@camstack/system 1.2.375 → 1.2.377

package/dist/{child-cap-dispatch-B9kziY4L.mjs → child-cap-dispatch-CgmOo0yl.mjs}

@@ -1,6 +1,6 @@
-import { Nr as EventCategory$1, vr as createEvent } from "./dist-ZdSg09GJ.mjs";
+import { Br as scrubKnownSecrets, Gr as EventCategory$1, Sr as createEvent, en as maskUrlCredentials } from "./dist-BWNoS-1S.mjs";
 import { a as parseProcStat, i as nodeProcReader } from "./proc-stat-CbC55Kqi.mjs";
-import "./hub-cap-forward-BdT320dq.mjs";
+import "./hub-cap-forward-CH6_VWVO.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomBytes, randomUUID } from "node:crypto";
 import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
@@ -18,7 +18,7 @@ import * as v8 from "node:v8";
 import { Session } from "node:inspector/promises";
 import { monitorEventLoopDelay } from "node:perf_hooks";
 import * as vm from "node:vm";
-import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry, asJsonObject, asString, createDeviceProxy, createEventBusSliceSource, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, readNodePin, scopeKey, sleep, withCapInputDefaults } from "@camstack/types/addon";
+import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry, asJsonObject, asString, collectZodSecretPaths, createDeviceProxy, createEventBusSliceSource, createSecretsAccess, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, readNodePin, scopeKey, sleep, withCapInputDefaults } from "@camstack/types/addon";
 import { once } from "node:events";
 import { connect, createConnection, createServer as createServer$1 } from "node:net";
 import { TRPCClientError, createTRPCClient } from "@trpc/client";
@@ -3175,6 +3175,118 @@ function createAddonPeerBytesFacility(args) {
 	};
 }
 //#endregion
+//#region src/logging/log-redactor.ts
+/**
+* The central log redactor (D787 §8). Every line passes through it before any
+* destination, ring buffer or subscriber sees it — in hub-main's `LogManager`,
+* in a forked runner's UDS logger (which alone knows the values that runner
+* resolved), and on an agent before a child's line is forwarded to the hub.
+*
+* Three nets, cheapest first:
+*  1. KNOWN VALUES — every secret this process resolved through `ctx.secrets`
+*     is replaced wherever it appears (`‹secret:<ref hash>›`). The only net
+*     that catches a value inside a library's error message.
+*  2. URL CREDENTIALS — `user:pass@` and credential query params in any URL
+*     inside a string (`maskUrlCredentials`), and the value after a
+*     credential-looking CLI flag (`--token X`, `--auth-key=X`).
+*  3. KEY NAMES — a `meta` value under a credential-named key, at any depth.
+*
+* Key names are a LOG heuristic only: whether a field is STORED in the
+* keychain is decided by its schema type, never by its name.
+*
+* Hot path: a line with no meta, no `://`, no `--` and no registered values
+* costs a few `includes` checks.
+*/
+var REDACTED = "***";
+/** Credential-named keys. Substring, case-insensitive; only STRING values are replaced. */
+var SECRET_KEY_SUBSTRINGS = [
+	"password",
+	"passwd",
+	"secret",
+	"token",
+	"apikey",
+	"api_key",
+	"authkey",
+	"auth_key",
+	"privatekey",
+	"private_key",
+	"passphrase",
+	"credential",
+	"cookie"
+];
+/** True when a meta key names a credential. */
+function isCredentialKeyName(key) {
+	const lower = key.toLowerCase();
+	return SECRET_KEY_SUBSTRINGS.some((needle) => lower.includes(needle));
+}
+var URL_IN_TEXT = /\b[a-z][a-z0-9+.-]*:\/\/[^\s"'<>`]+/gi;
+var CREDENTIAL_FLAG = /(--(?:token|auth-?key|password|passwd|pass|secret|api-?key|access-?token|refresh-?token)(?:=|\s+))(\S+)/gi;
+/** Redact one free-form string. */
+function redactLogText(text) {
+	let out = scrubKnownSecrets(text);
+	if (out.includes("://")) out = out.replace(URL_IN_TEXT, (url) => maskUrlCredentials(url));
+	if (out.includes("--")) out = out.replace(CREDENTIAL_FLAG, (_m, flag, value) => value.startsWith("‹secret:") ? `${flag}${value}` : `${flag}${REDACTED}`);
+	return out;
+}
+/** Bounds on the meta walk — a log line is not a place to traverse a graph. */
+var MAX_DEPTH = 8;
+var MAX_NODES = 2e3;
+/**
+* Redact a value, returning the SAME reference when nothing in it changed —
+* most lines carry clean meta, and copying every one would put an allocation
+* per log line on hub-main's event loop.
+*/
+function redactValue(value, depth, budget, seen) {
+	if (budget.nodes++ > MAX_NODES) return value;
+	if (typeof value === "string") return redactLogText(value);
+	if (value === null || typeof value !== "object") return value;
+	if (depth >= MAX_DEPTH || seen.has(value)) return value;
+	if (value instanceof Error) {
+		const message = redactLogText(value.message);
+		return message === value.message ? value : message;
+	}
+	if (value instanceof Date || ArrayBuffer.isView(value) || value instanceof ArrayBuffer) return value;
+	seen.add(value);
+	if (Array.isArray(value)) {
+		let copy = null;
+		for (let i = 0; i < value.length; i++) {
+			const item = value[i];
+			const next = redactValue(item, depth + 1, budget, seen);
+			if (next !== item) {
+				copy ??= [...value];
+				copy[i] = next;
+			}
+		}
+		return copy ?? value;
+	}
+	let copy = null;
+	for (const [key, child] of Object.entries(value)) {
+		const next = typeof child === "string" && child.length > 0 && isCredentialKeyName(key) ? REDACTED : redactValue(child, depth + 1, budget, seen);
+		if (next !== child) {
+			copy ??= { ...value };
+			copy[key] = next;
+		}
+	}
+	return copy ?? value;
+}
+/** Redact a `meta` record; the same object back when it was already clean. */
+function redactLogMeta(meta) {
+	const out = redactValue(meta, 0, { nodes: 0 }, /* @__PURE__ */ new WeakSet());
+	if (out === meta) return meta;
+	return out !== null && typeof out === "object" && !Array.isArray(out) ? Object.fromEntries(Object.entries(out)) : meta;
+}
+/** Redact a whole entry: message and meta. Tags are identifiers, left alone. */
+function redactLogEntry(entry) {
+	const message = redactLogText(entry.message);
+	const meta = entry.meta !== void 0 ? redactLogMeta(entry.meta) : void 0;
+	if (message === entry.message && meta === entry.meta) return entry;
+	return {
+		...entry,
+		message,
+		...meta !== void 0 ? { meta } : {}
+	};
+}
+//#endregion
 //#region src/kernel/deps/npm-command.ts
 /**
 * npm invocation resolver — makes "is npm available?" a solved problem for
@@ -4709,6 +4821,16 @@ function buildDeviceOpsProvider(device) {
 		}
 	};
 }
+/**
+* The secret paths a live device's config schema declares (D783). A device
+* whose `config` carries no readable schema (a test double) declares none —
+* the hub's keyword backstop still applies to it.
+*/
+function declaredSecretConfigPaths(device) {
+	const schema = device.config?.schema;
+	if (schema === void 0 || schema === null || typeof schema !== "object") return [];
+	return [...collectZodSecretPaths(schema)];
+}
 function callDeviceManager(api, method, input) {
 	const leaf = Reflect.get(Reflect.get(api, "deviceManager"), method);
 	return (leaf.mutate ?? leaf.query)(input);
@@ -4760,12 +4882,13 @@ function createBrokerDeviceManagerApi(opts) {
 			bindRuntimeState: (state) => {
 				runtimeStateRef = state;
 			},
-			persistConfig: async (data) => {
+			persistConfig: async (data, options) => {
 				const dataRecord = toPlainRecord(data);
 				if (!dataRecord) throw new Error(`worker-device-manager: persistConfig expected a plain object, got ${data === null ? "null" : typeof data}`);
 				await callDeviceManager(api, "persistConfig", {
 					deviceId: id,
-					data: dataRecord
+					data: dataRecord,
+					...options?.secretConfigPaths !== void 0 ? { secretConfigPaths: [...options.secretConfigPaths] } : {}
 				});
 			},
 			initialRuntimeState,
@@ -5155,7 +5278,8 @@ function createBrokerDeviceManagerApi(opts) {
 					name: device.name,
 					parentDeviceId: device.parentDeviceId,
 					features: [...device.features],
-					config: {}
+					config: {},
+					secretConfigPaths: declaredSecretConfigPaths(device)
 				});
 			} catch (err) {
 				registry.remove(device.id);
@@ -5174,7 +5298,8 @@ function createBrokerDeviceManagerApi(opts) {
 						name: device.name,
 						parentDeviceId: device.parentDeviceId,
 						features: [...device.features],
-						config: {}
+						config: {},
+						secretConfigPaths: declaredSecretConfigPaths(device)
 					});
 				} catch (err) {
 					opts.logger.debug("post-probe features meta refresh failed (non-fatal)", {
@@ -8286,22 +8411,33 @@ function extractNodeId(args) {
 	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
 }
 /**
-* Merge `callerAddonId` into `args` as an extra field — the SAME "provider
+* Stamp the CALLER identity into a cap call's args — the SAME "provider
 * destructures what it needs and ignores the rest" convention
 * {@link extractNodeId} already relies on for the inline `nodeId` pin.
-* `undefined` (the overwhelmingly common case: no caller hint, or the census
-* consuming it is disarmed) returns `args` unchanged — no allocation. A
-* non-object `args` (or `null`/array) is returned unchanged too: there is
-* nowhere to attach an extra key without changing the payload's shape, and a
-* provider taking a bare value never reads `callerAddonId` off it anyway.
-*/
-function withCallerAddonId(args, callerAddonId) {
-	if (callerAddonId === void 0) return args;
+*
+* The stamp is the transport's, never the caller's (D787):
+*  - a stamp (`callerAddonId` known to the transport) OVERWRITES whatever the
+*    args carry under that key;
+*  - NO stamp STRIPS the key: a call that crossed a wire with no identity the
+*    transport can vouch for must not arrive carrying a claimed one. The
+*    keychain owner-checks on this field, and until 2026-10-08 an unstamped
+*    call let a child's own `callerAddonId` through untouched.
+*
+* A hub in-process caller never reaches this function (`localProviderLink`
+* calls the provider directly), which is the one place a stated identity is
+* trusted. A non-object `args` (or `null`/array) is returned unchanged: there
+* is nowhere to attach a key, and nowhere one could hide.
+*/
+function stampCallerAddonId(args, callerAddonId) {
 	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
-	return {
+	if (callerAddonId !== void 0) return {
 		...args,
 		callerAddonId
 	};
+	if (!Object.prototype.hasOwnProperty.call(args, "callerAddonId")) return args;
+	const rest = {};
+	for (const [key, value] of Object.entries(args)) if (key !== "callerAddonId") rest[key] = value;
+	return rest;
 }
 var CapRouteResolver = class {
 	hubNodeId;
@@ -8405,7 +8541,7 @@ var CapRouteResolver = class {
 	*/
 	async dispatchInner(route, method, args, addonId, callerAddonId) {
 		switch (route.kind) {
-			case "hub-in-process": return route.ref.invoke(method, withCallerAddonId(args, callerAddonId));
+			case "hub-in-process": return route.ref.invoke(method, stampCallerAddonId(args, callerAddonId));
 			case "hub-local-uds": {
 				const registry = this.hubLocalRegistry;
 				if (registry === null) throw new CapRouteError(route.capName, method, {
@@ -8965,7 +9101,8 @@ var LocalChildRegistry = class {
 			method: input.method,
 			args: input.args,
 			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
-			...input.addonId !== void 0 ? { addonId: input.addonId } : {}
+			...input.addonId !== void 0 ? { addonId: input.addonId } : {},
+			...input.callerAddonId !== void 0 ? { callerAddonId: input.callerAddonId } : {}
 		};
 	}
 	listChildren() {
@@ -9239,7 +9376,8 @@ var LocalChildRegistry = class {
 							capName: out.capName,
 							method: out.method,
 							args: void 0,
-							...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {}
+							...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {},
+							...childId !== null ? { callerAddonId: childId } : {}
 						};
 						const declared = this.capTimeoutMs?.(out.capName, out.method);
 						return entry.channel.request(forward, {
@@ -9464,13 +9602,14 @@ var LocalChildClient = class {
 		channel.onRequest(async (body, payload) => {
 			const msg = body;
 			if (msg.kind === "cap-call") {
-				const args = payload !== void 0 ? unpackPayload(payload) : msg.args;
+				const args = stampCallerAddonId(payload !== void 0 ? unpackPayload(payload) : msg.args, msg.callerAddonId);
 				const result = await this.options.dispatch({
 					capName: msg.capName,
 					method: msg.method,
 					args,
 					...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {},
-					...msg.addonId !== void 0 ? { addonId: msg.addonId } : {}
+					...msg.addonId !== void 0 ? { addonId: msg.addonId } : {},
+					...msg.callerAddonId !== void 0 ? { callerAddonId: msg.callerAddonId } : {}
 				});
 				if (payload !== void 0 && result !== void 0) return new PayloadReply(void 0, packPayload(result));
 				return result;
@@ -9653,12 +9792,12 @@ function createUdsLoggerWithState(client, addonId, nodeId, levelState, scope, ta
 		} : baseTags;
 		const entry = {
 			level,
-			message,
+			message: redactLogText(message),
 			addonId,
 			nodeId,
 			...scope !== void 0 ? { scope } : {},
 			tags: mergedTags,
-			...extras?.meta !== void 0 ? { meta: extras.meta } : {}
+			...extras?.meta !== void 0 ? { meta: redactLogMeta(extras.meta) } : {}
 		};
 		client.sendLog(entry);
 	}
@@ -9880,7 +10019,8 @@ function createParentUnownedCallHandler(deps) {
 				method: input.method,
 				args: input.args,
 				deviceId,
-				native: true
+				native: true,
+				...input.callerAddonId !== void 0 ? { callerAddonId: input.callerAddonId } : {}
 			});
 			throw new Error(`no native provider for capability "${input.capName}" on device ${String(deviceId)}`);
 		}
@@ -9940,7 +10080,8 @@ function createParentUnownedCallHandler(deps) {
 						method: input.method,
 						args: input.args,
 						deviceId,
-						nodeId: owner.nodeId
+						nodeId: owner.nodeId,
+						...input.callerAddonId !== void 0 ? { callerAddonId: input.callerAddonId } : {}
 					});
 					return await brokerCallForCap(deps.broker, input.capName, input.method, input.args, { nodeId: owner.nodeId });
 				}
@@ -9950,7 +10091,8 @@ function createParentUnownedCallHandler(deps) {
 				method: input.method,
 				args: input.args,
 				...deviceId !== void 0 ? { deviceId } : {},
-				...nodeId !== void 0 ? { nodeId } : {}
+				...nodeId !== void 0 ? { nodeId } : {},
+				...input.callerAddonId !== void 0 ? { callerAddonId: input.callerAddonId } : {}
 			});
 			if (deps.isCoreServiceCap !== void 0 && !deps.isCoreServiceCap(input.capName)) {
 				for (let attempt = 1; attempt <= ADDON_CAP_RETRY_ATTEMPTS; attempt++) {
@@ -9961,7 +10103,7 @@ function createParentUnownedCallHandler(deps) {
 							...nodeId !== void 0 ? { nodeId } : {},
 							...deviceId !== void 0 ? { deviceId } : {}
 						});
-						return await retryResolver.dispatch(route, input.method, input.args);
+						return input.callerAddonId !== void 0 ? await retryResolver.dispatch(route, input.method, input.args, void 0, input.callerAddonId) : await retryResolver.dispatch(route, input.method, input.args);
 					} catch (err) {
 						if (!(err instanceof CapRouteError) || err.reason !== "no-provider") throw err;
 					}
@@ -11924,6 +12066,19 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		api,
 		deps: new AddonDepsManager(addonDataDir, scopedLogger),
 		settings: settingsView,
+		secrets: createSecretsAccess({
+			owner: addonId,
+			transport: {
+				put: (input) => api.keychain.put.mutate({
+					ref: input.ref,
+					value: input.value
+				}),
+				resolve: (input) => api.keychain.resolve.query({ refs: [...input.refs] }),
+				delete: (input) => api.keychain.delete.mutate({ refs: [...input.refs] }),
+				getState: () => api.keychain.getState.query({})
+			},
+			eventBus: scopedEventBus
+		}),
 		kernel: (() => {
 			const streamProbe = runtime.mode === "broker" ? {
 				probe: (url, probeOptions) => runtime.broker.call("$stream-probe.probe", {
@@ -12750,4 +12905,4 @@ function createChildCapDispatch(deps) {
 	};
 }
 //#endregion
-export { CapRouteError as $, EMPTY_CAP_ACTION_READING as $n, RUNNER_RSS_BUDGET_ENV as $t, resolveHwAccel as A, OUTBOUND_QUEUE_SUSTAIN_MS as An, DeviceRegistry as At, udsChildLogToWorkerEntry as B, createSocketPlaneMeter as Bn, hostNodeIdOf as Bt, getBrokerEventBus as C, HEAP_SPACE_REPORT_MIN_MB as Cn, capActionName as Ct, subscribePassthrough as D, readHeapSpaces as Dn, parseCapAction as Dt, setNodeEventInterest as E, heapSpaceField as En, capServiceName as Et, ipcParentLink as F, createMeshQueueReader as Fn, resolveAddonClass as Ft, UDS_NO_ROUTE_PREFIX as G, EMPTY_SOCKET_DIRECTION as Gn, HEAP_WATCH_INTERVAL_MS as Gt, createUdsLoggerWithControl as H, diffSocketPlane as Hn, HEAP_RECLAIM_MIN_INTERVAL_MS as Ht, localProviderLink as I, formatMeshQueue as In, buildNpmChildEnv as It, answerClaimedGetStatus as J, sampleSocketDirection as Jn, HUB_MAIN_RSS_BUDGET_MB as Jt, afterWorkerOnlineAnnounce as K, createSocketDirectionCounters as Kn, HEAP_WATCH_WARN_RATIO as Kt, createParentUnownedCallHandler as L, EMPTY_SOCKET_PLANE_BASELINE as Ln, resolveNpmInvocation as Lt, brokerTransportLink as M, createOutboundQueueGate as Mn, CapabilityUnavailableError as Mt, buildLinkChain as N, formatOutboundQueueVerdict as Nn, copyBundledNativeModules as Nt, AddonDepsManager as O, selectReportedSpaces as On, deserializeTypedArrays as Ot, deviceCapResolverLink as P, MESH_QUEUE_TOP_N as Pn, installManifestNativeDeps as Pt, CapRouteResolver as Q, CAP_ACTION_UNLABELLED as Qn, RUNNER_HEAP_WATCH_INTERVAL_MS as Qt, createUdsEventBridge as R, SOCKET_PLANE_TOP_N as Rn, runNpm as Rt, clusterEventTopic as S, DECISIVE_HEAP_SPACES as Sn, NATIVE_PROVIDER_SERVICE_INFIX as St, registerEventBusService as T, formatHeapSpaces as Tn, capBareAction as Tt, LocalChildClient as U, formatSocketPlane as Un, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Ut, createUdsLogger as V, createSocketPlaneReader as Vn, createAddonDataPlaneFacility as Vt, LocalChildRegistry as W, readSocketQueues as Wn, HEAP_RECLAIM_TRIGGER_MB as Wt, AGENT_CAP_FWD_ACTION as X, socketDirectionMessages as Xn, RSS_BUDGET_REANNOUNCE_MIN_MS as Xt, deviceOfGetStatus as Y, socketDirectionBytes as Yn, HUB_RSS_BUDGET_ENV as Yt, AGENT_CAP_FWD_SERVICE as Z, CAP_ACTION_OVERFLOW_LABEL as Zn, RSS_BUDGET_RELEASE_RATIO as Zt, getWorkerDeviceRegistry as _, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO as _n, getWorkerNativeCapSnapshot as _t, reapProcessGroup as a, describeRss as an, createEventPlaneMeter as ar, getCapUsageRegistry as at, setHubConnected as b, formatArrayBufferCensus as bn, createAddonService as bt, runnerOwnsProcessGroup as c, parseRssBudgetMb as cn, formatEventPlane as cr, UdsLocalTransportServer as ct, summarizeMembers as d, startHeapWatch as dn, localEndpointPath as dt, ZERO_LOOP_DELAY as en, MAX_CAP_ACTIONS_PER_PEER as er, classifyCapRoute as et, installManifestSystemDeps as f, startRunnerHeapWatch as fn, FrameDecoder as ft, createUdsAddonContext as g, ARRAY_BUFFER_CENSUS_THRESHOLD_MB as gn, getWorkerNativeCapProvider as gt, createAddonContext as h, ARRAY_BUFFER_CENSUS_SUSTAIN_MS as hn, createBrokerDeviceManagerApi as ht, killOwnRunnerGroupAfterParentLoss as i, createV8Reclaimer as in, EVENT_PLANE_TOP_N as ir, __resetCapUsageRegistryForTests as it, brokerCallForCap as j, OUTBOUND_QUEUE_THRESHOLD_BYTES as jn, CapabilityHandle as jt, createKernelHwAccel as k, OUTBOUND_QUEUE_COOLDOWN_MS as kn, serializeTypedArrays as kt, signalAllRunnerGroups as l, reclaimIntervalMs as ln, SocketChannel as lt, adaptBrokerToCluster as m, ARRAY_BUFFER_CENSUS_COOLDOWN_MS as mn, buildNativeCapProxy as mt, createChildCapDispatch as n, createDeferredHeapWatchSink as nn, createCapActionCensus as nr, CapUsageRegistry as nt, registerRunnerGroup as o, hubMainRssBudget as on, createEventPlaneReader as or, createLocalTransport as ot, installManifestPythonDeps as p, strandedMb as pn, encodeFrame as pt, GET_STATUS_METHOD as q, recordSocketFrame as qn, HUB_MAIN_HEAP_WATCH_LABEL as qt, defaultProcessGroupOps as r, createLoopDelayMeter as rn, diffCapActionCensus as rr, PARENT_ROUTED_PROVIDER_ADDON_ID as rt, releaseRunnerGroup as s, nextRssBudgetState as sn, diffEventPlane as sr, UdsLocalTransportClient as st, CAP_METHOD_NOT_IMPLEMENTED as t, buildHeapSample as tn, capActionLabel as tr, callWithServiceDiscovery as tt, startRunnerParentDeathWatchdog as u, shouldReclaim as un, PeerAnsweredError as ut, getOrInitReadinessRegistry as v, createArrayBufferCensusGate as vn, mountNativeCapService as vt, getMoleculerEventStats as w, emitHeapDiagnosticReport as wn, capActionSuffix as wt, EVENT_TOPIC_PREFIX as x, isArrayBufferCensusReport as xn, validateProviderRegistrations as xt, getOrInitReadinessRegistryForClient as y, createInspectorArrayBufferCensus as yn, setWorkerNativeCapsChangeListener as yt, createUdsEventBus as z, SOCKET_QUEUE_TOP_N as zn, createAddonPeerBytesFacility as zt };
+export { stampCallerAddonId as $, sampleSocketDirection as $n, HUB_MAIN_RSS_BUDGET_MB as $t, resolveHwAccel as A, formatHeapSpaces as An, serializeTypedArrays as At, udsChildLogToWorkerEntry as B, createMeshQueueReader as Bn, isCredentialKeyName as Bt, getBrokerEventBus as C, createArrayBufferCensusGate as Cn, NATIVE_PROVIDER_SERVICE_INFIX as Ct, subscribePassthrough as D, DECISIVE_HEAP_SPACES as Dn, capServiceName as Dt, setNodeEventInterest as E, isArrayBufferCensusReport as En, capBareAction as Et, ipcParentLink as F, OUTBOUND_QUEUE_SUSTAIN_MS as Fn, installManifestNativeDeps as Ft, UDS_NO_ROUTE_PREFIX as G, createSocketPlaneMeter as Gn, hostNodeIdOf as Gt, createUdsLoggerWithControl as H, EMPTY_SOCKET_PLANE_BASELINE as Hn, redactLogMeta as Ht, localProviderLink as I, OUTBOUND_QUEUE_THRESHOLD_BYTES as In, resolveAddonClass as It, answerClaimedGetStatus as J, formatSocketPlane as Jn, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Jt, afterWorkerOnlineAnnounce as K, createSocketPlaneReader as Kn, createAddonDataPlaneFacility as Kt, createParentUnownedCallHandler as L, createOutboundQueueGate as Ln, buildNpmChildEnv as Lt, brokerTransportLink as M, readHeapSpaces as Mn, CapabilityHandle as Mt, buildLinkChain as N, selectReportedSpaces as Nn, CapabilityUnavailableError as Nt, AddonDepsManager as O, HEAP_SPACE_REPORT_MIN_MB as On, parseCapAction as Ot, deviceCapResolverLink as P, OUTBOUND_QUEUE_COOLDOWN_MS as Pn, copyBundledNativeModules as Pt, CapRouteResolver as Q, recordSocketFrame as Qn, HUB_MAIN_HEAP_WATCH_LABEL as Qt, createUdsEventBridge as R, formatOutboundQueueVerdict as Rn, resolveNpmInvocation as Rt, clusterEventTopic as S, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO as Sn, validateProviderRegistrations as St, registerEventBusService as T, formatArrayBufferCensus as Tn, capActionSuffix as Tt, LocalChildClient as U, SOCKET_PLANE_TOP_N as Un, redactLogText as Ut, createUdsLogger as V, formatMeshQueue as Vn, redactLogEntry as Vt, LocalChildRegistry as W, SOCKET_QUEUE_TOP_N as Wn, createAddonPeerBytesFacility as Wt, AGENT_CAP_FWD_ACTION as X, EMPTY_SOCKET_DIRECTION as Xn, HEAP_WATCH_INTERVAL_MS as Xt, deviceOfGetStatus as Y, readSocketQueues as Yn, HEAP_RECLAIM_TRIGGER_MB as Yt, AGENT_CAP_FWD_SERVICE as Z, createSocketDirectionCounters as Zn, HEAP_WATCH_WARN_RATIO as Zt, getWorkerDeviceRegistry as _, startRunnerHeapWatch as _n, getWorkerNativeCapProvider as _t, reapProcessGroup as a, ZERO_LOOP_DELAY as an, MAX_CAP_ACTIONS_PER_PEER as ar, __resetCapUsageRegistryForTests as at, setHubConnected as b, ARRAY_BUFFER_CENSUS_SUSTAIN_MS as bn, setWorkerNativeCapsChangeListener as bt, runnerOwnsProcessGroup as c, createLoopDelayMeter as cn, diffCapActionCensus as cr, UdsLocalTransportClient as ct, summarizeMembers as d, hubMainRssBudget as dn, createEventPlaneReader as dr, PeerAnsweredError as dt, HUB_RSS_BUDGET_ENV as en, socketDirectionBytes as er, CapRouteError as et, installManifestSystemDeps as f, nextRssBudgetState as fn, diffEventPlane as fr, localEndpointPath as ft, createUdsAddonContext as g, startHeapWatch as gn, createBrokerDeviceManagerApi as gt, createAddonContext as h, shouldReclaim as hn, buildNativeCapProxy as ht, killOwnRunnerGroupAfterParentLoss as i, RUNNER_RSS_BUDGET_ENV as in, EMPTY_CAP_ACTION_READING as ir, PARENT_ROUTED_PROVIDER_ADDON_ID as it, brokerCallForCap as j, heapSpaceField as jn, DeviceRegistry as jt, createKernelHwAccel as k, emitHeapDiagnosticReport as kn, deserializeTypedArrays as kt, signalAllRunnerGroups as l, createV8Reclaimer as ln, EVENT_PLANE_TOP_N as lr, UdsLocalTransportServer as lt, adaptBrokerToCluster as m, reclaimIntervalMs as mn, encodeFrame as mt, createChildCapDispatch as n, RSS_BUDGET_RELEASE_RATIO as nn, CAP_ACTION_OVERFLOW_LABEL as nr, callWithServiceDiscovery as nt, registerRunnerGroup as o, buildHeapSample as on, capActionLabel as or, getCapUsageRegistry as ot, installManifestPythonDeps as p, parseRssBudgetMb as pn, formatEventPlane as pr, FrameDecoder as pt, GET_STATUS_METHOD as q, diffSocketPlane as qn, HEAP_RECLAIM_MIN_INTERVAL_MS as qt, defaultProcessGroupOps as r, RUNNER_HEAP_WATCH_INTERVAL_MS as rn, CAP_ACTION_UNLABELLED as rr, CapUsageRegistry as rt, releaseRunnerGroup as s, createDeferredHeapWatchSink as sn, createCapActionCensus as sr, createLocalTransport as st, CAP_METHOD_NOT_IMPLEMENTED as t, RSS_BUDGET_REANNOUNCE_MIN_MS as tn, socketDirectionMessages as tr, classifyCapRoute as tt, startRunnerParentDeathWatchdog as u, describeRss as un, createEventPlaneMeter as ur, SocketChannel as ut, getOrInitReadinessRegistry as v, strandedMb as vn, getWorkerNativeCapSnapshot as vt, getMoleculerEventStats as w, createInspectorArrayBufferCensus as wn, capActionName as wt, EVENT_TOPIC_PREFIX as x, ARRAY_BUFFER_CENSUS_THRESHOLD_MB as xn, createAddonService as xt, getOrInitReadinessRegistryForClient as y, ARRAY_BUFFER_CENSUS_COOLDOWN_MS as yn, mountNativeCapService as yt, createUdsEventBus as z, MESH_QUEUE_TOP_N as zn, runNpm as zt };