@camstack/system 1.2.378 → 1.2.380

package/assets/addon-pages-aggregator/icon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#4f46e5" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <rect x="3" y="3" width="18" height="18" rx="2"/>
+  <path d="M3 9h18"/>
+  <path d="M9 21V9"/>
+</svg>

package/assets/addon-widgets-aggregator/icon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#4f46e5" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <rect x="3" y="3" width="7" height="9" rx="1"/>
+  <rect x="14" y="3" width="7" height="5" rx="1"/>
+  <rect x="14" y="12" width="7" height="9" rx="1"/>
+  <rect x="3" y="16" width="7" height="5" rx="1"/>
+</svg>

package/assets/alert-center/icon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#d97706" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"/>
+  <path d="M12 9v4"/>
+  <path d="M12 17h.01"/>
+</svg>

package/assets/autotrack/icon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#7c3aed" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <circle cx="12" cy="12" r="7"/>
+  <circle cx="12" cy="12" r="2"/>
+  <path d="M12 2v3M12 19v3M2 12h3M19 12h3"/>
+</svg>

package/assets/backup-orchestrator/icon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#0d9488" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M3 12a9 9 0 1 0 3-6.7L3 8"/>
+  <path d="M3 3v5h5"/>
+  <path d="M12 7v5l3 2"/>
+</svg>

package/assets/calendars/icon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#4f46e5" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <rect x="3" y="4" width="18" height="18" rx="2"/>
+  <path d="M16 2v4M8 2v4M3 10h18"/>
+  <path d="M8 14h.01M12 14h.01M16 14h.01M8 18h.01M12 18h.01"/>
+</svg>

package/assets/camera-grid/icon.svg

@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#7c3aed" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <rect x="2" y="3" width="9" height="8" rx="1.5"/>
+  <rect x="13" y="3" width="9" height="8" rx="1.5"/>
+  <rect x="2" y="13" width="9" height="8" rx="1.5"/>
+  <rect x="13" y="13" width="9" height="8" rx="1.5"/>
+  <circle cx="6.5" cy="7" r="1.4" fill="#7c3aed" stroke="none"/>
+  <circle cx="17.5" cy="7" r="1.4" fill="#7c3aed" stroke="none"/>
+  <circle cx="6.5" cy="17" r="1.4" fill="#7c3aed" stroke="none"/>
+  <circle cx="17.5" cy="17" r="1.4" fill="#7c3aed" stroke="none"/>
+</svg>

package/assets/composer/icon.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#ea580c" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <rect x="2" y="3" width="7" height="7" rx="1"/>
+  <rect x="2" y="14" width="7" height="7" rx="1"/>
+  <rect x="15" y="8.5" width="7" height="7" rx="1"/>
+  <path d="M9 6.5h2.5a2 2 0 0 1 2 2V12H15"/>
+  <path d="M9 17.5h2.5a2 2 0 0 0 2-2V12"/>
+</svg>

package/assets/console-logging/icon.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#64748b" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="m4 17 6-6-6-6"/>
+  <path d="M12 19h8"/>
+</svg>

package/assets/core-blocks/icon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#ea580c" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <rect x="2" y="14" width="9" height="7" rx="1"/>
+  <rect x="13" y="14" width="9" height="7" rx="1"/>
+  <rect x="7.5" y="5" width="9" height="7" rx="1"/>
+  <path d="M10.5 5V3M13.5 5V3"/>
+</svg>

package/assets/device-manager/icon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#4f46e5" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <rect x="2" y="4" width="14" height="10" rx="2"/>
+  <path d="M6 18h6"/>
+  <path d="M9 14v4"/>
+  <rect x="18" y="8" width="4" height="12" rx="1"/>
+</svg>

package/assets/filesystem-storage/icon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#0d9488" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M22 12H2"/>
+  <path d="M5.45 5.11 2 12v6a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2v-6l-3.45-6.89A2 2 0 0 0 16.76 4H7.24a2 2 0 0 0-1.79 1.11z"/>
+  <path d="M6 16h.01"/>
+  <path d="M10 16h.01"/>
+</svg>

package/assets/hub-forwarder/icon.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#64748b" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M3 7h7"/>
+  <path d="M3 12h5"/>
+  <path d="M3 17h9"/>
+  <path d="m14 10 7-7"/>
+  <path d="M15 3h6v6"/>
+</svg>

package/assets/keychain/icon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#0d9488" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <circle cx="7.5" cy="15.5" r="4.5"/>
+  <path d="M10.7 12.3 21 2"/>
+  <path d="m15.5 7.5 3 3"/>
+  <path d="m18 5 2.5 2.5"/>
+</svg>

package/assets/liveness-monitor/icon.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#d97706" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M19 14c1.49-1.46 3-3.21 3-5.5A5.5 5.5 0 0 0 16.5 3c-1.76 0-3 .5-4.5 2-1.5-1.5-2.74-2-4.5-2A5.5 5.5 0 0 0 2 8.5c0 2.3 1.5 4.05 3 5.5l7 7z"/>
+  <path d="M3.22 12H9.5l.5-1 2 4.5 2-7 1.5 3.5h5.27"/>
+</svg>

package/assets/local-auth/icon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#e11d48" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <rect x="4" y="11" width="16" height="10" rx="2"/>
+  <path d="M8 11V7a4 4 0 0 1 8 0v4"/>
+  <path d="M12 15v2"/>
+</svg>

package/assets/local-network/icon.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#2563eb" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <rect x="9" y="2" width="6" height="6" rx="1"/>
+  <rect x="2" y="16" width="6" height="6" rx="1"/>
+  <rect x="16" y="16" width="6" height="6" rx="1"/>
+  <path d="M5 16v-3a1 1 0 0 1 1-1h12a1 1 0 0 1 1 1v3"/>
+  <path d="M12 12V8"/>
+</svg>

package/assets/loki-logging/icon.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#64748b" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M3 6h11"/>
+  <path d="M3 12h7"/>
+  <path d="M3 18h11"/>
+  <path d="m17 8 4 4-4 4"/>
+  <path d="M21 12h-7"/>
+</svg>

package/assets/metrics-native/icon.svg

@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#d97706" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M22 12h-4l-3 9L9 3l-3 9H2"/>
+</svg>

package/assets/platform-probe/icon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#d97706" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <rect x="5" y="5" width="14" height="14" rx="2"/>
+  <rect x="9" y="9" width="6" height="6" rx="1"/>
+  <path d="M9 2v3M15 2v3M9 19v3M15 19v3M2 9h3M2 15h3M19 9h3M19 15h3"/>
+</svg>

package/assets/remote-access-orchestrator/icon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#2563eb" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <circle cx="12" cy="12" r="10"/>
+  <path d="M2 12h20"/>
+  <path d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z"/>
+</svg>

package/assets/snapshot/icon.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#7c3aed" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M14.5 4h-5L7 7H4a2 2 0 0 0-2 2v9a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2h-3z"/>
+  <circle cx="12" cy="13" r="3"/>
+</svg>

package/assets/sqlite-settings/icon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#0d9488" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <ellipse cx="12" cy="5" rx="9" ry="3"/>
+  <path d="M3 5v14a9 3 0 0 0 18 0V5"/>
+  <path d="M3 12a9 3 0 0 0 18 0"/>
+</svg>

package/assets/storage-orchestrator/icon.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#0d9488" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <rect x="2" y="3" width="20" height="8" rx="2"/>
+  <rect x="2" y="13" width="20" height="8" rx="2"/>
+  <path d="M6 7h.01"/>
+  <path d="M6 17h.01"/>
+  <path d="M14 7h4"/>
+  <path d="M14 17h4"/>
+</svg>

package/assets/system-config/icon.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#4f46e5" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M4 21v-7M4 10V3M12 21v-9M12 8V3M20 21v-5M20 12V3"/>
+  <path d="M1 14h6M9 8h6M17 16h6"/>
+</svg>

package/assets/winston-logging/icon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#64748b" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/>
+  <path d="M14 2v6h6"/>
+  <path d="M8 13h8"/>
+  <path d="M8 17h5"/>
+</svg>

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-C9lmrWFT.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-CZeRUgYF.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { Ft as installManifestNativeDeps, H as createUdsLoggerWithControl, It as resolveAddonClass, St as validateProviderRegistrations, U as LocalChildClient, _n as startRunnerHeapWatch, _t as getWorkerNativeCapProvider, bt as setWorkerNativeCapsChangeListener, f as installManifestSystemDeps, g as createUdsAddonContext, i as killOwnRunnerGroupAfterParentLoss, in as RUNNER_RSS_BUDGET_ENV, kn as emitHeapDiagnosticReport, n as createChildCapDispatch, p as installManifestPythonDeps, u as startRunnerParentDeathWatchdog, vt as getWorkerNativeCapSnapshot } from "./child-cap-dispatch-DpHovtQd.mjs";
+import { Ft as installManifestNativeDeps, H as createUdsLoggerWithControl, It as resolveAddonClass, St as validateProviderRegistrations, U as LocalChildClient, _n as startRunnerHeapWatch, _t as getWorkerNativeCapProvider, bt as setWorkerNativeCapsChangeListener, f as installManifestSystemDeps, g as createUdsAddonContext, i as killOwnRunnerGroupAfterParentLoss, in as RUNNER_RSS_BUDGET_ENV, kn as emitHeapDiagnosticReport, n as createChildCapDispatch, p as installManifestPythonDeps, u as startRunnerParentDeathWatchdog, vt as getWorkerNativeCapSnapshot } from "./child-cap-dispatch-CpjohToR.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/addon-utils.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-Cek0wNdY.js");
-const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CbSmCWkp.js");
+const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-mk6WGxir.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 const require_snapshot_courtesy = require("./snapshot-courtesy-D_C5-nC0.js");
 exports.COURTESY_DEFAULT_WIDTH = require_snapshot_courtesy.COURTESY_DEFAULT_WIDTH;

package/dist/addon-utils.mjs

@@ -1,4 +1,4 @@
-import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-D8rqSWfW.mjs";
+import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-anUH2IE1.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg, t as COURTESY_DEFAULT_WIDTH } from "./snapshot-courtesy-CyFs1M3I.mjs";
 export { COURTESY_DEFAULT_WIDTH, CustomActionRegistry, ModelDownloadHttpError, ModelDownloadService, STALL_REPORT_MS, STALL_TICK_MS, adoptModelRevisions, attributeStall, collectModelFiles, contentTypeFor, courtesyCacheKey, createFileDataPlaneHandler, deleteModelFromDisk, downloadFile, ensureModel, getModelFilePath, isModelDownloadHttpError, isModelDownloaded, parseRangeHeader, renderCourtesyJpeg, renderCourtesyOverlayJpeg, resolveFormatRevision, startEventLoopStallMonitor };

package/dist/auth/auth-manager.d.ts

@@ -1,5 +1,6 @@
 import { IScopedLogger, TokenPayload, SsoBridgeClaimsSchema } from '@camstack/types';
 import { z } from 'zod';
+import { JwtSigningKeySource } from './jwt-signing-key.js';
 export type { TokenPayload };
 export type AuthConfigReader = {
     /**
@@ -13,7 +14,7 @@ export type AuthConfigReader = {
 };
 export declare class AuthManager {
     private readonly config;
-    private readonly jwtSecret;
+    private readonly signingKey;
     private readonly logger;
     /**
      * Offending `auth.tokenExpiry` values already reported by this instance.
@@ -25,7 +26,14 @@ export declare class AuthManager {
      * rest resolve silently to the same default until the value changes.
      */
     private readonly reportedInvalidExpiries;
-    constructor(config: AuthConfigReader, logger?: IScopedLogger);
+    /**
+     * @param signingKey where the session signing key comes from — the process
+     *   slot `local-auth` fills from the keychain (D797). Never config, never
+     *   env; read on every mint and verify, and it THROWS while unavailable.
+     */
+    constructor(config: AuthConfigReader, logger?: IScopedLogger, signingKey?: JwtSigningKeySource);
+    /** The current signing key; throws `JwtSigningKeyUnavailableError` while there is none. */
+    private get jwtSecret();
     signToken(payload: Omit<TokenPayload, 'iat' | 'exp'>): string;
     /**
      * The operator's `auth.tokenExpiry`, or `undefined` → DEFAULT_TOKEN_EXPIRY.

package/dist/auth/jwt-signing-key.d.ts

@@ -0,0 +1,42 @@
+import { SecretsAccess } from '@camstack/types';
+/** The keychain owner of every system-held secret. */
+export declare const SYSTEM_SECRET_OWNER = "system";
+/** `secret://system/global/jwtSigningKey`. */
+export declare const JWT_SIGNING_KEY_REF: string;
+export type JwtSigningKeyState = {
+    readonly state: 'ready';
+    readonly key: string;
+} | {
+    readonly state: 'unavailable';
+    readonly reason: string;
+};
+/** Sessions cannot be minted or verified: the signing key is not loaded. */
+export declare class JwtSigningKeyUnavailableError extends Error {
+    readonly reason: string;
+    constructor(reason: string);
+}
+/** Where an `AuthManager` gets its key. `current()` throws while there is none. */
+export interface JwtSigningKeySource {
+    current(): string;
+}
+/** Register the loaded (or unloadable) key. Called by the hub's `local-auth`. */
+export declare function setProcessJwtSigningKey(state: JwtSigningKeyState): void;
+/** Forget the key (tests, shutdown). */
+export declare function clearProcessJwtSigningKey(): void;
+export declare function getProcessJwtSigningKeyState(): JwtSigningKeyState;
+/** The process slot — the default source of every `AuthManager`. */
+export declare const processJwtSigningKey: JwtSigningKeySource;
+/** A fixed key — tests, and nothing else. */
+export declare function staticJwtSigningKey(key: string): JwtSigningKeySource;
+/** 32 random bytes, hex. */
+export declare function generateJwtSigningKey(): string;
+export interface LoadJwtSigningKeyDeps {
+    /** A keychain handle acting for owner `system`. */
+    readonly secrets: SecretsAccess;
+    readonly generate?: () => string;
+}
+/**
+ * Read the key from the keychain; generate and store one ONLY when the
+ * keychain answers that none exists. Never throws.
+ */
+export declare function loadJwtSigningKey(deps: LoadJwtSigningKeyDeps): Promise<JwtSigningKeyState>;

package/dist/auth/user-manager.d.ts

@@ -10,14 +10,20 @@ interface CreateUserInput {
     scopes?: TokenScope[];
 }
 type UpdatableUserFields = Partial<Pick<UserRecord, 'isAdmin' | 'allowedProviders' | 'allowedDevices' | 'scopes'>>;
+/**
+ * The account a fresh hub seeds on its first boot (D797). Not configurable —
+ * no env variable, no config.yaml key: the first sign-in with this password
+ * forces a change (admin-ui `mustChangePassword`), and an existing user is
+ * never overwritten (D728).
+ */
+export declare const FIRST_BOOT_ADMIN_USERNAME = "admin";
+export declare const FIRST_BOOT_ADMIN_PASSWORD = "changeme";
 export interface EnsureAdminOptions {
     /** The operator's explicit, one-shot recovery request. Never a default. */
     readonly resetPassword?: boolean;
 }
 /** What `ensureAdminExists` did — every branch is named so the caller can log it. */
 export type AdminSeedOutcome = {
-    readonly kind: 'not-configured';
-} | {
     readonly kind: 'seeded';
     readonly username: string;
 } | {
@@ -33,15 +39,10 @@ export type AdminSeedOutcome = {
 export interface UserStorageAccess {
     getStore(): SettingsStoreClient;
 }
-export interface UserConfigReader {
-    /** See `AuthConfigReader.get` — a reader answers only the paths it resolved. */
-    get<T>(path: string): T | undefined;
-}
 export declare class UserManager {
     private readonly storageAccess;
     private readonly auth;
-    private readonly config;
-    constructor(storageAccess: UserStorageAccess, auth: AuthManager, config: UserConfigReader);
+    constructor(storageAccess: UserStorageAccess, auth: AuthManager);
     private get store();
     create(input: CreateUserInput): Promise<UserRecord>;
     findByUsername(username: string): Promise<UserRecord | null>;
@@ -52,20 +53,19 @@ export declare class UserManager {
     delete(id: string): Promise<void>;
     resetPassword(id: string, newPassword: string): Promise<void>;
     /**
-     * Seed the configured admin (`auth.adminUsername` / `auth.adminPassword`,
-     * i.e. `CAMSTACK_ADMIN_USER` / `CAMSTACK_ADMIN_PASS`) — on FIRST boot only.
+     * Seed {@link FIRST_BOOT_ADMIN_USERNAME} / {@link FIRST_BOOT_ADMIN_PASSWORD}
+     * — on FIRST boot only, i.e. when no admin account exists.
      *
-     * The configured password is a seed, never an authority. Once any admin
-     * exists, this never writes a password: the operator's own change in the
-     * admin UI is the truth from then on. This method used to compare the stored
-     * hash with the configured password on every boot and rewrite it when they
-     * differed, so a password changed in the UI went back to the configured one
-     * (`changeme` on a Mac hub and on any container without `CAMSTACK_ADMIN_PASS`)
-     * at the next restart.
+     * The seed is never an authority. Once any admin exists, this never writes a
+     * password: the operator's own change in the admin UI is the truth from then
+     * on (D728). This method once compared the stored hash with a configured
+     * password on every boot and rewrote it when they differed, so a password
+     * changed in the UI went back at the next restart.
      *
      * `resetPassword: true` is the one explicit exception — the operator's
-     * one-shot recovery request (see `admin-password-reset.ts`): the configured
-     * admin's password is set back to the configured one.
+     * one-shot recovery request (`RESET_ADMIN_PASSWORD`, see
+     * `admin-account-boot.ts`): the `admin` user's password goes back to
+     * `changeme`, and the next sign-in forces a change again.
      */
     ensureAdminExists(options?: EnsureAdminOptions): Promise<AdminSeedOutcome>;
     /**

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gr as EventCategory, W as addonPagesCapability, cr as errMsg, lr as BaseAddon } from "../../dist-Bvl5JgNt.mjs";
+import { W as addonPagesCapability, cr as errMsg, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gr as EventCategory, K as addonWidgetsCapability, cr as errMsg, lr as BaseAddon } from "../../dist-Bvl5JgNt.mjs";
+import { K as addonWidgetsCapability, cr as errMsg, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Gr as EventCategory, Sr as createEvent, cr as errMsg, lr as BaseAddon, n as AlertSchema, q as alertsCapability } from "../../dist-Bvl5JgNt.mjs";
+import { Cr as createEvent, cr as errMsg, lr as BaseAddon, n as AlertSchema, q as alertsCapability, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Gr as EventCategory, S as FIRST_LEVEL_MACRO_CLASSES, X as bareAddonId, cr as errMsg, gn as ptzAutotrackCapability, kr as isEvent, lr as BaseAddon } from "../../dist-Bvl5JgNt.mjs";
+import { Ar as isEvent, S as FIRST_LEVEL_MACRO_CLASSES, X as bareAddonId, cr as errMsg, gn as ptzAutotrackCapability, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gr as EventCategory, In as storageOccupancyCapability, Ur as toNodeId, Y as backupCapability, g as DATABASE_SNAPSHOT_SUFFIX, jr as nodePin, lr as BaseAddon, nn as mayWriteToLocation } from "../../dist-Bvl5JgNt.mjs";
+import { Gr as toNodeId, In as storageOccupancyCapability, Mr as nodePin, Y as backupCapability, g as DATABASE_SNAPSHOT_SUFFIX, lr as BaseAddon, nn as mayWriteToLocation, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { et as calendarsCapability, lr as BaseAddon, p as CalendarPreferencesSchema } from "../../dist-Bvl5JgNt.mjs";
+import { et as calendarsCapability, lr as BaseAddon, p as CalendarPreferencesSchema } from "../../dist-B9oFw2jh.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { Dr as hydrateSchema, Gr as EventCategory, Jn as buildFfmpegArgs, M as MOTION_CLOSE_AFTER_MS, Nn as snapshotCapability, Rn as streamCatalogCapability, Sr as createEvent, ar as DeviceFeature, b as DeclaredDevices, cr as errMsg, i as BaseDevice, lr as BaseAddon, mt as declarationOwnerNodeId, on as motionCapability, rn as memoizePinnedFfmpeg, sr as DeviceType, tt as cameraGridLayoutCapability, y as DERIVED_CAMERA_SILENCED_CAP_NAMES } from "../../dist-Bvl5JgNt.mjs";
+import { Cr as createEvent, Jn as buildFfmpegArgs, M as MOTION_CLOSE_AFTER_MS, Nn as snapshotCapability, Or as hydrateSchema, Rn as streamCatalogCapability, ar as DeviceFeature, b as DeclaredDevices, cr as errMsg, i as BaseDevice, lr as BaseAddon, mt as declarationOwnerNodeId, on as motionCapability, qr as EventCategory, rn as memoizePinnedFfmpeg, sr as DeviceType, tt as cameraGridLayoutCapability, y as DERIVED_CAMERA_SILENCED_CAP_NAMES } from "../../dist-B9oFw2jh.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
-const require_composition_sources = require("../../composition-sources-CxhGdtdh.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_composition_sources = require("../../composition-sources-CHvLMrFI.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { $n as compositionItemFieldPath, Et as evaluateCompositionField, Gr as EventCategory, Q as buildCapabilityLookup, Qn as compositionFeatureEnabled, Sr as createEvent, Xn as composedDeviceRef, Yn as cloneStatefulExpressionMemory, Zn as composedDeviceStableId, b as DeclaredDevices, cr as errMsg, er as compositionSliceKey, i as BaseDevice, ir as toExpressionValue, it as compositionFieldKey, kt as expressionContainsBuiltinCall, l as COMPOSED_ITEM_FIXED_FIELDS, lr as BaseAddon, nr as createStatefulExpressionMemory, pn as planComposition, qn as COMPOSER_ADDON_ID, rr as disarmRoseMemory, rt as composerCapability, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey } from "../../dist-Bvl5JgNt.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-BLBd338N.mjs";
+import { $n as compositionItemFieldPath, Cr as createEvent, Et as evaluateCompositionField, Q as buildCapabilityLookup, Qn as compositionFeatureEnabled, Xn as composedDeviceRef, Yn as cloneStatefulExpressionMemory, Zn as composedDeviceStableId, b as DeclaredDevices, cr as errMsg, er as compositionSliceKey, i as BaseDevice, ir as toExpressionValue, it as compositionFieldKey, kt as expressionContainsBuiltinCall, l as COMPOSED_ITEM_FIXED_FIELDS, lr as BaseAddon, nr as createStatefulExpressionMemory, pn as planComposition, qn as COMPOSER_ADDON_ID, qr as EventCategory, rr as disarmRoseMemory, rt as composerCapability, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey } from "../../dist-B9oFw2jh.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-DT_uJwI3.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-Bvl5JgNt.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
-const require_composition_sources = require("../../composition-sources-CxhGdtdh.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_composition_sources = require("../../composition-sources-CHvLMrFI.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { Dr as hydrateSchema, Q as buildCapabilityLookup, Sn as resolveCoreBlockFiles, Vn as validateComposition, Xn as composedDeviceRef, at as compositionSourceRefs, b as DeclaredDevices, cr as errMsg, ct as coreBlockIdFromAddonId, d as CORE_BLOCKS_ADDON_ID, f as CORE_BLOCK_ADDON_PREFIX, lr as BaseAddon, lt as coreBlockSourceKind, m as CoreBlockSchema, ot as coreBlockAddonId, pn as planComposition, sn as normalizeCoreBlockWrite, st as coreBlockComposition, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey, u as COMPOSER_RUNNER_ID, ut as coreBlocksCapability, vn as replacedFieldKeys, vt as describeComposableCaps, xn as resolveCoreBlockEntry } from "../../dist-Bvl5JgNt.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-BLBd338N.mjs";
+import { Or as hydrateSchema, Q as buildCapabilityLookup, Sn as resolveCoreBlockFiles, Vn as validateComposition, Xn as composedDeviceRef, at as compositionSourceRefs, b as DeclaredDevices, cr as errMsg, ct as coreBlockIdFromAddonId, d as CORE_BLOCKS_ADDON_ID, f as CORE_BLOCK_ADDON_PREFIX, lr as BaseAddon, lt as coreBlockSourceKind, m as CoreBlockSchema, ot as coreBlockAddonId, pn as planComposition, sn as normalizeCoreBlockWrite, st as coreBlockComposition, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey, u as COMPOSER_RUNNER_ID, ut as coreBlocksCapability, vn as replacedFieldKeys, vt as describeComposableCaps, xn as resolveCoreBlockEntry } from "../../dist-B9oFw2jh.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-DT_uJwI3.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-gTsZfpmP.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-YOOKLA3v.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");