@camstack/system 1.2.433 → 1.2.434

package/dist/{device-ca-DUrcTW5h.mjs → device-ca-CDjGQQPd.mjs}

@@ -1,5 +1,5 @@
-import { E as DEVICE_SAN_USER_PREFIX, Mr as buildSecretRef, T as DEVICE_SAN_CREDENTIAL_PREFIX } from "./dist-DJnlnL7P.mjs";
-import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CAjSsrkk.mjs";
+import { E as DEVICE_SAN_USER_PREFIX, Nr as buildSecretRef, T as DEVICE_SAN_CREDENTIAL_PREFIX } from "./dist-CYcBqnXk.mjs";
+import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CDvj67p1.mjs";
 import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**
@@ -126,6 +126,16 @@ async function loadJwtSigningKey(deps) {
 }
 //#endregion
 //#region src/auth/device-ca.ts
+/**
+* Device CA (D855) — the THIRD certificate authority, distinct from the HTTPS
+* local CA (`tls/cert-issue.ts`, RSA) and the mesh CA
+* (`kernel/moleculer/mesh-mtls/mesh-ca.ts`). EC P-256, key in the keychain
+* (owner `system`), certificate persisted like `cluster.meshCa`.
+*
+* It signs ONE kind of leaf: a device credential. The device generated the key
+* pair; the hub only ever sees the public half (an SPKI). Same library and
+* WebCrypto path as the other two CAs, same pinned `@peculiar/x509`.
+*/
 cryptoProvider.set(webcrypto);
 var MS_PER_DAY = 864e5;
 var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
@@ -164,7 +174,7 @@ async function generateDeviceCa(now = /* @__PURE__ */ new Date()) {
 	const cert = await X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
 		signingAlgorithm: SIGNING_ALGORITHM,
@@ -204,7 +214,7 @@ async function rebuildDeviceCaCertificate(keyPem) {
 	const cert = await X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys: {
 			privateKey,
@@ -234,8 +244,9 @@ async function importDevicePublicKey(spki) {
 */
 async function issueDeviceLeaf(ca, input) {
 	const publicKey = await importDevicePublicKey(input.publicKeySpki);
-	const notBefore = input.now ?? /* @__PURE__ */ new Date();
-	const notAfter = new Date(notBefore.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
+	const issuedAt = input.now ?? /* @__PURE__ */ new Date();
+	const notBefore = backdatedNotBefore(issuedAt);
+	const notAfter = new Date(issuedAt.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
 	const serialNumber = freshSerial();
 	const extensions = [
 		new BasicConstraintsExtension(false, void 0, true),

package/dist/{device-ca-NNP4Jz0P.js → device-ca-D21ZP00q.js}

@@ -1,5 +1,5 @@
-const require_dist = require("./dist-C6Yvfhpq.js");
-const require_x509_es = require("./x509.es-Dzl0BbmG.js");
+const require_dist = require("./dist-CCH3XPqO.js");
+const require_x509_es = require("./x509.es-r7Ht1thA.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**
@@ -126,6 +126,16 @@ async function loadJwtSigningKey(deps) {
 }
 //#endregion
 //#region src/auth/device-ca.ts
+/**
+* Device CA (D855) — the THIRD certificate authority, distinct from the HTTPS
+* local CA (`tls/cert-issue.ts`, RSA) and the mesh CA
+* (`kernel/moleculer/mesh-mtls/mesh-ca.ts`). EC P-256, key in the keychain
+* (owner `system`), certificate persisted like `cluster.meshCa`.
+*
+* It signs ONE kind of leaf: a device credential. The device generated the key
+* pair; the hub only ever sees the public half (an SPKI). Same library and
+* WebCrypto path as the other two CAs, same pinned `@peculiar/x509`.
+*/
 require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
 var MS_PER_DAY = 864e5;
 var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
@@ -164,7 +174,7 @@ async function generateDeviceCa(now = /* @__PURE__ */ new Date()) {
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: require_x509_es.backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
 		signingAlgorithm: SIGNING_ALGORITHM,
@@ -204,7 +214,7 @@ async function rebuildDeviceCaCertificate(keyPem) {
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: require_x509_es.backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys: {
 			privateKey,
@@ -234,8 +244,9 @@ async function importDevicePublicKey(spki) {
 */
 async function issueDeviceLeaf(ca, input) {
 	const publicKey = await importDevicePublicKey(input.publicKeySpki);
-	const notBefore = input.now ?? /* @__PURE__ */ new Date();
-	const notAfter = new Date(notBefore.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
+	const issuedAt = input.now ?? /* @__PURE__ */ new Date();
+	const notBefore = require_x509_es.backdatedNotBefore(issuedAt);
+	const notAfter = new Date(issuedAt.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
 	const serialNumber = freshSerial();
 	const extensions = [
 		new require_x509_es.BasicConstraintsExtension(false, void 0, true),

package/dist/{dist-C6Yvfhpq.js → dist-CCH3XPqO.js}

@@ -718,7 +718,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep--g-h2_c_.mjs
+//#region ../types/dist/sleep-DAX0-2v9.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -9768,6 +9768,12 @@ function scopesAllowDeviceCap(scopes, access) {
 function scopesAllowAddon(scopes, addonId, access) {
 	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
 }
+zod.z.enum(["new-session", "step-up"]);
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = zod.z.discriminatedUnion("kind", [zod.z.object({ kind: zod.z.literal("native") }), zod.z.object({
+	kind: zod.z.literal("browser"),
+	startPath: zod.z.string().startsWith("/")
+})]);
 /**
 * Device certificates (D855) — the wire contract shared by the hub, the admin
 * UI and the native viewer.
@@ -9966,7 +9972,9 @@ zod.z.object({
 	signature: zod.z.literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: zod.z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: zod.z.array(zod.z.enum(["native", "web"]))
+	clients: zod.z.array(zod.z.enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 /**
 * What an expression's named bindings READ from.
@@ -41167,7 +41175,13 @@ var RedirectLoginMethodSchema = zod.z.object({
 	* `beginExternalLink` offer exactly the redirect methods that set this,
 	* whatever their id. Absent / false — a login button only.
 	*/
-	linkable: zod.z.boolean().optional()
+	linkable: zod.z.boolean().optional(),
+	/**
+	* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+	* when the route understands the app flow query (`app=1&code_challenge=…`),
+	* `null`/absent when there is no app path - the app hides the method.
+	*/
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A Module-Federation widget the login page mounts for an in-page
@@ -41186,7 +41200,9 @@ var WidgetLoginMethodSchema = zod.z.object({
 	bundle: zod.z.string(),
 	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 	remote: WidgetRemoteSchema,
-	stage: LoginStageEnum
+	stage: LoginStageEnum,
+	/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A declarative WebAuthn ceremony the shell renders natively (no remote
@@ -41204,7 +41220,9 @@ var PasskeyLoginMethodSchema = zod.z.object({
 	/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 	rpId: zod.z.string(),
 	/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-	origin: zod.z.string().nullable()
+	origin: zod.z.string().nullable(),
+	/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
 var LoginMethodContributionSchema = zod.z.discriminatedUnion("kind", [
@@ -54140,7 +54158,20 @@ var SsoBridgeClaimsSchema = zod.z.object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: zod.z.string().optional()
+	browserBinding: zod.z.string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: zod.z.object({
+		codeChallenge: zod.z.string(),
+		state: zod.z.string(),
+		purpose: zod.z.enum(["new-session", "step-up"]),
+		redirect: zod.z.string()
+	}).optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -85862,6 +85893,12 @@ Object.defineProperty(exports, "ScopedTokenSchema", {
 		return ScopedTokenSchema;
 	}
 });
+Object.defineProperty(exports, "SsoBridgeClaimsSchema", {
+	enumerable: true,
+	get: function() {
+		return SsoBridgeClaimsSchema;
+	}
+});
 Object.defineProperty(exports, "StorageCleanupJobSchema", {
 	enumerable: true,
 	get: function() {

package/dist/{dist-DJnlnL7P.mjs → dist-CYcBqnXk.mjs}

@@ -718,7 +718,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep--g-h2_c_.mjs
+//#region ../types/dist/sleep-DAX0-2v9.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -9768,6 +9768,12 @@ function scopesAllowDeviceCap(scopes, access) {
 function scopesAllowAddon(scopes, addonId, access) {
 	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
 }
+z.enum(["new-session", "step-up"]);
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = z.discriminatedUnion("kind", [z.object({ kind: z.literal("native") }), z.object({
+	kind: z.literal("browser"),
+	startPath: z.string().startsWith("/")
+})]);
 /**
 * Device certificates (D855) — the wire contract shared by the hub, the admin
 * UI and the native viewer.
@@ -9966,7 +9972,9 @@ z.object({
 	signature: z.literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: z.array(z.enum(["native", "web"]))
+	clients: z.array(z.enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 /**
 * What an expression's named bindings READ from.
@@ -41167,7 +41175,13 @@ var RedirectLoginMethodSchema = z.object({
 	* `beginExternalLink` offer exactly the redirect methods that set this,
 	* whatever their id. Absent / false — a login button only.
 	*/
-	linkable: z.boolean().optional()
+	linkable: z.boolean().optional(),
+	/**
+	* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+	* when the route understands the app flow query (`app=1&code_challenge=…`),
+	* `null`/absent when there is no app path - the app hides the method.
+	*/
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A Module-Federation widget the login page mounts for an in-page
@@ -41186,7 +41200,9 @@ var WidgetLoginMethodSchema = z.object({
 	bundle: z.string(),
 	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 	remote: WidgetRemoteSchema,
-	stage: LoginStageEnum
+	stage: LoginStageEnum,
+	/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A declarative WebAuthn ceremony the shell renders natively (no remote
@@ -41204,7 +41220,9 @@ var PasskeyLoginMethodSchema = z.object({
 	/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 	rpId: z.string(),
 	/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-	origin: z.string().nullable()
+	origin: z.string().nullable(),
+	/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
 var LoginMethodContributionSchema = z.discriminatedUnion("kind", [
@@ -54140,7 +54158,20 @@ var SsoBridgeClaimsSchema = z.object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: z.string().optional()
+	browserBinding: z.string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: z.object({
+		codeChallenge: z.string(),
+		state: z.string(),
+		purpose: z.enum(["new-session", "step-up"]),
+		redirect: z.string()
+	}).optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -85514,4 +85545,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { alertsCapability as $, vectorDimFromBase64 as $n, parseJsonUnknown as $r, kebabToCamel as $t, FieldClaimModeSchema as A, resolveCoreBlockEntry as An, asNumber as Ar, deviceManagerCapability as At, RECORDING_SOURCE_CAMSTACK_ADDON as B, settingsStoreCapability as Bn, expandCapMethods as Br, extractNestedAddonId as Bt, DEVICE_ENROLLMENT_TTL_MS as C, platformProbeCapability as Cn, REDACTED_SECRET as Cr, declarationOwnerNodeId as Ct, DeclaredDevices as D, replacedFieldKeys as Dn, SECRET_CLEAR as Dr, describeComposableCaps as Dt, DEVICE_SAN_USER_PREFIX as E, reducePoints as En, ReadinessTimeoutError as Er, deriveBatteryPresence as Et, LOG_LEVEL_RANK as F, resolveNotificationTapAddress as Fn, createEvent as Fr, enumerateSchemaFields as Ft, StorageCleanupJobSchema as G, storageOccupancyCapability as Gn, isKeychainStoredField as Gr, gbToBytes as Gt, STORAGE_ACCESS_FALLBACK as H, snapshotCapability as Hn, hydrateSchema as Hr, foldSnapshotByFunction as Ht, LegacyStorageLocationDefaultSchema as I, runtimeStatePolicyFor as In, customAction as Ir, evaluateCompositionField as It, StorageMigrationJobSchema as J, streamQualityLabel as Jn, isSecretMarkerLike as Jr, isCollectionArrayMethod as Jt, StorageLocationModeSchema as K, storageProviderCapability as Kn, isSecretClear as Kr, isAppLinkBase as Kt, METHOD_ACCESS_MAP as L, scopesAllowAddon as Ln, defineCustomActions as Lr, evictionPolicyOfLocation as Lt, HUB_MDNS_SERVICE_TYPE as M, resolveHubAddressRoles as Mn, buildSecretRef as Mr, deviceStatusCapability as Mt, HUB_MDNS_TXT_KEYS as N, resolveLocationMode as Nn, collectSecretConfigKeys as Nr, enumerateInferenceDevices as Nt, DeviceStatusSchema as O, resolveAppConnections as On, WELL_KNOWN_TAB_MAP as Or, deviceCredentialsCapability as Ot, KEYCHAIN_RESET_TRIGGER_ACTOR as P, resolveMethodAuth as Pn, collectZodSecretPaths as Pr, enumerateItemArrayFields as Pt, addonWidgetsCapability as Q, validateCustomAddress as Qn, parseJsonObject as Qr, isVoidInput as Qt, MINUTES_PER_DAY as R, scopesAllowDeviceCap as Rn, emitDownForOwnedCaps as Rr, expandContainer as Rt, DERIVED_CAMERA_SILENCED_CAP_NAMES as S, planComposition as Sn, DEVICE_STATUS_METHOD as Sr, databaseSnapshotCapability as St, DEVICE_SAN_CREDENTIAL_PREFIX as T, ptzAutotrackCapability as Tn, ReadinessRegistry as Tr, defineExtensionSlotProvider as Tt, STREAM_PROFILE_META as U, storageCapability as Un, isDeviceConfigCap as Ur, formatDeviceRevoker as Ut, RecordingStatusSchema as V, siteZoneKey as Vn, formatSecretScope as Vr, filesystemBrowseCapability as Vt, ScopedTokenSchema as W, storageMigrationCapability as Wn, isEvent as Wr, formatMinutes as Wt, addonPagesCapability as X, userManagementCapability as Xn, nodePin as Xr, isLocationEnabled as Xt, UserRecordSchema as Y, supportedRuntimes as Yn, makeSecretMarker as Yr, isDefaultAppConnectionEndpoint as Yt, addonSettingsCapability as Z, validateComposition as Zn, normalizeSecretOwner as Zr, isObjectInput as Zt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as _, normalizeUnit as _n, DeviceType as _r, coreBlockIdFromAddonId as _t, ApiKeyRecordSchema as a, secretTreeFromPaths as ai, localNetworkCapability as an, cloneStatefulExpressionMemory as ar, buildDeviceEnrollmentLink as at, DATA_STORE_DATABASES as b, parseStreamParamsFormPatch as bn, DATAPLANE_SECRET_HEADER as br, createDeviceExtensionProvider as bt, CAMERA_SWITCH_ORDER as c, toNodeId as ci, logLevelAtMost as cn, compositionFeatureEnabled as cr, calendarsCapability as ct, COMPOSED_ITEM_FIXED_FIELDS as d, EventCategory as di, mayWriteToLocation as dn, compositionSourceKey as dr, checkRoleAddress as dt, parseSecretRef as ei, keychainAdminCapability as en, vectorIndexDimConflictError as er, authProviderCapability as et, COMPOSER_RUNNER_ID as f, memoizePinnedFfmpeg as fn, createStatefulExpressionMemory as fr, composerCapability as ft, CoreBlockSchema as g, normalizeCoreBlockWrite as gn, DeviceRole as gr, coreBlockComposition as gt, CalendarPreferencesSchema as h, motionCapability as hn, DeviceFeature as hr, coreBlockAddonId as ht, AlertSchema as i, scopeKey as ii, lifecycleJobSchema as in, buildFfmpegArgs as ir, buildCapabilityLookup as it, FieldClaimSchema as j, resolveCoreBlockFiles as jn, asString$1 as jr, deviceStateCapability as jt, FIRST_LEVEL_MACRO_CLASSES as k, resolveBucketMs as kn, asJsonObject as kr, deviceExtensionCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, toSecretFieldView as li, looseSchema as ln, compositionItemFieldPath as lr, cameraGridLayoutCapability as lt, CORE_BLOCK_ADDON_PREFIX as m, modeMayWrite as mn, toExpressionValue as mr, compositionSourceRefs as mt, AGENT_MDNS_TXT_KEYS as n, resolveCapMount as ni, legacyAutoLinkIds as nn, withLocationMode as nr, bareAddonId as nt, BaseDevice as o, secretTreeFromSchema as oi, locationIconKey as on, composedDeviceRef as or, buildDeviceSignatureMessage as ot, CORE_BLOCKS_ADDON_ID as p, metricsProviderCapability as pn, disarmRoseMemory as pr, compositionFieldKey as pt, StorageLocationTypeSchema as q, streamCatalogCapability as qn, isSecretMarker as qr, isArrayOutputSchema as qt, ALL_CAPABILITY_DEFINITIONS as r, resolveSecretMarkers as ri, legacyModeOf as rn, COMPOSER_ADDON_ID as rr, batteryCapability as rt, BatteryStatusSchema as s, sleep as si, logDestinationCapability as sn, composedDeviceStableId as sr, buildStreamParamsConfigSchema as st, AGENT_MDNS_SERVICE_TYPE as t, readinessKey as ti, keychainCapability as tn, vectorStoreCapability as tr, backupCapability as tt, CAP_NAMES_WITH_STATUS as u, transformSecretWrite as ui, mayReadLocation as un, compositionSliceKey as ur, canonicalIconKey as ut, DATABASE_SNAPSHOT_SUFFIX as v, objectInputDeclaresAddonId as vn, errMsg as vr, coreBlockSourceKind as vt, DEVICE_NONCE_TTL_MS as w, procedureAuthKey as wn, RUNTIME_DEFAULTS as wr, decodeVectorBase64 as wt, DAY_NAMES as x, pickAppLinkHub as xn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as xr, dataStoreProviderCapability as xt, DATABASE_SNAPSHOT_TIMEOUT_MS as y, objectInputDeclaresRequiredDeviceId as yn, BaseAddon as yr, coreBlocksCapability as yt, MOTION_CLOSE_AFTER_MS as z, scoreRuntimes as zn, emitReadiness as zr, expressionContainsBuiltinCall as zt };
+export { addonWidgetsCapability as $, validateCustomAddress as $n, parseJsonObject as $r, isVoidInput as $t, FieldClaimModeSchema as A, resolveBucketMs as An, asJsonObject as Ar, deviceExtensionCapability as At, RECORDING_SOURCE_CAMSTACK_ADDON as B, scoreRuntimes as Bn, emitReadiness as Br, expressionContainsBuiltinCall as Bt, DEVICE_ENROLLMENT_TTL_MS as C, planComposition as Cn, DEVICE_STATUS_METHOD as Cr, databaseSnapshotCapability as Ct, DeclaredDevices as D, reducePoints as Dn, ReadinessTimeoutError as Dr, deriveBatteryPresence as Dt, DEVICE_SAN_USER_PREFIX as E, ptzAutotrackCapability as En, ReadinessRegistry as Er, defineExtensionSlotProvider as Et, LOG_LEVEL_RANK as F, resolveMethodAuth as Fn, collectZodSecretPaths as Fr, enumerateItemArrayFields as Ft, SsoBridgeClaimsSchema as G, storageMigrationCapability as Gn, isEvent as Gr, formatMinutes as Gt, STORAGE_ACCESS_FALLBACK as H, siteZoneKey as Hn, formatSecretScope as Hr, filesystemBrowseCapability as Ht, LegacyStorageLocationDefaultSchema as I, resolveNotificationTapAddress as In, createEvent as Ir, enumerateSchemaFields as It, StorageLocationTypeSchema as J, streamCatalogCapability as Jn, isSecretMarker as Jr, isArrayOutputSchema as Jt, StorageCleanupJobSchema as K, storageOccupancyCapability as Kn, isKeychainStoredField as Kr, gbToBytes as Kt, METHOD_ACCESS_MAP as L, runtimeStatePolicyFor as Ln, customAction as Lr, evaluateCompositionField as Lt, HUB_MDNS_SERVICE_TYPE as M, resolveCoreBlockFiles as Mn, asString$1 as Mr, deviceStateCapability as Mt, HUB_MDNS_TXT_KEYS as N, resolveHubAddressRoles as Nn, buildSecretRef as Nr, deviceStatusCapability as Nt, DeviceStatusSchema as O, replacedFieldKeys as On, SECRET_CLEAR as Or, describeComposableCaps as Ot, KEYCHAIN_RESET_TRIGGER_ACTOR as P, resolveLocationMode as Pn, collectSecretConfigKeys as Pr, enumerateInferenceDevices as Pt, addonSettingsCapability as Q, validateComposition as Qn, normalizeSecretOwner as Qr, isObjectInput as Qt, MINUTES_PER_DAY as R, scopesAllowAddon as Rn, defineCustomActions as Rr, evictionPolicyOfLocation as Rt, DERIVED_CAMERA_SILENCED_CAP_NAMES as S, pickAppLinkHub as Sn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Sr, dataStoreProviderCapability as St, DEVICE_SAN_CREDENTIAL_PREFIX as T, procedureAuthKey as Tn, RUNTIME_DEFAULTS as Tr, decodeVectorBase64 as Tt, STREAM_PROFILE_META as U, snapshotCapability as Un, hydrateSchema as Ur, foldSnapshotByFunction as Ut, RecordingStatusSchema as V, settingsStoreCapability as Vn, expandCapMethods as Vr, extractNestedAddonId as Vt, ScopedTokenSchema as W, storageCapability as Wn, isDeviceConfigCap as Wr, formatDeviceRevoker as Wt, UserRecordSchema as X, supportedRuntimes as Xn, makeSecretMarker as Xr, isDefaultAppConnectionEndpoint as Xt, StorageMigrationJobSchema as Y, streamQualityLabel as Yn, isSecretMarkerLike as Yr, isCollectionArrayMethod as Yt, addonPagesCapability as Z, userManagementCapability as Zn, nodePin as Zr, isLocationEnabled as Zt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as _, normalizeCoreBlockWrite as _n, DeviceRole as _r, coreBlockComposition as _t, ApiKeyRecordSchema as a, scopeKey as ai, lifecycleJobSchema as an, buildFfmpegArgs as ar, buildCapabilityLookup as at, DATA_STORE_DATABASES as b, objectInputDeclaresRequiredDeviceId as bn, BaseAddon as br, coreBlocksCapability as bt, CAMERA_SWITCH_ORDER as c, sleep as ci, logDestinationCapability as cn, composedDeviceStableId as cr, buildStreamParamsConfigSchema as ct, COMPOSED_ITEM_FIXED_FIELDS as d, transformSecretWrite as di, mayReadLocation as dn, compositionSliceKey as dr, canonicalIconKey as dt, parseJsonUnknown as ei, kebabToCamel as en, vectorDimFromBase64 as er, alertsCapability as et, COMPOSER_RUNNER_ID as f, EventCategory as fi, mayWriteToLocation as fn, compositionSourceKey as fr, checkRoleAddress as ft, CoreBlockSchema as g, motionCapability as gn, DeviceFeature as gr, coreBlockAddonId as gt, CalendarPreferencesSchema as h, modeMayWrite as hn, toExpressionValue as hr, compositionSourceRefs as ht, AlertSchema as i, resolveSecretMarkers as ii, legacyModeOf as in, COMPOSER_ADDON_ID as ir, batteryCapability as it, FieldClaimSchema as j, resolveCoreBlockEntry as jn, asNumber as jr, deviceManagerCapability as jt, FIRST_LEVEL_MACRO_CLASSES as k, resolveAppConnections as kn, WELL_KNOWN_TAB_MAP as kr, deviceCredentialsCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, toNodeId as li, logLevelAtMost as ln, compositionFeatureEnabled as lr, calendarsCapability as lt, CORE_BLOCK_ADDON_PREFIX as m, metricsProviderCapability as mn, disarmRoseMemory as mr, compositionFieldKey as mt, AGENT_MDNS_TXT_KEYS as n, readinessKey as ni, keychainCapability as nn, vectorStoreCapability as nr, backupCapability as nt, BaseDevice as o, secretTreeFromPaths as oi, localNetworkCapability as on, cloneStatefulExpressionMemory as or, buildDeviceEnrollmentLink as ot, CORE_BLOCKS_ADDON_ID as p, memoizePinnedFfmpeg as pn, createStatefulExpressionMemory as pr, composerCapability as pt, StorageLocationModeSchema as q, storageProviderCapability as qn, isSecretClear as qr, isAppLinkBase as qt, ALL_CAPABILITY_DEFINITIONS as r, resolveCapMount as ri, legacyAutoLinkIds as rn, withLocationMode as rr, bareAddonId as rt, BatteryStatusSchema as s, secretTreeFromSchema as si, locationIconKey as sn, composedDeviceRef as sr, buildDeviceSignatureMessage as st, AGENT_MDNS_SERVICE_TYPE as t, parseSecretRef as ti, keychainAdminCapability as tn, vectorIndexDimConflictError as tr, authProviderCapability as tt, CAP_NAMES_WITH_STATUS as u, toSecretFieldView as ui, looseSchema as un, compositionItemFieldPath as ur, cameraGridLayoutCapability as ut, DATABASE_SNAPSHOT_SUFFIX as v, normalizeUnit as vn, DeviceType as vr, coreBlockIdFromAddonId as vt, DEVICE_NONCE_TTL_MS as w, platformProbeCapability as wn, REDACTED_SECRET as wr, declarationOwnerNodeId as wt, DAY_NAMES as x, parseStreamParamsFormPatch as xn, DATAPLANE_SECRET_HEADER as xr, createDeviceExtensionProvider as xt, DATABASE_SNAPSHOT_TIMEOUT_MS as y, objectInputDeclaresAddonId as yn, errMsg as yr, coreBlockSourceKind as yt, MOTION_CLOSE_AFTER_MS as z, scopesAllowDeviceCap as zn, emitDownForOwnedCaps as zr, expandContainer as zt };

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-CPLvZbzA.js");
+const require_wal_maintenance = require("./wal-maintenance-LZYd8iT-.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-Bc38yI3r.mjs";
+import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-DgLLPK14.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/{hub-mdns-ciao-B50jAU5C.js → hub-mdns-ciao-CBLvq2oj.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_agent_https = require("./agent-https-CHZTxK-q.js");
+const require_agent_https = require("./agent-https-BZIwS4xF.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");
@@ -623,7 +623,7 @@ function applyCertificateToListener(dataDir) {
 //#region src/builtins/local-network/hub-mdns-ciao.ts
 function createCiaoPublisher() {
 	return { async publish(announcement) {
-		const { getResponder } = await Promise.resolve().then(() => /* @__PURE__ */ require_chunk.__toESM(require("./lib-DOJ5yyWA.js").default));
+		const { getResponder } = await Promise.resolve().then(() => /* @__PURE__ */ require_chunk.__toESM(require("./lib-NNxHSOIE.js").default));
 		const responder = getResponder();
 		const service = responder.createService({
 			name: announcement.name,

package/dist/{hub-mdns-ciao-8_Ed1Za5.mjs → hub-mdns-ciao-DJRwtlA8.mjs}

@@ -1,5 +1,5 @@
 import { o as __toESM } from "./chunk-CNf5ZN-e.mjs";
-import { D as reasonRequiresNewCa, E as evaluateExistingCert, _ as generateCa, b as collectCertIdentity, v as issueLeaf, y as loadCa } from "./agent-https-DtRU9A7I.mjs";
+import { D as reasonRequiresNewCa, E as evaluateExistingCert, _ as generateCa, b as collectCertIdentity, v as issueLeaf, y as loadCa } from "./agent-https-B8lKYVtU.mjs";
 import { X509Certificate, createPrivateKey } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { mkdir, writeFile } from "node:fs/promises";
@@ -623,7 +623,7 @@ function applyCertificateToListener(dataDir) {
 //#region src/builtins/local-network/hub-mdns-ciao.ts
 function createCiaoPublisher() {
 	return { async publish(announcement) {
-		const { getResponder } = await import("./lib-B_R6sPC3.mjs").then((m) => /* @__PURE__ */ __toESM(m.default));
+		const { getResponder } = await import("./lib-BeGzVQcd.mjs").then((m) => /* @__PURE__ */ __toESM(m.default));
 		const responder = getResponder();
 		const service = responder.createService({
 			name: announcement.name,

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-C6Yvfhpq.js");
-const require_device_ca = require("./device-ca-NNP4Jz0P.js");
+const require_dist = require("./dist-CCH3XPqO.js");
+const require_device_ca = require("./device-ca-D21ZP00q.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -22,21 +22,21 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-CPLvZbzA.js");
+const require_wal_maintenance = require("./wal-maintenance-LZYd8iT-.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_agent_https = require("./agent-https-CHZTxK-q.js");
-const require_constants = require("./constants-Ah3T_KAW.js");
+const require_agent_https = require("./agent-https-BZIwS4xF.js");
+const require_constants = require("./constants-CuOfMdYe.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-Bf_YnagS.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-B50jAU5C.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-CBLvq2oj.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-DqPaRjjY.js");
+const require_restore_archive = require("./restore-archive-Do0QwAik.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $r as parseJsonUnknown, $t as kebabToCamel$1, Ar as asNumber, Br as expandCapMethods, Bt as extractNestedAddonId, Er as ReadinessTimeoutError, F as LOG_LEVEL_RANK, Fr as createEvent$1, Jt as isCollectionArrayMethod, L as METHOD_ACCESS_MAP, Ln as scopesAllowAddon, Pn as resolveMethodAuth, Qr as parseJsonObject, Qt as isVoidInput, Rn as scopesAllowDeviceCap, Rr as emitDownForOwnedCaps, Sr as DEVICE_STATUS_METHOD, Tr as ReadinessRegistry, Yn as supportedRuntimes, Z as addonSettingsCapability, Zt as isObjectInput, br as DATAPLANE_SECRET_HEADER$1, cn as logLevelAtMost, di as EventCategory$1, ii as scopeKey, in as lifecycleJobSchema, jr as asString$1, kr as asJsonObject$1, ln as looseSchema, n as AGENT_MDNS_TXT_KEYS, ni as resolveCapMount, qt as isArrayOutputSchema, r as ALL_CAPABILITY_DEFINITIONS, t as AGENT_MDNS_SERVICE_TYPE, ti as readinessKey, vn as objectInputDeclaresAddonId, vr as errMsg$1, wn as procedureAuthKey, wr as RUNTIME_DEFAULTS, xr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, yn as objectInputDeclaresRequiredDeviceId } from "./dist-DJnlnL7P.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-DUrcTW5h.mjs";
+import { $r as parseJsonObject, $t as isVoidInput, Ar as asJsonObject$1, Cr as DEVICE_STATUS_METHOD, Dr as ReadinessTimeoutError, Er as ReadinessRegistry, F as LOG_LEVEL_RANK, Fn as resolveMethodAuth, Ir as createEvent$1, Jt as isArrayOutputSchema, L as METHOD_ACCESS_MAP, Mr as asString$1, Q as addonSettingsCapability, Qt as isObjectInput, Rn as scopesAllowAddon, Sr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Tn as procedureAuthKey, Tr as RUNTIME_DEFAULTS, Vr as expandCapMethods, Vt as extractNestedAddonId, Xn as supportedRuntimes, Yt as isCollectionArrayMethod, ai as scopeKey, an as lifecycleJobSchema, bn as objectInputDeclaresRequiredDeviceId, ei as parseJsonUnknown, en as kebabToCamel$1, fi as EventCategory$1, jr as asNumber, ln as logLevelAtMost, n as AGENT_MDNS_TXT_KEYS, ni as readinessKey, r as ALL_CAPABILITY_DEFINITIONS, ri as resolveCapMount, t as AGENT_MDNS_SERVICE_TYPE, un as looseSchema, xr as DATAPLANE_SECRET_HEADER$1, yn as objectInputDeclaresAddonId, yr as errMsg$1, zn as scopesAllowDeviceCap, zr as emitDownForOwnedCaps } from "./dist-CYcBqnXk.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-CDjGQQPd.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -21,21 +21,21 @@ import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-Bc38yI3r.mjs";
+import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-DgLLPK14.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { A as AgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as isPrivateAddress, f as issueAgentHttpsLeaf, g as CA_COMMON_NAME, h as pinnedHttpsCaFingerprint, i as certificateNames, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, l as isContainerBridgeAddress, m as pemDigest, n as acceptAgentSans, o as createAgentHttpsRequest, p as loadAgentHttps, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isLocalOnlyHostname, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts } from "./agent-https-DtRU9A7I.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-Cg9ve13y.mjs";
+import { A as AgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as isPrivateAddress, f as issueAgentHttpsLeaf, g as CA_COMMON_NAME, h as pinnedHttpsCaFingerprint, i as certificateNames, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, l as isContainerBridgeAddress, m as pemDigest, n as acceptAgentSans, o as createAgentHttpsRequest, p as loadAgentHttps, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isLocalOnlyHostname, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts } from "./agent-https-B8lKYVtU.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-CrMPWOug.mjs";
 import { $ as requireProcessMeshCa, A as dropProcessPeer, At as setProcessMeshAuthStatusSource, B as openMeshTlsWhenRevocationsLoaded, C as Transporters, Ct as MESH_AUTH_MODE_FIELD, D as mintMeshJoinToken, Dt as parseMeshAuthMode, E as JoinTokenJtiStore, Et as isMeshAuthMode, F as onProcessNodeRegistered, Ft as readCidrSetting, G as RENEWAL_ABANDONED, H as MESH_NODE_CERTIFICATES_COLLECTION, I as setProcessMeshPeerTransportLookup, J as setProcessMeshCertificateRegistry, K as describeMeshLeaf, L as renewMeshCertificate, M as getProcessNodeMeshTransport, Mt as createCidrMatcher, N as getProcessPeerLeaf, Nt as normalizeIp, O as processJoinTokenJtiStore, Ot as requestProcessMeshEnforcement, P as isProcessVerifiedMeshPeer, Pt as parseCidrList, Q as getProcessMeshCaState, R as revokeMeshCertificate, S as ServiceBroker, St as verifyAgentUiUnlockTicketEs256, SystemConfigAddon, T as enrollMeshNode, Tt as getProcessMeshAuthStatus, U as MESH_NODE_CERTIFICATES_COLUMNS, V as setProcessMeshTlsListenerState, W as MeshCertificateRegistry, X as processMeshCrl, Y as MeshCrl, Z as MeshCaKeeper, _ as signPairingProof, _t as isAllowedAgentDashboardReturnTo, a as hubHostFromMeshAddress, at as generateMeshKeyPair, b as TlsTcpTransporter, bt as parseAgentDashboardOrigins, c as PAIRING_MAX_SESSIONS, ct as issueMeshLeafFromCsr, d as PAIRING_PROTOCOL, dt as AGENT_UI_UNLOCK_DOMAIN, et as caFingerprint, f as PAIRING_TTL_MS, ft as AGENT_UI_UNLOCK_TTL_MS, g as keyFingerprintShort, gt as UnlockTicketJtiStore, h as describeCsr, ht as AGENT_UI_UNLOCK_VERSION, i as AgentPairing, it as generateMeshCa, j as emitProcessNodeRegistered, jt as setProcessMeshEnforcer, k as verifyMeshJoinToken, kt as setProcessMeshAuthMode, l as PAIRING_PATHS, lt as loadMeshCa, m as computePairingSas, mt as AGENT_UI_UNLOCK_USE, n as HubPairing, nt as createMeshCsrPem, o as PAIRING_CODE_DIGITS, ot as isValidAgentNodeId, p as computePairingCommitment, pt as AGENT_UI_UNLOCK_TYP, q as getProcessMeshCertificateRegistry, r as PairingHttpError, rt as exportMeshPrivateKeyPem, s as PAIRING_MAX_CODE_ATTEMPTS, st as issueMeshLeafForNode, tt as caFingerprintCompact, u as PAIRING_PIN_DIGITS, ut as AGENT_DASHBOARD_ORIGINS_FIELD, v as verifyPairingProof, vt as mintAgentUiUnlockTicket, w as setProcessMeshTlsEnabler, wt as getProcessMeshAuthMode, x as Errors, xt as verifyAgentUiUnlockTicket, y as MESH_TLS_PORT_HELLO_FIELD, yt as mintAgentUiUnlockTicketEs256, z as getProcessMeshTlsListenerState } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BQnbN0DP.mjs";
-import { C as DEFAULT_LAN_HTTP_PORT, D as closeLanHttp, E as bindPendingLanHttp, O as readLanHttpState, S as reissueTlsLeaf, T as applyLanHttp, _ as splitPemCertificates, a as storeUploadedCertificate, b as ensureTlsCert, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, k as registerLanHttpHandler, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as validateUploadedTls, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as allFamiliesListenHost, x as loadTlsCert, y as writeTlsMode } from "./hub-mdns-ciao-8_Ed1Za5.mjs";
+import { C as DEFAULT_LAN_HTTP_PORT, D as closeLanHttp, E as bindPendingLanHttp, O as readLanHttpState, S as reissueTlsLeaf, T as applyLanHttp, _ as splitPemCertificates, a as storeUploadedCertificate, b as ensureTlsCert, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, k as registerLanHttpHandler, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as validateUploadedTls, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as allFamiliesListenHost, x as loadTlsCert, y as writeTlsMode } from "./hub-mdns-ciao-DJRwtlA8.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-C3_rzOCx.mjs";
+import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-5ml7uYMf.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";

package/dist/kernel/moleculer/mesh-mtls/mesh-ca.d.ts

@@ -1,12 +1,3 @@
-/**
-* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
-*
-* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
-* signs node leaves (CN = nodeID) and join-token JWS (ES256). Issuance uses
-* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
-* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
-* the pinned range already shipping).
-*/
 import type { webcrypto as WebCrypto } from "node:crypto";
 import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
 /** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */

package/dist/{lib-B_R6sPC3.mjs → lib-BeGzVQcd.mjs}

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, r as __exportAll, t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
-import { h as tslib_es6_exports, m as init_tslib_es6 } from "./x509.es-CAjSsrkk.mjs";
+import { h as tslib_es6_exports, m as init_tslib_es6 } from "./x509.es-CDvj67p1.mjs";
 import { t as require_src } from "./src-hG4grMU4.mjs";
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/{lib-DOJ5yyWA.js → lib-NNxHSOIE.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_x509_es = require("./x509.es-Dzl0BbmG.js");
+const require_x509_es = require("./x509.es-r7Ht1thA.js");
 const require_src$1 = require("./src-CnAqG6EF.js");
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) => {

package/dist/{restore-archive-C3_rzOCx.mjs → restore-archive-5ml7uYMf.mjs}

@@ -1,4 +1,4 @@
-import { v as DATABASE_SNAPSHOT_SUFFIX } from "./dist-DJnlnL7P.mjs";
+import { v as DATABASE_SNAPSHOT_SUFFIX } from "./dist-CYcBqnXk.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{restore-archive-DqPaRjjY.js → restore-archive-Do0QwAik.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-C6Yvfhpq.js");
+const require_dist = require("./dist-CCH3XPqO.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{retired-settings-keys-DJBQkZok.js → retired-settings-keys-CEiCaI_j.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-C6Yvfhpq.js");
+const require_dist = require("./dist-CCH3XPqO.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-CAWHWDwy.mjs → retired-settings-keys-CyDdyjLP.mjs}

@@ -1,4 +1,4 @@
-import { kr as asJsonObject } from "./dist-DJnlnL7P.mjs";
+import { Ar as asJsonObject } from "./dist-CYcBqnXk.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/tls/cert-backdate.d.ts

@@ -0,0 +1,10 @@
+/**
+* How far a freshly issued certificate's `notBefore` is moved into the past.
+*
+* TLS refuses a certificate whose `notBefore` is in the verifier's future, and X.509 dates have
+* one-second resolution, so a certificate dated "now" fails the handshake on any peer whose clock
+* runs even slightly behind the issuer's. Expiry is always computed from the real `now`; only the
+* start of validity moves.
+*/
+export declare const CERT_NOT_BEFORE_BACKDATE_MS: number;
+export declare function backdatedNotBefore(now: Date): Date;

package/dist/tls/cert-issue.d.ts

@@ -1,23 +1,3 @@
-/**
-* Certificate issuance. Isolated so `cert-manager.ts` reads as policy and
-* this file reads as mechanics.
-*
-* **In-process, by decision (D551).** This used to shell out to `openssl`
-* three times. The hub's own TLS identity is not allowed to be a function
-* of which openssl happens to sit on the host: this fleet alone runs four
-* of them, and one — Ubuntu 20.04's 1.1.1f — silently ADDED the ambient
-* `/etc/ssl/openssl.cnf` `[req] x509_extensions = v3_ca` block on top of
-* our `-addext` flags, producing a root with two `basicConstraints` and
-* two `subjectKeyIdentifier` extensions. RFC 5280 §4.2 allows each at
-* most once, so OpenSSL 3 (which is what `node:crypto` is) marked that
-* root invalid: `X509Certificate.ca` read `false` on our own CA and
-* `checkIssued()` refused the pair. Under D227 that means "not issued by
-* the local CA", i.e. rotate the root — on every boot, forever, voiding
-* every trust an operator had granted by hand.
-*
-* Keys come from WebCrypto (`node:crypto`'s own implementation) and the
-* DER is assembled by `@peculiar/x509`. Nothing here reads the host.
-*/
 import type { webcrypto as WebCrypto } from "node:crypto";
 import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
 import type { CertIdentity } from "./cert-identity.js";

package/dist/{x509.es-CAjSsrkk.mjs → x509.es-CDvj67p1.mjs}

@@ -1,4 +1,17 @@
 import { n as __esmMin, r as __exportAll, t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
+//#region src/tls/cert-backdate.ts
+/**
+* How far a freshly issued certificate's `notBefore` is moved into the past.
+*
+* TLS refuses a certificate whose `notBefore` is in the verifier's future, and X.509 dates have
+* one-second resolution, so a certificate dated "now" fails the handshake on any peer whose clock
+* runs even slightly behind the issuer's. Expiry is always computed from the real `now`; only the
+* start of validity moves.
+*/
+var CERT_NOT_BEFORE_BACKDATE_MS = 5 * 6e4;
+function backdatedNotBefore(now) {
+	return /* @__PURE__ */ new Date(now.getTime() - CERT_NOT_BEFORE_BACKDATE_MS);
+}
 /*! *****************************************************************************
 Copyright (C) Microsoft. All rights reserved.
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -11900,4 +11913,4 @@ AsnEcSignatureFormatter.namedCurveSize.set("K-256", 32);
 AsnEcSignatureFormatter.namedCurveSize.set("P-384", 48);
 AsnEcSignatureFormatter.namedCurveSize.set("P-521", 66);
 //#endregion
-export { KeyUsagesExtension as a, Pkcs10CertificateRequestGenerator as c, X509Certificate as d, X509CertificateGenerator as f, tslib_es6_exports as h, KeyUsageFlags as i, SubjectAlternativeNameExtension as l, init_tslib_es6 as m, BasicConstraintsExtension as n, PemConverter as o, cryptoProvider as p, ExtendedKeyUsageExtension as r, Pkcs10CertificateRequest as s, AuthorityKeyIdentifierExtension as t, SubjectKeyIdentifierExtension as u };
+export { KeyUsagesExtension as a, Pkcs10CertificateRequestGenerator as c, X509Certificate as d, X509CertificateGenerator as f, backdatedNotBefore as g, tslib_es6_exports as h, KeyUsageFlags as i, SubjectAlternativeNameExtension as l, init_tslib_es6 as m, BasicConstraintsExtension as n, PemConverter as o, cryptoProvider as p, ExtendedKeyUsageExtension as r, Pkcs10CertificateRequest as s, AuthorityKeyIdentifierExtension as t, SubjectKeyIdentifierExtension as u };