@camstack/system 1.2.453 → 1.2.455

package/dist/{agent-https-DL2cFOQv.js → agent-https-CCvlRQKV.js}

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DyjNaeIj.js");
+const require_dist = require("./dist-DjQ8C-ku.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
-const require_constants = require("./constants-B3fDUnJt.js");
+const require_constants = require("./constants-DruwCkfp.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/{agent-https-XAZFJjOS.mjs → agent-https-CLWrOO3o.mjs}

@@ -1,6 +1,6 @@
-import { Mi as defineRecordKinds } from "./dist-B9C2v4SG.mjs";
+import { Li as defineRecordKinds } from "./dist-BpSENkRJ.mjs";
 import { S as backdatedNotBefore, _ as NameConstraints, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, g as GeneralSubtrees, h as GeneralSubtree, i as Extension, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension, v as GeneralName, x as AsnConvert } from "./x509.es-DK__ETIe.mjs";
-import { c as SERVER_AUTH_OID$1, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "./constants-DGBB3tNi.mjs";
+import { c as SERVER_AUTH_OID$1, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "./constants-DOlYt1t1.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/auth/auth-audit-log.d.ts

@@ -8,7 +8,7 @@ import type { AuthAuditBody } from "../builtins/local-auth/record-kinds.js";
 */
 export declare const AUTH_AUDIT_COLLECTION = "auth_audit";
 export declare const AUTH_AUDIT_COLUMNS: readonly CollectionColumn[];
-export declare const AUTH_AUDIT_ACTIONS: readonly ["second-factor-skipped", "admin-token-created", "admin-token-used", "admin-token-revoked", "credentials-revoked", "agent-addon-update", "agent-addon-update-refused", "device-credential-enrolled", "device-credential-revoked", "device-credential-login", "device-credential-login-refused"];
+export declare const AUTH_AUDIT_ACTIONS: readonly ["second-factor-skipped", "admin-token-created", "admin-token-used", "admin-token-revoked", "credentials-revoked", "agent-addon-update", "agent-addon-update-refused", "device-credential-enrolled", "device-credential-revoked", "device-credential-login", "device-credential-login-refused", "token-minted", "token-revoked"];
 export type AuthAuditAction = (typeof AUTH_AUDIT_ACTIONS)[number];
 export interface AuthAuditEvent {
 	readonly action: AuthAuditAction;

package/dist/auth/auth-manager.d.ts

@@ -1,4 +1,4 @@
-import type { IScopedLogger, TokenPayload } from "@camstack/types";
+import type { CredentialTokenClaims, IScopedLogger, TokenPayload } from "@camstack/types";
 import { SsoBridgeClaimsSchema } from "@camstack/types";
 import type { z } from "zod";
 import { type JwtSigningKeySource } from "./jwt-signing-key.js";
@@ -53,6 +53,12 @@ export declare class AuthManager {
 	* already had once.
 	*/
 	private readConfiguredExpiry;
+	/**
+	* Sign a unified token (D892). No `exp`: the token's row — read by `jti` on
+	* every verify for revocation — holds its one expiry. The claims are parsed
+	* before signing, so nothing outside the schema is ever signed.
+	*/
+	signCredentialToken(claims: CredentialTokenClaims): string;
 	verifyToken(token: string): TokenPayload;
 	hashPassword(password: string): Promise<string>;
 	comparePassword(password: string, hash: string): Promise<boolean>;

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DyjNaeIj.js");
+const require_dist = require("../../dist-DjQ8C-ku.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Hr as BaseAddon, Vr as errMsg, ma as EventCategory, ut as addonPagesCapability } from "../../dist-B9C2v4SG.mjs";
+import { Kr as errMsg, dt as addonPagesCapability, qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DyjNaeIj.js");
+const require_dist = require("../../dist-DjQ8C-ku.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Hr as BaseAddon, Vr as errMsg, ft as addonWidgetsCapability, ma as EventCategory } from "../../dist-B9C2v4SG.mjs";
+import { Kr as errMsg, pt as addonWidgetsCapability, qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alert-episode-policy.d.ts

@@ -0,0 +1,39 @@
+/**
+* When does an alert open a new EPISODE, and which edge of it is announced?
+*
+* The alert centre sends no notification. It stamps every alert it stores with
+* an `episodeId` (`metadata.episodeId`) and announces the opening and the
+* closing of critical and error episodes on the bus; Notification Center turns
+* those into notifications (`alert-critical`, `alert-error`,
+* `alert-critical-resolved`). The identity is what makes a notification
+* once-per-episode: any number of re-emits of an open alert keep the id, a new
+* episode after completion gets a new one.
+*/
+import { type AlertSeverity, type AlertStatus } from "@camstack/types";
+/** What the policy needs of a stored alert. */
+export interface EpisodeView {
+	readonly status: AlertStatus;
+	readonly severity: AlertSeverity;
+	readonly episodeId: string;
+	/** The emitter's own episode marker (`metadata.episodeKey`), when it has one. */
+	readonly episodeKey?: string;
+}
+export interface NextEpisodeIdInput {
+	readonly alertId: string;
+	readonly previous: EpisodeView | null;
+	readonly incomingKey: string | undefined;
+	readonly now: number;
+}
+/**
+* The previous episode continues while its alert is still open and the emitter
+* did not mark a new one; anything else opens `<alertId>@<now>`.
+*/
+export declare function nextEpisodeId(input: NextEpisodeIdInput): string;
+export type EpisodeEdge = "raised" | "resolved";
+/**
+* The edge to announce for a write that took `previous` to `next`, or `null`.
+* A re-emit that changes nothing about the episode announces nothing; an
+* escalation from `error` to `critical` inside one episode is announced again
+* (it is a different kind, and the operator opted into it separately).
+*/
+export declare function episodeEdge(previous: EpisodeView | null, next: EpisodeView): EpisodeEdge | null;

package/dist/builtins/alerts/alerts.addon.d.ts

@@ -3,23 +3,11 @@ import { BaseAddon, type ProviderRegistration } from "@camstack/types";
 interface AlertCenterConfig {
 	readonly maxAlerts: number;
 	readonly retentionDays: number;
-	/** Push critical system alerts (runner failed/refused, runners degraded) straight to the notifiers (D877). */
-	readonly criticalPushEnabled: boolean;
-	/**
-	* Notifier target ids for that push (`notification-target-multiselect`).
-	* Empty = every enabled operator-level (shared) target. A legacy CSV string
-	* still stored in the addon store is accepted at read time.
-	*/
-	readonly criticalPushTargetIds: readonly string[];
 }
 export declare class AlertCenterAddon extends BaseAddon<AlertCenterConfig> {
 	private alertStore;
 	private unsubscribers;
-	/** How long a burst of critical findings is gathered into one digest push. */
-	private readonly pushCoalesceMs;
-	constructor(options?: {
-		readonly pushCoalesceMs?: number;
-	});
+	constructor();
 	/**
 	* Per `(category, source.id)` counter used to rate-limit chatty
 	* events. Entries are pruned lazily when they age out of
@@ -37,41 +25,25 @@ export declare class AlertCenterAddon extends BaseAddon<AlertCenterConfig> {
 	markRead(alertId: string): Promise<void>;
 	markAllRead(): Promise<void>;
 	dismiss(alertId: string): Promise<void>;
+	/**
+	* Events are handled one at a time: every handler is a read-modify-write of
+	* an alert, and two concurrent events about one runner would both read "no
+	* alert yet" and open two episodes for it.
+	*/
+	private eventChain;
 	private handleEvent;
+	private processEvent;
 	private readRunnerRecord;
 	private handleRunnerEvent;
 	/**
 	* A runner reached `running`: its episode is over. Close the runner alert so a
-	* later failure opens a NEW episode (new push key), instead of folding into a
-	* stale `refused` record that would never push again.
+	* later failure opens a NEW episode, instead of folding into a stale
+	* `refused` record whose notification was already sent.
 	*/
 	private handleRunnerStateChanged;
 	/** The node's one-shot runner boot check: one alert, dismissed when the node is clean. */
 	private handleRunnerCheck;
 	private readAlertRaw;
-	/** Pushes run one at a time so a burst can never send the same state twice. */
-	private pushChain;
-	/** Findings waiting for the next digest, by alert id. */
-	private readonly pushQueue;
-	private pushTimer;
-	private pushPolicy;
-	/** Rewrite a legacy CSV `criticalPushTargetIds` string into `string[]`. */
-	private migrateCriticalPushTargetIds;
-	private pushPorts;
-	/**
-	* Queue a critical finding for the next digest. A burst (every runner of a boot)
-	* arrives within the coalesce window and leaves as ONE message per target.
-	*/
-	private queuePush;
-	/** Send the queued findings now (also the reconcile path). */
-	private flushPushes;
-	private storePushState;
-	/**
-	* Retry every critical alert whose push is still pending - at boot and when
-	* the notifiers or notification-center start. An alert whose state was already
-	* delivered is skipped by its key, so reconciling never sends twice.
-	*/
-	private reconcilePendingPushes;
 	private handleModelDownload;
 	/**
 	* `[ALERT-CENTER-EVENTS]` — rate limit a `(category, source.id)`
@@ -138,8 +110,23 @@ export declare class AlertCenterAddon extends BaseAddon<AlertCenterConfig> {
 	* Read-merge-write: SettingsBackend.update() replaces the entire `data` blob,
 	* so we must read the existing record, merge the patch, and write back.
 	*/
+	/** Alert writes (stamp + store + announce) from any caller, one at a time. */
+	private writeChain;
+	private serializedWrite;
 	private mergeUpdate;
+	private mergeUpdateNow;
+	/**
+	* Store an alert, stamping its episode identity. The stored alert is what a
+	* caller must use afterwards, and the opening or closing of a critical/error
+	* episode is announced here, in the one place every write passes through.
+	*/
 	private persistAlert;
+	private persistAlertNow;
+	/**
+	* Announce an episode edge on the bus. Telemetry, and it may be dropped
+	* (D8): Notification Center reconciles from the alerts store (D11, D49).
+	*/
+	private announceEpisode;
 	private emitAlertCreatedEvent;
 	private emitAlertUpdatedEvent;
 	private enforceMaxAlerts;