@camstack/system 1.2.137 → 1.2.139

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, v as addonPagesCapability, vt as errMsg, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { Kt as EventCategory, bt as BaseAddon, v as addonPagesCapability, yt as errMsg } from "../../dist-D595vzqY.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, b as addonWidgetsCapability, vt as errMsg, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { Kt as EventCategory, b as addonWidgetsCapability, bt as BaseAddon, yt as errMsg } from "../../dist-D595vzqY.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, n as AlertSchema, vt as errMsg, x as alertsCapability, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { Kt as EventCategory, Nt as createEvent, bt as BaseAddon, n as AlertSchema, x as alertsCapability, yt as errMsg } from "../../dist-D595vzqY.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { C as backupCapability, Gt as EventCategory, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { C as backupCapability, Kt as EventCategory, bt as BaseAddon } from "../../dist-D595vzqY.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { X as logDestinationCapability, bt as BaseAddon } from "../../dist-D595vzqY.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, vt as errMsg, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, bt as BaseAddon, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, yt as errMsg } from "../../dist-D595vzqY.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-Dvkcu_zf.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-IVq6xR9i.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -3949,6 +3949,112 @@ var DeviceMetaStore = class {
 	};
 };
 //#endregion
+//#region src/builtins/device-manager/fleet-read-census.ts
+/** How many stack frames identify a call site. One frame is a method; three are
+*  a cause — `listFleet < listAll < onDeviceRegistered` is the answer, `listAll`
+*  alone is not. Same choice, for the same reason, as `read-census.ts`. */
+var CENSUS_STACK_FRAMES = 3;
+function siteFromStack(stack) {
+	if (stack === void 0) return "unknown";
+	const frames = stack.split("\n").slice(1).map((line) => line.trim().replace(/^at\s+/, "")).filter((line) => line.length > 0).slice(0, CENSUS_STACK_FRAMES).map((line) => {
+		const open = line.indexOf(" (");
+		return (open > 0 ? line.slice(0, open) : line).replace(/^async\s+/, "");
+	});
+	return frames.length === 0 ? "unknown" : frames.join(" < ");
+}
+var FleetReadCensus = class FleetReadCensus {
+	/**
+	* Longest window the census may be armed for.
+	*
+	* Ten minutes covers a boot several times over and bounds what an operator
+	* pays if they set the variable and forget it. A diagnostic that can be left
+	* on becomes a tax nobody remembers enabling.
+	*/
+	static MAX_WINDOW_MS = 10 * 6e4;
+	windowMs;
+	closesAt;
+	counts = /* @__PURE__ */ new Map();
+	reported = false;
+	constructor(rawEnv, nowMs) {
+		const parsed = rawEnv === void 0 ? NaN : Number(rawEnv);
+		const valid = Number.isFinite(parsed) && parsed > 0;
+		this.windowMs = valid ? Math.min(parsed, FleetReadCensus.MAX_WINDOW_MS) : 0;
+		this.closesAt = valid ? nowMs + this.windowMs : 0;
+	}
+	get armed() {
+		return this.windowMs > 0;
+	}
+	/** Test seam: pretend the window closed. Production reads the clock. */
+	closeAt(nowMs) {
+		if (nowMs >= this.closesAt) this.forceClosed = true;
+	}
+	forceClosed = false;
+	isOpen(nowMs) {
+		if (!this.armed || this.forceClosed) return false;
+		return nowMs < this.closesAt;
+	}
+	/**
+	* Capture the caller, or `null` when the window is shut.
+	*
+	* Called at the START of a read. A read that began inside the window belongs
+	* to it even if it lands after the close — otherwise the slow reads at the
+	* edge would be attributed to nobody, and the slow ones are the interesting
+	* ones.
+	*/
+	siteOf(nowMs = Date.now()) {
+		if (!this.isOpen(nowMs)) return null;
+		const holder = {};
+		Error.captureStackTrace(holder, this.siteOf);
+		return siteFromStack(holder.stack);
+	}
+	/** Count one read at an already-captured site. A `null` site is not counted. */
+	record(site, rowCount) {
+		if (site === null) return;
+		const existing = this.counts.get(site);
+		if (existing === void 0) {
+			this.counts.set(site, {
+				site,
+				calls: 1,
+				rows: rowCount
+			});
+			return;
+		}
+		existing.calls += 1;
+		existing.rows += rowCount;
+	}
+	/** Attributed sites, busiest first. */
+	rows() {
+		return [...this.counts.values()].map((c) => ({
+			site: c.site,
+			calls: c.calls,
+			rows: c.rows
+		})).sort((a, b) => b.calls - a.calls);
+	}
+	/**
+	* Emit the report ONCE.
+	*
+	* `perMin` is included because the raw count is unreadable without the window
+	* it was taken over — "4 149" means nothing until you know it was 66 seconds.
+	*/
+	report(logger, elapsedMs) {
+		if (this.reported || !this.armed) return;
+		this.reported = true;
+		const rows = this.rows();
+		const totalCalls = rows.reduce((acc, r) => acc + r.calls, 0);
+		logger.info("fleet read census", { meta: {
+			elapsedMs,
+			sites: rows.length,
+			totalCalls,
+			rows: rows.map((r) => ({
+				site: r.site,
+				calls: r.calls,
+				rows: r.rows,
+				perMin: elapsedMs === 0 ? 0 : Math.round(r.calls * 6e4 / elapsedMs)
+			}))
+		} });
+	}
+};
+//#endregion
 //#region src/builtins/device-manager/device-row-store.ts
 /**
 * @durable class=ledger owner=device-manager
@@ -4278,9 +4384,17 @@ var DeviceRowStore = class {
 	backend;
 	logger;
 	declared = null;
-	constructor(backend, logger) {
+	/** Call-site attribution for fleet reads. Armed only by
+	*  `CAMSTACK_FLEET_READ_CENSUS_MS`; see `fleet-read-census.ts`. */
+	census;
+	constructor(backend, logger, census) {
 		this.backend = backend;
 		this.logger = logger;
+		this.census = census ?? new FleetReadCensus(process.env["CAMSTACK_FLEET_READ_CENSUS_MS"], Date.now());
+		if (this.census.armed) {
+			const startedAt = Date.now();
+			setTimeout(() => this.census.report(this.logger, Date.now() - startedAt), this.census.windowMs).unref?.();
+		}
 	}
 	/**
 	* Lazy, idempotent `declareCollection`, memoised on the PROMISE so N
@@ -4449,11 +4563,13 @@ var DeviceRowStore = class {
 	}
 	async list(filter, columns) {
 		await this.declare();
+		const site = this.census.siteOf();
 		const records = await this.backend.query({
 			collection: DEVICE_ROWS_COLLECTION,
 			filter,
 			...columns === void 0 ? {} : { columns }
 		});
+		this.census.record(site, records.length);
 		const out = [];
 		for (const record of records) {
 			const decoded = decodeDeviceRow(record.data);

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-DMOTtKH8.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CPRvyt-E.mjs";
+import { E as buildStreamParamsConfigSchema, Et as DeviceType, F as deviceStatusCapability, Gt as sleep, Kt as EventCategory, N as deviceManagerCapability, P as deviceStateCapability, R as enumerateItemArrayFields, Rt as isDeviceConfigCap, Tt as DeviceRole, a as CAP_NAMES_WITH_STATUS, bt as BaseAddon, et as normalizeUnit, kt as WELL_KNOWN_TAB_MAP, nt as parseStreamParamsFormPatch, ot as runtimeStatePolicyFor, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, wt as DeviceFeature, yt as errMsg, z as enumerateSchemaFields } from "../../dist-D595vzqY.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-BvxgnDT1.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -3944,6 +3944,112 @@ var DeviceMetaStore = class {
 	};
 };
 //#endregion
+//#region src/builtins/device-manager/fleet-read-census.ts
+/** How many stack frames identify a call site. One frame is a method; three are
+*  a cause — `listFleet < listAll < onDeviceRegistered` is the answer, `listAll`
+*  alone is not. Same choice, for the same reason, as `read-census.ts`. */
+var CENSUS_STACK_FRAMES = 3;
+function siteFromStack(stack) {
+	if (stack === void 0) return "unknown";
+	const frames = stack.split("\n").slice(1).map((line) => line.trim().replace(/^at\s+/, "")).filter((line) => line.length > 0).slice(0, CENSUS_STACK_FRAMES).map((line) => {
+		const open = line.indexOf(" (");
+		return (open > 0 ? line.slice(0, open) : line).replace(/^async\s+/, "");
+	});
+	return frames.length === 0 ? "unknown" : frames.join(" < ");
+}
+var FleetReadCensus = class FleetReadCensus {
+	/**
+	* Longest window the census may be armed for.
+	*
+	* Ten minutes covers a boot several times over and bounds what an operator
+	* pays if they set the variable and forget it. A diagnostic that can be left
+	* on becomes a tax nobody remembers enabling.
+	*/
+	static MAX_WINDOW_MS = 10 * 6e4;
+	windowMs;
+	closesAt;
+	counts = /* @__PURE__ */ new Map();
+	reported = false;
+	constructor(rawEnv, nowMs) {
+		const parsed = rawEnv === void 0 ? NaN : Number(rawEnv);
+		const valid = Number.isFinite(parsed) && parsed > 0;
+		this.windowMs = valid ? Math.min(parsed, FleetReadCensus.MAX_WINDOW_MS) : 0;
+		this.closesAt = valid ? nowMs + this.windowMs : 0;
+	}
+	get armed() {
+		return this.windowMs > 0;
+	}
+	/** Test seam: pretend the window closed. Production reads the clock. */
+	closeAt(nowMs) {
+		if (nowMs >= this.closesAt) this.forceClosed = true;
+	}
+	forceClosed = false;
+	isOpen(nowMs) {
+		if (!this.armed || this.forceClosed) return false;
+		return nowMs < this.closesAt;
+	}
+	/**
+	* Capture the caller, or `null` when the window is shut.
+	*
+	* Called at the START of a read. A read that began inside the window belongs
+	* to it even if it lands after the close — otherwise the slow reads at the
+	* edge would be attributed to nobody, and the slow ones are the interesting
+	* ones.
+	*/
+	siteOf(nowMs = Date.now()) {
+		if (!this.isOpen(nowMs)) return null;
+		const holder = {};
+		Error.captureStackTrace(holder, this.siteOf);
+		return siteFromStack(holder.stack);
+	}
+	/** Count one read at an already-captured site. A `null` site is not counted. */
+	record(site, rowCount) {
+		if (site === null) return;
+		const existing = this.counts.get(site);
+		if (existing === void 0) {
+			this.counts.set(site, {
+				site,
+				calls: 1,
+				rows: rowCount
+			});
+			return;
+		}
+		existing.calls += 1;
+		existing.rows += rowCount;
+	}
+	/** Attributed sites, busiest first. */
+	rows() {
+		return [...this.counts.values()].map((c) => ({
+			site: c.site,
+			calls: c.calls,
+			rows: c.rows
+		})).sort((a, b) => b.calls - a.calls);
+	}
+	/**
+	* Emit the report ONCE.
+	*
+	* `perMin` is included because the raw count is unreadable without the window
+	* it was taken over — "4 149" means nothing until you know it was 66 seconds.
+	*/
+	report(logger, elapsedMs) {
+		if (this.reported || !this.armed) return;
+		this.reported = true;
+		const rows = this.rows();
+		const totalCalls = rows.reduce((acc, r) => acc + r.calls, 0);
+		logger.info("fleet read census", { meta: {
+			elapsedMs,
+			sites: rows.length,
+			totalCalls,
+			rows: rows.map((r) => ({
+				site: r.site,
+				calls: r.calls,
+				rows: r.rows,
+				perMin: elapsedMs === 0 ? 0 : Math.round(r.calls * 6e4 / elapsedMs)
+			}))
+		} });
+	}
+};
+//#endregion
 //#region src/builtins/device-manager/device-row-store.ts
 /**
 * @durable class=ledger owner=device-manager
@@ -4273,9 +4379,17 @@ var DeviceRowStore = class {
 	backend;
 	logger;
 	declared = null;
-	constructor(backend, logger) {
+	/** Call-site attribution for fleet reads. Armed only by
+	*  `CAMSTACK_FLEET_READ_CENSUS_MS`; see `fleet-read-census.ts`. */
+	census;
+	constructor(backend, logger, census) {
 		this.backend = backend;
 		this.logger = logger;
+		this.census = census ?? new FleetReadCensus(process.env["CAMSTACK_FLEET_READ_CENSUS_MS"], Date.now());
+		if (this.census.armed) {
+			const startedAt = Date.now();
+			setTimeout(() => this.census.report(this.logger, Date.now() - startedAt), this.census.windowMs).unref?.();
+		}
 	}
 	/**
 	* Lazy, idempotent `declareCollection`, memoised on the PROMISE so N
@@ -4444,11 +4558,13 @@ var DeviceRowStore = class {
 	}
 	async list(filter, columns) {
 		await this.declare();
+		const site = this.census.siteOf();
 		const records = await this.backend.query({
 			collection: DEVICE_ROWS_COLLECTION,
 			filter,
 			...columns === void 0 ? {} : { columns }
 		});
+		this.census.record(site, records.length);
 		const out = [];
 		for (const record of records) {
 			const decoded = decodeDeviceRow(record.data);

package/dist/builtins/device-manager/device-row-store.d.ts

@@ -1,6 +1,7 @@
 import { ChildLayout, CollectionColumn, CollectionIndex, DeviceDisplayOverride, IScopedLogger, MutationFilter, QueryFilter, SettingsRecord, SettingsStoreClient } from '@camstack/types';
 import { RetiredRowStore } from '../sqlite-storage/retired-settings-keys.js';
 import { PersistedDeviceMeta } from './device-meta-types.js';
+import { FleetReadCensus } from './fleet-read-census.js';
 /**
  * @durable class=ledger owner=device-manager
  *   write="one row per device, written by `allocateDeviceId` (identity placeholder),
@@ -211,7 +212,10 @@ export declare class DeviceRowStore {
     private readonly backend;
     private readonly logger;
     private declared;
-    constructor(backend: DeviceRowBackend, logger: IScopedLogger);
+    /** Call-site attribution for fleet reads. Armed only by
+     *  `CAMSTACK_FLEET_READ_CENSUS_MS`; see `fleet-read-census.ts`. */
+    private readonly census;
+    constructor(backend: DeviceRowBackend, logger: IScopedLogger, census?: FleetReadCensus);
     /**
      * Lazy, idempotent `declareCollection`, memoised on the PROMISE so N
      * concurrent first-callers issue one declaration rather than N. A rejection

package/dist/builtins/device-manager/fleet-read-census.d.ts

@@ -0,0 +1,47 @@
+import { IScopedLogger } from '@camstack/types';
+/** One attributed call site. */
+export interface FleetCensusRow {
+    readonly site: string;
+    readonly calls: number;
+    readonly rows: number;
+}
+export declare class FleetReadCensus {
+    /**
+     * Longest window the census may be armed for.
+     *
+     * Ten minutes covers a boot several times over and bounds what an operator
+     * pays if they set the variable and forget it. A diagnostic that can be left
+     * on becomes a tax nobody remembers enabling.
+     */
+    static readonly MAX_WINDOW_MS: number;
+    readonly windowMs: number;
+    private readonly closesAt;
+    private readonly counts;
+    private reported;
+    constructor(rawEnv: string | undefined, nowMs: number);
+    get armed(): boolean;
+    /** Test seam: pretend the window closed. Production reads the clock. */
+    closeAt(nowMs: number): void;
+    private forceClosed;
+    private isOpen;
+    /**
+     * Capture the caller, or `null` when the window is shut.
+     *
+     * Called at the START of a read. A read that began inside the window belongs
+     * to it even if it lands after the close — otherwise the slow reads at the
+     * edge would be attributed to nobody, and the slow ones are the interesting
+     * ones.
+     */
+    siteOf(nowMs?: number): string | null;
+    /** Count one read at an already-captured site. A `null` site is not counted. */
+    record(site: string | null, rowCount: number): void;
+    /** Attributed sites, busiest first. */
+    rows(): readonly FleetCensusRow[];
+    /**
+     * Emit the report ONCE.
+     *
+     * `perMin` is included because the raw count is unreadable without the window
+     * it was taken over — "4 149" means nothing until you know it was 66 seconds.
+     */
+    report(logger: IScopedLogger, elapsedMs: number): void;
+}

package/dist/builtins/doorbell/virtual-doorbell.addon.d.ts

@@ -71,6 +71,13 @@ export declare class VirtualDoorbellAddon extends BaseAddon<VirtualDoorbellAddon
      * an open mirror performs NO I/O and cannot fail. The mirror can only
      * DESTROY a press through the one branch below, and that branch is not
      * allowed to be the last word — see `ringsDespiteUnboundMirror`.
+     *
+     * `sourceDeviceId`/`capName` are the source that produced this rise —
+     * carried through purely so the terminal `pressed` line can name it. Every
+     * suppression branch beside it already reports its source
+     * (`logSuppressions`); the successful path was the one place that did not,
+     * which meant answering "what rang it" required hand-correlating a
+     * timestamp against provider logs (proven live 2026-08-25, camera 615).
      */
     private fireDoorbell;
     /**

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over
@@ -544,7 +544,7 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 		await this.ensureAssignments();
 		const result = this.engine.onStateSlice(data.deviceId, data.capName, data.slice);
 		this.logSuppressions(data, result);
-		for (const cameraId of result.fired) await this.fireDoorbell(cameraId, Date.now());
+		for (const cameraId of result.fired) await this.fireDoorbell(cameraId, Date.now(), data.deviceId, data.capName);
 	}
 	/**
 	* Say out loud every case where a rise did NOT become a ring. Silence
@@ -585,8 +585,15 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	* an open mirror performs NO I/O and cannot fail. The mirror can only
 	* DESTROY a press through the one branch below, and that branch is not
 	* allowed to be the last word — see `ringsDespiteUnboundMirror`.
+	*
+	* `sourceDeviceId`/`capName` are the source that produced this rise —
+	* carried through purely so the terminal `pressed` line can name it. Every
+	* suppression branch beside it already reports its source
+	* (`logSuppressions`); the successful path was the one place that did not,
+	* which meant answering "what rang it" required hand-correlating a
+	* timestamp against provider logs (proven live 2026-08-25, camera 615).
 	*/
-	async fireDoorbell(cameraId, timestamp) {
+	async fireDoorbell(cameraId, timestamp, sourceDeviceId, capName) {
 		const binding = this.bindingMirror.get(cameraId);
 		if (!allowsRing(binding) && !await this.ringsDespiteUnboundMirror(cameraId, binding)) return;
 		if (!hasConfirmedBinding(binding)) this.ctx.logger.warn("virtual-doorbell: ringing on an unconfirmed binding — the bindings store has not corroborated an unbind, and a one-shot press is never dropped on an unproven read", {
@@ -623,7 +630,11 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 		}));
 		this.ctx.logger.info("virtual-doorbell: pressed", {
 			tags: { deviceId: cameraId },
-			meta: { timestamp }
+			meta: {
+				timestamp,
+				sourceDeviceId,
+				capName
+			}
 		});
 	}
 	/**

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { G as isSameAddonId, Gt as EventCategory, I as doorbellCapability, Mt as createEvent, Tt as DeviceType, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { Et as DeviceType, G as isSameAddonId, I as doorbellCapability, Kt as EventCategory, Nt as createEvent, bt as BaseAddon, w as bareAddonId, yt as errMsg } from "../../dist-D595vzqY.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over
@@ -539,7 +539,7 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 		await this.ensureAssignments();
 		const result = this.engine.onStateSlice(data.deviceId, data.capName, data.slice);
 		this.logSuppressions(data, result);
-		for (const cameraId of result.fired) await this.fireDoorbell(cameraId, Date.now());
+		for (const cameraId of result.fired) await this.fireDoorbell(cameraId, Date.now(), data.deviceId, data.capName);
 	}
 	/**
 	* Say out loud every case where a rise did NOT become a ring. Silence
@@ -580,8 +580,15 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 	* an open mirror performs NO I/O and cannot fail. The mirror can only
 	* DESTROY a press through the one branch below, and that branch is not
 	* allowed to be the last word — see `ringsDespiteUnboundMirror`.
+	*
+	* `sourceDeviceId`/`capName` are the source that produced this rise —
+	* carried through purely so the terminal `pressed` line can name it. Every
+	* suppression branch beside it already reports its source
+	* (`logSuppressions`); the successful path was the one place that did not,
+	* which meant answering "what rang it" required hand-correlating a
+	* timestamp against provider logs (proven live 2026-08-25, camera 615).
 	*/
-	async fireDoorbell(cameraId, timestamp) {
+	async fireDoorbell(cameraId, timestamp, sourceDeviceId, capName) {
 		const binding = this.bindingMirror.get(cameraId);
 		if (!allowsRing(binding) && !await this.ringsDespiteUnboundMirror(cameraId, binding)) return;
 		if (!hasConfirmedBinding(binding)) this.ctx.logger.warn("virtual-doorbell: ringing on an unconfirmed binding — the bindings store has not corroborated an unbind, and a one-shot press is never dropped on an unproven read", {
@@ -618,7 +625,11 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 		}));
 		this.ctx.logger.info("virtual-doorbell: pressed", {
 			tags: { deviceId: cameraId },
-			meta: { timestamp }
+			meta: {
+				timestamp,
+				sourceDeviceId,
+				capName
+			}
 		});
 	}
 	/**

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { X as logDestinationCapability, bt as BaseAddon } from "../../dist-D595vzqY.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, vt as errMsg, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { Kt as EventCategory, Nt as createEvent, bt as BaseAddon, yt as errMsg } from "../../dist-D595vzqY.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { S as authProviderCapability, _ as UserRecordSchema, bt as BaseAddon, gt as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema } from "../../dist-D595vzqY.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 const require_tls = require("../../tls-u8QCJCFE.js");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { Kt as EventCategory, Y as localNetworkCapability, bt as BaseAddon } from "../../dist-D595vzqY.mjs";
 import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-CQhPGSJm.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { X as logDestinationCapability, bt as BaseAddon } from "../../dist-D595vzqY.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as metricsProviderCapability, Gt as EventCategory, Mt as createEvent, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { $ as metricsProviderCapability, Kt as EventCategory, Nt as createEvent, bt as BaseAddon } from "../../dist-D595vzqY.mjs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Gt as EventCategory, L as enumerateInferenceDevices, Pt as emitReadiness, ct as scoreRuntimes, rt as platformProbeCapability, vt as errMsg, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { Ft as emitReadiness, Kt as EventCategory, L as enumerateInferenceDevices, bt as BaseAddon, lt as scoreRuntimes, rt as platformProbeCapability, yt as errMsg } from "../../dist-D595vzqY.mjs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { Kt as EventCategory, bt as BaseAddon } from "../../dist-D595vzqY.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Ct as DeviceFeature, Gt as EventCategory, M as deriveBatteryPresence, Rt as nodePin, T as batteryCapability, Tt as DeviceType, i as BatteryStatusSchema, mt as streamQualityLabel, ut as snapshotCapability, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { Et as DeviceType, Kt as EventCategory, M as deriveBatteryPresence, T as batteryCapability, bt as BaseAddon, dt as snapshotCapability, ht as streamQualityLabel, i as BatteryStatusSchema, w as bareAddonId, wt as DeviceFeature, yt as errMsg, zt as nodePin } from "../../dist-D595vzqY.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { V as filesystemBrowseCapability, pt as storageProviderCapability, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { V as filesystemBrowseCapability, bt as BaseAddon, mt as storageProviderCapability } from "../../dist-D595vzqY.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { dt as storageCapability, ft as storageMigrationCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as settingsStoreCapability, yt as BaseAddon, zt as parseJsonObject } from "../../dist-DMOTtKH8.mjs";
+import { Bt as parseJsonObject, bt as BaseAddon, ft as storageCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, pt as storageMigrationCapability, ut as settingsStoreCapability } from "../../dist-D595vzqY.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { It as hydrateSchema, vt as errMsg, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { Lt as hydrateSchema, bt as BaseAddon, yt as errMsg } from "../../dist-D595vzqY.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_dist = require("../../dist-MqjCyx1E.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
+import { X as logDestinationCapability, bt as BaseAddon } from "../../dist-D595vzqY.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-DMOTtKH8.mjs → dist-D595vzqY.mjs}

@@ -2534,7 +2534,7 @@ function method(input, output, options) {
 		input,
 		output,
 		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
+		...options?.auth !== void 0 ? { auth: options.auth } : {},
 		...options?.access !== void 0 ? { access: options.access } : {},
 		...options?.caller !== void 0 ? { caller: options.caller } : {},
 		timeoutMs: options?.timeoutMs
@@ -7742,6 +7742,44 @@ function objectInputDeclaresAddonId(schema) {
 function resolveDefShape(defShape) {
 	return typeof defShape === "function" ? defShape() : defShape;
 }
+/**
+* Effective auth for a cap method — the `internal: true` floor (Task 7.5c).
+*
+* `internal: true` on a cap def is a DECLARATION that its methods are for
+* in-process (`ctx.api`) consumption only. Nothing enforced that:
+* `resolveCapMount` never reads `internal` (an internal cap still gets a
+* full tRPC router), and a method that omitted an explicit `auth` used to
+* default — permanently, at `method()`-call time — to `'protected'`,
+* reachable by any authenticated session regardless of `internal`. That
+* silent default is how 45 procedures across 13 internal caps ended up
+* exposed, including `ssoBridge.signBridgeToken`: it accepted
+* caller-supplied claims (including `isAdmin`), was reachable by any
+* authenticated session, and its token is redeemed at
+* `/api/auth/sso/finish` to mint a session — a full privilege escalation.
+* See `docs/decisions/adr-0240-an-internal-cap-floors-its-unannotated-methods-to-admin.md`
+* (D240) for the record.
+*
+* The floor, exactly: an `internal` cap's method with NO explicit `auth`
+* resolves to `'admin'` instead of `'protected'`. A method that DELIBERATELY
+* declares an explicit `auth` — public, protected, or admin — keeps it
+* unconditionally; the author already said what they meant, and an
+* annotation that happens to agree with the floor is documentation, not
+* redundancy. A non-`internal` cap's un-annotated method is unaffected
+* (still `'protected'`). This is a FLOOR, not a hard `mount: 'skip'` — that
+* would also override a deliberate `auth: 'public'`/`'protected'` choice,
+* which is not the defect being closed.
+*
+* `method()` (`capability-definition.ts`) deliberately leaves `auth`
+* UNSET when the caller omits it (rather than defaulting there) so the
+* "was this explicit" bit survives to this single resolution point. Single
+* source of truth shared by the runtime builder (`cap-router-builder.ts`)
+* and the codegen (`generate-cap-routers.ts`, `gen-api-reference.ts`) — the
+* two must never disagree, a documented failure mode in this repo.
+*/
+function resolveMethodAuth(def, method) {
+	if (method.auth !== void 0) return method.auth;
+	return def.internal === true ? "admin" : "protected";
+}
 /** Auth level → base-procedure key. `superAdmin` collapses to `admin`. */
 function procedureAuthKey(auth) {
 	if (auth === "public") return "public";
@@ -39238,4 +39276,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { metricsProviderCapability as $, dataStoreProviderCapability as A, asNumber as At, extractNestedAddonId as B, parseJsonUnknown as Bt, backupCapability as C, DeviceFeature as Ct, coreBlockAddonId as D, ReadinessTimeoutError as Dt, buildStreamParamsConfigSchema as E, ReadinessRegistry as Et, deviceStatusCapability as F, expandCapMethods as Ft, isSameAddonId as G, EventCategory as Gt, isArrayOutputSchema as H, resolveCapMount as Ht, doorbellCapability as I, hydrateSchema as It, lifecycleJobSchema as J, isVoidInput as K, enumerateInferenceDevices as L, isDeviceConfigCap as Lt, deriveBatteryPresence as M, createEvent as Mt, deviceManagerCapability as N, emitDownForOwnedCaps as Nt, coreBlockIdFromAddonId as O, WELL_KNOWN_TAB_MAP as Ot, deviceStateCapability as P, emitReadiness as Pt, looseSchema as Q, enumerateItemArrayFields as R, nodePin as Rt, authProviderCapability as S, DEVICE_STATUS_METHOD as St, batteryCapability as T, DeviceType as Tt, isCollectionArrayMethod as U, scopeKey as Ut, filesystemBrowseCapability as V, readinessKey as Vt, isObjectInput as W, sleep as Wt, logDestinationCapability as X, localNetworkCapability as Y, logLevelAtMost as Z, UserRecordSchema as _, vectorStoreCapability as _t, CAP_NAMES_WITH_STATUS as a, runtimeStatePolicyFor as at, addonWidgetsCapability as b, DATAPLANE_SECRET_HEADER as bt, CoreBlockSchema as c, scoreRuntimes as ct, METHOD_ACCESS_MAP as d, storageCapability as dt, normalizeUnit as et, RUNTIME_DEFAULTS as f, storageMigrationCapability as ft, StorageMigrationJobSchema as g, vectorDimFromBase64 as gt, StorageLocationTypeSchema as h, userManagementCapability as ht, BatteryStatusSchema as i, procedureAuthKey as it, decodeVectorBase64 as j, asString as jt, coreBlocksCapability as k, asJsonObject as kt, DeclaredDevices as l, settingsStoreCapability as lt, ScopedTokenSchema as m, streamQualityLabel as mt, AlertSchema as n, parseStreamParamsFormPatch as nt, CORE_BLOCKS_ADDON_ID as o, scopesAllowAddon as ot, STREAM_PROFILE_META as p, storageProviderCapability as pt, kebabToCamel as q, ApiKeyRecordSchema as r, platformProbeCapability as rt, CORE_BLOCK_ADDON_PREFIX as s, scopesAllowDeviceCap as st, ALL_CAPABILITY_DEFINITIONS as t, objectInputDeclaresAddonId as tt, DeviceStatusSchema as u, snapshotCapability as ut, addonPagesCapability as v, errMsg as vt, bareAddonId as w, DeviceRole as wt, alertsCapability as x, DEVICE_SETTINGS_CONTRIBUTION_METHODS as xt, addonSettingsCapability as y, BaseAddon as yt, enumerateSchemaFields as z, parseJsonObject as zt };
+export { metricsProviderCapability as $, dataStoreProviderCapability as A, asJsonObject as At, extractNestedAddonId as B, parseJsonObject as Bt, backupCapability as C, DEVICE_STATUS_METHOD as Ct, coreBlockAddonId as D, ReadinessRegistry as Dt, buildStreamParamsConfigSchema as E, DeviceType as Et, deviceStatusCapability as F, emitReadiness as Ft, isSameAddonId as G, sleep as Gt, isArrayOutputSchema as H, readinessKey as Ht, doorbellCapability as I, expandCapMethods as It, lifecycleJobSchema as J, isVoidInput as K, EventCategory as Kt, enumerateInferenceDevices as L, hydrateSchema as Lt, deriveBatteryPresence as M, asString as Mt, deviceManagerCapability as N, createEvent as Nt, coreBlockIdFromAddonId as O, ReadinessTimeoutError as Ot, deviceStateCapability as P, emitDownForOwnedCaps as Pt, looseSchema as Q, enumerateItemArrayFields as R, isDeviceConfigCap as Rt, authProviderCapability as S, DEVICE_SETTINGS_CONTRIBUTION_METHODS as St, batteryCapability as T, DeviceRole as Tt, isCollectionArrayMethod as U, resolveCapMount as Ut, filesystemBrowseCapability as V, parseJsonUnknown as Vt, isObjectInput as W, scopeKey as Wt, logDestinationCapability as X, localNetworkCapability as Y, logLevelAtMost as Z, UserRecordSchema as _, vectorDimFromBase64 as _t, CAP_NAMES_WITH_STATUS as a, resolveMethodAuth as at, addonWidgetsCapability as b, BaseAddon as bt, CoreBlockSchema as c, scopesAllowDeviceCap as ct, METHOD_ACCESS_MAP as d, snapshotCapability as dt, normalizeUnit as et, RUNTIME_DEFAULTS as f, storageCapability as ft, StorageMigrationJobSchema as g, userManagementCapability as gt, StorageLocationTypeSchema as h, streamQualityLabel as ht, BatteryStatusSchema as i, procedureAuthKey as it, decodeVectorBase64 as j, asNumber as jt, coreBlocksCapability as k, WELL_KNOWN_TAB_MAP as kt, DeclaredDevices as l, scoreRuntimes as lt, ScopedTokenSchema as m, storageProviderCapability as mt, AlertSchema as n, parseStreamParamsFormPatch as nt, CORE_BLOCKS_ADDON_ID as o, runtimeStatePolicyFor as ot, STREAM_PROFILE_META as p, storageMigrationCapability as pt, kebabToCamel as q, ApiKeyRecordSchema as r, platformProbeCapability as rt, CORE_BLOCK_ADDON_PREFIX as s, scopesAllowAddon as st, ALL_CAPABILITY_DEFINITIONS as t, objectInputDeclaresAddonId as tt, DeviceStatusSchema as u, settingsStoreCapability as ut, addonPagesCapability as v, vectorStoreCapability as vt, bareAddonId as w, DeviceFeature as wt, alertsCapability as x, DATAPLANE_SECRET_HEADER as xt, addonSettingsCapability as y, errMsg as yt, enumerateSchemaFields as z, nodePin as zt };

package/dist/{dist-mQ3BkrJd.js → dist-MqjCyx1E.js}

@@ -2534,7 +2534,7 @@ function method(input, output, options) {
 		input,
 		output,
 		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
+		...options?.auth !== void 0 ? { auth: options.auth } : {},
 		...options?.access !== void 0 ? { access: options.access } : {},
 		...options?.caller !== void 0 ? { caller: options.caller } : {},
 		timeoutMs: options?.timeoutMs
@@ -7742,6 +7742,44 @@ function objectInputDeclaresAddonId(schema) {
 function resolveDefShape(defShape) {
 	return typeof defShape === "function" ? defShape() : defShape;
 }
+/**
+* Effective auth for a cap method — the `internal: true` floor (Task 7.5c).
+*
+* `internal: true` on a cap def is a DECLARATION that its methods are for
+* in-process (`ctx.api`) consumption only. Nothing enforced that:
+* `resolveCapMount` never reads `internal` (an internal cap still gets a
+* full tRPC router), and a method that omitted an explicit `auth` used to
+* default — permanently, at `method()`-call time — to `'protected'`,
+* reachable by any authenticated session regardless of `internal`. That
+* silent default is how 45 procedures across 13 internal caps ended up
+* exposed, including `ssoBridge.signBridgeToken`: it accepted
+* caller-supplied claims (including `isAdmin`), was reachable by any
+* authenticated session, and its token is redeemed at
+* `/api/auth/sso/finish` to mint a session — a full privilege escalation.
+* See `docs/decisions/adr-0240-an-internal-cap-floors-its-unannotated-methods-to-admin.md`
+* (D240) for the record.
+*
+* The floor, exactly: an `internal` cap's method with NO explicit `auth`
+* resolves to `'admin'` instead of `'protected'`. A method that DELIBERATELY
+* declares an explicit `auth` — public, protected, or admin — keeps it
+* unconditionally; the author already said what they meant, and an
+* annotation that happens to agree with the floor is documentation, not
+* redundancy. A non-`internal` cap's un-annotated method is unaffected
+* (still `'protected'`). This is a FLOOR, not a hard `mount: 'skip'` — that
+* would also override a deliberate `auth: 'public'`/`'protected'` choice,
+* which is not the defect being closed.
+*
+* `method()` (`capability-definition.ts`) deliberately leaves `auth`
+* UNSET when the caller omits it (rather than defaulting there) so the
+* "was this explicit" bit survives to this single resolution point. Single
+* source of truth shared by the runtime builder (`cap-router-builder.ts`)
+* and the codegen (`generate-cap-routers.ts`, `gen-api-reference.ts`) — the
+* two must never disagree, a documented failure mode in this repo.
+*/
+function resolveMethodAuth(def, method) {
+	if (method.auth !== void 0) return method.auth;
+	return def.internal === true ? "admin" : "protected";
+}
 /** Auth level → base-procedure key. `superAdmin` collapses to `admin`. */
 function procedureAuthKey(auth) {
 	if (auth === "public") return "public";
@@ -39742,6 +39780,12 @@ Object.defineProperty(exports, "resolveCapMount", {
 		return resolveCapMount;
 	}
 });
+Object.defineProperty(exports, "resolveMethodAuth", {
+	enumerable: true,
+	get: function() {
+		return resolveMethodAuth;
+	}
+});
 Object.defineProperty(exports, "runtimeStatePolicyFor", {
 	enumerable: true,
 	get: function() {

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-mQ3BkrJd.js");
+const require_dist = require("./dist-MqjCyx1E.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -6406,7 +6406,7 @@ function methodsFor(def) {
 		return {
 			name,
 			kind: m.kind ?? "query",
-			auth: m.auth ?? "protected",
+			auth: require_dist.resolveMethodAuth(def, m),
 			schema: m,
 			isVoid: require_dist.isVoidInput(m.input),
 			isObject: require_dist.isObjectInput(m.input),

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-DMOTtKH8.mjs";
+import { At as asJsonObject$1, B as extractNestedAddonId, Bt as parseJsonObject, Ct as DEVICE_STATUS_METHOD, Dt as ReadinessRegistry, H as isArrayOutputSchema, Ht as readinessKey, It as expandCapMethods, J as lifecycleJobSchema, K as isVoidInput, Kt as EventCategory$1, Mt as asString$1, Nt as createEvent, Ot as ReadinessTimeoutError, Pt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_SETTINGS_CONTRIBUTION_METHODS, U as isCollectionArrayMethod, Ut as resolveCapMount, Vt as parseJsonUnknown$1, W as isObjectInput, Wt as scopeKey, Z as logLevelAtMost, at as resolveMethodAuth, ct as scopesAllowDeviceCap, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asNumber, q as kebabToCamel, st as scopesAllowAddon, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, xt as DATAPLANE_SECRET_HEADER$1, y as addonSettingsCapability, yt as errMsg$1 } from "./dist-D595vzqY.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -6399,7 +6399,7 @@ function methodsFor(def) {
 		return {
 			name,
 			kind: m.kind ?? "query",
-			auth: m.auth ?? "protected",
+			auth: resolveMethodAuth(def, m),
 			schema: m,
 			isVoid: isVoidInput(m.input),
 			isObject: isObjectInput(m.input),

package/dist/{retired-settings-keys-CPRvyt-E.mjs → retired-settings-keys-BvxgnDT1.mjs}

@@ -1,4 +1,4 @@
-import { kt as asJsonObject } from "./dist-DMOTtKH8.mjs";
+import { At as asJsonObject } from "./dist-D595vzqY.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-Dvkcu_zf.js → retired-settings-keys-IVq6xR9i.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-mQ3BkrJd.js");
+const require_dist = require("./dist-MqjCyx1E.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.137",
+  "version": "1.2.139",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",