@camstack/system 1.2.417 → 1.2.419

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { An as scopesAllowAddon, Ar as emitDownForOwnedCaps, Bt as isArrayOutputSchema, Cr as asString$1, Dn as resolveMethodAuth, Dr as createEvent$1, Gr as parseJsonUnknown, Gt as isVoidInput, Hn as supportedRuntimes, J as addonSettingsCapability, Jr as resolveCapMount, Kt as kebabToCamel$1, L as RUNTIME_DEFAULTS, M as METHOD_ACCESS_MAP, Mr as expandCapMethods, Nt as extractNestedAddonId, Sr as asNumber, Vt as isCollectionArrayMethod, Wr as parseJsonObject, Wt as isObjectInput, Xr as scopeKey, Zt as lifecycleJobSchema, _n as procedureAuthKey, _r as ReadinessRegistry, dn as objectInputDeclaresAddonId, dr as errMsg$1, fn as objectInputDeclaresRequiredDeviceId, hr as DEVICE_STATUS_METHOD, jn as scopesAllowDeviceCap, k as LOG_LEVEL_RANK, mr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, nn as looseSchema, pr as DATAPLANE_SECRET_HEADER$1, qr as readinessKey, ri as EventCategory$1, t as ALL_CAPABILITY_DEFINITIONS, tn as logLevelAtMost, vr as ReadinessTimeoutError, xr as asJsonObject$1 } from "./dist-H_RapIeM.mjs";
-import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-xQxqpwMC.mjs";
+import { At as extractNestedAddonId, Bt as isObjectInput, Cn as resolveMethodAuth, Dn as scopesAllowDeviceCap, Dr as emitDownForOwnedCaps, En as scopesAllowAddon, G as addonSettingsCapability, Gr as resolveCapMount, Hr as parseJsonUnknown, Ht as kebabToCamel$1, It as isArrayOutputSchema, Lt as isCollectionArrayMethod, O as LOG_LEVEL_RANK, Qt as looseSchema, Rn as supportedRuntimes, Vr as parseJsonObject, Vt as isVoidInput, Wr as readinessKey, Zt as logLevelAtMost, br as asString$1, cn as objectInputDeclaresRequiredDeviceId, dr as DEVICE_STATUS_METHOD, ei as EventCategory$1, hr as ReadinessTimeoutError, j as METHOD_ACCESS_MAP, kr as expandCapMethods, lr as DATAPLANE_SECRET_HEADER$1, mr as ReadinessRegistry, pn as procedureAuthKey, pr as RUNTIME_DEFAULTS, qr as scopeKey, qt as lifecycleJobSchema, sn as objectInputDeclaresAddonId, sr as errMsg$1, t as ALL_CAPABILITY_DEFINITIONS, ur as DEVICE_SETTINGS_CONTRIBUTION_METHODS, vr as asJsonObject$1, wr as createEvent$1, yr as asNumber } from "./dist-C0wYvAHC.mjs";
+import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-dkTVfsLI.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -25,15 +25,15 @@ import { SqliteSettingsAddon, o as SqliteSettingsBackend, s as prefixRange } fro
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-BzxwnfDc.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-BeQWXybC.mjs";
 import { A as AGENT_UI_UNLOCK_VERSION, B as parseMeshAuthMode, C as generateMeshKeyPair, D as AGENT_DASHBOARD_ORIGINS_FIELD, E as loadMeshCa, F as verifyAgentUiUnlockTicket, G as createCidrMatcher, H as setProcessMeshAuthMode, I as MESH_AUTH_MODE_FIELD, J as readCidrSetting, K as normalizeIp, L as getProcessMeshAuthMode, M as isAllowedAgentDashboardReturnTo, N as mintAgentUiUnlockTicket, O as AGENT_UI_UNLOCK_DOMAIN, P as parseAgentDashboardOrigins, R as getProcessMeshAuthStatus, S as generateMeshCa, SystemConfigAddon, T as issueMeshLeafFromCsr, U as setProcessMeshAuthStatusSource, V as requestProcessMeshEnforcement, W as setProcessMeshEnforcer, _ as requireProcessMeshCa, a as setProcessMeshTlsEnabler, b as createMeshCsrPem, c as mintMeshJoinToken, d as getProcessNodeMeshTransport, f as setProcessMeshPeerTransportLookup, g as getProcessMeshCaState, h as MeshCaKeeper, i as ServiceBroker, j as UnlockTicketJtiStore, k as AGENT_UI_UNLOCK_TTL_MS, l as processJoinTokenJtiStore, m as processMeshCrl, n as TlsTcpTransporter, o as enrollMeshNode, p as MeshCrl, q as parseCidrList, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as caFingerprint, w as issueMeshLeafForNode, x as exportMeshPrivateKeyPem, y as caFingerprintCompact, z as isMeshAuthMode } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
-import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-DHv0kYcT.mjs";
-import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-D-2dPY-5.mjs";
+import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BQnbN0DP.mjs";
+import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-CaOLZ09W.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-CCAQicV-.mjs";
+import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-gGHgAZsz.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -51,12 +51,12 @@ import { execFile, spawn } from "node:child_process";
 import * as util from "node:util";
 import { promisify } from "node:util";
 import { once } from "node:events";
+import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry as ReadinessRegistry$1, asJsonObject, asString, collectZodSecretPaths, createDeviceProxy, createEvent, createEventBusSliceSource, createSecretsAccess, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods as expandCapMethods$1, maskUrlCredentials, readNodePin, scopeKey as scopeKey$1, scrubKnownSecrets, sleep, withCapInputDefaults } from "@camstack/types/addon";
 import { createServer as createServer$1, request } from "node:http";
 import * as v8 from "node:v8";
 import { Session } from "node:inspector/promises";
 import { monitorEventLoopDelay } from "node:perf_hooks";
 import * as vm from "node:vm";
-import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry as ReadinessRegistry$1, asJsonObject, asString, collectZodSecretPaths, createDeviceProxy, createEvent, createEventBusSliceSource, createSecretsAccess, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods as expandCapMethods$1, maskUrlCredentials, readNodePin, scopeKey as scopeKey$1, scrubKnownSecrets, sleep, withCapInputDefaults } from "@camstack/types/addon";
 import { TRPCClientError, createTRPCClient } from "@trpc/client";
 //#region src/addon/addon-api-factory.ts
 /**
@@ -24062,6 +24062,8 @@ function stripForgedIdentity(action, params) {
 	}
 	return withoutIdentity(params);
 }
+/** Minimum gap between two "mesh event refused" lines for one sender. */
+var DROPPED_EVENT_LOG_INTERVAL_MS = 6e4;
 function senderOf(ctx) {
 	const nodeID = ctx.nodeID;
 	return typeof nodeID === "string" && nodeID.length > 0 ? nodeID : null;
@@ -24075,6 +24077,29 @@ function paramNodeId(params) {
 */
 function createMeshAccessMiddleware(options) {
 	const { ownNodeId, authenticator, logger } = options;
+	const dropped = /* @__PURE__ */ new Map();
+	const noteDroppedEvent = (sender, eventName) => {
+		const now = Date.now();
+		const entry = dropped.get(sender) ?? {
+			lastLogAt: 0,
+			count: 0
+		};
+		const count = entry.count + 1;
+		if (now - entry.lastLogAt >= DROPPED_EVENT_LOG_INTERVAL_MS) {
+			logger?.warn("mesh event refused", {
+				sender,
+				event: eventName,
+				droppedSinceLastLog: count
+			});
+			dropped.set(sender, {
+				lastLogAt: now,
+				count: 0
+			});
+		} else dropped.set(sender, {
+			lastLogAt: entry.lastLogAt,
+			count
+		});
+	};
 	return {
 		name: "CamstackMeshAccess",
 		localAction(next, action) {
@@ -24100,9 +24125,12 @@ function createMeshAccessMiddleware(options) {
 			const name = event.name ?? "";
 			return function meshGatedEvent(ctx) {
 				const sender = senderOf(ctx);
-				if (sender === null || sender === ownNodeId) return next.call(this, ctx);
-				if (authenticator.admitEvent(sender, name).verdict === "deny") return void 0;
-				return next.call(this, ctx);
+				if (sender === null || sender === ownNodeId) return Promise.resolve(next.call(this, ctx));
+				if (authenticator.admitEvent(sender, name).verdict === "deny") {
+					noteDroppedEvent(sender, name);
+					return Promise.resolve();
+				}
+				return Promise.resolve(next.call(this, ctx));
 			};
 		}
 	};

package/dist/{jwt-signing-key-BiKHENST.js → jwt-signing-key-CWmNKLQi.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BMOD9OyH.js");
+const require_dist = require("./dist-DLHPmdoV.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{jwt-signing-key-xQxqpwMC.mjs → jwt-signing-key-dkTVfsLI.mjs}

@@ -1,4 +1,4 @@
-import { wr as buildSecretRef } from "./dist-H_RapIeM.mjs";
+import { xr as buildSecretRef } from "./dist-C0wYvAHC.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{restore-archive-BobsETEp.js → restore-archive-DZeFVS2l.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BMOD9OyH.js");
+const require_dist = require("./dist-DLHPmdoV.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");