
-		return {
-			type: "amd-xdna",
-			name: "AMD XDNA NPU"
-		};
-	}
-	return null;
-}
-//#endregion
-exports.classifyAmdNpu = classifyAmdNpu;

package/dist/amd-npu-Db_SoSuL.mjs

@@ -1,52 +0,0 @@
-//#region src/builtins/platform-probe/amd-npu.ts
-var ACCEL_CLASS = "/sys/class/accel";
-var ACCEL_DEV = "/dev/accel";
-var AMD_PCI_VENDOR = "0x1022";
-/** Phoenix / Hawk Point XDNA1. */
-var XDNA1_DEVICES = new Set(["0x1502"]);
-/** Strix / Krackan XDNA2. */
-var XDNA2_DEVICES = new Set(["0x17f0"]);
-function normalizePciId(raw) {
-	const t = raw.trim().toLowerCase();
-	if (t.startsWith("0x")) return t;
-	if (t.length > 0 && [...t].every((c) => "0123456789abcdef".includes(c))) return "0x" + t;
-	return t;
-}
-function hasAccelCharDevice(fsx) {
-	if (fsx.listDir(ACCEL_DEV).some((n) => n.startsWith("accel"))) return true;
-	return fsx.exists("/dev/accel/accel0");
-}
-/**
-* Detect an AMD XDNA NPU and report it as **present only**.
-*
-* Inference is NOT offered until P2 (Ryzen AI on Linux is Strix-first;
-* Phoenix is not a production path today). The probe still names the
-* generation so the UI and fleet census can show the hardware.
-*/
-function classifyAmdNpu(ctx, fsx) {
-	if (ctx.platform !== "linux" || ctx.arch !== "x64" || !ctx.amdPresent) return null;
-	if (!hasAccelCharDevice(fsx)) return null;
-	for (const name of fsx.listDir(ACCEL_CLASS)) {
-		if (!name.startsWith("accel")) continue;
-		const vendor = normalizePciId(fsx.readFile("/sys/class/accel/" + name + "/device/vendor"));
-		const device = normalizePciId(fsx.readFile("/sys/class/accel/" + name + "/device/device"));
-		if (vendor !== AMD_PCI_VENDOR) continue;
-		if (XDNA1_DEVICES.has(device)) return {
-			type: "amd-xdna",
-			name: "AMD XDNA1 NPU",
-			generation: "xdna1"
-		};
-		if (XDNA2_DEVICES.has(device)) return {
-			type: "amd-xdna",
-			name: "AMD XDNA2 NPU",
-			generation: "xdna2"
-		};
-		return {
-			type: "amd-xdna",
-			name: "AMD XDNA NPU"
-		};
-	}
-	return null;
-}
-//#endregion
-export { classifyAmdNpu };