@camstack/system 1.2.464 → 1.2.466

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,96 +1,15 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { $ as PreferenceDeviceIdSchema, $i as isSecretMarker, At as buildDeviceSignatureMessage, D as DEVICE_ENROLLMENT_TTL_MS, Q as PREFERENCES_MAX_VALUE_BYTES, Qt as deviceCredentialsCapability, Ui as defineRecordKinds, a as ApiKeyRecordSchema, b as CredentialTokenClaimsSchema, ei as BaseAddon, et as PreferenceNamespaceSchema, g as CREDENTIAL_TOKEN_AUDIENCE, gt as UserRecordSchema, hn as formatDeviceRevoker, jr as userManagementCapability, k as DEVICE_NONCE_TTL_MS, kt as buildDeviceEnrollmentLink, lt as SsoBridgeClaimsSchema, mt as TokenScopeSchema, na as makeSecretMarker, st as ScopedTokenSchema, tt as PreferenceValueSchema, wn as isCredentialTokenPayload, wt as authProviderCapability, xa as userError } from "../../dist-C2OBCa-A.mjs";
-import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
+import { $ as PreferenceNamespaceSchema, $r as BaseAddon, Ar as userManagementCapability, Ca as userError, Cn as isCredentialTokenPayload, Ct as authProviderCapability, E as DEVICE_ENROLLMENT_TTL_MS, Gi as defineRecordKinds, O as DEVICE_NONCE_TTL_MS, Ot as buildDeviceEnrollmentLink, Q as PreferenceDeviceIdSchema, Z as PREFERENCES_MAX_VALUE_BYTES, Zt as deviceCredentialsCapability, ct as SsoBridgeClaimsSchema, et as PreferenceValueSchema, h as CREDENTIAL_TOKEN_AUDIENCE, ht as UserRecordSchema, ia as makeSecretMarker, kt as buildDeviceSignatureMessage, mn as formatDeviceRevoker, ot as ScopedTokenSchema, pt as TokenScopeSchema, ta as isSecretMarker, y as CredentialTokenClaimsSchema } from "../../dist-CfjkLTZV.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-DZHKlZlD.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-B16Mr3EY.mjs";
+import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
 import * as path$1 from "node:path";
-import * as fs from "node:fs";
-//#region src/auth/parse-record.ts
-function parseRecord$2(kind, schema, data) {
-	try {
-		return schema.parse(data);
-	} catch (err) {
-		const topKeys = data && typeof data === "object" && !Array.isArray(data) ? Object.keys(data).join(", ") || "(empty)" : `(non-object: ${typeof data})`;
-		const detail = err instanceof Error ? err.message : String(err);
-		const hint = data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 1 && "data" in data ? " This shape is the legacy double-wrap from a stale settings-store query path. Restart the server with the latest @camstack/system build." : "";
-		throw new Error(`Failed to parse ${kind} from settings store. Top-level keys=[${topKeys}].${hint} Underlying: ${detail}`, { cause: err });
-	}
-}
-//#endregion
-//#region src/auth/api-key-manager.ts
-/**
-* Legacy API keys — LIST and REVOKE only.
-*
-* No boundary accepts one (the tRPC context has no branch for them) and
-* nothing creates them any more: what is left is the rows a hub may still
-* hold, so an operator can see and delete them. Tokens (`auth.mintToken`) are
-* the credential for scripts and integrations.
-*/
-var import_read_all_rows = require_read_all_rows();
-var API_KEYS_COLLECTION$1 = "api_keys";
-function parseApiKey(data) {
-	return parseRecord$2("api-key", ApiKeyRecordSchema, data);
-}
-function rowToApiKey(id, body) {
-	return parseApiKey({
-		id,
-		...body
-	});
-}
-var ApiKeyManager = class {
-	kind;
-	legacyStore;
-	constructor(deps) {
-		if ("apiKeysKind" in deps) {
-			this.kind = deps.apiKeysKind;
-			this.legacyStore = deps.legacyStore ?? null;
-		} else {
-			this.kind = null;
-			this.legacyStore = deps.getStore();
-		}
-	}
-	get store() {
-		if (this.legacyStore === null) throw new Error("ApiKeyManager: legacy store unavailable on records-only path");
-		return this.legacyStore;
-	}
-	async listAll() {
-		const kind = this.kind;
-		return (kind !== null ? (await (0, import_read_all_rows.readAllRows)(kind)).map((row) => rowToApiKey(row.id, row.data)) : (await this.store.query.query({ collection: API_KEYS_COLLECTION$1 })).map((r) => parseApiKey(r.data))).map((parsed) => {
-			const { tokenHash: _th, ...rest } = parsed;
-			return rest;
-		});
-	}
-	async revoke(id) {
-		const kind = this.kind;
-		if (kind !== null) {
-			await kind.delete(id);
-			return;
-		}
-		await this.store.delete.mutate({
-			collection: API_KEYS_COLLECTION$1,
-			key: id
-		});
-	}
-	async findById(id) {
-		const kind = this.kind;
-		if (kind !== null) {
-			const row = await kind.get(id);
-			return row === null ? null : rowToApiKey(row.id, row.data);
-		}
-		const results = await this.store.query.query({
-			collection: API_KEYS_COLLECTION$1,
-			filter: { where: { id } }
-		});
-		if (results.length === 0) return null;
-		return parseApiKey(results[0].data);
-	}
-};
-//#endregion
+import * as fs$1 from "node:fs";
 //#region ../../node_modules/bcryptjs/index.js
 /**
 * The random implementation to use as a fallback.
@@ -6335,6 +6254,7 @@ var AuthManager = class {
 * cannot be stored is logged loudly instead, and never blocks the action
 * (a login must not fail because the audit table is busy).
 */
+var import_read_all_rows = require_read_all_rows();
 /**
 * @durable class=ledger owner=local-auth
 *   write="one row per audited auth event: a second factor skipped from a trusted
@@ -6389,7 +6309,7 @@ var AUTH_AUDIT_ACTIONS = [
 ];
 var RETENTION_MS = 90 * 864e5;
 var MAX_LIST = 500;
-function parseRecord$1(data) {
+function parseRecord$2(data) {
 	const id = data["id"];
 	const rawAt = data["at"];
 	const at = typeof rawAt === "number" ? rawAt : typeof rawAt === "string" && rawAt.trim() !== "" && Number.isFinite(Number(rawAt)) ? Number(rawAt) : null;
@@ -6482,7 +6402,7 @@ var AuthAuditLog = class {
 			order: "at",
 			desc: true,
 			limit
-		})).records.map((row) => parseRecord$1({
+		})).records.map((row) => parseRecord$2({
 			id: row.id,
 			at: row.at,
 			action: row.data.action,
@@ -6493,7 +6413,7 @@ var AuthAuditLog = class {
 		return (await this.store.query.query({
 			collection: AUTH_AUDIT_COLLECTION,
 			...input.userId !== void 0 ? { filter: { where: { userId: input.userId } } } : {}
-		})).map((row) => parseRecord$1(row.data)).filter((r) => r !== null).toSorted((a, b) => b.at - a.at).slice(0, limit);
+		})).map((row) => parseRecord$2(row.data)).filter((r) => r !== null).toSorted((a, b) => b.at - a.at).slice(0, limit);
 	}
 	/** Delete rows older than 90 days. Returns how many. */
 	async reap() {
@@ -6709,7 +6629,7 @@ var PLATFORMS = [
 	"web",
 	"other"
 ];
-function parseRecord(data) {
+function parseRecord$1(data) {
 	const id = str$1(data, "id");
 	const userId = str$1(data, "userId");
 	const deviceName = str$1(data, "deviceName");
@@ -6774,7 +6694,7 @@ var DeviceCredentialManager = class {
 		const kind = this.deps.deviceCredentialsKind ?? null;
 		if (kind !== null) {
 			for (const row of await (0, import_read_all_rows.readAllRows)(kind)) {
-				const record = parseRecord({
+				const record = parseRecord$1({
 					id: row.id,
 					...row.data
 				});
@@ -6784,7 +6704,7 @@ var DeviceCredentialManager = class {
 		}
 		const rows = await this.store.query.query({ collection: DEVICE_CREDENTIALS_COLLECTION });
 		for (const row of rows) {
-			const record = parseRecord(row.data);
+			const record = parseRecord$1(row.data);
 			if (record !== null) this.records.set(record.id, record);
 		}
 	}
@@ -7205,7 +7125,6 @@ var USERS_COLLECTION$1 = "users";
 *     expiry column and no sweep, so a key lives until someone removes it (or the
 *     destructive `declareCollection` rebuild takes the table)."
 */
-var API_KEYS_COLLECTION = "api_keys";
 /**
 * @durable class=config owner=local-auth
 *   write="none since D895 — the pre-D892 scoped-token rows are kept on disk,
@@ -7294,52 +7213,6 @@ var USERS_COLUMNS = [
 		notNull: true
 	}
 ];
-var API_KEYS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "label",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "isAdmin",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "tokenHash",
-		type: "TEXT",
-		notNull: true,
-		unique: true
-	},
-	{
-		name: "tokenPrefix",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "allowedProviders",
-		type: "JSON"
-	},
-	{
-		name: "allowedDevices",
-		type: "JSON"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "lastUsedAt",
-		type: "INTEGER"
-	}
-];
 var USER_TOTP_COLUMNS = [
 	{
 		name: "userId",
@@ -7457,14 +7330,6 @@ async function declareAuthSchema(store, options) {
 		collection: USERS_COLLECTION$1,
 		columns: USERS_COLUMNS
 	});
-	if (!skip.has("api_keys")) await store.declareCollection.mutate({
-		collection: API_KEYS_COLLECTION,
-		columns: API_KEYS_COLUMNS,
-		indexes: [{
-			name: "idx_api_keys_token_prefix",
-			columns: ["tokenPrefix"]
-		}]
-	});
 	if (!skip.has("scoped_tokens")) await store.declareCollection.mutate({
 		collection: SCOPED_TOKENS_COLLECTION,
 		columns: SCOPED_TOKENS_COLUMNS,
@@ -7538,7 +7403,6 @@ async function declareAuthSchema(store, options) {
 */
 var DAY_MS = 864e5;
 var UserBodySchema = UserRecordSchema.omit({ id: true });
-var ApiKeyBodySchema = ApiKeyRecordSchema.omit({ id: true });
 var ScopedTokenBodySchema = ScopedTokenSchema.omit({ id: true });
 var AdminTokenBodySchema = z.object({
 	createdBy: z.string(),
@@ -7626,18 +7490,6 @@ var _localAuthRecordKinds = defineRecordKinds({
 		}],
 		retention: { none: "row goes only when an operator deletes the user; destructive declareCollection rebuild wipes all accounts" }
 	},
-	"api-keys": {
-		schema: ApiKeyBodySchema,
-		class: "config",
-		writeTrigger: "legacy list/revoke only — nothing creates new API keys",
-		device: "none",
-		at: "none",
-		indexes: [{
-			name: "prefix",
-			fields: ["tokenPrefix"]
-		}],
-		retention: { none: "explicit revoke only" }
-	},
 	"scoped-tokens": {
 		schema: ScopedTokenBodySchema,
 		class: "config",
@@ -7774,7 +7626,6 @@ var _localAuthRecordKinds = defineRecordKinds({
 });
 var localAuthRecordKinds = _localAuthRecordKinds;
 var localAuthUsersRecordKind = _localAuthRecordKinds.users;
-var localAuthApiKeysRecordKind = _localAuthRecordKinds["api-keys"];
 _localAuthRecordKinds["scoped-tokens"];
 _localAuthRecordKinds["admin-tokens"];
 var localAuthLoginSessionsRecordKind = _localAuthRecordKinds["login-sessions"];
@@ -7787,7 +7638,6 @@ var localAuthAuthAuditRecordKind = _localAuthRecordKinds["auth-audit"];
 /** Legacy collections that must not be `declareCollection` once these kinds are live. */
 var LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS = [
 	USERS_COLLECTION$1,
-	API_KEYS_COLLECTION,
 	SCOPED_TOKENS_COLLECTION,
 	ADMIN_TOKENS_COLLECTION,
 	LOGIN_SESSIONS_COLLECTION,
@@ -7800,7 +7650,6 @@ var LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS = [
 function localAuthRecordStoresOf(records) {
 	return {
 		users: records.kind(localAuthUsersRecordKind),
-		apiKeys: records.kind(localAuthApiKeysRecordKind),
 		loginSessions: records.kind(localAuthLoginSessionsRecordKind),
 		loginSessionCutoffs: records.kind(localAuthLoginSessionCutoffsRecordKind),
 		oauthSessions: records.kind(localAuthOauthSessionsRecordKind),
@@ -8720,6 +8569,18 @@ function getUserManagementInternal(provider) {
 	return internal;
 }
 //#endregion
+//#region src/auth/parse-record.ts
+function parseRecord(kind, schema, data) {
+	try {
+		return schema.parse(data);
+	} catch (err) {
+		const topKeys = data && typeof data === "object" && !Array.isArray(data) ? Object.keys(data).join(", ") || "(empty)" : `(non-object: ${typeof data})`;
+		const detail = err instanceof Error ? err.message : String(err);
+		const hint = data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 1 && "data" in data ? " This shape is the legacy double-wrap from a stale settings-store query path. Restart the server with the latest @camstack/system build." : "";
+		throw new Error(`Failed to parse ${kind} from settings store. Top-level keys=[${topKeys}].${hint} Underlying: ${detail}`, { cause: err });
+	}
+}
+//#endregion
 //#region src/auth/user-manager.ts
 var USERS_COLLECTION = "users";
 /**
@@ -8731,7 +8592,7 @@ var USERS_COLLECTION = "users";
 var FIRST_BOOT_ADMIN_USERNAME = "admin";
 var FIRST_BOOT_ADMIN_PASSWORD = "changeme";
 function parseUser(data) {
-	return parseRecord$2("user", UserRecordSchema, data);
+	return parseRecord("user", UserRecordSchema, data);
 }
 function userToBody(user) {
 	const { id: _id, ...body } = user;
@@ -12121,7 +11982,6 @@ function toAuthResult(user) {
 var LocalAuthAddon = class extends BaseAddon {
 	authManager = null;
 	userManager = null;
-	apiKeyManager = null;
 	oauthSessionManager = null;
 	reapTimer = null;
 	totpManager = null;
@@ -12157,10 +12017,6 @@ var LocalAuthAddon = class extends BaseAddon {
 				usersKind: authStores.users,
 				legacyStore: store
 			}, this.authManager);
-			this.apiKeyManager = new ApiKeyManager({
-				apiKeysKind: authStores.apiKeys,
-				legacyStore: store
-			});
 			this.oauthSessionManager = new OauthSessionManager({ oauthSessionsKind: authStores.oauthSessions });
 			this.totpManager = new TotpManager({
 				userTotpKind: authStores.userTotp,
@@ -12208,8 +12064,8 @@ var LocalAuthAddon = class extends BaseAddon {
 					users: this.userManager,
 					dataDir: this.ctx.nodeDataDir,
 					fs: {
-						exists: (filePath) => fs.existsSync(filePath),
-						remove: (filePath) => fs.rmSync(filePath, { force: true })
+						exists: (filePath) => fs$1.existsSync(filePath),
+						remove: (filePath) => fs$1.rmSync(filePath, { force: true })
 					},
 					logger: this.ctx.logger
 				});
@@ -12325,15 +12181,6 @@ var LocalAuthAddon = class extends BaseAddon {
 					totpEnabled
 				};
 			},
-			listApiKeys: async () => {
-				if (!this.apiKeyManager) return [];
-				return this.apiKeyManager.listAll();
-			},
-			revokeApiKey: async (input) => {
-				if (!this.apiKeyManager) throw new Error("API key management not available");
-				await this.apiKeyManager.revoke(input.id);
-				return { success: true };
-			},
 			oauthIssueCode: async (input) => {
 				return lazyOauthGrants().oauthIssueCode(input);
 			},
@@ -12694,7 +12541,6 @@ var LocalAuthAddon = class extends BaseAddon {
 		}
 		this.authManager = null;
 		this.userManager = null;
-		this.apiKeyManager = null;
 		this.oauthSessionManager = null;
 		this.externalIdentities = null;
 		this.loginSessions = null;
@@ -12704,4 +12550,4 @@ var LocalAuthAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { LocalAuthAddon, LocalAuthAddon as default, SettingsReadUnavailableError as _, attachUserManagementInternal as a, DeviceCaStore as c, onSessionsRevoked as d, DeviceCredentialManager as f, parseTokenExpiry as g, AuthManager as h, USER_MANAGEMENT_INTERNAL as i, LoginSessionManager as l, AuthAuditLog as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, PREVIOUS_LEAF_GRACE_MS as p, UserManager as r, preferencesLimitReasonOf as s, FIRST_BOOT_ADMIN_PASSWORD as t, REFRESH_TOKEN_PREFIX as u, isSettingsReadUnavailable as v, ApiKeyManager as y };
+export { LocalAuthAddon, LocalAuthAddon as default, SettingsReadUnavailableError as _, attachUserManagementInternal as a, DeviceCaStore as c, onSessionsRevoked as d, DeviceCredentialManager as f, parseTokenExpiry as g, AuthManager as h, USER_MANAGEMENT_INTERNAL as i, LoginSessionManager as l, AuthAuditLog as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, PREVIOUS_LEAF_GRACE_MS as p, UserManager as r, preferencesLimitReasonOf as s, FIRST_BOOT_ADMIN_PASSWORD as t, REFRESH_TOKEN_PREFIX as u, isSettingsReadUnavailable as v };

package/dist/builtins/local-auth/record-kinds.d.ts

@@ -10,12 +10,10 @@
 * `scoped-tokens` and `admin-tokens` hold pre-D892 rows read by nothing since
 * D895; they stay declared so the layout is unchanged.
 */
-import { ApiKeyRecordSchema, type DefinedRecordKind, type RecordKindHandle, type RecordsAccess, ScopedTokenSchema, TokenScopeSchema, UserRecordSchema } from "@camstack/types";
+import { type DefinedRecordKind, type RecordKindHandle, type RecordsAccess, ScopedTokenSchema, TokenScopeSchema, UserRecordSchema } from "@camstack/types";
 import { z } from "zod";
 export type UserBody = Omit<z.infer<typeof UserRecordSchema>, "id">;
 export declare const UserBodySchema: z.ZodType<UserBody>;
-export type ApiKeyBody = Omit<z.infer<typeof ApiKeyRecordSchema>, "id">;
-export declare const ApiKeyBodySchema: z.ZodType<ApiKeyBody>;
 export type ScopedTokenBody = Omit<z.infer<typeof ScopedTokenSchema>, "id">;
 export declare const ScopedTokenBodySchema: z.ZodType<ScopedTokenBody>;
 export type AdminTokenBody = {
@@ -103,7 +101,6 @@ export type AuthAuditBody = {
 export declare const AuthAuditBodySchema: z.ZodType<AuthAuditBody>;
 export type LocalAuthRecordKindsMap = {
 	readonly users: DefinedRecordKind<z.ZodType<UserBody>>;
-	readonly "api-keys": DefinedRecordKind<z.ZodType<ApiKeyBody>>;
 	readonly "scoped-tokens": DefinedRecordKind<z.ZodType<ScopedTokenBody>>;
 	readonly "admin-tokens": DefinedRecordKind<z.ZodType<AdminTokenBody>>;
 	readonly "login-sessions": DefinedRecordKind<z.ZodType<LoginSessionBody>>;
@@ -116,7 +113,6 @@ export type LocalAuthRecordKindsMap = {
 };
 export declare const localAuthRecordKinds: LocalAuthRecordKindsMap;
 export declare const localAuthUsersRecordKind: DefinedRecordKind<z.ZodType<UserBody>>;
-export declare const localAuthApiKeysRecordKind: DefinedRecordKind<z.ZodType<ApiKeyBody>>;
 export declare const localAuthScopedTokensRecordKind: DefinedRecordKind<z.ZodType<ScopedTokenBody>>;
 export declare const localAuthAdminTokensRecordKind: DefinedRecordKind<z.ZodType<AdminTokenBody>>;
 export declare const localAuthLoginSessionsRecordKind: DefinedRecordKind<z.ZodType<LoginSessionBody>>;
@@ -130,7 +126,6 @@ export declare const localAuthAuthAuditRecordKind: DefinedRecordKind<z.ZodType<A
 export declare const LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS: readonly string[];
 export interface LocalAuthRecordStores {
 	readonly users: RecordKindHandle<UserBody>;
-	readonly apiKeys: RecordKindHandle<ApiKeyBody>;
 	readonly loginSessions: RecordKindHandle<LoginSessionBody>;
 	readonly loginSessionCutoffs: RecordKindHandle<LoginSessionCutoffBody>;
 	readonly oauthSessions: RecordKindHandle<OauthSessionBody>;

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D9aw_d0G.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CFlhVKK6.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CWkX17zX.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { $r as errMsg, Ca as EventCategory, Fn as localNetworkCapability, Ft as checkRoleAddress, H as HUB_MDNS_TXT_KEYS, Nr as validateCustomAddress, Tn as isDefaultAppConnectionEndpoint, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, Zn as pickAppLinkHub, ei as BaseAddon, l as CAMSTACK_APP_LINK_ORIGIN, or as resolveAppConnections, pr as resolveNotificationTapAddress, ur as resolveHubAddressRoles, xn as isAppLinkBase, yr as shortHostname } from "../../dist-C2OBCa-A.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-Bm09NrMS.mjs";
+import { $r as BaseAddon, B as HUB_MDNS_SERVICE_TYPE, Mr as validateCustomAddress, Pn as localNetworkCapability, Pt as checkRoleAddress, Qr as errMsg, Ta as EventCategory, V as HUB_MDNS_TXT_KEYS, X as NetworkTunnelStartedDataSchema, Xn as pickAppLinkHub, ar as resolveAppConnections, bn as isAppLinkBase, c as CAMSTACK_APP_LINK_ORIGIN, fr as resolveNotificationTapAddress, lr as resolveHubAddressRoles, vr as shortHostname, wn as isDefaultAppConnectionEndpoint } from "../../dist-CfjkLTZV.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-CtHQEnb3.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D9aw_d0G.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 const require_log_read_filter = require("../../log-read-filter-Bi066jwU.js");
 let zod = require("zod");
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Ln as logDestinationCapability, ei as BaseAddon } from "../../dist-C2OBCa-A.mjs";
+import { $r as BaseAddon, In as logDestinationCapability } from "../../dist-CfjkLTZV.mjs";
 import { n as compileLogFilter, o as lineMatches } from "../../log-read-filter-D7Ev3zm-.mjs";
 import { z } from "zod";
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D9aw_d0G.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 let node_fs_promises = require("node:fs/promises");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,9 +1,9 @@
-import { $r as errMsg, Bi as createEvent, Ca as EventCategory, Un as metricsProviderCapability, ei as BaseAddon, ht as UNATTRIBUTED_BUCKET_KEY, ir as reducePoints, mn as foldSnapshotByFunction, rt as ROOT_BUCKET_KEY, sr as resolveBucketMs } from "../../dist-C2OBCa-A.mjs";
+import { $r as BaseAddon, Hi as createEvent, Hn as metricsProviderCapability, Qr as errMsg, Ta as EventCategory, mt as UNATTRIBUTED_BUCKET_KEY, nt as ROOT_BUCKET_KEY, or as resolveBucketMs, pn as foldSnapshotByFunction, rr as reducePoints } from "../../dist-CfjkLTZV.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";
 import { platform } from "node:os";
-import * as fs from "node:fs";
+import * as fs$1 from "node:fs";
 import { constants, readFileSync } from "node:fs";
 import { execFile, execFileSync } from "node:child_process";
 //#region src/builtins/native-metrics/cgroup-memory.ts
@@ -1642,7 +1642,7 @@ var NativeMetricsProvider = class {
 		let swapUsedBytes = 0;
 		let swapTotalBytes = 0;
 		if (IS_LINUX) try {
-			const meminfo = fs.readFileSync("/proc/meminfo", "utf-8");
+			const meminfo = fs$1.readFileSync("/proc/meminfo", "utf-8");
 			const swapTotal = parseInt(meminfo.match(/SwapTotal:\s+(\d+)/)?.[1] ?? "0", 10) * 1024;
 			const swapFree = parseInt(meminfo.match(/SwapFree:\s+(\d+)/)?.[1] ?? "0", 10) * 1024;
 			swapTotalBytes = swapTotal;
@@ -1720,7 +1720,7 @@ function sampleMacMemory(provider) {
 }
 function getDiskSpaceInternal(dirPath) {
 	return new Promise((resolve, reject) => {
-		fs.statfs(dirPath, (err, stats) => {
+		fs$1.statfs(dirPath, (err, stats) => {
 			if (err) return reject(err);
 			const totalBytes = stats.blocks * stats.bsize;
 			const availableBytes = stats.bavail * stats.bsize;
@@ -1738,7 +1738,7 @@ function getDiskSpaceInternal(dirPath) {
 async function takeDiskIoSnapshot() {
 	const now = Date.now();
 	if (IS_LINUX) try {
-		const data = fs.readFileSync("/proc/diskstats", "utf-8");
+		const data = fs$1.readFileSync("/proc/diskstats", "utf-8");
 		let readOps = 0, readBytes = 0, writeOps = 0, writeBytes = 0;
 		for (const line of data.split("\n")) {
 			const parts = line.trim().split(/\s+/);
@@ -1769,7 +1769,7 @@ async function takeDiskIoSnapshot() {
 async function takeNetworkIoSnapshot() {
 	const now = Date.now();
 	if (IS_LINUX) try {
-		const data = fs.readFileSync("/proc/net/dev", "utf-8");
+		const data = fs$1.readFileSync("/proc/net/dev", "utf-8");
 		let rxBytes = 0, txBytes = 0, rxPackets = 0, txPackets = 0, rxErrors = 0, txErrors = 0;
 		for (const line of data.split("\n")) {
 			const match = line.match(/^\s*(\w+):\s+(.+)$/);
@@ -1830,7 +1830,7 @@ async function takeNetworkIoSnapshot() {
 }
 async function getCpuTemperatureInternal() {
 	if (IS_LINUX) for (const p of ["/sys/class/thermal/thermal_zone0/temp", "/sys/class/hwmon/hwmon0/temp1_input"]) try {
-		const raw = fs.readFileSync(p, "utf-8").trim();
+		const raw = fs$1.readFileSync(p, "utf-8").trim();
 		const millideg = parseInt(raw, 10);
 		if (!isNaN(millideg)) return Math.round(millideg / 100) / 10;
 	} catch {
@@ -1881,10 +1881,10 @@ function getProcessResources() {
 	let threadCount = 0;
 	if (IS_LINUX) {
 		try {
-			openFds = fs.readdirSync(`/proc/${process.pid}/fd`).length;
+			openFds = fs$1.readdirSync(`/proc/${process.pid}/fd`).length;
 		} catch {}
 		try {
-			const match = fs.readFileSync(`/proc/${process.pid}/status`, "utf-8").match(/Threads:\s+(\d+)/);
+			const match = fs$1.readFileSync(`/proc/${process.pid}/status`, "utf-8").match(/Threads:\s+(\d+)/);
 			if (match) threadCount = parseInt(match[1], 10);
 		} catch {}
 	}
@@ -1899,7 +1899,7 @@ function getProcessResources() {
 function getPressure(resource) {
 	if (!IS_LINUX) return null;
 	try {
-		const data = fs.readFileSync(`/proc/pressure/${resource}`, "utf-8");
+		const data = fs$1.readFileSync(`/proc/pressure/${resource}`, "utf-8");
 		const parseLine = (prefix) => {
 			const match = data.match(new RegExp(`${prefix} avg10=(\\d+\\.\\d+) avg60=(\\d+\\.\\d+) avg300=(\\d+\\.\\d+)`));
 			if (!match) return null;

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D9aw_d0G.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 const require_coral_accelerators = require("../../coral-accelerators-oUXmmbc2.js");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/platform-probe/index.mjs

@@ -1,9 +1,9 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { $n as platformProbeCapability, $r as errMsg, Ca as EventCategory, Gi as emitReadiness, _r as scoreRuntimes, an as enumerateInferenceDevices, ei as BaseAddon } from "../../dist-C2OBCa-A.mjs";
-import { n as nodeCoralFs, t as classifyCoralAccelerator } from "../../coral-accelerators-D_S1Fo5h.mjs";
+import { $r as BaseAddon, Qn as platformProbeCapability, Qr as errMsg, Ta as EventCategory, gr as scoreRuntimes, in as enumerateInferenceDevices, qi as emitReadiness } from "../../dist-CfjkLTZV.mjs";
+import { n as nodeCoralFs, t as classifyCoralAccelerator } from "../../coral-accelerators-Qhn5TOYZ.mjs";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";
-import * as fs from "node:fs";
+import * as fs$1 from "node:fs";
 import { execFile } from "node:child_process";
 //#region src/builtins/platform-probe/amd-npu.ts
 var amd_npu_exports = /* @__PURE__ */ __exportAll({
@@ -448,14 +448,14 @@ var PlatformScorer = class {
 			if (nvidia) gpu = nvidia;
 			const listRenderNodes = () => {
 				try {
-					return fs.readdirSync("/dev/dri").filter((n) => n.startsWith("renderD")).map((n) => `/dev/dri/${n}`);
+					return fs$1.readdirSync("/dev/dri").filter((n) => n.startsWith("renderD")).map((n) => `/dev/dri/${n}`);
 				} catch {
 					return [];
 				}
 			};
 			const readDrmAttr = (node, attr) => {
 				try {
-					return fs.readFileSync(`/sys/class/drm/${node.split("/").pop()}/device/${attr}`, "utf8");
+					return fs$1.readFileSync(`/sys/class/drm/${node.split("/").pop()}/device/${attr}`, "utf8");
 				} catch {
 					return "";
 				}
@@ -481,12 +481,12 @@ var PlatformScorer = class {
 			}
 			const listDir = (p) => {
 				try {
-					return fs.readdirSync(p);
+					return fs$1.readdirSync(p);
 				} catch {
 					return [];
 				}
 			};
-			const exists = (p) => fs.existsSync(p);
+			const exists = (p) => fs$1.existsSync(p);
 			if (!npu) {
 				const { classifyIntelNpu } = await import("../../intel-npu-C8HKvRQF.mjs");
 				npu = classifyIntelNpu({
@@ -514,7 +514,7 @@ var PlatformScorer = class {
 					exists,
 					readFile: (p) => {
 						try {
-							return fs.readFileSync(p, "utf8");
+							return fs$1.readFileSync(p, "utf8");
 						} catch {
 							return "";
 						}

package/dist/builtins/record-entries/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D9aw_d0G.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/record-entries/index.mjs

@@ -1,4 +1,4 @@
-import { da as recordSecretRef, ei as BaseAddon, ki as UnknownRecordKindError, nr as recordEntriesCapability, ra as mapSecretLeaves, ui as InvalidRecordError } from "../../dist-C2OBCa-A.mjs";
+import { $r as BaseAddon, Ai as UnknownRecordKindError, aa as mapSecretLeaves, li as InvalidRecordError, pa as recordSecretRef, tr as recordEntriesCapability } from "../../dist-CfjkLTZV.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D9aw_d0G.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ca as EventCategory, ei as BaseAddon } from "../../dist-C2OBCa-A.mjs";
+import { $r as BaseAddon, Ta as EventCategory } from "../../dist-CfjkLTZV.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D9aw_d0G.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");