@camstack/system 1.2.433 → 1.2.434

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-B50jAU5C.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CBLvq2oj.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");
@@ -192,6 +192,48 @@ function withAppConnectionCustomEndpoints(detected, state) {
 	const extra = state.custom.filter((c) => wanted.has(c.baseUrl) && !known.has(c.baseUrl)).map(customEndpoint);
 	return [...detected, ...extra];
 }
+/** Where a twin sorts relative to its plain-HTTP row: straight after it. */
+var HTTPS_TWIN_PRIORITY_STEP = .5;
+/**
+* The HTTPS counterpart of every LAN address advertised over plain HTTP
+* (D859): `http://<lan>:<httpPort>` gains `https://<lan>:<httpsPort>`, the hub's
+* TLS listener, as its own row straight after it. The twin is an ordinary
+* detected LAN row — ticked, unticked and flagged like any other, on by default
+* (a LAN row is an automatic app connection). A phone that does not trust the
+* hub's local CA fails that candidate in the race it already runs; one that
+* does reaches it. Only the app-connection palette and the table carry twins:
+* the palette `internal` and `publicEndpoint` resolve over never does, so those
+* roles keep their answer. Rows already on https (LAN HTTP off), the public
+* tunnel, the mesh, custom addresses and loopback have no twin.
+*/
+function withLanHttpsCounterparts(palette, httpsPort) {
+	const known = new Set(palette.map((e) => e.baseUrl));
+	const out = [];
+	for (const endpoint of palette) {
+		out.push(endpoint);
+		if (endpoint.kind !== "lan-ipv4" && endpoint.kind !== "lan-ipv6") continue;
+		const twin = httpsTwinOf(endpoint, httpsPort);
+		if (twin === null || known.has(twin.baseUrl)) continue;
+		known.add(twin.baseUrl);
+		out.push(twin);
+	}
+	return out;
+}
+function httpsTwinOf(endpoint, httpsPort) {
+	let parsed;
+	try {
+		parsed = new URL(endpoint.baseUrl);
+	} catch {
+		return null;
+	}
+	if (parsed.protocol !== "http:") return null;
+	return {
+		...endpoint,
+		label: `${endpoint.label} (HTTPS)`,
+		baseUrl: `https://${parsed.hostname}:${httpsPort}`,
+		priority: endpoint.priority + HTTPS_TWIN_PRIORITY_STEP
+	};
+}
 /** Every role's answer — the resolvers from `@camstack/types`, nothing else. */
 function resolveRoles(state, appPalette, httpsPalette) {
 	return require_dist.resolveHubAddressRoles(withAppConnectionCustomEndpoints(appPalette, state), httpsPalette, state.flags);
@@ -597,9 +639,13 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	async palettes() {
 		const port = (await this.resolveAdvertisedListenPort(null)).port;
 		await this.reconcileMeshEndpoint();
+		const http = this.endpointsNow(false, false, "http", port);
+		const https = this.endpointsNow(false, false, "https", port);
 		return {
-			http: this.endpointsNow(false, false, "http", port),
-			https: this.endpointsNow(false, false, "https", port)
+			http,
+			https,
+			httpWithTwins: withLanHttpsCounterparts(http, port),
+			httpsWithTwins: withLanHttpsCounterparts(https, port)
 		};
 	}
 	/** The stored address book, normalised against what is detected now. */
@@ -612,11 +658,11 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	}
 	/** `getAddresses`: the Addresses table and every role's answer. */
 	async addressBook(scheme) {
-		const { http, https } = await this.palettes();
-		const state = this.addressState([...http, ...https]);
+		const { http, https, httpWithTwins, httpsWithTwins } = await this.palettes();
+		const state = this.addressState([...httpWithTwins, ...httpsWithTwins]);
 		const httpsPort = (await this.resolveAdvertisedListenPort(null)).port;
 		return buildAddressBook(state, {
-			rowsPalette: scheme === "http" ? http : https,
+			rowsPalette: scheme === "http" ? httpWithTwins : httpsWithTwins,
 			httpsPalette: https,
 			appLink: appLinkEndpoint(),
 			appLinkHub: require_dist.pickAppLinkHub(https),
@@ -628,8 +674,8 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	* naming an address in no row becomes a custom address in the same write).
 	*/
 	async changeAddressBook(change) {
-		const { http, https } = await this.palettes();
-		const detected = [...http, ...https];
+		const { httpWithTwins, httpsWithTwins } = await this.palettes();
+		const detected = [...httpWithTwins, ...httpsWithTwins];
 		const detectedUrls = new Set(detected.map((e) => e.baseUrl));
 		const changed = change(this.addressState(detected), {
 			detectedUrls,
@@ -708,7 +754,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	*/
 	async buildAdvertisedEndpoints(includeLoopback, ipv4Only, scheme, httpsPort) {
 		await this.reconcileMeshEndpoint();
-		const detected = this.endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort);
+		const detected = withLanHttpsCounterparts(this.endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort), httpsPort);
 		return withAppConnectionCustomEndpoints(detected, this.addressState(detected));
 	}
 	/**

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { Fn as resolveNotificationTapAddress, Kt as isAppLinkBase, M as HUB_MDNS_SERVICE_TYPE, Mn as resolveHubAddressRoles, N as HUB_MDNS_TXT_KEYS, On as resolveAppConnections, Qn as validateCustomAddress, Yt as isDefaultAppConnectionEndpoint, an as localNetworkCapability, di as EventCategory, dt as checkRoleAddress, l as CAMSTACK_APP_LINK_ORIGIN, xn as pickAppLinkHub, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
-import { C as DEFAULT_LAN_HTTP_PORT, O as readLanHttpState, T as applyLanHttp, a as storeUploadedCertificate, b as ensureTlsCert, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, m as readExtraSans, n as applyCertificateToListener, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans } from "../../hub-mdns-ciao-8_Ed1Za5.mjs";
+import { $n as validateCustomAddress, In as resolveNotificationTapAddress, M as HUB_MDNS_SERVICE_TYPE, N as HUB_MDNS_TXT_KEYS, Nn as resolveHubAddressRoles, Sn as pickAppLinkHub, Xt as isDefaultAppConnectionEndpoint, br as BaseAddon, fi as EventCategory, ft as checkRoleAddress, kn as resolveAppConnections, l as CAMSTACK_APP_LINK_ORIGIN, on as localNetworkCapability, qt as isAppLinkBase } from "../../dist-CYcBqnXk.mjs";
+import { C as DEFAULT_LAN_HTTP_PORT, O as readLanHttpState, T as applyLanHttp, a as storeUploadedCertificate, b as ensureTlsCert, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, m as readExtraSans, n as applyCertificateToListener, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans } from "../../hub-mdns-ciao-DJRwtlA8.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os from "node:os";
@@ -189,6 +189,48 @@ function withAppConnectionCustomEndpoints(detected, state) {
 	const extra = state.custom.filter((c) => wanted.has(c.baseUrl) && !known.has(c.baseUrl)).map(customEndpoint);
 	return [...detected, ...extra];
 }
+/** Where a twin sorts relative to its plain-HTTP row: straight after it. */
+var HTTPS_TWIN_PRIORITY_STEP = .5;
+/**
+* The HTTPS counterpart of every LAN address advertised over plain HTTP
+* (D859): `http://<lan>:<httpPort>` gains `https://<lan>:<httpsPort>`, the hub's
+* TLS listener, as its own row straight after it. The twin is an ordinary
+* detected LAN row — ticked, unticked and flagged like any other, on by default
+* (a LAN row is an automatic app connection). A phone that does not trust the
+* hub's local CA fails that candidate in the race it already runs; one that
+* does reaches it. Only the app-connection palette and the table carry twins:
+* the palette `internal` and `publicEndpoint` resolve over never does, so those
+* roles keep their answer. Rows already on https (LAN HTTP off), the public
+* tunnel, the mesh, custom addresses and loopback have no twin.
+*/
+function withLanHttpsCounterparts(palette, httpsPort) {
+	const known = new Set(palette.map((e) => e.baseUrl));
+	const out = [];
+	for (const endpoint of palette) {
+		out.push(endpoint);
+		if (endpoint.kind !== "lan-ipv4" && endpoint.kind !== "lan-ipv6") continue;
+		const twin = httpsTwinOf(endpoint, httpsPort);
+		if (twin === null || known.has(twin.baseUrl)) continue;
+		known.add(twin.baseUrl);
+		out.push(twin);
+	}
+	return out;
+}
+function httpsTwinOf(endpoint, httpsPort) {
+	let parsed;
+	try {
+		parsed = new URL(endpoint.baseUrl);
+	} catch {
+		return null;
+	}
+	if (parsed.protocol !== "http:") return null;
+	return {
+		...endpoint,
+		label: `${endpoint.label} (HTTPS)`,
+		baseUrl: `https://${parsed.hostname}:${httpsPort}`,
+		priority: endpoint.priority + HTTPS_TWIN_PRIORITY_STEP
+	};
+}
 /** Every role's answer — the resolvers from `@camstack/types`, nothing else. */
 function resolveRoles(state, appPalette, httpsPalette) {
 	return resolveHubAddressRoles(withAppConnectionCustomEndpoints(appPalette, state), httpsPalette, state.flags);
@@ -594,9 +636,13 @@ var LocalNetworkAddon = class extends BaseAddon {
 	async palettes() {
 		const port = (await this.resolveAdvertisedListenPort(null)).port;
 		await this.reconcileMeshEndpoint();
+		const http = this.endpointsNow(false, false, "http", port);
+		const https = this.endpointsNow(false, false, "https", port);
 		return {
-			http: this.endpointsNow(false, false, "http", port),
-			https: this.endpointsNow(false, false, "https", port)
+			http,
+			https,
+			httpWithTwins: withLanHttpsCounterparts(http, port),
+			httpsWithTwins: withLanHttpsCounterparts(https, port)
 		};
 	}
 	/** The stored address book, normalised against what is detected now. */
@@ -609,11 +655,11 @@ var LocalNetworkAddon = class extends BaseAddon {
 	}
 	/** `getAddresses`: the Addresses table and every role's answer. */
 	async addressBook(scheme) {
-		const { http, https } = await this.palettes();
-		const state = this.addressState([...http, ...https]);
+		const { http, https, httpWithTwins, httpsWithTwins } = await this.palettes();
+		const state = this.addressState([...httpWithTwins, ...httpsWithTwins]);
 		const httpsPort = (await this.resolveAdvertisedListenPort(null)).port;
 		return buildAddressBook(state, {
-			rowsPalette: scheme === "http" ? http : https,
+			rowsPalette: scheme === "http" ? httpWithTwins : httpsWithTwins,
 			httpsPalette: https,
 			appLink: appLinkEndpoint(),
 			appLinkHub: pickAppLinkHub(https),
@@ -625,8 +671,8 @@ var LocalNetworkAddon = class extends BaseAddon {
 	* naming an address in no row becomes a custom address in the same write).
 	*/
 	async changeAddressBook(change) {
-		const { http, https } = await this.palettes();
-		const detected = [...http, ...https];
+		const { httpWithTwins, httpsWithTwins } = await this.palettes();
+		const detected = [...httpWithTwins, ...httpsWithTwins];
 		const detectedUrls = new Set(detected.map((e) => e.baseUrl));
 		const changed = change(this.addressState(detected), {
 			detectedUrls,
@@ -705,7 +751,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 	*/
 	async buildAdvertisedEndpoints(includeLoopback, ipv4Only, scheme, httpsPort) {
 		await this.reconcileMeshEndpoint();
-		const detected = this.endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort);
+		const detected = withLanHttpsCounterparts(this.endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort), httpsPort);
 		return withAppConnectionCustomEndpoints(detected, this.addressState(detected));
 	}
 	/**

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { sn as logDestinationCapability, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { br as BaseAddon, cn as logDestinationCapability } from "../../dist-CYcBqnXk.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { En as reducePoints, Fr as createEvent, Ht as foldSnapshotByFunction, di as EventCategory, kn as resolveBucketMs, pn as metricsProviderCapability, vr as errMsg, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { An as resolveBucketMs, Dn as reducePoints, Ir as createEvent, Ut as foldSnapshotByFunction, br as BaseAddon, fi as EventCategory, mn as metricsProviderCapability, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";
 import { platform } from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { Cn as platformProbeCapability, Nt as enumerateInferenceDevices, di as EventCategory, vr as errMsg, yr as BaseAddon, zn as scoreRuntimes, zr as emitReadiness } from "../../dist-DJnlnL7P.mjs";
+import { Bn as scoreRuntimes, Br as emitReadiness, Pt as enumerateInferenceDevices, br as BaseAddon, fi as EventCategory, wn as platformProbeCapability, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { di as EventCategory, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { br as BaseAddon, fi as EventCategory } from "../../dist-CYcBqnXk.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Et as deriveBatteryPresence, Hn as snapshotCapability, Jn as streamQualityLabel, Xr as nodePin, _r as DeviceType, di as EventCategory, fn as memoizePinnedFfmpeg, hr as DeviceFeature, nt as bareAddonId, rt as batteryCapability, s as BatteryStatusSchema, vr as errMsg, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { Dt as deriveBatteryPresence, Un as snapshotCapability, Yn as streamQualityLabel, Zr as nodePin, br as BaseAddon, fi as EventCategory, gr as DeviceFeature, it as batteryCapability, pn as memoizePinnedFfmpeg, rt as bareAddonId, s as BatteryStatusSchema, vr as DeviceType, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Kn as storageProviderCapability, Vt as filesystemBrowseCapability, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { Ht as filesystemBrowseCapability, br as BaseAddon, qn as storageProviderCapability } from "../../dist-CYcBqnXk.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-CPLvZbzA.js");
+const require_wal_maintenance = require("../../wal-maintenance-LZYd8iT-.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-Bc38yI3r.mjs";
+import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-DgLLPK14.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-DJBQkZok.js");
-const require_wal_maintenance = require("../../wal-maintenance-CPLvZbzA.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-CEiCaI_j.js");
+const require_wal_maintenance = require("../../wal-maintenance-LZYd8iT-.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { St as databaseSnapshotCapability, _ as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, b as DATA_STORE_DATABASES, nt as bareAddonId, tr as vectorStoreCapability, v as DATABASE_SNAPSHOT_SUFFIX, vr as errMsg, wr as RUNTIME_DEFAULTS, xt as dataStoreProviderCapability, y as DATABASE_SNAPSHOT_TIMEOUT_MS, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
-import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-CAWHWDwy.mjs";
-import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-Bc38yI3r.mjs";
+import { Ct as databaseSnapshotCapability, St as dataStoreProviderCapability, Tr as RUNTIME_DEFAULTS, _ as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, b as DATA_STORE_DATABASES, br as BaseAddon, nr as vectorStoreCapability, rt as bareAddonId, v as DATABASE_SNAPSHOT_SUFFIX, y as DATABASE_SNAPSHOT_TIMEOUT_MS, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-CyDdyjLP.mjs";
+import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-DgLLPK14.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Bn as settingsStoreCapability, Cr as REDACTED_SECRET, G as StorageCleanupJobSchema, Gt as gbToBytes, I as LegacyStorageLocationDefaultSchema, J as StorageMigrationJobSchema, K as StorageLocationModeSchema, Lt as evictionPolicyOfLocation, Nn as resolveLocationMode, Nr as collectSecretConfigKeys, Qr as parseJsonObject, Un as storageCapability, Wn as storageMigrationCapability, Xt as isLocationEnabled, ai as secretTreeFromPaths, di as EventCategory, dn as mayWriteToLocation, mn as modeMayWrite, nr as withLocationMode, q as StorageLocationTypeSchema, qr as isSecretMarker, ri as resolveSecretMarkers, rn as legacyModeOf, ui as transformSecretWrite, un as mayReadLocation, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { $r as parseJsonObject, Gn as storageMigrationCapability, I as LegacyStorageLocationDefaultSchema, J as StorageLocationTypeSchema, Jr as isSecretMarker, K as StorageCleanupJobSchema, Kt as gbToBytes, Pn as resolveLocationMode, Pr as collectSecretConfigKeys, Rt as evictionPolicyOfLocation, Vn as settingsStoreCapability, Wn as storageCapability, Y as StorageMigrationJobSchema, Zt as isLocationEnabled, br as BaseAddon, di as transformSecretWrite, dn as mayReadLocation, fi as EventCategory, fn as mayWriteToLocation, hn as modeMayWrite, ii as resolveSecretMarkers, in as legacyModeOf, oi as secretTreeFromPaths, q as StorageLocationModeSchema, rr as withLocationMode, wr as REDACTED_SECRET } from "../../dist-CYcBqnXk.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
-const require_x509_es = require("../../x509.es-Dzl0BbmG.js");
-const require_agent_https = require("../../agent-https-CHZTxK-q.js");
-const require_constants$8 = require("../../constants-Ah3T_KAW.js");
+const require_x509_es = require("../../x509.es-r7Ht1thA.js");
+const require_agent_https = require("../../agent-https-BZIwS4xF.js");
+const require_constants$8 = require("../../constants-CuOfMdYe.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -408,6 +408,15 @@ function parsePayloadEs256(value) {
 }
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
+/**
+* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
+*
+* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
+* signs node leaves (CN = nodeID) and join-token JWS (ES256). Issuance uses
+* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
+* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
+* the pinned range already shipping).
+*/
 require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
 var MS_PER_DAY = 864e5;
 /** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
@@ -458,7 +467,7 @@ async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${require_constants$8.MESH_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: require_x509_es.backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + require_constants$8.MESH_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
 		signingAlgorithm: MESH_SIGNING_ALGORITHM,
@@ -509,7 +518,7 @@ async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
 			serialNumber,
 			subject: `CN=${cn}`,
 			issuer: ca.cert.subject,
-			notBefore: now,
+			notBefore: require_x509_es.backdatedNotBefore(now),
 			notAfter,
 			publicKey: csr.publicKey,
 			signingKey: ca.privateKey,
@@ -88439,12 +88448,18 @@ function isHttpUrl(value) {
 		return false;
 	}
 }
-/** The hub CA must be a self-signed CA certificate, valid now. */
+/**
+* Clock skew tolerated between the hub that minted a CA and this agent. X.509 dates have
+* one-second resolution and a fresh CA's notBefore is the hub's "now", so an agent whose clock
+* is even a moment behind would otherwise refuse a brand-new CA. Same bound as the offer `iat`.
+*/
+var CA_CLOCK_SKEW_MS = 6e4;
+/** The hub CA must be a self-signed CA certificate, valid now (give or take the skew). */
 function readCaCertificate(pem, nowMs) {
 	try {
 		const cert = new node_crypto.X509Certificate(pem);
 		if (!cert.ca || !cert.verify(cert.publicKey)) return null;
-		if (Date.parse(cert.validTo) <= nowMs || Date.parse(cert.validFrom) > nowMs) return null;
+		if (Date.parse(cert.validTo) <= nowMs || Date.parse(cert.validFrom) > nowMs + CA_CLOCK_SKEW_MS) return null;
 		return cert;
 	} catch {
 		return null;

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,9 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Hr as hydrateSchema, Ir as customAction, Kr as isSecretClear, Lr as defineCustomActions, Yr as makeSecretMarker, oi as secretTreeFromSchema, qr as isSecretMarker, ui as transformSecretWrite, vr as errMsg, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { Jr as isSecretMarker, Lr as customAction, Rr as defineCustomActions, Ur as hydrateSchema, Xr as makeSecretMarker, br as BaseAddon, di as transformSecretWrite, qr as isSecretClear, si as secretTreeFromSchema, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
-import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-CAjSsrkk.mjs";
-import { A as AgentHttpsNames, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, d as isPrivateAddress, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, u as isLocalOnlyHostname } from "../../agent-https-DtRU9A7I.mjs";
-import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-Cg9ve13y.mjs";
+import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-CDvj67p1.mjs";
+import { A as AgentHttpsNames, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, d as isPrivateAddress, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, u as isLocalOnlyHostname } from "../../agent-https-B8lKYVtU.mjs";
+import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-CrMPWOug.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createHmac, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";
@@ -399,6 +399,15 @@ function parsePayloadEs256(value) {
 }
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
+/**
+* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
+*
+* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
+* signs node leaves (CN = nodeID) and join-token JWS (ES256). Issuance uses
+* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
+* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
+* the pinned range already shipping).
+*/
 cryptoProvider.set(webcrypto);
 var MS_PER_DAY = 864e5;
 /** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
@@ -449,7 +458,7 @@ async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
 	const cert = await X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${MESH_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + MESH_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
 		signingAlgorithm: MESH_SIGNING_ALGORITHM,
@@ -500,7 +509,7 @@ async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
 			serialNumber,
 			subject: `CN=${cn}`,
 			issuer: ca.cert.subject,
-			notBefore: now,
+			notBefore: backdatedNotBefore(now),
 			notAfter,
 			publicKey: csr.publicKey,
 			signingKey: ca.privateKey,
@@ -88429,12 +88438,18 @@ function isHttpUrl(value) {
 		return false;
 	}
 }
-/** The hub CA must be a self-signed CA certificate, valid now. */
+/**
+* Clock skew tolerated between the hub that minted a CA and this agent. X.509 dates have
+* one-second resolution and a fresh CA's notBefore is the hub's "now", so an agent whose clock
+* is even a moment behind would otherwise refuse a brand-new CA. Same bound as the offer `iat`.
+*/
+var CA_CLOCK_SKEW_MS = 6e4;
+/** The hub CA must be a self-signed CA certificate, valid now (give or take the skew). */
 function readCaCertificate(pem, nowMs) {
 	try {
 		const cert = new X509Certificate(pem);
 		if (!cert.ca || !cert.verify(cert.publicKey)) return null;
-		if (Date.parse(cert.validTo) <= nowMs || Date.parse(cert.validFrom) > nowMs) return null;
+		if (Date.parse(cert.validTo) <= nowMs || Date.parse(cert.validFrom) > nowMs + CA_CLOCK_SKEW_MS) return null;
 		return cert;
 	} catch {
 		return null;

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { sn as logDestinationCapability, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { br as BaseAddon, cn as logDestinationCapability } from "../../dist-CYcBqnXk.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-BgJWQMjr.js → composition-sources-B7R1oQnY.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-C6Yvfhpq.js");
+const require_dist = require("./dist-CCH3XPqO.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-8-cpAt1c.mjs → composition-sources-CqrDyHM1.mjs}

@@ -1,4 +1,4 @@
-import { dr as compositionSourceKey, vr as errMsg } from "./dist-DJnlnL7P.mjs";
+import { fr as compositionSourceKey, yr as errMsg } from "./dist-CYcBqnXk.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-Cg9ve13y.mjs → constants-CrMPWOug.mjs}

@@ -1,4 +1,4 @@
-import { Mr as buildSecretRef } from "./dist-DJnlnL7P.mjs";
+import { Nr as buildSecretRef } from "./dist-CYcBqnXk.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{constants-Ah3T_KAW.js → constants-CuOfMdYe.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-C6Yvfhpq.js");
+const require_dist = require("./dist-CCH3XPqO.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**