@camstack/system 1.2.427 → 1.2.429

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
-const require_tls = require("../../tls-BgImdxCO.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
+const require_tls = require("../../tls-C5IYg3V5.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,6 +1,6 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { D as HUB_MDNS_TXT_KEYS, E as HUB_MDNS_SERVICE_TYPE, Hn as validateCustomAddress, It as isAppLinkBase, Sn as resolveHubAddressRoles, Tn as resolveNotificationTapAddress, Yt as localNetworkCapability, dn as pickAppLinkHub, lr as BaseAddon, rt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, ti as EventCategory, vn as resolveAppConnections, zt as isDefaultAppConnectionEndpoint } from "../../dist-DHSJV4Qc.mjs";
-import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-CaOLZ09W.mjs";
+import { A as HUB_MDNS_SERVICE_TYPE, An as resolveHubAddressRoles, En as resolveAppConnections, Nn as resolveNotificationTapAddress, Wt as isAppLinkBase, Xn as validateCustomAddress, _r as BaseAddon, j as HUB_MDNS_TXT_KEYS, li as EventCategory, lt as checkRoleAddress, qt as isDefaultAppConnectionEndpoint, rn as localNetworkCapability, s as CAMSTACK_APP_LINK_ORIGIN, yn as pickAppLinkHub } from "../../dist-CSSfTM18.mjs";
+import { A as readTlsMode, G as DEFAULT_LAN_HTTP_PORT, M as writeExtraSans, O as readExtraSans, P as ensureTlsCert, T as servedHttpsLeafFingerprint, X as readLanHttpState, _ as regenerateCertificate, g as applyCertificateToListener, k as readTlsAccessStatus, q as applyLanHttp, v as revertToGeneratedCertificate, y as storeUploadedCertificate } from "../../tls-CpcGkeJV.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-DHSJV4Qc.mjs";
+import { _r as BaseAddon, an as logDestinationCapability } from "../../dist-CSSfTM18.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Nt as foldSnapshotByFunction, Tr as createEvent, cr as errMsg, gn as reducePoints, lr as BaseAddon, rn as metricsProviderCapability, ti as EventCategory, yn as resolveBucketMs } from "../../dist-DHSJV4Qc.mjs";
+import { Bt as foldSnapshotByFunction, Dn as resolveBucketMs, Nr as createEvent, _r as BaseAddon, dn as metricsProviderCapability, gr as errMsg, li as EventCategory, wn as reducePoints } from "../../dist-CSSfTM18.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";
 import { platform } from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { cr as errMsg, kn as scoreRuntimes, kr as emitReadiness, lr as BaseAddon, pn as platformProbeCapability, ti as EventCategory, wt as enumerateInferenceDevices } from "../../dist-DHSJV4Qc.mjs";
+import { Ln as scoreRuntimes, Lr as emitReadiness, _r as BaseAddon, gr as errMsg, jt as enumerateInferenceDevices, li as EventCategory, xn as platformProbeCapability } from "../../dist-CSSfTM18.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { lr as BaseAddon, ti as EventCategory } from "../../dist-DHSJV4Qc.mjs";
+import { _r as BaseAddon, li as EventCategory } from "../../dist-CSSfTM18.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Br as nodePin, Mn as snapshotCapability, Rn as streamQualityLabel, X as bareAddonId, Z as batteryCapability, a as BatteryStatusSchema, ar as DeviceFeature, cr as errMsg, lr as BaseAddon, nn as memoizePinnedFfmpeg, sr as DeviceType, ti as EventCategory, vt as deriveBatteryPresence } from "../../dist-DHSJV4Qc.mjs";
+import { Bn as snapshotCapability, Jr as nodePin, Kn as streamQualityLabel, _r as BaseAddon, a as BatteryStatusSchema, et as bareAddonId, gr as errMsg, hr as DeviceType, li as EventCategory, pr as DeviceFeature, tt as batteryCapability, un as memoizePinnedFfmpeg, wt as deriveBatteryPresence } from "../../dist-CSSfTM18.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { In as storageProviderCapability, Mt as filesystemBrowseCapability, lr as BaseAddon } from "../../dist-DHSJV4Qc.mjs";
+import { Wn as storageProviderCapability, _r as BaseAddon, zt as filesystemBrowseCapability } from "../../dist-CSSfTM18.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-DItkuOvu.js");
+const require_wal_maintenance = require("../../wal-maintenance-BSGsxKW7.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-Drqhcjit.mjs";
+import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-DW0FfGV7.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-BfGaSeQI.js");
-const require_wal_maintenance = require("../../wal-maintenance-DItkuOvu.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-BTPkRLTS.js");
+const require_wal_maintenance = require("../../wal-maintenance-BSGsxKW7.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { Gn as vectorStoreCapability, X as bareAddonId, _ as DATABASE_SNAPSHOT_TIMEOUT_MS, cr as errMsg, g as DATABASE_SNAPSHOT_SUFFIX, h as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, lr as BaseAddon, mr as RUNTIME_DEFAULTS, mt as databaseSnapshotCapability, pt as dataStoreProviderCapability, v as DATA_STORE_DATABASES } from "../../dist-DHSJV4Qc.mjs";
-import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-CPz7zpza.mjs";
-import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-Drqhcjit.mjs";
+import { $n as vectorStoreCapability, Sr as RUNTIME_DEFAULTS, _ as DATABASE_SNAPSHOT_TIMEOUT_MS, _r as BaseAddon, bt as databaseSnapshotCapability, et as bareAddonId, g as DATABASE_SNAPSHOT_SUFFIX, gr as errMsg, h as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, v as DATA_STORE_DATABASES, yt as dataStoreProviderCapability } from "../../dist-CSSfTM18.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-H0rYXT27.mjs";
+import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-DW0FfGV7.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { A as LegacyStorageLocationDefaultSchema, An as settingsStoreCapability, B as StorageLocationModeSchema, Bt as isLocationEnabled, Cn as resolveLocationMode, Cr as collectSecretConfigKeys, Ft as gbToBytes, H as StorageMigrationJobSchema, Hr as parseJsonObject, Kn as withLocationMode, Lr as isSecretMarker, Nn as storageCapability, Ot as evictionPolicyOfLocation, Pn as storageMigrationCapability, V as StorageLocationTypeSchema, Yr as secretTreeFromPaths, ei as transformSecretWrite, en as mayReadLocation, in as modeMayWrite, lr as BaseAddon, pr as REDACTED_SECRET, qr as resolveSecretMarkers, qt as legacyModeOf, ti as EventCategory, tn as mayWriteToLocation, z as StorageCleanupJobSchema } from "../../dist-DHSJV4Qc.mjs";
+import { Ft as evictionPolicyOfLocation, G as StorageLocationTypeSchema, Gr as isSecretMarker, Hn as storageMigrationCapability, Jt as isLocationEnabled, K as StorageMigrationJobSchema, P as LegacyStorageLocationDefaultSchema, Rn as settingsStoreCapability, U as StorageCleanupJobSchema, Ut as gbToBytes, Vn as storageCapability, W as StorageLocationModeSchema, Xr as parseJsonObject, _r as BaseAddon, ci as transformSecretWrite, cn as mayReadLocation, er as withLocationMode, fn as modeMayWrite, jn as resolveLocationMode, jr as collectSecretConfigKeys, li as EventCategory, ln as mayWriteToLocation, ri as secretTreeFromPaths, ti as resolveSecretMarkers, tn as legacyModeOf, xr as REDACTED_SECRET } from "../../dist-CSSfTM18.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -7,9 +7,27 @@ export declare class SystemConfigAddon extends BaseAddon {
 	readonly id = "system-config";
 	private clusterSecretKeeper;
 	private meshCaKeeper;
+	private meshReapTimer;
+	private readonly meshGateTimers;
+	private stoppedMesh;
+	private loggedNoSettingsStore;
 	constructor();
 	protected onInitialize(): Promise<AddonInitResult<typeof systemConfigMeshActions>>;
 	protected onShutdown(): Promise<void>;
+	/**
+	* The hub's record of mesh leaves (D856): declared and loaded BEFORE the TLS
+	* listener opens, so persisted revocations are in the CRL before any node can
+	* connect. Best effort: a hub whose settings store is not up still serves the
+	* mesh (the registry then fills from the leaves nodes present).
+	*/
+	private initMeshCertificateRegistry;
+	/** Which names the hub certified to which agent. Best effort; nothing waits on it. */
+	private loadAgentHttpsNames;
+	/**
+	* The mesh TLS listener opens ONLY after the revocation registry has loaded and its
+	* revocations are in the CRL (D856): until then every agent is refused, because an
+	* empty CRL would accept a revoked leaf. Retries until the settings store answers.
+	*/
 	private onMeshCaReady;
 	private mintJoinToken;
 	/** D821 — short-lived ticket for the agent's `:4444` unlock session. */