@camstack/system 1.2.455 → 1.2.456

package/dist/{hub-mdns-ciao-Bkrvgnma.js → hub-mdns-ciao-CZlZRxxA.js}

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DjQ8C-ku.js");
+const require_dist = require("./dist-BpqA2CT0.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
-const require_agent_https = require("./agent-https-CCvlRQKV.js");
+const require_agent_https = require("./agent-https-yjxdfJDA.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");
@@ -204,7 +204,13 @@ async function ensureTlsCert(dataDir, options) {
 	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
 	let dropped = [];
 	try {
-		dropped = await regenerate(paths, rawIdentity, commonName, validDays, caRotated, reason);
+		dropped = await regenerate(paths, rawIdentity, {
+			commonName,
+			caCommonName: require_agent_https.localCaCommonName(options?.hubName),
+			validDays,
+			newCa: caRotated,
+			reason
+		});
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		if (!canKeepServing(paths)) throw err;
@@ -234,7 +240,13 @@ async function reissueTlsLeaf(dataDir, options) {
 	});
 	const previousFingerprint = readFingerprint(paths.certPath);
 	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
-	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null, await regenerate(paths, identity, commonName, validDays, false, null));
+	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null, await regenerate(paths, identity, {
+		commonName,
+		caCommonName: require_agent_https.localCaCommonName(options?.hubName),
+		validDays,
+		newCa: false,
+		reason: null
+	}));
 }
 /**
 * Uploaded mode keeps a generated CA beside the upload (agents' leaves are still signed
@@ -260,7 +272,7 @@ async function replaceUnconstrainedLocalCa(dataDir, options) {
 		extraSans: options?.extraSans ?? [],
 		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
 	});
-	const ca = await require_agent_https.generateCa(/* @__PURE__ */ new Date(), identity.dnsNames);
+	const ca = await require_agent_https.generateCa(/* @__PURE__ */ new Date(), identity.dnsNames, require_agent_https.localCaCommonName(options?.hubName));
 	archivePreviousCa(paths, ca);
 	await (0, node_fs_promises.writeFile)(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
 	(0, _camstack_types_node.writeOwnerOnlyFileSync)(`${paths.caKeyPath}.new`, ca.keyPem);
@@ -297,15 +309,10 @@ function decideRegeneration(paths, identity) {
 		return "unreadable";
 	}
 }
-/**
-* Build every byte in memory, then move the files into place. A crash
-* mid-way leaves the previous material untouched; a crash between the
-* moves leaves a key/certificate mismatch, which the evaluator reports as
-* `key-mismatch` and heals on the next boot.
-*/
-async function regenerate(paths, rawIdentity, commonName, validDays, newCa, reason) {
+async function regenerate(paths, rawIdentity, params) {
+	const { commonName, caCommonName, validDays, newCa, reason } = params;
 	const now = /* @__PURE__ */ new Date();
-	const ca = newCa ? await require_agent_https.generateCa(now, rawIdentity.dnsNames) : await require_agent_https.loadCa((0, node_fs.readFileSync)(paths.caCertPath, "utf-8"), (0, node_fs.readFileSync)(paths.caKeyPath, "utf-8"));
+	const ca = newCa ? await require_agent_https.generateCa(now, rawIdentity.dnsNames, caCommonName) : await require_agent_https.loadCa((0, node_fs.readFileSync)(paths.caCertPath, "utf-8"), (0, node_fs.readFileSync)(paths.caKeyPath, "utf-8"));
 	const constraints = require_agent_https.readNameConstraints(ca.cert);
 	const { identity, dropped } = constraints === null ? {
 		identity: rawIdentity,

package/dist/index.d.ts

@@ -9,15 +9,12 @@ export { ApiKeyManager } from "./auth/api-key-manager.js";
 export type { AuthConfigReader, ReauthClaims, TokenPayload } from "./auth/auth-manager.js";
 export { AuthManager } from "./auth/auth-manager.js";
 export { scopesAllowAddon, scopesAllowDeviceCap } from "./auth/scope-matcher.js";
-export { ScopedTokenManager } from "./auth/scoped-token-manager.js";
 export type { TokenExpiryResult } from "./auth/token-expiry.js";
 export { parseTokenExpiry } from "./auth/token-expiry.js";
 export type { CreateLoginSessionInput, LoginSessionCheck, LoginSessionMethod, LoginSessionRecord, LoginSessionRefresh, LoginSessionRevocation, LoginSessionSummary } from "./auth/login-session-manager.js";
 export { LoginSessionManager, REFRESH_TOKEN_PREFIX } from "./auth/login-session-manager.js";
 export { onSessionsRevoked } from "./auth/session-revocation-bus.js";
 export type { SessionsRevokedEvent, SessionsRevokedListener } from "./auth/session-revocation-bus.js";
-export type { AdminTokenRecord } from "./auth/admin-token-manager.js";
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AdminTokenManager } from "./auth/admin-token-manager.js";
 export { DeviceCaStore } from "./auth/device-ca-store.js";
 export { DEVICE_CA_KEY_REF, type DeviceCaSigner, generateDeviceCa, issueDeviceLeaf, loadDeviceCa, verifyDeviceLeaf, verifyDeviceSignature } from "./auth/device-ca.js";
 export { type AuthenticatedDevice, DeviceCredentialManager, type DeviceCredentialRecord, type DeviceCredentialState, PREVIOUS_LEAF_GRACE_MS, type DeviceCheckRefusal, type IssuedDeviceCertificate } from "./auth/device-credential-manager.js";
@@ -25,7 +22,8 @@ export { AuthAuditLog } from "./auth/auth-audit-log.js";
 export type { AuthAuditAction, AuthAuditEvent, AuthAuditRecord } from "./auth/auth-audit-log.js";
 export type { CidrMatcher, ParsedCidr, ParsedCidrList } from "./auth/cidr.js";
 export { createCidrMatcher, normalizeIp, parseCidrList, readCidrSetting } from "./auth/cidr.js";
-export type { AdminTokensInternal, AuthAuditInternal, DeviceCredentialsInternal, LinkExternalIdentityInput, LoginSessionsInternal, SetPasswordInput, UserManagementInternal } from "./auth/user-management-internal.js";
+export type { AuthAuditInternal, DeviceCredentialsInternal, LinkExternalIdentityInput, LoginSessionsInternal, SetPasswordInput, UserManagementInternal, UserPreferencesInternal } from "./auth/user-management-internal.js";
+export { type PreferencesLimitReason, preferencesLimitReasonOf } from "./builtins/local-auth/user-preferences-store.js";
 export { attachUserManagementInternal, getUserManagementInternal, USER_MANAGEMENT_INTERNAL } from "./auth/user-management-internal.js";
 export type { UserRecord, UserStorageAccess } from "./auth/user-manager.js";
 export { FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, UserManager } from "./auth/user-manager.js";

package/dist/index.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DjQ8C-ku.js");
+const require_dist = require("./dist-BpqA2CT0.js");
 const require_read_all_rows$1 = require("./read-all-rows-CVoO1ONM.js");
-const require_device_ca = require("./device-ca-QPBgfqVY.js");
+const require_device_ca = require("./device-ca-bpoEr0zG.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -27,21 +27,21 @@ const require_builtins_loki_logging_index = require("./builtins/loki-logging/ind
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_device_history_device_history_addon = require("./builtins/device-history/device-history.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-Bl0ZKjVR.js");
+const require_wal_maintenance = require("./wal-maintenance-CNEs_I94.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-DruwCkfp.js");
-const require_agent_https = require("./agent-https-CCvlRQKV.js");
+const require_constants = require("./constants-CavyKfHZ.js");
+const require_agent_https = require("./agent-https-yjxdfJDA.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-COyb49zm.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-Bkrvgnma.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-CZlZRxxA.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-4OP0EYg6.js");
+const require_restore_archive = require("./restore-archive-B4QG7XmX.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -27009,6 +27009,10 @@ var en_default = {
 	"device.credentials-unavailable": "Device credentials not available",
 	"device.credential-not-found": "Device credential not found: {id}",
 	"storage.no-provider": "No storage provider configured",
+	"preferences.forbidden": "This credential cannot reach account preferences",
+	"preferences.unavailable": "Account preferences are not available",
+	"preferences.value-too-large": "This preference value is too large",
+	"preferences.too-many-namespaces": "Too many preference namespaces for this account",
 	"recording.export-unknown": "Unknown export \"{id}\"",
 	"recording.export-invalid-range": "Invalid time range {fromMs}..{toMs}",
 	"recording.export-no-profiles": "The export needs at least one stream profile",
@@ -27256,6 +27260,10 @@ var it_default = {
 	"device.credentials-unavailable": "Le credenziali del dispositivo non sono disponibili",
 	"device.credential-not-found": "Credenziale del dispositivo non trovata: {id}",
 	"storage.no-provider": "Nessun provider di archiviazione configurato",
+	"preferences.forbidden": "Questa credenziale non può accedere alle preferenze dell’account",
+	"preferences.unavailable": "Le preferenze dell’account non sono disponibili",
+	"preferences.value-too-large": "Il valore di questa preferenza è troppo grande",
+	"preferences.too-many-namespaces": "Troppi gruppi di preferenze per questo account",
 	"recording.export-unknown": "Esportazione \"{id}\" sconosciuta",
 	"recording.export-invalid-range": "Intervallo di tempo non valido {fromMs}..{toMs}",
 	"recording.export-no-profiles": "L'esportazione richiede almeno un profilo di flusso",
@@ -27572,8 +27580,6 @@ function resetCatalogRegistryForTests() {
 	shared = null;
 }
 //#endregion
-exports.ADMIN_TOKEN_MAX_LIFETIME_MS = require_builtins_local_auth_local_auth_addon.ADMIN_TOKEN_MAX_LIFETIME_MS;
-exports.ADMIN_TOKEN_PREFIX = require_builtins_local_auth_local_auth_addon.ADMIN_TOKEN_PREFIX;
 exports.AGENT_CAP_FWD_ACTION = AGENT_CAP_FWD_ACTION;
 exports.AGENT_CAP_FWD_SERVICE = AGENT_CAP_FWD_SERVICE;
 exports.AGENT_DASHBOARD_ORIGINS_FIELD = require_builtins_system_config_system_config_addon.AGENT_DASHBOARD_ORIGINS_FIELD;
@@ -27598,7 +27604,6 @@ exports.AddonLoader = AddonLoader;
 exports.AddonManifest = AddonManifest;
 exports.AddonRefusedError = AddonRefusedError;
 exports.AddonRouteRegistry = AddonRouteRegistry;
-exports.AdminTokenManager = require_builtins_local_auth_local_auth_addon.AdminTokenManager;
 exports.AgentHttpsInstallError = require_agent_https.AgentHttpsInstallError;
 exports.AgentHttpsNames = require_agent_https.AgentHttpsNames;
 exports.AgentMdnsAdvertiser = AgentMdnsAdvertiser;
@@ -27775,7 +27780,6 @@ exports.STORAGE_DRAIN_STATE_LEGACY = require_builtins_storage_orchestrator_stora
 exports.STORE_READABLE_BOOTSTRAP_KEYS = STORE_READABLE_BOOTSTRAP_KEYS;
 exports.SYSTEM_SECRET_OWNER = require_device_ca.SYSTEM_SECRET_OWNER;
 exports.ScopedLogger = ScopedLogger;
-exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
 exports.SettingsReadUnavailableError = require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError;
 exports.SocketChannel = SocketChannel;
 exports.SqliteSettingsAddon = require_builtins_sqlite_storage_sqlite_settings_addon.SqliteSettingsAddon;
@@ -28094,6 +28098,7 @@ exports.loadAgentHttps = require_agent_https.loadAgentHttps;
 exports.loadDeviceCa = require_device_ca.loadDeviceCa;
 exports.loadMeshCa = require_agent_https.loadMeshCa;
 exports.loadTlsCert = require_hub_mdns_ciao.loadTlsCert;
+exports.localCaCommonName = require_agent_https.localCaCommonName;
 exports.localEndpointPath = localEndpointPath;
 exports.localProviderLink = localProviderLink;
 exports.localSupportedPythonRuntimes = localSupportedPythonRuntimes;
@@ -28119,6 +28124,7 @@ exports.pemDigest = require_agent_https.pemDigest;
 exports.permitsIdentity = require_agent_https.permitsIdentity;
 exports.permitsName = require_agent_https.permitsName;
 exports.pinnedHttpsCaFingerprint = require_agent_https.pinnedHttpsCaFingerprint;
+exports.preferencesLimitReasonOf = require_builtins_local_auth_local_auth_addon.preferencesLimitReasonOf;
 exports.prepareBootTls = require_hub_mdns_ciao.prepareBootTls;
 exports.prepareRestoreArchive = require_restore_archive.prepareRestoreArchive;
 exports.probePlatform = probePlatform;

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { Bi as expandCapMethods, Cr as supportedRuntimes, Dn as lifecycleJobSchema, Ei as asString$1, Hn as objectInputDeclaresRequiredDeviceId, K as METHOD_ACCESS_MAP, Kr as errMsg$1, Li as defineRecordKinds, Mn as looseSchema, Ni as createEvent$1, Qr as DEVICE_STATUS_METHOD, Ri as emitDownForOwnedCaps, Sn as kebabToCamel$1, Ti as asNumber, Vn as objectInputDeclaresAddonId, W as LOG_LEVEL_RANK, Xr as DATAPLANE_SECRET_HEADER$1, Yr as CALLER_STAMPED_CAPABILITIES$1, Zr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _ as CatalogFileSchema, _a as userError, _n as isCollectionArrayMethod, ar as resolveMethodAuth, bn as isObjectInput, ca as resolveCapMount, cr as scopesAllowAddon, d as CATALOG_LANGS, fi as RUNTIME_DEFAULTS, fn as interpolate, ft as addonSettingsCapability, gn as isArrayOutputSchema, hr as splitTranslationRef, jn as logLevelAtMost, lr as scopesAllowDeviceCap, mi as ReadinessTimeoutError, n as AGENT_MDNS_TXT_KEYS, na as parseJsonUnknown, oa as readinessKey, on as extractNestedAddonId, pi as ReadinessRegistry, qn as procedureAuthKey, r as ALL_CAPABILITY_DEFINITIONS, t as AGENT_MDNS_SERVICE_TYPE, ta as parseJsonObject, ua as scopeKey, va as withoutCallerStamp, wi as asJsonObject$1, xn as isVoidInput, ya as EventCategory$1 } from "./dist-BpSENkRJ.mjs";
+import { $n as procedureAuthKey, Ai as asJsonObject$1, Ca as userError, Dn as isVoidInput, En as isObjectInput, G as LOG_LEVEL_RANK, Jn as objectInputDeclaresRequiredDeviceId, Ki as expandCapMethods, Ln as logLevelAtMost, Mi as asString$1, Nn as lifecycleJobSchema, On as kebabToCamel$1, Qr as errMsg$1, Rn as looseSchema, Sn as isCollectionArrayMethod, Ta as EventCategory$1, Ui as defineRecordKinds, Wi as emitDownForOwnedCaps, _n as interpolate, _t as addonSettingsCapability, bi as ReadinessTimeoutError, ca as parseJsonUnknown, d as CATALOG_LANGS, dn as extractNestedAddonId, dr as resolveMethodAuth, fa as readinessKey, ga as scopeKey, hr as scopesAllowDeviceCap, ii as DEVICE_STATUS_METHOD, ji as asNumber, kr as supportedRuntimes, ma as resolveCapMount, mr as scopesAllowAddon, n as AGENT_MDNS_TXT_KEYS, ni as DATAPLANE_SECRET_HEADER$1, q as METHOD_ACCESS_MAP, qn as objectInputDeclaresAddonId, r as ALL_CAPABILITY_DEFINITIONS, ri as DEVICE_SETTINGS_CONTRIBUTION_METHODS, sa as parseJsonObject, t as AGENT_MDNS_SERVICE_TYPE, ti as CALLER_STAMPED_CAPABILITIES$1, v as CatalogFileSchema, vi as RUNTIME_DEFAULTS, wa as withoutCallerStamp, xn as isArrayOutputSchema, xr as splitTranslationRef, yi as ReadinessRegistry, zi as createEvent$1 } from "./dist-BSF_C8W2.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-uFbTyY_o.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-qz1Pmeu1.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -20,27 +20,27 @@ import "./builtins/device-manager/index.mjs";
 import { HubForwarderAddon, HubForwarderDestination } from "./builtins/hub-forwarder/index.mjs";
 import { LivenessMonitorAddon } from "./builtins/liveness-monitor/liveness-monitor.addon.mjs";
 import "./builtins/liveness-monitor/index.mjs";
-import { LocalAuthAddon, S as ApiKeyManager, _ as AuthAuditLog, a as attachUserManagementInternal, b as SettingsReadUnavailableError, c as ScopedTokenManager, d as onSessionsRevoked, f as DeviceCredentialManager, g as AdminTokenManager, h as ADMIN_TOKEN_PREFIX, i as USER_MANAGEMENT_INTERNAL, l as LoginSessionManager, m as ADMIN_TOKEN_MAX_LIFETIME_MS, n as FIRST_BOOT_ADMIN_USERNAME, o as getUserManagementInternal, p as PREVIOUS_LEAF_GRACE_MS, r as UserManager, s as DeviceCaStore, t as FIRST_BOOT_ADMIN_PASSWORD, u as REFRESH_TOKEN_PREFIX, v as AuthManager, x as isSettingsReadUnavailable, y as parseTokenExpiry } from "./builtins/local-auth/local-auth.addon.mjs";
+import { LocalAuthAddon, _ as SettingsReadUnavailableError, a as attachUserManagementInternal, c as DeviceCaStore, d as onSessionsRevoked, f as DeviceCredentialManager, g as parseTokenExpiry, h as AuthManager, i as USER_MANAGEMENT_INTERNAL, l as LoginSessionManager, m as AuthAuditLog, n as FIRST_BOOT_ADMIN_USERNAME, o as getUserManagementInternal, p as PREVIOUS_LEAF_GRACE_MS, r as UserManager, s as preferencesLimitReasonOf, t as FIRST_BOOT_ADMIN_PASSWORD, u as REFRESH_TOKEN_PREFIX, v as isSettingsReadUnavailable, y as ApiKeyManager } from "./builtins/local-auth/local-auth.addon.mjs";
 import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { DeviceHistoryAddon } from "./builtins/device-history/device-history.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { l as SqliteSettingsBackend } from "./wal-maintenance-TyuOEVy1.mjs";
+import { l as SqliteSettingsBackend } from "./wal-maintenance-AerF4XE6.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, l as STORAGE_DRAIN_STATE_LEGACY, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService, u as storageOrchestratorRecordKinds } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-DOlYt1t1.mjs";
-import { $ as generateMeshKeyPair, A as isConstrainedCa, C as MAX_LEAF_VALIDITY_DAYS, D as PERMITTED_DNS_SUFFIXES, F as AGENT_HTTPS_NAMES_COLLECTION, G as describeMeshLeaf, H as MESH_NODE_CERTIFICATES_COLUMNS, I as AGENT_HTTPS_NAMES_COLUMNS, J as caFingerprint, K as getProcessMeshCertificateRegistry, L as AgentHttpsNames, M as permitsIdentity, N as permitsName, O as PERMITTED_IP_RANGES, P as readNameConstraints, Q as generateMeshCa, R as getProcessAgentHttpsNames, S as LEAF_RENEWAL_WINDOW_DAYS, T as evaluateExistingCert, U as MeshCertificateRegistry, V as MESH_NODE_CERTIFICATES_COLLECTION, W as RENEWAL_ABANDONED, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, a as collectAgentNames, b as systemHostFacts, c as installAgentHttps, d as issueAgentHttpsLeaf, et as isValidAgentNodeId, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isLocalOnlyHostname, k as buildNameConstraintSet, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, nt as issueMeshLeafFromCsr, o as createAgentHttpsRequest, p as pemDigest, q as setProcessMeshCertificateRegistry, r as agentHttpsPaths, rt as loadMeshCa, s as describeHttpsLeaf, t as AgentHttpsInstallError, tt as issueMeshLeafForNode, u as isPrivateAddress, w as SERVER_AUTH_OID, x as CA_VALIDITY_DAYS, y as collectCertIdentity, z as setProcessAgentHttpsNames } from "./agent-https-CLWrOO3o.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-i5oD_gLB.mjs";
+import { $ as generateMeshCa, A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, G as RENEWAL_ABANDONED, H as MESH_NODE_CERTIFICATES_COLLECTION, I as AGENT_HTTPS_NAMES_COLLECTION, J as setProcessMeshCertificateRegistry, K as describeMeshLeaf, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, Q as exportMeshPrivateKeyPem, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, U as MESH_NODE_CERTIFICATES_COLUMNS, W as MeshCertificateRegistry, X as caFingerprintCompact, Y as caFingerprint, Z as createMeshCsrPem, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, et as generateMeshKeyPair, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, it as loadMeshCa, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, nt as issueMeshLeafForNode, o as createAgentHttpsRequest, p as pemDigest, q as getProcessMeshCertificateRegistry, r as agentHttpsPaths, rt as issueMeshLeafFromCsr, s as describeHttpsLeaf, t as AgentHttpsInstallError, tt as isValidAgentNodeId, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-fm4AR8XL.mjs";
 import { $ as parseCidrList, A as setProcessMeshPeerTransportLookup, B as requireProcessMeshCa, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as AGENT_UI_UNLOCK_VERSION, H as AGENT_UI_UNLOCK_TTL_MS, I as MeshCrl, J as mintAgentUiUnlockTicket, K as UnlockTicketJtiStore, L as processMeshCrl, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as normalizeIp, R as MeshCaKeeper, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as AGENT_UI_UNLOCK_TYP, V as AGENT_DASHBOARD_ORIGINS_FIELD, W as AGENT_UI_UNLOCK_USE, X as verifyAgentUiUnlockTicket, Y as parseAgentDashboardOrigins, Z as createCidrMatcher, _ as signPairingProof, a as hubHostFromMeshAddress, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, d as PAIRING_PROTOCOL, et as readCidrSetting, f as PAIRING_TTL_MS, g as keyFingerprintShort, h as describeCsr, i as AgentPairing, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, m as computePairingSas, n as HubPairing, o as PAIRING_CODE_DIGITS, p as computePairingCommitment, q as isAllowedAgentDashboardReturnTo, r as PairingHttpError, s as PAIRING_MAX_CODE_ATTEMPTS, u as PAIRING_PIN_DIGITS, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as getProcessMeshCaState } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-stpC3Zy-.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-DlgkFJVY.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-CHaGDzyz.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as backupOrchestratorRecordKinds, f as BackupDecryptError, g as generateBackupKeyPair, l as backupRecordStoresOf, m as BackupKeyMismatchError, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, v as readBackupEncryptionHeader } from "./restore-archive-YFSJRtKy.mjs";
+import { c as backupOrchestratorRecordKinds, f as BackupDecryptError, g as generateBackupKeyPair, l as backupRecordStoresOf, m as BackupKeyMismatchError, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, v as readBackupEncryptionHeader } from "./restore-archive-BGUM4FKf.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -27006,6 +27006,10 @@ var en_default = {
 	"device.credentials-unavailable": "Device credentials not available",
 	"device.credential-not-found": "Device credential not found: {id}",
 	"storage.no-provider": "No storage provider configured",
+	"preferences.forbidden": "This credential cannot reach account preferences",
+	"preferences.unavailable": "Account preferences are not available",
+	"preferences.value-too-large": "This preference value is too large",
+	"preferences.too-many-namespaces": "Too many preference namespaces for this account",
 	"recording.export-unknown": "Unknown export \"{id}\"",
 	"recording.export-invalid-range": "Invalid time range {fromMs}..{toMs}",
 	"recording.export-no-profiles": "The export needs at least one stream profile",
@@ -27253,6 +27257,10 @@ var it_default = {
 	"device.credentials-unavailable": "Le credenziali del dispositivo non sono disponibili",
 	"device.credential-not-found": "Credenziale del dispositivo non trovata: {id}",
 	"storage.no-provider": "Nessun provider di archiviazione configurato",
+	"preferences.forbidden": "Questa credenziale non può accedere alle preferenze dell’account",
+	"preferences.unavailable": "Le preferenze dell’account non sono disponibili",
+	"preferences.value-too-large": "Il valore di questa preferenza è troppo grande",
+	"preferences.too-many-namespaces": "Troppi gruppi di preferenze per questo account",
 	"recording.export-unknown": "Esportazione \"{id}\" sconosciuta",
 	"recording.export-invalid-range": "Intervallo di tempo non valido {fromMs}..{toMs}",
 	"recording.export-no-profiles": "L'esportazione richiede almeno un profilo di flusso",
@@ -27570,4 +27578,4 @@ function resetCatalogRegistryForTests() {
 }
 //#endregion
 var readAllRows = import_read_all_rows.readAllRows;
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRefusedError, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_NODE_HISTORY_COLLECTION, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ClusterNodeHistoryBodySchema, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceHistoryAddon, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, INTEGRATIONS_LEGACY, INTEGRATION_SETTINGS_LEGACY, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORAGE_DRAIN_STATE_LEGACY, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UNMIGRATED_SETTINGS_CODE, UNMIGRATED_SETTINGS_REMEDY, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UnmigratedSettingsError, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, asBrokerLike, assertLegacyBlobsMigrated, attachUserManagementInternal, attributeStall, backupOrchestratorRecordKinds, backupRecordStoresOf, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterAgentRecordKinds, clusterEventTopic, clusterNodeHistoryRecordKind, collectAgentNames, collectCertIdentity, collectModelFiles, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findAddonRefusal, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, integrationRegistryRecordKinds, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readAllRows, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storageOrchestratorRecordKinds, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRefusedError, AddonRouteRegistry, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_NODE_HISTORY_COLLECTION, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ClusterNodeHistoryBodySchema, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceHistoryAddon, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, INTEGRATIONS_LEGACY, INTEGRATION_SETTINGS_LEGACY, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORAGE_DRAIN_STATE_LEGACY, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UNMIGRATED_SETTINGS_CODE, UNMIGRATED_SETTINGS_REMEDY, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UnmigratedSettingsError, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, asBrokerLike, assertLegacyBlobsMigrated, attachUserManagementInternal, attributeStall, backupOrchestratorRecordKinds, backupRecordStoresOf, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterAgentRecordKinds, clusterEventTopic, clusterNodeHistoryRecordKind, collectAgentNames, collectCertIdentity, collectModelFiles, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findAddonRefusal, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, integrationRegistryRecordKinds, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localCaCommonName, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, preferencesLimitReasonOf, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readAllRows, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storageOrchestratorRecordKinds, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/{phase6-declare-gate-JQUqgQgq.mjs → phase6-declare-gate-B4yfsf2n.mjs}

@@ -1,4 +1,4 @@
-import { Fi as declarationsOf } from "./dist-BpSENkRJ.mjs";
+import { Vi as declarationsOf } from "./dist-BSF_C8W2.mjs";
 //#region src/builtins/records/legacy-table-row-count.ts
 /** Row count for a physical settings-db table (matches the records engine `legacyRowCount`). */
 function legacyTableRowCountFromList(tables, collection) {

package/dist/{phase6-declare-gate-DrmTtz7F.js → phase6-declare-gate-n-IZRklX.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DjQ8C-ku.js");
+const require_dist = require("./dist-BpqA2CT0.js");
 //#region src/builtins/records/legacy-table-row-count.ts
 /** Row count for a physical settings-db table (matches the records engine `legacyRowCount`). */
 function legacyTableRowCountFromList(tables, collection) {

package/dist/{restore-archive-4OP0EYg6.js → restore-archive-B4QG7XmX.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DjQ8C-ku.js");
+const require_dist = require("./dist-BpqA2CT0.js");
 const require_read_all_rows$1 = require("./read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/{restore-archive-YFSJRtKy.mjs → restore-archive-BGUM4FKf.mjs}

@@ -1,4 +1,4 @@
-import { Li as defineRecordKinds, j as DataStoreDatabaseSchema, x as DATABASE_SNAPSHOT_SUFFIX } from "./dist-BpSENkRJ.mjs";
+import { M as DataStoreDatabaseSchema, S as DATABASE_SNAPSHOT_SUFFIX, Ui as defineRecordKinds } from "./dist-BSF_C8W2.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";

package/dist/tls/cert-issue.d.ts

@@ -3,6 +3,19 @@ import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
 import type { CertIdentity } from "./cert-identity.js";
 /** Subject of the local root. Distinct from the leaf's CN by construction. */
 export declare const CA_COMMON_NAME = "CamStack Local CA";
+/** Between {@link CA_COMMON_NAME} and the hub's name in a new root's subject. */
+export declare const CA_HUB_NAME_SEPARATOR = " — ";
+/**
+* The subject CN of a NEW local root: `CamStack Local CA — <hub name>`, so two hubs'
+* roots installed on one phone can be told apart in its settings. The name is
+* sanitised for a CN (controls removed, whitespace collapsed) and cut so the whole
+* CN stays within 64 characters. An absent or unusable name, or one that is just
+* the product's own name, yields the plain {@link CA_COMMON_NAME}.
+*
+* Only a root being CREATED is named: an existing root is never reissued to rename
+* it, since every device that trusts it would have to install it again.
+*/
+export declare function localCaCommonName(hubName: string | undefined): string;
 /** A PEM-encoded certificate and the PKCS#8 PEM of its private key. */
 export interface CertMaterial {
 	readonly certPem: string;
@@ -23,8 +36,10 @@ export interface CaSigner {
 * It carries a CRITICAL `nameConstraints` extension (D873): private address
 * ranges and local-only DNS names, plus `hostnames` (the hub's own single-label
 * names at creation). A leaked key therefore cannot vouch for a public site.
+*
+* `commonName` is the subject CN, from {@link localCaCommonName}.
 */
-export declare function generateCa(now: Date, hostnames?: readonly string[]): Promise<CaSigner>;
+export declare function generateCa(now: Date, hostnames?: readonly string[], commonName?: string): Promise<CaSigner>;
 /** Re-open a root already on disk so a leaf can be issued under it. */
 export declare function loadCa(certPem: string, keyPem: string): Promise<CaSigner>;
 /**

package/dist/tls/cert-manager.d.ts

@@ -41,6 +41,12 @@ export interface EnsureTlsResult {
 export interface CertOptions {
 	/** Common Name for the leaf (default: 'camstack.local') */
 	readonly commonName?: string;
+	/**
+	* The hub's human name (D861). Read only when a NEW local root is created: its subject
+	* becomes `CamStack Local CA — <hubName>` ({@link localCaCommonName}). An existing root
+	* is never reissued because this changed. Absent: the plain `CamStack Local CA`.
+	*/
+	readonly hubName?: string;
 	/** Leaf validity in days. Clamped to `MAX_LEAF_VALIDITY_DAYS`. */
 	readonly validDays?: number;
 	/** Additional SANs (DNS names or IPs). Required coverage by definition. */

package/dist/tls/index.d.ts

@@ -3,7 +3,7 @@ export { type CertIdentity, type CertOptions, type HostFacts, type CertRegenerat
 export { type BootTls, type BootTlsMode, prepareBootTls } from "./boot-tls.js";
 export { clearHttpsListener, type HttpsReloadOutcome, leafFingerprintOf, registerHttpsListener, reloadHttpsListener, servedHttpsLeafFingerprint } from "./https-listener.js";
 export { applyCertificateToListener, regenerateCertificate, revertToGeneratedCertificate, storeUploadedCertificate, type UploadCertificateInput, useStoredUploadedCertificate } from "./tls-actions.js";
-export { CA_COMMON_NAME } from "./cert-issue.js";
+export { CA_COMMON_NAME, localCaCommonName } from "./cert-issue.js";
 export { checkUploadedCa, chainsToPublicRoot, validateUploadedTls, type UploadedCaCheck, type UploadedTlsErrorCode, type UploadedTlsValidation } from "./uploaded-cert.js";
 export { buildNameConstraintSet, isConstrainedCa, type NameConstraintSet, permitsIdentity, permitsName, readNameConstraints, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES } from "./cert-name-constraints.js";
 export { type StoredUploadInfo, type TlsAccessStatus, readTlsAccessStatus, splitPemCertificates, UPLOADED_CA_FILE, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans } from "./tls-status.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.455",
+  "version": "1.2.456",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",

package/dist/auth/admin-token-manager.d.ts

@@ -1,51 +0,0 @@
-import type { CollectionColumn, RecordKindHandle, SettingsStoreClient } from "@camstack/types";
-import type { AdminTokenBody } from "../builtins/local-auth/record-kinds.js";
-/**
-* @durable class=config owner=local-auth
-*   write="an admin creates a token (after re-authentication); `lastUsedAt` is
-*     rewritten at most once a minute while it is used; `revoke` stamps revokedAt"
-*   retention="the daily reap deletes rows expired or revoked more than 30 days ago"
-*/
-export declare const ADMIN_TOKENS_COLLECTION = "admin_tokens";
-export declare const ADMIN_TOKENS_COLUMNS: readonly CollectionColumn[];
-export declare const ADMIN_TOKEN_PREFIX = "csa_";
-export declare const ADMIN_TOKEN_MAX_LIFETIME_MS: number;
-export interface AdminTokenRecord {
-	readonly id: string;
-	readonly createdBy: string;
-	readonly name: string;
-	readonly tokenPrefix: string;
-	readonly createdAt: number;
-	readonly expiresAt: number;
-	readonly lastUsedAt: number | null;
-	readonly revokedAt: number | null;
-}
-export interface AdminTokenRecordsDeps {
-	readonly adminTokensKind: RecordKindHandle<AdminTokenBody>;
-	readonly store?: SettingsStoreClient;
-}
-export declare class AdminTokenManager {
-	private readonly now;
-	private readonly kind;
-	private readonly store;
-	constructor(deps: SettingsStoreClient | AdminTokenRecordsDeps, now?: () => number);
-	/** Mint a token for `createdBy`. Refuses an expiry in the past or past 90 days. */
-	create(input: {
-		readonly createdBy: string;
-		readonly name: string;
-		readonly expiresAt: number;
-	}): Promise<{
-		readonly token: string;
-		readonly record: AdminTokenRecord;
-	}>;
-	/** The live record behind `token`, or `null` (unknown, revoked, expired, not a `csa_`). */
-	validate(token: string): Promise<AdminTokenRecord | null>;
-	/** Every token not yet reaped, newest first (no hashes). */
-	list(): Promise<readonly AdminTokenRecord[]>;
-	/** Revoke one token. `false` when unknown or already revoked. */
-	revoke(id: string): Promise<boolean>;
-	/** Revoke every live token `userId` created (the user was deleted). */
-	revokeAllCreatedBy(userId: string): Promise<number>;
-	/** Delete rows expired or revoked more than 30 days ago. */
-	reap(): Promise<number>;
-}

package/dist/auth/scoped-token-manager.d.ts

@@ -1,25 +0,0 @@
-import type { RecordKindHandle, ScopedToken, TokenScope, SettingsStoreClient } from "@camstack/types";
-import type { ScopedTokenBody } from "../builtins/local-auth/record-kinds.js";
-export interface ScopedTokenRecordsDeps {
-	readonly scopedTokensKind: RecordKindHandle<ScopedTokenBody>;
-	readonly legacyStore?: SettingsStoreClient;
-}
-/**
-* Manages scoped API tokens with restricted addon/route/capability access.
-*/
-export declare class ScopedTokenManager {
-	private readonly kind;
-	private readonly store;
-	constructor(deps: SettingsStoreClient | ScopedTokenRecordsDeps);
-	create(userId: string, name: string, scopes: TokenScope[], expiresAt?: number): Promise<{
-		token: string;
-		record: ScopedToken;
-	}>;
-	validate(rawToken: string): Promise<ScopedToken | null>;
-	matchesScope(token: ScopedToken, addonId?: string, capability?: string): boolean;
-	revoke(tokenId: string): Promise<boolean>;
-	listForUser(userId: string): Promise<ScopedToken[]>;
-	updateLastUsed(tokenId: string): Promise<void>;
-	reapExpired(nowMs?: number): Promise<number>;
-	cleanupOrphans(validUserIds: ReadonlySet<string>): Promise<number>;
-}