@camstack/system 1.2.358 → 1.2.360

package/dist/{dist-D3bhbMY3.mjs → dist-C9Rk6KVv.mjs}

@@ -710,7 +710,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-DXKLNFvA.mjs
+//#region ../types/dist/sleep-C16NCZR2.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -17178,6 +17178,65 @@ var filesystemBrowseCapability = {
 		})
 	}
 };
+/** The central link domain the viewer app claims (Universal Links / App Links). */
+var CAMSTACK_APP_LINK_ORIGIN = "https://camstack.zentik.app";
+/** True when `baseUrl` names the CamStack app link rather than a hub address. */
+function isAppLinkBase(baseUrl) {
+	if (baseUrl === null || baseUrl === void 0 || baseUrl === "") return false;
+	try {
+		return new URL(baseUrl).origin === CAMSTACK_APP_LINK_ORIGIN;
+	} catch {
+		return false;
+	}
+}
+/**
+* Reduce a base URL to the bare origin the central page accepts as `hub=`,
+* or `null` when it cannot be one: not http(s), carries credentials, or does
+* not parse. A path/query/fragment is dropped — the central page mounts the
+* viewer under the origin itself.
+*/
+function toAppLinkHubOrigin(baseUrl) {
+	let parsed;
+	try {
+		parsed = new URL(baseUrl);
+	} catch {
+		return null;
+	}
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+	if (parsed.username !== "" || parsed.password !== "") return null;
+	if (parsed.hostname === "") return null;
+	return parsed.origin;
+}
+/**
+* The hub address an app link carries as `hub=`, chosen from the hub's OWN
+* advertised palette so it always agrees with what the Network page lists:
+* the public tunnel first, then the mesh (Tailscale MagicDNS) — HTTPS only,
+* because the app and the hosted viewer reach it from off the LAN. `null`
+* when the hub advertises neither.
+*/
+function pickAppLinkHub(endpoints) {
+	const rank = (e) => {
+		if (e.kind !== "public" || !e.baseUrl.startsWith("https://")) return null;
+		if (e.interfaceKind === "public") return 0;
+		if (e.interfaceKind === "vpn") return 1;
+		return null;
+	};
+	return endpoints.flatMap((e) => {
+		const r = rank(e);
+		const origin = toAppLinkHubOrigin(e.baseUrl);
+		return r === null || origin === null ? [] : [{
+			r,
+			p: e.priority,
+			origin
+		}];
+	}).toSorted((a, b) => a.r - b.r || a.p - b.p)[0]?.origin ?? null;
+}
+var HUB_ADDRESS_ROLES = [
+	"appConnections",
+	"notificationTaps",
+	"internal",
+	"publicEndpoint"
+];
 var IPV4_LITERAL = /^\d{1,3}(?:\.\d{1,3}){3}$/;
 function hostnameOf(baseUrl) {
 	try {
@@ -17187,6 +17246,9 @@ function hostnameOf(baseUrl) {
 		return null;
 	}
 }
+function trimSlash(baseUrl) {
+	return baseUrl.replace(/\/+$/, "");
+}
 function isMesh(endpoint) {
 	return endpoint.kind === "public" && endpoint.interfaceKind === "vpn";
 }
@@ -17201,11 +17263,11 @@ function isLanIpv4Literal(endpoint) {
 	const host = hostnameOf(endpoint.baseUrl);
 	return host !== null && IPV4_LITERAL.test(host);
 }
-/** Lower = better; `null` = never this audience's answer. */
-function rankFor(audience, endpoint) {
-	if (endpoint.kind === "loopback" || endpoint.kind === "app-link") return null;
+/** Lower = better; `null` = never this role's AUTOMATIC answer. */
+function autoRankFor(role, endpoint) {
+	if (endpoint.kind === "loopback" || endpoint.kind === "app-link" || endpoint.kind === "custom") return null;
 	if (hostnameOf(endpoint.baseUrl) === null) return null;
-	if (audience === "cluster") {
+	if (role === "internal") {
 		if (isLanIpv4Literal(endpoint)) return 0;
 		if (isPlausibleLan(endpoint)) return 1;
 		if (isMesh(endpoint)) return 2;
@@ -17231,11 +17293,11 @@ function isLoopbackHost(hostname) {
 	return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
 }
 /**
-* Validate an operator-typed override: an http(s) URL with a host, no
+* Validate an operator-typed address: an http(s) URL with a host, no
 * credentials, no path, and never loopback (it would name whoever dials it).
 * Answers the normalised origin (`scheme://host[:port]`).
 */
-function validateHubAddressOverride(raw) {
+function validateCustomAddress(raw) {
 	const trimmed = raw.trim();
 	if (trimmed === "") return {
 		ok: false,
@@ -17275,33 +17337,130 @@ function validateHubAddressOverride(raw) {
 		baseUrl: parsed.origin
 	};
 }
-/** {@link pickHubBaseUrl}, saying where the answer came from. */
-function resolveHubAddress(endpoints, audience, override) {
-	if (override !== null && override !== "") {
-		const check = validateHubAddressOverride(override);
-		if (check.ok) return {
-			override,
-			resolved: check.baseUrl,
-			source: "override"
-		};
-	}
-	const auto = pickFromPalette(endpoints, audience);
-	return {
-		override: override === null || override === "" ? null : override,
-		resolved: auto,
-		source: auto === null ? "none" : "auto"
+/** The reason a plain-http public endpoint is refused unless accepted. */
+var PUBLIC_ENDPOINT_HTTP_REASON = "The public endpoint needs an https:// address: passkeys and most identity providers refuse a plain-http origin. Accept http only when sign-in and notification links never leave your own network.";
+/**
+* May `baseUrl` carry `role`? The address check above, plus two role rules:
+* the app link carries `notificationTaps` only (it is not a hub address), and
+* a plain-http address carries `publicEndpoint` only when the operator
+* explicitly accepted it (`acceptInsecureHttp`) — a LAN-only password or
+* magic-link sign-in works over http, a passkey or an OIDC callback does not.
+*/
+function checkRoleAddress(role, baseUrl, options = {}) {
+	if (isAppLinkBase(baseUrl)) return role === "notificationTaps" ? {
+		ok: true,
+		baseUrl: CAMSTACK_APP_LINK_ORIGIN
+	} : {
+		ok: false,
+		reason: "The CamStack app link is not a hub address — only notification taps can use it."
+	};
+	const check = validateCustomAddress(baseUrl);
+	if (!check.ok) return check;
+	if (role === "publicEndpoint" && check.baseUrl.startsWith("http:") && options.acceptInsecureHttp !== true) return {
+		ok: false,
+		reason: PUBLIC_ENDPOINT_HTTP_REASON
 	};
+	return check;
 }
-function pickFromPalette(endpoints, audience) {
+/** A stored flag that still validates (stored values are external data). */
+function validFlag(role, flag) {
+	if (flag === null || flag === "") return null;
+	const check = checkRoleAddress(role, flag, { acceptInsecureHttp: true });
+	return check.ok ? check.baseUrl : null;
+}
+function pickAuto(endpoints, role) {
 	const best = endpoints.flatMap((endpoint) => {
-		const rank = rankFor(audience, endpoint);
+		const rank = autoRankFor(role, endpoint);
 		return rank === null ? [] : [{
 			rank,
 			priority: endpoint.priority,
 			endpoint
 		}];
 	}).toSorted((a, b) => a.rank - b.rank || a.priority - b.priority)[0];
-	return best === void 0 ? null : best.endpoint.baseUrl.replace(/\/+$/, "");
+	return best === void 0 ? null : trimSlash(best.endpoint.baseUrl);
+}
+function resolveHubRole(endpoints, role, flag) {
+	const flagged = validFlag(role, flag);
+	if (flagged !== null) return {
+		flagged,
+		resolved: flagged,
+		source: "flagged"
+	};
+	const auto = pickAuto(endpoints, role);
+	return {
+		flagged: null,
+		resolved: auto,
+		source: auto === null ? "none" : "auto"
+	};
+}
+/** `internal`: what agents and LAN devices download from. */
+function resolveInternalAddress(endpoints, flags) {
+	return resolveHubRole(endpoints, "internal", flags.internal);
+}
+/**
+* `publicEndpoint`: every URL that must work off the LAN — sign-in links, OIDC
+* / OAuth2 callbacks, the relying party, and notification buttons,
+* attachments, media and admin links.
+*/
+function resolvePublicEndpoint(endpoints, flags) {
+	return resolveHubRole(endpoints, "publicEndpoint", flags.publicEndpoint);
+}
+/** `notificationTaps`: the flagged address, else the CamStack app link (D709). */
+function resolveNotificationTapAddress(flags) {
+	const flagged = validFlag("notificationTaps", flags.notificationTaps);
+	if (flagged !== null && !isAppLinkBase(flagged)) return {
+		flagged,
+		resolved: flagged,
+		source: "flagged"
+	};
+	return {
+		flagged: null,
+		resolved: CAMSTACK_APP_LINK_ORIGIN,
+		source: "auto"
+	};
+}
+/** AUTO app connections: LAN IPv4 + the public tunnel. Never IPv6, mesh, loopback or custom. */
+function isDefaultAppConnectionEndpoint(endpoint) {
+	if (endpoint.kind === "lan-ipv4") return true;
+	return endpoint.kind === "public" && endpoint.interfaceKind === "public";
+}
+/**
+* The endpoints the apps race: the flagged ones that are in `endpoints`
+* (which carries the custom addresses flagged `appConnections`), else AUTO. A flagged
+* set none of which is currently up falls back to AUTO rather than racing
+* nothing.
+*/
+function selectAppConnectionEndpoints(endpoints, flags) {
+	const auto = endpoints.filter(isDefaultAppConnectionEndpoint);
+	if (flags.appConnections.length === 0) return auto;
+	const wanted = new Set(flags.appConnections);
+	const explicit = endpoints.filter((e) => wanted.has(e.baseUrl));
+	return explicit.length > 0 ? explicit : auto;
+}
+/** `appConnections`: what the apps try when connecting. */
+function resolveAppConnections(endpoints, flags) {
+	const wanted = new Set(flags.appConnections);
+	const selected = selectAppConnectionEndpoints(endpoints, flags);
+	const usedFlags = selected.some((e) => wanted.has(e.baseUrl));
+	return {
+		flagged: flags.appConnections,
+		resolved: selected.map((e) => e.baseUrl),
+		source: selected.length === 0 ? "none" : usedFlags ? "flagged" : "auto"
+	};
+}
+/**
+* Every role at once, each through its own resolver. `appPalette` is what
+* the apps race (it carries the custom addresses flagged `appConnections`);
+* `hubPalette` is the detected HTTPS palette `internal` and `publicEndpoint`
+* resolve over.
+*/
+function resolveHubAddressRoles(appPalette, hubPalette, flags) {
+	return {
+		appConnections: resolveAppConnections(appPalette, flags),
+		notificationTaps: resolveNotificationTapAddress(flags),
+		internal: resolveInternalAddress(hubPalette, flags),
+		publicEndpoint: resolvePublicEndpoint(hubPalette, flags)
+	};
 }
 /**
 * Transport bounds for AI capability methods.
@@ -21860,7 +22019,13 @@ var NcAlarmModeDelaysSchema = z.object({
 	* Absent = false (logged, not sent). Even when true it is not sent when that same sensor
 	* is the one that starts the entry delay — the entry-delay notification already names it.
 	*/
-	notifySensorRewatched: z.boolean().optional()
+	notifySensorRewatched: z.boolean().optional(),
+	/**
+	* D735: notify "ignored" when a sensor this arm bypassed really MOVED while armed (its own
+	* change time is after the arm) and set nothing off. Absent = false (logged, not sent). A
+	* re-sync, a recovery from `unavailable` or a duplicate is never announced, switch or not.
+	*/
+	notifySensorIgnored: z.boolean().optional()
 });
 var NcAlarmModeDelaysListSchema = z.array(NcAlarmModeDelaysSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
 /**
@@ -21879,7 +22044,9 @@ var NcAlarmModeDelaysEditSchema = z.object({
 	/** D706: set the switch, or `null` to clear it (back to the default, false). */
 	notifyDuringEntryDelay: z.boolean().nullable().optional(),
 	/** D706: set the switch, or `null` to clear it (back to the default, false). */
-	notifySensorRewatched: z.boolean().nullable().optional()
+	notifySensorRewatched: z.boolean().nullable().optional(),
+	/** D735: set the switch, or `null` to clear it (back to the default, false). */
+	notifySensorIgnored: z.boolean().nullable().optional()
 });
 var NcAlarmModeDelaysEditListSchema = z.array(NcAlarmModeDelaysEditSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
 /** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
@@ -31715,50 +31882,6 @@ var videoclipsCapability = {
 		})
 	}
 };
-/** The central link domain the viewer app claims (Universal Links / App Links). */
-var CAMSTACK_APP_LINK_ORIGIN = "https://camstack.zentik.app";
-/**
-* Reduce a base URL to the bare origin the central page accepts as `hub=`,
-* or `null` when it cannot be one: not http(s), carries credentials, or does
-* not parse. A path/query/fragment is dropped — the central page mounts the
-* viewer under the origin itself.
-*/
-function toAppLinkHubOrigin(baseUrl) {
-	let parsed;
-	try {
-		parsed = new URL(baseUrl);
-	} catch {
-		return null;
-	}
-	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
-	if (parsed.username !== "" || parsed.password !== "") return null;
-	if (parsed.hostname === "") return null;
-	return parsed.origin;
-}
-/**
-* The hub address an app link carries as `hub=`, chosen from the hub's OWN
-* advertised palette so it always agrees with what the Network page lists:
-* the public tunnel first, then the mesh (Tailscale MagicDNS) — HTTPS only,
-* because the app and the hosted viewer reach it from off the LAN. `null`
-* when the hub advertises neither.
-*/
-function pickAppLinkHub(endpoints) {
-	const rank = (e) => {
-		if (e.kind !== "public" || !e.baseUrl.startsWith("https://")) return null;
-		if (e.interfaceKind === "public") return 0;
-		if (e.interfaceKind === "vpn") return 1;
-		return null;
-	};
-	return endpoints.flatMap((e) => {
-		const r = rank(e);
-		const origin = toAppLinkHubOrigin(e.baseUrl);
-		return r === null || origin === null ? [] : [{
-			r,
-			p: e.priority,
-			origin
-		}];
-	}).toSorted((a, b) => a.r - b.r || a.p - b.p)[0]?.origin ?? null;
-}
 /**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
@@ -32234,6 +32357,35 @@ var webrtcSessionCapability = {
 			alive: z.boolean()
 		})),
 		/**
+		* The viewer's downlink probe, for ONE live session (D733).
+		*
+		* The player measures `/adaptive-probe` after the session's first decoded
+		* frame (D635). It used to act on the reading itself, by opening a SECOND
+		* session with `hints.downlinkMbps` — every adaptive live open became two
+		* sessions, two ICE + DTLS handshakes and two server pipelines. It now
+		* hands the measurement to the session it already has; the provider picks
+		* the rung exactly as it would from an offer's hints (same viewport
+		* ceiling) and moves the session there — in place when the negotiated
+		* codec carries the new rendition, by the existing re-offer
+		* (`getSessionState.pendingRenegotiation`) when it cannot.
+		*
+		* A MEASUREMENT, never a tier: the client does not choose. A probe only
+		* raises the rung; lowering it stays the ladder's call on delivery.
+		* `held` answers why nothing moved (`not-adaptive`, `pinned`,
+		* `already-there`, `recorded`, …) — a client that gets ANY answer must not
+		* fall back to a reconnect; only a provider that does not know the method
+		* (an older hub) leaves the client its legacy second session.
+		*/
+		applyDownlinkProbe: method(z.object({
+			deviceId: z.number().int().nonnegative(),
+			sessionId: z.string(),
+			downlinkMbps: z.number().nonnegative()
+		}), z.object({
+			outcome: z.enum(["switching", "held"]),
+			tier: CamProfileSchema.nullable(),
+			reason: z.string()
+		}), { kind: "mutation" }),
+		/**
 		* The SERVER's half of the stream-debug overlay, for one live session.
 		*
 		* The client can measure its own transport (`getStats()`); it cannot see
@@ -36517,7 +36669,8 @@ var ConnectionEndpointSchema = z.object({
 		"lan-ipv6",
 		"public",
 		"loopback",
-		"app-link"
+		"app-link",
+		"custom"
 	]),
 	/**
 	* Originating-interface kind — `lan`/`wifi`/`docker`/`vpn`/`other`/
@@ -36586,7 +36739,7 @@ var GetConnectionEndpointsResultSchema = z.object({
 	localPort: AdvertisedLocalPortSchema
 });
 /**
-* The address flagged for notification links. `baseUrl: null` = AUTO, which
+* The address flagged for notification taps (`notificationTaps`). `baseUrl: null` = AUTO, which
 * since D709 is the CamStack app link; `resolved` reports the effective value,
 * so the UI can show it either way.
 */
@@ -36620,13 +36773,12 @@ var ViewerEndpointsSchema = z.object({
 	resolved: z.array(z.string()).readonly()
 });
 /**
-* One audience's hub address (see `hub-address.ts`): the operator's stored
-* override, the address in use, and where it came from.
+* DEPRECATED compatibility shape of `getHubAddresses` (D729 amendment, kept
+* for addons built against it): `cluster` is the `internal` role, `browser`
+* the `publicEndpoint` role; `override` is the flagged address.
 */
 var HubAddressSnapshotSchema = z.object({
-	/** The operator's override, or null for automatic. */
 	override: z.string().nullable(),
-	/** The address in use, or null when nothing qualifies (never loopback). */
 	resolved: z.string().nullable(),
 	source: z.enum([
 		"override",
@@ -36635,11 +36787,63 @@ var HubAddressSnapshotSchema = z.object({
 	])
 });
 var HubAddressesSchema = z.object({
-	/** "Hub address for agents" — agents' bundle/model pulls, LAN devices. */
 	cluster: HubAddressSnapshotSchema,
-	/** "Public address for sign-in links" — e-mail links, OIDC, WebAuthn, OAuth2. */
 	browser: HubAddressSnapshotSchema
 });
+/**
+* What an address is used for (`hub-address.ts`, D734). `appConnections` is
+* many-valued; `notificationTaps`, `publicEndpoint` and `internal` are carried
+* by at most one address.
+*/
+var HubAddressRoleSchema = z.enum(HUB_ADDRESS_ROLES);
+var RoleSourceSchema = z.enum([
+	"flagged",
+	"auto",
+	"none"
+]);
+/** One single-valued role: the flagged address, the one in use, and why. */
+var HubAddressRoleResolutionSchema = z.object({
+	/** The address carrying the flag, or null = automatic. */
+	flagged: z.string().nullable(),
+	/** The address in use, or null when nothing qualifies (never loopback). */
+	resolved: z.string().nullable(),
+	source: RoleSourceSchema
+});
+var HubAppConnectionsResolutionSchema = z.object({
+	/** The addresses flagged `appConnections`, or empty = automatic. */
+	flagged: z.array(z.string()).readonly(),
+	/** What the apps race right now. */
+	resolved: z.array(z.string()).readonly(),
+	source: RoleSourceSchema
+});
+/**
+* One row of the Network page's Addresses table: a detected endpoint, an
+* operator-entered custom address, or the CamStack app link — flagged the
+* same way. A URL that is both detected and entered is ONE row.
+*/
+var HubAddressRowSchema = ConnectionEndpointSchema.extend({
+	/** In the hub's detected palette right now. */
+	detected: z.boolean(),
+	/** Entered by the operator (removable). */
+	custom: z.boolean(),
+	/** The roles explicitly flagged on this address. */
+	flags: z.array(HubAddressRoleSchema).readonly(),
+	/** The roles this address serves right now — flagged or automatic. */
+	inUse: z.array(HubAddressRoleSchema).readonly(),
+	/** The roles this address may be flagged with. */
+	eligible: z.array(HubAddressRoleSchema).readonly()
+});
+var HubAddressBookSchema = z.object({
+	rows: z.array(HubAddressRowSchema).readonly(),
+	roles: z.object({
+		appConnections: HubAppConnectionsResolutionSchema,
+		notificationTaps: HubAddressRoleResolutionSchema,
+		internal: HubAddressRoleResolutionSchema,
+		publicEndpoint: HubAddressRoleResolutionSchema
+	}),
+	/** The `hub=` an app link carries (D709), or null. */
+	appLinkHub: z.string().nullable()
+});
 var AllowedAddressesSchema = z.object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -36730,19 +36934,18 @@ var localNetworkCapability = {
 			*  tunnel always emits `https://` regardless. */
 			scheme: z.enum(["http", "https"]).optional(),
 			/** Append the CamStack app link entry (`kind: 'app-link'`, D709) —
-			*  an address notification links can be flagged with, not a hub
+			*  an address notification taps can be flagged with, not a hub
 			*  route. Default `false`: racers and rankers never see it. */
 			includeAppLink: z.boolean().optional()
 		}), GetConnectionEndpointsResultSchema),
 		/**
-		* The address notification links are flagged with. `baseUrl: null` means
-		* AUTO, which is the CamStack app link (D709): viewer taps go through
-		* `https://camstack.zentik.app/…?hub=<appLinkHub>` and open the app. Any
-		* hub address the palette lists can be flagged instead; then viewer taps,
-		* attachment links and action buttons all use it. Signed media and
-		* buttons never use the app link — with it flagged (or AUTO) they keep
-		* the ranked hub ladder (a configured origin, a connected tunnel, then
-		* the LAN), never loopback.
+		* The `notificationTaps` role (D734): where TAPPING a notification opens.
+		* `baseUrl: null` means AUTO, which is the CamStack app link (D709): taps
+		* go through `https://camstack.zentik.app/…?hub=<appLinkHub>` and open the
+		* app. Any hub address the palette lists can be flagged instead; then a
+		* tap opens that address. Only the tap: action buttons, attachment /
+		* media links and admin links follow the `publicEndpoint` role
+		* (`getAddresses().roles.publicEndpoint`), never this one.
 		*
 		* Why an explicit marker: the automatic ranking cannot know which of
 		* several reachable addresses the RECIPIENT can actually open. A link is
@@ -36752,45 +36955,79 @@ var localNetworkCapability = {
 		*/
 		getNotificationEndpoint: method(z.void(), NotificationEndpointSchema),
 		/**
-		* Mark which endpoint notification artifacts use. `baseUrl: null` restores
-		* AUTO. The value is stored verbatim (not an index into the candidate
-		* list): interfaces come and go, and an index would silently re-point at a
-		* different address after a reboot.
+		* @deprecated Use `setAddressRole({ role: 'notificationTaps', … })`. It
+		* writes the same `notificationTaps` flag, with the same validation. `baseUrl: null` restores automatic; an
+		* address that is not detected becomes a custom address.
 		*/
 		setNotificationEndpoint: method(z.object({ baseUrl: z.string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }),
 		/**
-		* The endpoints the SDK / viewer races for API access. Empty `baseUrls`
-		* means AUTO: every LAN IPv4 address plus the public tunnel, never IPv6,
-		* never mesh, never loopback. `resolved` is that set (or the operator's
-		* explicit subset) as it stands right now.
+		* The `appConnections` role as shipped apps read it: the flagged addresses
+		* (detected or custom), or empty for AUTO — every LAN IPv4 address plus
+		* the public tunnel, never IPv6, mesh, loopback or a custom address.
+		* `resolved` is the set as it stands right now; the custom ones in it are
+		* also in `getConnectionEndpoints`, which the apps filter by it.
 		*/
 		getViewerEndpoints: method(z.void(), ViewerEndpointsSchema),
 		/**
-		* Replace the viewer race set. Empty `baseUrls` restores AUTO. Stored
-		* verbatim (not indices) so a temporarily-down tunnel is not silently
-		* dropped from the operator's choice.
+		* @deprecated Use `setAddressRole({ role: 'appConnections', … })`. It
+		* replaces the same `appConnections` flags.
+		* Empty `baseUrls` restores automatic.
 		*/
 		setViewerEndpoints: method(z.object({ baseUrls: z.array(z.string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }),
 		/**
-		* The hub's address for each audience — agents (`cluster`) and sign-in
-		* links (`browser`) — as every consumer must read it: the operator's
-		* override when set, else the automatic pick from this cap's palette,
-		* never loopback. The ONE answer to "at which address is this hub
-		* reached?"; there is no environment variable for it.
+		* The Network page's Addresses table and every role's answer — the ONE
+		* reading of "which address is this hub reached at, for what": detected
+		* endpoints and custom addresses with their role flags, and per role the
+		* flagged address, the one in use and whether it is automatic. Agent
+		* deliveries and LAN devices read `roles.internal`; sign-in, OAuth2 and
+		* the notification centre's buttons / media / admin links read
+		* `roles.publicEndpoint`; nothing ranks the palette itself. `scheme` is
+		* the one the caller shows LAN rows in (as `getConnectionEndpoints`);
+		* `internal` and `publicEndpoint` are always resolved over the HTTPS
+		* palette.
 		*/
-		getHubAddresses: method(z.void(), HubAddressesSchema),
+		getAddresses: method(z.object({ scheme: z.enum(["http", "https"]).optional() }).optional(), HubAddressBookSchema),
 		/**
-		* Set or clear (`baseUrl: null`) one audience's override. Validated: an
-		* http(s) origin with a host, no credentials, no path, never loopback —
-		* an invalid value is refused with the reason, nothing is stored.
+		* Add a custom address. Validated: an http(s) origin with a host, no
+		* credentials, no path, never loopback — an invalid one is refused with
+		* the reason and nothing is stored. Adding an address that already exists
+		* only updates its label.
 		*/
-		setHubAddress: method(z.object({
-			audience: z.enum(["cluster", "browser"]),
-			baseUrl: z.string().nullable()
-		}), HubAddressesSchema, {
+		addCustomAddress: method(z.object({
+			baseUrl: z.string(),
+			label: z.string().max(80)
+		}), HubAddressBookSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/** Remove a custom address. Its role flags go with it (those roles turn automatic). */
+		removeCustomAddress: method(z.object({ baseUrl: z.string() }), HubAddressBookSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Flag (`enabled: true`) or unflag an address for a role. For a
+		* single-valued role, flagging moves the flag off every other address.
+		* `baseUrl: null` returns the role to automatic. The address must be a row
+		* of the table (detected, custom, or the app link for `notificationTaps`);
+		* `publicEndpoint` on a plain-http address is refused unless
+		* `acceptInsecureHttp`, and never takes the app link.
+		*/
+		setAddressRole: method(z.object({
+			role: HubAddressRoleSchema,
+			baseUrl: z.string().nullable(),
+			enabled: z.boolean(),
+			acceptInsecureHttp: z.boolean().optional()
+		}), HubAddressBookSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* @deprecated Read `getAddresses().roles.internal` / `.publicEndpoint`.
+		* Kept so an addon built against the D729 amendment keeps resolving:
+		* `cluster` = the `internal` role, `browser` = the `publicEndpoint` role.
+		*/
+		getHubAddresses: method(z.void(), HubAddressesSchema),
 		/**
 		* Read the operator's allowlist. Empty = "auto" (no filter). Used
 		* by the admin UI's address selector to seed its checkbox state.
@@ -49886,12 +50123,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.addCustomAddress": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.downloadCa": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getAddresses": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -49946,6 +50195,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.removeCustomAddress": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
@@ -49958,13 +50213,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"localNetwork.setAllowedAddresses": {
+	"localNetwork.setAddressRole": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"localNetwork.setHubAddress": {
+	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
@@ -54218,6 +54473,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"webrtcSession.applyDownlinkProbe": {
+		capName: "webrtc-session",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"webrtcSession.closeSession": {
 		capName: "webrtc-session",
 		capScope: "device",
@@ -58395,6 +58656,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"webrtcSession.applyDownlinkProbe": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"webrtcSession.closeSession": [{
 		name: "deviceId",
 		form: "single",
@@ -59998,4 +60264,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { calendarsCapability as $, errMsg as $n, motionCapability as $t, MOTION_CLOSE_AFTER_MS as A, streamQualityLabel as An, filesystemBrowseCapability as At, StorageLocationTypeSchema as B, cloneStatefulExpressionMemory as Bn, legacyAutoLinkIds as Bt, FieldClaimModeSchema as C, siteZoneKey as Cn, sleep as Cr, enumerateItemArrayFields as Ct, LocationIconIdSchema as D, storageOccupancyCapability as Dn, expandContainer as Dt, LegacyStorageLocationDefaultSchema as E, storageMigrationCapability as En, evictionPolicyOfLocation as Et, STORAGE_ACCESS_FALLBACK as F, vectorIndexDimConflictError as Fn, isCollectionArrayMethod as Ft, addonWidgetsCapability as G, compositionSliceKey as Gn, logDestinationCapability as Gt, UserRecordSchema as H, composedDeviceStableId as Hn, lifecycleJobSchema as Ht, STREAM_PROFILE_META as I, vectorStoreCapability as In, isLocationEnabled as It, backupCapability as J, disarmRoseMemory as Jn, mayReadLocation as Jt, alertsCapability as K, compositionSourceKey as Kn, logLevelAtMost as Kt, ScopedTokenSchema as L, withLocationMode as Ln, isObjectInput as Lt, REDACTED_SECRET as M, validateComposition as Mn, formatMinutes as Mt, RUNTIME_DEFAULTS as N, validateHubAddressOverride as Nn, gbToBytes as Nt, METHOD_ACCESS_MAP as O, storageProviderCapability as On, expressionContainsBuiltinCall as Ot, RecordingStatusSchema as P, vectorDimFromBase64 as Pn, isArrayOutputSchema as Pt, buildStreamParamsConfigSchema as Q, DeviceType as Qn, modeMayWrite as Qt, StorageCleanupJobSchema as R, COMPOSER_ADDON_ID as Rn, isVoidInput as Rt, FIRST_LEVEL_MACRO_CLASSES as S, settingsStoreCapability as Sn, scopeKey as Sr, enumerateInferenceDevices as St, LOG_LEVEL_RANK as T, storageCapability as Tn, EventCategory as Tr, evaluateCompositionField as Tt, addonPagesCapability as U, compositionFeatureEnabled as Un, localNetworkCapability as Ut, StorageMigrationJobSchema as V, composedDeviceRef as Vn, legacyModeOf as Vt, addonSettingsCapability as W, compositionItemFieldPath as Wn, locationIconKey as Wt, batteryCapability as X, DeviceFeature as Xn, memoizePinnedFfmpeg as Xt, bareAddonId as Y, toExpressionValue as Yn, mayWriteToLocation as Yt, buildCapabilityLookup as Z, DeviceRole as Zn, metricsProviderCapability as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, resolveMethodAuth as _n, nodePin as _r, describeComposableCaps as _t, BatteryStatusSchema as a, pickAppLinkHub as an, ReadinessTimeoutError as ar, coreBlockAddonId as at, DeclaredDevices as b, scopesAllowDeviceCap as bn, readinessKey as br, deviceStateCapability as bt, CAP_NAMES_WITH_STATUS as c, procedureAuthKey as cn, asNumber as cr, coreBlockSourceKind as ct, CORE_BLOCKS_ADDON_ID as d, replacedFieldKeys as dn, emitDownForOwnedCaps as dr, dataStoreProviderCapability as dt, normalizeCoreBlockWrite as en, BaseAddon as er, cameraGridLayoutCapability as et, CORE_BLOCK_ADDON_PREFIX as f, resolveBucketMs as fn, emitReadiness as fr, databaseSnapshotCapability as ft, DATABASE_SNAPSHOT_SUFFIX as g, resolveLocationMode as gn, isEvent as gr, deriveBatteryPresence as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, resolveHubAddress as hn, isDeviceConfigCap as hr, defineExtensionSlotProvider as ht, BaseDevice as i, parseStreamParamsFormPatch as in, ReadinessRegistry as ir, compositionSourceRefs as it, RECORDING_SOURCE_CAMSTACK_ADDON as j, userManagementCapability as jn, foldSnapshotByFunction as jt, MINUTES_PER_DAY as k, streamCatalogCapability as kn, extractNestedAddonId as kt, COMPOSED_ITEM_FIXED_FIELDS as l, ptzAutotrackCapability as ln, asString$1 as lr, coreBlocksCapability as lt, CoreBlockSchema as m, resolveCoreBlockFiles as mn, hydrateSchema as mr, decodeVectorBase64 as mt, AlertSchema as n, objectInputDeclaresAddonId as nn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as nr, composerCapability as nt, CAMERA_SWITCH_ORDER as o, planComposition as on, WELL_KNOWN_TAB_MAP as or, coreBlockComposition as ot, CalendarPreferencesSchema as p, resolveCoreBlockEntry as pn, expandCapMethods as pr, declarationOwnerNodeId as pt, authProviderCapability as q, createStatefulExpressionMemory as qn, looseSchema as qt, ApiKeyRecordSchema as r, objectInputDeclaresRequiredDeviceId as rn, DEVICE_STATUS_METHOD as rr, compositionFieldKey as rt, CAMSTACK_APP_LINK_ORIGIN as s, platformProbeCapability as sn, asJsonObject as sr, coreBlockIdFromAddonId as st, ALL_CAPABILITY_DEFINITIONS as t, normalizeUnit as tn, DATAPLANE_SECRET_HEADER as tr, collectSecretConfigKeys as tt, COMPOSER_RUNNER_ID as u, reducePoints as un, createEvent as ur, createDeviceExtensionProvider as ut, DAY_NAMES as v, runtimeStatePolicyFor as vn, parseJsonObject as vr, deviceExtensionCapability as vt, FieldClaimSchema as w, snapshotCapability as wn, toNodeId as wr, enumerateSchemaFields as wt, DeviceStatusSchema as x, scoreRuntimes as xn, resolveCapMount as xr, deviceStatusCapability as xt, DERIVED_CAMERA_SILENCED_CAP_NAMES as y, scopesAllowAddon as yn, parseJsonUnknown as yr, deviceManagerCapability as yt, StorageLocationModeSchema as z, buildFfmpegArgs as zn, kebabToCamel as zt };
+export { calendarsCapability as $, disarmRoseMemory as $n, memoizePinnedFfmpeg as $t, MOTION_CLOSE_AFTER_MS as A, storageCapability as An, EventCategory as Ar, extractNestedAddonId as At, StorageLocationTypeSchema as B, vectorIndexDimConflictError as Bn, isObjectInput as Bt, FieldClaimModeSchema as C, runtimeStatePolicyFor as Cn, parseJsonObject as Cr, enumerateInferenceDevices as Ct, LocationIconIdSchema as D, settingsStoreCapability as Dn, scopeKey as Dr, evictionPolicyOfLocation as Dt, LegacyStorageLocationDefaultSchema as E, scoreRuntimes as En, resolveCapMount as Er, evaluateCompositionField as Et, STORAGE_ACCESS_FALLBACK as F, streamQualityLabel as Fn, isAppLinkBase as Ft, addonWidgetsCapability as G, cloneStatefulExpressionMemory as Gn, lifecycleJobSchema as Gt, UserRecordSchema as H, withLocationMode as Hn, kebabToCamel as Ht, STREAM_PROFILE_META as I, userManagementCapability as In, isArrayOutputSchema as It, backupCapability as J, compositionFeatureEnabled as Jn, logDestinationCapability as Jt, alertsCapability as K, composedDeviceRef as Kn, localNetworkCapability as Kt, ScopedTokenSchema as L, validateComposition as Ln, isCollectionArrayMethod as Lt, REDACTED_SECRET as M, storageOccupancyCapability as Mn, foldSnapshotByFunction as Mt, RUNTIME_DEFAULTS as N, storageProviderCapability as Nn, formatMinutes as Nt, METHOD_ACCESS_MAP as O, siteZoneKey as On, sleep as Or, expandContainer as Ot, RecordingStatusSchema as P, streamCatalogCapability as Pn, gbToBytes as Pt, buildStreamParamsConfigSchema as Q, createStatefulExpressionMemory as Qn, mayWriteToLocation as Qt, StorageCleanupJobSchema as R, validateCustomAddress as Rn, isDefaultAppConnectionEndpoint as Rt, FIRST_LEVEL_MACRO_CLASSES as S, resolveNotificationTapAddress as Sn, nodePin as Sr, deviceStatusCapability as St, LOG_LEVEL_RANK as T, scopesAllowDeviceCap as Tn, readinessKey as Tr, enumerateSchemaFields as Tt, addonPagesCapability as U, COMPOSER_ADDON_ID as Un, legacyAutoLinkIds as Ut, StorageMigrationJobSchema as V, vectorStoreCapability as Vn, isVoidInput as Vt, addonSettingsCapability as W, buildFfmpegArgs as Wn, legacyModeOf as Wt, batteryCapability as X, compositionSliceKey as Xn, looseSchema as Xt, bareAddonId as Y, compositionItemFieldPath as Yn, logLevelAtMost as Yt, buildCapabilityLookup as Z, compositionSourceKey as Zn, mayReadLocation as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, resolveCoreBlockEntry as _n, emitReadiness as _r, deriveBatteryPresence as _t, BatteryStatusSchema as a, objectInputDeclaresAddonId as an, BaseAddon as ar, compositionSourceRefs as at, DeclaredDevices as b, resolveLocationMode as bn, isDeviceConfigCap as br, deviceManagerCapability as bt, CAP_NAMES_WITH_STATUS as c, pickAppLinkHub as cn, DEVICE_STATUS_METHOD as cr, coreBlockIdFromAddonId as ct, CORE_BLOCKS_ADDON_ID as d, procedureAuthKey as dn, WELL_KNOWN_TAB_MAP as dr, createDeviceExtensionProvider as dt, metricsProviderCapability as en, toExpressionValue as er, cameraGridLayoutCapability as et, CORE_BLOCK_ADDON_PREFIX as f, ptzAutotrackCapability as fn, asJsonObject as fr, dataStoreProviderCapability as ft, DATABASE_SNAPSHOT_SUFFIX as g, resolveBucketMs as gn, emitDownForOwnedCaps as gr, defineExtensionSlotProvider as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, resolveAppConnections as hn, createEvent as hr, decodeVectorBase64 as ht, BaseDevice as i, normalizeUnit as in, errMsg as ir, compositionFieldKey as it, RECORDING_SOURCE_CAMSTACK_ADDON as j, storageMigrationCapability as jn, filesystemBrowseCapability as jt, MINUTES_PER_DAY as k, snapshotCapability as kn, toNodeId as kr, expressionContainsBuiltinCall as kt, COMPOSED_ITEM_FIXED_FIELDS as l, planComposition as ln, ReadinessRegistry as lr, coreBlockSourceKind as lt, CoreBlockSchema as m, replacedFieldKeys as mn, asString$1 as mr, declarationOwnerNodeId as mt, AlertSchema as n, motionCapability as nn, DeviceRole as nr, collectSecretConfigKeys as nt, CAMERA_SWITCH_ORDER as o, objectInputDeclaresRequiredDeviceId as on, DATAPLANE_SECRET_HEADER as or, coreBlockAddonId as ot, CalendarPreferencesSchema as p, reducePoints as pn, asNumber as pr, databaseSnapshotCapability as pt, authProviderCapability as q, composedDeviceStableId as qn, locationIconKey as qt, ApiKeyRecordSchema as r, normalizeCoreBlockWrite as rn, DeviceType as rr, composerCapability as rt, CAMSTACK_APP_LINK_ORIGIN as s, parseStreamParamsFormPatch as sn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as sr, coreBlockComposition as st, ALL_CAPABILITY_DEFINITIONS as t, modeMayWrite as tn, DeviceFeature as tr, checkRoleAddress as tt, COMPOSER_RUNNER_ID as u, platformProbeCapability as un, ReadinessTimeoutError as ur, coreBlocksCapability as ut, DAY_NAMES as v, resolveCoreBlockFiles as vn, expandCapMethods as vr, describeComposableCaps as vt, FieldClaimSchema as w, scopesAllowAddon as wn, parseJsonUnknown as wr, enumerateItemArrayFields as wt, DeviceStatusSchema as x, resolveMethodAuth as xn, isEvent as xr, deviceStateCapability as xt, DERIVED_CAMERA_SILENCED_CAP_NAMES as y, resolveHubAddressRoles as yn, hydrateSchema as yr, deviceExtensionCapability as yt, StorageLocationModeSchema as z, vectorDimFromBase64 as zn, isLocationEnabled as zt };