@camstack/system 1.2.377 → 1.2.379

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,6 +1,6 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Bn as userManagementCapability, J as authProviderCapability, R as ScopedTokenSchema, U as UserRecordSchema, lr as BaseAddon, r as ApiKeyRecordSchema } from "../../dist-BWNoS-1S.mjs";
-import { z } from "zod";
+import { Bn as userManagementCapability, J as authProviderCapability, R as ScopedTokenSchema, U as UserRecordSchema, lr as BaseAddon, r as ApiKeyRecordSchema } from "../../dist-B9oFw2jh.mjs";
+import { a as loadJwtSigningKey, i as getProcessJwtSigningKeyState, o as processJwtSigningKey, s as setProcessJwtSigningKey, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-Qhde8r82.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -6195,7 +6195,7 @@ var noopLogger = {
 };
 var AuthManager = class {
 	config;
-	jwtSecret;
+	signingKey;
 	logger;
 	/**
 	* Offending `auth.tokenExpiry` values already reported by this instance.
@@ -6207,17 +6207,19 @@ var AuthManager = class {
 	* rest resolve silently to the same default until the value changes.
 	*/
 	reportedInvalidExpiries = /* @__PURE__ */ new Set();
-	constructor(config, logger = noopLogger) {
+	/**
+	* @param signingKey where the session signing key comes from — the process
+	*   slot `local-auth` fills from the keychain (D797). Never config, never
+	*   env; read on every mint and verify, and it THROWS while unavailable.
+	*/
+	constructor(config, logger = noopLogger, signingKey = processJwtSigningKey) {
 		this.config = config;
+		this.signingKey = signingKey;
 		this.logger = logger;
-		const configured = this.config.get("auth.jwtSecret");
-		if (configured) this.jwtSecret = configured;
-		else {
-			const secret = crypto$2.randomBytes(32).toString("hex");
-			this.config.update("auth", { jwtSecret: secret });
-			this.logger.info("Generated JWT secret and saved to config.yaml (auth.jwtSecret)");
-			this.jwtSecret = secret;
-		}
+	}
+	/** The current signing key; throws `JwtSigningKeyUnavailableError` while there is none. */
+	get jwtSecret() {
+		return this.signingKey.current();
 	}
 	signToken(payload) {
 		const configured = this.readConfiguredExpiry();
@@ -6610,17 +6612,23 @@ var ScopedTokenManager = class {
 //#endregion
 //#region src/auth/user-manager.ts
 var USERS_COLLECTION$1 = "users";
+/**
+* The account a fresh hub seeds on its first boot (D797). Not configurable —
+* no env variable, no config.yaml key: the first sign-in with this password
+* forces a change (admin-ui `mustChangePassword`), and an existing user is
+* never overwritten (D728).
+*/
+var FIRST_BOOT_ADMIN_USERNAME = "admin";
+var FIRST_BOOT_ADMIN_PASSWORD = "changeme";
 function parseUser(data) {
 	return parseRecord("user", UserRecordSchema, data);
 }
 var UserManager = class {
 	storageAccess;
 	auth;
-	config;
-	constructor(storageAccess, auth, config) {
+	constructor(storageAccess, auth) {
 		this.storageAccess = storageAccess;
 		this.auth = auth;
-		this.config = config;
 	}
 	get store() {
 		return this.storageAccess.getStore();
@@ -6710,53 +6718,50 @@ var UserManager = class {
 		});
 	}
 	/**
-	* Seed the configured admin (`auth.adminUsername` / `auth.adminPassword`,
-	* i.e. `CAMSTACK_ADMIN_USER` / `CAMSTACK_ADMIN_PASS`) — on FIRST boot only.
+	* Seed {@link FIRST_BOOT_ADMIN_USERNAME} / {@link FIRST_BOOT_ADMIN_PASSWORD}
+	* — on FIRST boot only, i.e. when no admin account exists.
 	*
-	* The configured password is a seed, never an authority. Once any admin
-	* exists, this never writes a password: the operator's own change in the
-	* admin UI is the truth from then on. This method used to compare the stored
-	* hash with the configured password on every boot and rewrite it when they
-	* differed, so a password changed in the UI went back to the configured one
-	* (`changeme` on a Mac hub and on any container without `CAMSTACK_ADMIN_PASS`)
-	* at the next restart.
+	* The seed is never an authority. Once any admin exists, this never writes a
+	* password: the operator's own change in the admin UI is the truth from then
+	* on (D728). This method once compared the stored hash with a configured
+	* password on every boot and rewrote it when they differed, so a password
+	* changed in the UI went back at the next restart.
 	*
 	* `resetPassword: true` is the one explicit exception — the operator's
-	* one-shot recovery request (see `admin-password-reset.ts`): the configured
-	* admin's password is set back to the configured one.
+	* one-shot recovery request (`RESET_ADMIN_PASSWORD`, see
+	* `admin-account-boot.ts`): the `admin` user's password goes back to
+	* `changeme`, and the next sign-in forces a change again.
 	*/
 	async ensureAdminExists(options = {}) {
-		const adminUsername = this.config.get("auth.adminUsername");
-		const adminPassword = this.config.get("auth.adminPassword");
-		if (!adminUsername || !adminPassword) return { kind: "not-configured" };
-		const existing = await this.findByUsername(adminUsername);
+		const username = FIRST_BOOT_ADMIN_USERNAME;
+		const existing = await this.findByUsername(username);
 		if (existing) {
 			if (options.resetPassword === true) {
-				await this.resetPassword(existing.id, adminPassword);
+				await this.resetPassword(existing.id, FIRST_BOOT_ADMIN_PASSWORD);
 				return {
 					kind: "reset",
-					username: adminUsername
+					username
 				};
 			}
 			return {
 				kind: "exists",
-				username: adminUsername
+				username
 			};
 		}
 		if ((await this.listAll()).some((u) => u.isAdmin)) return {
 			kind: "other-admin-exists",
-			username: adminUsername
+			username
 		};
 		await this.create({
-			username: adminUsername,
-			password: adminPassword,
+			username,
+			password: FIRST_BOOT_ADMIN_PASSWORD,
 			isAdmin: true,
 			allowedProviders: "*",
 			allowedDevices: {}
 		});
 		return {
 			kind: "seeded",
-			username: adminUsername
+			username
 		};
 	}
 	/**
@@ -6769,6 +6774,65 @@ var UserManager = class {
 		return this.auth.comparePassword(password, user.passwordHash);
 	}
 };
+var JwtSigningKeyKeeper = class {
+	deps;
+	retryTimer = null;
+	unsubscribe = null;
+	stopped = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async start() {
+		const secrets = this.deps.secrets;
+		if (secrets === null) {
+			this.apply({
+				state: "unavailable",
+				reason: "no keychain door in this process"
+			});
+			return;
+		}
+		this.unsubscribe = secrets.onChange((ref) => {
+			if (ref === JWT_SIGNING_KEY_REF) this.load(secrets);
+		});
+		await this.load(secrets);
+	}
+	stop() {
+		this.stopped = true;
+		if (this.retryTimer !== null) clearTimeout(this.retryTimer);
+		this.retryTimer = null;
+		this.unsubscribe?.();
+		this.unsubscribe = null;
+	}
+	async load(secrets) {
+		if (this.stopped) return;
+		const next = await loadJwtSigningKey({ secrets });
+		if (this.stopped) return;
+		this.apply(next);
+		if (next.state === "unavailable" && getProcessJwtSigningKeyState().state !== "ready") this.scheduleRetry(secrets);
+	}
+	apply(next) {
+		const previous = getProcessJwtSigningKeyState();
+		if (next.state === "ready") {
+			if (previous.state !== "ready") this.deps.logger.info("Session signing key loaded from the keychain");
+			setProcessJwtSigningKey(next);
+			return;
+		}
+		if (previous.state === "ready") return;
+		setProcessJwtSigningKey(next);
+		this.deps.logger.error("Sessions are UNAVAILABLE: the session signing key cannot be read from the keychain. No one can sign in and no session token verifies until the keychain unlocks (System → Secrets; or fix keychain.keyFile in config.yaml and restart). No fallback key is used.", { meta: {
+			reason: next.reason,
+			ref: JWT_SIGNING_KEY_REF
+		} });
+	}
+	scheduleRetry(secrets) {
+		if (this.stopped || this.retryTimer !== null) return;
+		this.retryTimer = setTimeout(() => {
+			this.retryTimer = null;
+			this.load(secrets);
+		}, this.deps.retryMs ?? 3e4);
+		this.retryTimer.unref?.();
+	}
+};
 //#endregion
 //#region src/builtins/local-auth/auth-schema.ts
 /**
@@ -9558,153 +9622,6 @@ var TotpManager = class {
 	}
 };
 //#endregion
-//#region src/kernel/config-schema.ts
-/** Default data directory — used when CAMSTACK_DATA env var is not set */
-var DEFAULT_DATA_PATH = "camstack-data";
-/**
-* A list of browser origins from config.yaml (a YAML list) or from the
-* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
-* only strings). Validation of each entry is the CORS policy's job
-* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
-* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
-*/
-var originListSchema = z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, z.array(z.string()));
-var serverSchema = z.object({
-	port: z.number().default(4443),
-	host: z.string().default("0.0.0.0"),
-	dataPath: z.string().default(DEFAULT_DATA_PATH),
-	/**
-	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
-	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
-	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
-	* who may read hub responses in a browser is a security decision, and the
-	* policy is live from the first request, before the settings store exists.
-	*/
-	corsOrigins: originListSchema.default([])
-});
-var authSchema = z.object({
-	jwtSecret: z.string().nullable().default(null),
-	adminUsername: z.string().default("admin"),
-	adminPassword: z.string().default("changeme")
-});
-var hubSchema = z.object({
-	url: z.string().default("ws://localhost:4443/agent"),
-	token: z.string().default("")
-});
-var agentSchema = z.object({
-	name: z.string().default(""),
-	/** Port for the agent status page (minimal HTML) */
-	statusPort: z.number().default(4444)
-});
-var tlsSchema = z.object({ 
-/**
-* Enable HTTPS (default: true). The certificate itself is never configured
-* here: the admin UI (Network → Local access) generates or uploads it
-* (D726), and boot serves whatever `tls/mode` says.
-*/
-enabled: z.boolean().default(true) });
-/**
-* Bootstrap-time addon configuration — read PURELY from YAML, before the
-* kernel can talk to the settings-store. This breaks the chicken-and-egg
-* where the settings store itself is implemented by an addon: the kernel
-* needs to know WHICH addon to load first to provide the store, and that
-* decision can't itself live in the store.
-*
-* Backward-compatible: every field is optional + defaults reproduce the
-* current hard-coded behavior. Existing config.yaml files keep working.
-*/
-var bootstrapAddonsSchema = z.object({
-	/**
-	* Addon implementing the `settings-store` capability. Loaded FIRST,
-	* before any other addon is enabled — every other addon's enable
-	* state, settings, and ordering lives in the store it provides.
-	*
-	* Default: '@camstack/addon-sqlite-storage' (the workspace's
-	* default SQLite-backed store). Future alternatives could swap this
-	* for postgres/redis without touching kernel code.
-	*/
-	settingsStoreAddon: z.string().default("@camstack/addon-sqlite-storage"),
-	/**
-	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
-	* on startup.
-	*
-	*   - `'npm'`     — pull from the npm registry (production default).
-	*   - `'local'`   — copy `packages/<X>/` from the workspace into
-	*                   `data/addons/<X>/`. Use for the Electron-
-	*                   packaged bundle and the e2e harness.
-	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
-	*                   dir via a directory symlink. Dev-only: a
-	*                   workspace rebuild (`npm run build -w <X>`) is
-	*                   immediately reflected at the next addon load,
-	*                   no copy step. Falls back to `'local'` on
-	*                   platforms that reject symlink creation (Windows
-	*                   without developer-mode).
-	*
-	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
-	* field. Leave undefined to keep the launcher's default behaviour
-	* (npm when no workspace, local when a bundled addons dir is
-	* present, …).
-	*/
-	installSource: z.enum([
-		"npm",
-		"local",
-		"symlink"
-	]).optional(),
-	/**
-	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
-	* Passing an array here REPLACES the default list entirely — useful
-	* for stripped-down deployments (only the bundle of addons the
-	* operator actually wants) and for forcing a different storage
-	* backend at first boot.
-	*
-	* Leave undefined to use the kernel-shipped defaults.
-	*/
-	requiredAddons: z.array(z.string()).optional(),
-	/**
-	* Disable list applied AFTER the settings-store reports the enabled
-	* set. Operator escape hatch — boot without a known-broken addon
-	* without having to mutate the store.
-	*/
-	forceDisable: z.array(z.string()).default([])
-});
-/**
-* Where the keychain's master key lives (D788). config.yaml ONLY: no env var
-* maps here, and the settings store may not answer it
-* (`BOOTSTRAP_OWNED_SECTIONS`). Absent → the desktop OS keychain when the hub
-* runs inside the desktop app, else `<dataDir>/.keychain/master.key`.
-*/
-var keychainSchema = z.object({
-	/** A file holding 32 random bytes, base64 (or hex). Keep it OFF the data volume. */
-	keyFile: z.string().min(1).optional(),
-	/**
-	* The key being rotated away from — consulted only to UNLOCK, so a move to a
-	* new key file is: new file, old one here, restart, rotate, remove this.
-	*/
-	previousKeyFile: z.string().min(1).optional()
-});
-/** Bootstrap config -- loaded from config.yaml ONLY at startup.
-*  All other settings live in SQL (system_settings table). */
-var bootstrapSchema = z.object({
-	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
-	mode: z.enum(["hub", "agent"]).default("hub"),
-	server: serverSchema.default(serverSchema.parse({})),
-	auth: authSchema.default(authSchema.parse({})),
-	/** Hub connection config — only used when mode='agent' */
-	hub: hubSchema.default(hubSchema.parse({})),
-	/** Agent-specific config — only used when mode='agent' */
-	agent: agentSchema.default(agentSchema.parse({})),
-	/** TLS configuration */
-	tls: tlsSchema.default(tlsSchema.parse({})),
-	/**
-	* Addon bootstrap directives — minimum addon set needed before the
-	* kernel can reach the settings-store. See bootstrapAddonsSchema.
-	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
-	*/
-	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({})),
-	/** Keychain master-key location (config.yaml only). */
-	keychain: keychainSchema.default({})
-});
-//#endregion
 //#region src/builtins/local-auth/admin-account-boot.ts
 /**
 * The admin account at boot: seed it once, reset it only on the operator's
@@ -9712,16 +9629,16 @@ var bootstrapSchema = z.object({
 *
 * ## Why a trigger FILE, not a variable
 *
-* The configured password (`CAMSTACK_ADMIN_PASS` / `auth.adminPassword`) seeds
-* the admin on first boot and is never applied again — a password the operator
-* changes in the admin UI survives every restart. Recovering a forgotten
+* A fresh hub seeds `admin` / `changeme` on its first boot (D797) and never
+* applies it again — a password the operator changes in the admin UI survives
+* every restart. Recovering a forgotten
 * password therefore needs an explicit request, and that request must be
 * ONE-SHOT: an environment flag stays set in a container template until someone
 * remembers to remove it, and while it is set it reverts the password on every
 * boot — the very defect this replaced. A file the hub DELETES after acting on
 * it cannot be left armed: create `RESET_ADMIN_PASSWORD` in the node's data
-* directory (`/data` in the container), restart, and the configured admin's
-* password is set back to the configured one, once.
+* directory (`/data` in the container), restart, and the `admin` user's
+* password is set back to `changeme`, once — the next sign-in forces a change.
 */
 /** The trigger's name, at the root of the node's data directory. */
 var ADMIN_PASSWORD_RESET_TRIGGER = "RESET_ADMIN_PASSWORD";
@@ -9743,23 +9660,20 @@ async function reconcileAdminAccountAtBoot(input) {
 function logOutcome(outcome, logger) {
 	switch (outcome.kind) {
 		case "seeded":
-			logger.info("Admin account seeded from the configured credentials (first boot)", { meta: { username: outcome.username } });
+			logger.info("Admin account seeded (first boot) — sign in as admin / changeme and set a password", { meta: { username: outcome.username } });
 			return;
 		case "reset":
-			logger.warn("Admin password reset to the configured password, as requested", { meta: { username: outcome.username } });
+			logger.warn("Admin password reset to the first-boot password, as requested", { meta: { username: outcome.username } });
 			return;
 		case "other-admin-exists":
-			logger.info("Configured admin username not seeded: another admin account already exists", { meta: { username: outcome.username } });
-			return;
-		case "not-configured":
-			logger.warn("No admin username/password configured — no admin account seeded");
+			logger.info("First-boot admin not seeded: another admin account already exists", { meta: { username: outcome.username } });
 			return;
 		case "exists": return;
 	}
 }
 /** Delete the trigger after acting on it — a reset must never repeat by itself. */
 function consumeTrigger(triggerPath, outcome, input) {
-	if (outcome.kind !== "reset") input.logger.warn("Admin password reset requested, but no configured admin account to reset", { meta: {
+	if (outcome.kind !== "reset") input.logger.warn("Admin password reset requested, but there is no `admin` user to reset", { meta: {
 		trigger: triggerPath,
 		outcome: outcome.kind
 	} });
@@ -9778,28 +9692,22 @@ function consumeTrigger(triggerPath, outcome, input) {
 * Every config path this reader can answer. Anything else resolves to
 * `undefined` by construction — see the module docblock.
 */
-function createAuthConfigReader(resolved, writeAuthSection) {
+function createAuthConfigReader(resolved) {
 	return {
 		get(path) {
 			switch (path) {
-				case "auth.jwtSecret": return narrow(resolved.jwtSecret);
-				case "auth.adminUsername": return narrow(resolved.adminUsername);
-				case "auth.adminPassword": return narrow(resolved.adminPassword);
 				case "auth.tokenExpiry": return narrow(resolved.tokenExpiry);
 				default: return;
 			}
 		},
-		update(_section, data) {
-			if (typeof data["jwtSecret"] === "string") writeAuthSection({ jwtSecret: data["jwtSecret"] });
-		}
+		update() {}
 	};
 }
 /**
 * The one documented type boundary in this module. `AuthConfigReader.get` is
 * the legacy `get<T>(path)` shape shared with `ConfigManager.get`, which is
 * likewise unchecked at runtime — every value returned here is a `string |
-* undefined` the caller immediately re-validates (`parseTokenExpiry`, the
-* truthiness gate on `jwtSecret`).
+* undefined` the caller immediately re-validates (`parseTokenExpiry`).
 */
 function narrow(value) {
 	return value;
@@ -10159,23 +10067,19 @@ var LocalAuthAddon = class extends BaseAddon {
 	reapTimer = null;
 	totpManager = null;
 	externalIdentities = null;
+	signingKeyKeeper = null;
 	constructor() {
-		super({
-			jwtSecret: "",
-			adminUsername: "",
-			adminPassword: ""
-		});
+		super({});
 	}
 	async onInitialize() {
-		const authSection = await this.ctx.settings?.getSection("auth") ?? {};
-		const reader = createAuthConfigReader({
-			jwtSecret: typeof authSection["jwtSecret"] === "string" ? authSection["jwtSecret"] : this.config.jwtSecret ?? "",
-			adminUsername: typeof authSection["adminUsername"] === "string" && authSection["adminUsername"] ? authSection["adminUsername"] : this.config.adminUsername ?? "",
-			adminPassword: typeof authSection["adminPassword"] === "string" && authSection["adminPassword"] ? authSection["adminPassword"] : this.config.adminPassword ?? "",
-			tokenExpiry: typeof authSection["tokenExpiry"] === "string" && authSection["tokenExpiry"] ? authSection["tokenExpiry"] : void 0
-		}, (patch) => {
-			this.ctx.settings?.setSection("auth", patch);
+		const forOwner = this.ctx.secrets?.forOwner ?? null;
+		this.signingKeyKeeper = new JwtSigningKeyKeeper({
+			secrets: forOwner === null ? null : forOwner("system"),
+			logger: this.ctx.logger
 		});
+		await this.signingKeyKeeper.start();
+		const authSection = await this.ctx.settings?.getSection("auth") ?? {};
+		const reader = createAuthConfigReader({ tokenExpiry: typeof authSection["tokenExpiry"] === "string" && authSection["tokenExpiry"] ? authSection["tokenExpiry"] : void 0 });
 		this.authManager = new AuthManager(reader, this.ctx.logger);
 		const store = this.ctx.api?.settingsStore;
 		if (store) {
@@ -10183,7 +10087,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			const storageAccess = { getStore() {
 				return store;
 			} };
-			this.userManager = new UserManager(storageAccess, this.authManager, reader);
+			this.userManager = new UserManager(storageAccess, this.authManager);
 			this.apiKeyManager = new ApiKeyManager(storageAccess, this.authManager);
 			this.scopedTokenManager = new ScopedTokenManager(store);
 			this.oauthSessionManager = new OauthSessionManager(store);
@@ -10461,6 +10365,8 @@ var LocalAuthAddon = class extends BaseAddon {
 		}
 	}
 	async onShutdown() {
+		this.signingKeyKeeper?.stop();
+		this.signingKeyKeeper = null;
 		if (this.reapTimer !== null) {
 			clearInterval(this.reapTimer);
 			this.reapTimer = null;
@@ -10474,4 +10380,4 @@ var LocalAuthAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { LocalAuthAddon, LocalAuthAddon as default, AuthManager as a, require_ms as c, ScopedTokenManager as i, require_safe_buffer as l, bootstrapSchema as n, SettingsReadUnavailableError as o, UserManager as r, isSettingsReadUnavailable as s, DEFAULT_DATA_PATH as t, ApiKeyManager as u };
+export { LocalAuthAddon, LocalAuthAddon as default, AuthManager as a, require_ms as c, ScopedTokenManager as i, require_safe_buffer as l, FIRST_BOOT_ADMIN_USERNAME as n, SettingsReadUnavailableError as o, UserManager as r, isSettingsReadUnavailable as s, FIRST_BOOT_ADMIN_PASSWORD as t, ApiKeyManager as u };

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_tls = require("../../tls-CCMX7MjX.js");
 let zod = require("zod");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Cn as resolveHubAddressRoles, En as resolveNotificationTapAddress, Gr as EventCategory, Hn as validateCustomAddress, It as isAppLinkBase, Yt as localNetworkCapability, fn as pickAppLinkHub, lr as BaseAddon, nt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, yn as resolveAppConnections, zt as isDefaultAppConnectionEndpoint } from "../../dist-BWNoS-1S.mjs";
+import { Cn as resolveHubAddressRoles, En as resolveNotificationTapAddress, Hn as validateCustomAddress, It as isAppLinkBase, Yt as localNetworkCapability, fn as pickAppLinkHub, lr as BaseAddon, nt as checkRoleAddress, qr as EventCategory, s as CAMSTACK_APP_LINK_ORIGIN, yn as resolveAppConnections, zt as isDefaultAppConnectionEndpoint } from "../../dist-B9oFw2jh.mjs";
 import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-CJHogwTl.mjs";
 import { z } from "zod";
 import * as os from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Gr as EventCategory, Mt as foldSnapshotByFunction, Sr as createEvent, _n as reducePoints, bn as resolveBucketMs, cr as errMsg, in as metricsProviderCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
+import { Cr as createEvent, Mt as foldSnapshotByFunction, _n as reducePoints, bn as resolveBucketMs, cr as errMsg, in as metricsProviderCapability, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { An as scoreRuntimes, Ct as enumerateInferenceDevices, Gr as EventCategory, cr as errMsg, lr as BaseAddon, mn as platformProbeCapability, wr as emitReadiness } from "../../dist-BWNoS-1S.mjs";
+import { An as scoreRuntimes, Ct as enumerateInferenceDevices, Tr as emitReadiness, cr as errMsg, lr as BaseAddon, mn as platformProbeCapability, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gr as EventCategory, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
+import { lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Gr as EventCategory, Nn as snapshotCapability, X as bareAddonId, Z as batteryCapability, _t as deriveBatteryPresence, a as BatteryStatusSchema, ar as DeviceFeature, cr as errMsg, jr as nodePin, lr as BaseAddon, rn as memoizePinnedFfmpeg, sr as DeviceType, zn as streamQualityLabel } from "../../dist-BWNoS-1S.mjs";
+import { Mr as nodePin, Nn as snapshotCapability, X as bareAddonId, Z as batteryCapability, _t as deriveBatteryPresence, a as BatteryStatusSchema, ar as DeviceFeature, cr as errMsg, lr as BaseAddon, qr as EventCategory, rn as memoizePinnedFfmpeg, sr as DeviceType, zn as streamQualityLabel } from "../../dist-B9oFw2jh.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Ln as storageProviderCapability, jt as filesystemBrowseCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
+import { Ln as storageProviderCapability, jt as filesystemBrowseCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_hub_cap_forward = require("../../hub-cap-forward-COCmYaup.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");