@camstack/system 1.2.345 → 1.2.347

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-Bm4Kpo7v.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-CVOa1BZI.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { Ft as installManifestNativeDeps, H as createUdsLoggerWithControl, It as resolveAddonClass, St as validateProviderRegistrations, Tn as emitHeapDiagnosticReport, U as LocalChildClient, _t as getWorkerNativeCapProvider, bt as setWorkerNativeCapsChangeListener, en as RUNNER_RSS_BUDGET_ENV, f as installManifestSystemDeps, g as createUdsAddonContext, i as killOwnRunnerGroupAfterParentLoss, n as createChildCapDispatch, p as installManifestPythonDeps, pn as startRunnerHeapWatch, u as startRunnerParentDeathWatchdog, vt as getWorkerNativeCapSnapshot } from "./child-cap-dispatch-B52e2Bcw.mjs";
+import { Ft as installManifestNativeDeps, H as createUdsLoggerWithControl, It as resolveAddonClass, St as validateProviderRegistrations, Tn as emitHeapDiagnosticReport, U as LocalChildClient, _t as getWorkerNativeCapProvider, bt as setWorkerNativeCapsChangeListener, en as RUNNER_RSS_BUDGET_ENV, f as installManifestSystemDeps, g as createUdsAddonContext, i as killOwnRunnerGroupAfterParentLoss, n as createChildCapDispatch, p as installManifestPythonDeps, pn as startRunnerHeapWatch, u as startRunnerParentDeathWatchdog, vt as getWorkerNativeCapSnapshot } from "./child-cap-dispatch-OLFN-F85.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, V as addonPagesCapability, Wn as errMsg, gr as EventCategory } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, V as addonPagesCapability, Wn as errMsg, gr as EventCategory } from "../../dist-BUFcHq7H.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, U as addonWidgetsCapability, Wn as errMsg, gr as EventCategory } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, U as addonWidgetsCapability, Wn as errMsg, gr as EventCategory } from "../../dist-BUFcHq7H.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, W as alertsCapability, Wn as errMsg, gr as EventCategory, n as AlertSchema, tr as createEvent } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, W as alertsCapability, Wn as errMsg, gr as EventCategory, n as AlertSchema, tr as createEvent } from "../../dist-BUFcHq7H.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, Wn as errMsg, b as FIRST_LEVEL_MACRO_CLASSES, gr as EventCategory, in as ptzAutotrackCapability, q as bareAddonId, sr as isEvent } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, Wn as errMsg, b as FIRST_LEVEL_MACRO_CLASSES, gr as EventCategory, in as ptzAutotrackCapability, q as bareAddonId, sr as isEvent } from "../../dist-BUFcHq7H.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, K as backupCapability, Kt as mayWriteToLocation, cr as nodePin, gr as EventCategory, hr as toNodeId, m as DATABASE_SNAPSHOT_SUFFIX, yn as storageOccupancyCapability } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, K as backupCapability, Kt as mayWriteToLocation, cr as nodePin, gr as EventCategory, hr as toNodeId, m as DATABASE_SNAPSHOT_SUFFIX, yn as storageOccupancyCapability } from "../../dist-BUFcHq7H.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 //#region src/builtins/calendars/calendars.addon.ts
 /**

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, Wn as errMsg, Z as calendarsCapability } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, Wn as errMsg, Z as calendarsCapability } from "../../dist-BUFcHq7H.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 //#region src/builtins/calendars/calendars.addon.ts
 /**

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { An as buildFfmpegArgs, Gn as BaseAddon, O as MOTION_CLOSE_AFTER_MS, Q as cameraGridLayoutCapability, Un as DeviceType, Vn as DeviceFeature, Wn as errMsg, Xt as motionCapability, _ as DERIVED_CAMERA_SILENCED_CAP_NAMES, ar as hydrateSchema, dt as declarationOwnerNodeId, gn as snapshotCapability, gr as EventCategory, i as BaseDevice, qt as memoizePinnedFfmpeg, tr as createEvent, v as DeclaredDevices, xn as streamCatalogCapability } from "../../dist-0zO6jHkf.mjs";
+import { An as buildFfmpegArgs, Gn as BaseAddon, O as MOTION_CLOSE_AFTER_MS, Q as cameraGridLayoutCapability, Un as DeviceType, Vn as DeviceFeature, Wn as errMsg, Xt as motionCapability, _ as DERIVED_CAMERA_SILENCED_CAP_NAMES, ar as hydrateSchema, dt as declarationOwnerNodeId, gn as snapshotCapability, gr as EventCategory, i as BaseDevice, qt as memoizePinnedFfmpeg, tr as createEvent, v as DeclaredDevices, xn as streamCatalogCapability } from "../../dist-BUFcHq7H.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
-const require_composition_sources = require("../../composition-sources-Dk6MDMFV.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
+const require_composition_sources = require("../../composition-sources-CeZ3tyH8.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { Bn as toExpressionValue, Ct as evaluateCompositionField, Fn as compositionItemFieldPath, Gn as BaseAddon, In as compositionSliceKey, Ln as compositionSourceKey, Mn as composedDeviceRef, Nn as composedDeviceStableId, Pn as compositionFeatureEnabled, Rn as createStatefulExpressionMemory, Un as DeviceType, Wn as errMsg, Y as buildCapabilityLookup, c as COMPOSED_ITEM_FIXED_FIELDS, et as composerCapability, gr as EventCategory, i as BaseDevice, jn as cloneStatefulExpressionMemory, kn as COMPOSER_ADDON_ID, t as ALL_CAPABILITY_DEFINITIONS, tn as planComposition, tr as createEvent, tt as compositionFieldKey, v as DeclaredDevices, zn as disarmRoseMemory } from "../../dist-0zO6jHkf.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-BSzq8Hfu.mjs";
+import { Bn as toExpressionValue, Ct as evaluateCompositionField, Fn as compositionItemFieldPath, Gn as BaseAddon, In as compositionSliceKey, Ln as compositionSourceKey, Mn as composedDeviceRef, Nn as composedDeviceStableId, Pn as compositionFeatureEnabled, Rn as createStatefulExpressionMemory, Un as DeviceType, Wn as errMsg, Y as buildCapabilityLookup, c as COMPOSED_ITEM_FIXED_FIELDS, et as composerCapability, gr as EventCategory, i as BaseDevice, jn as cloneStatefulExpressionMemory, kn as COMPOSER_ADDON_ID, t as ALL_CAPABILITY_DEFINITIONS, tn as planComposition, tr as createEvent, tt as compositionFieldKey, v as DeclaredDevices, zn as disarmRoseMemory } from "../../dist-BUFcHq7H.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-pQsmMdpR.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, Ht as logDestinationCapability } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, Ht as logDestinationCapability } from "../../dist-BUFcHq7H.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
-const require_composition_sources = require("../../composition-sources-Dk6MDMFV.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
+const require_composition_sources = require("../../composition-sources-CeZ3tyH8.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { Gn as BaseAddon, Ln as compositionSourceKey, Mn as composedDeviceRef, Wn as errMsg, Y as buildCapabilityLookup, at as coreBlockIdFromAddonId, d as CORE_BLOCK_ADDON_PREFIX, f as CoreBlockSchema, ht as describeComposableCaps, it as coreBlockComposition, l as COMPOSER_RUNNER_ID, nt as compositionSourceRefs, on as replacedFieldKeys, ot as coreBlockSourceKind, rt as coreBlockAddonId, st as coreBlocksCapability, t as ALL_CAPABILITY_DEFINITIONS, tn as planComposition, u as CORE_BLOCKS_ADDON_ID, v as DeclaredDevices, wn as validateComposition } from "../../dist-0zO6jHkf.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-BSzq8Hfu.mjs";
+import { Gn as BaseAddon, Ln as compositionSourceKey, Mn as composedDeviceRef, Wn as errMsg, Y as buildCapabilityLookup, at as coreBlockIdFromAddonId, d as CORE_BLOCK_ADDON_PREFIX, f as CoreBlockSchema, ht as describeComposableCaps, it as coreBlockComposition, l as COMPOSER_RUNNER_ID, nt as compositionSourceRefs, on as replacedFieldKeys, ot as coreBlockSourceKind, rt as coreBlockAddonId, st as coreBlocksCapability, t as ALL_CAPABILITY_DEFINITIONS, tn as planComposition, u as CORE_BLOCKS_ADDON_ID, v as DeclaredDevices, wn as validateComposition } from "../../dist-BUFcHq7H.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-pQsmMdpR.mjs";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";
 import * as fs from "node:fs/promises";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-uQUjT56-.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-Ddb5cCNR.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { D as MINUTES_PER_DAY, Gn as BaseAddon, Hn as DeviceRole, Lt as legacyAutoLinkIds, P as STREAM_PROFILE_META, S as FieldClaimSchema, St as enumerateSchemaFields, T as LocationIconIdSchema, Tt as expandContainer, Un as DeviceType, Vn as DeviceFeature, Vt as locationIconKey, Wn as errMsg, X as buildStreamParamsConfigSchema, Zn as WELL_KNOWN_TAB_MAP, Zt as normalizeUnit, _t as deviceManagerCapability, ct as createDeviceExtensionProvider, en as parseStreamParamsFormPatch, g as DAY_NAMES, gr as EventCategory, gt as deviceExtensionCapability, hn as siteZoneKey, kt as formatMinutes, mr as sleep$1, o as CAMERA_SWITCH_ORDER, or as isDeviceConfigCap, pt as defineExtensionSlotProvider, s as CAP_NAMES_WITH_STATUS, t as ALL_CAPABILITY_DEFINITIONS, un as runtimeStatePolicyFor, vt as deviceStateCapability, x as FieldClaimModeSchema, xt as enumerateItemArrayFields, y as DeviceStatusSchema, yt as deviceStatusCapability } from "../../dist-0zO6jHkf.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-Dnuhd8Ml.mjs";
+import { D as MINUTES_PER_DAY, Gn as BaseAddon, Hn as DeviceRole, Lt as legacyAutoLinkIds, P as STREAM_PROFILE_META, S as FieldClaimSchema, St as enumerateSchemaFields, T as LocationIconIdSchema, Tt as expandContainer, Un as DeviceType, Vn as DeviceFeature, Vt as locationIconKey, Wn as errMsg, X as buildStreamParamsConfigSchema, Zn as WELL_KNOWN_TAB_MAP, Zt as normalizeUnit, _t as deviceManagerCapability, ct as createDeviceExtensionProvider, en as parseStreamParamsFormPatch, g as DAY_NAMES, gr as EventCategory, gt as deviceExtensionCapability, hn as siteZoneKey, kt as formatMinutes, mr as sleep$1, o as CAMERA_SWITCH_ORDER, or as isDeviceConfigCap, pt as defineExtensionSlotProvider, s as CAP_NAMES_WITH_STATUS, t as ALL_CAPABILITY_DEFINITIONS, un as runtimeStatePolicyFor, vt as deviceStateCapability, x as FieldClaimModeSchema, xt as enumerateItemArrayFields, y as DeviceStatusSchema, yt as deviceStatusCapability } from "../../dist-BUFcHq7H.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-ltKefX3N.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, Ht as logDestinationCapability } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, Ht as logDestinationCapability } from "../../dist-BUFcHq7H.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, M as RecordingStatusSchema, Wn as errMsg, gr as EventCategory, k as RECORDING_SOURCE_CAMSTACK_ADDON, tr as createEvent } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, M as RecordingStatusSchema, Wn as errMsg, gr as EventCategory, k as RECORDING_SOURCE_CAMSTACK_ADDON, tr as createEvent } from "../../dist-BUFcHq7H.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { B as UserRecordSchema, Cn as userManagementCapability, F as ScopedTokenSchema, G as authProviderCapability, Gn as BaseAddon, r as ApiKeyRecordSchema } from "../../dist-0zO6jHkf.mjs";
+import { B as UserRecordSchema, Cn as userManagementCapability, F as ScopedTokenSchema, G as authProviderCapability, Gn as BaseAddon, r as ApiKeyRecordSchema } from "../../dist-BUFcHq7H.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
-const require_tls = require("../../tls-D_wUeOTD.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
+const require_tls = require("../../tls-DEjOOARt.js");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 let node_fs = require("node:fs");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { Bt as localNetworkCapability, Gn as BaseAddon, gr as EventCategory } from "../../dist-0zO6jHkf.mjs";
-import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-IM-v7JV4.mjs";
+import { Bt as localNetworkCapability, Gn as BaseAddon, gr as EventCategory } from "../../dist-BUFcHq7H.mjs";
+import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-DAtaKVUT.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { readFileSync } from "node:fs";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, Ht as logDestinationCapability } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, Ht as logDestinationCapability } from "../../dist-BUFcHq7H.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
 let node_fs_promises = require("node:fs/promises");
 let node_fs = require("node:fs");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, Jt as metricsProviderCapability, Ot as foldSnapshotByFunction, Wn as errMsg, an as reducePoints, gr as EventCategory, sn as resolveBucketMs, tr as createEvent } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, Jt as metricsProviderCapability, Ot as foldSnapshotByFunction, Wn as errMsg, an as reducePoints, gr as EventCategory, sn as resolveBucketMs, tr as createEvent } from "../../dist-BUFcHq7H.mjs";
 import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as fs from "node:fs";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Gn as BaseAddon, Wn as errMsg, bt as enumerateInferenceDevices, gr as EventCategory, nn as platformProbeCapability, pn as scoreRuntimes, rr as emitReadiness } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, Wn as errMsg, bt as enumerateInferenceDevices, gr as EventCategory, nn as platformProbeCapability, pn as scoreRuntimes, rr as emitReadiness } from "../../dist-BUFcHq7H.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 import * as os from "node:os";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, gr as EventCategory } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, gr as EventCategory } from "../../dist-BUFcHq7H.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, J as batteryCapability, Sn as streamQualityLabel, Un as DeviceType, Vn as DeviceFeature, Wn as errMsg, a as BatteryStatusSchema, cr as nodePin, gn as snapshotCapability, gr as EventCategory, mt as deriveBatteryPresence, q as bareAddonId, qt as memoizePinnedFfmpeg } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, J as batteryCapability, Sn as streamQualityLabel, Un as DeviceType, Vn as DeviceFeature, Wn as errMsg, a as BatteryStatusSchema, cr as nodePin, gn as snapshotCapability, gr as EventCategory, mt as deriveBatteryPresence, q as bareAddonId, qt as memoizePinnedFfmpeg } from "../../dist-BUFcHq7H.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Dt as filesystemBrowseCapability, Gn as BaseAddon, bn as storageProviderCapability } from "../../dist-0zO6jHkf.mjs";
+import { Dt as filesystemBrowseCapability, Gn as BaseAddon, bn as storageProviderCapability } from "../../dist-BUFcHq7H.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 const require_hub_cap_forward = require("../../hub-cap-forward-DmHNjbB0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as collectSecretConfigKeys, A as REDACTED_SECRET, At as gbToBytes, Gn as BaseAddon, Gt as mayReadLocation, I as StorageCleanupJobSchema, Kt as mayWriteToLocation, L as StorageLocationModeSchema, Nt as isLocationEnabled, On as withLocationMode, R as StorageLocationTypeSchema, Rt as legacyModeOf, Yt as modeMayWrite, _n as storageCapability, cn as resolveLocationMode, gr as EventCategory, lr as parseJsonObject, mn as settingsStoreCapability, vn as storageMigrationCapability, w as LegacyStorageLocationDefaultSchema, wt as evictionPolicyOfLocation, z as StorageMigrationJobSchema } from "../../dist-0zO6jHkf.mjs";
+import { $ as collectSecretConfigKeys, A as REDACTED_SECRET, At as gbToBytes, Gn as BaseAddon, Gt as mayReadLocation, I as StorageCleanupJobSchema, Kt as mayWriteToLocation, L as StorageLocationModeSchema, Nt as isLocationEnabled, On as withLocationMode, R as StorageLocationTypeSchema, Rt as legacyModeOf, Yt as modeMayWrite, _n as storageCapability, cn as resolveLocationMode, gr as EventCategory, lr as parseJsonObject, mn as settingsStoreCapability, vn as storageMigrationCapability, w as LegacyStorageLocationDefaultSchema, wt as evictionPolicyOfLocation, z as StorageMigrationJobSchema } from "../../dist-BUFcHq7H.mjs";
 import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-BdT320dq.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, Wn as errMsg, ar as hydrateSchema } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, Wn as errMsg, ar as hydrateSchema } from "../../dist-BUFcHq7H.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqafgUSr.js");
+const require_dist = require("../../dist-DTgd2gOR.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, Ht as logDestinationCapability } from "../../dist-0zO6jHkf.mjs";
+import { Gn as BaseAddon, Ht as logDestinationCapability } from "../../dist-BUFcHq7H.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{child-cap-dispatch-Bm4Kpo7v.js → child-cap-dispatch-CVOa1BZI.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CqafgUSr.js");
+const require_dist = require("./dist-DTgd2gOR.js");
 const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
 require("./hub-cap-forward-DmHNjbB0.js");
 let node_crypto = require("node:crypto");

package/dist/{child-cap-dispatch-B52e2Bcw.mjs → child-cap-dispatch-OLFN-F85.mjs}

@@ -1,4 +1,4 @@
-import { gr as EventCategory$1, tr as createEvent } from "./dist-0zO6jHkf.mjs";
+import { gr as EventCategory$1, tr as createEvent } from "./dist-BUFcHq7H.mjs";
 import { a as parseProcStat, i as nodeProcReader } from "./proc-stat-CbC55Kqi.mjs";
 import "./hub-cap-forward-BdT320dq.mjs";
 import * as crypto$1 from "node:crypto";

package/dist/{composition-sources-Dk6MDMFV.js → composition-sources-CeZ3tyH8.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CqafgUSr.js");
+const require_dist = require("./dist-DTgd2gOR.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-BSzq8Hfu.mjs → composition-sources-pQsmMdpR.mjs}

@@ -1,4 +1,4 @@
-import { Ln as compositionSourceKey, Wn as errMsg } from "./dist-0zO6jHkf.mjs";
+import { Ln as compositionSourceKey, Wn as errMsg } from "./dist-BUFcHq7H.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{dist-0zO6jHkf.mjs → dist-BUFcHq7H.mjs}

@@ -21525,6 +21525,39 @@ var NcAlarmSettingsSchema = z.object({
 	modeDelays: NcAlarmModeDelaysListSchema.default([])
 });
 /**
+* One named alarm configuration profile — a full {@link NcAlarmSettings} blob
+* (memberships including secure-on-arm, delays, announce targets). The id is
+* assigned by the server; clients show the name.
+*/
+var NcAlarmProfileMetaSchema = z.object({
+	id: z.string().min(1).max(64),
+	name: z.string().min(1).max(64),
+	/** The seeded Default profile — cannot be deleted. */
+	isDefault: z.boolean()
+});
+/**
+* Profiles ride on {@link NcAlarmConfig}: one globally active profile, whose
+* settings are what arm decisions and `settings` already expose. Switching
+* active applies that profile's blob onto the panel.
+*/
+var NcAlarmProfilesViewSchema = z.object({
+	activeId: z.string().min(1),
+	items: z.array(NcAlarmProfileMetaSchema).min(1)
+});
+var NcAlarmCreateProfileInputSchema = z.object({
+	name: z.string().min(1).max(64),
+	/**
+	* Omit / undefined → system defaults (empty memberships, stock delays).
+	* Set → clone that profile's settings.
+	*/
+	cloneFromId: z.string().min(1).max(64).optional()
+});
+var NcAlarmRenameProfileInputSchema = z.object({
+	id: z.string().min(1).max(64),
+	name: z.string().min(1).max(64)
+});
+var NcAlarmProfileIdInputSchema = z.object({ id: z.string().min(1).max(64) });
+/**
 * Every field optional — a tab edits one control at a time.
 *
 * List fields and `modeDelays` are re-declared WITHOUT their defaults:
@@ -21635,6 +21668,11 @@ var NcAlarmConfigSchema = z.object({
 	*/
 	deviceId: z.number().int().nullable(),
 	settings: NcAlarmSettingsSchema,
+	/**
+	* Named configuration profiles. Optional so an older hub answer still parses;
+	* a client without this field shows no picker (single implicit Default).
+	*/
+	profiles: NcAlarmProfilesViewSchema.optional(),
 	coverage: z.array(NcAlarmModeCoverageSchema),
 	/**
 	* The panel as it is NOW — state, what each mode would find open, what is
@@ -21925,6 +21963,36 @@ var notificationRulesCapability = {
 			auth: "admin"
 		}),
 		/**
+		* Create a named profile. Without `cloneFromId` the new profile starts at
+		* system defaults (empty memberships); with it, a copy of that profile.
+		* Does not activate — the operator switches explicitly.
+		*/
+		createAlarmProfile: method(NcAlarmCreateProfileInputSchema, NcAlarmConfigSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Rename a profile (Default included — only the name, never the id). */
+		renameAlarmProfile: method(NcAlarmRenameProfileInputSchema, NcAlarmConfigSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Delete a non-default profile. If it was active, Default becomes active
+		* and its settings are applied for arm decisions.
+		*/
+		deleteAlarmProfile: method(NcAlarmProfileIdInputSchema, NcAlarmConfigSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Make this profile active: its membership/delays blob is applied to the
+		* panel so the next arm uses it.
+		*/
+		activateAlarmProfile: method(NcAlarmProfileIdInputSchema, NcAlarmConfigSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* The CURRENT state of each asked device as the alarm reads it (D697) — open, closed,
 		* unknown (why) or not an opening, plus liveness. Classified by the same table the arm
 		* check uses (`alarm-openings.ts`), so the editor and the arm can never disagree. The
@@ -51423,12 +51491,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.activateAlarmProfile": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.cancelSnooze": {
 		capName: "notification-rules",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.createAlarmProfile": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.createRule": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -51441,6 +51521,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.deleteAlarmProfile": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"notificationRules.deleteRule": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -51525,6 +51611,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.renameAlarmProfile": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.resolveArtifactUrl": {
 		capName: "notification-rules",
 		capScope: "system",

package/dist/{dist-CqafgUSr.js → dist-DTgd2gOR.js}

@@ -21525,6 +21525,39 @@ var NcAlarmSettingsSchema = zod.z.object({
 	modeDelays: NcAlarmModeDelaysListSchema.default([])
 });
 /**
+* One named alarm configuration profile — a full {@link NcAlarmSettings} blob
+* (memberships including secure-on-arm, delays, announce targets). The id is
+* assigned by the server; clients show the name.
+*/
+var NcAlarmProfileMetaSchema = zod.z.object({
+	id: zod.z.string().min(1).max(64),
+	name: zod.z.string().min(1).max(64),
+	/** The seeded Default profile — cannot be deleted. */
+	isDefault: zod.z.boolean()
+});
+/**
+* Profiles ride on {@link NcAlarmConfig}: one globally active profile, whose
+* settings are what arm decisions and `settings` already expose. Switching
+* active applies that profile's blob onto the panel.
+*/
+var NcAlarmProfilesViewSchema = zod.z.object({
+	activeId: zod.z.string().min(1),
+	items: zod.z.array(NcAlarmProfileMetaSchema).min(1)
+});
+var NcAlarmCreateProfileInputSchema = zod.z.object({
+	name: zod.z.string().min(1).max(64),
+	/**
+	* Omit / undefined → system defaults (empty memberships, stock delays).
+	* Set → clone that profile's settings.
+	*/
+	cloneFromId: zod.z.string().min(1).max(64).optional()
+});
+var NcAlarmRenameProfileInputSchema = zod.z.object({
+	id: zod.z.string().min(1).max(64),
+	name: zod.z.string().min(1).max(64)
+});
+var NcAlarmProfileIdInputSchema = zod.z.object({ id: zod.z.string().min(1).max(64) });
+/**
 * Every field optional — a tab edits one control at a time.
 *
 * List fields and `modeDelays` are re-declared WITHOUT their defaults:
@@ -21635,6 +21668,11 @@ var NcAlarmConfigSchema = zod.z.object({
 	*/
 	deviceId: zod.z.number().int().nullable(),
 	settings: NcAlarmSettingsSchema,
+	/**
+	* Named configuration profiles. Optional so an older hub answer still parses;
+	* a client without this field shows no picker (single implicit Default).
+	*/
+	profiles: NcAlarmProfilesViewSchema.optional(),
 	coverage: zod.z.array(NcAlarmModeCoverageSchema),
 	/**
 	* The panel as it is NOW — state, what each mode would find open, what is
@@ -21925,6 +21963,36 @@ var notificationRulesCapability = {
 			auth: "admin"
 		}),
 		/**
+		* Create a named profile. Without `cloneFromId` the new profile starts at
+		* system defaults (empty memberships); with it, a copy of that profile.
+		* Does not activate — the operator switches explicitly.
+		*/
+		createAlarmProfile: method(NcAlarmCreateProfileInputSchema, NcAlarmConfigSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Rename a profile (Default included — only the name, never the id). */
+		renameAlarmProfile: method(NcAlarmRenameProfileInputSchema, NcAlarmConfigSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Delete a non-default profile. If it was active, Default becomes active
+		* and its settings are applied for arm decisions.
+		*/
+		deleteAlarmProfile: method(NcAlarmProfileIdInputSchema, NcAlarmConfigSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Make this profile active: its membership/delays blob is applied to the
+		* panel so the next arm uses it.
+		*/
+		activateAlarmProfile: method(NcAlarmProfileIdInputSchema, NcAlarmConfigSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* The CURRENT state of each asked device as the alarm reads it (D697) — open, closed,
 		* unknown (why) or not an opening, plus liveness. Classified by the same table the arm
 		* check uses (`alarm-openings.ts`), so the editor and the arm can never disagree. The
@@ -51423,12 +51491,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.activateAlarmProfile": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.cancelSnooze": {
 		capName: "notification-rules",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.createAlarmProfile": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.createRule": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -51441,6 +51521,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.deleteAlarmProfile": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"notificationRules.deleteRule": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -51525,6 +51611,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.renameAlarmProfile": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.resolveArtifactUrl": {
 		capName: "notification-rules",
 		capScope: "system",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CqafgUSr.js");
+const require_dist = require("./dist-DTgd2gOR.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -30,8 +30,8 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-ey4mbofz.js");
-const require_tls$1 = require("./tls-D_wUeOTD.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-Bm4Kpo7v.js");
+const require_tls$1 = require("./tls-DEjOOARt.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-CVOa1BZI.js");
 const require_resource_monitor = require("./resource-monitor-DzNn_IZK.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $n as asNumber, $t as objectInputDeclaresRequiredDeviceId, C as LOG_LEVEL_RANK, E as METHOD_ACCESS_MAP, Et as extractNestedAddonId, Ft as isVoidInput, H as addonSettingsCapability, It as kebabToCamel, Jn as DEVICE_STATUS_METHOD, Kn as DATAPLANE_SECRET_HEADER$1, Mt as isCollectionArrayMethod, Pt as isObjectInput, Qn as asJsonObject$1, Qt as objectInputDeclaresAddonId, Ut as logLevelAtMost, Wn as errMsg$1, Wt as looseSchema, Xn as ReadinessTimeoutError, Yn as ReadinessRegistry, dn as scopesAllowAddon, dr as readinessKey, er as asString$1, fn as scopesAllowDeviceCap, fr as resolveCapMount, gr as EventCategory$1, ir as expandCapMethods, j as RUNTIME_DEFAULTS, jt as isArrayOutputSchema, ln as resolveMethodAuth, lr as parseJsonObject, nr as emitDownForOwnedCaps, pr as scopeKey, qn as DEVICE_SETTINGS_CONTRIBUTION_METHODS, rn as procedureAuthKey, t as ALL_CAPABILITY_DEFINITIONS, tr as createEvent, ur as parseJsonUnknown, zt as lifecycleJobSchema } from "./dist-0zO6jHkf.mjs";
+import { $n as asNumber, $t as objectInputDeclaresRequiredDeviceId, C as LOG_LEVEL_RANK, E as METHOD_ACCESS_MAP, Et as extractNestedAddonId, Ft as isVoidInput, H as addonSettingsCapability, It as kebabToCamel, Jn as DEVICE_STATUS_METHOD, Kn as DATAPLANE_SECRET_HEADER$1, Mt as isCollectionArrayMethod, Pt as isObjectInput, Qn as asJsonObject$1, Qt as objectInputDeclaresAddonId, Ut as logLevelAtMost, Wn as errMsg$1, Wt as looseSchema, Xn as ReadinessTimeoutError, Yn as ReadinessRegistry, dn as scopesAllowAddon, dr as readinessKey, er as asString$1, fn as scopesAllowDeviceCap, fr as resolveCapMount, gr as EventCategory$1, ir as expandCapMethods, j as RUNTIME_DEFAULTS, jt as isArrayOutputSchema, ln as resolveMethodAuth, lr as parseJsonObject, nr as emitDownForOwnedCaps, pr as scopeKey, qn as DEVICE_SETTINGS_CONTRIBUTION_METHODS, rn as procedureAuthKey, t as ALL_CAPABILITY_DEFINITIONS, tr as createEvent, ur as parseJsonUnknown, zt as lifecycleJobSchema } from "./dist-BUFcHq7H.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -29,8 +29,8 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as ensureModel, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, g as downloadModel, h as downloadFile, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as deleteModelFromDisk, n as STALL_TICK_MS, o as contentTypeFor, p as collectModelFiles, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as fetchJson, x as isModelDownloaded, y as getModelFilePath } from "./event-loop-stall-monitor-EXjzIxDz.mjs";
-import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-IM-v7JV4.mjs";
-import { $ as CapRouteError, $n as CAP_ACTION_UNLABELLED, $t as RUNNER_HEAP_WATCH_INTERVAL_MS, A as resolveHwAccel, An as OUTBOUND_QUEUE_COOLDOWN_MS, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as SOCKET_QUEUE_TOP_N, Bt as createAddonPeerBytesFacility, C as getBrokerEventBus, Cn as DECISIVE_HEAP_SPACES, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as heapSpaceField, Dt as capServiceName, E as setNodeEventInterest, En as formatHeapSpaces, Et as capBareAction, F as ipcParentLink, Fn as MESH_QUEUE_TOP_N, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as readSocketQueues, Gt as HEAP_RECLAIM_TRIGGER_MB, H as createUdsLoggerWithControl, Hn as createSocketPlaneReader, Ht as createAddonDataPlaneFacility, I as localProviderLink, In as createMeshQueueReader, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as recordSocketFrame, Jt as HUB_MAIN_HEAP_WATCH_LABEL, K as afterWorkerOnlineAnnounce, Kn as EMPTY_SOCKET_DIRECTION, Kt as HEAP_WATCH_INTERVAL_MS, L as createParentUnownedCallHandler, Ln as formatMeshQueue, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, Mt as CapabilityHandle, N as buildLinkChain, Nn as createOutboundQueueGate, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as readHeapSpaces, Ot as parseCapAction, P as deviceCapResolverLink, Pn as formatOutboundQueueVerdict, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as CAP_ACTION_OVERFLOW_LABEL, Qt as RSS_BUDGET_RELEASE_RATIO, R as createUdsEventBridge, Rn as EMPTY_SOCKET_PLANE_BASELINE, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as isArrayBufferCensusReport, St as validateProviderRegistrations, T as registerEventBusService, Tn as emitHeapDiagnosticReport, Tt as capActionSuffix, U as LocalChildClient, Un as diffSocketPlane, Ut as HEAP_RECLAIM_MIN_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneMeter, Vt as hostNodeIdOf, W as LocalChildRegistry, Wn as formatSocketPlane, Wt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionBytes, Xt as HUB_RSS_BUDGET_ENV, Y as deviceOfGetStatus, Yn as sampleSocketDirection, Yt as HUB_MAIN_RSS_BUDGET_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as socketDirectionMessages, Zt as RSS_BUDGET_REANNOUNCE_MIN_MS, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, a as reapProcessGroup, an as createV8Reclaimer, ar as EVENT_PLANE_TOP_N, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as createInspectorArrayBufferCensus, c as runnerOwnsProcessGroup, cn as nextRssBudgetState, cr as diffEventPlane, ct as UdsLocalTransportClient, d as summarizeMembers, dn as shouldReclaim, dt as PeerAnsweredError, en as RUNNER_RSS_BUDGET_ENV, er as EMPTY_CAP_ACTION_READING, et as classifyCapRoute, f as installManifestSystemDeps, fn as startHeapWatch, ft as localEndpointPath, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ht as buildNativeCapProxy, in as createLoopDelayMeter, ir as diffCapActionCensus, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as OUTBOUND_QUEUE_SUSTAIN_MS, jt as DeviceRegistry, k as createKernelHwAccel, kn as selectReportedSpaces, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as parseRssBudgetMb, lr as formatEventPlane, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as strandedMb, mt as encodeFrame, nn as buildHeapSample, nr as capActionLabel, nt as readMoleculerFanoutMode, o as registerRunnerGroup, on as describeRss, or as createEventPlaneMeter, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as startRunnerHeapWatch, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as createSocketDirectionCounters, qt as HEAP_WATCH_WARN_RATIO, r as defaultProcessGroupOps, rn as createDeferredHeapWatchSink, rr as createCapActionCensus, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as hubMainRssBudget, sr as createEventPlaneReader, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as ZERO_LOOP_DELAY, tr as MAX_CAP_ACTIONS_PER_PEER, tt as callWithServiceDiscovery, un as reclaimIntervalMs, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, w as getMoleculerEventStats, wn as HEAP_SPACE_REPORT_MIN_MB, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as formatArrayBufferCensus, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as createArrayBufferCensusGate, yt as mountNativeCapService, z as createUdsEventBus, zn as SOCKET_PLANE_TOP_N, zt as runNpm } from "./child-cap-dispatch-B52e2Bcw.mjs";
+import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DAtaKVUT.mjs";
+import { $ as CapRouteError, $n as CAP_ACTION_UNLABELLED, $t as RUNNER_HEAP_WATCH_INTERVAL_MS, A as resolveHwAccel, An as OUTBOUND_QUEUE_COOLDOWN_MS, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as SOCKET_QUEUE_TOP_N, Bt as createAddonPeerBytesFacility, C as getBrokerEventBus, Cn as DECISIVE_HEAP_SPACES, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as heapSpaceField, Dt as capServiceName, E as setNodeEventInterest, En as formatHeapSpaces, Et as capBareAction, F as ipcParentLink, Fn as MESH_QUEUE_TOP_N, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as readSocketQueues, Gt as HEAP_RECLAIM_TRIGGER_MB, H as createUdsLoggerWithControl, Hn as createSocketPlaneReader, Ht as createAddonDataPlaneFacility, I as localProviderLink, In as createMeshQueueReader, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as recordSocketFrame, Jt as HUB_MAIN_HEAP_WATCH_LABEL, K as afterWorkerOnlineAnnounce, Kn as EMPTY_SOCKET_DIRECTION, Kt as HEAP_WATCH_INTERVAL_MS, L as createParentUnownedCallHandler, Ln as formatMeshQueue, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, Mt as CapabilityHandle, N as buildLinkChain, Nn as createOutboundQueueGate, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as readHeapSpaces, Ot as parseCapAction, P as deviceCapResolverLink, Pn as formatOutboundQueueVerdict, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as CAP_ACTION_OVERFLOW_LABEL, Qt as RSS_BUDGET_RELEASE_RATIO, R as createUdsEventBridge, Rn as EMPTY_SOCKET_PLANE_BASELINE, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as isArrayBufferCensusReport, St as validateProviderRegistrations, T as registerEventBusService, Tn as emitHeapDiagnosticReport, Tt as capActionSuffix, U as LocalChildClient, Un as diffSocketPlane, Ut as HEAP_RECLAIM_MIN_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneMeter, Vt as hostNodeIdOf, W as LocalChildRegistry, Wn as formatSocketPlane, Wt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionBytes, Xt as HUB_RSS_BUDGET_ENV, Y as deviceOfGetStatus, Yn as sampleSocketDirection, Yt as HUB_MAIN_RSS_BUDGET_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as socketDirectionMessages, Zt as RSS_BUDGET_REANNOUNCE_MIN_MS, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, a as reapProcessGroup, an as createV8Reclaimer, ar as EVENT_PLANE_TOP_N, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as createInspectorArrayBufferCensus, c as runnerOwnsProcessGroup, cn as nextRssBudgetState, cr as diffEventPlane, ct as UdsLocalTransportClient, d as summarizeMembers, dn as shouldReclaim, dt as PeerAnsweredError, en as RUNNER_RSS_BUDGET_ENV, er as EMPTY_CAP_ACTION_READING, et as classifyCapRoute, f as installManifestSystemDeps, fn as startHeapWatch, ft as localEndpointPath, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ht as buildNativeCapProxy, in as createLoopDelayMeter, ir as diffCapActionCensus, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as OUTBOUND_QUEUE_SUSTAIN_MS, jt as DeviceRegistry, k as createKernelHwAccel, kn as selectReportedSpaces, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as parseRssBudgetMb, lr as formatEventPlane, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as strandedMb, mt as encodeFrame, nn as buildHeapSample, nr as capActionLabel, nt as readMoleculerFanoutMode, o as registerRunnerGroup, on as describeRss, or as createEventPlaneMeter, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as startRunnerHeapWatch, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as createSocketDirectionCounters, qt as HEAP_WATCH_WARN_RATIO, r as defaultProcessGroupOps, rn as createDeferredHeapWatchSink, rr as createCapActionCensus, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as hubMainRssBudget, sr as createEventPlaneReader, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as ZERO_LOOP_DELAY, tr as MAX_CAP_ACTIONS_PER_PEER, tt as callWithServiceDiscovery, un as reclaimIntervalMs, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, w as getMoleculerEventStats, wn as HEAP_SPACE_REPORT_MIN_MB, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as formatArrayBufferCensus, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as createArrayBufferCensusGate, yt as mountNativeCapService, z as createUdsEventBus, zn as SOCKET_PLANE_TOP_N, zt as runNpm } from "./child-cap-dispatch-OLFN-F85.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B1v6E07R.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";

package/dist/{retired-settings-keys-uQUjT56-.js → retired-settings-keys-Ddb5cCNR.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CqafgUSr.js");
+const require_dist = require("./dist-DTgd2gOR.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-Dnuhd8Ml.mjs → retired-settings-keys-ltKefX3N.mjs}

@@ -1,4 +1,4 @@
-import { Qn as asJsonObject } from "./dist-0zO6jHkf.mjs";
+import { Qn as asJsonObject } from "./dist-BUFcHq7H.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/tls/cert-identity.d.ts

@@ -24,9 +24,10 @@ export declare function systemHostFacts(): HostFacts;
  *
  * The two are deliberately different sizes. Everything plausible is
  * certified — costs nothing. Only a **stable** identity gates
- * regeneration, because a gate that fires on a rotating address rewrites
- * the certificate on every boot, which is a worse bug than the one the
- * gate exists to fix.
+ * regeneration (IPv4 + DNS + operator `extraSans`), because a gate that
+ * fires on a rotating address rewrites the certificate on every boot,
+ * which is a worse bug than the one the gate exists to fix. IPv6 never
+ * gates — ULA proved as unstable as global SLAAC on the live hub.
  */
 export interface CertIdentity {
     readonly dnsNames: readonly string[];

package/dist/tls/cert-manager.d.ts

@@ -68,8 +68,9 @@ export interface CertOptions {
  *
  * And explicitly NOT when: the certificate names an address the machine
  * no longer has (a superset still works — the check is one-directional),
- * a volatile interface (docker/VPN/mesh) or a global-scope IPv6 address
- * changed (SLAAC privacy addresses rotate daily), or a new build shipped.
+ * a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
+ * (global and ULA both rotate under privacy extensions / interface-id
+ * churn — `os` cannot tell temporary from permanent), or a new build shipped.
  *
  * Every trigger is derived from the files plus the machine, so once a
  * reissue clears them it clears them for good: the next boot returns

package/dist/{tls-IM-v7JV4.mjs → tls-DAtaKVUT.mjs}

@@ -277,27 +277,21 @@ function isLinkLocal(value) {
 	const parsed = Number.parseInt(firstGroup, 16);
 	return Number.isFinite(parsed) && (parsed & 65472) === 65152;
 }
-/** `fc00::/7` — the IPv6 range that behaves like RFC 1918 does for v4. */
-function isUniqueLocalIpv6(value) {
-	if (!isIpv6(value)) return false;
-	const firstGroup = value.split(":")[0] ?? "";
-	const parsed = Number.parseInt(firstGroup, 16);
-	return Number.isFinite(parsed) && (parsed & 65024) === 64512;
-}
 function isVolatileInterface(name) {
 	const lower = name.toLowerCase();
 	return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
 }
 /**
-* A global-scope IPv6 address is NOT a stable identity: SLAAC privacy
-* extensions rotate temporary addresses roughly daily, and `os` gives us
-* no way to tell a temporary address from a permanent one. Gating on
-* one would reissue the certificate every day.
+* Only IPv4 gates a reissue. Every IPv6 address we see — global **or**
+* ULA — is certified but never required: `os` cannot tell a temporary
+* address from a permanent one, and the live hub's ULA interface-id
+* rotated on every restart (eight leaf reissues in one day under
+* `san-coverage-gap`). Gating on ULA reproduced the churn D227 exists
+* to prevent. Operators who need a fixed IPv6 declare it via `extraSans`.
 */
 function isStableGateAddress(address) {
 	if (isLinkLocal(address)) return false;
-	if (isIpv4(address)) return true;
-	return isUniqueLocalIpv6(address);
+	return isIpv4(address);
 }
 function addSan(dns, ips, value) {
 	const trimmed = value.trim();
@@ -11711,8 +11705,9 @@ var DEFAULT_COMMON_NAME = "camstack.local";
 *
 * And explicitly NOT when: the certificate names an address the machine
 * no longer has (a superset still works — the check is one-directional),
-* a volatile interface (docker/VPN/mesh) or a global-scope IPv6 address
-* changed (SLAAC privacy addresses rotate daily), or a new build shipped.
+* a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
+* (global and ULA both rotate under privacy extensions / interface-id
+* churn — `os` cannot tell temporary from permanent), or a new build shipped.
 *
 * Every trigger is derived from the files plus the machine, so once a
 * reissue clears them it clears them for good: the next boot returns

package/dist/{tls-D_wUeOTD.js → tls-DEjOOARt.js}

@@ -278,27 +278,21 @@ function isLinkLocal(value) {
 	const parsed = Number.parseInt(firstGroup, 16);
 	return Number.isFinite(parsed) && (parsed & 65472) === 65152;
 }
-/** `fc00::/7` — the IPv6 range that behaves like RFC 1918 does for v4. */
-function isUniqueLocalIpv6(value) {
-	if (!isIpv6(value)) return false;
-	const firstGroup = value.split(":")[0] ?? "";
-	const parsed = Number.parseInt(firstGroup, 16);
-	return Number.isFinite(parsed) && (parsed & 65024) === 64512;
-}
 function isVolatileInterface(name) {
 	const lower = name.toLowerCase();
 	return VOLATILE_INTERFACE_PREFIXES.some((prefix) => lower.startsWith(prefix));
 }
 /**
-* A global-scope IPv6 address is NOT a stable identity: SLAAC privacy
-* extensions rotate temporary addresses roughly daily, and `os` gives us
-* no way to tell a temporary address from a permanent one. Gating on
-* one would reissue the certificate every day.
+* Only IPv4 gates a reissue. Every IPv6 address we see — global **or**
+* ULA — is certified but never required: `os` cannot tell a temporary
+* address from a permanent one, and the live hub's ULA interface-id
+* rotated on every restart (eight leaf reissues in one day under
+* `san-coverage-gap`). Gating on ULA reproduced the churn D227 exists
+* to prevent. Operators who need a fixed IPv6 declare it via `extraSans`.
 */
 function isStableGateAddress(address) {
 	if (isLinkLocal(address)) return false;
-	if (isIpv4(address)) return true;
-	return isUniqueLocalIpv6(address);
+	return isIpv4(address);
 }
 function addSan(dns, ips, value) {
 	const trimmed = value.trim();
@@ -11712,8 +11706,9 @@ var DEFAULT_COMMON_NAME = "camstack.local";
 *
 * And explicitly NOT when: the certificate names an address the machine
 * no longer has (a superset still works — the check is one-directional),
-* a volatile interface (docker/VPN/mesh) or a global-scope IPv6 address
-* changed (SLAAC privacy addresses rotate daily), or a new build shipped.
+* a volatile interface (docker/VPN/mesh) or **any** IPv6 address changed
+* (global and ULA both rotate under privacy extensions / interface-id
+* churn — `os` cannot tell temporary from permanent), or a new build shipped.
 *
 * Every trigger is derived from the files plus the machine, so once a
 * reissue clears them it clears them for good: the next boot returns

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.345",
+  "version": "1.2.347",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",