@camstack/system 1.2.431 → 1.2.432

package/dist/{dist-CXG6muCR.mjs → dist-Bt8GTRHB.mjs}

@@ -718,7 +718,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-DxJdzHni.mjs
+//#region ../types/dist/sleep--g-h2_c_.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -16213,6 +16213,241 @@ var keychainCapability = {
 		getState: method(z.object({}), KeychainStateSchema, { auth: "admin" })
 	}
 };
+/**
+* device-history — the ONE mechanism for numeric history (D850).
+*
+* A device value is recorded because its capability says so (the `history`
+* block of a `*.cap.ts`, captured hub-side from `DeviceStateChanged`); any
+* other series is DECLARED by the addon that produces it and fed with points
+* (`record`) or closed five-minute buckets (`recordBuckets`). Rollups 5m / 1h /
+* 1d are computed here and nowhere else. Storage is `history.db` (D851).
+*
+* Who the PRODUCER is: `declareSeries`, `record` and `recordBuckets` are owner
+* checked against the `callerAddonId` the transport stamps into a call that
+* crossed a process (never in an input schema, so a session cannot supply it).
+* A call with no stamp is refused `not-owner`. The methods are `admin` so a
+* non-admin session never reaches them; an addon's `ctx.api` call bypasses the
+* tier by design.
+*/
+/** Whose history: a real device, or a cluster node (load, memory). */
+var DeviceHistorySubjectSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("device"),
+	deviceId: z.number().int()
+}), z.object({
+	kind: z.literal("node"),
+	nodeId: z.string().min(1)
+})]);
+var DeviceHistoryKindSchema = z.enum([
+	"gauge",
+	"counter",
+	"boolean"
+]);
+var DeviceHistoryResolutionSchema = z.enum([
+	"raw",
+	"5m",
+	"1h",
+	"1d"
+]);
+/** Why a producer's point or bucket was not stored. Counted, never silent (D391). */
+var DeviceHistoryRefusalReasonSchema = z.enum([
+	"undeclared",
+	"not-owner",
+	"opted-out",
+	"not-a-real-device",
+	"rate",
+	"ingest-mismatch",
+	"out-of-range"
+]);
+var RefusalSchema = z.object({
+	key: z.string(),
+	reason: DeviceHistoryRefusalReasonSchema,
+	count: z.number().int()
+});
+var IngestResultSchema = z.object({
+	accepted: z.number().int(),
+	refused: z.array(RefusalSchema).readonly()
+});
+var SeriesInfoSchema = z.object({
+	key: z.string(),
+	scope: z.string(),
+	kind: DeviceHistoryKindSchema,
+	/** `null` is unknown (a `unitFrom` series whose device does not state a unit right now), never a guess. */
+	unit: z.string().nullable(),
+	displayName: z.string(),
+	source: z.enum(["cap", "addon"]),
+	firstTs: z.number(),
+	lastTs: z.number()
+});
+var QueryPointSchema = z.object({
+	/** Raw: the point's time. Rollup: the bucket start. */
+	t: z.number(),
+	samples: z.number().int(),
+	/** `sum / samples`. */
+	mean: z.number().nullable(),
+	/** Time-weighted mean (`tw_sum / tw_ms`); `null` for bucket-ingested series. For a boolean: the fraction of time true. */
+	twMean: z.number().nullable(),
+	min: z.number(),
+	max: z.number(),
+	/** `null` is unknown, never zero (D393). */
+	last: z.number().nullable()
+});
+var QuerySeriesSchema = z.object({
+	scope: z.string(),
+	/** The last point STRICTLY BEFORE `from` in the chosen tier, so a step chart can start at the held value. */
+	before: z.object({
+		t: z.number(),
+		value: z.number().nullable()
+	}).nullable(),
+	points: z.array(QueryPointSchema).readonly()
+});
+/** The window part of a query, shared by the device and node forms. */
+var QueryWindowShape = {
+	key: z.string(),
+	scope: z.string().optional(),
+	from: z.number(),
+	to: z.number(),
+	resolution: z.union([DeviceHistoryResolutionSchema, z.literal("auto")]).default("auto"),
+	maxPoints: z.number().int().positive().max(5e3).default(1e3)
+};
+var QueryResultSchema = z.object({
+	resolution: DeviceHistoryResolutionSchema,
+	series: z.array(QuerySeriesSchema).readonly(),
+	truncated: z.boolean()
+});
+var TierStatusSchema = z.object({
+	tier: DeviceHistoryResolutionSchema,
+	/** `null` until the first background count answered. */
+	rows: z.number().int().nullable(),
+	/** `rows` times a fixed per-row estimate — approximate, labelled so. */
+	approxBytes: z.number().nullable(),
+	countedAt: z.number().nullable()
+});
+/** Operator/diagnostic view: rows per tier, last runs, refusals and drops since boot. */
+var DeviceHistoryStatusSchema = z.object({
+	startedAt: z.number(),
+	/** The store is declared, series loaded and the first reconcile has answered. */
+	ready: z.boolean(),
+	series: z.number().int(),
+	metrics: z.number().int(),
+	optedOutDevices: z.number().int(),
+	tiers: z.array(TierStatusSchema).readonly(),
+	capture: z.object({
+		eventsSeen: z.number().int(),
+		pointsEmitted: z.number().int(),
+		pointsWritten: z.number().int(),
+		pointsDropped: z.number().int(),
+		bufferDepth: z.number().int(),
+		trailingEmitted: z.number().int(),
+		reconciledPoints: z.number().int(),
+		reconcileRuns: z.number().int(),
+		reconcileFailures: z.number().int(),
+		lastReconcileAt: z.number().nullable(),
+		lastFlushAt: z.number().nullable(),
+		flushFailures: z.number().int(),
+		skipped: z.record(z.string(), z.number().int())
+	}),
+	ingest: z.object({
+		accepted: z.number().int(),
+		refused: z.record(z.string(), z.number().int())
+	}),
+	rollup: z.object({
+		last5mAt: z.number().nullable(),
+		last1hAt: z.number().nullable(),
+		last1dAt: z.number().nullable(),
+		errors: z.number().int(),
+		dirty5m: z.number().int(),
+		dirty1h: z.number().int(),
+		dirty1d: z.number().int()
+	}),
+	retention: z.object({
+		lastRunAt: z.number().nullable(),
+		deleted: z.record(z.string(), z.number().int()),
+		purgedSeries: z.number().int()
+	}),
+	directory: z.object({
+		devices: z.number().int(),
+		lastRefreshAt: z.number().nullable()
+	})
+});
+var deviceHistoryCapability = {
+	name: "device-history",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/**
+		* The series a DEVICE has, and their span. `deviceId` is a flat top-level field
+		* on purpose: the generated device selector (and so the scope gate) only sees
+		* top-level ids, and a nested `subject.deviceId` would let a principal limited
+		* to one device read another's history. Node series are the admin-only
+		* `listNodeSeries` / `queryNode`.
+		*/
+		listSeries: method(z.object({ deviceId: z.number().int() }), z.array(SeriesInfoSchema).readonly()),
+		listNodeSeries: method(z.object({ nodeId: z.string().min(1) }), z.array(SeriesInfoSchema).readonly(), { auth: "admin" }),
+		/**
+		* One series (or every scope of it) at one resolution. `auto` picks the
+		* finest tier whose retention covers `from` and whose point count fits
+		* `maxPoints`; when even the coarsest tier does not fit, the newest
+		* `maxPoints` points are returned and `truncated` is true.
+		*/
+		query: method(z.object({
+			deviceId: z.number().int(),
+			...QueryWindowShape
+		}), QueryResultSchema),
+		queryNode: method(z.object({
+			nodeId: z.string().min(1),
+			...QueryWindowShape
+		}), QueryResultSchema, { auth: "admin" }),
+		/** Producer: declare (idempotent) a series key this addon owns: `addon:<callerAddonId>/<name>`. */
+		declareSeries: method(z.object({
+			name: z.string().regex(/^[a-z0-9-]+$/),
+			subjectKind: z.enum(["device", "node"]),
+			kind: DeviceHistoryKindSchema,
+			unit: z.string().optional(),
+			displayName: z.string().min(1),
+			ingest: z.enum(["points", "buckets"])
+		}), z.object({ key: z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Producer: points. Low rate: at most one per 10 s per series, sustained. */
+		record: method(z.object({ points: z.array(z.object({
+			key: z.string(),
+			subject: DeviceHistorySubjectSchema,
+			scope: z.string().default(""),
+			ts: z.number(),
+			value: z.number()
+		})).max(5e3) }), IngestResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Producer: CLOSED five-minute buckets. Idempotent upsert keyed (series, bucketStart). */
+		recordBuckets: method(z.object({ buckets: z.array(z.object({
+			key: z.string(),
+			subject: DeviceHistorySubjectSchema,
+			scope: z.string().default(""),
+			bucketStart: z.number(),
+			samples: z.number().int().positive(),
+			sum: z.number(),
+			min: z.number(),
+			max: z.number(),
+			last: z.number().nullable(),
+			lastTs: z.number().nullable()
+		})).max(5e3) }), IngestResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Per-device opt-out. This addon IS the authority: the switch stores nothing elsewhere (D62). */
+		getDeviceEnabled: method(z.object({ deviceId: z.number().int() }), z.object({ enabled: z.boolean() })),
+		setDeviceEnabled: method(z.object({
+			deviceId: z.number().int(),
+			enabled: z.boolean()
+		}), z.object({ enabled: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getStatus: method(z.object({}), DeviceHistoryStatusSchema, { auth: "admin" })
+	}
+};
 var DeviceCaStatusSchema = z.discriminatedUnion("state", [
 	z.object({ state: z.literal("absent") }),
 	z.object({
@@ -74293,6 +74528,66 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceHistory.declareSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.getDeviceEnabled": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.getStatus": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.listNodeSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.listSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.query": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.queryNode": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.record": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.recordBuckets": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.setDeviceEnabled": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -80763,6 +81058,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	deviceDiscoveryCapability,
 	deviceExportCapability,
 	deviceExtensionCapability,
+	deviceHistoryCapability,
 	deviceManagerCapability,
 	deviceOpsCapability,
 	deviceProviderCapability,
@@ -81346,6 +81642,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceHistory.getDeviceEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.listSeries": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.query": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.setDeviceEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-BW1LIHi0.js");
+const require_wal_maintenance = require("./wal-maintenance-ChzCPUi2.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-vhPZLYuA.mjs";
+import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-uQGuStFW.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DxJdci75.js");
-const require_device_ca = require("./device-ca-CKiqh2Iu.js");
+const require_dist = require("./dist-BCKOeWu_.js");
+const require_device_ca = require("./device-ca-BCyAPmIj.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -22,13 +22,13 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-BW1LIHi0.js");
+const require_wal_maintenance = require("./wal-maintenance-ChzCPUi2.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
 const require_agent_https_names = require("./agent-https-names-CpUSuP4w.js");
-const require_constants = require("./constants-BcNaVkvI.js");
+const require_constants = require("./constants-DfP8V3eX.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
@@ -36,7 +36,7 @@ const require_custom_action_registry = require("./custom-action-registry-Bf_Ynag
 const require_tls = require("./tls-C5IYg3V5.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-CQJNoqRK.js");
+const require_restore_archive = require("./restore-archive-DhHH7VQp.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $r as readinessKey, Cr as ReadinessRegistry, Dr as asJsonObject$1, F as METHOD_ACCESS_MAP, Fn as scopesAllowAddon, Gt as isArrayOutputSchema, In as scopesAllowDeviceCap, Ir as emitDownForOwnedCaps, Kt as isCollectionArrayMethod, Mn as resolveMethodAuth, N as LOG_LEVEL_RANK, Nr as createEvent$1, Or as asNumber, Rr as expandCapMethods, Rt as extractNestedAddonId, Sn as procedureAuthKey, Sr as RUNTIME_DEFAULTS, Xr as parseJsonObject, Xt as isVoidInput, Y as addonSettingsCapability, Yt as isObjectInput, Zr as parseJsonUnknown, Zt as kebabToCamel$1, _n as objectInputDeclaresRequiredDeviceId, br as DEVICE_STATUS_METHOD, ei as resolveCapMount, gn as objectInputDeclaresAddonId, gr as errMsg$1, kr as asString$1, li as EventCategory$1, ni as scopeKey, nn as lifecycleJobSchema, on as logLevelAtMost, qn as supportedRuntimes, sn as looseSchema, t as ALL_CAPABILITY_DEFINITIONS, vr as DATAPLANE_SECRET_HEADER$1, wr as ReadinessTimeoutError, yr as DEVICE_SETTINGS_CONTRIBUTION_METHODS } from "./dist-CXG6muCR.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-B-BTxeCj.mjs";
+import { $r as readinessKey, Cr as ReadinessRegistry, Dr as asJsonObject$1, F as METHOD_ACCESS_MAP, Fn as scopesAllowAddon, Gt as isArrayOutputSchema, In as scopesAllowDeviceCap, Ir as emitDownForOwnedCaps, Kt as isCollectionArrayMethod, Mn as resolveMethodAuth, N as LOG_LEVEL_RANK, Nr as createEvent$1, Or as asNumber, Rr as expandCapMethods, Rt as extractNestedAddonId, Sn as procedureAuthKey, Sr as RUNTIME_DEFAULTS, Xr as parseJsonObject, Xt as isVoidInput, Y as addonSettingsCapability, Yt as isObjectInput, Zr as parseJsonUnknown, Zt as kebabToCamel$1, _n as objectInputDeclaresRequiredDeviceId, br as DEVICE_STATUS_METHOD, ei as resolveCapMount, gn as objectInputDeclaresAddonId, gr as errMsg$1, kr as asString$1, li as EventCategory$1, ni as scopeKey, nn as lifecycleJobSchema, on as logLevelAtMost, qn as supportedRuntimes, sn as looseSchema, t as ALL_CAPABILITY_DEFINITIONS, vr as DATAPLANE_SECRET_HEADER$1, wr as ReadinessTimeoutError, yr as DEVICE_SETTINGS_CONTRIBUTION_METHODS } from "./dist-Bt8GTRHB.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-4IY98a_-.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -21,13 +21,13 @@ import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-vhPZLYuA.mjs";
+import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-uQGuStFW.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
 import { a as setProcessAgentHttpsNames, i as getProcessAgentHttpsNames, n as AGENT_HTTPS_NAMES_COLUMNS, r as AgentHttpsNames, t as AGENT_HTTPS_NAMES_COLLECTION } from "./agent-https-names-uetr4OQl.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-CttE77VF.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-B89vjrSm.mjs";
 import { $ as verifyAgentUiUnlockTicket, A as setProcessMeshCertificateRegistry, B as generateMeshCa, C as setProcessMeshTlsListenerState, D as RENEWAL_ABANDONED, E as MeshCertificateRegistry, F as requireProcessMeshCa, G as AGENT_DASHBOARD_ORIGINS_FIELD, H as issueMeshLeafForNode, I as caFingerprint, J as AGENT_UI_UNLOCK_VERSION, K as AGENT_UI_UNLOCK_DOMAIN, L as caFingerprintCompact, M as processMeshCrl, N as MeshCaKeeper, O as describeMeshLeaf, P as getProcessMeshCaState, Q as parseAgentDashboardOrigins, R as createMeshCsrPem, S as openMeshTlsWhenRevocationsLoaded, SystemConfigAddon, T as MESH_NODE_CERTIFICATES_COLUMNS, U as issueMeshLeafFromCsr, V as generateMeshKeyPair, W as loadMeshCa, X as isAllowedAgentDashboardReturnTo, Y as UnlockTicketJtiStore, Z as mintAgentUiUnlockTicket, _ as onProcessNodeRegistered, a as ServiceBroker, at as requestProcessMeshEnforcement, b as revokeMeshCertificate, c as enrollMeshNode, ct as setProcessMeshEnforcer, d as processJoinTokenJtiStore, dt as parseCidrList, et as MESH_AUTH_MODE_FIELD, f as verifyMeshJoinToken, ft as readCidrSetting, g as getProcessPeerLeaf, h as getProcessNodeMeshTransport, i as Errors, it as parseMeshAuthMode, j as MeshCrl, k as getProcessMeshCertificateRegistry, l as JoinTokenJtiStore, lt as createCidrMatcher, m as emitProcessNodeRegistered, n as MESH_TLS_PORT_HELLO_FIELD, nt as getProcessMeshAuthStatus, o as Transporters, ot as setProcessMeshAuthMode, p as dropProcessPeer, q as AGENT_UI_UNLOCK_TTL_MS, r as TlsTcpTransporter, rt as isMeshAuthMode, s as setProcessMeshTlsEnabler, st as setProcessMeshAuthStatusSource, tt as getProcessMeshAuthMode, u as mintMeshJoinToken, ut as normalizeIp, v as setProcessMeshPeerTransportLookup, w as MESH_NODE_CERTIFICATES_COLLECTION, x as getProcessMeshTlsListenerState, y as renewMeshCertificate, z as exportMeshPrivateKeyPem } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
@@ -35,7 +35,7 @@ import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as
 import { A as readTlsMode, B as CA_VALIDITY_DAYS, C as registerHttpsListener, D as UPLOADED_CA_FILE, E as prepareBootTls, F as loadTlsCert, G as DEFAULT_LAN_HTTP_PORT, H as MAX_LEAF_VALIDITY_DAYS, I as reissueTlsLeaf, J as bindPendingLanHttp, K as allFamiliesListenHost, L as CA_COMMON_NAME, M as writeExtraSans, N as writeTlsMode, O as readExtraSans, P as ensureTlsCert, R as collectCertIdentity, S as leafFingerprintOf, T as servedHttpsLeafFingerprint, U as SERVER_AUTH_OID, V as LEAF_RENEWAL_WINDOW_DAYS, W as evaluateExistingCert, X as readLanHttpState, Y as closeLanHttp, Z as registerLanHttpHandler, _ as regenerateCertificate, a as collectAgentNames, b as validateUploadedTls, c as installAgentHttps, d as isPrivateAddress, f as issueAgentHttpsLeaf, g as applyCertificateToListener, h as pinnedHttpsCaFingerprint, i as certificateNames, j as splitPemCertificates, k as readTlsAccessStatus, l as isContainerBridgeAddress, m as pemDigest, n as acceptAgentSans, o as createAgentHttpsRequest, p as loadAgentHttps, q as applyLanHttp, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isLocalOnlyHostname, v as revertToGeneratedCertificate, w as reloadHttpsListener, x as clearHttpsListener, y as storeUploadedCertificate, z as systemHostFacts } from "./tls-CpcGkeJV.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-D_wBL1OO.mjs";
+import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-Bh34W8J8.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";

package/dist/{restore-archive-D_wBL1OO.mjs → restore-archive-Bh34W8J8.mjs}

@@ -1,4 +1,4 @@
-import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-CXG6muCR.mjs";
+import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-Bt8GTRHB.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{restore-archive-CQJNoqRK.js → restore-archive-DhHH7VQp.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DxJdci75.js");
+const require_dist = require("./dist-BCKOeWu_.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{retired-settings-keys-EmDe11cP.mjs → retired-settings-keys-CmcEitC2.mjs}

@@ -1,4 +1,4 @@
-import { Dr as asJsonObject } from "./dist-CXG6muCR.mjs";
+import { Dr as asJsonObject } from "./dist-Bt8GTRHB.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-g1oifXxR.js → retired-settings-keys-u3Wwkdrq.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DxJdci75.js");
+const require_dist = require("./dist-BCKOeWu_.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.431",
+  "version": "1.2.432",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",