@camstack/system 1.2.47 → 1.2.49

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Pt as EventCategory, ct as BaseAddon, m as addonPagesCapability, st as errMsg } from "../../dist-BRBfh1_9.mjs";
+import { Rt as EventCategory, dt as errMsg, ft as BaseAddon, m as addonPagesCapability } from "../../dist-C7rPTQLR.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Pt as EventCategory, ct as BaseAddon, g as addonWidgetsCapability, st as errMsg } from "../../dist-BRBfh1_9.mjs";
+import { Rt as EventCategory, dt as errMsg, ft as BaseAddon, g as addonWidgetsCapability } from "../../dist-C7rPTQLR.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Pt as EventCategory, _ as alertsCapability, ct as BaseAddon, n as AlertSchema, st as errMsg, xt as createEvent } from "../../dist-BRBfh1_9.mjs";
+import { Rt as EventCategory, Tt as createEvent, _ as alertsCapability, dt as errMsg, ft as BaseAddon, n as AlertSchema } from "../../dist-C7rPTQLR.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 let node_fs = require("node:fs");
 let node_fs$1 = require_chunk.__toESM(node_fs, 1);
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Pt as EventCategory, b as backupCapability, ct as BaseAddon } from "../../dist-BRBfh1_9.mjs";
+import { Rt as EventCategory, b as backupCapability, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
 import * as fs from "node:fs";
 import Kt from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { H as logDestinationCapability, ct as BaseAddon } from "../../dist-BRBfh1_9.mjs";
+import { W as logDestinationCapability, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
 let node_crypto = require("node:crypto");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { S as coreBlocksCapability, ct as BaseAddon, o as CoreBlockSchema } from "../../dist-BRBfh1_9.mjs";
+import { S as coreBlocksCapability, ft as BaseAddon, o as CoreBlockSchema } from "../../dist-C7rPTQLR.mjs";
 import * as path$1 from "node:path";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { A as enumerateSchemaFields, E as deviceStatusCapability, Et as isDeviceConfigCap, J as parseStreamParamsFormPatch, K as normalizeUnit, Nt as sleep, P as getByPath, Pt as EventCategory, Q as setByPath, T as deviceStateCapability, _t as WELL_KNOWN_TAB_MAP, a as CAP_NAMES_WITH_STATUS, ct as BaseAddon, ft as DeviceFeature, it as toExpressionValue, j as evaluateLinkExpression, k as enumerateItemArrayFields, mt as DeviceType, ot as validateExpressionSource, pt as DeviceRole, s as DeviceStatusSchema, st as errMsg, t as ALL_CAPABILITY_DEFINITIONS, u as STREAM_PROFILE_META, v as applyTransform, w as deviceManagerCapability, x as buildStreamParamsConfigSchema } from "../../dist-BRBfh1_9.mjs";
+import { At as isDeviceConfigCap, D as deviceStateCapability, E as deviceManagerCapability, I as getByPath, J as normalizeUnit, Lt as sleep, M as enumerateSchemaFields, N as evaluateLinkExpression, O as deviceStatusCapability, Rt as EventCategory, X as parseStreamParamsFormPatch, _t as DeviceRole, a as CAP_NAMES_WITH_STATUS, ct as validateExpressionSource, dt as errMsg, et as setByPath, ft as BaseAddon, gt as DeviceFeature, j as enumerateItemArrayFields, ot as toExpressionValue, s as DeviceStatusSchema, t as ALL_CAPABILITY_DEFINITIONS, u as STREAM_PROFILE_META, v as applyTransform, vt as DeviceType, x as buildStreamParamsConfigSchema, xt as WELL_KNOWN_TAB_MAP } from "../../dist-C7rPTQLR.mjs";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { D as doorbellCapability, Pt as EventCategory, ct as BaseAddon, mt as DeviceType, st as errMsg, xt as createEvent } from "../../dist-BRBfh1_9.mjs";
+import { Rt as EventCategory, Tt as createEvent, dt as errMsg, ft as BaseAddon, k as doorbellCapability, vt as DeviceType } from "../../dist-C7rPTQLR.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { H as logDestinationCapability, ct as BaseAddon } from "../../dist-BRBfh1_9.mjs";
+import { W as logDestinationCapability, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Pt as EventCategory, ct as BaseAddon, st as errMsg, xt as createEvent } from "../../dist-BRBfh1_9.mjs";
+import { Rt as EventCategory, Tt as createEvent, dt as errMsg, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { at as userManagementCapability, ct as BaseAddon, d as ScopedTokenSchema, p as UserRecordSchema, r as ApiKeyRecordSchema, y as authProviderCapability } from "../../dist-BRBfh1_9.mjs";
+import { d as ScopedTokenSchema, ft as BaseAddon, p as UserRecordSchema, r as ApiKeyRecordSchema, st as userManagementCapability, y as authProviderCapability } from "../../dist-C7rPTQLR.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomUUID } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Pt as EventCategory, V as localNetworkCapability, ct as BaseAddon } from "../../dist-BRBfh1_9.mjs";
+import { Rt as EventCategory, U as localNetworkCapability, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { H as logDestinationCapability, ct as BaseAddon } from "../../dist-BRBfh1_9.mjs";
+import { W as logDestinationCapability, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { G as metricsProviderCapability, Pt as EventCategory, ct as BaseAddon, xt as createEvent } from "../../dist-BRBfh1_9.mjs";
+import { Rt as EventCategory, Tt as createEvent, ft as BaseAddon, q as metricsProviderCapability } from "../../dist-C7rPTQLR.mjs";
 import * as fs from "node:fs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Ct as emitReadiness, O as enumerateInferenceDevices, Pt as EventCategory, Y as platformProbeCapability, Z as scoreRuntimes, ct as BaseAddon, st as errMsg } from "../../dist-BRBfh1_9.mjs";
+import { $ as scoreRuntimes, A as enumerateInferenceDevices, Dt as emitReadiness, Rt as EventCategory, Z as platformProbeCapability, dt as errMsg, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Pt as EventCategory, ct as BaseAddon } from "../../dist-BRBfh1_9.mjs";
+import { Rt as EventCategory, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 let node_child_process = require("node:child_process");
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Dt as nodePin, ct as BaseAddon, et as snapshotCapability, ft as DeviceFeature, i as BatteryStatusSchema, mt as DeviceType, rt as streamQualityLabel, st as errMsg } from "../../dist-BRBfh1_9.mjs";
+import { at as streamQualityLabel, dt as errMsg, ft as BaseAddon, gt as DeviceFeature, i as BatteryStatusSchema, jt as nodePin, nt as snapshotCapability, vt as DeviceType } from "../../dist-C7rPTQLR.mjs";
 import { execFile, spawn } from "node:child_process";
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/sqlite-storage/filesystem-storage-provider.d.ts

@@ -1,5 +1,5 @@
-import { z } from 'zod';
 import { IStorageProviderImpl, StorageLocation, StorageProviderInfoSchema } from '@camstack/types';
+import { z } from 'zod';
 type StorageProviderInfo = z.infer<typeof StorageProviderInfoSchema>;
 export declare class FilesystemStorageProvider implements IStorageProviderImpl {
     static readonly providerId = "filesystem-storage";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CKjrL1qP.js");
+const require_dist = require("../../dist-CH0DyAwh.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");
@@ -11,6 +11,69 @@ node_path = require_chunk.__toESM(node_path);
 let node_crypto = require("node:crypto");
 let node_os = require("node:os");
 let node_fs_promises = require("node:fs/promises");
+//#region src/builtins/sqlite-storage/path-guard.ts
+/**
+* Allowed-root containment guard for the filesystem-browse cap. Pure +
+* synchronous so it is trivially unit-testable; the provider applies it AFTER
+* resolving the real path (so symlink escapes are also caught upstream).
+*/
+/** True iff `candidate` is one of, or nested under, an allowed root. */
+function isWithinAllowedRoots(candidate, allowedRoots) {
+	const norm = (0, node_path.resolve)(candidate);
+	return allowedRoots.some((root) => {
+		const r = (0, node_path.resolve)(root);
+		return norm === r || norm.startsWith(r.endsWith(node_path.sep) ? r : r + node_path.sep);
+	});
+}
+/** Throws unless `candidate` is within an allowed root. */
+function assertWithinAllowedRoots(candidate, allowedRoots) {
+	if (!isWithinAllowedRoots(candidate, allowedRoots)) throw new Error(`path "${candidate}" is not within an allowed root`);
+}
+//#endregion
+//#region src/builtins/sqlite-storage/filesystem-browse-provider.ts
+/**
+* Per-node filesystem-browse provider. Lists/creates directories under
+* operator-configured allowed roots only (sandboxed by `path-guard`). Backs the
+* `filesystem-browse` cap so the admin UI can pick a node + path for a
+* node-local storage location.
+*/
+var FilesystemBrowseProvider = class {
+	allowedRoots;
+	/** allowedRoots is injected (read from addon config) so it stays per-node + testable. */
+	constructor(allowedRoots) {
+		this.allowedRoots = allowedRoots;
+	}
+	async listAllowedRoots() {
+		return [...this.allowedRoots()];
+	}
+	async browse({ path }) {
+		const real = await (0, node_fs_promises.realpath)(path).catch(() => path);
+		assertWithinAllowedRoots(real, await this.resolvedRoots());
+		const entries = (await (0, node_fs_promises.readdir)(real, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => ({
+			name: d.name,
+			path: (0, node_path.join)(real, d.name)
+		}));
+		const fs = await (0, node_fs_promises.statfs)(real);
+		const totalBytes = fs.blocks * fs.bsize;
+		return {
+			path: real,
+			entries,
+			freeBytes: fs.bavail * fs.bsize,
+			totalBytes
+		};
+	}
+	async createDir({ path }) {
+		const parent = (0, node_path.dirname)(path);
+		assertWithinAllowedRoots((0, node_path.join)(await (0, node_fs_promises.realpath)(parent).catch(() => parent), (0, node_path.basename)(path)), await this.resolvedRoots());
+		await (0, node_fs_promises.mkdir)(path, { recursive: true });
+		return { path };
+	}
+	/** Allowed roots with symlinks resolved (falls back to the raw root if it does not exist). */
+	async resolvedRoots() {
+		return Promise.all(this.allowedRoots().map((r) => (0, node_fs_promises.realpath)(r).catch(() => r)));
+	}
+};
+//#endregion
 //#region src/builtins/sqlite-storage/filesystem-storage-provider.ts
 /**
 * Filesystem `storage-provider` (Task 7).
@@ -272,69 +335,6 @@ var FilesystemStorageProvider = class FilesystemStorageProvider {
 	}
 };
 //#endregion
-//#region src/builtins/sqlite-storage/path-guard.ts
-/**
-* Allowed-root containment guard for the filesystem-browse cap. Pure +
-* synchronous so it is trivially unit-testable; the provider applies it AFTER
-* resolving the real path (so symlink escapes are also caught upstream).
-*/
-/** True iff `candidate` is one of, or nested under, an allowed root. */
-function isWithinAllowedRoots(candidate, allowedRoots) {
-	const norm = (0, node_path.resolve)(candidate);
-	return allowedRoots.some((root) => {
-		const r = (0, node_path.resolve)(root);
-		return norm === r || norm.startsWith(r.endsWith(node_path.sep) ? r : r + node_path.sep);
-	});
-}
-/** Throws unless `candidate` is within an allowed root. */
-function assertWithinAllowedRoots(candidate, allowedRoots) {
-	if (!isWithinAllowedRoots(candidate, allowedRoots)) throw new Error(`path "${candidate}" is not within an allowed root`);
-}
-//#endregion
-//#region src/builtins/sqlite-storage/filesystem-browse-provider.ts
-/**
-* Per-node filesystem-browse provider. Lists/creates directories under
-* operator-configured allowed roots only (sandboxed by `path-guard`). Backs the
-* `filesystem-browse` cap so the admin UI can pick a node + path for a
-* node-local storage location.
-*/
-var FilesystemBrowseProvider = class {
-	allowedRoots;
-	/** allowedRoots is injected (read from addon config) so it stays per-node + testable. */
-	constructor(allowedRoots) {
-		this.allowedRoots = allowedRoots;
-	}
-	async listAllowedRoots() {
-		return [...this.allowedRoots()];
-	}
-	async browse({ path }) {
-		const real = await (0, node_fs_promises.realpath)(path).catch(() => path);
-		assertWithinAllowedRoots(real, await this.resolvedRoots());
-		const entries = (await (0, node_fs_promises.readdir)(real, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => ({
-			name: d.name,
-			path: (0, node_path.join)(real, d.name)
-		}));
-		const fs = await (0, node_fs_promises.statfs)(real);
-		const totalBytes = fs.blocks * fs.bsize;
-		return {
-			path: real,
-			entries,
-			freeBytes: fs.bavail * fs.bsize,
-			totalBytes
-		};
-	}
-	async createDir({ path }) {
-		const parent = (0, node_path.dirname)(path);
-		assertWithinAllowedRoots((0, node_path.join)(await (0, node_fs_promises.realpath)(parent).catch(() => parent), (0, node_path.basename)(path)), await this.resolvedRoots());
-		await (0, node_fs_promises.mkdir)(path, { recursive: true });
-		return { path };
-	}
-	/** Allowed roots with symlinks resolved (falls back to the raw root if it does not exist). */
-	async resolvedRoots() {
-		return Promise.all(this.allowedRoots().map((r) => (0, node_fs_promises.realpath)(r).catch(() => r)));
-	}
-};
-//#endregion
 //#region src/builtins/sqlite-storage/filesystem-storage.addon.ts
 function defaultAllowedRoots() {
 	return [

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,10 +1,73 @@
-import { N as filesystemBrowseCapability, ct as BaseAddon, nt as storageProviderCapability } from "../../dist-BRBfh1_9.mjs";
+import { F as filesystemBrowseCapability, ft as BaseAddon, it as storageProviderCapability } from "../../dist-C7rPTQLR.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
+//#region src/builtins/sqlite-storage/path-guard.ts
+/**
+* Allowed-root containment guard for the filesystem-browse cap. Pure +
+* synchronous so it is trivially unit-testable; the provider applies it AFTER
+* resolving the real path (so symlink escapes are also caught upstream).
+*/
+/** True iff `candidate` is one of, or nested under, an allowed root. */
+function isWithinAllowedRoots(candidate, allowedRoots) {
+	const norm = resolve(candidate);
+	return allowedRoots.some((root) => {
+		const r = resolve(root);
+		return norm === r || norm.startsWith(r.endsWith(sep) ? r : r + sep);
+	});
+}
+/** Throws unless `candidate` is within an allowed root. */
+function assertWithinAllowedRoots(candidate, allowedRoots) {
+	if (!isWithinAllowedRoots(candidate, allowedRoots)) throw new Error(`path "${candidate}" is not within an allowed root`);
+}
+//#endregion
+//#region src/builtins/sqlite-storage/filesystem-browse-provider.ts
+/**
+* Per-node filesystem-browse provider. Lists/creates directories under
+* operator-configured allowed roots only (sandboxed by `path-guard`). Backs the
+* `filesystem-browse` cap so the admin UI can pick a node + path for a
+* node-local storage location.
+*/
+var FilesystemBrowseProvider = class {
+	allowedRoots;
+	/** allowedRoots is injected (read from addon config) so it stays per-node + testable. */
+	constructor(allowedRoots) {
+		this.allowedRoots = allowedRoots;
+	}
+	async listAllowedRoots() {
+		return [...this.allowedRoots()];
+	}
+	async browse({ path }) {
+		const real = await realpath(path).catch(() => path);
+		assertWithinAllowedRoots(real, await this.resolvedRoots());
+		const entries = (await readdir(real, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => ({
+			name: d.name,
+			path: join(real, d.name)
+		}));
+		const fs = await statfs(real);
+		const totalBytes = fs.blocks * fs.bsize;
+		return {
+			path: real,
+			entries,
+			freeBytes: fs.bavail * fs.bsize,
+			totalBytes
+		};
+	}
+	async createDir({ path }) {
+		const parent = dirname(path);
+		assertWithinAllowedRoots(join(await realpath(parent).catch(() => parent), basename(path)), await this.resolvedRoots());
+		await mkdir(path, { recursive: true });
+		return { path };
+	}
+	/** Allowed roots with symlinks resolved (falls back to the raw root if it does not exist). */
+	async resolvedRoots() {
+		return Promise.all(this.allowedRoots().map((r) => realpath(r).catch(() => r)));
+	}
+};
+//#endregion
 //#region src/builtins/sqlite-storage/filesystem-storage-provider.ts
 /**
 * Filesystem `storage-provider` (Task 7).
@@ -266,69 +329,6 @@ var FilesystemStorageProvider = class FilesystemStorageProvider {
 	}
 };
 //#endregion
-//#region src/builtins/sqlite-storage/path-guard.ts
-/**
-* Allowed-root containment guard for the filesystem-browse cap. Pure +
-* synchronous so it is trivially unit-testable; the provider applies it AFTER
-* resolving the real path (so symlink escapes are also caught upstream).
-*/
-/** True iff `candidate` is one of, or nested under, an allowed root. */
-function isWithinAllowedRoots(candidate, allowedRoots) {
-	const norm = resolve(candidate);
-	return allowedRoots.some((root) => {
-		const r = resolve(root);
-		return norm === r || norm.startsWith(r.endsWith(sep) ? r : r + sep);
-	});
-}
-/** Throws unless `candidate` is within an allowed root. */
-function assertWithinAllowedRoots(candidate, allowedRoots) {
-	if (!isWithinAllowedRoots(candidate, allowedRoots)) throw new Error(`path "${candidate}" is not within an allowed root`);
-}
-//#endregion
-//#region src/builtins/sqlite-storage/filesystem-browse-provider.ts
-/**
-* Per-node filesystem-browse provider. Lists/creates directories under
-* operator-configured allowed roots only (sandboxed by `path-guard`). Backs the
-* `filesystem-browse` cap so the admin UI can pick a node + path for a
-* node-local storage location.
-*/
-var FilesystemBrowseProvider = class {
-	allowedRoots;
-	/** allowedRoots is injected (read from addon config) so it stays per-node + testable. */
-	constructor(allowedRoots) {
-		this.allowedRoots = allowedRoots;
-	}
-	async listAllowedRoots() {
-		return [...this.allowedRoots()];
-	}
-	async browse({ path }) {
-		const real = await realpath(path).catch(() => path);
-		assertWithinAllowedRoots(real, await this.resolvedRoots());
-		const entries = (await readdir(real, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => ({
-			name: d.name,
-			path: join(real, d.name)
-		}));
-		const fs = await statfs(real);
-		const totalBytes = fs.blocks * fs.bsize;
-		return {
-			path: real,
-			entries,
-			freeBytes: fs.bavail * fs.bsize,
-			totalBytes
-		};
-	}
-	async createDir({ path }) {
-		const parent = dirname(path);
-		assertWithinAllowedRoots(join(await realpath(parent).catch(() => parent), basename(path)), await this.resolvedRoots());
-		await mkdir(path, { recursive: true });
-		return { path };
-	}
-	/** Allowed roots with symlinks resolved (falls back to the raw root if it does not exist). */
-	async resolvedRoots() {
-		return Promise.all(this.allowedRoots().map((r) => realpath(r).catch(() => r)));
-	}
-};
-//#endregion
 //#region src/builtins/sqlite-storage/filesystem-storage.addon.ts
 function defaultAllowedRoots() {
 	return [

package/dist/builtins/sqlite-storage/index.d.ts

@@ -1,8 +1,7 @@
+export { ConfigStore } from './config-store.js';
+export type { DeviceRow } from './device-store.js';
+export { DeviceStore } from './device-store.js';
+export { FilesystemStorageAddon, FilesystemStorageAddon as default, } from './filesystem-storage.addon.js';
 export { FilesystemStorageProvider } from './filesystem-storage-provider.js';
-export { FilesystemStorageAddon } from './filesystem-storage.addon.js';
-export { SqliteSettingsBackend } from './sqlite-settings-backend.js';
 export { SqliteSettingsAddon } from './sqlite-settings.addon.js';
-export { DeviceStore } from './device-store.js';
-export type { DeviceRow } from './device-store.js';
-export { ConfigStore } from './config-store.js';
-export { FilesystemStorageAddon as default } from './filesystem-storage.addon.js';
+export { SqliteSettingsBackend } from './sqlite-settings-backend.js';