@camstack/system 1.1.39 → 1.1.41

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-BGvIVCm_.js");
+const require_manifest_python_deps = require("./manifest-python-deps-BVUZVpma.js");
 const require_custom_action_registry = require("./custom-action-registry-vLYEFTtv.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { F as createUdsLoggerWithControl, I as LocalChildClient, i as createUdsAddonContext, it as setWorkerNativeCapsChangeListener, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestPythonDeps, tt as getWorkerNativeCapProvider, vt as installManifestNativeDeps, yt as resolveAddonClass } from "./manifest-python-deps-BjxBfiFd.mjs";
+import { F as createUdsLoggerWithControl, I as LocalChildClient, i as createUdsAddonContext, it as setWorkerNativeCapsChangeListener, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestPythonDeps, tt as getWorkerNativeCapProvider, vt as installManifestNativeDeps, yt as resolveAddonClass } from "./manifest-python-deps-DyIcZtF5.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-BEXwC-oo.mjs";
 import { register } from "node:module";
 import * as fs from "node:fs";

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, et as BaseAddon, f as addonPagesCapability, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, et as BaseAddon, f as addonPagesCapability, st as EventCategory } from "../../dist-ClOjKsC4.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, et as BaseAddon, m as addonWidgetsCapability, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, et as BaseAddon, m as addonWidgetsCapability, st as EventCategory } from "../../dist-ClOjKsC4.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 //#region src/builtins/alerts/alerts.addon.ts
 var CATEGORY_MAPPINGS = {
 	"addon.crashed": {

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, et as BaseAddon, h as alertsCapability, mt as createEvent, n as AlertSchema, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, et as BaseAddon, h as alertsCapability, mt as createEvent, n as AlertSchema, st as EventCategory } from "../../dist-ClOjKsC4.mjs";
 //#region src/builtins/alerts/alerts.addon.ts
 var CATEGORY_MAPPINGS = {
 	"addon.crashed": {

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 let node_fs = require("node:fs");
 let node_fs$1 = require_chunk.__toESM(node_fs, 1);
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { et as BaseAddon, st as EventCategory, v as backupCapability } from "../../dist-CU3lb_Ys.mjs";
+import { et as BaseAddon, st as EventCategory, v as backupCapability } from "../../dist-ClOjKsC4.mjs";
 import * as fs from "node:fs";
 import Kt from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { P as logDestinationCapability, et as BaseAddon } from "../../dist-CU3lb_Ys.mjs";
+import { P as logDestinationCapability, et as BaseAddon } from "../../dist-ClOjKsC4.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, C as enumerateItemArrayFields, D as getByPath, Q as validateExpressionSource, R as normalizeUnit, S as deviceStatusCapability, T as evaluateLinkExpression, Tt as sleep, W as setByPath, X as toExpressionValue, a as DeviceStatusSchema, at as DeviceRole, b as deviceManagerCapability, c as STREAM_PROFILE_META, et as BaseAddon, g as applyTransform, i as CAP_NAMES_WITH_STATUS, it as DeviceFeature, ot as DeviceType, st as EventCategory, t as ALL_CAPABILITY_DEFINITIONS, ut as WELL_KNOWN_TAB_MAP, w as enumerateSchemaFields, x as deviceStateCapability, y as buildStreamParamsConfigSchema, yt as isDeviceConfigCap, z as parseStreamParamsFormPatch } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, C as enumerateItemArrayFields, D as getByPath, Q as validateExpressionSource, R as normalizeUnit, S as deviceStatusCapability, T as evaluateLinkExpression, Tt as sleep, W as setByPath, X as toExpressionValue, a as DeviceStatusSchema, at as DeviceRole, b as deviceManagerCapability, c as STREAM_PROFILE_META, et as BaseAddon, g as applyTransform, i as CAP_NAMES_WITH_STATUS, it as DeviceFeature, ot as DeviceType, st as EventCategory, t as ALL_CAPABILITY_DEFINITIONS, ut as WELL_KNOWN_TAB_MAP, w as enumerateSchemaFields, x as deviceStateCapability, y as buildStreamParamsConfigSchema, yt as isDeviceConfigCap, z as parseStreamParamsFormPatch } from "../../dist-ClOjKsC4.mjs";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { P as logDestinationCapability, et as BaseAddon } from "../../dist-CU3lb_Ys.mjs";
+import { P as logDestinationCapability, et as BaseAddon } from "../../dist-ClOjKsC4.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,4 +1,4 @@
-import { Z as userManagementCapability, _ as authProviderCapability, d as UserRecordSchema, et as BaseAddon, l as ScopedTokenSchema, r as ApiKeyRecordSchema } from "../../dist-CU3lb_Ys.mjs";
+import { Z as userManagementCapability, _ as authProviderCapability, d as UserRecordSchema, et as BaseAddon, l as ScopedTokenSchema, r as ApiKeyRecordSchema } from "../../dist-ClOjKsC4.mjs";
 import { createRequire } from "node:module";
 import * as crypto$1 from "node:crypto";
 import { randomUUID } from "node:crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { N as localNetworkCapability, et as BaseAddon, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { N as localNetworkCapability, et as BaseAddon, st as EventCategory } from "../../dist-ClOjKsC4.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { I as metricsProviderCapability, et as BaseAddon, mt as createEvent, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { I as metricsProviderCapability, et as BaseAddon, mt as createEvent, st as EventCategory } from "../../dist-ClOjKsC4.mjs";
 import * as fs from "node:fs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/platform-probe/index.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, B as platformProbeCapability, U as scoreRuntimes, et as BaseAddon, gt as emitReadiness, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, B as platformProbeCapability, U as scoreRuntimes, et as BaseAddon, gt as emitReadiness, st as EventCategory } from "../../dist-ClOjKsC4.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { et as BaseAddon, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { et as BaseAddon, st as EventCategory } from "../../dist-ClOjKsC4.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 let node_child_process = require("node:child_process");
 //#region src/builtins/snapshot/snapshot.addon.ts
 /** Default cache window for non-battery cams (seconds). 10s feels live. */

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, K as snapshotCapability, L as nodePin, Y as streamQualityLabel, et as BaseAddon, it as DeviceFeature, ot as DeviceType } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, K as snapshotCapability, L as nodePin, Y as streamQualityLabel, et as BaseAddon, it as DeviceFeature, ot as DeviceType } from "../../dist-ClOjKsC4.mjs";
 import { execFile } from "node:child_process";
 //#region src/builtins/snapshot/snapshot.addon.ts
 /** Default cache window for non-battery cams (seconds). 10s feels live. */

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { E as filesystemBrowseCapability, J as storageProviderCapability, et as BaseAddon } from "../../dist-CU3lb_Ys.mjs";
+import { E as filesystemBrowseCapability, J as storageProviderCapability, et as BaseAddon } from "../../dist-ClOjKsC4.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { basename, dirname, join, resolve, sep } from "node:path";

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 let node_crypto = require("node:crypto");
 let better_sqlite3 = require("better-sqlite3");
 better_sqlite3 = require_chunk.__toESM(better_sqlite3);

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, G as settingsStoreCapability, dt as asJsonObject, et as BaseAddon, s as RUNTIME_DEFAULTS, xt as parseJsonUnknown } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, G as settingsStoreCapability, dt as asJsonObject, et as BaseAddon, s as RUNTIME_DEFAULTS, xt as parseJsonUnknown } from "../../dist-ClOjKsC4.mjs";
 import { randomUUID } from "node:crypto";
 import Database from "better-sqlite3";
 //#region src/builtins/sqlite-storage/sqlite-settings-backend.ts

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { bt as parseJsonObject, et as BaseAddon, q as storageCapability, u as StorageLocationTypeSchema } from "../../dist-CU3lb_Ys.mjs";
+import { bt as parseJsonObject, et as BaseAddon, q as storageCapability, u as StorageLocationTypeSchema } from "../../dist-ClOjKsC4.mjs";
 import * as path$1 from "node:path";
 import * as fs from "node:fs/promises";
 import { buildStorageLocationRegistry } from "@camstack/system";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, et as BaseAddon, vt as hydrateSchema } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, et as BaseAddon, vt as hydrateSchema } from "../../dist-ClOjKsC4.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-BCseJMTD.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { P as logDestinationCapability, et as BaseAddon } from "../../dist-CU3lb_Ys.mjs";
+import { P as logDestinationCapability, et as BaseAddon } from "../../dist-ClOjKsC4.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-fRVWwrkF.js → dist-BCseJMTD.js}

@@ -16578,10 +16578,32 @@ getTurnServers: method(zod.z.void(), zod.z.array(TurnServerSchema).readonly()) }
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
 *
+*   4. Second-factor preference (opt-in, default OFF):
+*      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+*      demanded as a second factor after a password login ONLY when the
+*      user explicitly opts in via `setSecondFactorPreference`.
+*      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+*        row ⇒ `enabled: false`).
+*      - `setSecondFactorPreference({userId, enabled})` — persisted by
+*        the providing addon beside its credentials.
+*
 * Challenges are short-lived (5 min, in-memory). The cap is internal —
 * the admin-ui composes the begin/finish round-trip and never exposes
 * the cap to non-admins.
@@ -16634,6 +16656,19 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			access: "view"
 		}),
+		beginDiscoverableAuthentication: method(zod.z.object({}), zod.z.object({ optionsJSON: zod.z.record(zod.z.string(), zod.z.unknown()) }), {
+			kind: "mutation",
+			access: "view"
+		}),
+		finishDiscoverableAuthentication: method(zod.z.object({ 
+		/** AuthenticationResponseJSON from the browser. */
+response: zod.z.record(zod.z.string(), zod.z.unknown()) }), zod.z.object({
+			verified: zod.z.boolean(),
+			userId: zod.z.string().nullable()
+		}), {
+			kind: "mutation",
+			access: "view"
+		}),
 		listPasskeys: method(zod.z.object({ userId: zod.z.string() }), zod.z.array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(zod.z.object({
 			userId: zod.z.string(),
@@ -16642,6 +16677,15 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
+		}),
+		getSecondFactorPreference: method(zod.z.object({ userId: zod.z.string() }), zod.z.object({ enabled: zod.z.boolean() }), { auth: "admin" }),
+		setSecondFactorPreference: method(zod.z.object({
+			userId: zod.z.string(),
+			enabled: zod.z.boolean()
+		}), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
 		})
 	}
 };
@@ -24532,6 +24576,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -24544,12 +24594,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"userPasskeys.getSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.listPasskeys": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -24562,6 +24624,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userPasskeys.setSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",

package/dist/{dist-CU3lb_Ys.mjs → dist-ClOjKsC4.mjs}

@@ -16578,10 +16578,32 @@ getTurnServers: method(z.void(), z.array(TurnServerSchema).readonly()) }
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
 *
+*   4. Second-factor preference (opt-in, default OFF):
+*      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+*      demanded as a second factor after a password login ONLY when the
+*      user explicitly opts in via `setSecondFactorPreference`.
+*      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+*        row ⇒ `enabled: false`).
+*      - `setSecondFactorPreference({userId, enabled})` — persisted by
+*        the providing addon beside its credentials.
+*
 * Challenges are short-lived (5 min, in-memory). The cap is internal —
 * the admin-ui composes the begin/finish round-trip and never exposes
 * the cap to non-admins.
@@ -16634,6 +16656,19 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			access: "view"
 		}),
+		beginDiscoverableAuthentication: method(z.object({}), z.object({ optionsJSON: z.record(z.string(), z.unknown()) }), {
+			kind: "mutation",
+			access: "view"
+		}),
+		finishDiscoverableAuthentication: method(z.object({ 
+		/** AuthenticationResponseJSON from the browser. */
+response: z.record(z.string(), z.unknown()) }), z.object({
+			verified: z.boolean(),
+			userId: z.string().nullable()
+		}), {
+			kind: "mutation",
+			access: "view"
+		}),
 		listPasskeys: method(z.object({ userId: z.string() }), z.array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(z.object({
 			userId: z.string(),
@@ -16642,6 +16677,15 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
+		}),
+		getSecondFactorPreference: method(z.object({ userId: z.string() }), z.object({ enabled: z.boolean() }), { auth: "admin" }),
+		setSecondFactorPreference: method(z.object({
+			userId: z.string(),
+			enabled: z.boolean()
+		}), z.object({ success: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
 		})
 	}
 };
@@ -24532,6 +24576,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -24544,12 +24594,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"userPasskeys.getSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.listPasskeys": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -24562,6 +24624,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userPasskeys.setSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-fRVWwrkF.js");
+const require_dist = require("./dist-BCseJMTD.js");
 const require_model_download_service = require("./model-download-service-D-Umz4-L.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
@@ -21,7 +21,7 @@ const require_builtins_local_auth_local_auth_addon = require("./builtins/local-a
 require("./builtins/local-auth/index.js");
 const require_builtins_device_manager_device_manager_addon = require("./builtins/device-manager/device-manager.addon.js");
 require("./builtins/device-manager/index.js");
-const require_manifest_python_deps = require("./manifest-python-deps-BGvIVCm_.js");
+const require_manifest_python_deps = require("./manifest-python-deps-BVUZVpma.js");
 const require_custom_action_registry = require("./custom-action-registry-vLYEFTtv.js");
 let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg$1, A as isVoidInput, Ct as resolveCapMount, F as looseSchema, M as lifecycleJobSchema, O as isArrayOutputSchema, St as readinessKey, V as procedureAuthKey, _t as expandCapMethods, bt as parseJsonObject, ct as ReadinessRegistry, dt as asJsonObject$1, ft as asNumber, ht as emitDownForOwnedCaps, j as kebabToCamel, k as isObjectInput, lt as ReadinessTimeoutError, mt as createEvent, nt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, o as METHOD_ACCESS_MAP, p as addonSettingsCapability, pt as asString$1, rt as DEVICE_STATUS_METHOD, s as RUNTIME_DEFAULTS, st as EventCategory$1, t as ALL_CAPABILITY_DEFINITIONS, tt as DATAPLANE_SECRET_HEADER$1, wt as scopeKey, xt as parseJsonUnknown$1 } from "./dist-CU3lb_Ys.mjs";
+import { $ as errMsg$1, A as isVoidInput, Ct as resolveCapMount, F as looseSchema, M as lifecycleJobSchema, O as isArrayOutputSchema, St as readinessKey, V as procedureAuthKey, _t as expandCapMethods, bt as parseJsonObject, ct as ReadinessRegistry, dt as asJsonObject$1, ft as asNumber, ht as emitDownForOwnedCaps, j as kebabToCamel, k as isObjectInput, lt as ReadinessTimeoutError, mt as createEvent, nt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, o as METHOD_ACCESS_MAP, p as addonSettingsCapability, pt as asString$1, rt as DEVICE_STATUS_METHOD, s as RUNTIME_DEFAULTS, st as EventCategory$1, t as ALL_CAPABILITY_DEFINITIONS, tt as DATAPLANE_SECRET_HEADER$1, wt as scopeKey, xt as parseJsonUnknown$1 } from "./dist-ClOjKsC4.mjs";
 import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-C-IHWnXx.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Le3l0qS2.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
@@ -19,7 +19,7 @@ import { LocalAuthAddon, a as require_ms, c as __esmMin, d as __toCommonJS, f as
 import "./builtins/local-auth/index.mjs";
 import { DeviceManagerAddon } from "./builtins/device-manager/device-manager.addon.mjs";
 import "./builtins/device-manager/index.mjs";
-import { $ as buildUdsNativeCapProxy, A as createParentUnownedCallHandler, B as AGENT_CAP_FWD_SERVICE, C as buildLinkChain, D as HUB_CAP_FWD_ACTION, E as localProviderLink, F as createUdsLoggerWithControl, G as createLocalTransport, H as CapRouteError, I as LocalChildClient, J as SocketChannel, K as UdsLocalTransportClient, L as LocalChildRegistry, M as createUdsEventBus, N as udsChildLogToWorkerEntry, O as HUB_CAP_FWD_SERVICE, P as createUdsLogger, Q as buildNativeCapProxy, R as UDS_NO_ROUTE_PREFIX, S as brokerTransportLink, T as ipcParentLink, U as classifyCapRoute, V as CapRouteResolver, W as callWithServiceDiscovery, X as FrameDecoder, Y as localEndpointPath, Z as encodeFrame, _ as resolveHwAccel, _t as CapabilityUnavailableError, a as getWorkerDeviceRegistry, at as createAddonService, b as getCapUsageRegistry, c as setHubConnected, ct as capActionName, d as getMoleculerEventStats, dt as capServiceName, et as createBrokerDeviceManagerApi, f as registerEventBusService, ft as parseCapAction, g as createKernelHwAccel, gt as CapabilityHandle, h as AddonDepsManager, ht as DeviceRegistry, i as createUdsAddonContext, j as createUdsEventBridge, k as createHubCapForwardService, l as EVENT_TOPIC_PREFIX, lt as capActionSuffix, m as subscribePassthrough, mt as serializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as validateProviderRegistrations, p as setNodeEventInterest, pt as deserializeTypedArrays, q as UdsLocalTransportServer, r as createAddonContext, rt as mountNativeCapService, s as getOrInitReadinessRegistryForClient, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestPythonDeps, u as getBrokerEventBus, ut as capBareAction, v as CapUsageRegistry, vt as installManifestNativeDeps, w as ipcChildLink, x as brokerCallForCap, y as __resetCapUsageRegistryForTests, yt as resolveAddonClass, z as AGENT_CAP_FWD_ACTION } from "./manifest-python-deps-BjxBfiFd.mjs";
+import { $ as buildUdsNativeCapProxy, A as createParentUnownedCallHandler, B as AGENT_CAP_FWD_SERVICE, C as buildLinkChain, D as HUB_CAP_FWD_ACTION, E as localProviderLink, F as createUdsLoggerWithControl, G as createLocalTransport, H as CapRouteError, I as LocalChildClient, J as SocketChannel, K as UdsLocalTransportClient, L as LocalChildRegistry, M as createUdsEventBus, N as udsChildLogToWorkerEntry, O as HUB_CAP_FWD_SERVICE, P as createUdsLogger, Q as buildNativeCapProxy, R as UDS_NO_ROUTE_PREFIX, S as brokerTransportLink, T as ipcParentLink, U as classifyCapRoute, V as CapRouteResolver, W as callWithServiceDiscovery, X as FrameDecoder, Y as localEndpointPath, Z as encodeFrame, _ as resolveHwAccel, _t as CapabilityUnavailableError, a as getWorkerDeviceRegistry, at as createAddonService, b as getCapUsageRegistry, c as setHubConnected, ct as capActionName, d as getMoleculerEventStats, dt as capServiceName, et as createBrokerDeviceManagerApi, f as registerEventBusService, ft as parseCapAction, g as createKernelHwAccel, gt as CapabilityHandle, h as AddonDepsManager, ht as DeviceRegistry, i as createUdsAddonContext, j as createUdsEventBridge, k as createHubCapForwardService, l as EVENT_TOPIC_PREFIX, lt as capActionSuffix, m as subscribePassthrough, mt as serializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as validateProviderRegistrations, p as setNodeEventInterest, pt as deserializeTypedArrays, q as UdsLocalTransportServer, r as createAddonContext, rt as mountNativeCapService, s as getOrInitReadinessRegistryForClient, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestPythonDeps, u as getBrokerEventBus, ut as capBareAction, v as CapUsageRegistry, vt as installManifestNativeDeps, w as ipcChildLink, x as brokerCallForCap, y as __resetCapUsageRegistryForTests, yt as resolveAddonClass, z as AGENT_CAP_FWD_ACTION } from "./manifest-python-deps-DyIcZtF5.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-BEXwC-oo.mjs";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { z } from "zod";

package/dist/{manifest-python-deps-BGvIVCm_.js → manifest-python-deps-BVUZVpma.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-fRVWwrkF.js");
+const require_dist = require("./dist-BCseJMTD.js");
 let _camstack_types_node = require("@camstack/types/node");
 let node_http = require("node:http");
 let node_fs = require("node:fs");

package/dist/{manifest-python-deps-BjxBfiFd.mjs → manifest-python-deps-DyIcZtF5.mjs}

@@ -1,4 +1,4 @@
-import { H as readNodePin } from "./dist-CU3lb_Ys.mjs";
+import { H as readNodePin } from "./dist-ClOjKsC4.mjs";
 import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { createServer } from "node:http";
 import * as fs from "node:fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.1.39",
+  "version": "1.1.41",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",