@camstack/system 1.2.116 → 1.2.118

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,8 +1,9 @@
-import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
-import { a as readLanHttpState, c as readTlsAccessStatus, d as writeTlsMode, f as validateUploadedTls, h as reissueTlsLeaf, l as readTlsMode, n as applyLanHttp, p as ensureTlsCert, s as readExtraSans, t as DEFAULT_LAN_HTTP_PORT, u as writeExtraSans } from "../../lan-http-bind-BDJm4d-K.mjs";
+import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
+import { c as readExtraSans, d as writeExtraSans, f as writeTlsMode, g as reissueTlsLeaf, l as readTlsAccessStatus, m as ensureTlsCert, o as readLanHttpState, p as validateUploadedTls, r as applyLanHttp, t as DEFAULT_LAN_HTTP_PORT, u as readTlsMode } from "../../lan-http-bind-jKrj6OjQ.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import * as os from "node:os";
+import { readFileSync } from "node:fs";
 import { isIP } from "node:net";
 //#region src/builtins/local-network/local-hostname.ts
 var DNS_NAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])$/;
@@ -38,6 +39,111 @@ function parseLocalHostname(raw) {
 	};
 }
 //#endregion
+//#region src/builtins/local-network/ipv6-lan.ts
+/**
+* IPv6 helpers for LAN advertisement: prefix matching (privacy addresses
+* rotate inside a /64), Linux `/proc/net/if_inet6` flags, and the gate
+* that keeps temporary GUA off the connection candidate list.
+*/
+var IFA_F_TEMPORARY = 1;
+var IFA_F_DEPRECATED = 32;
+var IFA_F_TENTATIVE = 64;
+/** First 64 bits, canonical hex groups, or null if the address is not IPv6. */
+function ipv6Prefix64Key(address) {
+	const groups = parseIpv6Groups(address);
+	if (groups === null) return null;
+	return groups.slice(0, 4).map((g) => g.toString(16).padStart(4, "0")).join(":");
+}
+/** 32-char lowercase hex (same encoding as `/proc/net/if_inet6`). */
+function ipv6ToHex32(address) {
+	const groups = parseIpv6Groups(address);
+	if (groups === null) return null;
+	return groups.map((g) => g.toString(16).padStart(4, "0")).join("");
+}
+/**
+* Parse Linux `if_inet6` into hex32 → flags. Unknown / malformed lines
+* are skipped. Keys match {@link ipv6ToHex32}.
+*/
+function parseProcIfInet6(text) {
+	const out = /* @__PURE__ */ new Map();
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (trimmed === "") continue;
+		const parts = trimmed.split(/\s+/);
+		const hex = parts[0]?.toLowerCase();
+		const flagsRaw = parts[4];
+		if (!hex || hex.length !== 32 || flagsRaw === void 0) continue;
+		const flags = Number.parseInt(flagsRaw, 16);
+		if (!Number.isFinite(flags)) continue;
+		out.set(hex, flags);
+	}
+	return out;
+}
+/**
+* Whether this IPv6 should be auto-seeded / advertised.
+* `flags === undefined` means the platform did not tell us (macOS, tests
+* without a proc snapshot) — keep every non-link-local plausible address.
+*
+* On Linux, drop addresses marked TEMPORARY / DEPRECATED / TENTATIVE, and
+* `flags === 0` which is how this kernel reports RFC 4941 privacy temps
+* (the stable GUA is PERMANENT|NODAD). Do **not** require PERMANENT —
+* stateful DHCPv6 GUA often has only NODAD (0x02).
+*/
+function shouldAdvertiseIpv6(address, flags) {
+	const a = address.toLowerCase().split("%")[0] ?? address;
+	if (a === "::" || a === "::1") return false;
+	if (a.startsWith("fe80:")) return false;
+	if (a.startsWith("ff")) return false;
+	if (flags === void 0) return true;
+	if ((flags & IFA_F_TEMPORARY) !== 0) return false;
+	if ((flags & IFA_F_DEPRECATED) !== 0) return false;
+	if ((flags & IFA_F_TENTATIVE) !== 0) return false;
+	if (flags === 0) return false;
+	return true;
+}
+function ipv6AllowlistMatches(address, allowed) {
+	if (allowed.includes(address)) return true;
+	const key = ipv6Prefix64Key(address);
+	if (key === null) return false;
+	for (const entry of allowed) {
+		if (!entry.includes(":")) continue;
+		if (ipv6Prefix64Key(entry) === key) return true;
+	}
+	return false;
+}
+function parseIpv6Groups(address) {
+	const raw = address.toLowerCase().split("%")[0];
+	if (!raw || raw.includes(".")) return null;
+	const sides = raw.split("::");
+	if (sides.length > 2) return null;
+	const parsePart = (part) => {
+		if (part === void 0 || part === "") return [];
+		const groups = part.split(":");
+		const out = [];
+		for (const g of groups) {
+			if (g === "") return null;
+			if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+			out.push(Number.parseInt(g, 16));
+		}
+		return out;
+	};
+	if (sides.length === 1) {
+		const groups = parsePart(sides[0]);
+		if (groups === null || groups.length !== 8) return null;
+		return groups;
+	}
+	const left = parsePart(sides[0]);
+	const right = parsePart(sides[1]);
+	if (left === null || right === null) return null;
+	const fill = 8 - left.length - right.length;
+	if (fill < 0) return null;
+	return [
+		...left,
+		...Array(fill).fill(0),
+		...right
+	];
+}
+//#endregion
 //#region src/builtins/local-network/local-network.addon.ts
 /**
 * local-network — hub-only system cap implementation.
@@ -63,6 +169,8 @@ function parseLocalHostname(raw) {
 */
 var MESH_PROVIDER_ADDON_IDS = ["tailscale-client"];
 var POLL_INTERVAL_MS = 3e4;
+/** Drop rotated IPv6 / dead extras from the persisted allowlist. */
+var ALLOWLIST_RECONCILE_INTERVAL_MS = 3600 * 1e3;
 /**
 * Compiled-in boot default — mirrors `CONFIG_DEFAULTS.server.port` in
 * `server/backend/src/boot/boot-config.ts`. Used only when neither the live
@@ -71,6 +179,8 @@ var POLL_INTERVAL_MS = 3e4;
 var DEFAULT_HUB_PORT = 4443;
 var LocalNetworkAddon = class extends BaseAddon {
 	pollTimer = null;
+	allowlistTimer = null;
+	allowlistReconcilePending = false;
 	lastSnapshotKey = "";
 	/** Optional public hostname tracked from `NetworkTunnelStarted`/
 	*  `Stopped` events on the bus. */
@@ -87,6 +197,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 			allowedAddresses: [],
 			bootSeeded: false,
 			notificationBaseUrl: "",
+			viewerBaseUrls: [],
 			httpEnabled: true,
 			httpPort: DEFAULT_LAN_HTTP_PORT,
 			localHostname: ""
@@ -107,6 +218,31 @@ var LocalNetworkAddon = class extends BaseAddon {
 		if (mesh !== null && mesh.host !== "") return `https://${mesh.host}:${mesh.port}`;
 		return null;
 	}
+	async snapshotViewerEndpoints() {
+		const selected = selectViewerEndpoints(await this.buildAdvertisedEndpoints(false, false, "http", (await this.resolveAdvertisedListenPort(null)).port), this.config.viewerBaseUrls);
+		return {
+			baseUrls: this.config.viewerBaseUrls,
+			resolved: selected.map((e) => e.baseUrl)
+		};
+	}
+	/**
+	* Palette shown in the Network tab: LAN IPv4, stable LAN IPv6, public,
+	* mesh. The viewer HTTP/WS race is a subset (`selectViewerEndpoints`) —
+	* IPv6 stays in this list because ICE/WebRTC gathers it regardless.
+	*/
+	async buildAdvertisedEndpoints(includeLoopback, ipv4Only, scheme, httpsPort) {
+		const allow = this.config.allowedAddresses;
+		const interfaces = applyAllowlist(this.enumerate(), allow);
+		await this.reconcileMeshEndpoint();
+		const httpState = readLanHttpState();
+		return buildEndpoints(interfaces, httpsPort, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, {
+			enabled: this.config.httpEnabled !== false,
+			listening: httpState.listening,
+			httpPort: this.resolvedHttpPort(),
+			httpsPort,
+			localHostname: this.config.localHostname || null
+		});
+	}
 	async onInitialize() {
 		if (!this.config.bootSeeded) {
 			const seed = autoSeedAllowlist(this.enumerate());
@@ -116,6 +252,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 			});
 			this.ctx.logger.info("local-network: first-boot auto-seed", { meta: { addresses: seed } });
 		}
+		await this.persistReconciledAllowlist();
 		const provider = {
 			list: async () => ({
 				interfaces: this.enumerate(),
@@ -123,27 +260,16 @@ var LocalNetworkAddon = class extends BaseAddon {
 			}),
 			getPreferred: async () => pickPreferred(applyAllowlist(this.enumerate(), this.config.allowedAddresses)),
 			getConnectionEndpoints: async (input) => {
-				const includeLoopback = input.includeLoopback ?? true;
-				const ipv4Only = input.ipv4Only ?? false;
+				const includeLoopback = input.includeLoopback ?? false;
 				const scheme = input.scheme ?? "http";
-				const allow = this.config.allowedAddresses;
-				const interfaces = applyAllowlist(this.enumerate(), allow);
 				const localPort = await this.resolveAdvertisedListenPort(input.port ?? null);
 				if (input.port !== void 0 && input.port !== localPort.port) this.ctx.logger.info("local-network: caller port hint overridden", { meta: {
 					hint: input.port,
 					advertised: localPort.port,
 					source: localPort.source
 				} });
-				await this.reconcileMeshEndpoint();
-				const httpState = readLanHttpState();
 				return {
-					endpoints: buildEndpoints(interfaces, localPort.port, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, {
-						enabled: this.config.httpEnabled !== false,
-						listening: httpState.listening,
-						httpPort: this.resolvedHttpPort(),
-						httpsPort: localPort.port,
-						localHostname: this.config.localHostname || null
-					}),
+					endpoints: await this.buildAdvertisedEndpoints(includeLoopback, input.ipv4Only ?? false, scheme, localPort.port),
 					localPort
 				};
 			},
@@ -159,6 +285,16 @@ var LocalNetworkAddon = class extends BaseAddon {
 					resolved: this.resolveNotificationEndpoint()
 				};
 			},
+			getViewerEndpoints: async () => this.snapshotViewerEndpoints(),
+			setViewerEndpoints: async ({ baseUrls }) => {
+				const cleaned = [...new Set(baseUrls.filter((u) => u.length > 0))];
+				await this.updateGlobalSettings({ viewerBaseUrls: cleaned });
+				this.ctx.logger.info("local-network: viewer endpoints set", { meta: {
+					count: cleaned.length,
+					auto: cleaned.length === 0
+				} });
+				return this.snapshotViewerEndpoints();
+			},
 			getAllowedAddresses: async () => ({ addresses: this.config.allowedAddresses }),
 			resetAllowlistToBestMatch: async () => {
 				const seed = autoSeedAllowlist(this.enumerate());
@@ -210,6 +346,10 @@ var LocalNetworkAddon = class extends BaseAddon {
 		this.lastSnapshotKey = snapshotKey(this.enumerate());
 		this.pollTimer = setInterval(() => this.detectChanges(), POLL_INTERVAL_MS);
 		this.pollTimer.unref?.();
+		this.allowlistTimer = setInterval(() => {
+			this.persistReconciledAllowlist();
+		}, ALLOWLIST_RECONCILE_INTERVAL_MS);
+		this.allowlistTimer.unref?.();
 		this.ctx.eventBus?.subscribe({ category: EventCategory.NetworkTunnelStarted }, (event) => {
 			const data = event.data ?? {};
 			if (typeof data.url === "string") try {
@@ -285,6 +425,10 @@ var LocalNetworkAddon = class extends BaseAddon {
 			clearInterval(this.pollTimer);
 			this.pollTimer = null;
 		}
+		if (this.allowlistTimer) {
+			clearInterval(this.allowlistTimer);
+			this.allowlistTimer = null;
+		}
 	}
 	/**
 	* Other hub addons (e.g. cloudflare-tunnel) signal the active public
@@ -418,7 +562,26 @@ var LocalNetworkAddon = class extends BaseAddon {
 		}
 	}
 	enumerate() {
-		return enumerateOsInterfaces(os.networkInterfaces());
+		return enumerateOsInterfaces(os.networkInterfaces(), readLinuxIpv6Flags());
+	}
+	/**
+	* Replace rotated IPv6 and drop addresses that no longer exist, without
+	* clearing operator extras that are still live (docker/vpn opt-in).
+	*/
+	async persistReconciledAllowlist(interfaces = this.enumerate()) {
+		if (this.allowlistReconcilePending) return;
+		this.allowlistReconcilePending = true;
+		try {
+			const next = reconcileAllowlist(this.config.allowedAddresses, interfaces);
+			if (sameAddressSet(this.config.allowedAddresses, next)) return;
+			await this.updateGlobalSettings({
+				allowedAddresses: next,
+				bootSeeded: true
+			});
+			this.ctx.logger.info("local-network: allowlist reconciled", { meta: { addresses: next } });
+		} finally {
+			this.allowlistReconcilePending = false;
+		}
 	}
 	detectChanges() {
 		const interfaces = this.enumerate();
@@ -429,6 +592,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 			key
 		} });
 		this.lastSnapshotKey = key;
+		this.persistReconciledAllowlist(interfaces);
 		this.ctx.eventBus?.emit({
 			id: `local-network-changed-${Date.now()}`,
 			timestamp: /* @__PURE__ */ new Date(),
@@ -477,7 +641,7 @@ function validPort(value) {
 	if (value === null) return null;
 	return Number.isInteger(value) && value >= 1 && value <= 65535 ? value : null;
 }
-function enumerateOsInterfaces(ifaces) {
+function enumerateOsInterfaces(ifaces, ipv6Flags) {
 	const raw = [];
 	for (const [name, addrs] of Object.entries(ifaces)) {
 		if (!addrs) continue;
@@ -497,8 +661,12 @@ function enumerateOsInterfaces(ifaces) {
 	const classified = raw.map((r) => {
 		const kind = classifyKind(r.name, r.address, r.internal);
 		const reachableKind = kind === "lan" || kind === "wifi";
-		const plausible = !r.internal && reachableKind && isPlausibleAutoSeed(r.address, r.family);
-		const plausibleReason = plausible ? "" : explainNonPlausible({
+		const hex = r.family === "IPv6" ? ipv6ToHex32(r.address) : null;
+		const flags = hex !== null ? ipv6Flags?.get(hex) : void 0;
+		const rangeOk = isPlausibleAutoSeed(r.address, r.family);
+		const stableV6 = r.family !== "IPv6" || shouldAdvertiseIpv6(r.address, flags);
+		const plausible = !r.internal && reachableKind && rangeOk && stableV6;
+		const plausibleReason = plausible ? "" : r.family === "IPv6" && rangeOk && !stableV6 ? "IPv6 temporary / privacy address — rotates and is not advertised." : explainNonPlausible({
 			kind,
 			family: r.family,
 			address: r.address,
@@ -527,13 +695,14 @@ function enumerateOsInterfaces(ifaces) {
 /**
 * Filter the interface list by the operator's allowlist. Empty
 * allowlist = no-op (every interface passes); otherwise only entries
-* whose `address` matches an allowlist entry remain. Loopback always
-* survives so the SDK keeps `127.0.0.1` as the last-resort fallback.
+* whose `address` matches an allowlist entry remain. IPv6 matches the
+* allowlisted /64 so a rotated privacy address does not hide the live
+* GUA. Loopback is not an advertised client route and is not forced
+* through.
 */
 function applyAllowlist(interfaces, allowed) {
 	if (allowed.length === 0) return interfaces;
-	const set = new Set(allowed);
-	return interfaces.filter((i) => i.kind === "loopback" || set.has(i.address));
+	return interfaces.filter((i) => ipv6AllowlistMatches(i.address, allowed) || allowed.includes(i.address));
 }
 /**
 * Rank interfaces and pick the auto-selected outbound one. See the
@@ -592,6 +761,13 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 		if (iface.address.startsWith("169.254.")) continue;
 		emit(iface, "lan-ipv4", `${formatKind(iface.kind)} — ${iface.name}`, `${lanScheme}://${iface.address}:${lanPort}`, 10 + priority++);
 	}
+	if (!ipv4Only) for (const iface of interfaces) {
+		if (iface.internal || iface.family !== "IPv6") continue;
+		if (iface.kind === "loopback") continue;
+		if (iface.address.toLowerCase().startsWith("fe80:")) continue;
+		if (!iface.plausible) continue;
+		emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, 10 + priority++);
+	}
 	if (publicHostname) out.push({
 		label: "Public tunnel",
 		baseUrl: `https://${publicHostname}`,
@@ -610,15 +786,6 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 		plausibleReason: "",
 		priority: 150
 	});
-	if (!ipv4Only) {
-		let v6prio = 200;
-		for (const iface of interfaces) {
-			if (iface.internal || iface.family !== "IPv6") continue;
-			if (iface.kind === "loopback") continue;
-			if (iface.address.startsWith("fe80:")) continue;
-			emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, v6prio++);
-		}
-	}
 	if (includeLoopback) out.push({
 		label: "Loopback",
 		baseUrl: `${scheme}://127.0.0.1:${port}`,
@@ -630,22 +797,39 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 	});
 	return out.toSorted((a, b) => a.priority - b.priority);
 }
+/** AUTO viewer race: LAN IPv4 + the public tunnel. Never IPv6, mesh, or loopback. */
+function isDefaultViewerEndpoint(endpoint) {
+	if (endpoint.kind === "lan-ipv4") return true;
+	return endpoint.kind === "public" && endpoint.interfaceKind === "public";
+}
+/**
+* The URLs the SDK should race for API / viewer access.
+*
+* Empty `viewerBaseUrls` = AUTO (IPv4 + public tunnel). A non-empty list is
+* the operator's pin; if none of those URLs are in the current palette,
+* fall back to AUTO rather than racing an empty set.
+*/
+function selectViewerEndpoints(endpoints, viewerBaseUrls) {
+	const auto = endpoints.filter(isDefaultViewerEndpoint);
+	if (viewerBaseUrls.length === 0) return auto;
+	const wanted = new Set(viewerBaseUrls);
+	const explicit = endpoints.filter((e) => wanted.has(e.baseUrl));
+	return explicit.length > 0 ? explicit : auto;
+}
 /**
 * First-boot heuristic: which addresses should the allowlist start
 * with? Includes LAN + Wi-Fi IPv4 addresses + plausible IPv6:
 *
 *   - **IPv4**: skip link-local (`169.254.*`), keep the rest.
 *   - **IPv6**: skip link-local (`fe80::*`), unspecified, and
-*     multicast. Keep ULAs (`fc00::/7` → `fc??:` / `fd??:`) and Global
-*     Unicast addresses (`2000::/3` → `2???`/`3???`). Privacy-extension
-*     temporary addresses get included by default; the operator can
-*     prune them from the Network Addresses tab if the rotating IPs
-*     become a nuisance.
+*     multicast. Keep ULAs (`fc00::/7`) and Global Unicast (`2000::/3`).
+*     Privacy-extension temporary addresses are skipped when Linux flags
+*     mark them non-permanent (`plausible === false`).
 *
 * Skips docker/vpn/loopback/other entirely — those stay opt-in.
 */
 function autoSeedAllowlist(interfaces) {
-	return [...new Set(interfaces.filter((i) => !i.internal && (i.kind === "lan" || i.kind === "wifi") && isPlausibleAutoSeed(i.address, i.family)).map((i) => i.address))];
+	return [...new Set(interfaces.filter((i) => !i.internal && (i.kind === "lan" || i.kind === "wifi") && isPlausibleAutoSeed(i.address, i.family) && (i.family !== "IPv6" || i.plausible)).map((i) => i.address))];
 }
 /**
 * Per-interface tooltip text surfaced on the "Unlikely usable" badge.
@@ -734,5 +918,30 @@ function formatKind(kind) {
 		case "other": return "Other";
 	}
 }
+/**
+* Rewrite a persisted allowlist against the live interface set:
+* current auto-seed (LAN/Wi-Fi, stable IPv6) plus still-live operator
+* extras (docker/vpn). Empty stays empty — that is "unrestricted".
+*/
+function reconcileAllowlist(current, interfaces) {
+	if (current.length === 0) return [];
+	const live = new Set(interfaces.map((i) => i.address));
+	const seed = autoSeedAllowlist(interfaces);
+	const seedSet = new Set(seed);
+	const extras = current.filter((a) => live.has(a) && !seedSet.has(a) && !a.includes(":"));
+	return [...new Set([...seed, ...extras])];
+}
+function sameAddressSet(a, b) {
+	if (a.length !== b.length) return false;
+	const set = new Set(a);
+	return b.every((addr) => set.has(addr));
+}
+function readLinuxIpv6Flags() {
+	try {
+		return parseProcIfInet6(readFileSync("/proc/net/if_inet6", "utf8"));
+	} catch {
+		return;
+	}
+}
 //#endregion
-export { LocalNetworkAddon, applyAllowlist, autoSeedAllowlist, buildEndpoints, classifyKind, enumerateOsInterfaces, explainNonPlausible, isPlausibleAutoSeed, pickPreferred, prefixLen, resolveAdvertisedPort };
+export { ALLOWLIST_RECONCILE_INTERVAL_MS, LocalNetworkAddon, applyAllowlist, autoSeedAllowlist, buildEndpoints, classifyKind, enumerateOsInterfaces, explainNonPlausible, ipv6Prefix64Key, isDefaultViewerEndpoint, isPlausibleAutoSeed, parseProcIfInet6, pickPreferred, prefixLen, reconcileAllowlist, resolveAdvertisedPort, selectViewerEndpoints, shouldAdvertiseIpv6 };

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as metricsProviderCapability, Gt as EventCategory, Mt as createEvent, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { $ as metricsProviderCapability, Gt as EventCategory, Mt as createEvent, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Gt as EventCategory, L as enumerateInferenceDevices, Pt as emitReadiness, ct as scoreRuntimes, rt as platformProbeCapability, vt as errMsg, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { Gt as EventCategory, L as enumerateInferenceDevices, Pt as emitReadiness, ct as scoreRuntimes, rt as platformProbeCapability, vt as errMsg, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { Gt as EventCategory, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Ct as DeviceFeature, Gt as EventCategory, M as deriveBatteryPresence, Rt as nodePin, T as batteryCapability, Tt as DeviceType, i as BatteryStatusSchema, mt as streamQualityLabel, ut as snapshotCapability, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { Ct as DeviceFeature, Gt as EventCategory, M as deriveBatteryPresence, Rt as nodePin, T as batteryCapability, Tt as DeviceType, i as BatteryStatusSchema, mt as streamQualityLabel, ut as snapshotCapability, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { V as filesystemBrowseCapability, pt as storageProviderCapability, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { V as filesystemBrowseCapability, pt as storageProviderCapability, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-BVAxT5XL.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-DHRXLMPn.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_module = require("node:module");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,5 +1,5 @@
-import { A as dataStoreProviderCapability, Bt as parseJsonUnknown, _t as vectorStoreCapability, f as RUNTIME_DEFAULTS, gt as vectorDimFromBase64, j as decodeVectorBase64, kt as asJsonObject, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
-import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-SrxMH3OT.mjs";
+import { A as dataStoreProviderCapability, Bt as parseJsonUnknown, _t as vectorStoreCapability, f as RUNTIME_DEFAULTS, gt as vectorDimFromBase64, j as decodeVectorBase64, kt as asJsonObject, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-Czd76yLZ.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { dt as storageCapability, ft as storageMigrationCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as settingsStoreCapability, yt as BaseAddon, zt as parseJsonObject } from "../../dist-BpzbLPel.mjs";
+import { dt as storageCapability, ft as storageMigrationCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as settingsStoreCapability, yt as BaseAddon, zt as parseJsonObject } from "../../dist-DCTpBXm4.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { It as hydrateSchema, vt as errMsg, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { It as hydrateSchema, vt as errMsg, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";