@camstack/system 1.2.451 → 1.2.453

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { Dn as looseSchema, En as logLevelAtMost, Fi as expandCapMethods, G as METHOD_ACCESS_MAP, Gr as DATAPLANE_SECRET_HEADER$1, Hn as procedureAuthKey, In as objectInputDeclaresAddonId, Kr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Ln as objectInputDeclaresRequiredDeviceId, Mi as defineRecordKinds, Ni as emitDownForOwnedCaps, Oi as createEvent$1, Sn as lifecycleJobSchema, U as LOG_LEVEL_RANK, Vr as errMsg$1, Wr as CALLER_STAMPED_CAPABILITIES$1, Xi as parseJsonObject, Zi as parseJsonUnknown, _ as CatalogFileSchema, _n as kebabToCamel$1, aa as scopeKey, bi as asNumber, ci as ReadinessRegistry, d as CATALOG_LANGS, dn as isArrayOutputSchema, dt as addonSettingsCapability, er as resolveMethodAuth, fa as userError, fn as isCollectionArrayMethod, gn as isVoidInput, hn as isObjectInput, ir as scopesAllowDeviceCap, li as ReadinessTimeoutError, ln as interpolate, ma as EventCategory$1, n as AGENT_MDNS_TXT_KEYS, pa as withoutCallerStamp, qr as DEVICE_STATUS_METHOD, r as ALL_CAPABILITY_DEFINITIONS, ra as resolveCapMount, rn as extractNestedAddonId, rr as scopesAllowAddon, si as RUNTIME_DEFAULTS, t as AGENT_MDNS_SERVICE_TYPE, ta as readinessKey, ur as splitTranslationRef, vr as supportedRuntimes, xi as asString$1, yi as asJsonObject$1 } from "./dist-DV2ll9Hi.mjs";
+import { Dn as looseSchema, En as logLevelAtMost, Fi as expandCapMethods, G as METHOD_ACCESS_MAP, Gr as DATAPLANE_SECRET_HEADER$1, Hn as procedureAuthKey, In as objectInputDeclaresAddonId, Kr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Ln as objectInputDeclaresRequiredDeviceId, Mi as defineRecordKinds, Ni as emitDownForOwnedCaps, Oi as createEvent$1, Sn as lifecycleJobSchema, U as LOG_LEVEL_RANK, Vr as errMsg$1, Wr as CALLER_STAMPED_CAPABILITIES$1, Xi as parseJsonObject, Zi as parseJsonUnknown, _ as CatalogFileSchema, _n as kebabToCamel$1, aa as scopeKey, bi as asNumber, ci as ReadinessRegistry, d as CATALOG_LANGS, dn as isArrayOutputSchema, dt as addonSettingsCapability, er as resolveMethodAuth, fa as userError, fn as isCollectionArrayMethod, gn as isVoidInput, hn as isObjectInput, ir as scopesAllowDeviceCap, li as ReadinessTimeoutError, ln as interpolate, ma as EventCategory$1, n as AGENT_MDNS_TXT_KEYS, pa as withoutCallerStamp, qr as DEVICE_STATUS_METHOD, r as ALL_CAPABILITY_DEFINITIONS, ra as resolveCapMount, rn as extractNestedAddonId, rr as scopesAllowAddon, si as RUNTIME_DEFAULTS, t as AGENT_MDNS_SERVICE_TYPE, ta as readinessKey, ur as splitTranslationRef, vr as supportedRuntimes, xi as asString$1, yi as asJsonObject$1 } from "./dist-B9C2v4SG.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-D05nqNXE.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-Dpkxg7px.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -26,21 +26,21 @@ import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { DeviceHistoryAddon } from "./builtins/device-history/device-history.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { l as SqliteSettingsBackend } from "./wal-maintenance-_tiSo8gz.mjs";
+import { l as SqliteSettingsBackend } from "./wal-maintenance-HEmw2Fik.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, l as STORAGE_DRAIN_STATE_LEGACY, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService, u as storageOrchestratorRecordKinds } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-gzGZbnwO.mjs";
-import { $ as generateMeshKeyPair, A as isConstrainedCa, C as MAX_LEAF_VALIDITY_DAYS, D as PERMITTED_DNS_SUFFIXES, F as AGENT_HTTPS_NAMES_COLLECTION, G as describeMeshLeaf, H as MESH_NODE_CERTIFICATES_COLUMNS, I as AGENT_HTTPS_NAMES_COLUMNS, J as caFingerprint, K as getProcessMeshCertificateRegistry, L as AgentHttpsNames, M as permitsIdentity, N as permitsName, O as PERMITTED_IP_RANGES, P as readNameConstraints, Q as generateMeshCa, R as getProcessAgentHttpsNames, S as LEAF_RENEWAL_WINDOW_DAYS, T as evaluateExistingCert, U as MeshCertificateRegistry, V as MESH_NODE_CERTIFICATES_COLLECTION, W as RENEWAL_ABANDONED, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, a as collectAgentNames, b as systemHostFacts, c as installAgentHttps, d as issueAgentHttpsLeaf, et as isValidAgentNodeId, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isLocalOnlyHostname, k as buildNameConstraintSet, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, nt as issueMeshLeafFromCsr, o as createAgentHttpsRequest, p as pemDigest, q as setProcessMeshCertificateRegistry, r as agentHttpsPaths, rt as loadMeshCa, s as describeHttpsLeaf, t as AgentHttpsInstallError, tt as issueMeshLeafForNode, u as isPrivateAddress, w as SERVER_AUTH_OID, x as CA_VALIDITY_DAYS, y as collectCertIdentity, z as setProcessAgentHttpsNames } from "./agent-https-D6lRxHma.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-DGBB3tNi.mjs";
+import { $ as generateMeshKeyPair, A as isConstrainedCa, C as MAX_LEAF_VALIDITY_DAYS, D as PERMITTED_DNS_SUFFIXES, F as AGENT_HTTPS_NAMES_COLLECTION, G as describeMeshLeaf, H as MESH_NODE_CERTIFICATES_COLUMNS, I as AGENT_HTTPS_NAMES_COLUMNS, J as caFingerprint, K as getProcessMeshCertificateRegistry, L as AgentHttpsNames, M as permitsIdentity, N as permitsName, O as PERMITTED_IP_RANGES, P as readNameConstraints, Q as generateMeshCa, R as getProcessAgentHttpsNames, S as LEAF_RENEWAL_WINDOW_DAYS, T as evaluateExistingCert, U as MeshCertificateRegistry, V as MESH_NODE_CERTIFICATES_COLLECTION, W as RENEWAL_ABANDONED, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, a as collectAgentNames, b as systemHostFacts, c as installAgentHttps, d as issueAgentHttpsLeaf, et as isValidAgentNodeId, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isLocalOnlyHostname, k as buildNameConstraintSet, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, nt as issueMeshLeafFromCsr, o as createAgentHttpsRequest, p as pemDigest, q as setProcessMeshCertificateRegistry, r as agentHttpsPaths, rt as loadMeshCa, s as describeHttpsLeaf, t as AgentHttpsInstallError, tt as issueMeshLeafForNode, u as isPrivateAddress, w as SERVER_AUTH_OID, x as CA_VALIDITY_DAYS, y as collectCertIdentity, z as setProcessAgentHttpsNames } from "./agent-https-XAZFJjOS.mjs";
 import { $ as parseCidrList, A as setProcessMeshPeerTransportLookup, B as requireProcessMeshCa, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as AGENT_UI_UNLOCK_VERSION, H as AGENT_UI_UNLOCK_TTL_MS, I as MeshCrl, J as mintAgentUiUnlockTicket, K as UnlockTicketJtiStore, L as processMeshCrl, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as normalizeIp, R as MeshCaKeeper, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as AGENT_UI_UNLOCK_TYP, V as AGENT_DASHBOARD_ORIGINS_FIELD, W as AGENT_UI_UNLOCK_USE, X as verifyAgentUiUnlockTicket, Y as parseAgentDashboardOrigins, Z as createCidrMatcher, _ as signPairingProof, a as hubHostFromMeshAddress, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, d as PAIRING_PROTOCOL, et as readCidrSetting, f as PAIRING_TTL_MS, g as keyFingerprintShort, h as describeCsr, i as AgentPairing, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, m as computePairingSas, n as HubPairing, o as PAIRING_CODE_DIGITS, p as computePairingCommitment, q as isAllowedAgentDashboardReturnTo, r as PairingHttpError, s as PAIRING_MAX_CODE_ATTEMPTS, u as PAIRING_PIN_DIGITS, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as getProcessMeshCaState } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-stpC3Zy-.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-BPOg2iyc.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-B4wHDMvk.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as backupOrchestratorRecordKinds, f as BackupDecryptError, g as generateBackupKeyPair, l as backupRecordStoresOf, m as BackupKeyMismatchError, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, v as readBackupEncryptionHeader } from "./restore-archive-Jiz63mVB.mjs";
+import { c as backupOrchestratorRecordKinds, f as BackupDecryptError, g as generateBackupKeyPair, l as backupRecordStoresOf, m as BackupKeyMismatchError, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, v as readBackupEncryptionHeader } from "./restore-archive-D7HwsszI.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -11606,8 +11606,16 @@ function buildOneCapRouter(def, primitives, services) {
 					const nodeId = typeof picked.nodeId === "string" ? picked.nodeId : void 0;
 					const topLevelAddonId = typeof picked.addonId === "string" ? picked.addonId : void 0;
 					const canRecoverNestedAddonId = !isArrayOutputSchema(method.schema.output) && !objectInputDeclaresAddonId(method.schema.input);
-					const addonId = topLevelAddonId ?? (canRecoverNestedAddonId ? extractNestedAddonId(rest) : void 0);
-					return invokeCapMethod(resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services, topLevelAddonId), method, method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest, capName, isCollection, services);
+					let addonId = topLevelAddonId ?? (canRecoverNestedAddonId ? extractNestedAddonId(rest) : void 0);
+					const resolveAndInvoke = async () => {
+						let refusePin = topLevelAddonId;
+						if (addonId === void 0 && !method.isArrayOutput && services.inferCollectionAddonPin) {
+							addonId = await Promise.resolve(services.inferCollectionAddonPin(capName, method.name, rest));
+							if (addonId !== void 0) refusePin = addonId;
+						}
+						return invokeCapMethod(resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services, refusePin), method, method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest, capName, isCollection, services);
+					};
+					return resolveAndInvoke();
 				}
 				const { rest, picked } = stripKeys(input, ["nodeId"]);
 				return invokeCapMethod(resolveProviderForCall(capName, typeof picked.nodeId === "string" ? picked.nodeId : void 0, () => getLocal(ctx), services), method, method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest, capName, isCollection, services);

package/dist/kernel/cap-router-builder.d.ts

@@ -136,6 +136,15 @@ export interface CapRouterServices {
 	*/
 	readonly rejectUnresolvedAddonPin?: (capName: string, addonId: string) => void;
 	/**
+	* When a collection cap call has no top-level `{ addonId }` pin (and nested
+	* recovery did not apply), the server may infer the owning provider from the
+	* method payload — e.g. `device-adoption` maps `integrationId` → addon via the
+	* integrations store, or `camDeviceId` → addon via the device registry for
+	* `resync`. Return `undefined` to keep the cap's default collection routing;
+	* implementations that cannot infer MUST throw via {@link badRequest}.
+	*/
+	readonly inferCollectionAddonPin?: (capName: string, methodName: string, methodInput: Record<string, unknown>) => string | undefined | Promise<string | undefined>;
+	/**
 	* Raise the canonical error for a resolved provider that does NOT
 	* implement `method` (Task 7.5d). Before this existed the router called
 	* `provider[method.name]?.(payload)` — an optional call that let a missing

package/dist/{phase6-declare-gate-C6WqagkC.js → phase6-declare-gate-BlTDMI3t.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-Ct88catN.js");
+const require_dist = require("./dist-DyjNaeIj.js");
 //#region src/builtins/records/legacy-table-row-count.ts
 /** Row count for a physical settings-db table (matches the records engine `legacyRowCount`). */
 function legacyTableRowCountFromList(tables, collection) {

package/dist/{phase6-declare-gate-BJplW6tX.mjs → phase6-declare-gate-CNxKbsvm.mjs}

@@ -1,4 +1,4 @@
-import { Ai as declarationsOf } from "./dist-DV2ll9Hi.mjs";
+import { Ai as declarationsOf } from "./dist-B9C2v4SG.mjs";
 //#region src/builtins/records/legacy-table-row-count.ts
 /** Row count for a physical settings-db table (matches the records engine `legacyRowCount`). */
 function legacyTableRowCountFromList(tables, collection) {

package/dist/{restore-archive-Cprdh3P9.js → restore-archive-BeGP9IYs.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Ct88catN.js");
+const require_dist = require("./dist-DyjNaeIj.js");
 const require_read_all_rows$1 = require("./read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/{restore-archive-Jiz63mVB.mjs → restore-archive-D7HwsszI.mjs}

@@ -1,4 +1,4 @@
-import { A as DataStoreDatabaseSchema, Mi as defineRecordKinds, b as DATABASE_SNAPSHOT_SUFFIX } from "./dist-DV2ll9Hi.mjs";
+import { A as DataStoreDatabaseSchema, Mi as defineRecordKinds, b as DATABASE_SNAPSHOT_SUFFIX } from "./dist-B9C2v4SG.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.451",
+  "version": "1.2.453",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",