@camstack/system 1.2.438 → 1.2.439

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-GgG-7amw.js");
+const require_dist = require("../../dist-BOWdLjoK.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as StorageLocationTypeSchema, $n as storageMigrationCapability, Bn as resolveLocationMode, Hr as collectSecretConfigKeys, Mr as REDACTED_SECRET, Or as BaseAddon, Q as StorageLocationModeSchema, Qn as storageCapability, Ut as evictionPolicyOfLocation, Z as StorageCleanupJobSchema, Zt as gbToBytes, _i as transformSecretWrite, _n as mayReadLocation, di as resolveSecretMarkers, dr as withLocationMode, et as StorageMigrationJobSchema, ni as isSecretMarker, oi as parseJsonObject, pi as secretTreeFromPaths, qn as settingsStoreCapability, rn as isLocationEnabled, un as legacyModeOf, vn as mayWriteToLocation, xn as modeMayWrite, yi as EventCategory, z as LegacyStorageLocationDefaultSchema } from "../../dist-Dc8GKC5H.mjs";
+import { $ as StorageLocationTypeSchema, $n as storageMigrationCapability, Bn as resolveLocationMode, Hr as collectSecretConfigKeys, Mr as REDACTED_SECRET, Or as BaseAddon, Q as StorageLocationModeSchema, Qn as storageCapability, Ut as evictionPolicyOfLocation, Z as StorageCleanupJobSchema, Zt as gbToBytes, _i as transformSecretWrite, _n as mayReadLocation, di as resolveSecretMarkers, dr as withLocationMode, et as StorageMigrationJobSchema, ni as isSecretMarker, oi as parseJsonObject, pi as secretTreeFromPaths, qn as settingsStoreCapability, rn as isLocationEnabled, un as legacyModeOf, vn as mayWriteToLocation, xn as modeMayWrite, yi as EventCategory, z as LegacyStorageLocationDefaultSchema } from "../../dist-yI6kF6r6.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-GgG-7amw.js");
+const require_dist = require("../../dist-BOWdLjoK.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
-const require_x509_es = require("../../x509.es-r7Ht1thA.js");
-const require_agent_https = require("../../agent-https-BZIwS4xF.js");
-const require_constants$8 = require("../../constants-wkcn5Ij3.js");
+const require_x509_es = require("../../x509.es-C4cOo48M.js");
+const require_agent_https = require("../../agent-https-DlpTMDqA.js");
+const require_constants$8 = require("../../constants-BRsjQwi-.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,9 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Dr as errMsg, Gr as customAction, Jn as shortHostname, Kr as defineCustomActions, Or as BaseAddon, Y as ServerNameSchema, Zr as hydrateSchema } from "../../dist-Dc8GKC5H.mjs";
+import { Dr as errMsg, Gr as customAction, Jn as shortHostname, Kr as defineCustomActions, Or as BaseAddon, Y as ServerNameSchema, Zr as hydrateSchema } from "../../dist-yI6kF6r6.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
-import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-CDvj67p1.mjs";
-import { A as AgentHttpsNames, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, d as isPrivateAddress, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, u as isLocalOnlyHostname } from "../../agent-https-BPfHrI4c.mjs";
-import { a as MESH_CA_KEY_REF, c as SERVER_AUTH_OID, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "../../constants-DQK705Sb.mjs";
+import { S as backdatedNotBefore, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension } from "../../x509.es-DK__ETIe.mjs";
+import { F as AGENT_HTTPS_NAMES_COLLECTION, I as AGENT_HTTPS_NAMES_COLUMNS, L as AgentHttpsNames, R as getProcessAgentHttpsNames, j as isLocalOnlyHostname, u as isPrivateAddress, z as setProcessAgentHttpsNames } from "../../agent-https-U0d4uvn2.mjs";
+import { a as MESH_CA_KEY_REF, c as SERVER_AUTH_OID, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "../../constants-B92BjObl.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-GgG-7amw.js");
+const require_dist = require("../../dist-BOWdLjoK.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Or as BaseAddon, mn as logDestinationCapability } from "../../dist-Dc8GKC5H.mjs";
+import { Or as BaseAddon, mn as logDestinationCapability } from "../../dist-yI6kF6r6.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-DI3Z83vG.js → composition-sources-B4jC2FC7.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-GgG-7amw.js");
+const require_dist = require("./dist-BOWdLjoK.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-DpHGCjdL.mjs → composition-sources-BGOSCGWa.mjs}

@@ -1,4 +1,4 @@
-import { Dr as errMsg, br as compositionSourceKey } from "./dist-Dc8GKC5H.mjs";
+import { Dr as errMsg, br as compositionSourceKey } from "./dist-yI6kF6r6.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-DQK705Sb.mjs → constants-B92BjObl.mjs}

@@ -1,4 +1,4 @@
-import { Vr as buildSecretRef } from "./dist-Dc8GKC5H.mjs";
+import { Vr as buildSecretRef } from "./dist-yI6kF6r6.mjs";
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
 var MESH_CA_KEY_REF = buildSecretRef({
 	owner: "system",

package/dist/{constants-wkcn5Ij3.js → constants-BRsjQwi-.js}

@@ -1,5 +1,5 @@
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
-var MESH_CA_KEY_REF = require("./dist-GgG-7amw.js").buildSecretRef({
+var MESH_CA_KEY_REF = require("./dist-BOWdLjoK.js").buildSecretRef({
 	owner: "system",
 	scope: { kind: "global" },
 	fieldPath: "meshCaKey"

package/dist/{device-ca-DvIZjXIl.mjs → device-ca-46BUsWD1.mjs}

@@ -1,5 +1,5 @@
-import { D as DEVICE_SAN_CREDENTIAL_PREFIX, O as DEVICE_SAN_USER_PREFIX, Vr as buildSecretRef } from "./dist-Dc8GKC5H.mjs";
-import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CDvj67p1.mjs";
+import { D as DEVICE_SAN_CREDENTIAL_PREFIX, O as DEVICE_SAN_USER_PREFIX, Vr as buildSecretRef } from "./dist-yI6kF6r6.mjs";
+import { S as backdatedNotBefore, a as KeyUsageFlags, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension } from "./x509.es-DK__ETIe.mjs";
 import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{device-ca-BSvkXqyI.js → device-ca-DHG9OW2m.js}

@@ -1,5 +1,5 @@
-const require_dist = require("./dist-GgG-7amw.js");
-const require_x509_es = require("./x509.es-r7Ht1thA.js");
+const require_dist = require("./dist-BOWdLjoK.js");
+const require_x509_es = require("./x509.es-C4cOo48M.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{dist-GgG-7amw.js → dist-BOWdLjoK.js}

@@ -9321,11 +9321,10 @@ var ClipModelMetaSchema = zod.z.object({
 	/**
 	* The `vector-store` index this model's vectors live in. ONE feature space
 	* per index: two models share an index only when their vectors are ranked
-	* against each other, which for CLIP means never across families. MobileCLIP
-	* S1 and S2 share `object-clip` for history (separated by the row's
-	* `modelId`); any other model gets its own.
+	* against each other, which for CLIP means never across families. Every
+	* model gets its own.
 	*/
-	vectorIndex: zod.z.string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	vectorIndex: zod.z.string().regex(/^object-clip-[a-z0-9][a-z0-9-]*$/),
 	/**
 	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
 	* must be unique per tokenizer: every model's siblings land in ONE flat
@@ -61888,7 +61887,19 @@ var TlsStatusSchema = zod.z.object({
 	sans: zod.z.array(zod.z.string()),
 	caCertPem: zod.z.string().nullable(),
 	reissueError: zod.z.string().nullable(),
-	restartRequired: zod.z.boolean()
+	restartRequired: zod.z.boolean(),
+	/** An uploaded certificate is served but no CA is kept for it and it is not publicly signed (D873). */
+	caMissing: zod.z.boolean(),
+	/** Does the hub's own generated CA carry a critical name constraint? `null` while it has none. */
+	localCaConstrained: zod.z.boolean().nullable(),
+	/** ISO time the generated CA was replaced by a constrained one; devices must re-download it. */
+	caReplacedAt: zod.z.string().nullable(),
+	/** The uploaded certificate kept on disk, selectable again after "Revert to generated". */
+	storedUpload: zod.z.object({
+		leafFingerprintSha256: zod.z.string(),
+		validTo: zod.z.string(),
+		hasCa: zod.z.boolean()
+	}).nullable()
 });
 var localNetworkCapability = {
 	name: "local-network",
@@ -62082,7 +62093,10 @@ var localNetworkCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Replace the served material with operator-supplied PEMs. */
+		/**
+		* Replace the served material with operator-supplied PEMs. A certificate that does not lead
+		* to a public CA must come with its CA certificate, validated and kept for Download CA (D873).
+		*/
 		uploadCertificate: method(zod.z.object({
 			certPem: zod.z.string().min(1),
 			keyPem: zod.z.string().min(1),
@@ -62093,7 +62107,14 @@ var localNetworkCapability = {
 		}),
 		/** The local CA PEM, or empty when there is none to download. */
 		downloadCa: method(zod.z.void(), zod.z.object({ pem: zod.z.string() })),
-		/** Drop uploaded material and return to the generated local CA. */
+		/**
+		* Serve the kept upload again after "Revert to generated" (D873). Refused when none is kept.
+		*/
+		useStoredUploadedCertificate: method(zod.z.void(), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Return to the generated local CA. The uploaded certificate stays stored (D873). */
 		revertToGeneratedCertificate: method(zod.z.void(), TlsStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -76482,6 +76503,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.useStoredUploadedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.getStatus": {
 		capName: "lock-control",
 		capScope: "device",

package/dist/{dist-Dc8GKC5H.mjs → dist-yI6kF6r6.mjs}

@@ -9321,11 +9321,10 @@ var ClipModelMetaSchema = z.object({
 	/**
 	* The `vector-store` index this model's vectors live in. ONE feature space
 	* per index: two models share an index only when their vectors are ranked
-	* against each other, which for CLIP means never across families. MobileCLIP
-	* S1 and S2 share `object-clip` for history (separated by the row's
-	* `modelId`); any other model gets its own.
+	* against each other, which for CLIP means never across families. Every
+	* model gets its own.
 	*/
-	vectorIndex: z.string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	vectorIndex: z.string().regex(/^object-clip-[a-z0-9][a-z0-9-]*$/),
 	/**
 	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
 	* must be unique per tokenizer: every model's siblings land in ONE flat
@@ -61888,7 +61887,19 @@ var TlsStatusSchema = z.object({
 	sans: z.array(z.string()),
 	caCertPem: z.string().nullable(),
 	reissueError: z.string().nullable(),
-	restartRequired: z.boolean()
+	restartRequired: z.boolean(),
+	/** An uploaded certificate is served but no CA is kept for it and it is not publicly signed (D873). */
+	caMissing: z.boolean(),
+	/** Does the hub's own generated CA carry a critical name constraint? `null` while it has none. */
+	localCaConstrained: z.boolean().nullable(),
+	/** ISO time the generated CA was replaced by a constrained one; devices must re-download it. */
+	caReplacedAt: z.string().nullable(),
+	/** The uploaded certificate kept on disk, selectable again after "Revert to generated". */
+	storedUpload: z.object({
+		leafFingerprintSha256: z.string(),
+		validTo: z.string(),
+		hasCa: z.boolean()
+	}).nullable()
 });
 var localNetworkCapability = {
 	name: "local-network",
@@ -62082,7 +62093,10 @@ var localNetworkCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Replace the served material with operator-supplied PEMs. */
+		/**
+		* Replace the served material with operator-supplied PEMs. A certificate that does not lead
+		* to a public CA must come with its CA certificate, validated and kept for Download CA (D873).
+		*/
 		uploadCertificate: method(z.object({
 			certPem: z.string().min(1),
 			keyPem: z.string().min(1),
@@ -62093,7 +62107,14 @@ var localNetworkCapability = {
 		}),
 		/** The local CA PEM, or empty when there is none to download. */
 		downloadCa: method(z.void(), z.object({ pem: z.string() })),
-		/** Drop uploaded material and return to the generated local CA. */
+		/**
+		* Serve the kept upload again after "Revert to generated" (D873). Refused when none is kept.
+		*/
+		useStoredUploadedCertificate: method(z.void(), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Return to the generated local CA. The uploaded certificate stays stored (D873). */
 		revertToGeneratedCertificate: method(z.void(), TlsStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -76482,6 +76503,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.useStoredUploadedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.getStatus": {
 		capName: "lock-control",
 		capScope: "device",

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-mjB2i-VR.js");
+const require_wal_maintenance = require("./wal-maintenance-DEL_jeG0.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-Bx3lcVA7.mjs";
+import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-xsvdT5Go.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**