@camstack/system 1.2.417 → 1.2.418

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { An as scopesAllowAddon, Ar as emitDownForOwnedCaps, Bt as isArrayOutputSchema, Cr as asString$1, Dn as resolveMethodAuth, Dr as createEvent$1, Gr as parseJsonUnknown, Gt as isVoidInput, Hn as supportedRuntimes, J as addonSettingsCapability, Jr as resolveCapMount, Kt as kebabToCamel$1, L as RUNTIME_DEFAULTS, M as METHOD_ACCESS_MAP, Mr as expandCapMethods, Nt as extractNestedAddonId, Sr as asNumber, Vt as isCollectionArrayMethod, Wr as parseJsonObject, Wt as isObjectInput, Xr as scopeKey, Zt as lifecycleJobSchema, _n as procedureAuthKey, _r as ReadinessRegistry, dn as objectInputDeclaresAddonId, dr as errMsg$1, fn as objectInputDeclaresRequiredDeviceId, hr as DEVICE_STATUS_METHOD, jn as scopesAllowDeviceCap, k as LOG_LEVEL_RANK, mr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, nn as looseSchema, pr as DATAPLANE_SECRET_HEADER$1, qr as readinessKey, ri as EventCategory$1, t as ALL_CAPABILITY_DEFINITIONS, tn as logLevelAtMost, vr as ReadinessTimeoutError, xr as asJsonObject$1 } from "./dist-H_RapIeM.mjs";
-import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-xQxqpwMC.mjs";
+import { At as extractNestedAddonId, Bt as isObjectInput, Cn as resolveMethodAuth, Dn as scopesAllowDeviceCap, Dr as emitDownForOwnedCaps, En as scopesAllowAddon, G as addonSettingsCapability, Gr as resolveCapMount, Hr as parseJsonUnknown, Ht as kebabToCamel$1, It as isArrayOutputSchema, Lt as isCollectionArrayMethod, O as LOG_LEVEL_RANK, Qt as looseSchema, Rn as supportedRuntimes, Vr as parseJsonObject, Vt as isVoidInput, Wr as readinessKey, Zt as logLevelAtMost, br as asString$1, cn as objectInputDeclaresRequiredDeviceId, dr as DEVICE_STATUS_METHOD, ei as EventCategory$1, hr as ReadinessTimeoutError, j as METHOD_ACCESS_MAP, kr as expandCapMethods, lr as DATAPLANE_SECRET_HEADER$1, mr as ReadinessRegistry, pn as procedureAuthKey, pr as RUNTIME_DEFAULTS, qr as scopeKey, qt as lifecycleJobSchema, sn as objectInputDeclaresAddonId, sr as errMsg$1, t as ALL_CAPABILITY_DEFINITIONS, ur as DEVICE_SETTINGS_CONTRIBUTION_METHODS, vr as asJsonObject$1, wr as createEvent$1, yr as asNumber } from "./dist-DlmdESNT.mjs";
+import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-CGg61A5v.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -25,15 +25,15 @@ import { SqliteSettingsAddon, o as SqliteSettingsBackend, s as prefixRange } fro
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-BzxwnfDc.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-C8T7u1_Z.mjs";
 import { A as AGENT_UI_UNLOCK_VERSION, B as parseMeshAuthMode, C as generateMeshKeyPair, D as AGENT_DASHBOARD_ORIGINS_FIELD, E as loadMeshCa, F as verifyAgentUiUnlockTicket, G as createCidrMatcher, H as setProcessMeshAuthMode, I as MESH_AUTH_MODE_FIELD, J as readCidrSetting, K as normalizeIp, L as getProcessMeshAuthMode, M as isAllowedAgentDashboardReturnTo, N as mintAgentUiUnlockTicket, O as AGENT_UI_UNLOCK_DOMAIN, P as parseAgentDashboardOrigins, R as getProcessMeshAuthStatus, S as generateMeshCa, SystemConfigAddon, T as issueMeshLeafFromCsr, U as setProcessMeshAuthStatusSource, V as requestProcessMeshEnforcement, W as setProcessMeshEnforcer, _ as requireProcessMeshCa, a as setProcessMeshTlsEnabler, b as createMeshCsrPem, c as mintMeshJoinToken, d as getProcessNodeMeshTransport, f as setProcessMeshPeerTransportLookup, g as getProcessMeshCaState, h as MeshCaKeeper, i as ServiceBroker, j as UnlockTicketJtiStore, k as AGENT_UI_UNLOCK_TTL_MS, l as processJoinTokenJtiStore, m as processMeshCrl, n as TlsTcpTransporter, o as enrollMeshNode, p as MeshCrl, q as parseCidrList, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as caFingerprint, w as issueMeshLeafForNode, x as exportMeshPrivateKeyPem, y as caFingerprintCompact, z as isMeshAuthMode } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
-import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-DHv0kYcT.mjs";
-import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-D-2dPY-5.mjs";
+import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BQnbN0DP.mjs";
+import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-CaOLZ09W.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-CCAQicV-.mjs";
+import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-DVo5ooBt.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -51,12 +51,12 @@ import { execFile, spawn } from "node:child_process";
 import * as util from "node:util";
 import { promisify } from "node:util";
 import { once } from "node:events";
+import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry as ReadinessRegistry$1, asJsonObject, asString, collectZodSecretPaths, createDeviceProxy, createEvent, createEventBusSliceSource, createSecretsAccess, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods as expandCapMethods$1, maskUrlCredentials, readNodePin, scopeKey as scopeKey$1, scrubKnownSecrets, sleep, withCapInputDefaults } from "@camstack/types/addon";
 import { createServer as createServer$1, request } from "node:http";
 import * as v8 from "node:v8";
 import { Session } from "node:inspector/promises";
 import { monitorEventLoopDelay } from "node:perf_hooks";
 import * as vm from "node:vm";
-import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry as ReadinessRegistry$1, asJsonObject, asString, collectZodSecretPaths, createDeviceProxy, createEvent, createEventBusSliceSource, createSecretsAccess, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods as expandCapMethods$1, maskUrlCredentials, readNodePin, scopeKey as scopeKey$1, scrubKnownSecrets, sleep, withCapInputDefaults } from "@camstack/types/addon";
 import { TRPCClientError, createTRPCClient } from "@trpc/client";
 //#region src/addon/addon-api-factory.ts
 /**
@@ -24062,6 +24062,8 @@ function stripForgedIdentity(action, params) {
 	}
 	return withoutIdentity(params);
 }
+/** Minimum gap between two "mesh event refused" lines for one sender. */
+var DROPPED_EVENT_LOG_INTERVAL_MS = 6e4;
 function senderOf(ctx) {
 	const nodeID = ctx.nodeID;
 	return typeof nodeID === "string" && nodeID.length > 0 ? nodeID : null;
@@ -24075,6 +24077,29 @@ function paramNodeId(params) {
 */
 function createMeshAccessMiddleware(options) {
 	const { ownNodeId, authenticator, logger } = options;
+	const dropped = /* @__PURE__ */ new Map();
+	const noteDroppedEvent = (sender, eventName) => {
+		const now = Date.now();
+		const entry = dropped.get(sender) ?? {
+			lastLogAt: 0,
+			count: 0
+		};
+		const count = entry.count + 1;
+		if (now - entry.lastLogAt >= DROPPED_EVENT_LOG_INTERVAL_MS) {
+			logger?.warn("mesh event refused", {
+				sender,
+				event: eventName,
+				droppedSinceLastLog: count
+			});
+			dropped.set(sender, {
+				lastLogAt: now,
+				count: 0
+			});
+		} else dropped.set(sender, {
+			lastLogAt: entry.lastLogAt,
+			count
+		});
+	};
 	return {
 		name: "CamstackMeshAccess",
 		localAction(next, action) {
@@ -24100,9 +24125,12 @@ function createMeshAccessMiddleware(options) {
 			const name = event.name ?? "";
 			return function meshGatedEvent(ctx) {
 				const sender = senderOf(ctx);
-				if (sender === null || sender === ownNodeId) return next.call(this, ctx);
-				if (authenticator.admitEvent(sender, name).verdict === "deny") return void 0;
-				return next.call(this, ctx);
+				if (sender === null || sender === ownNodeId) return Promise.resolve(next.call(this, ctx));
+				if (authenticator.admitEvent(sender, name).verdict === "deny") {
+					noteDroppedEvent(sender, name);
+					return Promise.resolve();
+				}
+				return Promise.resolve(next.call(this, ctx));
 			};
 		}
 	};

package/dist/{jwt-signing-key-xQxqpwMC.mjs → jwt-signing-key-CGg61A5v.mjs}

@@ -1,4 +1,4 @@
-import { wr as buildSecretRef } from "./dist-H_RapIeM.mjs";
+import { xr as buildSecretRef } from "./dist-DlmdESNT.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{jwt-signing-key-BiKHENST.js → jwt-signing-key-Jyu81jZR.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BMOD9OyH.js");
+const require_dist = require("./dist-DVUg8e1T.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{restore-archive-BobsETEp.js → restore-archive-Bq5PpQ-H.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BMOD9OyH.js");
+const require_dist = require("./dist-DVUg8e1T.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{restore-archive-CCAQicV-.mjs → restore-archive-DVo5ooBt.mjs}

@@ -1,4 +1,4 @@
-import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-H_RapIeM.mjs";
+import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-DlmdESNT.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{retired-settings-keys-BMq2u4Wv.js → retired-settings-keys-CihMX6h9.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BMOD9OyH.js");
+const require_dist = require("./dist-DVUg8e1T.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-CwL4zHLg.mjs → retired-settings-keys-k_XuC-Mt.mjs}

@@ -1,4 +1,4 @@
-import { xr as asJsonObject } from "./dist-H_RapIeM.mjs";
+import { vr as asJsonObject } from "./dist-DlmdESNT.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{tls-C0TRPfqc.js → tls-BgImdxCO.js}

@@ -1,6 +1,7 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
 const require_x509_es = require("./x509.es-Dzl0BbmG.js");
 let node_crypto = require("node:crypto");
+let _camstack_types_node = require("@camstack/types/node");
 let node_net = require("node:net");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
@@ -594,22 +595,14 @@ async function regenerate(paths, identity, commonName, validDays, newCa) {
 	const chainPem = `${leaf.certPem.trimEnd()}\n${ca.certPem.trimEnd()}\n`;
 	if (newCa) {
 		await (0, node_fs_promises.writeFile)(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
-		await (0, node_fs_promises.writeFile)(`${paths.caKeyPath}.new`, ca.keyPem, {
-			encoding: "utf-8",
-			mode: 384
-		});
+		(0, _camstack_types_node.writeOwnerOnlyFileSync)(`${paths.caKeyPath}.new`, ca.keyPem);
 		(0, node_fs.renameSync)(`${paths.caCertPath}.new`, paths.caCertPath);
 		(0, node_fs.renameSync)(`${paths.caKeyPath}.new`, paths.caKeyPath);
-		await (0, node_fs_promises.chmod)(paths.caKeyPath, 384);
 	}
-	await (0, node_fs_promises.writeFile)(`${paths.keyPath}.new`, leaf.keyPem, {
-		encoding: "utf-8",
-		mode: 384
-	});
+	(0, _camstack_types_node.writeOwnerOnlyFileSync)(`${paths.keyPath}.new`, leaf.keyPem);
 	await (0, node_fs_promises.writeFile)(`${paths.certPath}.new`, chainPem, "utf-8");
 	(0, node_fs.renameSync)(`${paths.keyPath}.new`, paths.keyPath);
 	(0, node_fs.renameSync)(`${paths.certPath}.new`, paths.certPath);
-	await (0, node_fs_promises.chmod)(paths.keyPath, 384);
 }
 function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
 	const leaf = new node_crypto.X509Certificate((0, node_fs.readFileSync)(paths.certPath));
@@ -917,7 +910,7 @@ async function storeUploadedCertificate(dataDir, input) {
 	const dir = (0, node_path.join)(dataDir, "tls");
 	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
 	await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.crt"), withNewline(input.certPem));
-	await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, "camstack.key"), withNewline(input.keyPem), { mode: 384 });
+	(0, _camstack_types_node.writeOwnerOnlyFileSync)((0, node_path.join)(dir, "camstack.key"), withNewline(input.keyPem));
 	const caPath = (0, node_path.join)(dir, UPLOADED_CA_FILE);
 	if (input.caPem !== void 0 && input.caPem.trim() !== "") await (0, node_fs_promises.writeFile)(caPath, withNewline(input.caPem));
 	else (0, node_fs.rmSync)(caPath, { force: true });

package/dist/{tls-D-2dPY-5.mjs → tls-CaOLZ09W.mjs}

@@ -1,7 +1,8 @@
 import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CAjSsrkk.mjs";
 import { X509Certificate, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
+import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { isIP } from "node:net";
-import { chmod, mkdir, writeFile } from "node:fs/promises";
+import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import * as os from "node:os";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
@@ -592,22 +593,14 @@ async function regenerate(paths, identity, commonName, validDays, newCa) {
 	const chainPem = `${leaf.certPem.trimEnd()}\n${ca.certPem.trimEnd()}\n`;
 	if (newCa) {
 		await writeFile(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
-		await writeFile(`${paths.caKeyPath}.new`, ca.keyPem, {
-			encoding: "utf-8",
-			mode: 384
-		});
+		writeOwnerOnlyFileSync(`${paths.caKeyPath}.new`, ca.keyPem);
 		renameSync(`${paths.caCertPath}.new`, paths.caCertPath);
 		renameSync(`${paths.caKeyPath}.new`, paths.caKeyPath);
-		await chmod(paths.caKeyPath, 384);
 	}
-	await writeFile(`${paths.keyPath}.new`, leaf.keyPem, {
-		encoding: "utf-8",
-		mode: 384
-	});
+	writeOwnerOnlyFileSync(`${paths.keyPath}.new`, leaf.keyPem);
 	await writeFile(`${paths.certPath}.new`, chainPem, "utf-8");
 	renameSync(`${paths.keyPath}.new`, paths.keyPath);
 	renameSync(`${paths.certPath}.new`, paths.certPath);
-	await chmod(paths.keyPath, 384);
 }
 function describe(paths, generated, reason, caRotated, previousFingerprintSha256, reissueError) {
 	const leaf = new X509Certificate(readFileSync(paths.certPath));
@@ -915,7 +908,7 @@ async function storeUploadedCertificate(dataDir, input) {
 	const dir = join(dataDir, "tls");
 	await mkdir(dir, { recursive: true });
 	await writeFile(join(dir, "camstack.crt"), withNewline(input.certPem));
-	await writeFile(join(dir, "camstack.key"), withNewline(input.keyPem), { mode: 384 });
+	writeOwnerOnlyFileSync(join(dir, "camstack.key"), withNewline(input.keyPem));
 	const caPath = join(dir, UPLOADED_CA_FILE);
 	if (input.caPem !== void 0 && input.caPem.trim() !== "") await writeFile(caPath, withNewline(input.caPem));
 	else rmSync(caPath, { force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.417",
+  "version": "1.2.418",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",

package/dist/amd-npu-B-QyyMyF.js

@@ -1,53 +0,0 @@
-require("./chunk-Cek0wNdY.js");
-//#region src/builtins/platform-probe/amd-npu.ts
-var ACCEL_CLASS = "/sys/class/accel";
-var ACCEL_DEV = "/dev/accel";
-var AMD_PCI_VENDOR = "0x1022";
-/** Phoenix / Hawk Point XDNA1. */
-var XDNA1_DEVICES = new Set(["0x1502"]);
-/** Strix / Krackan XDNA2. */
-var XDNA2_DEVICES = new Set(["0x17f0"]);
-function normalizePciId(raw) {
-	const t = raw.trim().toLowerCase();
-	if (t.startsWith("0x")) return t;
-	if (t.length > 0 && [...t].every((c) => "0123456789abcdef".includes(c))) return "0x" + t;
-	return t;
-}
-function hasAccelCharDevice(fsx) {
-	if (fsx.listDir(ACCEL_DEV).some((n) => n.startsWith("accel"))) return true;
-	return fsx.exists("/dev/accel/accel0");
-}
-/**
-* Detect an AMD XDNA NPU and report it as **present only**.
-*
-* Inference is NOT offered until P2 (Ryzen AI on Linux is Strix-first;
-* Phoenix is not a production path today). The probe still names the
-* generation so the UI and fleet census can show the hardware.
-*/
-function classifyAmdNpu(ctx, fsx) {
-	if (ctx.platform !== "linux" || ctx.arch !== "x64" || !ctx.amdPresent) return null;
-	if (!hasAccelCharDevice(fsx)) return null;
-	for (const name of fsx.listDir(ACCEL_CLASS)) {
-		if (!name.startsWith("accel")) continue;
-		const vendor = normalizePciId(fsx.readFile("/sys/class/accel/" + name + "/device/vendor"));
-		const device = normalizePciId(fsx.readFile("/sys/class/accel/" + name + "/device/device"));
-		if (vendor !== AMD_PCI_VENDOR) continue;
-		if (XDNA1_DEVICES.has(device)) return {
-			type: "amd-xdna",
-			name: "AMD XDNA1 NPU",
-			generation: "xdna1"
-		};
-		if (XDNA2_DEVICES.has(device)) return {
-			type: "amd-xdna",
-			name: "AMD XDNA2 NPU",
-			generation: "xdna2"
-		};
-		return {
-			type: "amd-xdna",
-			name: "AMD XDNA NPU"
-		};
-	}
-	return null;
-}
-//#endregion
-exports.classifyAmdNpu = classifyAmdNpu;

package/dist/amd-npu-Db_SoSuL.mjs

@@ -1,52 +0,0 @@
-//#region src/builtins/platform-probe/amd-npu.ts
-var ACCEL_CLASS = "/sys/class/accel";
-var ACCEL_DEV = "/dev/accel";
-var AMD_PCI_VENDOR = "0x1022";
-/** Phoenix / Hawk Point XDNA1. */
-var XDNA1_DEVICES = new Set(["0x1502"]);
-/** Strix / Krackan XDNA2. */
-var XDNA2_DEVICES = new Set(["0x17f0"]);
-function normalizePciId(raw) {
-	const t = raw.trim().toLowerCase();
-	if (t.startsWith("0x")) return t;
-	if (t.length > 0 && [...t].every((c) => "0123456789abcdef".includes(c))) return "0x" + t;
-	return t;
-}
-function hasAccelCharDevice(fsx) {
-	if (fsx.listDir(ACCEL_DEV).some((n) => n.startsWith("accel"))) return true;
-	return fsx.exists("/dev/accel/accel0");
-}
-/**
-* Detect an AMD XDNA NPU and report it as **present only**.
-*
-* Inference is NOT offered until P2 (Ryzen AI on Linux is Strix-first;
-* Phoenix is not a production path today). The probe still names the
-* generation so the UI and fleet census can show the hardware.
-*/
-function classifyAmdNpu(ctx, fsx) {
-	if (ctx.platform !== "linux" || ctx.arch !== "x64" || !ctx.amdPresent) return null;
-	if (!hasAccelCharDevice(fsx)) return null;
-	for (const name of fsx.listDir(ACCEL_CLASS)) {
-		if (!name.startsWith("accel")) continue;
-		const vendor = normalizePciId(fsx.readFile("/sys/class/accel/" + name + "/device/vendor"));
-		const device = normalizePciId(fsx.readFile("/sys/class/accel/" + name + "/device/device"));
-		if (vendor !== AMD_PCI_VENDOR) continue;
-		if (XDNA1_DEVICES.has(device)) return {
-			type: "amd-xdna",
-			name: "AMD XDNA1 NPU",
-			generation: "xdna1"
-		};
-		if (XDNA2_DEVICES.has(device)) return {
-			type: "amd-xdna",
-			name: "AMD XDNA2 NPU",
-			generation: "xdna2"
-		};
-		return {
-			type: "amd-xdna",
-			name: "AMD XDNA NPU"
-		};
-	}
-	return null;
-}
-//#endregion
-export { classifyAmdNpu };