@camstack/system 1.2.358 → 1.2.359

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,8 +1,232 @@
-import { Nn as validateHubAddressOverride, Tr as EventCategory, Ut as localNetworkCapability, an as pickAppLinkHub, er as BaseAddon, hn as resolveHubAddress, s as CAMSTACK_APP_LINK_ORIGIN } from "../../dist-D3bhbMY3.mjs";
+import { Ar as EventCategory, Ft as isAppLinkBase, Kt as localNetworkCapability, Rn as validateCustomAddress, Rt as isDefaultViewerEndpoint, Sn as resolveViewerAddresses, ar as BaseAddon, cn as pickAppLinkHub, s as CAMSTACK_APP_LINK_ORIGIN, tt as checkRoleAddress, vn as resolveHubAddressRoles, xn as resolveNotificationsAddress } from "../../dist-pTfD_M-U.mjs";
 import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-CJHogwTl.mjs";
+import { z } from "zod";
 import * as os from "node:os";
 import { readFileSync } from "node:fs";
 import { isIP } from "node:net";
+//#region src/builtins/local-network/address-book.ts
+/**
+* The Network page's address book, as pure functions: custom addresses plus
+* the role flags carried by detected and custom addresses alike.
+*
+* ## Storage
+*
+* The role flags keep the keys they always had, so a rolled-back hub reads
+* them with the meaning it knew: `viewerBaseUrls` (viewer, many),
+* `notificationBaseUrl` (notifications, D709), `agentBaseUrl` and
+* `signInBaseUrl` (agents / sign-in, D729 amendment). A single-valued role is
+* one URL — at most one address carries it, by construction. `''` / `[]` is
+* automatic. The custom addresses are `customAddresses` (url + label).
+*
+* ## Migration in the read path
+*
+* Before this, a single-valued flag could name an address that was in no row:
+* the notification links' typed custom address (D709) and the two hub-address
+* overrides (D729 amendment) were free URLs. {@link normalizeAddressBook}
+* turns every such flag into a custom address carrying that role, on every
+* read; the next write persists the result. It is the same rule forever, not
+* a one-off: a flagged detected address that disappears (a DHCP move) shows up
+* as a custom row instead of vanishing while it still wins.
+*/
+var CustomAddressListSchema = z.array(z.object({
+	baseUrl: z.string(),
+	label: z.string()
+}));
+/** The label a flag promoted to a custom address is given. */
+var PROMOTED_LABEL = {
+	notifications: "Notification links address",
+	agents: "Hub address for agents",
+	signIn: "Sign-in address"
+};
+var SINGLE_ROLES = [
+	"notifications",
+	"agents",
+	"signIn"
+];
+function flagOf(value) {
+	return value === "" ? null : value;
+}
+/** Parse the stored custom list; a malformed store reads as empty, never throws. */
+function parseCustomAddresses(raw) {
+	const parsed = CustomAddressListSchema.safeParse(raw ?? []);
+	return parsed.success ? parsed.data : [];
+}
+/**
+* The address book as it stands: stored custom addresses, plus every
+* single-valued flag that names neither a detected address, a custom one nor
+* the app link, promoted to a custom address (see the module doc).
+*/
+function normalizeAddressBook(stored, detectedUrls) {
+	const flags = {
+		viewer: stored.viewerBaseUrls,
+		notifications: flagOf(stored.notificationBaseUrl),
+		agents: flagOf(stored.agentBaseUrl),
+		signIn: flagOf(stored.signInBaseUrl)
+	};
+	const custom = [...parseCustomAddresses(stored.customAddresses)];
+	for (const role of SINGLE_ROLES) {
+		const url = flags[role];
+		if (url === null || isAppLinkBase(url) || detectedUrls.has(url)) continue;
+		if (custom.some((c) => c.baseUrl === url)) continue;
+		custom.push({
+			baseUrl: url,
+			label: PROMOTED_LABEL[role]
+		});
+	}
+	return {
+		custom,
+		flags
+	};
+}
+/** The stored-settings patch that persists `state`. */
+function addressBookPatch(state) {
+	return {
+		customAddresses: state.custom,
+		viewerBaseUrls: state.flags.viewer,
+		notificationBaseUrl: state.flags.notifications ?? "",
+		agentBaseUrl: state.flags.agents ?? "",
+		signInBaseUrl: state.flags.signIn ?? ""
+	};
+}
+function withCustomAddress(state, entry) {
+	const custom = state.custom.some((c) => c.baseUrl === entry.baseUrl) ? state.custom.map((c) => c.baseUrl === entry.baseUrl ? entry : c) : [...state.custom, entry];
+	return {
+		...state,
+		custom
+	};
+}
+/** Drop a custom address and every flag it carried (those roles turn automatic). */
+function withoutCustomAddress(state, baseUrl) {
+	const clear = (flag) => flag === baseUrl ? null : flag;
+	return {
+		custom: state.custom.filter((c) => c.baseUrl !== baseUrl),
+		flags: {
+			viewer: state.flags.viewer.filter((u) => u !== baseUrl),
+			notifications: clear(state.flags.notifications),
+			agents: clear(state.flags.agents),
+			signIn: clear(state.flags.signIn)
+		}
+	};
+}
+/** Every role back to automatic for `role`. */
+function withRoleAutomatic(state, role) {
+	return role === "viewer" ? {
+		...state,
+		flags: {
+			...state.flags,
+			viewer: []
+		}
+	} : {
+		...state,
+		flags: {
+			...state.flags,
+			[role]: null
+		}
+	};
+}
+/**
+* Flag or unflag `baseUrl` for `role`. A single-valued role flagged here moves
+* off every other address (it is one URL); unflagging the address that carries
+* it returns the role to automatic. The app link flagged for notifications IS
+* the automatic answer, stored as automatic — one representation. `viewer`
+* toggles inside the set; toggling while automatic starts from the automatic
+* set (`autoViewer`) so the other addresses keep racing.
+*/
+function withRoleFlag(state, role, baseUrl, enabled, autoViewer) {
+	if (role === "viewer") {
+		const without = (state.flags.viewer.length === 0 ? autoViewer : state.flags.viewer).filter((u) => u !== baseUrl);
+		const viewer = enabled ? [...without, baseUrl] : without;
+		return {
+			...state,
+			flags: {
+				...state.flags,
+				viewer
+			}
+		};
+	}
+	if (role === "notifications" && isAppLinkBase(baseUrl)) return withRoleAutomatic(state, role);
+	if (enabled) return {
+		...state,
+		flags: {
+			...state.flags,
+			[role]: baseUrl
+		}
+	};
+	return state.flags[role] === baseUrl ? withRoleAutomatic(state, role) : state;
+}
+/** What a row may be flagged with. */
+function eligibleRoles(endpoint) {
+	if (endpoint.kind === "loopback") return [];
+	if (endpoint.kind === "app-link") return ["notifications"];
+	return [
+		"viewer",
+		"notifications",
+		"agents",
+		"signIn"
+	];
+}
+/** A custom address as a palette entry (`kind: 'custom'`). */
+function customEndpoint(entry) {
+	return {
+		label: entry.label === "" ? "Custom address" : entry.label,
+		baseUrl: entry.baseUrl,
+		kind: "custom",
+		interfaceKind: "other",
+		plausible: true,
+		plausibleReason: "",
+		priority: 200
+	};
+}
+/**
+* The palette a client races: the detected endpoints plus the custom
+* addresses flagged `viewer` (a detected URL is never listed twice).
+*/
+function withViewerCustomEndpoints(detected, state) {
+	const known = new Set(detected.map((e) => e.baseUrl));
+	const wanted = new Set(state.flags.viewer);
+	const extra = state.custom.filter((c) => wanted.has(c.baseUrl) && !known.has(c.baseUrl)).map(customEndpoint);
+	return [...detected, ...extra];
+}
+/** Every role's answer — the resolvers from `@camstack/types`, nothing else. */
+function resolveRoles(state, viewerPalette, httpsPalette) {
+	return resolveHubAddressRoles(withViewerCustomEndpoints(viewerPalette, state), httpsPalette, state.flags);
+}
+function flagsOn(state, baseUrl) {
+	const out = [];
+	if (state.flags.viewer.includes(baseUrl)) out.push("viewer");
+	for (const role of SINGLE_ROLES) if (state.flags[role] === baseUrl) out.push(role);
+	return out;
+}
+function inUseOn(roles, baseUrl) {
+	const out = [];
+	if (roles.viewer.resolved.includes(baseUrl)) out.push("viewer");
+	for (const role of SINGLE_ROLES) if (roles[role].resolved === baseUrl) out.push(role);
+	return out;
+}
+/** The Addresses table: app link, detected rows, then custom-only rows. */
+function buildAddressBook(state, inputs) {
+	const roles = resolveRoles(state, inputs.rowsPalette, inputs.httpsPalette);
+	const customUrls = new Set(state.custom.map((c) => c.baseUrl));
+	const detectedUrls = new Set(inputs.rowsPalette.map((e) => e.baseUrl));
+	const row = (endpoint, detected) => ({
+		...endpoint,
+		detected,
+		custom: customUrls.has(endpoint.baseUrl),
+		flags: endpoint.kind === "app-link" ? [] : flagsOn(state, endpoint.baseUrl),
+		inUse: endpoint.kind === "app-link" ? roles.notifications.resolved === "https://camstack.zentik.app" ? ["notifications"] : [] : inUseOn(roles, endpoint.baseUrl),
+		eligible: eligibleRoles(endpoint)
+	});
+	return {
+		rows: [
+			row(inputs.appLink, false),
+			...inputs.rowsPalette.map((e) => row(e, true)),
+			...state.custom.filter((c) => !detectedUrls.has(c.baseUrl)).map((c) => row(customEndpoint(c), false))
+		],
+		roles,
+		appLinkHub: inputs.appLinkHub
+	};
+}
+//#endregion
 //#region src/builtins/local-network/ipv6-lan.ts
 /**
 * IPv6 helpers for LAN advertisement: prefix matching (privacy addresses
@@ -196,6 +420,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 			bootSeeded: false,
 			notificationBaseUrl: "",
 			viewerBaseUrls: [],
+			customAddresses: [],
 			httpEnabled: true,
 			httpPort: DEFAULT_LAN_HTTP_PORT,
 			localHostname: "",
@@ -204,62 +429,126 @@ var LocalNetworkAddon = class extends BaseAddon {
 		});
 	}
 	/**
-	* Both audiences' hub address: the override when set, else the automatic
-	* pick over the HTTPS palette (`resolveHubAddress`). The one reading every
-	* consumer goes through — `getHubAddresses`.
+	* The detected palettes, with the mesh reconciled once: `https` (what agents
+	* and sign-in resolve over, and the app link's `hub=`) and `http` (what the
+	* viewer race resolves over, as before).
 	*/
-	async snapshotHubAddresses() {
+	async palettes() {
 		const port = (await this.resolveAdvertisedListenPort(null)).port;
-		const palette = await this.buildAdvertisedEndpoints(false, false, "https", port);
+		await this.reconcileMeshEndpoint();
 		return {
-			cluster: resolveHubAddress(palette, "cluster", this.config.agentBaseUrl || null),
-			browser: resolveHubAddress(palette, "browser", this.config.signInBaseUrl || null)
+			http: this.endpointsNow(false, false, "http", port),
+			https: this.endpointsNow(false, false, "https", port)
 		};
 	}
+	/** The stored address book, normalised against what is detected now. */
+	addressState(detected) {
+		return normalizeAddressBook(this.config, new Set(detected.map((e) => e.baseUrl)));
+	}
+	/** The role flags alone — they do not depend on what is detected. */
+	storedFlags() {
+		return normalizeAddressBook(this.config, /* @__PURE__ */ new Set()).flags;
+	}
+	/** `getAddresses`: the Addresses table and every role's answer. */
+	async addressBook(scheme) {
+		const { http, https } = await this.palettes();
+		return buildAddressBook(this.addressState([...http, ...https]), {
+			rowsPalette: scheme === "http" ? http : https,
+			httpsPalette: https,
+			appLink: appLinkEndpoint(),
+			appLinkHub: pickAppLinkHub(https)
+		});
+	}
 	/**
-	* The effective flagged notification address: the operator's explicit
-	* choice, else AUTO — the CamStack app link (D709, operator decision
-	* 2026-10-06; before it AUTO was the tunnel, then the mesh). The app link is
-	* not a hub address: the NC's signed media and buttons keep their own hub
-	* ladder when it is flagged; only viewer taps take the app form.
+	* Apply one change to the address book and persist it, normalised (a flag
+	* naming an address in no row becomes a custom address in the same write).
 	*/
-	resolveNotificationEndpoint() {
-		const explicit = this.config.notificationBaseUrl;
-		return explicit !== "" ? explicit : CAMSTACK_APP_LINK_ORIGIN;
+	async changeAddressBook(change) {
+		const { http, https } = await this.palettes();
+		const detected = [...http, ...https];
+		const detectedUrls = new Set(detected.map((e) => e.baseUrl));
+		const changed = change(this.addressState(detected), {
+			detectedUrls,
+			autoViewer: [...new Set(detected.filter(isDefaultViewerEndpoint).map((e) => e.baseUrl))]
+		});
+		const after = normalizeAddressBook({
+			...addressBookPatch(changed),
+			customAddresses: changed.custom
+		}, detectedUrls);
+		await this.updateGlobalSettings(addressBookPatch(after));
+	}
+	/** The deprecated `getHubAddresses` shape, from the role resolvers. */
+	async snapshotHubAddresses() {
+		const { roles } = await this.addressBook("https");
+		const legacy = (r) => ({
+			override: r.flagged,
+			resolved: r.resolved,
+			source: r.source === "flagged" ? "override" : r.source
+		});
+		return {
+			cluster: legacy(roles.agents),
+			browser: legacy(roles.signIn)
+		};
 	}
 	/**
-	* The `hub=` an app link carries: the best public HTTPS address in this
-	* cap's own palette (tunnel, then mesh) — so it can never disagree with
-	* what the Network page lists. See `pickAppLinkHub`.
+	* Flag / unflag `baseUrl` for `role`, or (`baseUrl: null`) return the role
+	* to automatic. Validated: the address must be a row (detected, custom, or
+	* the app link for notifications), never loopback, and `signIn` on plain
+	* http only when accepted. A refusal stores nothing.
 	*/
-	async resolveAppLinkHub() {
-		const port = (await this.resolveAdvertisedListenPort(null)).port;
-		return pickAppLinkHub(await this.buildAdvertisedEndpoints(false, false, "https", port));
+	async setRole(role, baseUrl, enabled, acceptInsecureHttp) {
+		if (baseUrl === null || baseUrl.trim() === "" && role !== "viewer") {
+			await this.changeAddressBook((state) => withRoleAutomatic(state, role));
+			this.ctx.logger.info("local-network: address role set to automatic", { meta: { role } });
+			return;
+		}
+		let target = baseUrl.trim();
+		if (enabled) {
+			const check = checkRoleAddress(role, target, { acceptInsecureHttp });
+			if (!check.ok) throw new Error(check.reason);
+			target = check.baseUrl;
+		}
+		await this.changeAddressBook((state, ctx) => {
+			const known = isAppLinkBase(target) || ctx.detectedUrls.has(target) || state.custom.some((c) => c.baseUrl === target);
+			if (enabled && !known && role !== "notifications") throw new Error(`${target} is not in the address list — add it as a custom address first.`);
+			return withRoleFlag(state, role, target, enabled, ctx.autoViewer);
+		});
+		this.ctx.logger.info("local-network: address role set", { meta: {
+			role,
+			baseUrl: target,
+			enabled
+		} });
 	}
 	async notificationEndpointSnapshot() {
-		const explicit = this.config.notificationBaseUrl;
+		const resolution = resolveNotificationsAddress(this.storedFlags());
+		const port = (await this.resolveAdvertisedListenPort(null)).port;
 		return {
-			baseUrl: explicit === "" ? null : explicit,
-			resolved: this.resolveNotificationEndpoint(),
-			appLinkHub: await this.resolveAppLinkHub()
+			baseUrl: resolution.flagged,
+			resolved: resolution.resolved,
+			appLinkHub: pickAppLinkHub(await this.buildAdvertisedEndpoints(false, false, "https", port))
 		};
 	}
 	async snapshotViewerEndpoints() {
-		const selected = selectViewerEndpoints(await this.buildAdvertisedEndpoints(false, false, "http", (await this.resolveAdvertisedListenPort(null)).port), this.config.viewerBaseUrls);
+		const resolution = resolveViewerAddresses(await this.buildAdvertisedEndpoints(false, false, "http", (await this.resolveAdvertisedListenPort(null)).port), this.storedFlags());
 		return {
-			baseUrls: this.config.viewerBaseUrls,
-			resolved: selected.map((e) => e.baseUrl)
+			baseUrls: resolution.flagged,
+			resolved: resolution.resolved
 		};
 	}
 	/**
-	* Palette shown in the Network tab: LAN IPv4, stable LAN IPv6, public,
-	* mesh. The viewer HTTP/WS race is a subset (`selectViewerEndpoints`) —
-	* IPv6 stays in this list because ICE/WebRTC gathers it regardless.
+	* Palette shown to clients: LAN IPv4, stable LAN IPv6, public, mesh, and
+	* the custom addresses flagged `viewer` (`kind: 'custom'`). The viewer
+	* HTTP/WS race is a subset (`selectViewerEndpoints`) — IPv6 stays in this
+	* list because ICE/WebRTC gathers it regardless.
 	*/
 	async buildAdvertisedEndpoints(includeLoopback, ipv4Only, scheme, httpsPort) {
-		const allow = this.config.allowedAddresses;
-		const interfaces = applyAllowlist(this.enumerate(), allow);
 		await this.reconcileMeshEndpoint();
+		const detected = this.endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort);
+		return withViewerCustomEndpoints(detected, this.addressState(detected));
+	}
+	/** The DETECTED palette from the cached interface/tunnel/mesh state. */
+	endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort) {
+		const interfaces = applyAllowlist(this.enumerate(), this.config.allowedAddresses);
 		const httpState = readLanHttpState();
 		return buildEndpoints(interfaces, httpsPort, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, {
 			enabled: this.config.httpEnabled !== false,
@@ -302,35 +591,50 @@ var LocalNetworkAddon = class extends BaseAddon {
 			},
 			getNotificationEndpoint: async () => this.notificationEndpointSnapshot(),
 			setNotificationEndpoint: async ({ baseUrl }) => {
-				await this.updateGlobalSettings({ notificationBaseUrl: baseUrl ?? "" });
-				this.ctx.logger.info("local-network: notification endpoint set", { meta: { baseUrl: baseUrl ?? "(auto)" } });
+				await this.setRole("notifications", baseUrl, true, false);
 				return this.notificationEndpointSnapshot();
 			},
-			getHubAddresses: async () => this.snapshotHubAddresses(),
-			setHubAddress: async ({ audience, baseUrl }) => {
-				let stored = "";
-				if (baseUrl !== null && baseUrl.trim() !== "") {
-					const check = validateHubAddressOverride(baseUrl);
-					if (!check.ok) throw new Error(check.reason);
-					stored = check.baseUrl;
-				}
-				await this.updateGlobalSettings(audience === "cluster" ? { agentBaseUrl: stored } : { signInBaseUrl: stored });
-				this.ctx.logger.info("local-network: hub address override set", { meta: {
-					audience,
-					baseUrl: stored === "" ? "(auto)" : stored
-				} });
-				return this.snapshotHubAddresses();
-			},
 			getViewerEndpoints: async () => this.snapshotViewerEndpoints(),
 			setViewerEndpoints: async ({ baseUrls }) => {
-				const cleaned = [...new Set(baseUrls.filter((u) => u.length > 0))];
-				await this.updateGlobalSettings({ viewerBaseUrls: cleaned });
+				const viewer = [...new Set(baseUrls.filter((u) => u.length > 0))];
+				await this.changeAddressBook((state) => ({
+					...state,
+					flags: {
+						...state.flags,
+						viewer
+					}
+				}));
 				this.ctx.logger.info("local-network: viewer endpoints set", { meta: {
-					count: cleaned.length,
-					auto: cleaned.length === 0
+					count: viewer.length,
+					auto: viewer.length === 0
 				} });
 				return this.snapshotViewerEndpoints();
 			},
+			getAddresses: async (input) => this.addressBook(input?.scheme ?? "https"),
+			addCustomAddress: async ({ baseUrl, label }) => {
+				const check = validateCustomAddress(baseUrl);
+				if (!check.ok) throw new Error(check.reason);
+				const entry = {
+					baseUrl: check.baseUrl,
+					label: label.trim()
+				};
+				await this.changeAddressBook((state) => withCustomAddress(state, entry));
+				this.ctx.logger.info("local-network: custom address added", { meta: {
+					baseUrl: entry.baseUrl,
+					label: entry.label
+				} });
+				return this.addressBook("https");
+			},
+			removeCustomAddress: async ({ baseUrl }) => {
+				await this.changeAddressBook((state) => withoutCustomAddress(state, baseUrl));
+				this.ctx.logger.info("local-network: custom address removed", { meta: { baseUrl } });
+				return this.addressBook("https");
+			},
+			setAddressRole: async ({ role, baseUrl, enabled, acceptInsecureHttp }) => {
+				await this.setRole(role, baseUrl, enabled, acceptInsecureHttp === true);
+				return this.addressBook("https");
+			},
+			getHubAddresses: async () => this.snapshotHubAddresses(),
 			getAllowedAddresses: async () => ({ addresses: this.config.allowedAddresses }),
 			resetAllowlistToBestMatch: async () => {
 				const seed = autoSeedAllowlist(this.enumerate());
@@ -872,25 +1176,6 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 	});
 	return out.toSorted((a, b) => a.priority - b.priority);
 }
-/** AUTO viewer race: LAN IPv4 + the public tunnel. Never IPv6, mesh, or loopback. */
-function isDefaultViewerEndpoint(endpoint) {
-	if (endpoint.kind === "lan-ipv4") return true;
-	return endpoint.kind === "public" && endpoint.interfaceKind === "public";
-}
-/**
-* The URLs the SDK should race for API / viewer access.
-*
-* Empty `viewerBaseUrls` = AUTO (IPv4 + public tunnel). A non-empty list is
-* the operator's pin; if none of those URLs are in the current palette,
-* fall back to AUTO rather than racing an empty set.
-*/
-function selectViewerEndpoints(endpoints, viewerBaseUrls) {
-	const auto = endpoints.filter(isDefaultViewerEndpoint);
-	if (viewerBaseUrls.length === 0) return auto;
-	const wanted = new Set(viewerBaseUrls);
-	const explicit = endpoints.filter((e) => wanted.has(e.baseUrl));
-	return explicit.length > 0 ? explicit : auto;
-}
 /**
 * First-boot heuristic: which addresses should the allowlist start
 * with? Includes LAN + Wi-Fi IPv4 addresses + plausible IPv6:
@@ -1019,4 +1304,4 @@ function readLinuxIpv6Flags() {
 	}
 }
 //#endregion
-export { ALLOWLIST_RECONCILE_INTERVAL_MS, LocalNetworkAddon, appLinkEndpoint, applyAllowlist, autoSeedAllowlist, buildEndpoints, classifyKind, enumerateOsInterfaces, explainNonPlausible, ipv6Prefix64Key, isDefaultViewerEndpoint, isPlausibleAutoSeed, parseProcIfInet6, pickPreferred, prefixLen, reconcileAllowlist, resolveAdvertisedPort, selectViewerEndpoints, shouldAdvertiseIpv6 };
+export { ALLOWLIST_RECONCILE_INTERVAL_MS, LocalNetworkAddon, appLinkEndpoint, applyAllowlist, autoSeedAllowlist, buildEndpoints, classifyKind, enumerateOsInterfaces, explainNonPlausible, ipv6Prefix64Key, isPlausibleAutoSeed, parseProcIfInet6, pickPreferred, prefixLen, reconcileAllowlist, resolveAdvertisedPort, shouldAdvertiseIpv6 };

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DzAHit0a.js");
+const require_dist = require("../../dist-W_X44h-s.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Gt as logDestinationCapability, er as BaseAddon } from "../../dist-D3bhbMY3.mjs";
+import { Jt as logDestinationCapability, ar as BaseAddon } from "../../dist-pTfD_M-U.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DzAHit0a.js");
+const require_dist = require("../../dist-W_X44h-s.js");
 const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { $n as errMsg, Tr as EventCategory, Zt as metricsProviderCapability, er as BaseAddon, fn as resolveBucketMs, jt as foldSnapshotByFunction, un as reducePoints, ur as createEvent } from "../../dist-D3bhbMY3.mjs";
+import { Ar as EventCategory, Mt as foldSnapshotByFunction, ar as BaseAddon, en as metricsProviderCapability, hn as resolveBucketMs, hr as createEvent, ir as errMsg, pn as reducePoints } from "../../dist-pTfD_M-U.mjs";
 import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DzAHit0a.js");
+const require_dist = require("../../dist-W_X44h-s.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { $n as errMsg, St as enumerateInferenceDevices, Tr as EventCategory, er as BaseAddon, fr as emitReadiness, sn as platformProbeCapability, xn as scoreRuntimes } from "../../dist-D3bhbMY3.mjs";
+import { Ar as EventCategory, Ct as enumerateInferenceDevices, En as scoreRuntimes, _r as emitReadiness, ar as BaseAddon, ir as errMsg, un as platformProbeCapability } from "../../dist-pTfD_M-U.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DzAHit0a.js");
+const require_dist = require("../../dist-W_X44h-s.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Tr as EventCategory, er as BaseAddon } from "../../dist-D3bhbMY3.mjs";
+import { Ar as EventCategory, ar as BaseAddon } from "../../dist-pTfD_M-U.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DzAHit0a.js");
+const require_dist = require("../../dist-W_X44h-s.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { $n as errMsg, An as streamQualityLabel, Qn as DeviceType, Tr as EventCategory, X as batteryCapability, Xn as DeviceFeature, Xt as memoizePinnedFfmpeg, Y as bareAddonId, _r as nodePin, a as BatteryStatusSchema, er as BaseAddon, gt as deriveBatteryPresence, wn as snapshotCapability } from "../../dist-D3bhbMY3.mjs";
+import { $t as memoizePinnedFfmpeg, Ar as EventCategory, Fn as streamQualityLabel, Sr as nodePin, X as batteryCapability, Y as bareAddonId, _t as deriveBatteryPresence, a as BatteryStatusSchema, ar as BaseAddon, ir as errMsg, kn as snapshotCapability, rr as DeviceType, tr as DeviceFeature } from "../../dist-pTfD_M-U.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DzAHit0a.js");
+const require_dist = require("../../dist-W_X44h-s.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { At as filesystemBrowseCapability, On as storageProviderCapability, er as BaseAddon } from "../../dist-D3bhbMY3.mjs";
+import { Nn as storageProviderCapability, ar as BaseAddon, jt as filesystemBrowseCapability } from "../../dist-pTfD_M-U.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DzAHit0a.js");
+const require_dist = require("../../dist-W_X44h-s.js");
 const require_hub_cap_forward = require("../../hub-cap-forward-DmHNjbB0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { B as StorageLocationTypeSchema, E as LegacyStorageLocationDefaultSchema, En as storageMigrationCapability, Et as evictionPolicyOfLocation, It as isLocationEnabled, Jt as mayReadLocation, Ln as withLocationMode, M as REDACTED_SECRET, Nt as gbToBytes, Qt as modeMayWrite, R as StorageCleanupJobSchema, Sn as settingsStoreCapability, Tn as storageCapability, Tr as EventCategory, V as StorageMigrationJobSchema, Vt as legacyModeOf, Yt as mayWriteToLocation, er as BaseAddon, gn as resolveLocationMode, tt as collectSecretConfigKeys, vr as parseJsonObject, z as StorageLocationModeSchema } from "../../dist-D3bhbMY3.mjs";
+import { An as storageCapability, Ar as EventCategory, B as StorageLocationTypeSchema, Cr as parseJsonObject, Dn as settingsStoreCapability, Dt as evictionPolicyOfLocation, E as LegacyStorageLocationDefaultSchema, Hn as withLocationMode, M as REDACTED_SECRET, Pt as gbToBytes, Qt as mayWriteToLocation, R as StorageCleanupJobSchema, V as StorageMigrationJobSchema, Wt as legacyModeOf, Zt as mayReadLocation, ar as BaseAddon, jn as storageMigrationCapability, nt as collectSecretConfigKeys, tn as modeMayWrite, yn as resolveLocationMode, z as StorageLocationModeSchema, zt as isLocationEnabled } from "../../dist-pTfD_M-U.mjs";
 import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-BdT320dq.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DzAHit0a.js");
+const require_dist = require("../../dist-W_X44h-s.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.