@camstack/system 1.2.422 → 1.2.424

package/dist/{dist-FSNJUw7p.js → dist-CiUKtVkX.js}

@@ -15133,8 +15133,23 @@ var BulkRecordSchema = zod.z.object({
 	data: zod.z.record(zod.z.string(), zod.z.unknown())
 });
 /**
+* The database FILES one `sqlite-settings` engine process owns (D851).
+* Closed on purpose: a file is a thing the engine opens, backs up and gives a
+* serving thread, so a new one is a code change, never a string a caller
+* invents. `settings` is `camstack.db` and the default for every collection
+* that names no file.
+*/
+var DataStoreDatabaseSchema = zod.z.enum([
+	"settings",
+	"events",
+	"history"
+]);
+/** Every database file, in a stable order (settings first). */
+var DATA_STORE_DATABASES = DataStoreDatabaseSchema.options;
+/**
 * One write inside a {@link settingsStoreCapability.methods.transact} call.
-* Only the three that a "replace this set, bump that revision" write needs.
+* The three that a "replace this set, bump that revision" write needs, plus
+* the batched upsert a rollup writer needs.
 */
 var TransactOpSchema = zod.z.discriminatedUnion("op", [
 	zod.z.object({
@@ -15152,6 +15167,12 @@ var TransactOpSchema = zod.z.discriminatedUnion("op", [
 		collection: zod.z.string(),
 		id: zod.z.string(),
 		data: zod.z.record(zod.z.string(), zod.z.unknown())
+	}),
+	zod.z.object({
+		op: zod.z.literal("upsertMany"),
+		collection: zod.z.string(),
+		conflict: zod.z.array(zod.z.string()).readonly(),
+		records: zod.z.array(BulkRecordSchema).readonly()
 	})
 ]);
 /**
@@ -15203,6 +15224,30 @@ var CollectionIndexSchema = zod.z.object({
 	unique: zod.z.boolean().optional()
 });
 /**
+* The input of `declareCollection` — ONE schema for the door and for the
+* engine behind it, so the two surfaces cannot drift (the dispatcher forwards
+* the payload untouched).
+*
+* - `database` — the file the collection lives in (D851). Absent means
+*   `settings`. A declaration naming a file other than the one the table is
+*   already in is REFUSED by the engine, never moved.
+* - `primaryKey` — a COMPOSITE key, as column names. A single name is the same
+*   as `primaryKey: true` on that column. A composite-keyed collection has no
+*   `id`: it is written with `insertMany` / `upsertMany` / `transact` and read
+*   with `query` / `count` / `aggregate` / `deleteWhere`; the calls that
+*   address one row by id are refused.
+* - `withoutRowid` — emit `WITHOUT ROWID`. Requires a primary key.
+*/
+var DeclareCollectionInputSchema = zod.z.object({
+	namespace: zod.z.string().optional(),
+	collection: zod.z.string(),
+	columns: zod.z.array(CollectionColumnSchema).readonly(),
+	indexes: zod.z.array(CollectionIndexSchema).readonly().optional(),
+	database: DataStoreDatabaseSchema.optional(),
+	primaryKey: zod.z.array(zod.z.string()).readonly().optional(),
+	withoutRowid: zod.z.boolean().optional()
+});
+/**
 * settings-store — singleton capability for addon-scoped persistence.
 *
 * Every method operates within a `collection`. An optional `namespace`
@@ -15340,6 +15385,29 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* {@link upsert} for a BATCH, in ONE transaction on ONE prepared statement.
+		*
+		* The write-side twin of {@link insertMany} for rows that may already
+		* exist: a rollup writer recomputes a bucket and must overwrite it, and
+		* N round trips with N COMMITs is the cost {@link insertMany} was added to
+		* avoid. `conflict` has the meaning it has on {@link upsert} (declared
+		* columns covered by a UNIQUE index or the primary key, never empty).
+		*
+		* Every record of a batch must carry the SAME set of declared columns and
+		* every `conflict` column: one batch is one statement shape, and a record
+		* that silently bound NULL over a column it did not mention would erase
+		* it. A heterogeneous batch is refused whole. **All or nothing.**
+		*/
+		upsertMany: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			conflict: zod.z.array(zod.z.string()).readonly(),
+			records: zod.z.array(BulkRecordSchema).readonly()
+		}), zod.z.object({ upserted: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Insert a new record. */
 		insert: method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -15538,12 +15606,7 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 		* `pipeline-analytics:object-events`) to avoid cross-addon
 		* clashes — no automatic prefix is added.
 		*/
-		declareCollection: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			columns: zod.z.array(CollectionColumnSchema).readonly(),
-			indexes: zod.z.array(CollectionIndexSchema).readonly().optional()
-		}), zod.z.void(), {
+		declareCollection: method(DeclareCollectionInputSchema, zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		})
@@ -15694,6 +15757,16 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/** Upsert many records in ONE transaction; see the door's `upsertMany`. */
+		upsertMany: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			conflict: zod.z.array(zod.z.string()).readonly(),
+			records: zod.z.array(BulkRecordSchema).readonly()
+		}), zod.z.object({ upserted: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Insert many records in ONE transaction. All or nothing. */
 		insertMany: method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -15786,12 +15859,7 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 			collection: zod.z.string()
 		}), zod.z.boolean(), { auth: "admin" }),
 		/** Declare a typed (SQL-backed) collection with columns + indexes. */
-		declareCollection: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			columns: zod.z.array(CollectionColumnSchema).readonly(),
-			indexes: zod.z.array(CollectionIndexSchema).readonly().optional()
-		}), zod.z.void(), {
+		declareCollection: method(DeclareCollectionInputSchema, zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		})
@@ -26434,6 +26502,9 @@ var RetrainBoxReviewSchema = zod.z.object({
 	/** The baseline was re-derived, not snapshotted (a pre-origin row). */
 	approximate: zod.z.boolean(),
 	origin: RetrainOriginSchema.optional(),
+	/** The class / label the box carries NOW (a removed box: its origin's). Absent on an older hub. */
+	macroClass: RetrainMacroClassSchema.optional(),
+	label: zod.z.string().optional(),
 	iou: zod.z.number().optional()
 });
 var RetrainFrameReviewSchema = zod.z.object({
@@ -53095,6 +53166,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.upsertMany": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dayNight.getOptions": {
 		capName: "day-night",
 		capScope: "device",
@@ -57943,6 +58020,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.upsertMany": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"smoke.getStatus": {
 		capName: "smoke",
 		capScope: "device",
@@ -65565,6 +65648,12 @@ Object.defineProperty(exports, "DATAPLANE_SECRET_HEADER", {
 		return DATAPLANE_SECRET_HEADER;
 	}
 });
+Object.defineProperty(exports, "DATA_STORE_DATABASES", {
+	enumerable: true,
+	get: function() {
+		return DATA_STORE_DATABASES;
+	}
+});
 Object.defineProperty(exports, "DAY_NAMES", {
 	enumerable: true,
 	get: function() {

package/dist/file-host-worker.js

@@ -0,0 +1,144 @@
+require("./chunk-Cek0wNdY.js");
+const require_wal_maintenance = require("./wal-maintenance-BzdCQGjH.js");
+let node_worker_threads = require("node:worker_threads");
+//#region src/builtins/sqlite-storage/file-host-worker.ts
+/**
+* The thread that serves ONE database file of the engine (D851): its own
+* `better-sqlite3` connection hosting the same {@link SqliteSettingsBackend}
+* class `camstack.db` runs on the main thread, plus — for `events` — the
+* sqlite-vec index over that connection.
+*
+* A worker entry is a separate bundle (`dist/file-host-worker.js`, wired in
+* `vite.config.ts` next to the checkpoint and snapshot workers). It imports no
+* kernel code: the backend, the protocol and `@camstack/types`, nothing else.
+*
+* What it does NOT own: the WAL checkpoint, the `-shm` canary and the snapshot
+* of this file run in their own threads, started by the main thread's
+* `OwnedSqliteFile` exactly as for `camstack.db`. What it DOES own and the main
+* thread cannot reach: the connection itself — so the statement profiler and
+* the idle-gated `wal_checkpoint(TRUNCATE)` / `incremental_vacuum` live here.
+*
+* Logging: this thread has no logger of its own. Every line is posted to the
+* main thread, which writes it through the runner's `Db/<databaseId>` logger
+* with `tags: { database }`.
+*/
+/** Pages handed back per idle tick on a file in incremental auto-vacuum mode. */
+var INCREMENTAL_VACUUM_PAGES = 256;
+/** A logger whose every line is a message to the main thread. */
+function forwardingLogger(post, scope, bound) {
+	const send = (level) => (message, extras) => {
+		post({
+			kind: "log",
+			level,
+			message,
+			scope,
+			tags: {
+				...bound,
+				...extras?.tags
+			},
+			...extras?.meta !== void 0 ? { meta: extras.meta } : {}
+		});
+	};
+	return {
+		debug: send("debug"),
+		info: send("info"),
+		warn: send("warn"),
+		error: send("error"),
+		child: (childScope) => forwardingLogger(post, childScope, bound),
+		withTags: (tags) => forwardingLogger(post, scope, {
+			...bound,
+			...tags
+		})
+	};
+}
+async function main() {
+	const port = node_worker_threads.parentPort;
+	if (port === null) throw new Error("file-host-worker: no parent port");
+	if (!require_wal_maintenance.isFileHostWorkerData(node_worker_threads.workerData)) throw new Error("file-host-worker: bad workerData");
+	const spec = node_worker_threads.workerData.spec;
+	const post = (message, transfer = []) => port.postMessage(message, [...transfer]);
+	const logger = forwardingLogger(post, "", { database: spec.databaseId });
+	let backend;
+	let vectorIndex = null;
+	let maintenance = null;
+	try {
+		backend = new require_wal_maintenance.SqliteSettingsBackend(spec.livePath, {}, logger.child("Query"), {
+			databaseId: spec.databaseId,
+			autoVacuum: spec.autoVacuum,
+			canonicalKv: false
+		});
+		await backend.initialize();
+		if (spec.loadVectorExtension) {
+			vectorIndex = require_wal_maintenance.createVectorIndex(backend, logger.child("VectorIndex"));
+			await vectorIndex.loadIndexRegistry();
+		}
+		const db = backend.getDatabase();
+		if (db !== null) {
+			maintenance = new require_wal_maintenance.WalMaintenance({
+				db,
+				dbPath: spec.livePath,
+				logger: logger.child("WalMaintenance"),
+				incrementalVacuumPages: INCREMENTAL_VACUUM_PAGES
+			});
+			maintenance.start();
+		}
+	} catch (err) {
+		post({
+			kind: "boot-failed",
+			error: require_wal_maintenance.serializeError(err)
+		});
+		return;
+	}
+	const dataTarget = backend;
+	const vectorTarget = vectorIndex === null ? null : require_wal_maintenance.vectorProviderOf(vectorIndex);
+	const control = require_wal_maintenance.controlTargetOf(backend, node_worker_threads.threadId);
+	const answer = (id, result, transfer = false) => post({
+		kind: "result",
+		id,
+		ok: true,
+		result
+	}, transfer ? require_wal_maintenance.collectTransferables(result) : []);
+	const refuse = (id, err) => {
+		post({
+			kind: "result",
+			id,
+			ok: false,
+			error: require_wal_maintenance.serializeError(err)
+		});
+	};
+	const serve = async (request) => {
+		try {
+			if (request.kind === "stop") {
+				maintenance?.stop();
+				await backend.shutdown();
+				answer(request.id, void 0);
+				port.close();
+				return;
+			}
+			if (request.kind === "data") {
+				answer(request.id, await require_wal_maintenance.callData(dataTarget, request.op, require_wal_maintenance.trustInput(request.input)));
+				return;
+			}
+			if (request.kind === "vector") {
+				if (vectorTarget === null) throw new Error(`database "${spec.databaseId}" does not serve vector calls`);
+				answer(request.id, await require_wal_maintenance.callVector(vectorTarget, request.op, require_wal_maintenance.trustInput(request.input)), true);
+				return;
+			}
+			answer(request.id, require_wal_maintenance.callControl(control, request.op, require_wal_maintenance.trustInput(request.input)));
+		} catch (err) {
+			refuse(request.id, err);
+		}
+	};
+	port.on("message", (message) => {
+		if (!require_wal_maintenance.isFileHostRequest(message)) return;
+		serve(message);
+	});
+	post({
+		kind: "ready",
+		declared: [...backend.declaredCollectionNames()]
+	});
+}
+main().catch((err) => {
+	throw err;
+});
+//#endregion

package/dist/file-host-worker.mjs

@@ -0,0 +1,144 @@
+import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-BlqNqaQ3.mjs";
+import { parentPort, threadId, workerData } from "node:worker_threads";
+//#region src/builtins/sqlite-storage/file-host-worker.ts
+/**
+* The thread that serves ONE database file of the engine (D851): its own
+* `better-sqlite3` connection hosting the same {@link SqliteSettingsBackend}
+* class `camstack.db` runs on the main thread, plus — for `events` — the
+* sqlite-vec index over that connection.
+*
+* A worker entry is a separate bundle (`dist/file-host-worker.js`, wired in
+* `vite.config.ts` next to the checkpoint and snapshot workers). It imports no
+* kernel code: the backend, the protocol and `@camstack/types`, nothing else.
+*
+* What it does NOT own: the WAL checkpoint, the `-shm` canary and the snapshot
+* of this file run in their own threads, started by the main thread's
+* `OwnedSqliteFile` exactly as for `camstack.db`. What it DOES own and the main
+* thread cannot reach: the connection itself — so the statement profiler and
+* the idle-gated `wal_checkpoint(TRUNCATE)` / `incremental_vacuum` live here.
+*
+* Logging: this thread has no logger of its own. Every line is posted to the
+* main thread, which writes it through the runner's `Db/<databaseId>` logger
+* with `tags: { database }`.
+*/
+/** Pages handed back per idle tick on a file in incremental auto-vacuum mode. */
+var INCREMENTAL_VACUUM_PAGES = 256;
+/** A logger whose every line is a message to the main thread. */
+function forwardingLogger(post, scope, bound) {
+	const send = (level) => (message, extras) => {
+		post({
+			kind: "log",
+			level,
+			message,
+			scope,
+			tags: {
+				...bound,
+				...extras?.tags
+			},
+			...extras?.meta !== void 0 ? { meta: extras.meta } : {}
+		});
+	};
+	return {
+		debug: send("debug"),
+		info: send("info"),
+		warn: send("warn"),
+		error: send("error"),
+		child: (childScope) => forwardingLogger(post, childScope, bound),
+		withTags: (tags) => forwardingLogger(post, scope, {
+			...bound,
+			...tags
+		})
+	};
+}
+async function main() {
+	const port = parentPort;
+	if (port === null) throw new Error("file-host-worker: no parent port");
+	if (!isFileHostWorkerData(workerData)) throw new Error("file-host-worker: bad workerData");
+	const spec = workerData.spec;
+	const post = (message, transfer = []) => port.postMessage(message, [...transfer]);
+	const logger = forwardingLogger(post, "", { database: spec.databaseId });
+	let backend;
+	let vectorIndex = null;
+	let maintenance = null;
+	try {
+		backend = new SqliteSettingsBackend(spec.livePath, {}, logger.child("Query"), {
+			databaseId: spec.databaseId,
+			autoVacuum: spec.autoVacuum,
+			canonicalKv: false
+		});
+		await backend.initialize();
+		if (spec.loadVectorExtension) {
+			vectorIndex = createVectorIndex(backend, logger.child("VectorIndex"));
+			await vectorIndex.loadIndexRegistry();
+		}
+		const db = backend.getDatabase();
+		if (db !== null) {
+			maintenance = new WalMaintenance({
+				db,
+				dbPath: spec.livePath,
+				logger: logger.child("WalMaintenance"),
+				incrementalVacuumPages: INCREMENTAL_VACUUM_PAGES
+			});
+			maintenance.start();
+		}
+	} catch (err) {
+		post({
+			kind: "boot-failed",
+			error: serializeError(err)
+		});
+		return;
+	}
+	const dataTarget = backend;
+	const vectorTarget = vectorIndex === null ? null : vectorProviderOf(vectorIndex);
+	const control = controlTargetOf(backend, threadId);
+	const answer = (id, result, transfer = false) => post({
+		kind: "result",
+		id,
+		ok: true,
+		result
+	}, transfer ? collectTransferables(result) : []);
+	const refuse = (id, err) => {
+		post({
+			kind: "result",
+			id,
+			ok: false,
+			error: serializeError(err)
+		});
+	};
+	const serve = async (request) => {
+		try {
+			if (request.kind === "stop") {
+				maintenance?.stop();
+				await backend.shutdown();
+				answer(request.id, void 0);
+				port.close();
+				return;
+			}
+			if (request.kind === "data") {
+				answer(request.id, await callData(dataTarget, request.op, trustInput(request.input)));
+				return;
+			}
+			if (request.kind === "vector") {
+				if (vectorTarget === null) throw new Error(`database "${spec.databaseId}" does not serve vector calls`);
+				answer(request.id, await callVector(vectorTarget, request.op, trustInput(request.input)), true);
+				return;
+			}
+			answer(request.id, callControl(control, request.op, trustInput(request.input)));
+		} catch (err) {
+			refuse(request.id, err);
+		}
+	};
+	port.on("message", (message) => {
+		if (!isFileHostRequest(message)) return;
+		serve(message);
+	});
+	post({
+		kind: "ready",
+		declared: [...backend.declaredCollectionNames()]
+	});
+}
+main().catch((err) => {
+	throw err;
+});
+//#endregion
+export {};

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-FSNJUw7p.js");
-const require_jwt_signing_key = require("./jwt-signing-key-CPha_bf7.js");
+const require_dist = require("./dist-CiUKtVkX.js");
+const require_jwt_signing_key = require("./jwt-signing-key-nwRpRgf_.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -22,11 +22,12 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
+const require_wal_maintenance = require("./wal-maintenance-BzdCQGjH.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-CY4vXTV-.js");
+const require_constants = require("./constants-BBWZlnpQ.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
@@ -34,7 +35,7 @@ const require_custom_action_registry = require("./custom-action-registry-Bf_Ynag
 const require_tls = require("./tls-BgImdxCO.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-BwGWspP1.js");
+const require_restore_archive = require("./restore-archive-DA-aJtg7.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -11472,7 +11473,7 @@ var PREFIX_PAGE_BUDGET = 512;
 *   be handed something that looks like a complete answer.
 */
 async function loadPrefixed(door, collection, prefix, decode = unwrapValue) {
-	const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(prefix);
+	const range = require_wal_maintenance.prefixRange(prefix);
 	const result = {};
 	let cursor = range?.lo ?? null;
 	for (let page = 0;; page++) {
@@ -11528,7 +11529,7 @@ async function loadSystemSettingsPrefix(door, prefix, mayRead = () => true) {
 	return result;
 }
 async function replacePrefixed(door, collection, prefix, values, wrap) {
-	const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(prefix);
+	const range = require_wal_maintenance.prefixRange(prefix);
 	if (range !== null) await door.deleteWhere({
 		collection,
 		filter: { whereBetween: { id: [range.lo, range.hi] } }
@@ -11609,7 +11610,7 @@ function createDoorSettingsView(addonId, door, sections) {
 			}));
 		},
 		async clearDeviceStore(deviceId) {
-			const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(`${addonId}:${String(deviceId)}.`);
+			const range = require_wal_maintenance.prefixRange(`${addonId}:${String(deviceId)}.`);
 			if (range === null) return;
 			await door.deleteWhere({
 				collection: "addon-device-settings",
@@ -27002,7 +27003,7 @@ exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.Scoped
 exports.SettingsReadUnavailableError = require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError;
 exports.SocketChannel = SocketChannel;
 exports.SqliteSettingsAddon = require_builtins_sqlite_storage_sqlite_settings_addon.SqliteSettingsAddon;
-exports.SqliteSettingsBackend = require_builtins_sqlite_storage_sqlite_settings_addon.SqliteSettingsBackend;
+exports.SqliteSettingsBackend = require_wal_maintenance.SqliteSettingsBackend;
 exports.StagingArea = StagingArea;
 exports.StorageLocationManager = StorageLocationManager;
 exports.StorageManager = StorageManager;

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { At as extractNestedAddonId, Bt as isObjectInput, Cn as resolveMethodAuth, Dn as scopesAllowDeviceCap, Dr as emitDownForOwnedCaps, En as scopesAllowAddon, G as addonSettingsCapability, Gr as resolveCapMount, Hr as parseJsonUnknown, Ht as kebabToCamel$1, It as isArrayOutputSchema, Lt as isCollectionArrayMethod, O as LOG_LEVEL_RANK, Qt as looseSchema, Rn as supportedRuntimes, Vr as parseJsonObject, Vt as isVoidInput, Wr as readinessKey, Zt as logLevelAtMost, br as asString$1, cn as objectInputDeclaresRequiredDeviceId, dr as DEVICE_STATUS_METHOD, ei as EventCategory$1, hr as ReadinessTimeoutError, j as METHOD_ACCESS_MAP, kr as expandCapMethods, lr as DATAPLANE_SECRET_HEADER$1, mr as ReadinessRegistry, pn as procedureAuthKey, pr as RUNTIME_DEFAULTS, qr as scopeKey, qt as lifecycleJobSchema, sn as objectInputDeclaresAddonId, sr as errMsg$1, t as ALL_CAPABILITY_DEFINITIONS, ur as DEVICE_SETTINGS_CONTRIBUTION_METHODS, vr as asJsonObject$1, wr as createEvent$1, yr as asNumber } from "./dist-CHsJCqrf.mjs";
-import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-DUVvfILp.mjs";
+import { $t as looseSchema, Ar as expandCapMethods, Dn as scopesAllowAddon, Gr as readinessKey, Hr as parseJsonObject, Ht as isVoidInput, Jr as scopeKey, Jt as lifecycleJobSchema, K as addonSettingsCapability, Kr as resolveCapMount, Lt as isArrayOutputSchema, M as METHOD_ACCESS_MAP, On as scopesAllowDeviceCap, Or as emitDownForOwnedCaps, Qt as logLevelAtMost, Rt as isCollectionArrayMethod, Tr as createEvent$1, Ur as parseJsonUnknown, Ut as kebabToCamel$1, Vt as isObjectInput, br as asNumber, cn as objectInputDeclaresAddonId, cr as errMsg$1, dr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, fr as DEVICE_STATUS_METHOD, gr as ReadinessTimeoutError, hr as ReadinessRegistry, jt as extractNestedAddonId, k as LOG_LEVEL_RANK, ln as objectInputDeclaresRequiredDeviceId, mn as procedureAuthKey, mr as RUNTIME_DEFAULTS, t as ALL_CAPABILITY_DEFINITIONS, ti as EventCategory$1, ur as DATAPLANE_SECRET_HEADER$1, wn as resolveMethodAuth, xr as asString$1, yr as asJsonObject$1, zn as supportedRuntimes } from "./dist-B-NmfvVC.mjs";
+import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-CUpweD22.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -21,11 +21,12 @@ import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { SqliteSettingsAddon, o as SqliteSettingsBackend, s as prefixRange } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
+import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-BlqNqaQ3.mjs";
+import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-iLQM7god.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-DHhhVjkt.mjs";
 import { A as AGENT_UI_UNLOCK_TTL_MS, B as isMeshAuthMode, C as generateMeshCa, D as loadMeshCa, E as issueMeshLeafFromCsr, F as parseAgentDashboardOrigins, G as setProcessMeshEnforcer, H as requestProcessMeshEnforcement, I as verifyAgentUiUnlockTicket, J as parseCidrList, K as createCidrMatcher, L as MESH_AUTH_MODE_FIELD, M as UnlockTicketJtiStore, N as isAllowedAgentDashboardReturnTo, O as AGENT_DASHBOARD_ORIGINS_FIELD, P as mintAgentUiUnlockTicket, R as getProcessMeshAuthMode, S as exportMeshPrivateKeyPem, SystemConfigAddon, T as issueMeshLeafForNode, U as setProcessMeshAuthMode, V as parseMeshAuthMode, W as setProcessMeshAuthStatusSource, Y as readCidrSetting, _ as getProcessMeshCaState, a as ServiceBroker, b as caFingerprintCompact, c as JoinTokenJtiStore, d as verifyMeshJoinToken, f as getProcessNodeMeshTransport, g as MeshCaKeeper, h as processMeshCrl, i as Errors, j as AGENT_UI_UNLOCK_VERSION, k as AGENT_UI_UNLOCK_DOMAIN, l as mintMeshJoinToken, m as MeshCrl, n as MESH_TLS_PORT_HELLO_FIELD, o as setProcessMeshTlsEnabler, p as setProcessMeshPeerTransportLookup, q as normalizeIp, r as TlsTcpTransporter, s as enrollMeshNode, u as processJoinTokenJtiStore, v as requireProcessMeshCa, w as generateMeshKeyPair, x as createMeshCsrPem, y as caFingerprint, z as getProcessMeshAuthStatus } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
@@ -33,7 +34,7 @@ import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as
 import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-CaOLZ09W.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-J_BsGRBy.mjs";
+import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-CFmPVlWQ.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";

package/dist/{jwt-signing-key-DUVvfILp.mjs → jwt-signing-key-CUpweD22.mjs}

@@ -1,4 +1,4 @@
-import { xr as buildSecretRef } from "./dist-CHsJCqrf.mjs";
+import { Sr as buildSecretRef } from "./dist-B-NmfvVC.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{jwt-signing-key-CPha_bf7.js → jwt-signing-key-nwRpRgf_.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-FSNJUw7p.js");
+const require_dist = require("./dist-CiUKtVkX.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{restore-archive-J_BsGRBy.mjs → restore-archive-CFmPVlWQ.mjs}

@@ -1,4 +1,4 @@
-import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-CHsJCqrf.mjs";
+import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-B-NmfvVC.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{restore-archive-BwGWspP1.js → restore-archive-DA-aJtg7.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-FSNJUw7p.js");
+const require_dist = require("./dist-CiUKtVkX.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{retired-settings-keys-BuQBYfu0.js → retired-settings-keys-D62kN_hT.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-FSNJUw7p.js");
+const require_dist = require("./dist-CiUKtVkX.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-3SMjMqj0.mjs → retired-settings-keys-DCGEI4Vi.mjs}

@@ -1,4 +1,4 @@
-import { vr as asJsonObject } from "./dist-CHsJCqrf.mjs";
+import { yr as asJsonObject } from "./dist-B-NmfvVC.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/sqlite-snapshot-worker.js

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
 const require_sqlite_snapshot_protocol = require("./sqlite-snapshot-protocol-B9OndqZv.js");
+let node_worker_threads = require("node:worker_threads");
 let better_sqlite3 = require("better-sqlite3");
 better_sqlite3 = require_chunk.__toESM(better_sqlite3);
-let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/sqlite-snapshot-worker.ts
 /**
 * The snapshot worker — a thread of the process that OWNS a live SQLite

package/dist/sqlite-snapshot-worker.mjs

@@ -1,6 +1,6 @@
 import { n as isSnapshotWorkerData, t as SnapshotRefusedError } from "./sqlite-snapshot-protocol-2QaTouWV.mjs";
-import Database from "better-sqlite3";
 import { isMainThread, parentPort, workerData } from "node:worker_threads";
+import Database from "better-sqlite3";
 //#region src/builtins/sqlite-storage/sqlite-snapshot-worker.ts
 /**
 * The snapshot worker — a thread of the process that OWNS a live SQLite