@camstack/system 1.2.429 → 1.2.431

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { $n as vectorStoreCapability, Sr as RUNTIME_DEFAULTS, _ as DATABASE_SNAPSHOT_TIMEOUT_MS, _r as BaseAddon, bt as databaseSnapshotCapability, et as bareAddonId, g as DATABASE_SNAPSHOT_SUFFIX, gr as errMsg, h as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, v as DATA_STORE_DATABASES, yt as dataStoreProviderCapability } from "../../dist-CSSfTM18.mjs";
-import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-H0rYXT27.mjs";
-import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-DW0FfGV7.mjs";
+import { $n as vectorStoreCapability, Sr as RUNTIME_DEFAULTS, _ as DATABASE_SNAPSHOT_TIMEOUT_MS, _r as BaseAddon, bt as databaseSnapshotCapability, et as bareAddonId, g as DATABASE_SNAPSHOT_SUFFIX, gr as errMsg, h as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, v as DATA_STORE_DATABASES, yt as dataStoreProviderCapability } from "../../dist-CXG6muCR.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-EmDe11cP.mjs";
+import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-vhPZLYuA.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";
@@ -21,6 +21,8 @@ function defaultFileHostWorkerPath() {
 	const packageRoot = path.dirname(require_.resolve("@camstack/system/package.json"));
 	return path.join(packageRoot, "dist", "file-host-worker.js");
 }
+/** How long a stopped thread has to end on its own before it is terminated. */
+var FILE_HOST_EXIT_GRACE_MS = 5e3;
 var FileHostClient = class {
 	spec;
 	logger;
@@ -32,6 +34,8 @@ var FileHostClient = class {
 	nextId = 1;
 	lastOp = "(none yet)";
 	stopping = false;
+	/** Settles when the thread's event loop has ended and its isolate is gone. */
+	exited;
 	dead = false;
 	lastBusyLogAt = -Infinity;
 	declared = /* @__PURE__ */ new Set();
@@ -56,8 +60,14 @@ var FileHostClient = class {
 		});
 		this.thread.on("message", (message) => this.onMessage(message));
 		this.thread.on("error", (err) => this.die(`worker error: ${errMsg(err)}`));
+		this.exited = new Promise((resolve) => {
+			this.thread.on("exit", () => resolve());
+		});
 		this.thread.on("exit", (code) => {
-			if (this.stopping) return;
+			if (this.stopping) {
+				for (const pending of this.pending.values()) if (pending.op === "stop") pending.resolve(void 0);
+				return;
+			}
 			this.die(`worker exited with code ${code}`);
 		});
 	}
@@ -116,6 +126,26 @@ var FileHostClient = class {
 				});
 			});
 		} finally {
+			await this.awaitExit();
+		}
+	}
+	/**
+	* Let the thread END ITSELF after it answered `stop`: it has closed every
+	* statement and the connection and closed its port, so its loop drains and
+	* the isolate is disposed from inside. `terminate()` straight after the
+	* answer races that disposal and, on macOS, took the whole process down with
+	* a SIGSEGV in the isolate's teardown GC. Terminate is only the fallback for
+	* a thread that does not leave in time.
+	*/
+	async awaitExit() {
+		let timer;
+		const timedOut = new Promise((resolve) => {
+			timer = setTimeout(() => resolve("timeout"), FILE_HOST_EXIT_GRACE_MS);
+		});
+		const outcome = await Promise.race([this.exited.then(() => "exited"), timedOut]);
+		if (timer !== void 0) clearTimeout(timer);
+		if (outcome === "timeout") {
+			this.logger.warn("database worker did not leave after stop — terminating it", { tags: { database: this.spec.databaseId } });
 			await this.thread.terminate();
 		}
 	}

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Bgy_AmwX.js");
+const require_dist = require("../../dist-DxJdci75.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ft as evictionPolicyOfLocation, G as StorageLocationTypeSchema, Gr as isSecretMarker, Hn as storageMigrationCapability, Jt as isLocationEnabled, K as StorageMigrationJobSchema, P as LegacyStorageLocationDefaultSchema, Rn as settingsStoreCapability, U as StorageCleanupJobSchema, Ut as gbToBytes, Vn as storageCapability, W as StorageLocationModeSchema, Xr as parseJsonObject, _r as BaseAddon, ci as transformSecretWrite, cn as mayReadLocation, er as withLocationMode, fn as modeMayWrite, jn as resolveLocationMode, jr as collectSecretConfigKeys, li as EventCategory, ln as mayWriteToLocation, ri as secretTreeFromPaths, ti as resolveSecretMarkers, tn as legacyModeOf, xr as REDACTED_SECRET } from "../../dist-CSSfTM18.mjs";
+import { Ft as evictionPolicyOfLocation, G as StorageLocationTypeSchema, Gr as isSecretMarker, Hn as storageMigrationCapability, Jt as isLocationEnabled, K as StorageMigrationJobSchema, P as LegacyStorageLocationDefaultSchema, Rn as settingsStoreCapability, U as StorageCleanupJobSchema, Ut as gbToBytes, Vn as storageCapability, W as StorageLocationModeSchema, Xr as parseJsonObject, _r as BaseAddon, ci as transformSecretWrite, cn as mayReadLocation, er as withLocationMode, fn as modeMayWrite, jn as resolveLocationMode, jr as collectSecretConfigKeys, li as EventCategory, ln as mayWriteToLocation, ri as secretTreeFromPaths, ti as resolveSecretMarkers, tn as legacyModeOf, xr as REDACTED_SECRET } from "../../dist-CXG6muCR.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Bgy_AmwX.js");
+const require_dist = require("../../dist-DxJdci75.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_x509_es = require("../../x509.es-Dzl0BbmG.js");
 const require_agent_https_names = require("../../agent-https-names-CpUSuP4w.js");
-const require_constants$8 = require("../../constants-RI-hGP5S.js");
+const require_constants$8 = require("../../constants-BcNaVkvI.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -792,7 +792,7 @@ var MeshCertificateRegistry = class {
 	async recordObserved(nodeId, leaf) {
 		const known = this.rows.get(leaf.fingerprint);
 		if (known !== void 0) {
-			if (known.revokedReason !== "renewal-abandoned") return false;
+			if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
 			const reinstated = {
 				...known,
 				revokedAt: null,
@@ -908,6 +908,29 @@ var MeshCertificateRegistry = class {
 		return settled;
 	}
 	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+	/** Fingerprints of renewal leaves whose handover is running right now (this process only). */
+	renewalsInFlight = /* @__PURE__ */ new Set();
+	/**
+	* A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
+	* presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
+	* flap set-aside / reinstate on the node's first connection with it).
+	*/
+	beginRenewal(fingerprint) {
+		this.renewalsInFlight.add(fingerprint);
+	}
+	endRenewal(fingerprint) {
+		this.renewalsInFlight.delete(fingerprint);
+	}
+	async abandonRenewalsNewerThan(presented) {
+		let changed = false;
+		for (const record of this.liveFor(presented.nodeId)) {
+			if (record.fingerprint === presented.fingerprint) continue;
+			if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
+			if (this.renewalsInFlight.has(record.fingerprint)) continue;
+			if (await this.abandon(record.fingerprint)) changed = true;
+		}
+		return changed;
+	}
 	async abandon(fingerprint) {
 		const record = this.rows.get(fingerprint);
 		if (record === void 0 || record.revokedAt !== null) return false;
@@ -1063,6 +1086,24 @@ function message$1(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 async function renewMeshCertificate(deps) {
+	const inFlight = { fingerprint: null };
+	try {
+		return await runRenewal(deps, inFlight);
+	} finally {
+		if (inFlight.fingerprint !== null) {
+			deps.registry.endRenewal(inFlight.fingerprint);
+			const live = deps.peers.peerLeaf(deps.nodeId);
+			if (live !== void 0) await deps.registry.recordObserved(deps.nodeId, {
+				cn: deps.nodeId,
+				serial: live.serial,
+				fingerprint: live.fingerprint,
+				notBefore: live.notBefore,
+				notAfter: live.notAfter
+			}).catch(() => void 0);
+		}
+	}
+}
+async function runRenewal(deps, inFlight) {
 	const { nodeId, log } = deps;
 	const tags = { nodeId };
 	const sleep = deps.sleep ?? defaultSleep;
@@ -1124,12 +1165,28 @@ async function renewMeshCertificate(deps) {
 		return fail("issue", message$1(error), true);
 	}
 	const newLeaf = describeMeshLeaf(issued.certPem);
+	deps.registry.beginRenewal(newLeaf.fingerprint);
+	inFlight.fingerprint = newLeaf.fingerprint;
 	let resolveRegistered = () => void 0;
 	const registeredPromise = new Promise((resolve) => {
 		resolveRegistered = resolve;
 	});
-	const unsubscribe = deps.registrations.subscribe((id) => {
-		if (id === nodeId && deps.peers.peerLeaf(nodeId)?.fingerprint === newLeaf.fingerprint) resolveRegistered(true);
+	const expected = deps.expectedAddons?.(nodeId) ?? [];
+	let missingAddons = [];
+	const unsubscribe = deps.registrations.subscribe((id, addonIds) => {
+		if (id !== nodeId || deps.peers.peerLeaf(nodeId)?.fingerprint !== newLeaf.fingerprint) return;
+		if (addonIds !== void 0) {
+			const present = new Set(addonIds);
+			missingAddons = expected.filter((addonId) => !present.has(addonId));
+			if (missingAddons.length > 0) {
+				log.warn("Mesh renewal: the node registered without addons it had before - waiting", {
+					tags,
+					meta: { missing: missingAddons }
+				});
+				return;
+			}
+		}
+		resolveRegistered(true);
 	});
 	const deadlineTimer = setTimer(() => resolveRegistered(false), timeoutMs);
 	registeredPromise.then(() => deadlineTimer.cancel());
@@ -1160,7 +1217,8 @@ async function renewMeshCertificate(deps) {
 			}
 		});
 		await deps.registry.abandon(newLeaf.fingerprint);
-		return fail("reconnect", `the node was not back and registered with the new leaf within ${Math.round(timeoutMs / 1e3)} s; the previous leaf was kept and is still valid`, true);
+		const lost = missingAddons.length > 0 ? ` (its last registration lacked ${missingAddons.length} addon(s) it had before: ${missingAddons.slice(0, 5).join(", ")}; the swap was rolled back and nothing was revoked - once those addons are running again the next renewal will go through)` : "";
+		return fail("reconnect", `the node was not back and registered with the new leaf within ${Math.round(timeoutMs / 1e3)} s${lost}; the previous leaf was kept and is still valid`, true);
 	}
 	log.info("Mesh renewal: the node registered presenting the new leaf", { tags });
 	let confirmError = "the node did not confirm the new leaf";
@@ -1280,10 +1338,14 @@ function onProcessNodeRegistered(listener) {
 		listeners.delete(listener);
 	};
 }
-/** Called by the hub when a node's `registerNode` has been applied. */
-function emitProcessNodeRegistered(nodeId) {
+/**
+* Called by the hub when a node's `registerNode` has been applied. `addonIds` is what that
+* registration carried (a node's own addons and its children's, D3), so a waiter can tell the
+* registration of a node that came back WHOLE from the first one of a node that lost its children.
+*/
+function emitProcessNodeRegistered(nodeId, addonIds) {
 	for (const listener of [...registrationListeners()]) try {
-		listener(nodeId);
+		listener(nodeId, addonIds);
 	} catch {}
 }
 //#endregion
@@ -87836,6 +87898,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 			});
 			server.on("error", (err) => {
 				this.logger.error("Mesh TLS server error.", err);
+				if (this.tlsServer === server) this.tlsServer = null;
 				reject(err);
 			});
 			server.listen({
@@ -87845,9 +87908,9 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 				const address = server.address();
 				const port = address !== null && typeof address === "object" ? address.port : tlsPort;
 				this.logger.info(`Mesh TLS server is listening on port ${port}`);
+				this.tlsServer = server;
 				resolve();
 			});
-			this.tlsServer = server;
 		});
 	}
 	onTlsClientConnected(socket) {
@@ -88676,6 +88739,7 @@ exports.ServiceBroker = ServiceBroker;
 exports.SystemConfigAddon = SystemConfigAddon;
 exports.default = SystemConfigAddon;
 exports.TlsTcpTransporter = TlsTcpTransporter;
+exports.Transporters = Transporters;
 exports.UnlockTicketJtiStore = UnlockTicketJtiStore;
 exports.caFingerprint = caFingerprint;
 exports.caFingerprintCompact = caFingerprintCompact;

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,9 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Br as hydrateSchema, Fr as defineCustomActions, Gr as isSecretMarker, Pr as customAction, Wr as isSecretClear, _r as BaseAddon, ci as transformSecretWrite, gr as errMsg, ii as secretTreeFromSchema, qr as makeSecretMarker } from "../../dist-CSSfTM18.mjs";
+import { Br as hydrateSchema, Fr as defineCustomActions, Gr as isSecretMarker, Pr as customAction, Wr as isSecretClear, _r as BaseAddon, ci as transformSecretWrite, gr as errMsg, ii as secretTreeFromSchema, qr as makeSecretMarker } from "../../dist-CXG6muCR.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-CAjSsrkk.mjs";
 import { a as setProcessAgentHttpsNames, n as AGENT_HTTPS_NAMES_COLUMNS, r as AgentHttpsNames, t as AGENT_HTTPS_NAMES_COLLECTION } from "../../agent-https-names-uetr4OQl.mjs";
-import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-CKuWoWvc.mjs";
+import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-CttE77VF.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createHmac, randomBytes, timingSafeEqual, webcrypto } from "node:crypto";
@@ -783,7 +783,7 @@ var MeshCertificateRegistry = class {
 	async recordObserved(nodeId, leaf) {
 		const known = this.rows.get(leaf.fingerprint);
 		if (known !== void 0) {
-			if (known.revokedReason !== "renewal-abandoned") return false;
+			if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
 			const reinstated = {
 				...known,
 				revokedAt: null,
@@ -899,6 +899,29 @@ var MeshCertificateRegistry = class {
 		return settled;
 	}
 	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+	/** Fingerprints of renewal leaves whose handover is running right now (this process only). */
+	renewalsInFlight = /* @__PURE__ */ new Set();
+	/**
+	* A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
+	* presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
+	* flap set-aside / reinstate on the node's first connection with it).
+	*/
+	beginRenewal(fingerprint) {
+		this.renewalsInFlight.add(fingerprint);
+	}
+	endRenewal(fingerprint) {
+		this.renewalsInFlight.delete(fingerprint);
+	}
+	async abandonRenewalsNewerThan(presented) {
+		let changed = false;
+		for (const record of this.liveFor(presented.nodeId)) {
+			if (record.fingerprint === presented.fingerprint) continue;
+			if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
+			if (this.renewalsInFlight.has(record.fingerprint)) continue;
+			if (await this.abandon(record.fingerprint)) changed = true;
+		}
+		return changed;
+	}
 	async abandon(fingerprint) {
 		const record = this.rows.get(fingerprint);
 		if (record === void 0 || record.revokedAt !== null) return false;
@@ -1054,6 +1077,24 @@ function message$1(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 async function renewMeshCertificate(deps) {
+	const inFlight = { fingerprint: null };
+	try {
+		return await runRenewal(deps, inFlight);
+	} finally {
+		if (inFlight.fingerprint !== null) {
+			deps.registry.endRenewal(inFlight.fingerprint);
+			const live = deps.peers.peerLeaf(deps.nodeId);
+			if (live !== void 0) await deps.registry.recordObserved(deps.nodeId, {
+				cn: deps.nodeId,
+				serial: live.serial,
+				fingerprint: live.fingerprint,
+				notBefore: live.notBefore,
+				notAfter: live.notAfter
+			}).catch(() => void 0);
+		}
+	}
+}
+async function runRenewal(deps, inFlight) {
 	const { nodeId, log } = deps;
 	const tags = { nodeId };
 	const sleep = deps.sleep ?? defaultSleep;
@@ -1115,12 +1156,28 @@ async function renewMeshCertificate(deps) {
 		return fail("issue", message$1(error), true);
 	}
 	const newLeaf = describeMeshLeaf(issued.certPem);
+	deps.registry.beginRenewal(newLeaf.fingerprint);
+	inFlight.fingerprint = newLeaf.fingerprint;
 	let resolveRegistered = () => void 0;
 	const registeredPromise = new Promise((resolve) => {
 		resolveRegistered = resolve;
 	});
-	const unsubscribe = deps.registrations.subscribe((id) => {
-		if (id === nodeId && deps.peers.peerLeaf(nodeId)?.fingerprint === newLeaf.fingerprint) resolveRegistered(true);
+	const expected = deps.expectedAddons?.(nodeId) ?? [];
+	let missingAddons = [];
+	const unsubscribe = deps.registrations.subscribe((id, addonIds) => {
+		if (id !== nodeId || deps.peers.peerLeaf(nodeId)?.fingerprint !== newLeaf.fingerprint) return;
+		if (addonIds !== void 0) {
+			const present = new Set(addonIds);
+			missingAddons = expected.filter((addonId) => !present.has(addonId));
+			if (missingAddons.length > 0) {
+				log.warn("Mesh renewal: the node registered without addons it had before - waiting", {
+					tags,
+					meta: { missing: missingAddons }
+				});
+				return;
+			}
+		}
+		resolveRegistered(true);
 	});
 	const deadlineTimer = setTimer(() => resolveRegistered(false), timeoutMs);
 	registeredPromise.then(() => deadlineTimer.cancel());
@@ -1151,7 +1208,8 @@ async function renewMeshCertificate(deps) {
 			}
 		});
 		await deps.registry.abandon(newLeaf.fingerprint);
-		return fail("reconnect", `the node was not back and registered with the new leaf within ${Math.round(timeoutMs / 1e3)} s; the previous leaf was kept and is still valid`, true);
+		const lost = missingAddons.length > 0 ? ` (its last registration lacked ${missingAddons.length} addon(s) it had before: ${missingAddons.slice(0, 5).join(", ")}; the swap was rolled back and nothing was revoked - once those addons are running again the next renewal will go through)` : "";
+		return fail("reconnect", `the node was not back and registered with the new leaf within ${Math.round(timeoutMs / 1e3)} s${lost}; the previous leaf was kept and is still valid`, true);
 	}
 	log.info("Mesh renewal: the node registered presenting the new leaf", { tags });
 	let confirmError = "the node did not confirm the new leaf";
@@ -1271,10 +1329,14 @@ function onProcessNodeRegistered(listener) {
 		listeners.delete(listener);
 	};
 }
-/** Called by the hub when a node's `registerNode` has been applied. */
-function emitProcessNodeRegistered(nodeId) {
+/**
+* Called by the hub when a node's `registerNode` has been applied. `addonIds` is what that
+* registration carried (a node's own addons and its children's, D3), so a waiter can tell the
+* registration of a node that came back WHOLE from the first one of a node that lost its children.
+*/
+function emitProcessNodeRegistered(nodeId, addonIds) {
 	for (const listener of [...registrationListeners()]) try {
-		listener(nodeId);
+		listener(nodeId, addonIds);
 	} catch {}
 }
 //#endregion
@@ -87827,6 +87889,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 			});
 			server.on("error", (err) => {
 				this.logger.error("Mesh TLS server error.", err);
+				if (this.tlsServer === server) this.tlsServer = null;
 				reject(err);
 			});
 			server.listen({
@@ -87836,9 +87899,9 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 				const address = server.address();
 				const port = address !== null && typeof address === "object" ? address.port : tlsPort;
 				this.logger.info(`Mesh TLS server is listening on port ${port}`);
+				this.tlsServer = server;
 				resolve();
 			});
-			this.tlsServer = server;
 		});
 	}
 	onTlsClientConnected(socket) {
@@ -88647,4 +88710,4 @@ function readJwtExp(token) {
 	return typeof exp === "number" ? exp : 0;
 }
 //#endregion
-export { MESH_AUTH_MODE_FIELD as $, MeshCrl as A, generateMeshKeyPair as B, MESH_NODE_CERTIFICATES_COLLECTION as C, describeMeshLeaf as D, RENEWAL_ABANDONED as E, caFingerprint as F, AGENT_UI_UNLOCK_DOMAIN as G, issueMeshLeafFromCsr as H, caFingerprintCompact as I, UnlockTicketJtiStore as J, AGENT_UI_UNLOCK_TTL_MS as K, createMeshCsrPem as L, MeshCaKeeper as M, getProcessMeshCaState as N, getProcessMeshCertificateRegistry as O, requireProcessMeshCa as P, verifyAgentUiUnlockTicket as Q, exportMeshPrivateKeyPem as R, setProcessMeshTlsListenerState as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, MeshCertificateRegistry as T, loadMeshCa as U, issueMeshLeafForNode as V, AGENT_DASHBOARD_ORIGINS_FIELD as W, mintAgentUiUnlockTicket as X, isAllowedAgentDashboardReturnTo as Y, parseAgentDashboardOrigins as Z, setProcessMeshPeerTransportLookup as _, ServiceBroker as a, setProcessMeshAuthMode as at, getProcessMeshTlsListenerState as b, JoinTokenJtiStore as c, createCidrMatcher as ct, verifyMeshJoinToken as d, readCidrSetting as dt, getProcessMeshAuthMode as et, dropProcessPeer as f, onProcessNodeRegistered as g, getProcessPeerLeaf as h, Errors as i, requestProcessMeshEnforcement as it, processMeshCrl as j, setProcessMeshCertificateRegistry as k, mintMeshJoinToken as l, normalizeIp as lt, getProcessNodeMeshTransport as m, MESH_TLS_PORT_HELLO_FIELD as n, isMeshAuthMode as nt, setProcessMeshTlsEnabler as o, setProcessMeshAuthStatusSource as ot, emitProcessNodeRegistered as p, AGENT_UI_UNLOCK_VERSION as q, TlsTcpTransporter as r, parseMeshAuthMode as rt, enrollMeshNode as s, setProcessMeshEnforcer as st, systemConfigMeshActions as t, getProcessMeshAuthStatus as tt, processJoinTokenJtiStore as u, parseCidrList as ut, renewMeshCertificate as v, MESH_NODE_CERTIFICATES_COLUMNS as w, openMeshTlsWhenRevocationsLoaded as x, revokeMeshCertificate as y, generateMeshCa as z };
+export { verifyAgentUiUnlockTicket as $, setProcessMeshCertificateRegistry as A, generateMeshCa as B, setProcessMeshTlsListenerState as C, RENEWAL_ABANDONED as D, MeshCertificateRegistry as E, requireProcessMeshCa as F, AGENT_DASHBOARD_ORIGINS_FIELD as G, issueMeshLeafForNode as H, caFingerprint as I, AGENT_UI_UNLOCK_VERSION as J, AGENT_UI_UNLOCK_DOMAIN as K, caFingerprintCompact as L, processMeshCrl as M, MeshCaKeeper as N, describeMeshLeaf as O, getProcessMeshCaState as P, parseAgentDashboardOrigins as Q, createMeshCsrPem as R, openMeshTlsWhenRevocationsLoaded as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, MESH_NODE_CERTIFICATES_COLUMNS as T, issueMeshLeafFromCsr as U, generateMeshKeyPair as V, loadMeshCa as W, isAllowedAgentDashboardReturnTo as X, UnlockTicketJtiStore as Y, mintAgentUiUnlockTicket as Z, onProcessNodeRegistered as _, ServiceBroker as a, requestProcessMeshEnforcement as at, revokeMeshCertificate as b, enrollMeshNode as c, setProcessMeshEnforcer as ct, processJoinTokenJtiStore as d, parseCidrList as dt, MESH_AUTH_MODE_FIELD as et, verifyMeshJoinToken as f, readCidrSetting as ft, getProcessPeerLeaf as g, getProcessNodeMeshTransport as h, Errors as i, parseMeshAuthMode as it, MeshCrl as j, getProcessMeshCertificateRegistry as k, JoinTokenJtiStore as l, createCidrMatcher as lt, emitProcessNodeRegistered as m, MESH_TLS_PORT_HELLO_FIELD as n, getProcessMeshAuthStatus as nt, Transporters as o, setProcessMeshAuthMode as ot, dropProcessPeer as p, AGENT_UI_UNLOCK_TTL_MS as q, TlsTcpTransporter as r, isMeshAuthMode as rt, setProcessMeshTlsEnabler as s, setProcessMeshAuthStatusSource as st, systemConfigMeshActions as t, getProcessMeshAuthMode as tt, mintMeshJoinToken as u, normalizeIp as ut, setProcessMeshPeerTransportLookup as v, MESH_NODE_CERTIFICATES_COLLECTION as w, getProcessMeshTlsListenerState as x, renewMeshCertificate as y, exportMeshPrivateKeyPem as z };

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Bgy_AmwX.js");
+const require_dist = require("../../dist-DxJdci75.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { _r as BaseAddon, an as logDestinationCapability } from "../../dist-CSSfTM18.mjs";
+import { _r as BaseAddon, an as logDestinationCapability } from "../../dist-CXG6muCR.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-SYtYuAgh.mjs → composition-sources-Cw_TXEq9.mjs}

@@ -1,4 +1,4 @@
-import { gr as errMsg, lr as compositionSourceKey } from "./dist-CSSfTM18.mjs";
+import { gr as errMsg, lr as compositionSourceKey } from "./dist-CXG6muCR.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-C2VNX6tF.js → composition-sources-o5MPSlk6.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-Bgy_AmwX.js");
+const require_dist = require("./dist-DxJdci75.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-RI-hGP5S.js → constants-BcNaVkvI.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-Bgy_AmwX.js");
+const require_dist = require("./dist-DxJdci75.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{constants-CKuWoWvc.mjs → constants-CttE77VF.mjs}

@@ -1,4 +1,4 @@
-import { Ar as buildSecretRef } from "./dist-CSSfTM18.mjs";
+import { Ar as buildSecretRef } from "./dist-CXG6muCR.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{device-ca-R7DKKZL6.mjs → device-ca-B-BTxeCj.mjs}

@@ -1,4 +1,4 @@
-import { Ar as buildSecretRef, C as DEVICE_SAN_CREDENTIAL_PREFIX, w as DEVICE_SAN_USER_PREFIX } from "./dist-CSSfTM18.mjs";
+import { Ar as buildSecretRef, C as DEVICE_SAN_CREDENTIAL_PREFIX, w as DEVICE_SAN_USER_PREFIX } from "./dist-CXG6muCR.mjs";
 import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CAjSsrkk.mjs";
 import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts

package/dist/{device-ca-BWfdDB3k.js → device-ca-CKiqh2Iu.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-Bgy_AmwX.js");
+const require_dist = require("./dist-DxJdci75.js");
 const require_x509_es = require("./x509.es-Dzl0BbmG.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts