@camstack/system 1.2.435 → 1.2.437

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { At as deviceCredentialsCapability, C as DEVICE_ENROLLMENT_TTL_MS, G as ScopedTokenSchema, Gt as formatDeviceRevoker, K as SsoBridgeClaimsSchema, Qn as userManagementCapability, Z as UserRecordSchema, a as ApiKeyRecordSchema, ct as buildDeviceSignatureMessage, nt as authProviderCapability, st as buildDeviceEnrollmentLink, w as DEVICE_NONCE_TTL_MS, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { C as DEVICE_ENROLLMENT_TTL_MS, Cr as BaseAddon, G as ScopedTokenSchema, Kt as formatDeviceRevoker, Q as UserRecordSchema, a as ApiKeyRecordSchema, ct as buildDeviceEnrollmentLink, er as userManagementCapability, jt as deviceCredentialsCapability, lt as buildDeviceSignatureMessage, q as SsoBridgeClaimsSchema, rt as authProviderCapability, w as DEVICE_NONCE_TTL_MS } from "../../dist-m5JkT8UN.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-B6YJZus6.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-BhdBByGD.mjs";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -6448,6 +6448,33 @@ var ScopedTokenManager = class {
 	}
 };
 //#endregion
+//#region src/auth/session-revocation-bus.ts
+var BUS_KEY = Symbol.for("camstack.login-sessions.revocation-bus");
+function listeners() {
+	const existing = Reflect.get(globalThis, BUS_KEY);
+	if (existing instanceof Set) return existing;
+	const created = /* @__PURE__ */ new Set();
+	Reflect.set(globalThis, BUS_KEY, created);
+	return created;
+}
+/** Subscribe; returns the unsubscribe. */
+function onSessionsRevoked(listener) {
+	const set = listeners();
+	set.add(listener);
+	return () => {
+		set.delete(listener);
+	};
+}
+/** Announce an ended batch. A listener that throws never reaches the revoke. */
+function announceSessionsRevoked(event, onListenerError) {
+	if (event.sessionIds.length === 0 && !event.allOfUser) return;
+	for (const listener of [...listeners()]) try {
+		listener(event);
+	} catch (error) {
+		onListenerError?.(error);
+	}
+}
+//#endregion
 //#region src/auth/login-session-manager.ts
 /**
 * Login sessions — the server-side record behind every session token.
@@ -6797,6 +6824,7 @@ var LoginSessionManager = class {
 			revokedReason: reason
 		};
 		this.replace(session, updated);
+		this.announce([updated.id], session.userId, false, null, reason);
 		await this.persist(updated);
 		return true;
 	}
@@ -6820,6 +6848,7 @@ var LoginSessionManager = class {
 			this.replace(session, updated);
 			ended.push(updated);
 		}
+		this.announce(ended.map((s) => s.id), userId, true, options.exceptSessionId ?? null, options.reason);
 		await this.persistCutoff(userId, at);
 		for (const session of ended) await this.persist(session);
 		return ended.length;
@@ -6838,6 +6867,7 @@ var LoginSessionManager = class {
 			this.replace(session, updated);
 			ended.push(updated);
 		}
+		this.announce(ended.map((s) => s.id), null, false, null, reason);
 		for (const session of ended) await this.persist(session);
 		return ended.length;
 	}
@@ -6863,6 +6893,16 @@ var LoginSessionManager = class {
 		}
 		return dead.length;
 	}
+	/** Tell the hub which sessions just ended — right after the mirror, before the store write. */
+	announce(sessionIds, userId, allOfUser, exceptSessionId, reason) {
+		announceSessionsRevoked({
+			sessionIds,
+			userId,
+			allOfUser,
+			exceptSessionId,
+			reason
+		}, (error) => this.logger?.error("A session-revocation listener threw — the revoke stands", { meta: { error: error instanceof Error ? error.message : String(error) } }));
+	}
 	newRefreshToken() {
 		return `${REFRESH_TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("base64url")}`;
 	}
@@ -12061,4 +12101,4 @@ var LocalAuthAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { LocalAuthAddon, LocalAuthAddon as default, AuthManager as _, attachUserManagementInternal as a, isSettingsReadUnavailable as b, DeviceCredentialManager as c, ADMIN_TOKEN_MAX_LIFETIME_MS as d, ADMIN_TOKEN_PREFIX as f, ScopedTokenManager as g, REFRESH_TOKEN_PREFIX as h, USER_MANAGEMENT_INTERNAL as i, PREVIOUS_LEAF_GRACE_MS as l, LoginSessionManager as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, AdminTokenManager as p, UserManager as r, AuthAuditLog as s, FIRST_BOOT_ADMIN_PASSWORD as t, DeviceCaStore as u, parseTokenExpiry as v, ApiKeyManager as x, SettingsReadUnavailableError as y };
+export { LocalAuthAddon, LocalAuthAddon as default, ApiKeyManager as S, ScopedTokenManager as _, attachUserManagementInternal as a, SettingsReadUnavailableError as b, DeviceCredentialManager as c, ADMIN_TOKEN_MAX_LIFETIME_MS as d, ADMIN_TOKEN_PREFIX as f, onSessionsRevoked as g, REFRESH_TOKEN_PREFIX as h, USER_MANAGEMENT_INTERNAL as i, PREVIOUS_LEAF_GRACE_MS as l, LoginSessionManager as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, AdminTokenManager as p, UserManager as r, AuthAuditLog as s, FIRST_BOOT_ADMIN_PASSWORD as t, DeviceCaStore as u, AuthManager as v, isSettingsReadUnavailable as x, parseTokenExpiry as y };

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CBLvq2oj.js");
 let zod = require("zod");
 let node_net = require("node:net");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,8 +1,8 @@
-import { An as resolveAppConnections, B as NetworkTunnelStartedDataSchema, Cn as pickAppLinkHub, Jt as isAppLinkBase, Ln as resolveNotificationTapAddress, M as HUB_MDNS_SERVICE_TYPE, N as HUB_MDNS_TXT_KEYS, Pn as resolveHubAddressRoles, Zt as isDefaultAppConnectionEndpoint, er as validateCustomAddress, l as CAMSTACK_APP_LINK_ORIGIN, pi as EventCategory, pt as checkRoleAddress, sn as localNetworkCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
-import { C as DEFAULT_LAN_HTTP_PORT, O as readLanHttpState, T as applyLanHttp, a as storeUploadedCertificate, b as ensureTlsCert, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, m as readExtraSans, n as applyCertificateToListener, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans } from "../../hub-mdns-ciao-DJRwtlA8.mjs";
+import { B as NetworkTunnelStartedDataSchema, Cr as BaseAddon, Fn as resolveHubAddressRoles, M as HUB_MDNS_SERVICE_TYPE, N as HUB_MDNS_TXT_KEYS, Qt as isDefaultAppConnectionEndpoint, Rn as resolveNotificationTapAddress, Yt as isAppLinkBase, cn as localNetworkCapability, jn as resolveAppConnections, l as CAMSTACK_APP_LINK_ORIGIN, mt as checkRoleAddress, nr as validateCustomAddress, pi as EventCategory, wn as pickAppLinkHub } from "../../dist-m5JkT8UN.mjs";
+import { C as DEFAULT_LAN_HTTP_PORT, O as readLanHttpState, T as applyLanHttp, a as storeUploadedCertificate, b as ensureTlsCert, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, m as readExtraSans, n as applyCertificateToListener, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans } from "../../hub-mdns-ciao-DMlQTdPU.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
-import * as os from "node:os";
+import * as os$1 from "node:os";
 import { readFileSync } from "node:fs";
 //#region src/builtins/local-network/address-book.ts
 /**
@@ -1186,7 +1186,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 		}
 	}
 	enumerate() {
-		return enumerateOsInterfaces(os.networkInterfaces(), readLinuxIpv6Flags());
+		return enumerateOsInterfaces(os$1.networkInterfaces(), readLinuxIpv6Flags());
 	}
 	/**
 	* Replace rotated IPv6 and drop addresses that no longer exist, without

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { Cr as BaseAddon, un as logDestinationCapability } from "../../dist-m5JkT8UN.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,6 +1,6 @@
-import { Lr as createEvent, On as reducePoints, Wt as foldSnapshotByFunction, br as errMsg, hn as metricsProviderCapability, jn as resolveBucketMs, pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { Cr as BaseAddon, Gt as foldSnapshotByFunction, Mn as resolveBucketMs, Sr as errMsg, gn as metricsProviderCapability, kn as reducePoints, pi as EventCategory, zr as createEvent } from "../../dist-m5JkT8UN.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
-import * as os from "node:os";
+import * as os$1 from "node:os";
 import { platform } from "node:os";
 import * as fs from "node:fs";
 import { constants, readFileSync } from "node:fs";
@@ -2008,8 +2008,8 @@ async function readNvidiaGpu(deps) {
 }
 //#endregion
 //#region src/builtins/native-metrics/native-metrics-provider.ts
-var IS_DARWIN = os.platform() === "darwin";
-var IS_LINUX = os.platform() === "linux";
+var IS_DARWIN = os$1.platform() === "darwin";
+var IS_LINUX = os$1.platform() === "linux";
 var NativeMetricsProvider = class {
 	id = "native";
 	cachedSnapshot = null;
@@ -2149,14 +2149,14 @@ var NativeMetricsProvider = class {
 			system: pct(dSys),
 			irq: pct(dIrq),
 			nice: pct(dNice),
-			loadAvg: os.loadavg(),
-			cores: os.cpus().length
+			loadAvg: os$1.loadavg(),
+			cores: os$1.cpus().length
 		};
 	}
 	/** Cached macOS memory (set by sampleMacMemory timer). */
 	_cachedMacMem = null;
 	getMemoryInfo() {
-		const total = os.totalmem();
+		const total = os$1.totalmem();
 		if (total === 0) return {
 			percent: 0,
 			totalBytes: 0,
@@ -2166,7 +2166,7 @@ var NativeMetricsProvider = class {
 			swapTotalBytes: 0
 		};
 		if (IS_DARWIN && this._cachedMacMem !== null) return this._cachedMacMem;
-		const free = os.freemem();
+		const free = os$1.freemem();
 		const used = total - free;
 		let swapUsedBytes = 0;
 		let swapTotalBytes = 0;
@@ -2188,7 +2188,7 @@ var NativeMetricsProvider = class {
 	}
 };
 function aggregateCpuTimes() {
-	const cpus = os.cpus();
+	const cpus = os$1.cpus();
 	let user = 0, nice = 0, sys = 0, irq = 0, idle = 0;
 	for (const cpu of cpus) {
 		user += cpu.times.user;
@@ -2221,7 +2221,7 @@ function sampleMacMemory(provider) {
 		const purgeable = parse("Pages purgeable");
 		const speculative = parse("Pages speculative");
 		const available = free + inactive + purgeable + speculative;
-		const total = os.totalmem();
+		const total = os$1.totalmem();
 		const used = total - available;
 		let swapUsedBytes = 0;
 		let swapTotalBytes = 0;

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,6 +1,6 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { Ft as enumerateInferenceDevices, Tn as platformProbeCapability, Vn as scoreRuntimes, Vr as emitReadiness, br as errMsg, pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
-import * as os from "node:os";
+import { Cr as BaseAddon, En as platformProbeCapability, Hn as scoreRuntimes, It as enumerateInferenceDevices, Sr as errMsg, Ur as emitReadiness, pi as EventCategory } from "../../dist-m5JkT8UN.mjs";
+import * as os$1 from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -336,7 +336,7 @@ async function getAvailableRAM_MB() {
 		return Math.round(mem.available / 1024 / 1024);
 	} catch (err) {
 		console.debug(`systeminformation not available, using platform-specific RAM probe: ${errMsg(err)}`);
-		const platform = os.platform();
+		const platform = os$1.platform();
 		try {
 			if (platform === "darwin") {
 				const { stdout: output } = await execFileAsync("vm_stat", [], {
@@ -356,7 +356,7 @@ async function getAvailableRAM_MB() {
 		} catch (probeErr) {
 			console.debug(`RAM probe failed, using total RAM fallback: ${errMsg(probeErr)}`);
 		}
-		return Math.round(os.totalmem() / 1024 / 1024);
+		return Math.round(os$1.totalmem() / 1024 / 1024);
 	}
 }
 var PlatformScorer = class {
@@ -443,12 +443,12 @@ var PlatformScorer = class {
 		return this.cached;
 	}
 	async probeHardware() {
-		const platform = os.platform();
-		const arch = os.arch();
-		const cpus = os.cpus();
+		const platform = os$1.platform();
+		const arch = os$1.arch();
+		const cpus = os$1.cpus();
 		const cpuModel = cpus[0]?.model ?? "unknown";
 		const cpuCores = cpus.length;
-		const totalRAM_MB = Math.round(os.totalmem() / 1024 / 1024);
+		const totalRAM_MB = Math.round(os$1.totalmem() / 1024 / 1024);
 		const availableRAM_MB = await getAvailableRAM_MB();
 		this.logger.debug("RAM probed", { meta: {
 			totalRAM_MB,

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { Cr as BaseAddon, pi as EventCategory } from "../../dist-m5JkT8UN.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Ot as deriveBatteryPresence, Qr as nodePin, Wn as snapshotCapability, Xn as streamQualityLabel, _r as DeviceFeature, at as batteryCapability, br as errMsg, it as bareAddonId, mn as memoizePinnedFfmpeg, pi as EventCategory, s as BatteryStatusSchema, xr as BaseAddon, yr as DeviceType } from "../../dist-Bz4_y8Xy.mjs";
+import { $r as nodePin, Cr as BaseAddon, Kn as snapshotCapability, Qn as streamQualityLabel, Sr as errMsg, at as bareAddonId, hn as memoizePinnedFfmpeg, kt as deriveBatteryPresence, ot as batteryCapability, pi as EventCategory, s as BatteryStatusSchema, xr as DeviceType, yr as DeviceFeature } from "../../dist-m5JkT8UN.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Jn as storageProviderCapability, Ut as filesystemBrowseCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { Cr as BaseAddon, Wt as filesystemBrowseCapability, Xn as storageProviderCapability } from "../../dist-m5JkT8UN.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-D3gwRj1B.js");
+const require_wal_maintenance = require("../../wal-maintenance-Ch79gy9S.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-DLrbapzi.mjs";
+import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-DvnVO5IK.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-CO3RqsDw.js");
-const require_wal_maintenance = require("../../wal-maintenance-D3gwRj1B.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-DNfV28R_.js");
+const require_wal_maintenance = require("../../wal-maintenance-Ch79gy9S.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { Ct as dataStoreProviderCapability, Er as RUNTIME_DEFAULTS, _ as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, b as DATA_STORE_DATABASES, br as errMsg, it as bareAddonId, rr as vectorStoreCapability, v as DATABASE_SNAPSHOT_SUFFIX, wt as databaseSnapshotCapability, xr as BaseAddon, y as DATABASE_SNAPSHOT_TIMEOUT_MS } from "../../dist-Bz4_y8Xy.mjs";
-import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-9nA85bwT.mjs";
-import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-DLrbapzi.mjs";
+import { Cr as BaseAddon, Or as RUNTIME_DEFAULTS, Sr as errMsg, Tt as databaseSnapshotCapability, _ as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, ar as vectorStoreCapability, at as bareAddonId, b as DATA_STORE_DATABASES, v as DATABASE_SNAPSHOT_SUFFIX, wt as dataStoreProviderCapability, y as DATABASE_SNAPSHOT_TIMEOUT_MS } from "../../dist-m5JkT8UN.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-C5qP9QIf.mjs";
+import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-DvnVO5IK.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Fn as resolveLocationMode, Fr as collectSecretConfigKeys, Gn as storageCapability, Hn as settingsStoreCapability, I as LegacyStorageLocationDefaultSchema, J as StorageLocationModeSchema, Kn as storageMigrationCapability, Qt as isLocationEnabled, Tr as REDACTED_SECRET, X as StorageMigrationJobSchema, Y as StorageLocationTypeSchema, Yr as isSecretMarker, ai as resolveSecretMarkers, an as legacyModeOf, ei as parseJsonObject, fi as transformSecretWrite, fn as mayReadLocation, gn as modeMayWrite, ir as withLocationMode, pi as EventCategory, pn as mayWriteToLocation, q as StorageCleanupJobSchema, qt as gbToBytes, si as secretTreeFromPaths, xr as BaseAddon, zt as evictionPolicyOfLocation } from "../../dist-Bz4_y8Xy.mjs";
+import { $t as isLocationEnabled, Bt as evictionPolicyOfLocation, Cr as BaseAddon, Dr as REDACTED_SECRET, I as LegacyStorageLocationDefaultSchema, In as resolveLocationMode, J as StorageCleanupJobSchema, Jn as storageMigrationCapability, Jt as gbToBytes, Lr as collectSecretConfigKeys, Un as settingsStoreCapability, X as StorageLocationTypeSchema, Y as StorageLocationModeSchema, Z as StorageMigrationJobSchema, Zr as isSecretMarker, _n as modeMayWrite, ci as secretTreeFromPaths, fi as transformSecretWrite, mn as mayWriteToLocation, oi as resolveSecretMarkers, on as legacyModeOf, or as withLocationMode, pi as EventCategory, pn as mayReadLocation, qn as storageCapability, ti as parseJsonObject } from "../../dist-m5JkT8UN.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -5,7 +5,6 @@ import { systemConfigMeshActions } from "./mesh-actions.js";
 export declare const SYSTEM_CONFIG_CLUSTER_SECTION_ID = "system-config-cluster";
 export declare class SystemConfigAddon extends BaseAddon {
 	readonly id = "system-config";
-	private clusterSecretKeeper;
 	private meshCaKeeper;
 	private meshReapTimer;
 	private readonly meshGateTimers;
@@ -29,40 +28,29 @@ export declare class SystemConfigAddon extends BaseAddon {
 	* empty CRL would accept a revoked leaf. Retries until the settings store answers.
 	*/
 	private onMeshCaReady;
-	private mintJoinToken;
 	/** D821 — short-lived ticket for the agent's `:4444` unlock session. */
 	private mintAgentUiUnlock;
 	private readAgentDashboardOrigins;
-	private resolveHubUrl;
-	private resolveHubMeshAddress;
 	/** The keychain handle for owner `system`; `null` where there is no door. */
 	private systemSecrets;
 	private buildGlobalSchema;
 	getGlobalSettings(): Promise<ConfigUISchemaWithValues>;
 	/**
 	* The admin UI / `addonSettings` cap prefer {@link BaseAddon.updateGlobalSettingsAsOperator}.
-	* That BaseAddon path writes the generic addon store and never reaches
-	* {@link writeClusterSection}. Route the operator write through the same
-	* section-aware path as {@link updateGlobalSettings}.
+	* That BaseAddon path writes the generic addon store and never reaches the
+	* yml sections. Route the operator write through the same section-aware path
+	* as {@link updateGlobalSettings}.
 	*/
 	override updateGlobalSettingsAsOperator(patch: Record<string, unknown>, _nodeId?: string): Promise<void>;
-	updateGlobalSettings(patch: Record<string, unknown>): Promise<void>;
-	/**
-	* The cluster secret's save path: the value goes to the keychain (owner
-	* `system`), the row gets the marker; `''` / a view keeps. `$secretClear` is
-	* REFUSED: the secret is mandatory (D802). A value the keychain cannot store
-	* is REFUSED — never written inline (D787, P5). Mesh auth mode is always
-	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
-	*/
-	private writeClusterSection;
-	/** Persist + publish mesh auth mode (always `enforced` after D821). */
-	private writeMeshAuthMode;
 	/**
-	* First boot, or a keychain reset that cleared the marker (D802): a fresh
-	* random secret, stored like an operator save. Mesh auth stays enforced
-	* (D821) — every agent must present the secret; there is no transition window.
+	* The value to store for a `name` in a save, or `undefined` for "leave the row
+	* alone". The whole form posts every field, so an empty box on a hub that was
+	* never named is the NORMAL case and must write nothing (D861: a seed never
+	* overwrites); an empty box over a stored name is the operator clearing it,
+	* which stores `''` (readers treat it as unset). Anything else must be a valid
+	* name — refused whole, like the network lists.
 	*/
-	private generateClusterSecret;
-	private storeClusterSecret;
+	private normalizeServerName;
+	updateGlobalSettings(patch: Record<string, unknown>): Promise<void>;
 }
 export default SystemConfigAddon;