@camstack/system 1.2.460 → 1.2.462

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,9 +1,9 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { $ as PreferenceDeviceIdSchema, Ca as userError, D as DEVICE_ENROLLMENT_TTL_MS, En as isCredentialTokenPayload, Et as authProviderCapability, Gi as defineRecordKinds, Mt as buildDeviceSignatureMessage, Nr as userManagementCapability, Q as PREFERENCES_MAX_VALUE_BYTES, _n as formatDeviceRevoker, a as ApiKeyRecordSchema, b as CredentialTokenClaimsSchema, dt as SsoBridgeClaimsSchema, en as deviceCredentialsCapability, et as PreferenceNamespaceSchema, g as CREDENTIAL_TOKEN_AUDIENCE, gt as TokenScopeSchema, ia as makeSecretMarker, jt as buildDeviceEnrollmentLink, k as DEVICE_NONCE_TTL_MS, lt as ScopedTokenSchema, ni as BaseAddon, ta as isSecretMarker, tt as PreferenceValueSchema, vt as UserRecordSchema } from "../../dist-Wy8cTxg6.mjs";
+import { $ as PreferenceDeviceIdSchema, $i as isSecretMarker, At as buildDeviceSignatureMessage, D as DEVICE_ENROLLMENT_TTL_MS, Q as PREFERENCES_MAX_VALUE_BYTES, Qt as deviceCredentialsCapability, Ui as defineRecordKinds, a as ApiKeyRecordSchema, b as CredentialTokenClaimsSchema, ei as BaseAddon, et as PreferenceNamespaceSchema, g as CREDENTIAL_TOKEN_AUDIENCE, gt as UserRecordSchema, hn as formatDeviceRevoker, jr as userManagementCapability, k as DEVICE_NONCE_TTL_MS, kt as buildDeviceEnrollmentLink, lt as SsoBridgeClaimsSchema, mt as TokenScopeSchema, na as makeSecretMarker, st as ScopedTokenSchema, tt as PreferenceValueSchema, wn as isCredentialTokenPayload, wt as authProviderCapability, xa as userError } from "../../dist-8tWIDoWp.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-Bnkw8GyU.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-BU_gnd-q.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
@@ -7214,16 +7214,6 @@ var API_KEYS_COLLECTION = "api_keys";
 */
 var SCOPED_TOKENS_COLLECTION = "scoped_tokens";
 /**
-* @durable class=ledger owner=local-auth
-*   write="one row per redeemed OAuth code — every completed account link through
-*     `oauthExchangeCode`; `touch` rewrites `lastUsedAt` on each refresh"
-*   retention="ONLY revoked rows are pruned: the daily sweep deletes sessions
-*     revoked more than OAUTH_REVOKED_RETENTION_MS (30 d) ago. An ACTIVE session
-*     has `revokedAt` NULL, never expires and is never swept — the table grows one
-*     row per login until an operator revokes the link."
-*/
-var OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
-/**
 * TOTP enrollment table — split off from `users` to avoid the
 * destructive drop-+-recreate migration `ensureTable` performs when a
 * new column is added to a typed schema (see `sqlite-settings-backend.ts`).
@@ -7455,47 +7445,6 @@ var SCOPED_TOKENS_COLUMNS = [
 		notNull: true
 	}
 ];
-var OAUTH_SESSIONS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "userId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "username",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "integrationId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "scopes",
-		type: "JSON"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "lastUsedAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "revokedAt",
-		type: "INTEGER"
-	}
-];
 /**
 * Declare every auth collection with the typed schema. Called by
 * `LocalAuthAddon.onInitialize` before constructing the per-collection
@@ -7536,14 +7485,6 @@ async function declareAuthSchema(store, options) {
 			columns: ["userId"]
 		}]
 	});
-	if (!skip.has("oauth_sessions")) await store.declareCollection.mutate({
-		collection: OAUTH_SESSIONS_COLLECTION,
-		columns: OAUTH_SESSIONS_COLUMNS,
-		indexes: [{
-			name: "idx_oauth_sessions_user_id",
-			columns: ["userId"]
-		}]
-	});
 	if (!skip.has("login_sessions")) await store.declareCollection.mutate({
 		collection: LOGIN_SESSIONS_COLLECTION,
 		columns: LOGIN_SESSIONS_COLUMNS,
@@ -7587,7 +7528,7 @@ async function declareAuthSchema(store, options) {
 * Record kinds owned by `local-auth` (records plan phase 6 / §2.8).
 *
 * Operator-only legacy drop: auth tables are NEVER removed by the orphan job —
-* use `storageAdmin.dropCollection` with `expectRows` after verify (see
+* the operator drops a legacy table by hand, offline (D902; see
 * `docs/design/records-phase-6-auth-migration.md`).
 *
 * Before hub restart: mint and test an admin token (`auth.mintToken` with `'*'`); snapshot every kind.
@@ -7758,16 +7699,19 @@ var _localAuthRecordKinds = defineRecordKinds({
 	"oauth-sessions": {
 		schema: OauthSessionBodySchema,
 		class: "ledger",
-		writeTrigger: "OAuth code exchange; refresh touches lastUsedAt",
+		writeTrigger: "OAuth code exchange; refresh touches lastUsedAt; revoke stamps revokedAt",
 		device: "none",
 		at: "none",
 		indexes: [{
 			name: "user",
 			fields: ["userId"]
+		}, {
+			name: "revoked",
+			fields: ["revokedAt"]
 		}],
 		retention: {
 			owner: "local-auth",
-			reason: "daily reap deletes revoked sessions older than 30 days; active rows never expire"
+			reason: "daily reap deletes sessions revoked more than 30 days ago; an active session has no lifetime, so no engine TTL"
 		}
 	},
 	"user-totp": {
@@ -7848,7 +7792,6 @@ var LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS = [
 	ADMIN_TOKENS_COLLECTION,
 	LOGIN_SESSIONS_COLLECTION,
 	LOGIN_SESSION_CUTOFFS_COLLECTION,
-	OAUTH_SESSIONS_COLLECTION,
 	USER_TOTP_COLLECTION,
 	USER_EXTERNAL_IDENTITIES_COLLECTION,
 	DEVICE_CREDENTIALS_COLLECTION,
@@ -8053,7 +7996,7 @@ function num(data, key) {
 	const value = data[key];
 	return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
-function parseSession$1(data) {
+function parseSession(data) {
 	const id = str(data, "id");
 	const userId = str(data, "userId");
 	const createdAt = num(data, "createdAt");
@@ -8116,7 +8059,7 @@ var LoginSessionManager = class {
 		if (sessionsKind !== null) {
 			const rows = await (0, import_read_all_rows.readAllRows)(sessionsKind);
 			for (const row of rows) {
-				const record = parseSession$1({
+				const record = parseSession({
 					id: row.id,
 					...row.data
 				});
@@ -8128,7 +8071,7 @@ var LoginSessionManager = class {
 		}
 		const rows = await this.store.query.query({ collection: LOGIN_SESSIONS_COLLECTION });
 		for (const row of rows) {
-			const record = parseSession$1(row.data);
+			const record = parseSession(row.data);
 			if (record !== null) this.remember(record);
 		}
 		const cutoffs = await this.store.query.query({ collection: LOGIN_SESSION_CUTOFFS_COLLECTION });
@@ -12034,33 +11977,6 @@ function createOauthGrants(ssoBridge, sessionManager) {
 }
 //#endregion
 //#region src/builtins/local-auth/oauth-session-manager.ts
-function parseSession(data) {
-	const id = data["id"];
-	const userId = data["userId"];
-	const username = data["username"];
-	const integrationId = data["integrationId"];
-	const scopes = data["scopes"];
-	const createdAt = data["createdAt"];
-	const lastUsedAt = data["lastUsedAt"];
-	const revokedAt = data["revokedAt"];
-	if (typeof id !== "string") throw new Error("oauth_sessions row: missing id");
-	if (typeof userId !== "string") throw new Error("oauth_sessions row: missing userId");
-	if (typeof username !== "string") throw new Error("oauth_sessions row: missing username");
-	if (typeof integrationId !== "string") throw new Error("oauth_sessions row: missing integrationId");
-	if (!Array.isArray(scopes)) throw new Error("oauth_sessions row: scopes must be an array");
-	if (typeof createdAt !== "number") throw new Error("oauth_sessions row: missing createdAt");
-	if (typeof lastUsedAt !== "number") throw new Error("oauth_sessions row: missing lastUsedAt");
-	return {
-		id,
-		userId,
-		username,
-		integrationId,
-		scopes,
-		createdAt,
-		lastUsedAt,
-		revokedAt: typeof revokedAt === "number" ? revokedAt : null
-	};
-}
 function sessionToBody(session) {
 	return {
 		userId: session.userId,
@@ -12073,22 +11989,34 @@ function sessionToBody(session) {
 	};
 }
 function rowToSession(id, body) {
-	return parseSession({
+	return {
 		id,
-		...body
-	});
+		userId: body.userId,
+		username: body.username,
+		integrationId: body.integrationId,
+		scopes: body.scopes,
+		createdAt: body.createdAt,
+		lastUsedAt: body.lastUsedAt,
+		revokedAt: typeof body.revokedAt === "number" ? body.revokedAt : null
+	};
 }
+/**
+* The OAuth account links (one row per redeemed code), kept in local-auth's
+* `oauth-sessions` records kind (D881, D902). There is no table: the
+* `oauth_sessions` collection and its settings-store path are gone.
+*/
 var OauthSessionManager = class {
 	kind;
-	store;
 	constructor(deps) {
-		if ("oauthSessionsKind" in deps) {
-			this.kind = deps.oauthSessionsKind;
-			this.store = deps.legacyStore ?? null;
-		} else {
-			this.kind = null;
-			this.store = deps;
-		}
+		this.kind = deps.oauthSessionsKind;
+	}
+	async write(session) {
+		const parsed = localAuthRecordKinds["oauth-sessions"].schema.safeParse(sessionToBody(session));
+		if (!parsed.success) throw new Error(parsed.error.message);
+		await this.kind.put({
+			id: session.id,
+			data: parsed.data
+		});
 	}
 	async create(input) {
 		const now = Date.now();
@@ -12102,117 +12030,53 @@ var OauthSessionManager = class {
 			lastUsedAt: now,
 			revokedAt: null
 		};
-		const kind = this.kind;
-		if (kind !== null) {
-			const parsed = localAuthRecordKinds["oauth-sessions"].schema.safeParse(sessionToBody(session));
-			if (!parsed.success) throw new Error(parsed.error.message);
-			await kind.put({
-				id: session.id,
-				data: parsed.data
-			});
-			return session;
-		}
-		await this.store.insert.mutate({
-			collection: OAUTH_SESSIONS_COLLECTION,
-			record: {
-				id: session.id,
-				data: { ...session }
-			}
-		});
+		await this.write(session);
 		return session;
 	}
 	async list() {
-		const kind = this.kind;
-		if (kind !== null) return (await (0, import_read_all_rows.readAllRows)(kind)).map((row) => rowToSession(row.id, row.data));
-		return (await this.store.query.query({
-			collection: OAUTH_SESSIONS_COLLECTION,
-			filter: {}
-		})).map((r) => parseSession(r.data));
+		return (await (0, import_read_all_rows.readAllRows)(this.kind)).map((row) => rowToSession(row.id, row.data));
 	}
 	async getById(id) {
-		const kind = this.kind;
-		if (kind !== null) {
-			const row = await kind.get(id);
-			return row === null ? null : rowToSession(row.id, row.data);
-		}
-		const results = await this.store.query.query({
-			collection: OAUTH_SESSIONS_COLLECTION,
-			filter: { where: { id } }
-		});
-		if (results.length === 0) return null;
-		return parseSession(results[0].data);
+		const row = await this.kind.get(id);
+		return row === null ? null : rowToSession(row.id, row.data);
 	}
 	async markRevoked(id) {
 		const existing = await this.getById(id);
 		if (existing === null) return false;
 		if (existing.revokedAt !== null) return true;
-		const updated = {
+		await this.write({
 			...existing,
 			revokedAt: Date.now()
-		};
-		const kind = this.kind;
-		if (kind !== null) {
-			const parsed = localAuthRecordKinds["oauth-sessions"].schema.safeParse(sessionToBody(updated));
-			if (!parsed.success) throw new Error(parsed.error.message);
-			await kind.put({
-				id,
-				data: parsed.data
-			});
-			return true;
-		}
-		await this.store.update.mutate({
-			collection: OAUTH_SESSIONS_COLLECTION,
-			id,
-			data: { ...updated }
 		});
 		return true;
 	}
 	async remove(id) {
 		if (await this.getById(id) === null) return false;
-		const kind = this.kind;
-		if (kind !== null) {
-			await kind.delete(id);
-			return true;
-		}
-		await this.store.delete.mutate({
-			collection: OAUTH_SESSIONS_COLLECTION,
-			key: id
-		});
+		await this.kind.delete(id);
 		return true;
 	}
+	/**
+	* Delete the sessions revoked at or before `horizonMs`. An active session
+	* (`revokedAt` null) is never matched: it has no lifetime of its own, which
+	* is why this is the owner's sweep and not an engine TTL.
+	*/
 	async reapRevoked(horizonMs) {
-		const kind = this.kind;
-		if (kind !== null) return kind.deleteWhere({ where: { revokedAt: {
+		return this.kind.deleteWhere({ where: { revokedAt: {
 			gte: 1,
 			lte: horizonMs
 		} } });
-		const { deleted } = await this.store.deleteWhere.mutate({
-			collection: OAUTH_SESSIONS_COLLECTION,
-			filter: { whereBetween: { revokedAt: [1, horizonMs] } }
-		});
-		return deleted;
 	}
 	async touch(id) {
 		const existing = await this.getById(id);
 		if (existing === null) return;
-		const updated = {
+		const parsed = localAuthRecordKinds["oauth-sessions"].schema.safeParse(sessionToBody({
 			...existing,
 			lastUsedAt: Date.now()
-		};
-		const kind = this.kind;
-		if (kind !== null) {
-			const parsed = localAuthRecordKinds["oauth-sessions"].schema.safeParse(sessionToBody(updated));
-			if (!parsed.success) return;
-			await kind.put({
-				id,
-				data: parsed.data
-			});
-			return;
-		}
-		await this.store.update.mutate({
-			collection: OAUTH_SESSIONS_COLLECTION,
+		}));
+		if (!parsed.success) return;
+		await this.kind.put({
 			id,
-			data: { ...updated }
+			data: parsed.data
 		});
 	}
 };
@@ -12297,10 +12161,7 @@ var LocalAuthAddon = class extends BaseAddon {
 				apiKeysKind: authStores.apiKeys,
 				legacyStore: store
 			});
-			this.oauthSessionManager = new OauthSessionManager({
-				oauthSessionsKind: authStores.oauthSessions,
-				legacyStore: store
-			});
+			this.oauthSessionManager = new OauthSessionManager({ oauthSessionsKind: authStores.oauthSessions });
 			this.totpManager = new TotpManager({
 				userTotpKind: authStores.userTotp,
 				legacyStore: store

package/dist/builtins/local-auth/oauth-session-manager.d.ts

@@ -1,4 +1,4 @@
-import type { RecordKindHandle, SettingsStoreClient, TokenScope } from "@camstack/types";
+import type { RecordKindHandle, TokenScope } from "@camstack/types";
 import type { OauthSessionBody } from "./record-kinds.js";
 export interface OauthSession {
 	readonly id: string;
@@ -18,17 +18,26 @@ interface CreateInput {
 }
 export interface OauthSessionRecordsDeps {
 	readonly oauthSessionsKind: RecordKindHandle<OauthSessionBody>;
-	readonly legacyStore?: SettingsStoreClient;
 }
+/**
+* The OAuth account links (one row per redeemed code), kept in local-auth's
+* `oauth-sessions` records kind (D881, D902). There is no table: the
+* `oauth_sessions` collection and its settings-store path are gone.
+*/
 export declare class OauthSessionManager {
 	private readonly kind;
-	private readonly store;
-	constructor(deps: SettingsStoreClient | OauthSessionRecordsDeps);
+	constructor(deps: OauthSessionRecordsDeps);
+	private write;
 	create(input: CreateInput): Promise<OauthSession>;
 	list(): Promise<OauthSession[]>;
 	getById(id: string): Promise<OauthSession | null>;
 	markRevoked(id: string): Promise<boolean>;
 	remove(id: string): Promise<boolean>;
+	/**
+	* Delete the sessions revoked at or before `horizonMs`. An active session
+	* (`revokedAt` null) is never matched: it has no lifetime of its own, which
+	* is why this is the owner's sweep and not an engine TTL.
+	*/
 	reapRevoked(horizonMs: number): Promise<number>;
 	touch(id: string): Promise<void>;
 }

package/dist/builtins/local-auth/record-kinds.d.ts

@@ -2,7 +2,7 @@
 * Record kinds owned by `local-auth` (records plan phase 6 / §2.8).
 *
 * Operator-only legacy drop: auth tables are NEVER removed by the orphan job —
-* use `storageAdmin.dropCollection` with `expectRows` after verify (see
+* the operator drops a legacy table by hand, offline (D902; see
 * `docs/design/records-phase-6-auth-migration.md`).
 *
 * Before hub restart: mint and test an admin token (`auth.mintToken` with `'*'`); snapshot every kind.

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Bn-RNanh.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CTBTlia4.js");
+const require_dist = require("../../dist-Ct-4tTeX.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-DJ-Amqd7.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { $n as pickAppLinkHub, Cn as isAppLinkBase, Dn as isDefaultAppConnectionEndpoint, Fr as validateCustomAddress, H as HUB_MDNS_TXT_KEYS, Ln as localNetworkCapability, Lt as checkRoleAddress, Ta as EventCategory, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, cr as resolveAppConnections, fr as resolveHubAddressRoles, hr as resolveNotificationTapAddress, l as CAMSTACK_APP_LINK_ORIGIN, ni as BaseAddon, ti as errMsg, xr as shortHostname } from "../../dist-Wy8cTxg6.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-CJu0nhla.mjs";
+import { $r as errMsg, Ca as EventCategory, Fn as localNetworkCapability, Ft as checkRoleAddress, H as HUB_MDNS_TXT_KEYS, Nr as validateCustomAddress, Tn as isDefaultAppConnectionEndpoint, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, Zn as pickAppLinkHub, ei as BaseAddon, l as CAMSTACK_APP_LINK_ORIGIN, or as resolveAppConnections, pr as resolveNotificationTapAddress, ur as resolveHubAddressRoles, xn as isAppLinkBase, yr as shortHostname } from "../../dist-8tWIDoWp.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-Cuy7LUdz.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Bn-RNanh.js");
+const require_dist = require("../../dist-Ct-4tTeX.js");
 const require_log_read_filter = require("../../log-read-filter-Bi066jwU.js");
 let zod = require("zod");
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { ni as BaseAddon, zn as logDestinationCapability } from "../../dist-Wy8cTxg6.mjs";
+import { Ln as logDestinationCapability, ei as BaseAddon } from "../../dist-8tWIDoWp.mjs";
 import { n as compileLogFilter, o as lineMatches } from "../../log-read-filter-D7Ev3zm-.mjs";
 import { z } from "zod";
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Bn-RNanh.js");
+const require_dist = require("../../dist-Ct-4tTeX.js");
 let node_fs_promises = require("node:fs/promises");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Gn as metricsProviderCapability, Hi as createEvent, Ta as EventCategory, _t as UNATTRIBUTED_BUCKET_KEY, gn as foldSnapshotByFunction, lr as resolveBucketMs, ni as BaseAddon, or as reducePoints, rt as ROOT_BUCKET_KEY, ti as errMsg } from "../../dist-Wy8cTxg6.mjs";
+import { $r as errMsg, Bi as createEvent, Ca as EventCategory, Un as metricsProviderCapability, ei as BaseAddon, ht as UNATTRIBUTED_BUCKET_KEY, ir as reducePoints, mn as foldSnapshotByFunction, rt as ROOT_BUCKET_KEY, sr as resolveBucketMs } from "../../dist-8tWIDoWp.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Bn-RNanh.js");
+const require_dist = require("../../dist-Ct-4tTeX.js");
 const require_coral_accelerators = require("../../coral-accelerators-oUXmmbc2.js");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { Ta as EventCategory, ni as BaseAddon, qi as emitReadiness, sn as enumerateInferenceDevices, ti as errMsg, tr as platformProbeCapability, yr as scoreRuntimes } from "../../dist-Wy8cTxg6.mjs";
+import { $n as platformProbeCapability, $r as errMsg, Ca as EventCategory, Gi as emitReadiness, _r as scoreRuntimes, an as enumerateInferenceDevices, ei as BaseAddon } from "../../dist-8tWIDoWp.mjs";
 import { n as nodeCoralFs, t as classifyCoralAccelerator } from "../../coral-accelerators-Qhn5TOYZ.mjs";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";

package/dist/builtins/record-entries/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Bn-RNanh.js");
+const require_dist = require("../../dist-Ct-4tTeX.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/record-entries/index.mjs

@@ -1,4 +1,4 @@
-import { aa as mapSecretLeaves, fi as InvalidRecordError, ir as recordEntriesCapability, ji as UnknownRecordKindError, ni as BaseAddon, pa as recordSecretRef } from "../../dist-Wy8cTxg6.mjs";
+import { da as recordSecretRef, ei as BaseAddon, ki as UnknownRecordKindError, nr as recordEntriesCapability, ra as mapSecretLeaves, ui as InvalidRecordError } from "../../dist-8tWIDoWp.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Bn-RNanh.js");
+const require_dist = require("../../dist-Ct-4tTeX.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ta as EventCategory, ni as BaseAddon } from "../../dist-Wy8cTxg6.mjs";
+import { Ca as EventCategory, ei as BaseAddon } from "../../dist-8tWIDoWp.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Bn-RNanh.js");
+const require_dist = require("../../dist-Ct-4tTeX.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Cr as snapshotCapability, Ot as bareAddonId, Qr as DeviceFeature, Qt as deriveBatteryPresence, Ta as EventCategory, Wn as memoizePinnedFfmpeg, ei as DeviceType, jr as streamQualityLabel, kt as batteryCapability, ni as BaseAddon, oa as nodePin, s as BatteryStatusSchema, ti as errMsg } from "../../dist-Wy8cTxg6.mjs";
+import { $r as errMsg, Ca as EventCategory, Dt as batteryCapability, Et as bareAddonId, Hn as memoizePinnedFfmpeg, Qr as DeviceType, Xr as DeviceFeature, Xt as deriveBatteryPresence, ei as BaseAddon, ia as nodePin, kr as streamQualityLabel, s as BatteryStatusSchema, xr as snapshotCapability } from "../../dist-8tWIDoWp.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/file-host-protocol.d.ts

@@ -40,15 +40,6 @@ export interface ControlOps {
 		};
 		readonly output: boolean;
 	};
-	/** Drop a retired table, reporting the rows that went with it (`null`: not there). */
-	readonly dropRetiredTable: {
-		readonly input: {
-			readonly name: string;
-		};
-		readonly output: {
-			readonly rows: number;
-		} | null;
-	};
 	/** Which thread serves this file. */
 	readonly threadId: {
 		readonly input: Record<string, never>;

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Bn-RNanh.js");
+const require_dist = require("../../dist-Ct-4tTeX.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { hn as filesystemBrowseCapability, kr as storageProviderCapability, ni as BaseAddon } from "../../dist-Wy8cTxg6.mjs";
+import { Dr as storageProviderCapability, ei as BaseAddon, pn as filesystemBrowseCapability } from "../../dist-8tWIDoWp.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-CaJjuLHq.js");
+const require_wal_maintenance = require("../../wal-maintenance-DBvuVU9s.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-Bj_MmDkr.mjs";
+import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-BvzVehem.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {