@camstack/system 1.2.474 → 1.2.475

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Or as storageProviderCapability, pn as filesystemBrowseCapability, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
+import { Or as storageProviderCapability, pn as filesystemBrowseCapability, ti as BaseAddon } from "../../dist-DygMs3Qc.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-DyMUz_Hy.js");
+const require_wal_maintenance = require("../../wal-maintenance-D3UwIKX5.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-BnhkcEkI.mjs";
+import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-rLv4uOmp.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-BtDdPdZ7.js");
 const require_retired_settings_keys = require("../../retired-settings-keys-DorakcxV.js");
-const require_wal_maintenance = require("../../wal-maintenance-DyMUz_Hy.js");
+const require_wal_maintenance = require("../../wal-maintenance-D3UwIKX5.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { Ai as TransactRefusedError, C as DATA_STORE_DATABASES, Ci as RecordKindDeclarationSchema, Et as bareAddonId, Gt as dataStoreProviderCapability, Kt as databaseSnapshotCapability, Lr as vectorStoreCapability, Mi as UnknownRecordKindError, S as DATABASE_SNAPSHOT_TIMEOUT_MS, _i as RECORD_SWEEP_INTERVAL_MS, b as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, bi as RUNTIME_DEFAULTS, da as normalizeSecretOwner, di as InvalidRecordError, ei as errMsg, fi as NoCallerError, ir as recordsCapability, si as DeclarationRefusedError, ti as BaseAddon, wr as storageAdminCapability, x as DATABASE_SNAPSHOT_SUFFIX } from "../../dist-BugavoVR.mjs";
+import { Ai as TransactRefusedError, C as DATA_STORE_DATABASES, Ci as RecordKindDeclarationSchema, Et as bareAddonId, Gt as dataStoreProviderCapability, Kt as databaseSnapshotCapability, Lr as vectorStoreCapability, Mi as UnknownRecordKindError, S as DATABASE_SNAPSHOT_TIMEOUT_MS, _i as RECORD_SWEEP_INTERVAL_MS, b as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, bi as RUNTIME_DEFAULTS, da as normalizeSecretOwner, di as InvalidRecordError, ei as errMsg, fi as NoCallerError, ir as recordsCapability, si as DeclarationRefusedError, ti as BaseAddon, wr as storageAdminCapability, x as DATABASE_SNAPSHOT_SUFFIX } from "../../dist-DygMs3Qc.mjs";
 import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-CWp7ZSeA.mjs";
-import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, S as trustResult, T as callData, _ as collectTransferables, a as WalMaintenance, c as vectorProviderOfOwnedFile, d as CrossDatabaseTransactError, f as DatabaseBusyError, l as SqliteSettingsBackend, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callControl } from "../../wal-maintenance-BnhkcEkI.mjs";
+import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, S as trustResult, T as callData, _ as collectTransferables, a as WalMaintenance, c as vectorProviderOfOwnedFile, d as CrossDatabaseTransactError, f as DatabaseBusyError, l as SqliteSettingsBackend, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callControl } from "../../wal-maintenance-rLv4uOmp.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-BtDdPdZ7.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Bi as collectSecretConfigKeys, Bn as mayReadLocation, En as isLocationEnabled, Er as storageMigrationCapability, Nn as legacyModeOf, Oa as EventCategory, Rr as withLocationMode, Ta as transformSecretWrite, Tr as storageCapability, Vn as mayWriteToLocation, Wn as modeMayWrite, _n as gbToBytes, ba as secretTreeFromPaths, dt as StorageLocationModeSchema, fa as parseJsonObject, fr as resolveLocationMode, ft as StorageLocationTypeSchema, ia as isSecretMarker, ln as evictionPolicyOfLocation, pt as StorageMigrationJobSchema, q as LegacyStorageLocationDefaultSchema, qi as defineRecordKinds, ti as BaseAddon, ua as normalizeNodeId, ut as StorageCleanupJobSchema, va as resolveSecretMarkers, vi as REDACTED_SECRET, yr as settingsStoreCapability } from "../../dist-BugavoVR.mjs";
+import { Bi as collectSecretConfigKeys, Bn as mayReadLocation, En as isLocationEnabled, Er as storageMigrationCapability, Nn as legacyModeOf, Oa as EventCategory, Rr as withLocationMode, Ta as transformSecretWrite, Tr as storageCapability, Vn as mayWriteToLocation, Wn as modeMayWrite, _n as gbToBytes, ba as secretTreeFromPaths, dt as StorageLocationModeSchema, fa as parseJsonObject, fr as resolveLocationMode, ft as StorageLocationTypeSchema, ia as isSecretMarker, ln as evictionPolicyOfLocation, pt as StorageMigrationJobSchema, q as LegacyStorageLocationDefaultSchema, qi as defineRecordKinds, ti as BaseAddon, ua as normalizeNodeId, ut as StorageCleanupJobSchema, va as resolveSecretMarkers, vi as REDACTED_SECRET, yr as settingsStoreCapability } from "../../dist-DygMs3Qc.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-BtDdPdZ7.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
-const require_x509_es = require("../../x509.es-C4cOo48M.js");
-const require_agent_https = require("../../agent-https-DRwEbLL7.js");
-const require_constants$8 = require("../../constants-C0hrXcEr.js");
+const require_x509_es = require("../../x509.es-WtnRNyYS.js");
+const require_agent_https = require("../../agent-https-BsqT0qni.js");
+const require_constants$8 = require("../../constants-3Wj5OyEk.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -355,7 +355,7 @@ async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
 		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
 		await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey)
 	];
-	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
+	const cert = await require_x509_es.withUtcTimeEncoding(() => require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${require_constants$8.MESH_CA_COMMON_NAME}`,
 		notBefore: require_x509_es.backdatedNotBefore(now),
@@ -363,7 +363,7 @@ async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
 		keys,
 		signingAlgorithm: MESH_SIGNING_ALGORITHM,
 		extensions
-	});
+	}));
 	return {
 		certPem: toCertPem(cert),
 		keyPem: await exportKeyPem(keys.privateKey),
@@ -405,7 +405,7 @@ async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
 		await require_x509_es.AuthorityKeyIdentifierExtension.create(ca.cert)
 	];
 	return {
-		certPem: toCertPem(await require_x509_es.X509CertificateGenerator.create({
+		certPem: toCertPem(await require_x509_es.withUtcTimeEncoding(() => require_x509_es.X509CertificateGenerator.create({
 			serialNumber,
 			subject: `CN=${cn}`,
 			issuer: ca.cert.subject,
@@ -415,7 +415,7 @@ async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
 			signingKey: ca.privateKey,
 			signingAlgorithm: MESH_SIGNING_ALGORITHM,
 			extensions
-		})),
+		}))),
 		serialNumber,
 		notAfter,
 		commonName: cn

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,9 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { $i as hydrateSchema, Gi as customAction, Ki as defineCustomActions, br as shortHostname, ct as ServerNameSchema, ei as errMsg, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
+import { $i as hydrateSchema, Gi as customAction, Ki as defineCustomActions, br as shortHostname, ct as ServerNameSchema, ei as errMsg, ti as BaseAddon } from "../../dist-DygMs3Qc.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
-import { S as backdatedNotBefore, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension } from "../../x509.es-DK__ETIe.mjs";
-import { B as setProcessAgentHttpsNames, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, R as AgentHttpsNames, V as systemConfigRecordKinds, u as isPrivateAddress, z as getProcessAgentHttpsNames } from "../../agent-https-CbczsyM0.mjs";
-import { a as MESH_CA_KEY_REF, c as SERVER_AUTH_OID, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "../../constants-Dy8CaDeT.mjs";
+import { C as backdatedNotBefore, S as withUtcTimeEncoding, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension } from "../../x509.es-BRiJgOvu.mjs";
+import { B as setProcessAgentHttpsNames, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, R as AgentHttpsNames, V as systemConfigRecordKinds, u as isPrivateAddress, z as getProcessAgentHttpsNames } from "../../agent-https-wA8gGLc1.mjs";
+import { a as MESH_CA_KEY_REF, c as SERVER_AUTH_OID, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "../../constants-DZJAkne8.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";
@@ -345,7 +345,7 @@ async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
 		new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
 		await SubjectKeyIdentifierExtension.create(keys.publicKey)
 	];
-	const cert = await X509CertificateGenerator.createSelfSigned({
+	const cert = await withUtcTimeEncoding(() => X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${MESH_CA_COMMON_NAME}`,
 		notBefore: backdatedNotBefore(now),
@@ -353,7 +353,7 @@ async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
 		keys,
 		signingAlgorithm: MESH_SIGNING_ALGORITHM,
 		extensions
-	});
+	}));
 	return {
 		certPem: toCertPem(cert),
 		keyPem: await exportKeyPem(keys.privateKey),
@@ -395,7 +395,7 @@ async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
 		await AuthorityKeyIdentifierExtension.create(ca.cert)
 	];
 	return {
-		certPem: toCertPem(await X509CertificateGenerator.create({
+		certPem: toCertPem(await withUtcTimeEncoding(() => X509CertificateGenerator.create({
 			serialNumber,
 			subject: `CN=${cn}`,
 			issuer: ca.cert.subject,
@@ -405,7 +405,7 @@ async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
 			signingKey: ca.privateKey,
 			signingAlgorithm: MESH_SIGNING_ALGORITHM,
 			extensions
-		})),
+		}))),
 		serialNumber,
 		notAfter,
 		commonName: cn

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-BtDdPdZ7.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 const require_log_file_read_protocol = require("../../log-file-read-protocol-D0WcLbIV.js");
 let node_path = require("node:path");

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Ln as logDestinationCapability, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
+import { Ln as logDestinationCapability, ti as BaseAddon } from "../../dist-DygMs3Qc.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import { a as LogFileIndexStore, i as serveRead, n as isFromReader, t as CancelBook } from "../../log-file-read-protocol-B7M3X3bT.mjs";
 import { createRequire } from "node:module";

package/dist/{composition-sources-CsBIIit3.mjs → composition-sources-CiFkyAcf.mjs}

@@ -1,4 +1,4 @@
-import { ei as errMsg, qr as compositionSourceKey } from "./dist-BugavoVR.mjs";
+import { ei as errMsg, qr as compositionSourceKey } from "./dist-DygMs3Qc.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-CJv3W669.js → composition-sources-DeUSUid6.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-Sn-HiZ4e.js");
+const require_dist = require("./dist-BtDdPdZ7.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-C0hrXcEr.js → constants-3Wj5OyEk.js}

@@ -1,5 +1,5 @@
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
-var MESH_CA_KEY_REF = require("./dist-Sn-HiZ4e.js").buildSecretRef({
+var MESH_CA_KEY_REF = require("./dist-BtDdPdZ7.js").buildSecretRef({
 	owner: "system",
 	scope: { kind: "global" },
 	fieldPath: "meshCaKey"

package/dist/{constants-Dy8CaDeT.mjs → constants-DZJAkne8.mjs}

@@ -1,4 +1,4 @@
-import { zi as buildSecretRef } from "./dist-BugavoVR.mjs";
+import { zi as buildSecretRef } from "./dist-DygMs3Qc.mjs";
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
 var MESH_CA_KEY_REF = buildSecretRef({
 	owner: "system",

package/dist/{device-ca-CHdsePe5.mjs → device-ca-DiV5xcMz.mjs}

@@ -1,5 +1,5 @@
-import { A as DEVICE_SAN_USER_PREFIX, k as DEVICE_SAN_CREDENTIAL_PREFIX, zi as buildSecretRef } from "./dist-BugavoVR.mjs";
-import { S as backdatedNotBefore, a as KeyUsageFlags, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension } from "./x509.es-DK__ETIe.mjs";
+import { A as DEVICE_SAN_USER_PREFIX, k as DEVICE_SAN_CREDENTIAL_PREFIX, zi as buildSecretRef } from "./dist-DygMs3Qc.mjs";
+import { C as backdatedNotBefore, S as withUtcTimeEncoding, a as KeyUsageFlags, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension } from "./x509.es-BRiJgOvu.mjs";
 import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**
@@ -171,7 +171,7 @@ async function generateDeviceCa(now = /* @__PURE__ */ new Date()) {
 		new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
 		await SubjectKeyIdentifierExtension.create(keys.publicKey)
 	];
-	const cert = await X509CertificateGenerator.createSelfSigned({
+	const cert = await withUtcTimeEncoding(() => X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
 		notBefore: backdatedNotBefore(now),
@@ -179,7 +179,7 @@ async function generateDeviceCa(now = /* @__PURE__ */ new Date()) {
 		keys,
 		signingAlgorithm: SIGNING_ALGORITHM,
 		extensions
-	});
+	}));
 	const pkcs8 = await webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
 	return {
 		certPem: certPemOf(cert),
@@ -211,7 +211,12 @@ async function rebuildDeviceCaCertificate(keyPem) {
 		y: jwk.y
 	}, KEY_ALGORITHM, true, ["verify"]);
 	const now = /* @__PURE__ */ new Date();
-	const cert = await X509CertificateGenerator.createSelfSigned({
+	const extensions = [
+		new BasicConstraintsExtension(true, 0, true),
+		new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
+		await SubjectKeyIdentifierExtension.create(publicKey)
+	];
+	const cert = await withUtcTimeEncoding(() => X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
 		notBefore: backdatedNotBefore(now),
@@ -221,12 +226,8 @@ async function rebuildDeviceCaCertificate(keyPem) {
 			publicKey
 		},
 		signingAlgorithm: SIGNING_ALGORITHM,
-		extensions: [
-			new BasicConstraintsExtension(true, 0, true),
-			new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
-			await SubjectKeyIdentifierExtension.create(publicKey)
-		]
-	});
+		extensions
+	}));
 	return {
 		certPem: certPemOf(cert),
 		keyPem,
@@ -262,7 +263,7 @@ async function issueDeviceLeaf(ca, input) {
 		await SubjectKeyIdentifierExtension.create(publicKey),
 		await AuthorityKeyIdentifierExtension.create(ca.cert)
 	];
-	const pem = certPemOf(await X509CertificateGenerator.create({
+	const pem = certPemOf(await withUtcTimeEncoding(() => X509CertificateGenerator.create({
 		serialNumber,
 		subject: `CN=${input.credentialId}`,
 		issuer: ca.cert.subject,
@@ -272,7 +273,7 @@ async function issueDeviceLeaf(ca, input) {
 		signingKey: ca.privateKey,
 		signingAlgorithm: SIGNING_ALGORITHM,
 		extensions
-	}));
+	})));
 	return {
 		certPem: pem,
 		serialNumber,

package/dist/{device-ca-Dg3rSU48.js → device-ca-ftrfVdc0.js}

@@ -1,5 +1,5 @@
-const require_dist = require("./dist-Sn-HiZ4e.js");
-const require_x509_es = require("./x509.es-C4cOo48M.js");
+const require_dist = require("./dist-BtDdPdZ7.js");
+const require_x509_es = require("./x509.es-WtnRNyYS.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**
@@ -171,7 +171,7 @@ async function generateDeviceCa(now = /* @__PURE__ */ new Date()) {
 		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
 		await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey)
 	];
-	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
+	const cert = await require_x509_es.withUtcTimeEncoding(() => require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
 		notBefore: require_x509_es.backdatedNotBefore(now),
@@ -179,7 +179,7 @@ async function generateDeviceCa(now = /* @__PURE__ */ new Date()) {
 		keys,
 		signingAlgorithm: SIGNING_ALGORITHM,
 		extensions
-	});
+	}));
 	const pkcs8 = await node_crypto.webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
 	return {
 		certPem: certPemOf(cert),
@@ -211,7 +211,12 @@ async function rebuildDeviceCaCertificate(keyPem) {
 		y: jwk.y
 	}, KEY_ALGORITHM, true, ["verify"]);
 	const now = /* @__PURE__ */ new Date();
-	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
+	const extensions = [
+		new require_x509_es.BasicConstraintsExtension(true, 0, true),
+		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
+		await require_x509_es.SubjectKeyIdentifierExtension.create(publicKey)
+	];
+	const cert = await require_x509_es.withUtcTimeEncoding(() => require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
 		notBefore: require_x509_es.backdatedNotBefore(now),
@@ -221,12 +226,8 @@ async function rebuildDeviceCaCertificate(keyPem) {
 			publicKey
 		},
 		signingAlgorithm: SIGNING_ALGORITHM,
-		extensions: [
-			new require_x509_es.BasicConstraintsExtension(true, 0, true),
-			new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
-			await require_x509_es.SubjectKeyIdentifierExtension.create(publicKey)
-		]
-	});
+		extensions
+	}));
 	return {
 		certPem: certPemOf(cert),
 		keyPem,
@@ -262,7 +263,7 @@ async function issueDeviceLeaf(ca, input) {
 		await require_x509_es.SubjectKeyIdentifierExtension.create(publicKey),
 		await require_x509_es.AuthorityKeyIdentifierExtension.create(ca.cert)
 	];
-	const pem = certPemOf(await require_x509_es.X509CertificateGenerator.create({
+	const pem = certPemOf(await require_x509_es.withUtcTimeEncoding(() => require_x509_es.X509CertificateGenerator.create({
 		serialNumber,
 		subject: `CN=${input.credentialId}`,
 		issuer: ca.cert.subject,
@@ -272,7 +273,7 @@ async function issueDeviceLeaf(ca, input) {
 		signingKey: ca.privateKey,
 		signingAlgorithm: SIGNING_ALGORITHM,
 		extensions
-	}));
+	})));
 	return {
 		certPem: pem,
 		serialNumber,