@camstack/system 1.2.474 → 1.2.475

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { Cn as isCollectionArrayMethod, Cr as splitTranslationRef, Da as withoutCallerStamp, Dn as isObjectInput, Ea as userError, Fi as asNumber, Ii as asString$1, J as METHOD_ACCESS_MAP, Ji as emitDownForOwnedCaps, Jn as objectInputDeclaresAddonId, K as LOG_LEVEL_RANK, Oa as EventCategory$1, On as isVoidInput, Pi as asJsonObject$1, Pn as lifecycleJobSchema, Rn as logLevelAtMost, Si as ReadinessTimeoutError, Sn as isArrayOutputSchema, Wi as createEvent$1, Xi as expandCapMethods, Yn as objectInputDeclaresRequiredDeviceId, _ as CatalogFileSchema, _a as resolveCapMount, _r as scopesAllowDeviceCap, ai as DEVICE_SETTINGS_CONTRIBUTION_METHODS, bi as RUNTIME_DEFAULTS, ei as errMsg$1, fa as parseJsonObject, fn as extractNestedAddonId, gr as scopesAllowAddon, ha as readinessKey, ii as DATAPLANE_SECRET_HEADER$1, jr as supportedRuntimes, kn as kebabToCamel$1, n as AGENT_MDNS_TXT_KEYS, oi as DEVICE_STATUS_METHOD, pa as parseJsonUnknown, pr as resolveMethodAuth, qi as defineRecordKinds, r as ALL_CAPABILITY_DEFINITIONS, ri as CALLER_STAMPED_CAPABILITIES$1, t as AGENT_MDNS_SERVICE_TYPE, tr as procedureAuthKey, u as CATALOG_LANGS, vn as interpolate, vt as addonSettingsCapability, xi as ReadinessRegistry, ya as scopeKey, zn as looseSchema } from "./dist-BugavoVR.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-CHdsePe5.mjs";
+import { Cn as isCollectionArrayMethod, Cr as splitTranslationRef, Da as withoutCallerStamp, Dn as isObjectInput, Ea as userError, Fi as asNumber, Ii as asString$1, J as METHOD_ACCESS_MAP, Ji as emitDownForOwnedCaps, Jn as objectInputDeclaresAddonId, K as LOG_LEVEL_RANK, Oa as EventCategory$1, On as isVoidInput, Pi as asJsonObject$1, Pn as lifecycleJobSchema, Rn as logLevelAtMost, Si as ReadinessTimeoutError, Sn as isArrayOutputSchema, Wi as createEvent$1, Xi as expandCapMethods, Yn as objectInputDeclaresRequiredDeviceId, _ as CatalogFileSchema, _a as resolveCapMount, _r as scopesAllowDeviceCap, ai as DEVICE_SETTINGS_CONTRIBUTION_METHODS, bi as RUNTIME_DEFAULTS, ei as errMsg$1, fa as parseJsonObject, fn as extractNestedAddonId, gr as scopesAllowAddon, ha as readinessKey, ii as DATAPLANE_SECRET_HEADER$1, jr as supportedRuntimes, kn as kebabToCamel$1, n as AGENT_MDNS_TXT_KEYS, oi as DEVICE_STATUS_METHOD, pa as parseJsonUnknown, pr as resolveMethodAuth, qi as defineRecordKinds, r as ALL_CAPABILITY_DEFINITIONS, ri as CALLER_STAMPED_CAPABILITIES$1, t as AGENT_MDNS_SERVICE_TYPE, tr as procedureAuthKey, u as CATALOG_LANGS, vn as interpolate, vt as addonSettingsCapability, xi as ReadinessRegistry, ya as scopeKey, zn as looseSchema } from "./dist-DygMs3Qc.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-DiV5xcMz.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
@@ -25,21 +25,21 @@ import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { DeviceHistoryAddon } from "./builtins/device-history/device-history.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-BnhkcEkI.mjs";
+import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-rLv4uOmp.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, l as STORAGE_DRAIN_STATE_LEGACY, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService, u as storageOrchestratorRecordKinds } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-CbczsyM0.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-Dy8CaDeT.mjs";
+import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-wA8gGLc1.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-DZJAkne8.mjs";
 import { $ as generateMeshKeyPair, A as setProcessMeshPeerTransportLookup, B as describeMeshLeaf, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as MeshCaKeeper, H as setProcessMeshCertificateRegistry, I as MESH_NODE_CERTIFICATES_COLLECTION, J as caFingerprint, K as getProcessMeshCaState, L as MESH_NODE_CERTIFICATES_COLUMNS, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as generateMeshCa, R as MeshCertificateRegistry, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as MeshCrl, V as getProcessMeshCertificateRegistry, W as processMeshCrl, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, _ as signPairingProof, _t as readCidrSetting, a as hubHostFromMeshAddress, at as AGENT_UI_UNLOCK_TTL_MS, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, ct as AGENT_UI_UNLOCK_VERSION, d as PAIRING_PROTOCOL, dt as mintAgentUiUnlockTicket, et as isValidAgentNodeId, f as PAIRING_TTL_MS, ft as parseAgentDashboardOrigins, g as keyFingerprintShort, gt as parseCidrList, h as describeCsr, ht as normalizeIp, i as AgentPairing, it as AGENT_DASHBOARD_ORIGINS_FIELD, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, lt as UnlockTicketJtiStore, m as computePairingSas, mt as createCidrMatcher, n as HubPairing, nt as issueMeshLeafFromCsr, o as PAIRING_CODE_DIGITS, ot as AGENT_UI_UNLOCK_TYP, p as computePairingCommitment, pt as verifyAgentUiUnlockTicket, q as requireProcessMeshCa, r as PairingHttpError, rt as loadMeshCa, s as PAIRING_MAX_CODE_ATTEMPTS, st as AGENT_UI_UNLOCK_USE, tt as issueMeshLeafForNode, u as PAIRING_PIN_DIGITS, ut as isAllowedAgentDashboardReturnTo, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as RENEWAL_ABANDONED } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-DZSCLBuT.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-BDvqGIw4.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-Bc9PnWu3.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-CFBm30Gk.mjs";
+import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-D_Pwryre.mjs";
 import { r as nodeCoralFs, t as classifyCoralAccelerator } from "./coral-accelerators-DBlgWB8k.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";

package/dist/{lib-8oZrELLm.js → lib-C3U1yluo.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_x509_es = require("./x509.es-C4cOo48M.js");
+const require_x509_es = require("./x509.es-WtnRNyYS.js");
 const require_src$1 = require("./src-CnAqG6EF.js");
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) => {

package/dist/{lib-DK38ompL.mjs → lib-DFZblCIu.mjs}

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, r as __exportAll, t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
-import { b as tslib_es6_exports, y as init_tslib_es6 } from "./x509.es-DK__ETIe.mjs";
+import { b as tslib_es6_exports, y as init_tslib_es6 } from "./x509.es-BRiJgOvu.mjs";
 import { t as require_src } from "./src-hG4grMU4.mjs";
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/{restore-archive-CFBm30Gk.mjs → restore-archive-D_Pwryre.mjs}

@@ -1,4 +1,4 @@
-import { M as DataStoreDatabaseSchema, qi as defineRecordKinds, x as DATABASE_SNAPSHOT_SUFFIX } from "./dist-BugavoVR.mjs";
+import { M as DataStoreDatabaseSchema, qi as defineRecordKinds, x as DATABASE_SNAPSHOT_SUFFIX } from "./dist-DygMs3Qc.mjs";
 import { z } from "zod";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";

package/dist/{restore-archive-gYKzaJ4Y.js → restore-archive-TDkQfmLO.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Sn-HiZ4e.js");
+const require_dist = require("./dist-BtDdPdZ7.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");

package/dist/tls/cert-utc-time.d.ts

@@ -0,0 +1 @@
+export declare function withUtcTimeEncoding<T>(encode: () => T | Promise<T>): Promise<T>;

package/dist/{x509.es-DK__ETIe.mjs → x509.es-BRiJgOvu.mjs}

@@ -12,6 +12,29 @@ var CERT_NOT_BEFORE_BACKDATE_MS = 5 * 6e4;
 function backdatedNotBefore(now) {
 	return /* @__PURE__ */ new Date(now.getTime() - CERT_NOT_BEFORE_BACKDATE_MS);
 }
+//#endregion
+//#region src/tls/cert-utc-time.ts
+var encodingDepth = 0;
+var localSetMilliseconds;
+function setMillisecondsAsUtc(ms) {
+	return this.setUTCMilliseconds(ms);
+}
+async function withUtcTimeEncoding(encode) {
+	if (encodingDepth === 0) {
+		localSetMilliseconds = Date.prototype.setMilliseconds;
+		Date.prototype.setMilliseconds = setMillisecondsAsUtc;
+	}
+	encodingDepth += 1;
+	try {
+		return await encode();
+	} finally {
+		encodingDepth -= 1;
+		if (encodingDepth === 0 && localSetMilliseconds !== void 0) {
+			Date.prototype.setMilliseconds = localSetMilliseconds;
+			localSetMilliseconds = void 0;
+		}
+	}
+}
 /*! *****************************************************************************
 Copyright (C) Microsoft. All rights reserved.
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -11913,4 +11936,4 @@ AsnEcSignatureFormatter.namedCurveSize.set("K-256", 32);
 AsnEcSignatureFormatter.namedCurveSize.set("P-384", 48);
 AsnEcSignatureFormatter.namedCurveSize.set("P-521", 66);
 //#endregion
-export { backdatedNotBefore as S, NameConstraints as _, KeyUsageFlags as a, tslib_es6_exports as b, Pkcs10CertificateRequest as c, SubjectKeyIdentifierExtension as d, X509Certificate as f, GeneralSubtrees as g, GeneralSubtree as h, Extension as i, Pkcs10CertificateRequestGenerator as l, cryptoProvider as m, BasicConstraintsExtension as n, KeyUsagesExtension as o, X509CertificateGenerator as p, ExtendedKeyUsageExtension as r, PemConverter as s, AuthorityKeyIdentifierExtension as t, SubjectAlternativeNameExtension as u, GeneralName$1 as v, AsnConvert as x, init_tslib_es6 as y };
+export { backdatedNotBefore as C, withUtcTimeEncoding as S, NameConstraints as _, KeyUsageFlags as a, tslib_es6_exports as b, Pkcs10CertificateRequest as c, SubjectKeyIdentifierExtension as d, X509Certificate as f, GeneralSubtrees as g, GeneralSubtree as h, Extension as i, Pkcs10CertificateRequestGenerator as l, cryptoProvider as m, BasicConstraintsExtension as n, KeyUsagesExtension as o, X509CertificateGenerator as p, ExtendedKeyUsageExtension as r, PemConverter as s, AuthorityKeyIdentifierExtension as t, SubjectAlternativeNameExtension as u, GeneralName$1 as v, AsnConvert as x, init_tslib_es6 as y };

package/dist/{x509.es-C4cOo48M.js → x509.es-WtnRNyYS.js}

@@ -12,6 +12,29 @@ var CERT_NOT_BEFORE_BACKDATE_MS = 5 * 6e4;
 function backdatedNotBefore(now) {
 	return /* @__PURE__ */ new Date(now.getTime() - CERT_NOT_BEFORE_BACKDATE_MS);
 }
+//#endregion
+//#region src/tls/cert-utc-time.ts
+var encodingDepth = 0;
+var localSetMilliseconds;
+function setMillisecondsAsUtc(ms) {
+	return this.setUTCMilliseconds(ms);
+}
+async function withUtcTimeEncoding(encode) {
+	if (encodingDepth === 0) {
+		localSetMilliseconds = Date.prototype.setMilliseconds;
+		Date.prototype.setMilliseconds = setMillisecondsAsUtc;
+	}
+	encodingDepth += 1;
+	try {
+		return await encode();
+	} finally {
+		encodingDepth -= 1;
+		if (encodingDepth === 0 && localSetMilliseconds !== void 0) {
+			Date.prototype.setMilliseconds = localSetMilliseconds;
+			localSetMilliseconds = void 0;
+		}
+	}
+}
 /*! *****************************************************************************
 Copyright (C) Microsoft. All rights reserved.
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -12045,3 +12068,9 @@ Object.defineProperty(exports, "tslib_es6_exports", {
 		return tslib_es6_exports;
 	}
 });
+Object.defineProperty(exports, "withUtcTimeEncoding", {
+	enumerable: true,
+	get: function() {
+		return withUtcTimeEncoding;
+	}
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.474",
+  "version": "1.2.475",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",