@camstack/system 1.2.428 → 1.2.430

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
-const require_tls = require("../../tls-BgImdxCO.js");
+const require_dist = require("../../dist-DxJdci75.js");
+const require_tls = require("../../tls-C5IYg3V5.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,6 +1,6 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { D as HUB_MDNS_TXT_KEYS, E as HUB_MDNS_SERVICE_TYPE, Hn as validateCustomAddress, It as isAppLinkBase, Sn as resolveHubAddressRoles, Tn as resolveNotificationTapAddress, Yt as localNetworkCapability, dn as pickAppLinkHub, lr as BaseAddon, rt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, ti as EventCategory, vn as resolveAppConnections, zt as isDefaultAppConnectionEndpoint } from "../../dist-DHSJV4Qc.mjs";
-import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-CaOLZ09W.mjs";
+import { A as HUB_MDNS_SERVICE_TYPE, An as resolveHubAddressRoles, En as resolveAppConnections, Nn as resolveNotificationTapAddress, Wt as isAppLinkBase, Xn as validateCustomAddress, _r as BaseAddon, j as HUB_MDNS_TXT_KEYS, li as EventCategory, lt as checkRoleAddress, qt as isDefaultAppConnectionEndpoint, rn as localNetworkCapability, s as CAMSTACK_APP_LINK_ORIGIN, yn as pickAppLinkHub } from "../../dist-CXG6muCR.mjs";
+import { A as readTlsMode, G as DEFAULT_LAN_HTTP_PORT, M as writeExtraSans, O as readExtraSans, P as ensureTlsCert, T as servedHttpsLeafFingerprint, X as readLanHttpState, _ as regenerateCertificate, g as applyCertificateToListener, k as readTlsAccessStatus, q as applyLanHttp, v as revertToGeneratedCertificate, y as storeUploadedCertificate } from "../../tls-CpcGkeJV.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-DxJdci75.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-DHSJV4Qc.mjs";
+import { _r as BaseAddon, an as logDestinationCapability } from "../../dist-CXG6muCR.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-DxJdci75.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Nt as foldSnapshotByFunction, Tr as createEvent, cr as errMsg, gn as reducePoints, lr as BaseAddon, rn as metricsProviderCapability, ti as EventCategory, yn as resolveBucketMs } from "../../dist-DHSJV4Qc.mjs";
+import { Bt as foldSnapshotByFunction, Dn as resolveBucketMs, Nr as createEvent, _r as BaseAddon, dn as metricsProviderCapability, gr as errMsg, li as EventCategory, wn as reducePoints } from "../../dist-CXG6muCR.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";
 import { platform } from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-DxJdci75.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { cr as errMsg, kn as scoreRuntimes, kr as emitReadiness, lr as BaseAddon, pn as platformProbeCapability, ti as EventCategory, wt as enumerateInferenceDevices } from "../../dist-DHSJV4Qc.mjs";
+import { Ln as scoreRuntimes, Lr as emitReadiness, _r as BaseAddon, gr as errMsg, jt as enumerateInferenceDevices, li as EventCategory, xn as platformProbeCapability } from "../../dist-CXG6muCR.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-DxJdci75.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { lr as BaseAddon, ti as EventCategory } from "../../dist-DHSJV4Qc.mjs";
+import { _r as BaseAddon, li as EventCategory } from "../../dist-CXG6muCR.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-DxJdci75.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Br as nodePin, Mn as snapshotCapability, Rn as streamQualityLabel, X as bareAddonId, Z as batteryCapability, a as BatteryStatusSchema, ar as DeviceFeature, cr as errMsg, lr as BaseAddon, nn as memoizePinnedFfmpeg, sr as DeviceType, ti as EventCategory, vt as deriveBatteryPresence } from "../../dist-DHSJV4Qc.mjs";
+import { Bn as snapshotCapability, Jr as nodePin, Kn as streamQualityLabel, _r as BaseAddon, a as BatteryStatusSchema, et as bareAddonId, gr as errMsg, hr as DeviceType, li as EventCategory, pr as DeviceFeature, tt as batteryCapability, un as memoizePinnedFfmpeg, wt as deriveBatteryPresence } from "../../dist-CXG6muCR.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/file-host-client.d.ts

@@ -34,6 +34,8 @@ export declare class FileHostClient {
 	private nextId;
 	private lastOp;
 	private stopping;
+	/** Settles when the thread's event loop has ended and its isolate is gone. */
+	private readonly exited;
 	private dead;
 	private lastBusyLogAt;
 	private declared;
@@ -49,6 +51,15 @@ export declare class FileHostClient {
 	control<K extends ControlOp>(op: K, input: ControlOps[K]["input"]): Promise<ControlOps[K]["output"]>;
 	/** Ask the thread to close its connection, then end it. */
 	stop(): Promise<void>;
+	/**
+	* Let the thread END ITSELF after it answered `stop`: it has closed every
+	* statement and the connection and closed its port, so its loop drains and
+	* the isolate is disposed from inside. `terminate()` straight after the
+	* answer races that disposal and, on macOS, took the whole process down with
+	* a SIGSEGV in the isolate's teardown GC. Terminate is only the fallback for
+	* a thread that does not leave in time.
+	*/
+	private awaitExit;
 	inFlight(): number;
 	private request;
 	private logBusy;

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-DxJdci75.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { In as storageProviderCapability, Mt as filesystemBrowseCapability, lr as BaseAddon } from "../../dist-DHSJV4Qc.mjs";
+import { Wn as storageProviderCapability, _r as BaseAddon, zt as filesystemBrowseCapability } from "../../dist-CXG6muCR.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-DItkuOvu.js");
+const require_wal_maintenance = require("../../wal-maintenance-BW1LIHi0.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-Drqhcjit.mjs";
+import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-vhPZLYuA.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-BfGaSeQI.js");
-const require_wal_maintenance = require("../../wal-maintenance-DItkuOvu.js");
+const require_dist = require("../../dist-DxJdci75.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-g1oifXxR.js");
+const require_wal_maintenance = require("../../wal-maintenance-BW1LIHi0.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");
@@ -27,6 +27,8 @@ function defaultFileHostWorkerPath() {
 	const packageRoot = node_path.default.dirname(require_.resolve("@camstack/system/package.json"));
 	return node_path.default.join(packageRoot, "dist", "file-host-worker.js");
 }
+/** How long a stopped thread has to end on its own before it is terminated. */
+var FILE_HOST_EXIT_GRACE_MS = 5e3;
 var FileHostClient = class {
 	spec;
 	logger;
@@ -38,6 +40,8 @@ var FileHostClient = class {
 	nextId = 1;
 	lastOp = "(none yet)";
 	stopping = false;
+	/** Settles when the thread's event loop has ended and its isolate is gone. */
+	exited;
 	dead = false;
 	lastBusyLogAt = -Infinity;
 	declared = /* @__PURE__ */ new Set();
@@ -62,8 +66,14 @@ var FileHostClient = class {
 		});
 		this.thread.on("message", (message) => this.onMessage(message));
 		this.thread.on("error", (err) => this.die(`worker error: ${require_dist.errMsg(err)}`));
+		this.exited = new Promise((resolve) => {
+			this.thread.on("exit", () => resolve());
+		});
 		this.thread.on("exit", (code) => {
-			if (this.stopping) return;
+			if (this.stopping) {
+				for (const pending of this.pending.values()) if (pending.op === "stop") pending.resolve(void 0);
+				return;
+			}
 			this.die(`worker exited with code ${code}`);
 		});
 	}
@@ -122,6 +132,26 @@ var FileHostClient = class {
 				});
 			});
 		} finally {
+			await this.awaitExit();
+		}
+	}
+	/**
+	* Let the thread END ITSELF after it answered `stop`: it has closed every
+	* statement and the connection and closed its port, so its loop drains and
+	* the isolate is disposed from inside. `terminate()` straight after the
+	* answer races that disposal and, on macOS, took the whole process down with
+	* a SIGSEGV in the isolate's teardown GC. Terminate is only the fallback for
+	* a thread that does not leave in time.
+	*/
+	async awaitExit() {
+		let timer;
+		const timedOut = new Promise((resolve) => {
+			timer = setTimeout(() => resolve("timeout"), FILE_HOST_EXIT_GRACE_MS);
+		});
+		const outcome = await Promise.race([this.exited.then(() => "exited"), timedOut]);
+		if (timer !== void 0) clearTimeout(timer);
+		if (outcome === "timeout") {
+			this.logger.warn("database worker did not leave after stop — terminating it", { tags: { database: this.spec.databaseId } });
 			await this.thread.terminate();
 		}
 	}

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { Gn as vectorStoreCapability, X as bareAddonId, _ as DATABASE_SNAPSHOT_TIMEOUT_MS, cr as errMsg, g as DATABASE_SNAPSHOT_SUFFIX, h as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, lr as BaseAddon, mr as RUNTIME_DEFAULTS, mt as databaseSnapshotCapability, pt as dataStoreProviderCapability, v as DATA_STORE_DATABASES } from "../../dist-DHSJV4Qc.mjs";
-import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-CPz7zpza.mjs";
-import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-Drqhcjit.mjs";
+import { $n as vectorStoreCapability, Sr as RUNTIME_DEFAULTS, _ as DATABASE_SNAPSHOT_TIMEOUT_MS, _r as BaseAddon, bt as databaseSnapshotCapability, et as bareAddonId, g as DATABASE_SNAPSHOT_SUFFIX, gr as errMsg, h as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, v as DATA_STORE_DATABASES, yt as dataStoreProviderCapability } from "../../dist-CXG6muCR.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-EmDe11cP.mjs";
+import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-vhPZLYuA.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";
@@ -21,6 +21,8 @@ function defaultFileHostWorkerPath() {
 	const packageRoot = path.dirname(require_.resolve("@camstack/system/package.json"));
 	return path.join(packageRoot, "dist", "file-host-worker.js");
 }
+/** How long a stopped thread has to end on its own before it is terminated. */
+var FILE_HOST_EXIT_GRACE_MS = 5e3;
 var FileHostClient = class {
 	spec;
 	logger;
@@ -32,6 +34,8 @@ var FileHostClient = class {
 	nextId = 1;
 	lastOp = "(none yet)";
 	stopping = false;
+	/** Settles when the thread's event loop has ended and its isolate is gone. */
+	exited;
 	dead = false;
 	lastBusyLogAt = -Infinity;
 	declared = /* @__PURE__ */ new Set();
@@ -56,8 +60,14 @@ var FileHostClient = class {
 		});
 		this.thread.on("message", (message) => this.onMessage(message));
 		this.thread.on("error", (err) => this.die(`worker error: ${errMsg(err)}`));
+		this.exited = new Promise((resolve) => {
+			this.thread.on("exit", () => resolve());
+		});
 		this.thread.on("exit", (code) => {
-			if (this.stopping) return;
+			if (this.stopping) {
+				for (const pending of this.pending.values()) if (pending.op === "stop") pending.resolve(void 0);
+				return;
+			}
 			this.die(`worker exited with code ${code}`);
 		});
 	}
@@ -116,6 +126,26 @@ var FileHostClient = class {
 				});
 			});
 		} finally {
+			await this.awaitExit();
+		}
+	}
+	/**
+	* Let the thread END ITSELF after it answered `stop`: it has closed every
+	* statement and the connection and closed its port, so its loop drains and
+	* the isolate is disposed from inside. `terminate()` straight after the
+	* answer races that disposal and, on macOS, took the whole process down with
+	* a SIGSEGV in the isolate's teardown GC. Terminate is only the fallback for
+	* a thread that does not leave in time.
+	*/
+	async awaitExit() {
+		let timer;
+		const timedOut = new Promise((resolve) => {
+			timer = setTimeout(() => resolve("timeout"), FILE_HOST_EXIT_GRACE_MS);
+		});
+		const outcome = await Promise.race([this.exited.then(() => "exited"), timedOut]);
+		if (timer !== void 0) clearTimeout(timer);
+		if (outcome === "timeout") {
+			this.logger.warn("database worker did not leave after stop — terminating it", { tags: { database: this.spec.databaseId } });
 			await this.thread.terminate();
 		}
 	}

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-DxJdci75.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { A as LegacyStorageLocationDefaultSchema, An as settingsStoreCapability, B as StorageLocationModeSchema, Bt as isLocationEnabled, Cn as resolveLocationMode, Cr as collectSecretConfigKeys, Ft as gbToBytes, H as StorageMigrationJobSchema, Hr as parseJsonObject, Kn as withLocationMode, Lr as isSecretMarker, Nn as storageCapability, Ot as evictionPolicyOfLocation, Pn as storageMigrationCapability, V as StorageLocationTypeSchema, Yr as secretTreeFromPaths, ei as transformSecretWrite, en as mayReadLocation, in as modeMayWrite, lr as BaseAddon, pr as REDACTED_SECRET, qr as resolveSecretMarkers, qt as legacyModeOf, ti as EventCategory, tn as mayWriteToLocation, z as StorageCleanupJobSchema } from "../../dist-DHSJV4Qc.mjs";
+import { Ft as evictionPolicyOfLocation, G as StorageLocationTypeSchema, Gr as isSecretMarker, Hn as storageMigrationCapability, Jt as isLocationEnabled, K as StorageMigrationJobSchema, P as LegacyStorageLocationDefaultSchema, Rn as settingsStoreCapability, U as StorageCleanupJobSchema, Ut as gbToBytes, Vn as storageCapability, W as StorageLocationModeSchema, Xr as parseJsonObject, _r as BaseAddon, ci as transformSecretWrite, cn as mayReadLocation, er as withLocationMode, fn as modeMayWrite, jn as resolveLocationMode, jr as collectSecretConfigKeys, li as EventCategory, ln as mayWriteToLocation, ri as secretTreeFromPaths, ti as resolveSecretMarkers, tn as legacyModeOf, xr as REDACTED_SECRET } from "../../dist-CXG6muCR.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -7,9 +7,27 @@ export declare class SystemConfigAddon extends BaseAddon {
 	readonly id = "system-config";
 	private clusterSecretKeeper;
 	private meshCaKeeper;
+	private meshReapTimer;
+	private readonly meshGateTimers;
+	private stoppedMesh;
+	private loggedNoSettingsStore;
 	constructor();
 	protected onInitialize(): Promise<AddonInitResult<typeof systemConfigMeshActions>>;
 	protected onShutdown(): Promise<void>;
+	/**
+	* The hub's record of mesh leaves (D856): declared and loaded BEFORE the TLS
+	* listener opens, so persisted revocations are in the CRL before any node can
+	* connect. Best effort: a hub whose settings store is not up still serves the
+	* mesh (the registry then fills from the leaves nodes present).
+	*/
+	private initMeshCertificateRegistry;
+	/** Which names the hub certified to which agent. Best effort; nothing waits on it. */
+	private loadAgentHttpsNames;
+	/**
+	* The mesh TLS listener opens ONLY after the revocation registry has loaded and its
+	* revocations are in the CRL (D856): until then every agent is refused, because an
+	* empty CRL would accept a revoked leaf. Retries until the settings store answers.
+	*/
 	private onMeshCaReady;
 	private mintJoinToken;
 	/** D821 — short-lived ticket for the agent's `:4444` unlock session. */