gencow 0.1.229 → 0.1.230

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gencow",
-  "version": "0.1.229",
+  "version": "0.1.230",
   "description": "Gencow — AI Backend Engine",
   "type": "module",
   "bin": {
@@ -38,8 +38,8 @@
     "@types/node": "^25.9.5",
     "better-auth": "^1.6.23",
     "@gencow/core": "0.1.44",
-    "@gencow/react": "0.2.7",
-    "@gencow/client": "0.2.7"
+    "@gencow/client": "0.2.7",
+    "@gencow/react": "0.2.7"
   },
   "scripts": {
     "prebuild": "pnpm --filter @gencow/migration-contract run build && pnpm --filter @gencow/server run build",

package/runtime/server.mjs

@@ -106033,7 +106033,7 @@ var require_package = __commonJS({
 var require_libvips = __commonJS({
   "../../node_modules/.pnpm/sharp@0.34.5/node_modules/sharp/lib/libvips.js"(exports2, module2) {
     var { spawnSync: spawnSync2 } = __require("node:child_process");
-    var { createHash: createHash89 } = __require("node:crypto");
+    var { createHash: createHash90 } = __require("node:crypto");
     var semverCoerce = require_coerce();
     var semverGreaterThanOrEqualTo = require_gte();
     var semverSatisfies = require_satisfies();
@@ -106124,7 +106124,7 @@ var require_libvips = __commonJS({
       }
       return false;
     };
-    var sha512 = (s3) => createHash89("sha512").update(s3).digest("hex");
+    var sha512 = (s3) => createHash90("sha512").update(s3).digest("hex");
     var yarnLocator = () => {
       try {
         const identHash = sha512(`imgsharp-libvips-${buildPlatformArch()}`);
@@ -153344,6 +153344,19 @@ var init_server_platform_custom_domain_http_entry = __esm({
   }
 });
 
+// ../server/dist/custom-domain-route-marker.js
+import { createHash as createHash24 } from "node:crypto";
+function buildCustomDomainRouteMarker(host, appName) {
+  return `v1.${createHash24("sha256").update("gencow-domain-route\0").update(host.trim().toLowerCase()).update("\0").update(appName).digest("base64url")}`;
+}
+var CUSTOM_DOMAIN_VERIFICATION_PATH;
+var init_custom_domain_route_marker = __esm({
+  "../server/dist/custom-domain-route-marker.js"() {
+    "use strict";
+    CUSTOM_DOMAIN_VERIFICATION_PATH = "/.well-known/gencow-domain-verification";
+  }
+});
+
 // ../server/dist/server-platform-app-proxy-pre-route.js
 function buildAppProjectionBlockedResponse() {
   return Response.json({
@@ -153356,6 +153369,19 @@ async function maybeBuildPlatformAppProxyPreRouteResponse(params) {
   if (isTlsReadyProbe && await params.findTlsAuthorizableDomainApp?.(params.host)) {
     return new Response(null, { status: 204, headers: { "X-Gencow-Domain-Ready": "1" } });
   }
+  if (params.requestPath === CUSTOM_DOMAIN_VERIFICATION_PATH && (params.request.method === "GET" || params.request.method === "HEAD")) {
+    const appName = await params.findTlsAuthorizableDomainApp?.(params.host);
+    if (appName) {
+      return new Response(null, {
+        status: 204,
+        headers: {
+          "Cache-Control": "no-store",
+          "X-Content-Type-Options": "nosniff",
+          "X-Gencow-Domain-Verification": buildCustomDomainRouteMarker(params.host, appName)
+        }
+      });
+    }
+  }
   const httpEntryResponse = await maybeBuildCustomDomainHttpEntryResponse({
     request: params.request,
     host: params.host,
@@ -153369,6 +153395,7 @@ var init_server_platform_app_proxy_pre_route = __esm({
   "../server/dist/server-platform-app-proxy-pre-route.js"() {
     "use strict";
     init_server_platform_custom_domain_http_entry();
+    init_custom_domain_route_marker();
   }
 });
 
@@ -166926,7 +166953,7 @@ var init_server_platform_notification_worker_runtime = __esm({
 });
 
 // ../server/src/server-node-proxy-signature.ts
-import { createHash as createHash24, createHmac as createHmac9, timingSafeEqual as timingSafeEqual11 } from "crypto";
+import { createHash as createHash25, createHmac as createHmac9, timingSafeEqual as timingSafeEqual11 } from "crypto";
 function sanitizeNodeProxyForwardHeaders(headers) {
   const sanitized = new Headers();
   for (const [key, value] of headers.entries()) {
@@ -166949,7 +166976,7 @@ function canonicalSignedHeaderHash2(headers) {
     const value = headers?.get(name) ?? "";
     return `${name}:${value.trim()}`;
   }).join("\n");
-  return createHash24("sha256").update(canonical).digest("base64url");
+  return createHash25("sha256").update(canonical).digest("base64url");
 }
 function buildSignaturePayload2(input) {
   return [
@@ -176533,7 +176560,7 @@ var init_postgres_temporal2 = __esm({
 });
 
 // ../platform/src/deployment-executor-operation.ts
-import { createHash as createHash25 } from "node:crypto";
+import { createHash as createHash26 } from "node:crypto";
 function sanitizeDeploymentExecutorWarnings(warnings) {
   if (!Array.isArray(warnings) || warnings.length > 1e3) {
     throw new Error("DEPLOYMENT_EXECUTOR_RECEIPT_WARNING_INVALID");
@@ -176589,7 +176616,7 @@ function sanitizeDeploymentExecutorReceipt(input) {
   };
 }
 function hashDeploymentExecutorReceipt(receipt) {
-  return createHash25("sha256").update(JSON.stringify(receipt)).digest("hex");
+  return createHash26("sha256").update(JSON.stringify(receipt)).digest("hex");
 }
 var DEPLOYMENT_EXECUTOR_STATES, SAFE_CODE, SAFE_DETAIL, SECRET_PATTERN, SERVING_ROUTE_EVENT_ID, MAX_RECEIPT_WARNINGS, SAFE_WARNING_PHASE;
 var init_deployment_executor_operation = __esm({
@@ -176619,7 +176646,7 @@ var init_deployment_executor_operation = __esm({
 });
 
 // ../platform/src/deployment-executor-worker-store.ts
-import { createHash as createHash26 } from "node:crypto";
+import { createHash as createHash27 } from "node:crypto";
 import { and as and6, eq as eq7, inArray as inArray3, isNull as isNull2, ne as ne3, sql as sql61 } from "drizzle-orm";
 async function hasReadyDeploymentExecutor(input) {
   const now = input.now ?? /* @__PURE__ */ new Date();
@@ -180359,7 +180386,7 @@ var init_deploy_dependency_compat = __esm({
 });
 
 // ../platform/src/provisioner-cron-sync.ts
-import { createHash as createHash27, createHmac as createHmac10 } from "crypto";
+import { createHash as createHash28, createHmac as createHmac10 } from "crypto";
 import { existsSync as existsSync22, mkdtempSync as mkdtempSync4, readFileSync as readFileSync20, rmSync as rmSync4 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { resolve as resolve50 } from "path";
@@ -180478,7 +180505,7 @@ function readCronManifest(dataDir) {
       if (!raw2.sourceHash.startsWith("sha256:")) {
         throw new Error("cron manifest sourceHash must be a sha256 string");
       }
-      const sourceHash = `sha256:${createHash27("sha256").update(readFileSync20(sourceFile)).digest("hex")}`;
+      const sourceHash = `sha256:${createHash28("sha256").update(readFileSync20(sourceFile)).digest("hex")}`;
       if (raw2.sourceHash !== sourceHash) {
         throw new Error("cron manifest sourceHash does not match cron source");
       }
@@ -180563,7 +180590,7 @@ function withTimeout(promise2, timeoutMs, message) {
 function buildCacheBustedImportSpecifier(filePath) {
   let hash9 = "";
   try {
-    hash9 = createHash27("sha256").update(readFileSync20(filePath)).digest("hex").slice(0, 16);
+    hash9 = createHash28("sha256").update(readFileSync20(filePath)).digest("hex").slice(0, 16);
   } catch {
     hash9 = String(Date.now());
   }
@@ -180919,7 +180946,7 @@ var init_tar_buffer_extract = __esm({
 });
 
 // ../platform/src/app-deployment-artifact-filesystem.ts
-import { createHash as createHash28 } from "node:crypto";
+import { createHash as createHash29 } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { chmod, cp, lstat as lstat2, mkdir as mkdir5, open as open2, readdir as readdir4 } from "node:fs/promises";
 import { relative as relative10, resolve as resolve51, sep } from "node:path";
@@ -180934,7 +180961,7 @@ function hashArtifactClosure(files) {
   const canonical = [...files].sort(
     (left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0
   );
-  return createHash28("sha256").update(canonical.map((file2) => `${file2.path}\0${file2.size}\0${file2.sha256}
+  return createHash29("sha256").update(canonical.map((file2) => `${file2.path}\0${file2.size}\0${file2.sha256}
 `).join("")).digest("hex");
 }
 function validateArtifactFiles(files) {
@@ -180951,7 +180978,7 @@ function validateArtifactFiles(files) {
   return validated.sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
 }
 async function hashArtifactFile(path4) {
-  const hash9 = createHash28("sha256");
+  const hash9 = createHash29("sha256");
   for await (const chunk2 of createReadStream(path4)) hash9.update(chunk2);
   return hash9.digest("hex");
 }
@@ -181093,14 +181120,14 @@ var init_app_deployment_artifact_metadata = __esm({
 });
 
 // ../platform/src/app-deployment-artifact-store.ts
-import { createHash as createHash29, randomUUID as randomUUID19 } from "node:crypto";
+import { createHash as createHash30, randomUUID as randomUUID19 } from "node:crypto";
 import { chmod as chmod2, mkdir as mkdir6, mkdtemp as mkdtemp2, readFile as readFile5, rename as rename4, rm as rm2, stat as stat7, writeFile as writeFile3 } from "node:fs/promises";
 import { join as join15 } from "node:path";
 function fail4(code, cause) {
   throw new AppDeploymentArtifactError(code, cause === void 0 ? void 0 : { cause });
 }
 function sha2565(value) {
-  return createHash29("sha256").update(value).digest("hex");
+  return createHash30("sha256").update(value).digest("hex");
 }
 function appScopeSha256(scope) {
   const appId = String(scope.appId);
@@ -181313,7 +181340,7 @@ var init_app_deployment_artifact_store = __esm({
 });
 
 // ../platform/src/deploy-contract-admission.ts
-import { createHash as createHash30 } from "node:crypto";
+import { createHash as createHash31 } from "node:crypto";
 function exactObject(value, fields, label) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error(`${label} must be an object`);
@@ -181446,7 +181473,7 @@ function parseStoredDeployClaimV1(contractJson) {
   }
 }
 function hashAdmittedDeployClaimV1(claim) {
-  return createHash30("sha256").update(JSON.stringify(canonicalize(claim))).digest("hex");
+  return createHash31("sha256").update(JSON.stringify(canonicalize(claim))).digest("hex");
 }
 var MAX_CLAIM_HEADER_BYTES, SHA256_PATTERN, REQUEST_ID_PATTERN, VERSION_PATTERN, DEPLOY_CLAIM_GENERATORS;
 var init_deploy_contract_admission = __esm({
@@ -181462,7 +181489,7 @@ var init_deploy_contract_admission = __esm({
 });
 
 // ../platform/src/deploy-archive-admission.ts
-import { createHash as createHash31 } from "node:crypto";
+import { createHash as createHash32 } from "node:crypto";
 function fail5(code, details) {
   throw new DeployArchiveAdmissionError(code, details);
 }
@@ -181479,7 +181506,7 @@ function normalizeEntryPath(rawPath, directory) {
   return normalized;
 }
 function sha2567(value) {
-  return createHash31("sha256").update(value).digest("hex");
+  return createHash32("sha256").update(value).digest("hex");
 }
 function equalContractValue(left, right) {
   return JSON.stringify(left) === JSON.stringify(right);
@@ -181566,7 +181593,7 @@ async function inspectDeployArchive(bundle, overrides = {}) {
       if (uncompressedBytes / bundle.length > limits.maxCompressionRatio) {
         streamError ??= new DeployArchiveAdmissionError("DEPLOY_ARCHIVE_COMPRESSION_LIMIT");
       }
-      const hash9 = createHash31("sha256");
+      const hash9 = createHash32("sha256");
       const chunks = [];
       let actualBytes = 0;
       const selectedMetadata = isMetadataFile(path4);
@@ -181813,7 +181840,7 @@ var init_deployment_attempt_lease_scope = __esm({
 });
 
 // ../platform/src/deployment-attempt-reconciliation.ts
-import { createHash as createHash32 } from "node:crypto";
+import { createHash as createHash33 } from "node:crypto";
 import { and as and8, eq as eq10 } from "drizzle-orm";
 async function loadDeploymentAttemptByRequestIdentity(input) {
   const rows4 = await input.db.select(attemptRowSelection()).from(deployments).where(
@@ -181822,7 +181849,7 @@ async function loadDeploymentAttemptByRequestIdentity(input) {
       eq10(deployments.env, input.env),
       eq10(
         deployments.idempotencyKeyHash,
-        createHash32("sha256").update(`deploy-idempotency-v1\0${input.requestId}`).digest("hex")
+        createHash33("sha256").update(`deploy-idempotency-v1\0${input.requestId}`).digest("hex")
       )
     )
   ).limit(1);
@@ -181866,12 +181893,12 @@ var init_deployment_attempt_reconciliation = __esm({
       protocolVersion: deployments.protocolVersion,
       declaredRuntime: deployments.declaredRuntime
     });
-    hashDeploymentAttemptId = (appId, env2, requestId) => createHash32("sha256").update(`deploy-attempt-v1\0${appId}\0${env2}\0${requestId}`).digest("hex");
+    hashDeploymentAttemptId = (appId, env2, requestId) => createHash33("sha256").update(`deploy-attempt-v1\0${appId}\0${env2}\0${requestId}`).digest("hex");
   }
 });
 
 // ../platform/src/deployment-attempt-store.ts
-import { createHash as createHash33, randomUUID as randomUUID20 } from "node:crypto";
+import { createHash as createHash34, randomUUID as randomUUID20 } from "node:crypto";
 import { and as and9, eq as eq11, inArray as inArray5, isNull as isNull4, ne as ne5, sql as sql64 } from "drizzle-orm";
 function assertFailureCode(code) {
   if (!FAILURE_CODE_PATTERN.test(code)) {
@@ -181909,7 +181936,7 @@ function requireAttemptRow(rows4, operation) {
   return row;
 }
 function hashSourceDeployBundle(bundle) {
-  return createHash33("sha256").update(bundle).digest("hex");
+  return createHash34("sha256").update(bundle).digest("hex");
 }
 async function preallocateDeploymentAttempt(input) {
   const sourceBundleSha256 = hashSourceDeployBundle(input.bundle);
@@ -182294,8 +182321,8 @@ var init_deployment_attempt_store = __esm({
     LEGACY_MESSAGE_MAX = 300;
     DEPLOYMENT_ATTEMPT_LEASE_TTL_MS = 5 * 6e4;
     DEPLOYMENT_ATTEMPT_HEARTBEAT_MS = 2e4;
-    PROCESS_INVOCATION_ID = createHash33("sha256").update(`${process.pid}:${process.ppid}:${Date.now()}:${randomUUID20()}`).digest("hex").slice(0, 32);
-    hashDeploymentRequestId = (requestId) => createHash33("sha256").update(`deploy-idempotency-v1\0${requestId}`).digest("hex");
+    PROCESS_INVOCATION_ID = createHash34("sha256").update(`${process.pid}:${process.ppid}:${Date.now()}:${randomUUID20()}`).digest("hex").slice(0, 32);
+    hashDeploymentRequestId = (requestId) => createHash34("sha256").update(`deploy-idempotency-v1\0${requestId}`).digest("hex");
   }
 });
 
@@ -182814,10 +182841,10 @@ var init_drizzle_migration_store = __esm({
 });
 
 // ../platform/src/migration-execution-plan.ts
-import { createHash as createHash34 } from "node:crypto";
+import { createHash as createHash35 } from "node:crypto";
 import { getMigrationsToRun } from "drizzle-orm/migrator.utils";
 function fingerprint2(value) {
-  return createHash34("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash35("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function localFingerprint(migrations) {
   return fingerprint2(
@@ -184466,14 +184493,14 @@ var init_migration_actionable_diagnostic = __esm({
 });
 
 // ../platform/src/migration-bundle-manifest.ts
-import { createHash as createHash35 } from "node:crypto";
+import { createHash as createHash36 } from "node:crypto";
 import { existsSync as existsSync24, lstatSync as lstatSync2, readFileSync as readFileSync21, readdirSync as readdirSync7 } from "node:fs";
 import { relative as relative11, resolve as resolve54 } from "node:path";
 function fail7(code) {
   throw new MigrationBundleManifestError(code);
 }
 function sha2568(value) {
-  return createHash35("sha256").update(value).digest("hex");
+  return createHash36("sha256").update(value).digest("hex");
 }
 function hasExactKeys(value, keys2) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
@@ -186180,7 +186207,7 @@ var init_serving_route_manifest_schema = __esm({
 });
 
 // ../server/src/serving-route-manifest-contract.ts
-import { createHash as createHash36, sign as sign3, verify as verify3 } from "node:crypto";
+import { createHash as createHash37, sign as sign3, verify as verify3 } from "node:crypto";
 function canonicalValue(input) {
   if (Array.isArray(input)) return input.map(canonicalValue);
   if (!input || typeof input !== "object") return input;
@@ -186200,7 +186227,7 @@ function deepFreeze(input) {
   return input;
 }
 function sha2569(input) {
-  return createHash36("sha256").update(input).digest("hex");
+  return createHash37("sha256").update(input).digest("hex");
 }
 function buildServingRouteManifestEntry(input) {
   return deepFreeze(normalizeServingRouteManifestEntry(input));
@@ -186220,7 +186247,7 @@ var init_serving_route_manifest_contract = __esm({
 });
 
 // ../platform/src/app-serving-route-topology-store.ts
-import { createHash as createHash37 } from "node:crypto";
+import { createHash as createHash38 } from "node:crypto";
 import { sql as sql65 } from "drizzle-orm";
 function fail10(code) {
   throw new Error(code);
@@ -186230,7 +186257,7 @@ function rowsFromResult29(result2) {
   return result2?.rows ?? [];
 }
 function hashCanonical(value) {
-  return createHash37("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash38("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function normalizeTopology(input) {
   if (!ENVIRONMENTS.has(input.environment) || !REFERENCE2.test(input.topologyRevision) || input.targetSets.length < 1 || input.targetSets.length > MAX_TARGET_SETS) {
@@ -186453,7 +186480,7 @@ var init_app_serving_route_receipt_store = __esm({
 });
 
 // ../platform/src/app-serving-route-outbox-store.ts
-import { createHash as createHash38 } from "node:crypto";
+import { createHash as createHash39 } from "node:crypto";
 import { sql as sql67 } from "drizzle-orm";
 function fail12(code) {
   throw new Error(code);
@@ -186517,7 +186544,7 @@ function normalizeInput(input) {
   return { ...decision, entryHash, entryPayload };
 }
 function routeEventId(input) {
-  const digest4 = createHash38("sha256").update(
+  const digest4 = createHash39("sha256").update(
     JSON.stringify([
       2,
       input.environment,
@@ -186982,7 +187009,7 @@ var init_ws_capacity_policy2 = __esm({
 });
 
 // ../platform/src/app-serving-route-source-compiler.ts
-import { createHash as createHash39 } from "node:crypto";
+import { createHash as createHash40 } from "node:crypto";
 function buildAppServingRouteRealtimeSource(input) {
   if (typeof input.ownerAccountId !== "string" || input.ownerAccountId.length < 1 || input.ownerAccountId.length > 512 || !PLAN.test(input.plan)) {
     return fail13("APP_SERVING_ROUTE_REALTIME_POLICY_INVALID");
@@ -186992,7 +187019,7 @@ function buildAppServingRouteRealtimeSource(input) {
     return fail13("APP_SERVING_ROUTE_REALTIME_POLICY_INVALID");
   }
   return {
-    accountCapacityKey: createHash39("sha256").update(JSON.stringify([1, input.environment, input.ownerAccountId])).digest("hex"),
+    accountCapacityKey: createHash40("sha256").update(JSON.stringify([1, input.environment, input.ownerAccountId])).digest("hex"),
     plan: input.plan,
     ...limits
   };
@@ -187147,7 +187174,7 @@ var init_deployment_executor_lifecycle_authority = __esm({
 });
 
 // ../platform/src/app-release-finalize-store.ts
-import { createHash as createHash40, randomUUID as randomUUID21 } from "node:crypto";
+import { createHash as createHash41, randomUUID as randomUUID21 } from "node:crypto";
 import { and as and13, desc as desc5, eq as eq16, inArray as inArray7, sql as sql70 } from "drizzle-orm";
 var init_app_release_finalize_store = __esm({
   "../platform/src/app-release-finalize-store.ts"() {
@@ -187163,7 +187190,7 @@ var init_app_release_finalize_store = __esm({
 });
 
 // ../platform/src/app-release-store.ts
-import { createHash as createHash41, randomUUID as randomUUID22 } from "node:crypto";
+import { createHash as createHash42, randomUUID as randomUUID22 } from "node:crypto";
 import { and as and14, eq as eq17 } from "drizzle-orm";
 var init_app_release_store = __esm({
   "../platform/src/app-release-store.ts"() {
@@ -187334,7 +187361,7 @@ var init_deployment_executor_store = __esm({
 });
 
 // ../platform/src/runtime-route-binding-contract.ts
-import { createHash as createHash42 } from "node:crypto";
+import { createHash as createHash43 } from "node:crypto";
 function requiredIdentity(value, code) {
   const normalized = value.trim();
   if (!normalized) throw new Error(code);
@@ -187369,7 +187396,7 @@ function canonicalPayload(binding) {
   ];
 }
 function canonicalTenantRouteBindingHash(binding) {
-  return createHash42("sha256").update(JSON.stringify(canonicalPayload(binding))).digest("hex");
+  return createHash43("sha256").update(JSON.stringify(canonicalPayload(binding))).digest("hex");
 }
 function buildCanonicalTenantRouteBinding(input) {
   const binding = {
@@ -187410,7 +187437,7 @@ __export(runtime_route_binding_reader_exports, {
   loadCanonicalTenantRouteProjectionProof: () => loadCanonicalTenantRouteProjectionProof,
   loadCanonicalTenantRouteRemovalTargets: () => loadCanonicalTenantRouteRemovalTargets
 });
-import { createHash as createHash43 } from "node:crypto";
+import { createHash as createHash44 } from "node:crypto";
 import { and as and16, eq as eq19 } from "drizzle-orm";
 function bindingFromRows(rows4) {
   if (rows4.length !== 1) {
@@ -187647,7 +187674,7 @@ function fleetAuthorityDigest(rows4) {
     row.port,
     row.readyContractHash
   ]).sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
-  return createHash43("sha256").update(JSON.stringify(evidence)).digest("hex");
+  return createHash44("sha256").update(JSON.stringify(evidence)).digest("hex");
 }
 async function queryFleetAuthorityRows(db) {
   return await db.select(fleetSelection()).from(appRuntimeDesiredState).innerJoin(apps, eq19(apps.id, appRuntimeDesiredState.appId)).leftJoin(
@@ -188031,7 +188058,7 @@ var init_deployment_executor_http_presentation = __esm({
 });
 
 // ../platform/src/app-delete-operation-store.ts
-import { createHash as createHash44 } from "node:crypto";
+import { createHash as createHash45 } from "node:crypto";
 import { and as and17, asc as asc4, desc as desc6, eq as eq20, inArray as inArray9, lt as lt5, lte as lte5, notExists as notExists2, or as or8, sql as sql72 } from "drizzle-orm";
 function isAppDeleteTerminalState(state2) {
   return APP_DELETE_TERMINAL_STATES.includes(state2);
@@ -188044,7 +188071,7 @@ function replayOrThrowTerminal(row) {
   return operation;
 }
 function digest(value) {
-  return createHash44("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash45("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function operationId(identityHash) {
   return `app_delete_${identityHash.slice(0, 32)}`;
@@ -188291,12 +188318,12 @@ var init_app_delete_admission = __esm({
 });
 
 // ../platform/src/deployment-executor-spool.ts
-import { createHash as createHash45, randomUUID as randomUUID23 } from "node:crypto";
+import { createHash as createHash46, randomUUID as randomUUID23 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import { chmod as chmod3, link, mkdir as mkdir7, open as open3, readdir as readdir5, rm as rm3, stat as stat8 } from "node:fs/promises";
 import { resolve as resolve55 } from "node:path";
 function hashBundle(bundle) {
-  return createHash45("sha256").update(bundle).digest("hex");
+  return createHash46("sha256").update(bundle).digest("hex");
 }
 function validateAttemptId(attemptId) {
   if (!/^[a-zA-Z0-9_-]{8,160}$/u.test(attemptId)) {
@@ -188752,7 +188779,7 @@ var init_deployment_executor_admission = __esm({
 });
 
 // ../platform/src/deployment-failure-receipt-store.ts
-import { createHash as createHash46 } from "node:crypto";
+import { createHash as createHash47 } from "node:crypto";
 import { and as and20, desc as desc8, eq as eq23, gt as gt5, inArray as inArray12, isNull as isNull6, lte as lte6 } from "drizzle-orm";
 async function getOwnedDeploymentFailureReceipt(db, ownerId, correlationId, now = /* @__PURE__ */ new Date()) {
   if (!CORRELATION_PATTERN.test(correlationId)) return null;
@@ -189252,7 +189279,7 @@ var init_provisioner_capacity = __esm({
 });
 
 // ../platform/src/deployment-runtime-manifest.ts
-import { createHash as createHash47 } from "crypto";
+import { createHash as createHash48 } from "crypto";
 import { existsSync as existsSync25, readFileSync as readFileSync23, readdirSync as readdirSync8, realpathSync as realpathSync2 } from "fs";
 import { createRequire as createRequire3 } from "module";
 import { dirname as dirname13, isAbsolute as isAbsolute10, join as join16, relative as relative12, resolve as resolve57 } from "path";
@@ -189265,18 +189292,18 @@ function safeRealpath(path4) {
   }
 }
 function sha256Text(value) {
-  return `sha256:${createHash47("sha256").update(value).digest("hex")}`;
+  return `sha256:${createHash48("sha256").update(value).digest("hex")}`;
 }
 function sha256File(path4) {
   try {
-    return `sha256:${createHash47("sha256").update(readFileSync23(path4)).digest("hex")}`;
+    return `sha256:${createHash48("sha256").update(readFileSync23(path4)).digest("hex")}`;
   } catch {
     return "";
   }
 }
 function sha256RuntimeTree(path4) {
   if (!existsSync25(path4)) return "";
-  const hash9 = createHash47("sha256");
+  const hash9 = createHash48("sha256");
   const walk2 = (currentPath, relativePath) => {
     const entries = readdirSync8(currentPath, { withFileTypes: true }).sort(
       (left, right) => left.name.localeCompare(right.name)
@@ -400805,7 +400832,7 @@ var init_runtime_platform_source_closure = __esm({
 });
 
 // ../platform/src/runtime-release-fingerprint.ts
-import { createHash as createHash48 } from "crypto";
+import { createHash as createHash49 } from "crypto";
 import { existsSync as existsSync30, lstatSync as lstatSync4, readFileSync as readFileSync28, readdirSync as readdirSync10, realpathSync as realpathSync3 } from "fs";
 import { relative as relative14, resolve as resolve62 } from "path";
 function safeRealpath2(path4) {
@@ -400963,7 +400990,7 @@ function collectRuntimeReleaseInstalledPackagePaths(repoRoot2) {
   return collected.sort((a, b2) => a.name.localeCompare(b2.name));
 }
 function fingerprintReleaseOwnedNodeModulesRoots(repoRoot2) {
-  const hash9 = createHash48("sha256");
+  const hash9 = createHash49("sha256");
   for (const workspacePackage of collectRuntimeReleaseWorkspacePackages(repoRoot2)) {
     hash9.update(`workspace:${workspacePackage.name}
 `);
@@ -400977,7 +401004,7 @@ function fingerprintReleaseOwnedNodeModulesRoots(repoRoot2) {
   return hash9.digest("hex");
 }
 function buildRuntimeReleaseId(repoRoot2, layoutVersion) {
-  const hash9 = createHash48("sha256");
+  const hash9 = createHash49("sha256");
   hash9.update(`runtime-layout-v${layoutVersion}
 `);
   for (const workspacePackage of collectRuntimeReleaseWorkspacePackages(repoRoot2)) {
@@ -401057,7 +401084,7 @@ var init_runtime_support_files = __esm({
 });
 
 // ../platform/src/runtime-generation-publisher.ts
-import { createHash as createHash49, randomUUID as randomUUID24 } from "crypto";
+import { createHash as createHash50, randomUUID as randomUUID24 } from "crypto";
 import {
   chmodSync,
   closeSync,
@@ -401237,7 +401264,7 @@ function sha256RuntimePaths(sourceRoot, seeds) {
   const context2 = {
     sourceRoot: canonicalRoot,
     visited: /* @__PURE__ */ new Set(),
-    hash: createHash49("sha256")
+    hash: createHash50("sha256")
   };
   for (const seed of seeds) hashRelativeRuntimePath(context2, seed);
   return `sha256:${context2.hash.digest("hex")}`;
@@ -401255,7 +401282,7 @@ function sha256RuntimeSnapshot(manifest) {
   return sha256RuntimePaths(sourceRoot, runtimeSnapshotSeeds(manifest, sourceRoot));
 }
 function runtimeReleaseId(manifestHash, runtimeClosureSha256) {
-  return `sha256:${createHash49("sha256").update(`${manifestHash}\0${runtimeClosureSha256}`).digest("hex")}`;
+  return `sha256:${createHash50("sha256").update(`${manifestHash}\0${runtimeClosureSha256}`).digest("hex")}`;
 }
 function prepareRuntimeGenerationManifest(manifest) {
   const runtimeClosureSha256 = sha256RuntimeSnapshot(manifest);
@@ -401494,7 +401521,7 @@ var init_runtime_generation_publisher = __esm({
 });
 
 // ../platform/src/runtime-generation-store.ts
-import { createHash as createHash50 } from "crypto";
+import { createHash as createHash51 } from "crypto";
 import { closeSync as closeSync2, existsSync as existsSync33, fsyncSync as fsyncSync2, openSync as openSync2, readFileSync as readFileSync30, writeFileSync as writeFileSync4 } from "fs";
 import { resolve as resolve66 } from "path";
 function runtimeGenerationFailureReason(error51) {
@@ -401585,7 +401612,7 @@ function assertLegacyIdentityFieldsAreAbsent(manifest, releaseId, manifestHash)
   }
 }
 function sha256File2(path4) {
-  return `sha256:${createHash50("sha256").update(readFileSync30(path4)).digest("hex")}`;
+  return `sha256:${createHash51("sha256").update(readFileSync30(path4)).digest("hex")}`;
 }
 function assertFileHashMatches(path4, expectedSha256, label, manifestHash) {
   if (!existsSync33(path4)) {
@@ -403653,7 +403680,7 @@ var init_app_runtime_exit = __esm({
 });
 
 // ../platform/src/cowbox-profile-contract.ts
-import { createHash as createHash51 } from "crypto";
+import { createHash as createHash52 } from "crypto";
 import { existsSync as existsSync38, lstatSync as lstatSync9, readFileSync as readFileSync34, realpathSync as realpathSync7 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { basename as basename11, dirname as dirname19, isAbsolute as isAbsolute14, relative as relative20, resolve as resolve72 } from "path";
@@ -403702,7 +403729,7 @@ function realpathIfPresent(path4) {
 }
 function cowboxCallerContractSha256(platformSourceDir = MODULE_DIR2) {
   const sourceDir = realpathIfPresent(platformSourceDir);
-  const hash9 = createHash51("sha256");
+  const hash9 = createHash52("sha256");
   for (const filename of COWBOX_CALLER_CONTRACT_FILENAMES) {
     const path4 = resolve72(sourceDir, filename);
     if (!isContainedPath(sourceDir, path4) || !existsSync38(path4) || !lstatSync9(path4).isFile()) {
@@ -403721,7 +403748,7 @@ function cowboxProfileReleaseId(identity2) {
     warmPool: identity2.profiles.warmPool,
     schemaProof: identity2.profiles.schemaProof
   };
-  const releaseHash = createHash51("sha256").update(JSON.stringify({ callerContractSha256: identity2.callerContractSha256, profiles })).digest("hex");
+  const releaseHash = createHash52("sha256").update(JSON.stringify({ callerContractSha256: identity2.callerContractSha256, profiles })).digest("hex");
   return `cowbox-sha256-${releaseHash}`;
 }
 function readProfileGenerationManifest(generationDir, env2) {
@@ -403839,7 +403866,7 @@ function readCowboxProfile(kind, profilePath) {
   return source;
 }
 function cowboxProfileSha256(profileSource) {
-  return `sha256:${createHash51("sha256").update(profileSource).digest("hex")}`;
+  return `sha256:${createHash52("sha256").update(profileSource).digest("hex")}`;
 }
 var COWBOX_PROFILE_FILENAMES, COWBOX_PROFILE_ENV_KEYS, COWBOX_PROFILE_VARIABLE_NAMES, LEGACY_WORKER_PROFILE_VARIABLE_NAMES, COWBOX_CALLER_CONTRACT_FILENAMES, TEMPLATE_VARIABLE_NAME_PATTERN, MODULE_DIR2;
 var init_cowbox_profile_contract = __esm({
@@ -403906,7 +403933,7 @@ var init_cowbox_profile_contract = __esm({
 });
 
 // ../platform/src/runtime-process-identity.ts
-import { createHash as createHash52 } from "node:crypto";
+import { createHash as createHash53 } from "node:crypto";
 import { readFileSync as readFileSync35 } from "node:fs";
 function parseLinuxProcStatRecord(source) {
   const open4 = source.indexOf("(");
@@ -403946,7 +403973,7 @@ function readLinuxProcessState(pid, readFile10 = (path4) => readFileSync35(path4
 function canonicalCgroupRefHash(source) {
   const canonical = source.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean).sort().join("\n");
   if (!canonical) return null;
-  return createHash52("sha256").update(canonical).digest("hex");
+  return createHash53("sha256").update(canonical).digest("hex");
 }
 function observeLinuxProcessIdentity(pid, runnerSessionId, readFile10 = (path4) => readFileSync35(path4, "utf8"), platform = process.platform) {
   if (platform !== "linux" || !Number.isSafeInteger(pid) || pid <= 1 || !runnerSessionId.trim()) {
@@ -404761,7 +404788,7 @@ var init_cowbox_control_handoff = __esm({
 });
 
 // ../platform/src/runner-spawn-lifecycle.ts
-import { createHash as createHash53 } from "node:crypto";
+import { createHash as createHash54 } from "node:crypto";
 function spawnWithLifecycleReceipt(input) {
   let descriptorsClosed = false;
   const closeParentDescriptors = () => {
@@ -404829,7 +404856,7 @@ var init_runner_spawn_lifecycle = __esm({
         this.code = code;
         this.processSpawned = processSpawned;
         this.pid = processSpawned ? Number(pid) : null;
-        this.fingerprint = createHash53("sha256").update(`${code}\0${safeCause}\0${this.phase}\0${processSpawned ? "pid" : "no-pid"}`).digest("hex");
+        this.fingerprint = createHash54("sha256").update(`${code}\0${safeCause}\0${this.phase}\0${processSpawned ? "pid" : "no-pid"}`).digest("hex");
         Object.defineProperty(this, "cause", { value: cause, configurable: true });
       }
     };
@@ -405920,7 +405947,7 @@ __export(bun_runner_exports, {
   BunRunner: () => BunRunner
 });
 import { spawn as spawn3 } from "child_process";
-import { createHash as createHash54 } from "node:crypto";
+import { createHash as createHash55 } from "node:crypto";
 import { existsSync as existsSync42 } from "fs";
 import { resolve as resolve78 } from "path";
 import { homedir as homedir3 } from "os";
@@ -406054,7 +406081,7 @@ var init_bun_runner = __esm({
             pidStartTicks: localBirth,
             processGroupId: proc.pid,
             processGroupStartTicks: localBirth,
-            cgroupRefHash: createHash54("sha256").update(`local:${proc.pid}:${session2.sessionId}`).digest("hex"),
+            cgroupRefHash: createHash55("sha256").update(`local:${proc.pid}:${session2.sessionId}`).digest("hex"),
             runnerSessionId: session2.sessionId
           });
         }
@@ -406284,12 +406311,12 @@ var init_app_boot_failure_policy = __esm({
 });
 
 // ../server/src/app-internal-token.ts
-import { createHash as createHash55, createHmac as createHmac11 } from "node:crypto";
+import { createHash as createHash56, createHmac as createHmac11 } from "node:crypto";
 function deriveAppInternalToken(appId, appName, masterSecret) {
   if (!Number.isSafeInteger(appId) || appId < 1 || typeof appName !== "string" || appName.length < 1 || appName.length > 128 || typeof masterSecret !== "string" || masterSecret.length < 1) {
     throw new Error("APP_INTERNAL_TOKEN_INPUT_INVALID");
   }
-  const tokenKey = createHash55("sha256").update(`gencow-internal-token:v1:${masterSecret}`).digest();
+  const tokenKey = createHash56("sha256").update(`gencow-internal-token:v1:${masterSecret}`).digest();
   return createHmac11("sha256", tokenKey).update(`usage:${appId}:${appName}`).digest("hex");
 }
 var init_app_internal_token = __esm({
@@ -407090,7 +407117,7 @@ var init_provisioner_blue_green = __esm({
 });
 
 // ../platform/src/provisioner-deploy-runtime.ts
-import { createHash as createHash56 } from "crypto";
+import { createHash as createHash57 } from "crypto";
 import { existsSync as existsSync45, readFileSync as readFileSync43 } from "fs";
 import { resolve as resolve81 } from "path";
 async function assertDeployBundlePreflight(tarGzBuffer) {
@@ -407230,7 +407257,7 @@ async function deployBundleRuntime(params) {
     waitForPortFree: params.waitForPortFree,
     forceStopAppServingPorts: params.forceStopAppServingPorts
   });
-  const hash9 = createHash56("sha256").update(params.tarGzBuffer).digest("hex");
+  const hash9 = createHash57("sha256").update(params.tarGzBuffer).digest("hex");
   const stagedBundle = await createStagedBundleWorkspace(params.dataDir, params.tarGzBuffer);
   try {
     await applyLinuxBundlePermissions(params.appName, stagedBundle.path, logger3);
@@ -407521,7 +407548,7 @@ var init_platform_system_sql = __esm({
 });
 
 // ../platform/src/provisioner-env-builder.ts
-import { createHash as createHash57 } from "crypto";
+import { createHash as createHash58 } from "crypto";
 import { existsSync as existsSync46, readFileSync as readFileSync44 } from "fs";
 import { resolve as resolve82 } from "path";
 function addManagedPublicOrigin(origins, origin) {
@@ -407694,7 +407721,7 @@ async function buildProvisionerAppEnv(params) {
     env2.GENCOW_SYSTEM_DATABASE_URL = systemDatabaseUrl;
   }
   removePlatformOnlyEnvFromAppEnv(env2);
-  env2.BETTER_AUTH_SECRET = createHash57("sha256").update(`gencow-app-auth-${params.appName}-${runtimeEnv.BETTER_AUTH_SECRET || "default"}`).digest("hex");
+  env2.BETTER_AUTH_SECRET = createHash58("sha256").update(`gencow-app-auth-${params.appName}-${runtimeEnv.BETTER_AUTH_SECRET || "default"}`).digest("hex");
   env2.BETTER_AUTH_URL = `https://${params.appName}.${publicDomain}`;
   env2.GENCOW_MANAGED_PUBLIC_ORIGINS = [...managedPublicOrigins].join(",");
   if (params.appDbId) {
@@ -409751,7 +409778,7 @@ var init_rag_corpus_policy2 = __esm({
 });
 
 // ../server/src/server-document-runtime.ts
-import { createHash as createHash58 } from "crypto";
+import { createHash as createHash59 } from "crypto";
 var MAX_DOCUMENT_SIZE_BYTES2;
 var init_server_document_runtime2 = __esm({
   "../server/src/server-document-runtime.ts"() {
@@ -411367,7 +411394,7 @@ var init_runtime_postgres_client = __esm({
 });
 
 // ../server/src/platform-database-capability-config.ts
-import { createHash as createHash59 } from "node:crypto";
+import { createHash as createHash60 } from "node:crypto";
 var init_platform_database_capability_config = __esm({
   "../server/src/platform-database-capability-config.ts"() {
     "use strict";
@@ -411375,7 +411402,7 @@ var init_platform_database_capability_config = __esm({
 });
 
 // ../server/src/platform-database-capability-readiness.ts
-import { createHash as createHash60 } from "node:crypto";
+import { createHash as createHash61 } from "node:crypto";
 var init_platform_database_capability_readiness = __esm({
   "../server/src/platform-database-capability-readiness.ts"() {
     "use strict";
@@ -411384,7 +411411,7 @@ var init_platform_database_capability_readiness = __esm({
 });
 
 // ../server/src/platform-database-capabilities.ts
-import { createHash as createHash61 } from "node:crypto";
+import { createHash as createHash62 } from "node:crypto";
 var init_platform_database_capabilities = __esm({
   "../server/src/platform-database-capabilities.ts"() {
     "use strict";
@@ -412912,7 +412939,7 @@ var init_drizzle_migration_store_reconciler = __esm({
 });
 
 // ../platform/src/provisioner-primary-migrations.ts
-import { createHash as createHash62 } from "node:crypto";
+import { createHash as createHash63 } from "node:crypto";
 import { readFileSync as readFileSync50, realpathSync as realpathSync8 } from "node:fs";
 import { resolve as resolve93, sep as sep4 } from "node:path";
 import { readMigrationFiles } from "drizzle-orm/migrator";
@@ -412990,7 +413017,7 @@ function readVerifiedLocalMigrationSources(migrationsFolder) {
       if (error51 instanceof MigrationExecutionPlanError) throw error51;
       return localPlanChanged(`migration ${JSON.stringify(metadata.name)} could not be read safely`);
     }
-    const rawHash = createHash62("sha256").update(sqlContent).digest("hex");
+    const rawHash = createHash63("sha256").update(sqlContent).digest("hex");
     if (rawHash !== metadata.hash) {
       return localPlanChanged(
         `migration ${JSON.stringify(metadata.name)} changed while its execution plan was being built`
@@ -413448,7 +413475,7 @@ var init_provisioner_drizzle_tsconfig = __esm({
 });
 
 // ../platform/src/canonical-schema-proof-runner.ts
-import { createHash as createHash63 } from "node:crypto";
+import { createHash as createHash64 } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import {
   chmodSync as chmodSync5,
@@ -413481,7 +413508,7 @@ function classifyCanonicalSchemaProofFailure(stage, error51) {
   return new CanonicalSchemaProofError(stage, "PLATFORM_ACTION_REQUIRED");
 }
 function sha25610(value) {
-  return createHash63("sha256").update(value).digest("hex");
+  return createHash64("sha256").update(value).digest("hex");
 }
 function buildCanonicalSchemaProofFromSql(sql117) {
   const canonicalSql = sql117.trim();
@@ -413769,7 +413796,7 @@ var init_canonical_schema_proof_runner = __esm({
 });
 
 // ../platform/src/workspace-schema-sources.ts
-import { createHash as createHash64 } from "node:crypto";
+import { createHash as createHash65 } from "node:crypto";
 import { existsSync as existsSync54, lstatSync as lstatSync11, readFileSync as readFileSync53 } from "node:fs";
 import { relative as relative22, resolve as resolve96, sep as sep6 } from "node:path";
 function declaresUnverifiableSchemaSource(dataDir) {
@@ -413789,7 +413816,7 @@ function isWithin2(root2, candidate) {
   return rel === "" || rel !== ".." && !rel.startsWith(`..${sep6}`);
 }
 function sha25611(bytes) {
-  return createHash64("sha256").update(bytes).digest("hex");
+  return createHash65("sha256").update(bytes).digest("hex");
 }
 function resolveWorkspaceSchemaSourcePaths(params) {
   const backendRoot = resolve96(params.dataDir, "gencow");
@@ -413837,7 +413864,7 @@ var init_workspace_schema_sources = __esm({
 
 // ../platform/src/provisioner-schema.ts
 import { existsSync as existsSync55, readFileSync as readFileSync54, readdirSync as readdirSync22 } from "fs";
-import { createHash as createHash65 } from "node:crypto";
+import { createHash as createHash66 } from "node:crypto";
 import { basename as basename13, dirname as dirname25, resolve as resolve97 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 function resolveTenantDdlRoleNameFromDatabaseUrl(databaseUrl) {
@@ -413903,12 +413930,12 @@ function buildV1MigrationIdentity(migrationsDir) {
   const files = collectMigrationSqlFilePaths(migrationsDir, true);
   const rows4 = files.map((filePath) => {
     const name = basename13(dirname25(filePath));
-    const sqlSha256 = createHash65("sha256").update(readFileSync54(filePath)).digest("hex");
+    const sqlSha256 = createHash66("sha256").update(readFileSync54(filePath)).digest("hex");
     return { name, sqlSha256 };
   });
   return {
     migrationNames: rows4.map((row) => row.name),
-    bundleSha256: createHash65("sha256").update(JSON.stringify(rows4)).digest("hex")
+    bundleSha256: createHash66("sha256").update(JSON.stringify(rows4)).digest("hex")
   };
 }
 async function resolveWorkspaceSchemaDeploymentDecision(params) {
@@ -414003,7 +414030,7 @@ async function prepareAppSchemaProofSource(appName, options = {}) {
   };
 }
 function buildSchemaNoopInspection(decision) {
-  const fingerprint3 = createHash65("sha256").update(JSON.stringify(decision)).digest("hex").slice(0, 24);
+  const fingerprint3 = createHash66("sha256").update(JSON.stringify(decision)).digest("hex").slice(0, 24);
   return { planId: `mig_${fingerprint3}`, appliedVerifiedCount: 0, pendingCount: 0 };
 }
 async function reconcileDrizzleMigrationStoreBeforePrimaryMigrate(params) {
@@ -414618,11 +414645,11 @@ var init_provisioner_verified_runtime_layout = __esm({
 });
 
 // ../platform/src/legacy-runtime-dependency-evidence.ts
-import { createHash as createHash66 } from "node:crypto";
+import { createHash as createHash67 } from "node:crypto";
 import { existsSync as existsSync58, lstatSync as lstatSync12, readFileSync as readFileSync56, realpathSync as realpathSync11, statSync as statSync13 } from "node:fs";
 import { join as join24, resolve as resolve99, sep as sep7 } from "node:path";
 function sha25612(value) {
-  return `sha256:${createHash66("sha256").update(value).digest("hex")}`;
+  return `sha256:${createHash67("sha256").update(value).digest("hex")}`;
 }
 function readBoundedRegularFile(path4, maxBytes) {
   try {
@@ -416529,7 +416556,7 @@ var init_runtime_absence_terminalizer = __esm({
 });
 
 // ../platform/src/app-candidate-generation-store.ts
-import { createHash as createHash67, randomUUID as randomUUID29 } from "node:crypto";
+import { createHash as createHash68, randomUUID as randomUUID29 } from "node:crypto";
 import {
   chmod as chmod4,
   chown,
@@ -416547,7 +416574,7 @@ import {
 } from "node:fs/promises";
 import { basename as basename14, dirname as dirname27, isAbsolute as isAbsolute16, join as join26, relative as relative24, resolve as resolve101, sep as sep8 } from "node:path";
 function sha25613(value) {
-  return createHash67("sha256").update(value).digest("hex");
+  return createHash68("sha256").update(value).digest("hex");
 }
 function fail14(code) {
   throw new Error(code);
@@ -416583,7 +416610,7 @@ async function verifyOrSealWorkspace(input) {
   const durableDataDir = resolve101(input.durableDataDir);
   const workspaceRoot = await realpath(workspacePath);
   const runtimeGenerationRoot = await realpath(input.runtimeGenerationRoot);
-  const closure = createHash67("sha256");
+  const closure = createHash68("sha256");
   const runtimeGenerationDir = dirname27(runtimeGenerationRoot);
   const runtimeGenerationPublicNodeModulesDir = join26(runtimeGenerationDir, "public-node_modules");
   const runtimeGenerationManifest = join26(runtimeGenerationDir, "runtime-manifest.json");
@@ -417550,14 +417577,14 @@ var init_candidate_failure_reconciliation = __esm({
 });
 
 // ../platform/src/legacy-runtime-bootstrap-store.ts
-import { createHash as createHash68 } from "node:crypto";
+import { createHash as createHash69 } from "node:crypto";
 import { and as and27, eq as eq31, inArray as inArray15, isNull as isNull8, or as or10, sql as sql85 } from "drizzle-orm";
 function sameDesired(left, right) {
   if (!left || !right) return left === null && !right;
   return left.authorityMode === right.authorityMode && left.desiredRuntimeState === right.desiredRuntimeState && left.desiredActivationId === right.desiredActivationId && left.activationEpoch === right.activationEpoch && left.nodeId === right.nodeId && left.nodeEpoch === right.nodeEpoch;
 }
 function servingProofHash(input) {
-  return createHash68("sha256").update(
+  return createHash69("sha256").update(
     JSON.stringify([
       "legacy-bootstrap-serving-proof-v1",
       input.appId,
@@ -418086,7 +418113,7 @@ var init_route_activation_adapter = __esm({
 });
 
 // ../server/src/runtime-ready-contract.ts
-import { createHash as createHash69 } from "node:crypto";
+import { createHash as createHash70 } from "node:crypto";
 function fail18(code) {
   throw new Error(code);
 }
@@ -418118,7 +418145,7 @@ function canonicalRuntimeReadyContract2(contract) {
   };
 }
 function buildRuntimeReadyContractHash2(contract) {
-  return createHash69("sha256").update(JSON.stringify(canonicalRuntimeReadyContract2(contract))).digest("hex");
+  return createHash70("sha256").update(JSON.stringify(canonicalRuntimeReadyContract2(contract))).digest("hex");
 }
 function buildRuntimeReadyAttestationEnvelope2(contract, observedOperation) {
   const canonical = canonicalRuntimeReadyContract2(contract);
@@ -418134,7 +418161,7 @@ function buildRuntimeReadyAttestationEnvelope2(contract, observedOperation) {
     candidateSessionNonce: canonical.instanceId,
     readyContractHash: buildRuntimeReadyContractHash2(canonical),
     callableBackend: canonical.callableBackend,
-    capabilityHash: createHash69("sha256").update(JSON.stringify(canonical.capabilityNames)).digest("hex"),
+    capabilityHash: createHash70("sha256").update(JSON.stringify(canonical.capabilityNames)).digest("hex"),
     ...canonical.expectedOperationManifestHash ? {
       operationManifestHash: observedOperation?.manifestHash ?? canonical.expectedOperationManifestHash,
       operationCount: observedOperation?.count ?? canonical.expectedOperationCount
@@ -418558,10 +418585,10 @@ var init_runtime_candidate_cleanup = __esm({
 });
 
 // ../platform/src/runtime-candidate-identity.ts
-import { createHash as createHash70 } from "node:crypto";
+import { createHash as createHash71 } from "node:crypto";
 import { and as and30, eq as eq34, inArray as inArray18, isNull as isNull10, or as or12, sql as sql88 } from "drizzle-orm";
 function sha25614(value) {
-  return createHash70("sha256").update(value).digest("hex");
+  return createHash71("sha256").update(value).digest("hex");
 }
 function fail20(code) {
   throw new Error(code);
@@ -419397,13 +419424,13 @@ var init_deployment_control_plane_orchestrator = __esm({
 });
 
 // ../platform/src/deployment-schema-revision.ts
-import { createHash as createHash71 } from "node:crypto";
+import { createHash as createHash72 } from "node:crypto";
 import { and as and31, eq as eq35, isNull as isNull11, or as or13 } from "drizzle-orm";
 function fail21(code) {
   throw Object.assign(new Error(code), { code });
 }
 function sha25615(value) {
-  return createHash71("sha256").update(value).digest("hex");
+  return createHash72("sha256").update(value).digest("hex");
 }
 function revisionSelection() {
   return {
@@ -420538,9 +420565,9 @@ var init_apps_schema_push_safety = __esm({
 });
 
 // ../platform/src/tenant-database-authority-contract.ts
-import { createHash as createHash72 } from "node:crypto";
+import { createHash as createHash73 } from "node:crypto";
 function buildTenantAuthorityBindingFingerprint(input) {
-  return createHash72("sha256").update(
+  return createHash73("sha256").update(
     JSON.stringify({
       appId: input.appId,
       appInstanceId: input.appInstanceId,
@@ -420744,10 +420771,10 @@ var init_deployment_schema_constraint = __esm({
 });
 
 // ../platform/src/deployment-schema-preparation.ts
-import { createHash as createHash73 } from "node:crypto";
+import { createHash as createHash74 } from "node:crypto";
 import { resolve as resolve104 } from "node:path";
 function sha25616(value) {
-  return createHash73("sha256").update(value).digest("hex");
+  return createHash74("sha256").update(value).digest("hex");
 }
 async function prepareDeploymentSchema(input, hooks = defaultHooks) {
   if (input.environment) {
@@ -422014,10 +422041,10 @@ var init_runtime_stop_dispatch_recovery = __esm({
 });
 
 // ../platform/src/runtime-stop-intent-store.ts
-import { createHash as createHash74 } from "node:crypto";
+import { createHash as createHash75 } from "node:crypto";
 import { and as and37, eq as eq41, exists as exists2, gt as gt7, inArray as inArray20, isNotNull as isNotNull2, isNull as isNull13, lte as lte9, or as or15, sql as sql94 } from "drizzle-orm";
 function sha25617(value) {
-  return createHash74("sha256").update(value).digest("hex");
+  return createHash75("sha256").update(value).digest("hex");
 }
 function fail25(code) {
   throw new Error(code);
@@ -422622,7 +422649,7 @@ var init_runtime_exit_store = __esm({
 });
 
 // ../platform/src/runtime-convergence-command-store.ts
-import { createHash as createHash75 } from "node:crypto";
+import { createHash as createHash76 } from "node:crypto";
 import { and as and39, eq as eq43, inArray as inArray22, sql as sql96 } from "drizzle-orm";
 async function enqueueRuntimeConvergenceCommand(input) {
   return enqueueRuntimeConvergenceCommandWithPolicy(input, {
@@ -422658,9 +422685,9 @@ async function enqueueRuntimeConvergenceCommandWithPolicy(input, policy) {
   if (!Number.isSafeInteger(input.appId) || input.appId < 1 || policy.expectedCurrentDeploymentId !== void 0 && (!Number.isSafeInteger(policy.expectedCurrentDeploymentId) || policy.expectedCurrentDeploymentId < 1) || !["running", "stopped", "absent"].includes(input.targetRuntimeState) || input.expectedDesiredRuntimeState !== void 0 && input.expectedDesiredRuntimeState !== expectedDesiredForTarget[input.targetRuntimeState] || !["controller", "owner", "admin", "platform"].includes(input.actorKind) || !CORRELATION_ID.test(input.correlationId)) {
     throw new Error("RUNTIME_CONVERGENCE_ENQUEUE_INPUT_INVALID");
   }
-  const identityHash = createHash75("sha256").update(JSON.stringify([1, input.appId, input.targetRuntimeState, input.correlationId])).digest("hex");
+  const identityHash = createHash76("sha256").update(JSON.stringify([1, input.appId, input.targetRuntimeState, input.correlationId])).digest("hex");
   const operationId2 = `runtime_converge_${identityHash.slice(0, 32)}`;
-  const actorIdHash = input.actorId ? createHash75("sha256").update(input.actorId).digest("hex") : null;
+  const actorIdHash = input.actorId ? createHash76("sha256").update(input.actorId).digest("hex") : null;
   return input.db.transaction(async (tx) => {
     const lockedApp = await tx.execute(sql96`
       SELECT id,
@@ -424169,10 +424196,10 @@ var init_runtime_expired_retirement_renewal = __esm({
 });
 
 // ../platform/src/runtime-absence-proof-store.ts
-import { createHash as createHash76, randomUUID as randomUUID31 } from "node:crypto";
+import { createHash as createHash77, randomUUID as randomUUID31 } from "node:crypto";
 import { and as and45, eq as eq49, isNull as isNull18, ne as ne12 } from "drizzle-orm";
 function hash3(value) {
-  return createHash76("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash77("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function runtimeAbsenceEvidenceHash(evidence) {
   if (!Number.isSafeInteger(evidence.deploymentId) || evidence.deploymentId <= 0 || !evidence.appInstanceId || !evidence.activationId || !evidence.instanceId || !evidence.artifactRef || !evidence.sourceGenerationRef || !evidence.runtimeGenerationRef || !evidence.nodeId || !Number.isSafeInteger(evidence.nodeEpoch) || evidence.nodeEpoch < 0 || !Number.isSafeInteger(evidence.leaseEpoch) || evidence.leaseEpoch < 0) {
@@ -424349,10 +424376,10 @@ var init_runtime_absence_proof_store = __esm({
 });
 
 // ../platform/src/runtime-crash-recovery-store.ts
-import { createHash as createHash77, randomUUID as randomUUID32 } from "node:crypto";
+import { createHash as createHash78, randomUUID as randomUUID32 } from "node:crypto";
 import { and as and46, eq as eq50, isNull as isNull19 } from "drizzle-orm";
 function hash4(value) {
-  return createHash77("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash78("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function runtimeCrashRecoveryEvidenceHash(evidence) {
   if (!evidence.artifactRef || !evidence.sourceGenerationRef || !evidence.runtimeGenerationRef || !evidence.nodeId) {
@@ -425030,7 +425057,7 @@ var init_deployment_executor_spool_compensation = __esm({
 });
 
 // ../platform/src/app-release-restore-operation.ts
-import { createHash as createHash78, randomUUID as randomUUID33 } from "node:crypto";
+import { createHash as createHash79, randomUUID as randomUUID33 } from "node:crypto";
 import { and as and50, eq as eq54, gt as gt11, inArray as inArray27, isNull as isNull21, like as like3, lte as lte11, or as or18, sql as sql99 } from "drizzle-orm";
 var DEFAULT_LEASE_MS, DEFAULT_HEARTBEAT_MS;
 var init_app_release_restore_operation = __esm({
@@ -425284,9 +425311,9 @@ var init_runtime_absence_rollout = __esm({
 });
 
 // ../platform/src/runtime-absence-fleet-observer.ts
-import { createHash as createHash79, createHmac as createHmac12, randomUUID as randomUUID34, timingSafeEqual as timingSafeEqual12 } from "node:crypto";
+import { createHash as createHash80, createHmac as createHmac12, randomUUID as randomUUID34, timingSafeEqual as timingSafeEqual12 } from "node:crypto";
 function hash5(value) {
-  return createHash79("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash80("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function buildRuntimeAbsenceObservationSignature(input) {
   return createHmac12("sha256", input.secret).update(
@@ -426919,7 +426946,7 @@ var init_runtime_candidate_cgroup_cleanup = __esm({
 });
 
 // ../platform/src/runtime-exact-stable-crash-recovery.ts
-import { createHash as createHash80 } from "node:crypto";
+import { createHash as createHash81 } from "node:crypto";
 import { and as and60, eq as eq65, inArray as inArray34, isNull as isNull25, ne as ne13, sql as sql104 } from "drizzle-orm";
 function createExactStableRuntimeCrashRecoveryResolver(adapterInput, currentNodeId, inspectInstance) {
   const resolveWithDb = (db, appId) => resolveExactStableRuntimeCrashRecovery({
@@ -427054,7 +427081,7 @@ async function resolveExactStableRuntimeCrashRecovery(input) {
       const inspection = await input.inspectInstance(binding.appName, rows4[0]);
       if (!(inspection.live && inspection.runnerRefExact && inspection.pidExact && inspection.identityExact && inspection.readyExact))
         return null;
-      return createHash80("sha256").update(
+      return createHash81("sha256").update(
         JSON.stringify([
           evidence.evidenceHash,
           binding.bindingHash,
@@ -427925,10 +427952,10 @@ var init_runtime_explicit_stop_expired_drain = __esm({
 });
 
 // ../platform/src/runtime-explicit-stop-store.ts
-import { createHash as createHash81 } from "node:crypto";
+import { createHash as createHash82 } from "node:crypto";
 import { and as and63, eq as eq68, inArray as inArray36, isNotNull as isNotNull6, isNull as isNull28, sql as sql106 } from "drizzle-orm";
 function digest2(value) {
-  return createHash81("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash82("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function safeLifecycleFailureCode(value) {
   const code = value instanceof Error ? value.message : String(value);
@@ -428767,10 +428794,10 @@ var init_legacy_runtime_evidence_observer = __esm({
 });
 
 // ../platform/src/runtime-legacy-preserve-operation-store.ts
-import { createHash as createHash82 } from "node:crypto";
+import { createHash as createHash83 } from "node:crypto";
 import { and as and66, eq as eq71, inArray as inArray38, lte as lte13, sql as sql107 } from "drizzle-orm";
 function hash6(value) {
-  return createHash82("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash83("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function fail32(code) {
   throw new Error(code);
@@ -428950,10 +428977,10 @@ var init_runtime_lifecycle_policy = __esm({
 });
 
 // ../platform/src/runtime-scale-down-store.ts
-import { createHash as createHash83 } from "node:crypto";
+import { createHash as createHash84 } from "node:crypto";
 import { and as and67, eq as eq72, inArray as inArray39, isNull as isNull29, sql as sql108 } from "drizzle-orm";
 function hash7(value) {
-  return createHash83("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash84("sha256").update(JSON.stringify(value)).digest("hex");
 }
 async function recordScaleDownRemediation(input) {
   const now = input.now ?? /* @__PURE__ */ new Date();
@@ -429512,10 +429539,10 @@ var init_runtime_malformed_legacy_absence_recovery = __esm({
 });
 
 // ../platform/src/legacy-runtime-bootstrap-orchestrator.ts
-import { createHash as createHash84, randomUUID as randomUUID35 } from "node:crypto";
+import { createHash as createHash85, randomUUID as randomUUID35 } from "node:crypto";
 import { and as and70, eq as eq75, gt as gt14, inArray as inArray42, notInArray as notInArray4 } from "drizzle-orm";
 function hash8(value) {
-  return createHash84("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash85("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function diagnosticDecisionReason(decisionReason, evidence) {
   const incompleteReason = evidence.incompleteReason;
@@ -430024,7 +430051,7 @@ var init_runtime_control_plane_reconciler = __esm({
 });
 
 // ../platform/src/runtime-legacy-effective-route-proof.ts
-import { createHash as createHash85 } from "node:crypto";
+import { createHash as createHash86 } from "node:crypto";
 import { eq as eq76 } from "drizzle-orm";
 function fail34(code) {
   throw new Error(code);
@@ -430068,7 +430095,7 @@ async function loadLegacyEffectiveRouteGateProof(input) {
     listener: { identity: null, hash: null },
     route: { identity: null, hash: null }
   };
-  const proofHash = createHash85("sha256").update(
+  const proofHash = createHash86("sha256").update(
     JSON.stringify({
       appId: input.appId,
       appName: app2.name,
@@ -430104,7 +430131,7 @@ async function loadLegacyEffectiveRouteGateProof(input) {
         slotHashes: durable.slots.slice().sort((left, right) => left.platformSlot.localeCompare(right.platformSlot)).map((slot) => slot.bindingHash)
       }
     },
-    unverifiedCompositeDigest: legacyProof.process.hash && legacyProof.warmPool.hash && legacyProof.listener.hash ? createHash85("sha256").update(
+    unverifiedCompositeDigest: legacyProof.process.hash && legacyProof.warmPool.hash && legacyProof.listener.hash ? createHash86("sha256").update(
       JSON.stringify({
         appId: input.appId,
         appName: app2.name,
@@ -431528,10 +431555,10 @@ var init_runtime_control_plane_lifecycle = __esm({
 });
 
 // ../platform/src/deployment-control-plane-observer.ts
-import { createHash as createHash86, randomUUID as randomUUID36 } from "node:crypto";
+import { createHash as createHash87, randomUUID as randomUUID36 } from "node:crypto";
 import { and as and74, eq as eq80, gt as gt17, sql as sql112 } from "drizzle-orm";
 function observedActivationId(appId, deploymentId) {
-  const digest4 = createHash86("sha256").update(`legacy-observed\0${appId}\0${deploymentId}`).digest("hex").slice(0, 32);
+  const digest4 = createHash87("sha256").update(`legacy-observed\0${appId}\0${deploymentId}`).digest("hex").slice(0, 32);
   return `legacy_${digest4}`;
 }
 function resolveNodeId(nodeId) {
@@ -431850,7 +431877,7 @@ var init_runtime_stop_operation = __esm({
 });
 
 // ../platform/src/app-delete-terminal-evidence.ts
-import { createHash as createHash87 } from "node:crypto";
+import { createHash as createHash88 } from "node:crypto";
 var init_app_delete_terminal_evidence = __esm({
   "../platform/src/app-delete-terminal-evidence.ts"() {
     "use strict";
@@ -432222,10 +432249,10 @@ var init_platform_api_runtime_convergence = __esm({
 });
 
 // ../platform/src/runtime-manual-crash-recovery-approval-store.ts
-import { createHash as createHash88 } from "node:crypto";
+import { createHash as createHash89 } from "node:crypto";
 import { and as and82, eq as eq89, sql as sql116 } from "drizzle-orm";
 function digest3(value) {
-  return createHash88("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash89("sha256").update(JSON.stringify(value)).digest("hex");
 }
 async function approveManualCrashRecovery(input) {
   if (!Number.isSafeInteger(input.appId) || input.appId < 1 || !input.actorId || !input.correlationId) {
@@ -458626,8 +458653,8 @@ function getSecretKey() {
     return cachedKey;
   const internalToken = process.env.GENCOW_INTERNAL_TOKEN;
   if (internalToken) {
-    const { createHash: createHash89 } = __require("crypto");
-    cachedKey = createHash89("sha256").update(`gencow-settings-key:${internalToken}`).digest().subarray(0, KEY_LENGTH);
+    const { createHash: createHash90 } = __require("crypto");
+    cachedKey = createHash90("sha256").update(`gencow-settings-key:${internalToken}`).digest().subarray(0, KEY_LENGTH);
     return cachedKey;
   }
   const keyPath = resolveSecretKeyPath();