@camstack/system 1.2.433 → 1.2.435

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-CPLvZbzA.js");
+const require_wal_maintenance = require("./wal-maintenance-D3gwRj1B.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-Bc38yI3r.mjs";
+import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-DLrbapzi.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/{hub-mdns-ciao-B50jAU5C.js → hub-mdns-ciao-CBLvq2oj.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_agent_https = require("./agent-https-CHZTxK-q.js");
+const require_agent_https = require("./agent-https-BZIwS4xF.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");
@@ -623,7 +623,7 @@ function applyCertificateToListener(dataDir) {
 //#region src/builtins/local-network/hub-mdns-ciao.ts
 function createCiaoPublisher() {
 	return { async publish(announcement) {
-		const { getResponder } = await Promise.resolve().then(() => /* @__PURE__ */ require_chunk.__toESM(require("./lib-DOJ5yyWA.js").default));
+		const { getResponder } = await Promise.resolve().then(() => /* @__PURE__ */ require_chunk.__toESM(require("./lib-NNxHSOIE.js").default));
 		const responder = getResponder();
 		const service = responder.createService({
 			name: announcement.name,

package/dist/{hub-mdns-ciao-8_Ed1Za5.mjs → hub-mdns-ciao-DJRwtlA8.mjs}

@@ -1,5 +1,5 @@
 import { o as __toESM } from "./chunk-CNf5ZN-e.mjs";
-import { D as reasonRequiresNewCa, E as evaluateExistingCert, _ as generateCa, b as collectCertIdentity, v as issueLeaf, y as loadCa } from "./agent-https-DtRU9A7I.mjs";
+import { D as reasonRequiresNewCa, E as evaluateExistingCert, _ as generateCa, b as collectCertIdentity, v as issueLeaf, y as loadCa } from "./agent-https-B8lKYVtU.mjs";
 import { X509Certificate, createPrivateKey } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { mkdir, writeFile } from "node:fs/promises";
@@ -623,7 +623,7 @@ function applyCertificateToListener(dataDir) {
 //#region src/builtins/local-network/hub-mdns-ciao.ts
 function createCiaoPublisher() {
 	return { async publish(announcement) {
-		const { getResponder } = await import("./lib-B_R6sPC3.mjs").then((m) => /* @__PURE__ */ __toESM(m.default));
+		const { getResponder } = await import("./lib-BeGzVQcd.mjs").then((m) => /* @__PURE__ */ __toESM(m.default));
 		const responder = getResponder();
 		const service = responder.createService({
 			name: announcement.name,

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-C6Yvfhpq.js");
-const require_device_ca = require("./device-ca-NNP4Jz0P.js");
+const require_dist = require("./dist-CnUtkSwN.js");
+const require_device_ca = require("./device-ca-WXuKc8AX.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -22,21 +22,21 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-CPLvZbzA.js");
+const require_wal_maintenance = require("./wal-maintenance-D3gwRj1B.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_agent_https = require("./agent-https-CHZTxK-q.js");
-const require_constants = require("./constants-Ah3T_KAW.js");
+const require_agent_https = require("./agent-https-BZIwS4xF.js");
+const require_constants = require("./constants-DL87WgeN.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-Bf_YnagS.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-B50jAU5C.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-CBLvq2oj.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-DqPaRjjY.js");
+const require_restore_archive = require("./restore-archive-BNoFLAg8.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $r as parseJsonUnknown, $t as kebabToCamel$1, Ar as asNumber, Br as expandCapMethods, Bt as extractNestedAddonId, Er as ReadinessTimeoutError, F as LOG_LEVEL_RANK, Fr as createEvent$1, Jt as isCollectionArrayMethod, L as METHOD_ACCESS_MAP, Ln as scopesAllowAddon, Pn as resolveMethodAuth, Qr as parseJsonObject, Qt as isVoidInput, Rn as scopesAllowDeviceCap, Rr as emitDownForOwnedCaps, Sr as DEVICE_STATUS_METHOD, Tr as ReadinessRegistry, Yn as supportedRuntimes, Z as addonSettingsCapability, Zt as isObjectInput, br as DATAPLANE_SECRET_HEADER$1, cn as logLevelAtMost, di as EventCategory$1, ii as scopeKey, in as lifecycleJobSchema, jr as asString$1, kr as asJsonObject$1, ln as looseSchema, n as AGENT_MDNS_TXT_KEYS, ni as resolveCapMount, qt as isArrayOutputSchema, r as ALL_CAPABILITY_DEFINITIONS, t as AGENT_MDNS_SERVICE_TYPE, ti as readinessKey, vn as objectInputDeclaresAddonId, vr as errMsg$1, wn as procedureAuthKey, wr as RUNTIME_DEFAULTS, xr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, yn as objectInputDeclaresRequiredDeviceId } from "./dist-DJnlnL7P.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-DUrcTW5h.mjs";
+import { $ as addonSettingsCapability, $t as isObjectInput, Bn as scopesAllowDeviceCap, Br as emitDownForOwnedCaps, Cr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Dr as ReadinessRegistry, En as procedureAuthKey, Er as RUNTIME_DEFAULTS, F as LOG_LEVEL_RANK, Hr as expandCapMethods, Ht as extractNestedAddonId, In as resolveMethodAuth, L as METHOD_ACCESS_MAP, Lr as createEvent$1, Mr as asNumber, Nr as asString$1, Or as ReadinessTimeoutError, Sr as DATAPLANE_SECRET_HEADER$1, Xt as isCollectionArrayMethod, Yt as isArrayOutputSchema, Zn as supportedRuntimes, bn as objectInputDeclaresAddonId, br as errMsg$1, dn as looseSchema, ei as parseJsonObject, en as isVoidInput, ii as resolveCapMount, jr as asJsonObject$1, n as AGENT_MDNS_TXT_KEYS, oi as scopeKey, on as lifecycleJobSchema, pi as EventCategory$1, r as ALL_CAPABILITY_DEFINITIONS, ri as readinessKey, t as AGENT_MDNS_SERVICE_TYPE, ti as parseJsonUnknown, tn as kebabToCamel$1, un as logLevelAtMost, wr as DEVICE_STATUS_METHOD, xn as objectInputDeclaresRequiredDeviceId, zn as scopesAllowAddon } from "./dist-Bz4_y8Xy.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-B6YJZus6.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -21,21 +21,21 @@ import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-Bc38yI3r.mjs";
+import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-DLrbapzi.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { A as AgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as isPrivateAddress, f as issueAgentHttpsLeaf, g as CA_COMMON_NAME, h as pinnedHttpsCaFingerprint, i as certificateNames, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, l as isContainerBridgeAddress, m as pemDigest, n as acceptAgentSans, o as createAgentHttpsRequest, p as loadAgentHttps, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isLocalOnlyHostname, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts } from "./agent-https-DtRU9A7I.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-Cg9ve13y.mjs";
+import { A as AgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as isPrivateAddress, f as issueAgentHttpsLeaf, g as CA_COMMON_NAME, h as pinnedHttpsCaFingerprint, i as certificateNames, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, l as isContainerBridgeAddress, m as pemDigest, n as acceptAgentSans, o as createAgentHttpsRequest, p as loadAgentHttps, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isLocalOnlyHostname, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts } from "./agent-https-B8lKYVtU.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-DoiTA134.mjs";
 import { $ as requireProcessMeshCa, A as dropProcessPeer, At as setProcessMeshAuthStatusSource, B as openMeshTlsWhenRevocationsLoaded, C as Transporters, Ct as MESH_AUTH_MODE_FIELD, D as mintMeshJoinToken, Dt as parseMeshAuthMode, E as JoinTokenJtiStore, Et as isMeshAuthMode, F as onProcessNodeRegistered, Ft as readCidrSetting, G as RENEWAL_ABANDONED, H as MESH_NODE_CERTIFICATES_COLLECTION, I as setProcessMeshPeerTransportLookup, J as setProcessMeshCertificateRegistry, K as describeMeshLeaf, L as renewMeshCertificate, M as getProcessNodeMeshTransport, Mt as createCidrMatcher, N as getProcessPeerLeaf, Nt as normalizeIp, O as processJoinTokenJtiStore, Ot as requestProcessMeshEnforcement, P as isProcessVerifiedMeshPeer, Pt as parseCidrList, Q as getProcessMeshCaState, R as revokeMeshCertificate, S as ServiceBroker, St as verifyAgentUiUnlockTicketEs256, SystemConfigAddon, T as enrollMeshNode, Tt as getProcessMeshAuthStatus, U as MESH_NODE_CERTIFICATES_COLUMNS, V as setProcessMeshTlsListenerState, W as MeshCertificateRegistry, X as processMeshCrl, Y as MeshCrl, Z as MeshCaKeeper, _ as signPairingProof, _t as isAllowedAgentDashboardReturnTo, a as hubHostFromMeshAddress, at as generateMeshKeyPair, b as TlsTcpTransporter, bt as parseAgentDashboardOrigins, c as PAIRING_MAX_SESSIONS, ct as issueMeshLeafFromCsr, d as PAIRING_PROTOCOL, dt as AGENT_UI_UNLOCK_DOMAIN, et as caFingerprint, f as PAIRING_TTL_MS, ft as AGENT_UI_UNLOCK_TTL_MS, g as keyFingerprintShort, gt as UnlockTicketJtiStore, h as describeCsr, ht as AGENT_UI_UNLOCK_VERSION, i as AgentPairing, it as generateMeshCa, j as emitProcessNodeRegistered, jt as setProcessMeshEnforcer, k as verifyMeshJoinToken, kt as setProcessMeshAuthMode, l as PAIRING_PATHS, lt as loadMeshCa, m as computePairingSas, mt as AGENT_UI_UNLOCK_USE, n as HubPairing, nt as createMeshCsrPem, o as PAIRING_CODE_DIGITS, ot as isValidAgentNodeId, p as computePairingCommitment, pt as AGENT_UI_UNLOCK_TYP, q as getProcessMeshCertificateRegistry, r as PairingHttpError, rt as exportMeshPrivateKeyPem, s as PAIRING_MAX_CODE_ATTEMPTS, st as issueMeshLeafForNode, tt as caFingerprintCompact, u as PAIRING_PIN_DIGITS, ut as AGENT_DASHBOARD_ORIGINS_FIELD, v as verifyPairingProof, vt as mintAgentUiUnlockTicket, w as setProcessMeshTlsEnabler, wt as getProcessMeshAuthMode, x as Errors, xt as verifyAgentUiUnlockTicket, y as MESH_TLS_PORT_HELLO_FIELD, yt as mintAgentUiUnlockTicketEs256, z as getProcessMeshTlsListenerState } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BQnbN0DP.mjs";
-import { C as DEFAULT_LAN_HTTP_PORT, D as closeLanHttp, E as bindPendingLanHttp, O as readLanHttpState, S as reissueTlsLeaf, T as applyLanHttp, _ as splitPemCertificates, a as storeUploadedCertificate, b as ensureTlsCert, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, k as registerLanHttpHandler, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as validateUploadedTls, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as allFamiliesListenHost, x as loadTlsCert, y as writeTlsMode } from "./hub-mdns-ciao-8_Ed1Za5.mjs";
+import { C as DEFAULT_LAN_HTTP_PORT, D as closeLanHttp, E as bindPendingLanHttp, O as readLanHttpState, S as reissueTlsLeaf, T as applyLanHttp, _ as splitPemCertificates, a as storeUploadedCertificate, b as ensureTlsCert, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, k as registerLanHttpHandler, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as validateUploadedTls, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as allFamiliesListenHost, x as loadTlsCert, y as writeTlsMode } from "./hub-mdns-ciao-DJRwtlA8.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-C3_rzOCx.mjs";
+import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-DJYuznWP.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";

package/dist/kernel/moleculer/mesh-mtls/mesh-ca.d.ts

@@ -1,12 +1,3 @@
-/**
-* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
-*
-* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
-* signs node leaves (CN = nodeID) and join-token JWS (ES256). Issuance uses
-* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
-* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
-* the pinned range already shipping).
-*/
 import type { webcrypto as WebCrypto } from "node:crypto";
 import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
 /** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */

package/dist/{lib-B_R6sPC3.mjs → lib-BeGzVQcd.mjs}

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, r as __exportAll, t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
-import { h as tslib_es6_exports, m as init_tslib_es6 } from "./x509.es-CAjSsrkk.mjs";
+import { h as tslib_es6_exports, m as init_tslib_es6 } from "./x509.es-CDvj67p1.mjs";
 import { t as require_src } from "./src-hG4grMU4.mjs";
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/{lib-DOJ5yyWA.js → lib-NNxHSOIE.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_x509_es = require("./x509.es-Dzl0BbmG.js");
+const require_x509_es = require("./x509.es-r7Ht1thA.js");
 const require_src$1 = require("./src-CnAqG6EF.js");
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) => {

package/dist/{restore-archive-DqPaRjjY.js → restore-archive-BNoFLAg8.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-C6Yvfhpq.js");
+const require_dist = require("./dist-CnUtkSwN.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{restore-archive-C3_rzOCx.mjs → restore-archive-DJYuznWP.mjs}

@@ -1,4 +1,4 @@
-import { v as DATABASE_SNAPSHOT_SUFFIX } from "./dist-DJnlnL7P.mjs";
+import { v as DATABASE_SNAPSHOT_SUFFIX } from "./dist-Bz4_y8Xy.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{retired-settings-keys-CAWHWDwy.mjs → retired-settings-keys-9nA85bwT.mjs}

@@ -1,4 +1,4 @@
-import { kr as asJsonObject } from "./dist-DJnlnL7P.mjs";
+import { jr as asJsonObject } from "./dist-Bz4_y8Xy.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-DJBQkZok.js → retired-settings-keys-CO3RqsDw.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-C6Yvfhpq.js");
+const require_dist = require("./dist-CnUtkSwN.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/tls/cert-backdate.d.ts

@@ -0,0 +1,10 @@
+/**
+* How far a freshly issued certificate's `notBefore` is moved into the past.
+*
+* TLS refuses a certificate whose `notBefore` is in the verifier's future, and X.509 dates have
+* one-second resolution, so a certificate dated "now" fails the handshake on any peer whose clock
+* runs even slightly behind the issuer's. Expiry is always computed from the real `now`; only the
+* start of validity moves.
+*/
+export declare const CERT_NOT_BEFORE_BACKDATE_MS: number;
+export declare function backdatedNotBefore(now: Date): Date;

package/dist/tls/cert-issue.d.ts

@@ -1,23 +1,3 @@
-/**
-* Certificate issuance. Isolated so `cert-manager.ts` reads as policy and
-* this file reads as mechanics.
-*
-* **In-process, by decision (D551).** This used to shell out to `openssl`
-* three times. The hub's own TLS identity is not allowed to be a function
-* of which openssl happens to sit on the host: this fleet alone runs four
-* of them, and one — Ubuntu 20.04's 1.1.1f — silently ADDED the ambient
-* `/etc/ssl/openssl.cnf` `[req] x509_extensions = v3_ca` block on top of
-* our `-addext` flags, producing a root with two `basicConstraints` and
-* two `subjectKeyIdentifier` extensions. RFC 5280 §4.2 allows each at
-* most once, so OpenSSL 3 (which is what `node:crypto` is) marked that
-* root invalid: `X509Certificate.ca` read `false` on our own CA and
-* `checkIssued()` refused the pair. Under D227 that means "not issued by
-* the local CA", i.e. rotate the root — on every boot, forever, voiding
-* every trust an operator had granted by hand.
-*
-* Keys come from WebCrypto (`node:crypto`'s own implementation) and the
-* DER is assembled by `@peculiar/x509`. Nothing here reads the host.
-*/
 import type { webcrypto as WebCrypto } from "node:crypto";
 import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
 import type { CertIdentity } from "./cert-identity.js";

package/dist/{x509.es-CAjSsrkk.mjs → x509.es-CDvj67p1.mjs}

@@ -1,4 +1,17 @@
 import { n as __esmMin, r as __exportAll, t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
+//#region src/tls/cert-backdate.ts
+/**
+* How far a freshly issued certificate's `notBefore` is moved into the past.
+*
+* TLS refuses a certificate whose `notBefore` is in the verifier's future, and X.509 dates have
+* one-second resolution, so a certificate dated "now" fails the handshake on any peer whose clock
+* runs even slightly behind the issuer's. Expiry is always computed from the real `now`; only the
+* start of validity moves.
+*/
+var CERT_NOT_BEFORE_BACKDATE_MS = 5 * 6e4;
+function backdatedNotBefore(now) {
+	return /* @__PURE__ */ new Date(now.getTime() - CERT_NOT_BEFORE_BACKDATE_MS);
+}
 /*! *****************************************************************************
 Copyright (C) Microsoft. All rights reserved.
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -11900,4 +11913,4 @@ AsnEcSignatureFormatter.namedCurveSize.set("K-256", 32);
 AsnEcSignatureFormatter.namedCurveSize.set("P-384", 48);
 AsnEcSignatureFormatter.namedCurveSize.set("P-521", 66);
 //#endregion
-export { KeyUsagesExtension as a, Pkcs10CertificateRequestGenerator as c, X509Certificate as d, X509CertificateGenerator as f, tslib_es6_exports as h, KeyUsageFlags as i, SubjectAlternativeNameExtension as l, init_tslib_es6 as m, BasicConstraintsExtension as n, PemConverter as o, cryptoProvider as p, ExtendedKeyUsageExtension as r, Pkcs10CertificateRequest as s, AuthorityKeyIdentifierExtension as t, SubjectKeyIdentifierExtension as u };
+export { KeyUsagesExtension as a, Pkcs10CertificateRequestGenerator as c, X509Certificate as d, X509CertificateGenerator as f, backdatedNotBefore as g, tslib_es6_exports as h, KeyUsageFlags as i, SubjectAlternativeNameExtension as l, init_tslib_es6 as m, BasicConstraintsExtension as n, PemConverter as o, cryptoProvider as p, ExtendedKeyUsageExtension as r, Pkcs10CertificateRequest as s, AuthorityKeyIdentifierExtension as t, SubjectKeyIdentifierExtension as u };

package/dist/{x509.es-Dzl0BbmG.js → x509.es-r7Ht1thA.js}

@@ -1,4 +1,17 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
+//#region src/tls/cert-backdate.ts
+/**
+* How far a freshly issued certificate's `notBefore` is moved into the past.
+*
+* TLS refuses a certificate whose `notBefore` is in the verifier's future, and X.509 dates have
+* one-second resolution, so a certificate dated "now" fails the handshake on any peer whose clock
+* runs even slightly behind the issuer's. Expiry is always computed from the real `now`; only the
+* start of validity moves.
+*/
+var CERT_NOT_BEFORE_BACKDATE_MS = 5 * 6e4;
+function backdatedNotBefore(now) {
+	return /* @__PURE__ */ new Date(now.getTime() - CERT_NOT_BEFORE_BACKDATE_MS);
+}
 /*! *****************************************************************************
 Copyright (C) Microsoft. All rights reserved.
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -11972,6 +11985,12 @@ Object.defineProperty(exports, "X509CertificateGenerator", {
 		return X509CertificateGenerator;
 	}
 });
+Object.defineProperty(exports, "backdatedNotBefore", {
+	enumerable: true,
+	get: function() {
+		return backdatedNotBefore;
+	}
+});
 Object.defineProperty(exports, "cryptoProvider", {
 	enumerable: true,
 	get: function() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.433",
+  "version": "1.2.435",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",