@camstack/system 1.2.433 → 1.2.435

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-B50jAU5C.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CBLvq2oj.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");
@@ -192,6 +192,48 @@ function withAppConnectionCustomEndpoints(detected, state) {
 	const extra = state.custom.filter((c) => wanted.has(c.baseUrl) && !known.has(c.baseUrl)).map(customEndpoint);
 	return [...detected, ...extra];
 }
+/** Where a twin sorts relative to its plain-HTTP row: straight after it. */
+var HTTPS_TWIN_PRIORITY_STEP = .5;
+/**
+* The HTTPS counterpart of every LAN address advertised over plain HTTP
+* (D859): `http://<lan>:<httpPort>` gains `https://<lan>:<httpsPort>`, the hub's
+* TLS listener, as its own row straight after it. The twin is an ordinary
+* detected LAN row — ticked, unticked and flagged like any other, on by default
+* (a LAN row is an automatic app connection). A phone that does not trust the
+* hub's local CA fails that candidate in the race it already runs; one that
+* does reaches it. Only the app-connection palette and the table carry twins:
+* the palette `internal` and `publicEndpoint` resolve over never does, so those
+* roles keep their answer. Rows already on https (LAN HTTP off), the public
+* tunnel, the mesh, custom addresses and loopback have no twin.
+*/
+function withLanHttpsCounterparts(palette, httpsPort) {
+	const known = new Set(palette.map((e) => e.baseUrl));
+	const out = [];
+	for (const endpoint of palette) {
+		out.push(endpoint);
+		if (endpoint.kind !== "lan-ipv4" && endpoint.kind !== "lan-ipv6") continue;
+		const twin = httpsTwinOf(endpoint, httpsPort);
+		if (twin === null || known.has(twin.baseUrl)) continue;
+		known.add(twin.baseUrl);
+		out.push(twin);
+	}
+	return out;
+}
+function httpsTwinOf(endpoint, httpsPort) {
+	let parsed;
+	try {
+		parsed = new URL(endpoint.baseUrl);
+	} catch {
+		return null;
+	}
+	if (parsed.protocol !== "http:") return null;
+	return {
+		...endpoint,
+		label: `${endpoint.label} (HTTPS)`,
+		baseUrl: `https://${parsed.hostname}:${httpsPort}`,
+		priority: endpoint.priority + HTTPS_TWIN_PRIORITY_STEP
+	};
+}
 /** Every role's answer — the resolvers from `@camstack/types`, nothing else. */
 function resolveRoles(state, appPalette, httpsPalette) {
 	return require_dist.resolveHubAddressRoles(withAppConnectionCustomEndpoints(appPalette, state), httpsPalette, state.flags);
@@ -566,6 +608,8 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	/** Optional public hostname tracked from `NetworkTunnelStarted`/
 	*  `Stopped` events on the bus. */
 	publicHostname = "";
+	/** False for a Quick tunnel: shown in the palette, never picked automatically (D860). */
+	publicHostnameStable = true;
 	/**
 	* Mesh-reachable endpoint (Tailscale MagicDNS / 100.x), learned from
 	* the `MeshNetworkChanged` event-tail and refreshed by a pull-reconcile
@@ -597,9 +641,13 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	async palettes() {
 		const port = (await this.resolveAdvertisedListenPort(null)).port;
 		await this.reconcileMeshEndpoint();
+		const http = this.endpointsNow(false, false, "http", port);
+		const https = this.endpointsNow(false, false, "https", port);
 		return {
-			http: this.endpointsNow(false, false, "http", port),
-			https: this.endpointsNow(false, false, "https", port)
+			http,
+			https,
+			httpWithTwins: withLanHttpsCounterparts(http, port),
+			httpsWithTwins: withLanHttpsCounterparts(https, port)
 		};
 	}
 	/** The stored address book, normalised against what is detected now. */
@@ -612,11 +660,11 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	}
 	/** `getAddresses`: the Addresses table and every role's answer. */
 	async addressBook(scheme) {
-		const { http, https } = await this.palettes();
-		const state = this.addressState([...http, ...https]);
+		const { http, https, httpWithTwins, httpsWithTwins } = await this.palettes();
+		const state = this.addressState([...httpWithTwins, ...httpsWithTwins]);
 		const httpsPort = (await this.resolveAdvertisedListenPort(null)).port;
 		return buildAddressBook(state, {
-			rowsPalette: scheme === "http" ? http : https,
+			rowsPalette: scheme === "http" ? httpWithTwins : httpsWithTwins,
 			httpsPalette: https,
 			appLink: appLinkEndpoint(),
 			appLinkHub: require_dist.pickAppLinkHub(https),
@@ -628,8 +676,8 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	* naming an address in no row becomes a custom address in the same write).
 	*/
 	async changeAddressBook(change) {
-		const { http, https } = await this.palettes();
-		const detected = [...http, ...https];
+		const { httpWithTwins, httpsWithTwins } = await this.palettes();
+		const detected = [...httpWithTwins, ...httpsWithTwins];
 		const detectedUrls = new Set(detected.map((e) => e.baseUrl));
 		const changed = change(this.addressState(detected), {
 			detectedUrls,
@@ -708,7 +756,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	*/
 	async buildAdvertisedEndpoints(includeLoopback, ipv4Only, scheme, httpsPort) {
 		await this.reconcileMeshEndpoint();
-		const detected = this.endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort);
+		const detected = withLanHttpsCounterparts(this.endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort), httpsPort);
 		return withAppConnectionCustomEndpoints(detected, this.addressState(detected));
 	}
 	/**
@@ -737,7 +785,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			httpPort: this.resolvedHttpPort(),
 			httpsPort,
 			localHostname: this.config.localHostname || null
-		} : null);
+		} : null, this.publicHostnameStable);
 	}
 	async onInitialize() {
 		if (!this.config.bootSeeded) {
@@ -870,11 +918,14 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		}, ALLOWLIST_RECONCILE_INTERVAL_MS);
 		this.allowlistTimer.unref?.();
 		this.ctx.eventBus?.subscribe({ category: require_dist.EventCategory.NetworkTunnelStarted }, (event) => {
-			const data = event.data ?? {};
-			if (typeof data.url === "string") try {
-				const hostname = new URL(data.url).hostname;
-				if (hostname && !hostname.endsWith(".placeholder") && !hostname.startsWith("pending.")) this.setPublicHostname(hostname);
-			} catch {}
+			const parsed = require_dist.NetworkTunnelStartedDataSchema.safeParse(event.data ?? {});
+			if (parsed.success) {
+				const data = parsed.data;
+				try {
+					const hostname = new URL(data.url).hostname;
+					if (hostname && !hostname.endsWith(".placeholder") && !hostname.startsWith("pending.")) this.setPublicHostname(hostname, data.stable !== false);
+				} catch {}
+			}
 		});
 		this.ctx.eventBus?.subscribe({ category: require_dist.EventCategory.NetworkTunnelStopped }, () => this.setPublicHostname(""));
 		this.ctx.eventBus?.subscribe({ category: require_dist.EventCategory.MeshNetworkChanged }, (event) => {
@@ -985,10 +1036,14 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	* `onInitialize`. This setter exists for tests + future direct
 	* callers; cleared by passing an empty string.
 	*/
-	setPublicHostname(hostname) {
-		if (this.publicHostname === hostname) return;
+	setPublicHostname(hostname, stable = true) {
+		if (this.publicHostname === hostname && this.publicHostnameStable === stable) return;
 		this.publicHostname = hostname;
-		this.ctx.logger.info("local-network: public hostname updated", { meta: { hostname: hostname || "(cleared)" } });
+		this.publicHostnameStable = stable;
+		this.ctx.logger.info("local-network: public hostname updated", { meta: {
+			hostname: hostname || "(cleared)",
+			stable
+		} });
 	}
 	/**
 	* Replace the cached mesh endpoint. Set from the `MeshNetworkChanged`
@@ -1317,7 +1372,7 @@ function appLinkEndpoint() {
 		priority: -1
 	};
 }
-function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostname, scheme = "http", meshEndpoint = null, lanHttp = null) {
+function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostname, scheme = "http", meshEndpoint = null, lanHttp = null, publicHostnameStable = true) {
 	const out = [];
 	let priority = 0;
 	const preferred = pickPreferred(interfaces);
@@ -1360,13 +1415,14 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 		emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, 10 + priority++);
 	}
 	if (publicHostname) out.push({
-		label: "Public tunnel",
+		label: publicHostnameStable ? "Public tunnel" : "Public tunnel (temporary address)",
 		baseUrl: `https://${publicHostname}`,
 		kind: "public",
 		interfaceKind: "public",
 		plausible: true,
 		plausibleReason: "",
-		priority: 100
+		priority: 100,
+		...publicHostnameStable ? {} : { stable: false }
 	});
 	if (meshEndpoint && meshEndpoint.host) out.push({
 		label: "Mesh (Tailscale)",

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { Fn as resolveNotificationTapAddress, Kt as isAppLinkBase, M as HUB_MDNS_SERVICE_TYPE, Mn as resolveHubAddressRoles, N as HUB_MDNS_TXT_KEYS, On as resolveAppConnections, Qn as validateCustomAddress, Yt as isDefaultAppConnectionEndpoint, an as localNetworkCapability, di as EventCategory, dt as checkRoleAddress, l as CAMSTACK_APP_LINK_ORIGIN, xn as pickAppLinkHub, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
-import { C as DEFAULT_LAN_HTTP_PORT, O as readLanHttpState, T as applyLanHttp, a as storeUploadedCertificate, b as ensureTlsCert, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, m as readExtraSans, n as applyCertificateToListener, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans } from "../../hub-mdns-ciao-8_Ed1Za5.mjs";
+import { An as resolveAppConnections, B as NetworkTunnelStartedDataSchema, Cn as pickAppLinkHub, Jt as isAppLinkBase, Ln as resolveNotificationTapAddress, M as HUB_MDNS_SERVICE_TYPE, N as HUB_MDNS_TXT_KEYS, Pn as resolveHubAddressRoles, Zt as isDefaultAppConnectionEndpoint, er as validateCustomAddress, l as CAMSTACK_APP_LINK_ORIGIN, pi as EventCategory, pt as checkRoleAddress, sn as localNetworkCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { C as DEFAULT_LAN_HTTP_PORT, O as readLanHttpState, T as applyLanHttp, a as storeUploadedCertificate, b as ensureTlsCert, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, m as readExtraSans, n as applyCertificateToListener, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans } from "../../hub-mdns-ciao-DJRwtlA8.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os from "node:os";
@@ -189,6 +189,48 @@ function withAppConnectionCustomEndpoints(detected, state) {
 	const extra = state.custom.filter((c) => wanted.has(c.baseUrl) && !known.has(c.baseUrl)).map(customEndpoint);
 	return [...detected, ...extra];
 }
+/** Where a twin sorts relative to its plain-HTTP row: straight after it. */
+var HTTPS_TWIN_PRIORITY_STEP = .5;
+/**
+* The HTTPS counterpart of every LAN address advertised over plain HTTP
+* (D859): `http://<lan>:<httpPort>` gains `https://<lan>:<httpsPort>`, the hub's
+* TLS listener, as its own row straight after it. The twin is an ordinary
+* detected LAN row — ticked, unticked and flagged like any other, on by default
+* (a LAN row is an automatic app connection). A phone that does not trust the
+* hub's local CA fails that candidate in the race it already runs; one that
+* does reaches it. Only the app-connection palette and the table carry twins:
+* the palette `internal` and `publicEndpoint` resolve over never does, so those
+* roles keep their answer. Rows already on https (LAN HTTP off), the public
+* tunnel, the mesh, custom addresses and loopback have no twin.
+*/
+function withLanHttpsCounterparts(palette, httpsPort) {
+	const known = new Set(palette.map((e) => e.baseUrl));
+	const out = [];
+	for (const endpoint of palette) {
+		out.push(endpoint);
+		if (endpoint.kind !== "lan-ipv4" && endpoint.kind !== "lan-ipv6") continue;
+		const twin = httpsTwinOf(endpoint, httpsPort);
+		if (twin === null || known.has(twin.baseUrl)) continue;
+		known.add(twin.baseUrl);
+		out.push(twin);
+	}
+	return out;
+}
+function httpsTwinOf(endpoint, httpsPort) {
+	let parsed;
+	try {
+		parsed = new URL(endpoint.baseUrl);
+	} catch {
+		return null;
+	}
+	if (parsed.protocol !== "http:") return null;
+	return {
+		...endpoint,
+		label: `${endpoint.label} (HTTPS)`,
+		baseUrl: `https://${parsed.hostname}:${httpsPort}`,
+		priority: endpoint.priority + HTTPS_TWIN_PRIORITY_STEP
+	};
+}
 /** Every role's answer — the resolvers from `@camstack/types`, nothing else. */
 function resolveRoles(state, appPalette, httpsPalette) {
 	return resolveHubAddressRoles(withAppConnectionCustomEndpoints(appPalette, state), httpsPalette, state.flags);
@@ -563,6 +605,8 @@ var LocalNetworkAddon = class extends BaseAddon {
 	/** Optional public hostname tracked from `NetworkTunnelStarted`/
 	*  `Stopped` events on the bus. */
 	publicHostname = "";
+	/** False for a Quick tunnel: shown in the palette, never picked automatically (D860). */
+	publicHostnameStable = true;
 	/**
 	* Mesh-reachable endpoint (Tailscale MagicDNS / 100.x), learned from
 	* the `MeshNetworkChanged` event-tail and refreshed by a pull-reconcile
@@ -594,9 +638,13 @@ var LocalNetworkAddon = class extends BaseAddon {
 	async palettes() {
 		const port = (await this.resolveAdvertisedListenPort(null)).port;
 		await this.reconcileMeshEndpoint();
+		const http = this.endpointsNow(false, false, "http", port);
+		const https = this.endpointsNow(false, false, "https", port);
 		return {
-			http: this.endpointsNow(false, false, "http", port),
-			https: this.endpointsNow(false, false, "https", port)
+			http,
+			https,
+			httpWithTwins: withLanHttpsCounterparts(http, port),
+			httpsWithTwins: withLanHttpsCounterparts(https, port)
 		};
 	}
 	/** The stored address book, normalised against what is detected now. */
@@ -609,11 +657,11 @@ var LocalNetworkAddon = class extends BaseAddon {
 	}
 	/** `getAddresses`: the Addresses table and every role's answer. */
 	async addressBook(scheme) {
-		const { http, https } = await this.palettes();
-		const state = this.addressState([...http, ...https]);
+		const { http, https, httpWithTwins, httpsWithTwins } = await this.palettes();
+		const state = this.addressState([...httpWithTwins, ...httpsWithTwins]);
 		const httpsPort = (await this.resolveAdvertisedListenPort(null)).port;
 		return buildAddressBook(state, {
-			rowsPalette: scheme === "http" ? http : https,
+			rowsPalette: scheme === "http" ? httpWithTwins : httpsWithTwins,
 			httpsPalette: https,
 			appLink: appLinkEndpoint(),
 			appLinkHub: pickAppLinkHub(https),
@@ -625,8 +673,8 @@ var LocalNetworkAddon = class extends BaseAddon {
 	* naming an address in no row becomes a custom address in the same write).
 	*/
 	async changeAddressBook(change) {
-		const { http, https } = await this.palettes();
-		const detected = [...http, ...https];
+		const { httpWithTwins, httpsWithTwins } = await this.palettes();
+		const detected = [...httpWithTwins, ...httpsWithTwins];
 		const detectedUrls = new Set(detected.map((e) => e.baseUrl));
 		const changed = change(this.addressState(detected), {
 			detectedUrls,
@@ -705,7 +753,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 	*/
 	async buildAdvertisedEndpoints(includeLoopback, ipv4Only, scheme, httpsPort) {
 		await this.reconcileMeshEndpoint();
-		const detected = this.endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort);
+		const detected = withLanHttpsCounterparts(this.endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort), httpsPort);
 		return withAppConnectionCustomEndpoints(detected, this.addressState(detected));
 	}
 	/**
@@ -734,7 +782,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 			httpPort: this.resolvedHttpPort(),
 			httpsPort,
 			localHostname: this.config.localHostname || null
-		} : null);
+		} : null, this.publicHostnameStable);
 	}
 	async onInitialize() {
 		if (!this.config.bootSeeded) {
@@ -867,11 +915,14 @@ var LocalNetworkAddon = class extends BaseAddon {
 		}, ALLOWLIST_RECONCILE_INTERVAL_MS);
 		this.allowlistTimer.unref?.();
 		this.ctx.eventBus?.subscribe({ category: EventCategory.NetworkTunnelStarted }, (event) => {
-			const data = event.data ?? {};
-			if (typeof data.url === "string") try {
-				const hostname = new URL(data.url).hostname;
-				if (hostname && !hostname.endsWith(".placeholder") && !hostname.startsWith("pending.")) this.setPublicHostname(hostname);
-			} catch {}
+			const parsed = NetworkTunnelStartedDataSchema.safeParse(event.data ?? {});
+			if (parsed.success) {
+				const data = parsed.data;
+				try {
+					const hostname = new URL(data.url).hostname;
+					if (hostname && !hostname.endsWith(".placeholder") && !hostname.startsWith("pending.")) this.setPublicHostname(hostname, data.stable !== false);
+				} catch {}
+			}
 		});
 		this.ctx.eventBus?.subscribe({ category: EventCategory.NetworkTunnelStopped }, () => this.setPublicHostname(""));
 		this.ctx.eventBus?.subscribe({ category: EventCategory.MeshNetworkChanged }, (event) => {
@@ -982,10 +1033,14 @@ var LocalNetworkAddon = class extends BaseAddon {
 	* `onInitialize`. This setter exists for tests + future direct
 	* callers; cleared by passing an empty string.
 	*/
-	setPublicHostname(hostname) {
-		if (this.publicHostname === hostname) return;
+	setPublicHostname(hostname, stable = true) {
+		if (this.publicHostname === hostname && this.publicHostnameStable === stable) return;
 		this.publicHostname = hostname;
-		this.ctx.logger.info("local-network: public hostname updated", { meta: { hostname: hostname || "(cleared)" } });
+		this.publicHostnameStable = stable;
+		this.ctx.logger.info("local-network: public hostname updated", { meta: {
+			hostname: hostname || "(cleared)",
+			stable
+		} });
 	}
 	/**
 	* Replace the cached mesh endpoint. Set from the `MeshNetworkChanged`
@@ -1314,7 +1369,7 @@ function appLinkEndpoint() {
 		priority: -1
 	};
 }
-function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostname, scheme = "http", meshEndpoint = null, lanHttp = null) {
+function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostname, scheme = "http", meshEndpoint = null, lanHttp = null, publicHostnameStable = true) {
 	const out = [];
 	let priority = 0;
 	const preferred = pickPreferred(interfaces);
@@ -1357,13 +1412,14 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 		emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, 10 + priority++);
 	}
 	if (publicHostname) out.push({
-		label: "Public tunnel",
+		label: publicHostnameStable ? "Public tunnel" : "Public tunnel (temporary address)",
 		baseUrl: `https://${publicHostname}`,
 		kind: "public",
 		interfaceKind: "public",
 		plausible: true,
 		plausibleReason: "",
-		priority: 100
+		priority: 100,
+		...publicHostnameStable ? {} : { stable: false }
 	});
 	if (meshEndpoint && meshEndpoint.host) out.push({
 		label: "Mesh (Tailscale)",

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { sn as logDestinationCapability, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { En as reducePoints, Fr as createEvent, Ht as foldSnapshotByFunction, di as EventCategory, kn as resolveBucketMs, pn as metricsProviderCapability, vr as errMsg, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { Lr as createEvent, On as reducePoints, Wt as foldSnapshotByFunction, br as errMsg, hn as metricsProviderCapability, jn as resolveBucketMs, pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";
 import { platform } from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { Cn as platformProbeCapability, Nt as enumerateInferenceDevices, di as EventCategory, vr as errMsg, yr as BaseAddon, zn as scoreRuntimes, zr as emitReadiness } from "../../dist-DJnlnL7P.mjs";
+import { Ft as enumerateInferenceDevices, Tn as platformProbeCapability, Vn as scoreRuntimes, Vr as emitReadiness, br as errMsg, pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { di as EventCategory, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Et as deriveBatteryPresence, Hn as snapshotCapability, Jn as streamQualityLabel, Xr as nodePin, _r as DeviceType, di as EventCategory, fn as memoizePinnedFfmpeg, hr as DeviceFeature, nt as bareAddonId, rt as batteryCapability, s as BatteryStatusSchema, vr as errMsg, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { Ot as deriveBatteryPresence, Qr as nodePin, Wn as snapshotCapability, Xn as streamQualityLabel, _r as DeviceFeature, at as batteryCapability, br as errMsg, it as bareAddonId, mn as memoizePinnedFfmpeg, pi as EventCategory, s as BatteryStatusSchema, xr as BaseAddon, yr as DeviceType } from "../../dist-Bz4_y8Xy.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Kn as storageProviderCapability, Vt as filesystemBrowseCapability, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { Jn as storageProviderCapability, Ut as filesystemBrowseCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-CPLvZbzA.js");
+const require_wal_maintenance = require("../../wal-maintenance-D3gwRj1B.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-Bc38yI3r.mjs";
+import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-DLrbapzi.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-DJBQkZok.js");
-const require_wal_maintenance = require("../../wal-maintenance-CPLvZbzA.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-CO3RqsDw.js");
+const require_wal_maintenance = require("../../wal-maintenance-D3gwRj1B.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { St as databaseSnapshotCapability, _ as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, b as DATA_STORE_DATABASES, nt as bareAddonId, tr as vectorStoreCapability, v as DATABASE_SNAPSHOT_SUFFIX, vr as errMsg, wr as RUNTIME_DEFAULTS, xt as dataStoreProviderCapability, y as DATABASE_SNAPSHOT_TIMEOUT_MS, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
-import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-CAWHWDwy.mjs";
-import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-Bc38yI3r.mjs";
+import { Ct as dataStoreProviderCapability, Er as RUNTIME_DEFAULTS, _ as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, b as DATA_STORE_DATABASES, br as errMsg, it as bareAddonId, rr as vectorStoreCapability, v as DATABASE_SNAPSHOT_SUFFIX, wt as databaseSnapshotCapability, xr as BaseAddon, y as DATABASE_SNAPSHOT_TIMEOUT_MS } from "../../dist-Bz4_y8Xy.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-9nA85bwT.mjs";
+import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-DLrbapzi.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Bn as settingsStoreCapability, Cr as REDACTED_SECRET, G as StorageCleanupJobSchema, Gt as gbToBytes, I as LegacyStorageLocationDefaultSchema, J as StorageMigrationJobSchema, K as StorageLocationModeSchema, Lt as evictionPolicyOfLocation, Nn as resolveLocationMode, Nr as collectSecretConfigKeys, Qr as parseJsonObject, Un as storageCapability, Wn as storageMigrationCapability, Xt as isLocationEnabled, ai as secretTreeFromPaths, di as EventCategory, dn as mayWriteToLocation, mn as modeMayWrite, nr as withLocationMode, q as StorageLocationTypeSchema, qr as isSecretMarker, ri as resolveSecretMarkers, rn as legacyModeOf, ui as transformSecretWrite, un as mayReadLocation, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { Fn as resolveLocationMode, Fr as collectSecretConfigKeys, Gn as storageCapability, Hn as settingsStoreCapability, I as LegacyStorageLocationDefaultSchema, J as StorageLocationModeSchema, Kn as storageMigrationCapability, Qt as isLocationEnabled, Tr as REDACTED_SECRET, X as StorageMigrationJobSchema, Y as StorageLocationTypeSchema, Yr as isSecretMarker, ai as resolveSecretMarkers, an as legacyModeOf, ei as parseJsonObject, fi as transformSecretWrite, fn as mayReadLocation, gn as modeMayWrite, ir as withLocationMode, pi as EventCategory, pn as mayWriteToLocation, q as StorageCleanupJobSchema, qt as gbToBytes, si as secretTreeFromPaths, xr as BaseAddon, zt as evictionPolicyOfLocation } from "../../dist-Bz4_y8Xy.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
-const require_x509_es = require("../../x509.es-Dzl0BbmG.js");
-const require_agent_https = require("../../agent-https-CHZTxK-q.js");
-const require_constants$8 = require("../../constants-Ah3T_KAW.js");
+const require_x509_es = require("../../x509.es-r7Ht1thA.js");
+const require_agent_https = require("../../agent-https-BZIwS4xF.js");
+const require_constants$8 = require("../../constants-DL87WgeN.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -408,6 +408,15 @@ function parsePayloadEs256(value) {
 }
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
+/**
+* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
+*
+* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
+* signs node leaves (CN = nodeID) and join-token JWS (ES256). Issuance uses
+* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
+* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
+* the pinned range already shipping).
+*/
 require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
 var MS_PER_DAY = 864e5;
 /** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
@@ -458,7 +467,7 @@ async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${require_constants$8.MESH_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: require_x509_es.backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + require_constants$8.MESH_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
 		signingAlgorithm: MESH_SIGNING_ALGORITHM,
@@ -509,7 +518,7 @@ async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
 			serialNumber,
 			subject: `CN=${cn}`,
 			issuer: ca.cert.subject,
-			notBefore: now,
+			notBefore: require_x509_es.backdatedNotBefore(now),
 			notAfter,
 			publicKey: csr.publicKey,
 			signingKey: ca.privateKey,
@@ -88439,12 +88448,18 @@ function isHttpUrl(value) {
 		return false;
 	}
 }
-/** The hub CA must be a self-signed CA certificate, valid now. */
+/**
+* Clock skew tolerated between the hub that minted a CA and this agent. X.509 dates have
+* one-second resolution and a fresh CA's notBefore is the hub's "now", so an agent whose clock
+* is even a moment behind would otherwise refuse a brand-new CA. Same bound as the offer `iat`.
+*/
+var CA_CLOCK_SKEW_MS = 6e4;
+/** The hub CA must be a self-signed CA certificate, valid now (give or take the skew). */
 function readCaCertificate(pem, nowMs) {
 	try {
 		const cert = new node_crypto.X509Certificate(pem);
 		if (!cert.ca || !cert.verify(cert.publicKey)) return null;
-		if (Date.parse(cert.validTo) <= nowMs || Date.parse(cert.validFrom) > nowMs) return null;
+		if (Date.parse(cert.validTo) <= nowMs || Date.parse(cert.validFrom) > nowMs + CA_CLOCK_SKEW_MS) return null;
 		return cert;
 	} catch {
 		return null;