@camstack/system 1.2.457 → 1.2.458

package/dist/builtins/keychain/index.mjs

@@ -1,8 +1,8 @@
-import { G as KeychainResetRecordSchema, Ki as defineRecordKinds, Mn as keychainAdminCapability, Nn as keychainCapability, Oa as EventCategory, U as KEYCHAIN_RESET_TRIGGER_ACTOR, W as KeychainAuditEntrySchema, Xi as formatSecretScope, fa as parseSecretRef, la as normalizeSecretOwner, ni as BaseAddon } from "../../dist-Dhux90yB.mjs";
+import { G as KeychainResetRecordSchema, Ki as defineRecordKinds, Mn as keychainAdminCapability, Nn as keychainCapability, Oa as EventCategory, U as KEYCHAIN_RESET_TRIGGER_ACTOR, W as KeychainAuditEntrySchema, Xi as formatSecretScope, fa as parseSecretRef, la as normalizeSecretOwner, ni as BaseAddon } from "../../dist-B_GRPhnY.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-BB6nHAL5.mjs";
-import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-x9ZCbQJP.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants-cxKcZRMi.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-lEaAQ9Xi.mjs";
+import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-Lb-mrVvz.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-FGjnsE2x.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Hi as createEvent, Oa as EventCategory, it as RecordingStatusSchema, ni as BaseAddon, nt as RECORDING_SOURCE_CAMSTACK_ADDON, ti as errMsg } from "../../dist-Dhux90yB.mjs";
+import { Hi as createEvent, Oa as EventCategory, it as RecordingStatusSchema, ni as BaseAddon, nt as RECORDING_SOURCE_CAMSTACK_ADDON, ti as errMsg } from "../../dist-B_GRPhnY.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,12 +3,12 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-CVK3YcR_.js");
-const require_phase6_declare_gate = require("../../phase6-declare-gate-BO-_jLh_.js");
+const require_device_ca = require("../../device-ca-BrVK_5s3.js");
+const require_phase6_declare_gate = require("../../phase6-declare-gate-Dag1_WR2.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,10 +1,10 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { $ as PreferenceDeviceIdSchema, D as DEVICE_ENROLLMENT_TTL_MS, Ea as userError, En as isCredentialTokenPayload, Et as authProviderCapability, Ki as defineRecordKinds, Mt as buildDeviceSignatureMessage, Nr as userManagementCapability, Q as PREFERENCES_MAX_VALUE_BYTES, _n as formatDeviceRevoker, a as ApiKeyRecordSchema, aa as makeSecretMarker, b as CredentialTokenClaimsSchema, dt as SsoBridgeClaimsSchema, en as deviceCredentialsCapability, et as PreferenceNamespaceSchema, g as CREDENTIAL_TOKEN_AUDIENCE, gt as TokenScopeSchema, jt as buildDeviceEnrollmentLink, k as DEVICE_NONCE_TTL_MS, lt as ScopedTokenSchema, na as isSecretMarker, ni as BaseAddon, tt as PreferenceValueSchema, vt as UserRecordSchema } from "../../dist-Dhux90yB.mjs";
+import { $ as PreferenceDeviceIdSchema, D as DEVICE_ENROLLMENT_TTL_MS, Ea as userError, En as isCredentialTokenPayload, Et as authProviderCapability, Ki as defineRecordKinds, Mt as buildDeviceSignatureMessage, Nr as userManagementCapability, Q as PREFERENCES_MAX_VALUE_BYTES, _n as formatDeviceRevoker, a as ApiKeyRecordSchema, aa as makeSecretMarker, b as CredentialTokenClaimsSchema, dt as SsoBridgeClaimsSchema, en as deviceCredentialsCapability, et as PreferenceNamespaceSchema, g as CREDENTIAL_TOKEN_AUDIENCE, gt as TokenScopeSchema, jt as buildDeviceEnrollmentLink, k as DEVICE_NONCE_TTL_MS, lt as ScopedTokenSchema, na as isSecretMarker, ni as BaseAddon, tt as PreferenceValueSchema, vt as UserRecordSchema } from "../../dist-B_GRPhnY.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-BB6nHAL5.mjs";
-import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-x9ZCbQJP.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-lEaAQ9Xi.mjs";
+import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-Lb-mrVvz.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-DB1Y9agt.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-nce3TXs_.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { $n as pickAppLinkHub, Cn as isAppLinkBase, Dn as isDefaultAppConnectionEndpoint, Fr as validateCustomAddress, H as HUB_MDNS_TXT_KEYS, Ln as localNetworkCapability, Lt as checkRoleAddress, Oa as EventCategory, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, cr as resolveAppConnections, fr as resolveHubAddressRoles, hr as resolveNotificationTapAddress, l as CAMSTACK_APP_LINK_ORIGIN, ni as BaseAddon, ti as errMsg, xr as shortHostname } from "../../dist-Dhux90yB.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-B8olZqqd.mjs";
+import { $n as pickAppLinkHub, Cn as isAppLinkBase, Dn as isDefaultAppConnectionEndpoint, Fr as validateCustomAddress, H as HUB_MDNS_TXT_KEYS, Ln as localNetworkCapability, Lt as checkRoleAddress, Oa as EventCategory, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, cr as resolveAppConnections, fr as resolveHubAddressRoles, hr as resolveNotificationTapAddress, l as CAMSTACK_APP_LINK_ORIGIN, ni as BaseAddon, ti as errMsg, xr as shortHostname } from "../../dist-B_GRPhnY.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-Bg2HfTwP.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
 const require_log_read_filter = require("../../log-read-filter-Bi066jwU.js");
 let zod = require("zod");
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { ni as BaseAddon, zn as logDestinationCapability } from "../../dist-Dhux90yB.mjs";
+import { ni as BaseAddon, zn as logDestinationCapability } from "../../dist-B_GRPhnY.mjs";
 import { n as compileLogFilter, o as lineMatches } from "../../log-read-filter-D7Ev3zm-.mjs";
 import { z } from "zod";
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
 let node_fs_promises = require("node:fs/promises");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Gn as metricsProviderCapability, Hi as createEvent, Oa as EventCategory, _t as UNATTRIBUTED_BUCKET_KEY, gn as foldSnapshotByFunction, lr as resolveBucketMs, ni as BaseAddon, or as reducePoints, rt as ROOT_BUCKET_KEY, ti as errMsg } from "../../dist-Dhux90yB.mjs";
+import { Gn as metricsProviderCapability, Hi as createEvent, Oa as EventCategory, _t as UNATTRIBUTED_BUCKET_KEY, gn as foldSnapshotByFunction, lr as resolveBucketMs, ni as BaseAddon, or as reducePoints, rt as ROOT_BUCKET_KEY, ti as errMsg } from "../../dist-B_GRPhnY.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";

package/dist/builtins/platform-probe/coral-accelerators.d.ts

@@ -1,22 +1,39 @@
 import type { CoralInfo } from "@camstack/types";
 /**
-* Filesystem seam for Coral USB Edge TPU detection — mirrors the
-* `AcceleratorFs` pattern in `intel-accelerators.ts` so the classifier stays a
-* pure, unit-testable function over injected reads.
+* Filesystem seam for Coral Edge TPU detection (USB and PCIe/M.2) — mirrors
+* the `AcceleratorFs` pattern in `intel-accelerators.ts` so the classifier
+* stays a pure, unit-testable function over injected reads.
 */
 export interface CoralFs {
 	/** USB device directory names under `/sys/bus/usb/devices` (e.g. `2-4`). */
 	listUsbDevices(): readonly string[];
 	/** Read a `<sysfsNode>/<attr>` value (idVendor / idProduct), trimmed. */
 	readUsbAttr(device: string, attr: string): string;
-	/** Whether a filesystem path exists (the libedgetpu delegate). */
+	/** PCI function names under `/sys/bus/pci/devices` (e.g. `0000:03:00.0`). */
+	listPciDevices(): readonly string[];
+	/** Read a PCI function's `vendor` / `device` attribute (e.g. `0x1ac1`), trimmed. */
+	readPciAttr(device: string, attr: string): string;
+	/** Entry names under `/sys/class/apex` (the gasket/apex driver: `apex_0`, …). */
+	listApexClass(): readonly string[];
+	/** Whether this process can open a device node for read AND write. */
+	canOpen(path: string): boolean;
+	/** Whether a filesystem path exists (the libedgetpu delegate, `/dev/apex_N`). */
 	exists(path: string): boolean;
 }
 /**
-* Detect a Coral USB Edge TPU. Present when EITHER a matching USB device is
-* enumerated OR the libedgetpu delegate is installed (the delegate is the
-* hub-provisioned runtime prerequisite; on a container whose `/sys` USB view is
-* limited, its presence is a reliable operator-intent signal that the Coral is
-* wired through). Returns `null` when neither signal is found.
+* Detect Coral Edge TPUs on USB and PCIe/M.2.
+*
+* - USB: every matching USB device counts (multiple Corals run concurrently).
+* - PCIe: the apex driver's units, each usable only if its device node opens;
+*   a Coral PCI function the driver did not bind is `driver-missing`.
+* - Fallback: when NO Coral signal of either bus is visible but the libedgetpu
+*   delegate is installed (a container whose `/sys` USB view is limited), one
+*   USB Coral is assumed — never when a PCI Coral was seen, since the delegate
+*   then says nothing about USB.
+*
+* Returns `null` only when no Coral was found at all; a present-but-unusable
+* Coral is reported with its typed reason, never as absent (D393/D315).
 */
 export declare function classifyCoralAccelerator(fsx: CoralFs): CoralInfo | null;
+/** The real filesystem view: `/sys` for enumeration, `/dev` for access. */
+export declare const nodeCoralFs: CoralFs;

package/dist/builtins/platform-probe/index.js

@@ -3,62 +3,14 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
+const require_coral_accelerators = require("../../coral-accelerators-Bi_c3Rft.js");
 let node_util = require("node:util");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");
-//#region src/builtins/platform-probe/coral-accelerators.ts
-/**
-* Coral USB Edge TPU USB identifiers.
-*
-* The device enumerates as `1a6e:089a` (Global Unichip) BEFORE the libedgetpu
-* firmware loads, then re-enumerates as `18d1:9302` (Google) AFTER. Either id
-* means a Coral is physically attached, so both count as a positive signal.
-*/
-var CORAL_USB_IDS = [{
-	vendor: "1a6e",
-	product: "089a"
-}, {
-	vendor: "18d1",
-	product: "9302"
-}];
-/**
-* Default install path of the libedgetpu delegate on the hub, provisioned
-* out-of-band by `/data/deps/edgetpu-install.sh` (it is a system shared
-* library, not a pip package). Overridable via `CAMSTACK_EDGETPU_LIB` — kept in
-* sync with the Python pool's own default in `inference_pool.py`.
-*/
-var DEFAULT_EDGETPU_LIB = "/data/deps/edgetpu/lib/libedgetpu.so.1";
-/**
-* Detect a Coral USB Edge TPU. Present when EITHER a matching USB device is
-* enumerated OR the libedgetpu delegate is installed (the delegate is the
-* hub-provisioned runtime prerequisite; on a container whose `/sys` USB view is
-* limited, its presence is a reliable operator-intent signal that the Coral is
-* wired through). Returns `null` when neither signal is found.
-*/
-function classifyCoralAccelerator(fsx) {
-	let count = 0;
-	for (const device of fsx.listUsbDevices()) {
-		const vendor = fsx.readUsbAttr(device, "idVendor").toLowerCase();
-		const product = fsx.readUsbAttr(device, "idProduct").toLowerCase();
-		if (CORAL_USB_IDS.some((id) => id.vendor === vendor && id.product === product)) count++;
-	}
-	if (count > 0) return {
-		type: "coral-edgetpu",
-		bus: "usb",
-		count
-	};
-	const libPath = process.env["CAMSTACK_EDGETPU_LIB"] ?? DEFAULT_EDGETPU_LIB;
-	if (fsx.exists(libPath)) return {
-		type: "coral-edgetpu",
-		bus: "usb"
-	};
-	return null;
-}
-//#endregion
 //#region src/builtins/platform-probe/amd-npu.ts
 var amd_npu_exports = /* @__PURE__ */ require_chunk.__exportAll({
 	classifyAmdNpu: () => classifyAmdNpu,
@@ -462,24 +414,15 @@ var PlatformScorer = class {
 		} });
 		let gpu = null;
 		let npu = null;
-		const coral = classifyCoralAccelerator({
-			listUsbDevices: () => {
-				try {
-					return node_fs.readdirSync("/sys/bus/usb/devices");
-				} catch {
-					return [];
-				}
-			},
-			readUsbAttr: (device, attr) => {
-				try {
-					return node_fs.readFileSync(`/sys/bus/usb/devices/${device}/${attr}`, "utf8").trim();
-				} catch {
-					return "";
-				}
-			},
-			exists: (p) => node_fs.existsSync(p)
-		});
-		if (coral) this.logger.info("Coral USB Edge TPU detected", { meta: { bus: coral.bus } });
+		const coral = require_coral_accelerators.classifyCoralAccelerator(require_coral_accelerators.nodeCoralFs);
+		if (coral) {
+			if ((coral.units ?? []).length > 0) this.logger.info("Coral Edge TPU detected", { meta: { units: coral.units } });
+			for (const unavailable of coral.unavailable ?? []) this.logger.warn("Coral Edge TPU present but unusable", { meta: {
+				bus: unavailable.bus,
+				count: unavailable.count,
+				reason: unavailable.reason
+			} });
+		}
 		if (platform === "darwin" && arch === "arm64") {
 			gpu = {
 				type: "apple",

package/dist/builtins/platform-probe/index.mjs

@@ -1,58 +1,10 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { Ji as emitReadiness, Oa as EventCategory, ni as BaseAddon, sn as enumerateInferenceDevices, ti as errMsg, tr as platformProbeCapability, yr as scoreRuntimes } from "../../dist-Dhux90yB.mjs";
+import { Ji as emitReadiness, Oa as EventCategory, ni as BaseAddon, sn as enumerateInferenceDevices, ti as errMsg, tr as platformProbeCapability, yr as scoreRuntimes } from "../../dist-B_GRPhnY.mjs";
+import { n as nodeCoralFs, t as classifyCoralAccelerator } from "../../coral-accelerators-DcnZvctM.mjs";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
-//#region src/builtins/platform-probe/coral-accelerators.ts
-/**
-* Coral USB Edge TPU USB identifiers.
-*
-* The device enumerates as `1a6e:089a` (Global Unichip) BEFORE the libedgetpu
-* firmware loads, then re-enumerates as `18d1:9302` (Google) AFTER. Either id
-* means a Coral is physically attached, so both count as a positive signal.
-*/
-var CORAL_USB_IDS = [{
-	vendor: "1a6e",
-	product: "089a"
-}, {
-	vendor: "18d1",
-	product: "9302"
-}];
-/**
-* Default install path of the libedgetpu delegate on the hub, provisioned
-* out-of-band by `/data/deps/edgetpu-install.sh` (it is a system shared
-* library, not a pip package). Overridable via `CAMSTACK_EDGETPU_LIB` — kept in
-* sync with the Python pool's own default in `inference_pool.py`.
-*/
-var DEFAULT_EDGETPU_LIB = "/data/deps/edgetpu/lib/libedgetpu.so.1";
-/**
-* Detect a Coral USB Edge TPU. Present when EITHER a matching USB device is
-* enumerated OR the libedgetpu delegate is installed (the delegate is the
-* hub-provisioned runtime prerequisite; on a container whose `/sys` USB view is
-* limited, its presence is a reliable operator-intent signal that the Coral is
-* wired through). Returns `null` when neither signal is found.
-*/
-function classifyCoralAccelerator(fsx) {
-	let count = 0;
-	for (const device of fsx.listUsbDevices()) {
-		const vendor = fsx.readUsbAttr(device, "idVendor").toLowerCase();
-		const product = fsx.readUsbAttr(device, "idProduct").toLowerCase();
-		if (CORAL_USB_IDS.some((id) => id.vendor === vendor && id.product === product)) count++;
-	}
-	if (count > 0) return {
-		type: "coral-edgetpu",
-		bus: "usb",
-		count
-	};
-	const libPath = process.env["CAMSTACK_EDGETPU_LIB"] ?? DEFAULT_EDGETPU_LIB;
-	if (fsx.exists(libPath)) return {
-		type: "coral-edgetpu",
-		bus: "usb"
-	};
-	return null;
-}
-//#endregion
 //#region src/builtins/platform-probe/amd-npu.ts
 var amd_npu_exports = /* @__PURE__ */ __exportAll({
 	classifyAmdNpu: () => classifyAmdNpu,
@@ -456,24 +408,15 @@ var PlatformScorer = class {
 		} });
 		let gpu = null;
 		let npu = null;
-		const coral = classifyCoralAccelerator({
-			listUsbDevices: () => {
-				try {
-					return fs.readdirSync("/sys/bus/usb/devices");
-				} catch {
-					return [];
-				}
-			},
-			readUsbAttr: (device, attr) => {
-				try {
-					return fs.readFileSync(`/sys/bus/usb/devices/${device}/${attr}`, "utf8").trim();
-				} catch {
-					return "";
-				}
-			},
-			exists: (p) => fs.existsSync(p)
-		});
-		if (coral) this.logger.info("Coral USB Edge TPU detected", { meta: { bus: coral.bus } });
+		const coral = classifyCoralAccelerator(nodeCoralFs);
+		if (coral) {
+			if ((coral.units ?? []).length > 0) this.logger.info("Coral Edge TPU detected", { meta: { units: coral.units } });
+			for (const unavailable of coral.unavailable ?? []) this.logger.warn("Coral Edge TPU present but unusable", { meta: {
+				bus: unavailable.bus,
+				count: unavailable.count,
+				reason: unavailable.reason
+			} });
+		}
 		if (platform === "darwin" && arch === "arm64") {
 			gpu = {
 				type: "apple",

package/dist/builtins/record-entries/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/record-entries/index.mjs

@@ -1,4 +1,4 @@
-import { fi as InvalidRecordError, ga as recordSecretRef, ir as recordEntriesCapability, ji as UnknownRecordKindError, ni as BaseAddon, oa as mapSecretLeaves } from "../../dist-Dhux90yB.mjs";
+import { fi as InvalidRecordError, ga as recordSecretRef, ir as recordEntriesCapability, ji as UnknownRecordKindError, ni as BaseAddon, oa as mapSecretLeaves } from "../../dist-B_GRPhnY.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Oa as EventCategory, ni as BaseAddon } from "../../dist-Dhux90yB.mjs";
+import { Oa as EventCategory, ni as BaseAddon } from "../../dist-B_GRPhnY.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Cr as snapshotCapability, Oa as EventCategory, Ot as bareAddonId, Qr as DeviceFeature, Qt as deriveBatteryPresence, Wn as memoizePinnedFfmpeg, ei as DeviceType, jr as streamQualityLabel, kt as batteryCapability, ni as BaseAddon, s as BatteryStatusSchema, sa as nodePin, ti as errMsg } from "../../dist-Dhux90yB.mjs";
+import { Cr as snapshotCapability, Oa as EventCategory, Ot as bareAddonId, Qr as DeviceFeature, Qt as deriveBatteryPresence, Wn as memoizePinnedFfmpeg, ei as DeviceType, jr as streamQualityLabel, kt as batteryCapability, ni as BaseAddon, s as BatteryStatusSchema, sa as nodePin, ti as errMsg } from "../../dist-B_GRPhnY.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { hn as filesystemBrowseCapability, kr as storageProviderCapability, ni as BaseAddon } from "../../dist-Dhux90yB.mjs";
+import { hn as filesystemBrowseCapability, kr as storageProviderCapability, ni as BaseAddon } from "../../dist-B_GRPhnY.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-DVN-DiVP.js");
+const require_wal_maintenance = require("../../wal-maintenance-DfSIOj24.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-BMiX6UIa.mjs";
+import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-Duejh7Lx.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
 const require_retired_settings_keys = require("../../retired-settings-keys-D_VwZiDt.js");
-const require_wal_maintenance = require("../../wal-maintenance-DVN-DiVP.js");
+const require_wal_maintenance = require("../../wal-maintenance-DfSIOj24.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { C as DATABASE_SNAPSHOT_TIMEOUT_MS, Jt as databaseSnapshotCapability, Ot as bareAddonId, Rr as vectorStoreCapability, S as DATABASE_SNAPSHOT_SUFFIX, Tr as storageAdminCapability, ar as recordsCapability, ci as DeclarationRefusedError, ji as UnknownRecordKindError, la as normalizeSecretOwner, ma as parseSettingsBrokersAdoptsFrom, ni as BaseAddon, ot as STORAGE_ADMIN_MOVED_COLLECTIONS, pa as parseSettingsArrayAdoptsFrom, pi as NoCallerError, qt as dataStoreProviderCapability, st as STORAGE_ADMIN_SCOPED_BASES, ti as errMsg, vi as RECORD_SWEEP_INTERVAL_MS, w as DATA_STORE_DATABASES, wi as RecordKindDeclarationSchema, x as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, xi as RUNTIME_DEFAULTS } from "../../dist-Dhux90yB.mjs";
+import { C as DATABASE_SNAPSHOT_TIMEOUT_MS, Jt as databaseSnapshotCapability, Ot as bareAddonId, Rr as vectorStoreCapability, S as DATABASE_SNAPSHOT_SUFFIX, Tr as storageAdminCapability, ar as recordsCapability, ci as DeclarationRefusedError, ji as UnknownRecordKindError, la as normalizeSecretOwner, ma as parseSettingsBrokersAdoptsFrom, ni as BaseAddon, ot as STORAGE_ADMIN_MOVED_COLLECTIONS, pa as parseSettingsArrayAdoptsFrom, pi as NoCallerError, qt as dataStoreProviderCapability, st as STORAGE_ADMIN_SCOPED_BASES, ti as errMsg, vi as RECORD_SWEEP_INTERVAL_MS, w as DATA_STORE_DATABASES, wi as RecordKindDeclarationSchema, x as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, xi as RUNTIME_DEFAULTS } from "../../dist-B_GRPhnY.mjs";
 import { i as retiredKeyStoreOf, n as purgeRetiredSettingsKeys } from "../../retired-settings-keys-Bhwe4ymb.mjs";
-import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, S as trustResult, T as callData, _ as collectTransferables, a as WalMaintenance, c as vectorProviderOfOwnedFile, d as CrossDatabaseTransactError, f as DatabaseBusyError, l as SqliteSettingsBackend, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callControl } from "../../wal-maintenance-BMiX6UIa.mjs";
+import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, S as trustResult, T as callData, _ as collectTransferables, a as WalMaintenance, c as vectorProviderOfOwnedFile, d as CrossDatabaseTransactError, f as DatabaseBusyError, l as SqliteSettingsBackend, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callControl } from "../../wal-maintenance-Duejh7Lx.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Dr as storageMigrationCapability, Er as storageCapability, Fn as legacyModeOf, Hn as mayReadLocation, Ki as defineRecordKinds, Kn as modeMayWrite, Oa as EventCategory, On as isLocationEnabled, Ri as collectSecretConfigKeys, Ta as transformSecretWrite, Un as mayWriteToLocation, ba as secretTreeFromPaths, br as settingsStoreCapability, ca as normalizeNodeId, dn as evictionPolicyOfLocation, ft as StorageCleanupJobSchema, ht as StorageMigrationJobSchema, mt as StorageLocationTypeSchema, na as isSecretMarker, ni as BaseAddon, pr as resolveLocationMode, pt as StorageLocationModeSchema, q as LegacyStorageLocationDefaultSchema, ua as parseJsonObject, va as resolveSecretMarkers, yi as REDACTED_SECRET, yn as gbToBytes, zr as withLocationMode } from "../../dist-Dhux90yB.mjs";
+import { Dr as storageMigrationCapability, Er as storageCapability, Fn as legacyModeOf, Hn as mayReadLocation, Ki as defineRecordKinds, Kn as modeMayWrite, Oa as EventCategory, On as isLocationEnabled, Ri as collectSecretConfigKeys, Ta as transformSecretWrite, Un as mayWriteToLocation, ba as secretTreeFromPaths, br as settingsStoreCapability, ca as normalizeNodeId, dn as evictionPolicyOfLocation, ft as StorageCleanupJobSchema, ht as StorageMigrationJobSchema, mt as StorageLocationTypeSchema, na as isSecretMarker, ni as BaseAddon, pr as resolveLocationMode, pt as StorageLocationModeSchema, q as LegacyStorageLocationDefaultSchema, ua as parseJsonObject, va as resolveSecretMarkers, yi as REDACTED_SECRET, yn as gbToBytes, zr as withLocationMode } from "../../dist-B_GRPhnY.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_x509_es = require("../../x509.es-C4cOo48M.js");
-const require_constants$8 = require("../../constants-B_X9cWEK.js");
-const require_agent_https = require("../../agent-https-CoyOZ3pC.js");
+const require_constants$8 = require("../../constants-Njka8Cv6.js");
+const require_agent_https = require("../../agent-https-DOELEug8.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,9 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Gi as defineCustomActions, Ui as customAction, Zi as hydrateSchema, ni as BaseAddon, ti as errMsg, ut as ServerNameSchema, xr as shortHostname } from "../../dist-Dhux90yB.mjs";
+import { Gi as defineCustomActions, Ui as customAction, Zi as hydrateSchema, ni as BaseAddon, ti as errMsg, ut as ServerNameSchema, xr as shortHostname } from "../../dist-B_GRPhnY.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { c as Pkcs10CertificateRequest } from "../../x509.es-DK__ETIe.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "../../constants-cxKcZRMi.mjs";
-import { $ as generateMeshCa, B as setProcessAgentHttpsNames, H as MESH_NODE_CERTIFICATES_COLLECTION, I as AGENT_HTTPS_NAMES_COLLECTION, J as setProcessMeshCertificateRegistry, K as describeMeshLeaf, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, Q as exportMeshPrivateKeyPem, R as AgentHttpsNames, U as MESH_NODE_CERTIFICATES_COLUMNS, V as systemConfigRecordKinds, W as MeshCertificateRegistry, X as caFingerprintCompact, Z as createMeshCsrPem, at as subjectCn, et as generateMeshKeyPair, it as loadMeshCa, nt as issueMeshLeafForNode, rt as issueMeshLeafFromCsr, tt as isValidAgentNodeId, u as isPrivateAddress, z as getProcessAgentHttpsNames } from "../../agent-https-CK9Z4sSR.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "../../constants-FGjnsE2x.mjs";
+import { $ as generateMeshCa, B as setProcessAgentHttpsNames, H as MESH_NODE_CERTIFICATES_COLLECTION, I as AGENT_HTTPS_NAMES_COLLECTION, J as setProcessMeshCertificateRegistry, K as describeMeshLeaf, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, Q as exportMeshPrivateKeyPem, R as AgentHttpsNames, U as MESH_NODE_CERTIFICATES_COLUMNS, V as systemConfigRecordKinds, W as MeshCertificateRegistry, X as caFingerprintCompact, Z as createMeshCsrPem, at as subjectCn, et as generateMeshKeyPair, it as loadMeshCa, nt as issueMeshLeafForNode, rt as issueMeshLeafFromCsr, tt as isValidAgentNodeId, u as isPrivateAddress, z as getProcessAgentHttpsNames } from "../../agent-https-CQA3W-3e.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-BZQjLPiz.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 const require_log_file_read_protocol = require("../../log-file-read-protocol-D0WcLbIV.js");
 let node_path = require("node:path");

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { ni as BaseAddon, zn as logDestinationCapability } from "../../dist-Dhux90yB.mjs";
+import { ni as BaseAddon, zn as logDestinationCapability } from "../../dist-B_GRPhnY.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import { a as LogFileIndexStore, i as serveRead, n as isFromReader, t as CancelBook } from "../../log-file-read-protocol-B7M3X3bT.mjs";
 import { createRequire } from "node:module";

package/dist/{composition-sources-B_jeZDRJ.mjs → composition-sources-BVguN7VV.mjs}

@@ -1,4 +1,4 @@
-import { Jr as compositionSourceKey, ti as errMsg } from "./dist-Dhux90yB.mjs";
+import { Jr as compositionSourceKey, ti as errMsg } from "./dist-B_GRPhnY.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-qKyvMAvc.js → composition-sources-DURQNDJ4.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-C89nqNnn.js");
+const require_dist = require("./dist-BZQjLPiz.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-cxKcZRMi.mjs → constants-FGjnsE2x.mjs}

@@ -1,4 +1,4 @@
-import { Li as buildSecretRef } from "./dist-Dhux90yB.mjs";
+import { Li as buildSecretRef } from "./dist-B_GRPhnY.mjs";
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
 var MESH_CA_KEY_REF = buildSecretRef({
 	owner: "system",

package/dist/{constants-B_X9cWEK.js → constants-Njka8Cv6.js}

@@ -1,5 +1,5 @@
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
-var MESH_CA_KEY_REF = require("./dist-C89nqNnn.js").buildSecretRef({
+var MESH_CA_KEY_REF = require("./dist-BZQjLPiz.js").buildSecretRef({
 	owner: "system",
 	scope: { kind: "global" },
 	fieldPath: "meshCaKey"