@camstack/system 1.2.474 → 1.2.476

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,6 +1,6 @@
-import { $i as hydrateSchema, $n as planComposition, Bt as coreBlockComposition, Hi as collectSecretMarkerRefs, Hr as composedDeviceRef, Ht as coreBlockSourceKind, Kn as normalizeCoreBlockWrite, N as DeclaredDevices, Nr as validateComposition, Ot as buildCapabilityLookup, Rt as compositionSourceRefs, Ta as transformSecretWrite, Ut as coreBlocksCapability, Vt as coreBlockIdFromAddonId, Zt as describeComposableCaps, ei as errMsg, f as COMPOSER_RUNNER_ID, ia as isSecretMarker, lr as resolveCoreBlockEntry, m as CORE_BLOCK_ADDON_PREFIX, oa as isSecretRefOwnedBy, or as replacedFieldKeys, p as CORE_BLOCKS_ADDON_ID, qi as defineRecordKinds, qr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, ti as BaseAddon, ur as resolveCoreBlockFiles, v as CoreBlockSchema, va as resolveSecretMarkers, xa as secretTreeFromSchema, zt as coreBlockAddonId } from "../../dist-BugavoVR.mjs";
+import { $i as hydrateSchema, $n as planComposition, Bt as coreBlockComposition, Hi as collectSecretMarkerRefs, Hr as composedDeviceRef, Ht as coreBlockSourceKind, Kn as normalizeCoreBlockWrite, N as DeclaredDevices, Nr as validateComposition, Ot as buildCapabilityLookup, Rt as compositionSourceRefs, Ta as transformSecretWrite, Ut as coreBlocksCapability, Vt as coreBlockIdFromAddonId, Zt as describeComposableCaps, ei as errMsg, f as COMPOSER_RUNNER_ID, ia as isSecretMarker, lr as resolveCoreBlockEntry, m as CORE_BLOCK_ADDON_PREFIX, oa as isSecretRefOwnedBy, or as replacedFieldKeys, p as CORE_BLOCKS_ADDON_ID, qi as defineRecordKinds, qr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, ti as BaseAddon, ur as resolveCoreBlockFiles, v as CoreBlockSchema, va as resolveSecretMarkers, xa as secretTreeFromSchema, zt as coreBlockAddonId } from "../../dist-B_V9r61Z.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-CsBIIit3.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-B5nK7pHt.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { n as unwrapStoredValue, t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";
 import { createRequire } from "node:module";
@@ -241,6 +241,13 @@ var BlockSupervisor = class {
 	emptyAppliesOwed = 2;
 	/** Consecutive applies that could not reach the composer: warned once per run. */
 	failedApplies = 0;
+	/** Composition ids the operator deleted. Passed until their claims are released. */
+	retiredBlockIds = /* @__PURE__ */ new Set();
+	/** What the last composition apply said about claim releases. */
+	releaseReport = {
+		error: null,
+		unreleased: []
+	};
 	constructor(deps) {
 		this.deps = deps;
 	}
@@ -276,6 +283,26 @@ var BlockSupervisor = class {
 	* timer tick could stop a runner the tick had just decided was healthy and
 	* then never re-launch it.
 	*/
+	/**
+	* The block row is already gone. The next apply names it retired so its
+	* claims are released before this resolves. A release that does not land is
+	* returned; the id stays retired so the following pass tries again.
+	*/
+	retireComposition(blockId) {
+		this.retiredBlockIds = new Set([...this.retiredBlockIds, blockId]);
+		return this.converge().then(() => this.claimsOf(blockId));
+	}
+	/**
+	* One apply, awaited. Used when an edit replaced a block's caps: the
+	* composer releases what the new plan dropped before this resolves.
+	*/
+	convergeForClaims() {
+		if (this.deps.composer === null) return Promise.reject(/* @__PURE__ */ new Error("core-blocks: no composer is available — a replaced claim cannot be released"));
+		return this.converge().then(() => {
+			if (this.releaseReport.error !== null) throw new Error(`core-blocks: a replaced claim was not released — ${this.releaseReport.error}`);
+			return this.releaseReport.unreleased;
+		});
+	}
 	restart(blockId) {
 		const block = this.deps.store.get(blockId);
 		if (block !== null && coreBlockSourceKind(block) === "composition") {
@@ -364,9 +391,13 @@ var BlockSupervisor = class {
 		});
 		const unreadable = this.deps.store.unreadableCompositions();
 		const nothingToSay = compositions.length === 0 && unreadable.length === 0;
-		if (nothingToSay && this.emptyAppliesOwed === 0) return;
+		if (nothingToSay && this.emptyAppliesOwed === 0 && this.retiredBlockIds.size === 0) return;
 		const composer = this.deps.composer;
 		if (composer === null) {
+			if (this.retiredBlockIds.size > 0) this.releaseReport = {
+				error: "no composer is available on this node — claims cannot be released",
+				unreleased: []
+			};
 			for (const { block } of compositions) await this.report(block.id, "failed", "no composer is available on this node — a composition cannot run here");
 			return;
 		}
@@ -389,7 +420,8 @@ var BlockSupervisor = class {
 					composition
 				})),
 				restartBlockIds: [...restart],
-				unreadableBlocks: [...unreadable]
+				unreadableBlocks: [...unreadable],
+				retiredBlockIds: [...this.retiredBlockIds]
 			});
 			if (this.failedApplies > 0) {
 				this.deps.logger.info("the composer answered again", { meta: { failedApplies: this.failedApplies } });
@@ -397,6 +429,7 @@ var BlockSupervisor = class {
 			}
 			this.pendingCompositionRestarts = new Set([...this.pendingCompositionRestarts].filter((id) => !restart.has(id)));
 			this.emptyAppliesOwed = !nothingToSay || !result.acted ? 2 : Math.max(0, this.emptyAppliesOwed - 1);
+			this.noteRelease(result);
 			const verdicts = new Map(result.blocks.map((v) => [v.blockId, v]));
 			for (const { block } of compositions) {
 				const verdict = verdicts.get(block.id);
@@ -404,13 +437,39 @@ var BlockSupervisor = class {
 				else await this.report(block.id, verdict.status, verdict.reason);
 			}
 		} catch (err) {
+			const error = errMsg(err);
+			this.releaseReport = {
+				error,
+				unreleased: []
+			};
 			this.failedApplies += 1;
 			if (this.failedApplies === 1) this.deps.logger.warn("the composer could not be reached — compositions keep their last status", { meta: {
-				error: errMsg(err),
+				error,
 				compositions: compositions.length
 			} });
-			for (const { block } of compositions) if (block.status === "stopped" && block.enabled) await this.report(block.id, "starting", `the composer is not reachable yet: ${errMsg(err)}`);
+			for (const { block } of compositions) if (block.status === "stopped" && block.enabled) await this.report(block.id, "starting", `the composer is not reachable yet: ${error}`);
+		}
+	}
+	claimsOf(blockId) {
+		if (this.releaseReport.error !== null) throw new Error(`core-blocks: claims of "${blockId}" were not released — ${this.releaseReport.error}`);
+		return this.releaseReport.unreleased.filter((claim) => claim.owner === blockId);
+	}
+	/** Remember which retired ids still hold a claim. An apply that did not act keeps every id. */
+	noteRelease(result) {
+		const unreleased = result.unreleasedClaims ?? [];
+		if (!result.acted) {
+			this.releaseReport = {
+				error: "the composer did not apply — claims stay until it does",
+				unreleased
+			};
+			return;
 		}
+		this.releaseReport = {
+			error: null,
+			unreleased
+		};
+		const failed = new Set(unreleased.map((claim) => claim.owner));
+		this.retiredBlockIds = new Set([...this.retiredBlockIds].filter((id) => failed.has(id)));
 	}
 	/** Compile, write the package, spawn. Each failure is reported ON the block
 	*  — the author asked for this to run, so they are owed the reason it does
@@ -2077,7 +2136,21 @@ function buildCompositionApi(deps) {
 				blockId,
 				by: caller.userId
 			} });
-			deps.convergeSoon();
+			if (block.composition !== void 0) {
+				const unreleased = (await deps.convergeForClaims()).filter((claim) => claim.owner === blockId);
+				if (unreleased.length > 0) {
+					for (const claim of unreleased) deps.logger.error("composition saved but a replaced claim was not released", {
+						tags: { deviceId: claim.deviceId },
+						meta: {
+							blockId,
+							cap: claim.capName,
+							error: claim.error
+						}
+					});
+					const detail = unreleased.map((claim) => `${claim.capName} on device ${claim.deviceId}: ${claim.error}`).join("; ");
+					throw new Error(`core-blocks: "${blockId}" was saved but a replaced claim was not released — ${detail}`);
+				}
+			} else deps.convergeSoon();
 			return { block: updated };
 		}),
 		getComposition: async ({ blockId }) => {
@@ -2453,9 +2526,30 @@ var CoreBlocksAddon = class extends BaseAddon {
 				return { block: updated };
 			},
 			delete: async ({ blockId }) => {
+				const existing = this.requireStore().get(blockId);
+				const composition = existing !== null && coreBlockComposition(existing) !== null;
 				await this.requireStore().delete(blockId);
 				await this.requirePrefs().delete(blockId);
-				this.convergeSoon();
+				if (composition && this.supervisor === null) {
+					this.ctx.logger.error("composition deleted but no supervisor can release its claims", { meta: { blockId } });
+					throw new Error(`core-blocks: "${blockId}" was deleted but no supervisor runs here — its claims were not released`);
+				}
+				if (composition && this.supervisor !== null) {
+					const unreleased = await this.supervisor.retireComposition(blockId);
+					if (unreleased.length > 0) {
+						for (const claim of unreleased) this.ctx.logger.error("composition deleted but its claim was not released", {
+							tags: { deviceId: claim.deviceId },
+							meta: {
+								blockId,
+								cap: claim.capName,
+								owner: claim.owner,
+								error: claim.error
+							}
+						});
+						const detail = unreleased.map((claim) => `${claim.capName} on device ${claim.deviceId}: ${claim.error}`).join("; ");
+						throw new Error(`core-blocks: "${blockId}" was deleted but its claims were not released — ${detail}`);
+					}
+				} else this.convergeSoon();
 				return { success: true };
 			},
 			setEnabled: async ({ blockId, enabled }) => {
@@ -2464,9 +2558,9 @@ var CoreBlocksAddon = class extends BaseAddon {
 				return { block: updated };
 			},
 			/**
-			* Awaited, unlike every other write here.
+			* Awaited, like a composition delete.
 			*
-			* `create`/`update` deliberately do not wait — the write is already
+			* `create`/`update` of a code block deliberately do not wait — the write is already
 			* durable and converging forks a process. A restart has no durable half:
 			* the whole thing IS the converge, so returning before it ran would hand
 			* the operator the old status and read as "nothing happened".
@@ -2547,6 +2641,10 @@ var CoreBlocksAddon = class extends BaseAddon {
 			lookupCap: buildCapabilityLookup(ALL_CAPABILITY_DEFINITIONS),
 			composerStates: async (blockIds) => (await requireApi().composer.getStates.query({ blockIds: [...blockIds] })).states,
 			convergeSoon: () => this.convergeSoon(),
+			convergeForClaims: () => {
+				if (this.supervisor === null) return Promise.reject(/* @__PURE__ */ new Error("core-blocks: no block supervisor runs on this node — claims cannot be released"));
+				return this.supervisor.convergeForClaims();
+			},
 			logger: this.ctx.logger.child("compositions"),
 			capabilityDefinitions: ALL_CAPABILITY_DEFINITIONS
 		});

package/dist/builtins/device-history/device-history.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 //#region src/builtins/device-history/time/bucket-time.ts
 /**
 * Bucket arithmetic for the three rollup tiers (D850, plan §4/§5.5).

package/dist/builtins/device-history/device-history.addon.mjs

@@ -1,4 +1,4 @@
-import { $r as DeviceType, B as HISTORY_ITEM_CATALOG, Ct as armRemovalReconcile, D as DEVICE_HISTORY_ENERGY_KEY, Oa as EventCategory, Qi as historyItemFieldPath, Yi as emitReadiness, en as deviceHistoryCapability, nn as deviceRemovalHookCapability, ti as BaseAddon, ui as HISTORY_DEFAULT_MIN_INTERVAL_MS, z as HISTORY_CATALOG } from "../../dist-BugavoVR.mjs";
+import { $r as DeviceType, B as HISTORY_ITEM_CATALOG, Ct as armRemovalReconcile, D as DEVICE_HISTORY_ENERGY_KEY, Oa as EventCategory, Qi as historyItemFieldPath, Yi as emitReadiness, en as deviceHistoryCapability, nn as deviceRemovalHookCapability, ti as BaseAddon, ui as HISTORY_DEFAULT_MIN_INTERVAL_MS, z as HISTORY_CATALOG } from "../../dist-B_V9r61Z.mjs";
 //#region src/builtins/device-history/time/bucket-time.ts
 /**
 * Bucket arithmetic for the three rollup tiers (D850, plan §4/§5.5).

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { $r as DeviceType, $t as deviceExtensionCapability, Ea as userError, F as DeviceTombstoneSchema, In as locationIconKey, L as FieldClaimModeSchema, Mn as legacyAutoLinkIds, Ni as WELL_KNOWN_TAB_MAP, Oa as EventCategory, Oi as SECRET_CLEAR, P as DeviceStatusSchema, Pt as canonicalIconKey, Qr as DeviceRole, R as FieldClaimSchema, Sa as sleep$1, Ta as transformSecretWrite, Ui as collectZodSecretPaths, Wt as createDeviceExtensionProvider, Y as MINUTES_PER_DAY, Yt as defineExtensionSlotProvider, Zn as parseStreamParamsFormPatch, Zr as DeviceFeature, aa as isSecretMarkerLike, ba as secretTreeFromPaths, ea as isDeviceConfigCap, ei as errMsg, gn as formatMinutes, hr as runtimeStatePolicyFor, ia as isSecretMarker, in as deviceStatusCapability, jt as buildStreamParamsConfigSchema, l as CAP_NAMES_WITH_STATUS, na as isKeychainStoredField, on as enumerateItemArrayFields, ot as STREAM_PROFILE_META, qi as defineRecordKinds, qn as normalizeUnit, r as ALL_CAPABILITY_DEFINITIONS, ra as isSecretClear, rn as deviceStateCapability, s as CAMERA_SWITCH_ORDER, sn as enumerateSchemaFields, ti as BaseAddon, tn as deviceManagerCapability, un as expandContainer, va as resolveSecretMarkers, w as DAY_NAMES, wa as toSecretFieldView, xr as siteZoneKey } from "../../dist-BugavoVR.mjs";
+import { $r as DeviceType, $t as deviceExtensionCapability, Ea as userError, F as DeviceTombstoneSchema, In as locationIconKey, L as FieldClaimModeSchema, Mn as legacyAutoLinkIds, Ni as WELL_KNOWN_TAB_MAP, Oa as EventCategory, Oi as SECRET_CLEAR, P as DeviceStatusSchema, Pt as canonicalIconKey, Qr as DeviceRole, R as FieldClaimSchema, Sa as sleep$1, Ta as transformSecretWrite, Ui as collectZodSecretPaths, Wt as createDeviceExtensionProvider, Y as MINUTES_PER_DAY, Yt as defineExtensionSlotProvider, Zn as parseStreamParamsFormPatch, Zr as DeviceFeature, aa as isSecretMarkerLike, ba as secretTreeFromPaths, ea as isDeviceConfigCap, ei as errMsg, gn as formatMinutes, hr as runtimeStatePolicyFor, ia as isSecretMarker, in as deviceStatusCapability, jt as buildStreamParamsConfigSchema, l as CAP_NAMES_WITH_STATUS, na as isKeychainStoredField, on as enumerateItemArrayFields, ot as STREAM_PROFILE_META, qi as defineRecordKinds, qn as normalizeUnit, r as ALL_CAPABILITY_DEFINITIONS, ra as isSecretClear, rn as deviceStateCapability, s as CAMERA_SWITCH_ORDER, sn as enumerateSchemaFields, ti as BaseAddon, tn as deviceManagerCapability, un as expandContainer, va as resolveSecretMarkers, w as DAY_NAMES, wa as toSecretFieldView, xr as siteZoneKey } from "../../dist-B_V9r61Z.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Ln as logDestinationCapability, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
+import { Ln as logDestinationCapability, ti as BaseAddon } from "../../dist-B_V9r61Z.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
-const require_device_ca = require("../../device-ca-Dg3rSU48.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
+const require_device_ca = require("../../device-ca-DhyQeXsa.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_constants = require("../../constants-C0hrXcEr.js");
+const require_constants = require("../../constants-D4VigrMM.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/keychain/index.mjs

@@ -1,7 +1,7 @@
-import { An as keychainAdminCapability, G as KeychainResetRecordSchema, Oa as EventCategory, U as KEYCHAIN_RESET_TRIGGER_ACTOR, W as KeychainAuditEntrySchema, Zi as formatSecretScope, da as normalizeSecretOwner, jn as keychainCapability, ma as parseSecretRef, qi as defineRecordKinds, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-CHdsePe5.mjs";
+import { An as keychainAdminCapability, G as KeychainResetRecordSchema, Oa as EventCategory, U as KEYCHAIN_RESET_TRIGGER_ACTOR, W as KeychainAuditEntrySchema, Zi as formatSecretScope, da as normalizeSecretOwner, jn as keychainCapability, ma as parseSecretRef, qi as defineRecordKinds, ti as BaseAddon } from "../../dist-B_V9r61Z.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-CvBZeyVX.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants-Dy8CaDeT.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-jbhoFV7w.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);
 let node_path = require("node:path");

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Oa as EventCategory, Vn as mayWriteToLocation, Wi as createEvent, ei as errMsg, it as RecordingStatusSchema, nt as RECORDING_SOURCE_CAMSTACK_ADDON, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
+import { Oa as EventCategory, Vn as mayWriteToLocation, Wi as createEvent, ei as errMsg, it as RecordingStatusSchema, nt as RECORDING_SOURCE_CAMSTACK_ADDON, ti as BaseAddon } from "../../dist-B_V9r61Z.mjs";
 import * as fsp from "node:fs/promises";
 import path from "node:path";
 import { constants } from "node:fs";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-Dg3rSU48.js");
+const require_device_ca = require("../../device-ca-DhyQeXsa.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { $ as PreferenceDeviceIdSchema, At as buildDeviceSignatureMessage, E as DEVICE_ENROLLMENT_TTL_MS, Ea as userError, Mr as userManagementCapability, O as DEVICE_NONCE_TTL_MS, Q as PREFERENCES_MAX_VALUE_BYTES, Qt as deviceCredentialsCapability, et as PreferenceNamespaceSchema, gt as UserRecordSchema, h as CREDENTIAL_TOKEN_AUDIENCE, hn as formatDeviceRevoker, ia as isSecretMarker, kt as buildDeviceEnrollmentLink, lt as SsoBridgeClaimsSchema, mt as TokenScopeSchema, qi as defineRecordKinds, sa as makeSecretMarker, st as ScopedTokenSchema, ti as BaseAddon, tt as PreferenceValueSchema, wn as isCredentialTokenPayload, wt as authProviderCapability, y as CredentialTokenClaimsSchema } from "../../dist-BugavoVR.mjs";
+import { $ as PreferenceDeviceIdSchema, At as buildDeviceSignatureMessage, E as DEVICE_ENROLLMENT_TTL_MS, Ea as userError, Mr as userManagementCapability, O as DEVICE_NONCE_TTL_MS, Q as PREFERENCES_MAX_VALUE_BYTES, Qt as deviceCredentialsCapability, et as PreferenceNamespaceSchema, gt as UserRecordSchema, h as CREDENTIAL_TOKEN_AUDIENCE, hn as formatDeviceRevoker, ia as isSecretMarker, kt as buildDeviceEnrollmentLink, lt as SsoBridgeClaimsSchema, mt as TokenScopeSchema, qi as defineRecordKinds, sa as makeSecretMarker, st as ScopedTokenSchema, ti as BaseAddon, tt as PreferenceValueSchema, wn as isCredentialTokenPayload, wt as authProviderCapability, y as CredentialTokenClaimsSchema } from "../../dist-B_V9r61Z.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-CHdsePe5.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-CvBZeyVX.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-DkncLbg9.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-DFidf52M.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { Fn as localNetworkCapability, Ft as checkRoleAddress, H as HUB_MDNS_TXT_KEYS, Oa as EventCategory, Pr as validateCustomAddress, Qn as pickAppLinkHub, Tn as isDefaultAppConnectionEndpoint, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, br as shortHostname, c as CAMSTACK_APP_LINK_ORIGIN, dr as resolveHubAddressRoles, ei as errMsg, mr as resolveNotificationTapAddress, sr as resolveAppConnections, ti as BaseAddon, xn as isAppLinkBase } from "../../dist-BugavoVR.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-BDvqGIw4.mjs";
+import { Fn as localNetworkCapability, Ft as checkRoleAddress, H as HUB_MDNS_TXT_KEYS, Oa as EventCategory, Pr as validateCustomAddress, Qn as pickAppLinkHub, Tn as isDefaultAppConnectionEndpoint, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, br as shortHostname, c as CAMSTACK_APP_LINK_ORIGIN, dr as resolveHubAddressRoles, ei as errMsg, mr as resolveNotificationTapAddress, sr as resolveAppConnections, ti as BaseAddon, xn as isAppLinkBase } from "../../dist-B_V9r61Z.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-BuUg0gpI.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 const require_log_read_filter = require("../../log-read-filter-Bi066jwU.js");
 let zod = require("zod");
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Ln as logDestinationCapability, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
+import { Ln as logDestinationCapability, ti as BaseAddon } from "../../dist-B_V9r61Z.mjs";
 import { n as compileLogFilter, o as lineMatches } from "../../log-read-filter-D7Ev3zm-.mjs";
 import { z } from "zod";
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 let node_fs_promises = require("node:fs/promises");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Oa as EventCategory, Un as metricsProviderCapability, Wi as createEvent, ar as reducePoints, cr as resolveBucketMs, ei as errMsg, ht as UNATTRIBUTED_BUCKET_KEY, mn as foldSnapshotByFunction, rt as ROOT_BUCKET_KEY, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
+import { Oa as EventCategory, Un as metricsProviderCapability, Wi as createEvent, ar as reducePoints, cr as resolveBucketMs, ei as errMsg, ht as UNATTRIBUTED_BUCKET_KEY, mn as foldSnapshotByFunction, rt as ROOT_BUCKET_KEY, ti as BaseAddon } from "../../dist-B_V9r61Z.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 const require_coral_accelerators = require("../../coral-accelerators-BSVsBVzt.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { Oa as EventCategory, Xn as parseAcceleratorFactsJson, Yi as emitReadiness, an as enumerateInferenceDevices, ei as errMsg, er as platformProbeCapability, ti as BaseAddon, vr as scoreRuntimes } from "../../dist-BugavoVR.mjs";
+import { Oa as EventCategory, Xn as parseAcceleratorFactsJson, Yi as emitReadiness, an as enumerateInferenceDevices, ei as errMsg, er as platformProbeCapability, ti as BaseAddon, vr as scoreRuntimes } from "../../dist-B_V9r61Z.mjs";
 import { n as detectCoralAccelerator, r as nodeCoralFs } from "../../coral-accelerators-DBlgWB8k.mjs";
 import * as path$1 from "node:path";
 import { promisify } from "node:util";

package/dist/builtins/record-entries/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/record-entries/index.mjs

@@ -1,4 +1,4 @@
-import { Mi as UnknownRecordKindError, ca as mapSecretLeaves, di as InvalidRecordError, ga as recordSecretRef, rr as recordEntriesCapability, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
+import { Mi as UnknownRecordKindError, ca as mapSecretLeaves, di as InvalidRecordError, ga as recordSecretRef, rr as recordEntriesCapability, ti as BaseAddon } from "../../dist-B_V9r61Z.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Oa as EventCategory, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
+import { Oa as EventCategory, ti as BaseAddon } from "../../dist-B_V9r61Z.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { $r as DeviceType, Ar as streamQualityLabel, Dt as batteryCapability, Et as bareAddonId, Hn as memoizePinnedFfmpeg, Oa as EventCategory, Sr as snapshotCapability, Xt as deriveBatteryPresence, Zr as DeviceFeature, ei as errMsg, la as nodePin, o as BatteryStatusSchema, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
+import { $r as DeviceType, Ar as streamQualityLabel, Dt as batteryCapability, Et as bareAddonId, Hn as memoizePinnedFfmpeg, Oa as EventCategory, Sr as snapshotCapability, Xt as deriveBatteryPresence, Zr as DeviceFeature, ei as errMsg, la as nodePin, o as BatteryStatusSchema, ti as BaseAddon } from "../../dist-B_V9r61Z.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Or as storageProviderCapability, pn as filesystemBrowseCapability, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
+import { Or as storageProviderCapability, pn as filesystemBrowseCapability, ti as BaseAddon } from "../../dist-B_V9r61Z.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-DyMUz_Hy.js");
+const require_wal_maintenance = require("../../wal-maintenance-B7xBeIFi.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-BnhkcEkI.mjs";
+import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-DItlr0Yu.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 const require_retired_settings_keys = require("../../retired-settings-keys-DorakcxV.js");
-const require_wal_maintenance = require("../../wal-maintenance-DyMUz_Hy.js");
+const require_wal_maintenance = require("../../wal-maintenance-B7xBeIFi.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { Ai as TransactRefusedError, C as DATA_STORE_DATABASES, Ci as RecordKindDeclarationSchema, Et as bareAddonId, Gt as dataStoreProviderCapability, Kt as databaseSnapshotCapability, Lr as vectorStoreCapability, Mi as UnknownRecordKindError, S as DATABASE_SNAPSHOT_TIMEOUT_MS, _i as RECORD_SWEEP_INTERVAL_MS, b as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, bi as RUNTIME_DEFAULTS, da as normalizeSecretOwner, di as InvalidRecordError, ei as errMsg, fi as NoCallerError, ir as recordsCapability, si as DeclarationRefusedError, ti as BaseAddon, wr as storageAdminCapability, x as DATABASE_SNAPSHOT_SUFFIX } from "../../dist-BugavoVR.mjs";
+import { Ai as TransactRefusedError, C as DATA_STORE_DATABASES, Ci as RecordKindDeclarationSchema, Et as bareAddonId, Gt as dataStoreProviderCapability, Kt as databaseSnapshotCapability, Lr as vectorStoreCapability, Mi as UnknownRecordKindError, S as DATABASE_SNAPSHOT_TIMEOUT_MS, _i as RECORD_SWEEP_INTERVAL_MS, b as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, bi as RUNTIME_DEFAULTS, da as normalizeSecretOwner, di as InvalidRecordError, ei as errMsg, fi as NoCallerError, ir as recordsCapability, si as DeclarationRefusedError, ti as BaseAddon, wr as storageAdminCapability, x as DATABASE_SNAPSHOT_SUFFIX } from "../../dist-B_V9r61Z.mjs";
 import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-CWp7ZSeA.mjs";
-import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, S as trustResult, T as callData, _ as collectTransferables, a as WalMaintenance, c as vectorProviderOfOwnedFile, d as CrossDatabaseTransactError, f as DatabaseBusyError, l as SqliteSettingsBackend, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callControl } from "../../wal-maintenance-BnhkcEkI.mjs";
+import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, S as trustResult, T as callData, _ as collectTransferables, a as WalMaintenance, c as vectorProviderOfOwnedFile, d as CrossDatabaseTransactError, f as DatabaseBusyError, l as SqliteSettingsBackend, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callControl } from "../../wal-maintenance-DItlr0Yu.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Bi as collectSecretConfigKeys, Bn as mayReadLocation, En as isLocationEnabled, Er as storageMigrationCapability, Nn as legacyModeOf, Oa as EventCategory, Rr as withLocationMode, Ta as transformSecretWrite, Tr as storageCapability, Vn as mayWriteToLocation, Wn as modeMayWrite, _n as gbToBytes, ba as secretTreeFromPaths, dt as StorageLocationModeSchema, fa as parseJsonObject, fr as resolveLocationMode, ft as StorageLocationTypeSchema, ia as isSecretMarker, ln as evictionPolicyOfLocation, pt as StorageMigrationJobSchema, q as LegacyStorageLocationDefaultSchema, qi as defineRecordKinds, ti as BaseAddon, ua as normalizeNodeId, ut as StorageCleanupJobSchema, va as resolveSecretMarkers, vi as REDACTED_SECRET, yr as settingsStoreCapability } from "../../dist-BugavoVR.mjs";
+import { Bi as collectSecretConfigKeys, Bn as mayReadLocation, En as isLocationEnabled, Er as storageMigrationCapability, Nn as legacyModeOf, Oa as EventCategory, Rr as withLocationMode, Ta as transformSecretWrite, Tr as storageCapability, Vn as mayWriteToLocation, Wn as modeMayWrite, _n as gbToBytes, ba as secretTreeFromPaths, dt as StorageLocationModeSchema, fa as parseJsonObject, fr as resolveLocationMode, ft as StorageLocationTypeSchema, ia as isSecretMarker, ln as evictionPolicyOfLocation, pt as StorageMigrationJobSchema, q as LegacyStorageLocationDefaultSchema, qi as defineRecordKinds, ti as BaseAddon, ua as normalizeNodeId, ut as StorageCleanupJobSchema, va as resolveSecretMarkers, vi as REDACTED_SECRET, yr as settingsStoreCapability } from "../../dist-B_V9r61Z.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
-const require_x509_es = require("../../x509.es-C4cOo48M.js");
-const require_agent_https = require("../../agent-https-DRwEbLL7.js");
-const require_constants$8 = require("../../constants-C0hrXcEr.js");
+const require_x509_es = require("../../x509.es-WtnRNyYS.js");
+const require_agent_https = require("../../agent-https-DkXBXEvz.js");
+const require_constants$8 = require("../../constants-D4VigrMM.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -355,7 +355,7 @@ async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
 		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
 		await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey)
 	];
-	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
+	const cert = await require_x509_es.withUtcTimeEncoding(() => require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${require_constants$8.MESH_CA_COMMON_NAME}`,
 		notBefore: require_x509_es.backdatedNotBefore(now),
@@ -363,7 +363,7 @@ async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
 		keys,
 		signingAlgorithm: MESH_SIGNING_ALGORITHM,
 		extensions
-	});
+	}));
 	return {
 		certPem: toCertPem(cert),
 		keyPem: await exportKeyPem(keys.privateKey),
@@ -405,7 +405,7 @@ async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
 		await require_x509_es.AuthorityKeyIdentifierExtension.create(ca.cert)
 	];
 	return {
-		certPem: toCertPem(await require_x509_es.X509CertificateGenerator.create({
+		certPem: toCertPem(await require_x509_es.withUtcTimeEncoding(() => require_x509_es.X509CertificateGenerator.create({
 			serialNumber,
 			subject: `CN=${cn}`,
 			issuer: ca.cert.subject,
@@ -415,7 +415,7 @@ async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
 			signingKey: ca.privateKey,
 			signingAlgorithm: MESH_SIGNING_ALGORITHM,
 			extensions
-		})),
+		}))),
 		serialNumber,
 		notAfter,
 		commonName: cn