@camstack/system 1.2.380 → 1.2.381

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as buildStreamParamsConfigSchema, A as MINUTES_PER_DAY, C as FieldClaimModeSchema, Dn as runtimeStatePolicyFor, Hr as secretTreeFromPaths, Kr as transformSecretWrite, Kt as legacyAutoLinkIds, L as STREAM_PROFILE_META, Mn as siteZoneKey, Nt as formatMinutes, O as LocationIconIdSchema, Ot as expandContainer, Sr as collectZodSecretPaths, St as deviceStatusCapability, Tt as enumerateSchemaFields, Wr as sleep$1, Xt as locationIconKey, ar as DeviceFeature, bt as deviceManagerCapability, c as CAP_NAMES_WITH_STATUS, cn as normalizeUnit, cr as errMsg, dn as parseStreamParamsFormPatch, dt as createDeviceExtensionProvider, gr as WELL_KNOWN_TAB_MAP, gt as defineExtensionSlotProvider, kr as isDeviceConfigCap, lr as BaseAddon, o as CAMERA_SWITCH_ORDER, or as DeviceRole, qr as EventCategory, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, v as DAY_NAMES, w as FieldClaimSchema, wt as enumerateItemArrayFields, x as DeviceStatusSchema, xt as deviceStateCapability, yt as deviceExtensionCapability, zr as resolveSecretMarkers } from "../../dist-B9oFw2jh.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-DlZ3VV6x.mjs";
+import { $ as buildStreamParamsConfigSchema, A as MINUTES_PER_DAY, Ar as isDeviceConfigCap, C as FieldClaimModeSchema, Cr as collectZodSecretPaths, Dn as runtimeStatePolicyFor, Fr as isSecretMarkerLike, Jr as sleep$1, Kr as secretTreeFromPaths, Kt as legacyAutoLinkIds, L as STREAM_PROFILE_META, Mn as siteZoneKey, Mr as isKeychainStoredField, Nr as isSecretClear, Nt as formatMinutes, O as LocationIconIdSchema, Ot as expandContainer, Pr as isSecretMarker, Qr as EventCategory, St as deviceStatusCapability, Tt as enumerateSchemaFields, Ur as resolveSecretMarkers, Xr as toSecretFieldView, Xt as locationIconKey, Zr as transformSecretWrite, _r as WELL_KNOWN_TAB_MAP, ar as DeviceFeature, bt as deviceManagerCapability, c as CAP_NAMES_WITH_STATUS, cn as normalizeUnit, cr as errMsg, dn as parseStreamParamsFormPatch, dt as createDeviceExtensionProvider, gr as SECRET_CLEAR, gt as defineExtensionSlotProvider, lr as BaseAddon, o as CAMERA_SWITCH_ORDER, or as DeviceRole, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, v as DAY_NAMES, w as FieldClaimSchema, wt as enumerateItemArrayFields, x as DeviceStatusSchema, xt as deviceStateCapability, yt as deviceExtensionCapability } from "../../dist-BC0GnGeg.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-MCVhxPkJ.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
@@ -1028,6 +1028,105 @@ function mergeAggregates(parts) {
 	return out;
 }
 //#endregion
+//#region src/builtins/device-manager/device-form-secrets.ts
+/**
+* A driver's device-settings form, kept on the keychain side of the wire
+* (D787 / D789 for device forms).
+*
+* A driver hydrates its own form from the config `loadConfig` RESOLVED for it,
+* so a camera password reaches the form as plaintext even though the stored
+* blob holds a keychain marker. This module closes that in ONE place — the
+* device-manager aggregate every device form goes through — for every driver:
+*
+*  - READ ({@link viewStoredSecrets}): a form field whose key names a stored
+*    MARKER (a declared `secretConfigPaths` entry, or a field secret by type)
+*    is handed the marker's VIEW instead of the driver's plaintext. A value
+*    that is still inline plaintext in the blob (not migrated) is left as the
+*    driver hydrated it: there is nothing to reveal it by.
+*  - WRITE ({@link applyDriverFormPatch}): the form sends the view back for an
+*    untouched field and `{ $secretClear: true }` for an explicit clear. The
+*    driver understands neither (its schema wants a string), so a view is
+*    dropped from the driver's patch (KEEP — the driver still holds the
+*    resolved value) and a clear reaches the driver as `''` while the stored
+*    marker is removed at the keychain door. A typed value passes through and
+*    the driver's own persist stores it in the keychain.
+*
+* Top-level keys only: a driver form's field key is its config key for every
+* declared device secret today (`password`, `apiKey`, `localKey`). A nested or
+* per-row path (`connection.password`, `rows[].pin`) is not mapped onto a form
+* field and keeps the driver's hydration.
+*/
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The declared paths that name a top-level config key. */
+function topLevelKeys(paths) {
+	return new Set(paths.filter((p) => p.length > 0 && !p.includes(".") && !p.includes("[")));
+}
+function viewField(field, stored, declared) {
+	if (!isRecord$2(field)) return field;
+	const nested = field["fields"];
+	if (Array.isArray(nested)) return {
+		...field,
+		fields: nested.map((f) => viewField(f, stored, declared))
+	};
+	const tabs = field["tabs"];
+	if (Array.isArray(tabs)) return {
+		...field,
+		tabs: tabs.map((tab) => isRecord$2(tab) && Array.isArray(tab["fields"]) ? {
+			...tab,
+			fields: tab["fields"].map((f) => viewField(f, stored, declared))
+		} : tab)
+	};
+	const key = field["key"];
+	if (typeof key !== "string" || !("value" in field)) return field;
+	const marker = stored[key];
+	if (!isSecretMarker(marker)) return field;
+	const secretByType = isKeychainStoredField(field);
+	if (!secretByType && !declared.has(key)) return field;
+	const type = secretByType ? field["type"] : "password";
+	return {
+		...field,
+		type,
+		value: toSecretFieldView(marker)
+	};
+}
+/**
+* The driver's hydrated sections with every keychain-stored secret replaced
+* by its view. Returns the input unchanged when the blob holds no marker.
+*/
+function viewStoredSecrets(sections, stored, declaredPaths) {
+	if (!Object.values(stored).some(isSecretMarker)) return sections;
+	const declared = topLevelKeys(declaredPaths);
+	return sections.map((section) => ({
+		...section,
+		fields: section.fields.map((f) => viewField(f, stored, declared))
+	}));
+}
+/** Split a device-settings form patch (see the module doc). */
+function splitDriverFormPatch(patch) {
+	const driverPatch = {};
+	const clearKeys = [];
+	for (const [key, value] of Object.entries(patch)) if (isSecretClear(value)) {
+		driverPatch[key] = "";
+		clearKeys.push(key);
+	} else if (!isSecretMarkerLike(value)) driverPatch[key] = value;
+	return {
+		driverPatch,
+		clearKeys
+	};
+}
+/**
+* Apply a device-settings form patch: the driver gets plain values only, then
+* an explicit clear removes the stored secret at the keychain door (after the
+* driver's own persist, whose `''` the door reads as KEEP).
+*/
+async function applyDriverFormPatch(input) {
+	const { driverPatch, clearKeys } = splitDriverFormPatch(input.patch);
+	if (Object.keys(driverPatch).length > 0) await input.applyToDriver(driverPatch);
+	if (clearKeys.length > 0) await input.clearSecrets(clearKeys);
+}
+//#endregion
 //#region src/builtins/device-manager/stale-wrapper-activations.ts
 /**
 * A stored wrapper activation that names a cap with NO wrapper any more.
@@ -3446,6 +3545,25 @@ function refusedLinkedPicks(params) {
 //#endregion
 //#region src/builtins/device-manager/device-aggregation.ts
 /**
+* A driver's hydrated sections as the browser may see them: every secret the
+* keychain stores is its VIEW, never the plaintext the driver was handed by
+* `loadConfig`. An unreadable blob withholds nothing new — the non-admin
+* redaction still runs at the transport — but it is logged.
+*/
+async function driverSectionsWithSecretViews(deps, deviceId, sections) {
+	const door = deps.deviceFormSecrets;
+	if (!door) return sections;
+	try {
+		return viewStoredSecrets(sections, await door.readStored(deviceId), door.declaredPaths(deviceId));
+	} catch (err) {
+		deps.ctx.logger.warn("device form: stored config unreadable — secret views not applied", {
+			tags: { deviceId },
+			meta: { error: errMsg(err) }
+		});
+		return sections;
+	}
+}
+/**
 * One process-wide cache behind every device-details fan-out.
 *
 * Module-level on purpose: the page re-polls every 2.5 s and a per-call cache
@@ -3671,16 +3789,18 @@ async function buildBaseDeviceSection(deps, deviceId) {
 	if (!hubLocal && !nativeOwner) return null;
 	const sections = [];
 	const driverResult = await resolveDriverConfigSchema(deps, deviceId, hubLocal);
-	if (driverResult.status === "ok") for (const section of driverResult.schema.sections) sections.push({
-		id: section.id,
-		title: section.title,
-		tab: section.tab ?? "general",
-		order: section.order ?? 1,
-		fields: [...section.fields],
-		...section.description !== void 0 ? { description: section.description } : {},
-		...section.columns !== void 0 ? { columns: section.columns } : {}
-	});
-	else if (driverResult.status === "unavailable") sections.push({
+	if (driverResult.status === "ok") {
+		const driverSections = await driverSectionsWithSecretViews(deps, deviceId, driverResult.schema.sections);
+		for (const section of driverSections) sections.push({
+			id: section.id,
+			title: section.title,
+			tab: section.tab ?? "general",
+			order: section.order ?? 1,
+			fields: [...section.fields],
+			...section.description !== void 0 ? { description: section.description } : {},
+			...section.columns !== void 0 ? { columns: section.columns } : {}
+		});
+	} else if (driverResult.status === "unavailable") sections.push({
 		id: "driver-settings-unavailable",
 		title: "Driver Settings",
 		tab: "general",
@@ -4074,19 +4194,26 @@ async function applyGroupPatch(deps, deviceId, group) {
 			});
 			throw new Error(`[device-manager] ${retired.join(", ")} can no longer be saved from the settings section — reload the page and use the Extensions section`);
 		}
-		const driverPatch = group.patch;
-		if (Object.keys(driverPatch).length === 0) return;
-		const hubRegistry = deps.ctx.kernel?.deviceRegistry;
-		const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
-		if (found) {
-			await found.device.applySettingsPatch(driverPatch);
-			return;
-		}
-		const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
-		if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
-		await ops.setConfig({
-			deviceId,
-			values: driverPatch
+		await applyDriverFormPatch({
+			patch: group.patch,
+			applyToDriver: async (driverPatch) => {
+				const hubRegistry = deps.ctx.kernel?.deviceRegistry;
+				const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
+				if (found) {
+					await found.device.applySettingsPatch(driverPatch);
+					return;
+				}
+				const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
+				if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
+				await ops.setConfig({
+					deviceId,
+					values: driverPatch
+				});
+			},
+			clearSecrets: async (keys) => {
+				if (!deps.deviceFormSecrets) throw new Error(`[device-manager] cannot clear ${keys.join(", ")}: no keychain door`);
+				await deps.deviceFormSecrets.clear(deviceId, keys);
+			}
 		});
 		return;
 	}
@@ -9712,6 +9839,8 @@ var DeviceManagerAddon = class extends BaseAddon {
 	removalFence = createRemovalFence();
 	/** Declared secret config paths per device, as last registered (D783). */
 	secretConfigPaths = createSecretConfigPathRegistry();
+	/** The keychain side of driver device forms (D789), wired in onInitialize. */
+	deviceFormSecrets;
 	/** The runtime-state mirror, asserted present (constructed in onInitialize). */
 	get stateMirror() {
 		if (!this.stateMirrorImpl) throw new Error("DeviceManagerAddon: state mirror accessed before onInitialize");
@@ -9864,7 +9993,8 @@ var DeviceManagerAddon = class extends BaseAddon {
 			ctx: this.ctx,
 			capabilityRegistry: this.capabilityRegistry,
 			remoteNativeCaps: this.remoteNativeCaps,
-			bindingsDeps: this.bindingsDeps
+			bindingsDeps: this.bindingsDeps,
+			...this.deviceFormSecrets ? { deviceFormSecrets: this.deviceFormSecrets } : {}
 		};
 	}
 	async getDeviceAggregate(deviceId, kind) {
@@ -9960,6 +10090,15 @@ var DeviceManagerAddon = class extends BaseAddon {
 				return provider;
 			}
 		};
+		this.deviceFormSecrets = {
+			readStored: (deviceId) => settings.readDeviceStore(deviceId),
+			declaredPaths: (deviceId) => this.secretConfigPaths.get(deviceId) ?? [],
+			clear: (deviceId, keys) => persistConfig(pctx, {
+				deviceId,
+				data: Object.fromEntries(keys.map((key) => [key, SECRET_CLEAR])),
+				secretConfigPaths: [...new Set([...this.secretConfigPaths.get(deviceId) ?? [], ...keys])]
+			})
+		};
 		try {
 			await runLocationBackfillAtBoot(pctx, bootRows);
 		} catch (err) {

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
-const require_jwt_signing_key = require("../../jwt-signing-key-C2rE3wH6.js");
-const require_cluster_secret = require("../../cluster-secret-Dg0OOOSr.js");
+const require_dist = require("../../dist-BugrtARh.js");
+const require_jwt_signing_key = require("../../jwt-signing-key-CjoZcol8.js");
+const require_cluster_secret = require("../../cluster-secret-BUiG8DCo.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { Dr as formatSecretScope, Gt as keychainCapability, Ir as parseSecretRef, Nr as normalizeSecretOwner, Wt as keychainAdminCapability, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
-import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-Qhde8r82.mjs";
-import { i as CLUSTER_SECRET_SETTINGS_KEY } from "../../cluster-secret-BDue-uJj.mjs";
+import { Br as parseSecretRef, Gt as keychainCapability, Lr as normalizeSecretOwner, Or as formatSecretScope, Qr as EventCategory, Wt as keychainAdminCapability, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
+import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-CsuVKA1W.mjs";
+import { i as CLUSTER_SECRET_SETTINGS_KEY } from "../../cluster-secret-DgJTZ4qY.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as createEvent, F as RecordingStatusSchema, N as RECORDING_SOURCE_CAMSTACK_ADDON, cr as errMsg, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { F as RecordingStatusSchema, N as RECORDING_SOURCE_CAMSTACK_ADDON, Qr as EventCategory, cr as errMsg, lr as BaseAddon, wr as createEvent } from "../../dist-BC0GnGeg.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
-const require_jwt_signing_key = require("../../jwt-signing-key-C2rE3wH6.js");
+const require_dist = require("../../dist-BugrtARh.js");
+const require_jwt_signing_key = require("../../jwt-signing-key-CjoZcol8.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,6 +1,6 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Bn as userManagementCapability, J as authProviderCapability, R as ScopedTokenSchema, U as UserRecordSchema, lr as BaseAddon, r as ApiKeyRecordSchema } from "../../dist-B9oFw2jh.mjs";
-import { a as loadJwtSigningKey, i as getProcessJwtSigningKeyState, o as processJwtSigningKey, s as setProcessJwtSigningKey, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-Qhde8r82.mjs";
+import { Bn as userManagementCapability, J as authProviderCapability, R as ScopedTokenSchema, U as UserRecordSchema, lr as BaseAddon, r as ApiKeyRecordSchema } from "../../dist-BC0GnGeg.mjs";
+import { a as loadJwtSigningKey, i as getProcessJwtSigningKeyState, o as processJwtSigningKey, s as setProcessJwtSigningKey, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-CsuVKA1W.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 const require_tls = require("../../tls-CCMX7MjX.js");
 let zod = require("zod");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Cn as resolveHubAddressRoles, En as resolveNotificationTapAddress, Hn as validateCustomAddress, It as isAppLinkBase, Yt as localNetworkCapability, fn as pickAppLinkHub, lr as BaseAddon, nt as checkRoleAddress, qr as EventCategory, s as CAMSTACK_APP_LINK_ORIGIN, yn as resolveAppConnections, zt as isDefaultAppConnectionEndpoint } from "../../dist-B9oFw2jh.mjs";
+import { Cn as resolveHubAddressRoles, En as resolveNotificationTapAddress, Hn as validateCustomAddress, It as isAppLinkBase, Qr as EventCategory, Yt as localNetworkCapability, fn as pickAppLinkHub, lr as BaseAddon, nt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, yn as resolveAppConnections, zt as isDefaultAppConnectionEndpoint } from "../../dist-BC0GnGeg.mjs";
 import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-CJHogwTl.mjs";
 import { z } from "zod";
 import * as os from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as createEvent, Mt as foldSnapshotByFunction, _n as reducePoints, bn as resolveBucketMs, cr as errMsg, in as metricsProviderCapability, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { Mt as foldSnapshotByFunction, Qr as EventCategory, _n as reducePoints, bn as resolveBucketMs, cr as errMsg, in as metricsProviderCapability, lr as BaseAddon, wr as createEvent } from "../../dist-BC0GnGeg.mjs";
 import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { An as scoreRuntimes, Ct as enumerateInferenceDevices, Tr as emitReadiness, cr as errMsg, lr as BaseAddon, mn as platformProbeCapability, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { An as scoreRuntimes, Ct as enumerateInferenceDevices, Er as emitReadiness, Qr as EventCategory, cr as errMsg, lr as BaseAddon, mn as platformProbeCapability } from "../../dist-BC0GnGeg.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { Qr as EventCategory, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Mr as nodePin, Nn as snapshotCapability, X as bareAddonId, Z as batteryCapability, _t as deriveBatteryPresence, a as BatteryStatusSchema, ar as DeviceFeature, cr as errMsg, lr as BaseAddon, qr as EventCategory, rn as memoizePinnedFfmpeg, sr as DeviceType, zn as streamQualityLabel } from "../../dist-B9oFw2jh.mjs";
+import { Ir as nodePin, Nn as snapshotCapability, Qr as EventCategory, X as bareAddonId, Z as batteryCapability, _t as deriveBatteryPresence, a as BatteryStatusSchema, ar as DeviceFeature, cr as errMsg, lr as BaseAddon, rn as memoizePinnedFfmpeg, sr as DeviceType, zn as streamQualityLabel } from "../../dist-BC0GnGeg.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Ln as storageProviderCapability, jt as filesystemBrowseCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
+import { Ln as storageProviderCapability, jt as filesystemBrowseCapability, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 const require_hub_cap_forward = require("../../hub-cap-forward-COCmYaup.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { B as StorageLocationModeSchema, Bt as isLocationEnabled, D as LegacyStorageLocationDefaultSchema, Dt as evictionPolicyOfLocation, Fn as storageMigrationCapability, H as StorageMigrationJobSchema, Hr as secretTreeFromPaths, Kn as withLocationMode, Kr as transformSecretWrite, Pn as storageCapability, Pr as parseJsonObject, Pt as gbToBytes, V as StorageLocationTypeSchema, an as modeMayWrite, jn as settingsStoreCapability, jr as isSecretMarker, lr as BaseAddon, nn as mayWriteToLocation, pr as REDACTED_SECRET, qr as EventCategory, qt as legacyModeOf, tn as mayReadLocation, wn as resolveLocationMode, xr as collectSecretConfigKeys, z as StorageCleanupJobSchema, zr as resolveSecretMarkers } from "../../dist-B9oFw2jh.mjs";
+import { B as StorageLocationModeSchema, Bt as isLocationEnabled, D as LegacyStorageLocationDefaultSchema, Dt as evictionPolicyOfLocation, Fn as storageMigrationCapability, H as StorageMigrationJobSchema, Kn as withLocationMode, Kr as secretTreeFromPaths, Pn as storageCapability, Pr as isSecretMarker, Pt as gbToBytes, Qr as EventCategory, Rr as parseJsonObject, Sr as collectSecretConfigKeys, Ur as resolveSecretMarkers, V as StorageLocationTypeSchema, Zr as transformSecretWrite, an as modeMayWrite, jn as settingsStoreCapability, lr as BaseAddon, nn as mayWriteToLocation, pr as REDACTED_SECRET, qt as legacyModeOf, tn as mayReadLocation, wn as resolveLocationMode, z as StorageCleanupJobSchema } from "../../dist-BC0GnGeg.mjs";
 import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-CH6_VWVO.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
-const require_cluster_secret = require("../../cluster-secret-Dg0OOOSr.js");
+const require_dist = require("../../dist-BugrtARh.js");
+const require_cluster_secret = require("../../cluster-secret-BUiG8DCo.js");
 //#region src/builtins/system-config/cluster-secret-keeper.ts
 /**
 * Keeps the hub's cluster-secret gate in step with System → Cluster (D797).

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,5 +1,5 @@
-import { Kr as transformSecretWrite, Or as hydrateSchema, Ur as secretTreeFromSchema, cr as errMsg, jr as isSecretMarker, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
-import { d as setProcessClusterSecretGate, l as hashClusterSecret, n as CLUSTER_SECRET_REF } from "../../cluster-secret-BDue-uJj.mjs";
+import { Pr as isSecretMarker, Zr as transformSecretWrite, cr as errMsg, kr as hydrateSchema, lr as BaseAddon, qr as secretTreeFromSchema } from "../../dist-BC0GnGeg.mjs";
+import { d as setProcessClusterSecretGate, l as hashClusterSecret, n as CLUSTER_SECRET_REF } from "../../cluster-secret-DgJTZ4qY.mjs";
 //#region src/builtins/system-config/cluster-secret-keeper.ts
 /**
 * Keeps the hub's cluster-secret gate in step with System → Cluster (D797).

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{child-cap-dispatch-CpjohToR.mjs → child-cap-dispatch-BTe4eKep.mjs}

@@ -1,4 +1,4 @@
-import { Cr as createEvent, Vr as scrubKnownSecrets, en as maskUrlCredentials, qr as EventCategory$1 } from "./dist-B9oFw2jh.mjs";
+import { Gr as scrubKnownSecrets, Qr as EventCategory$1, en as maskUrlCredentials, wr as createEvent } from "./dist-BC0GnGeg.mjs";
 import { a as parseProcStat, i as nodeProcReader } from "./proc-stat-CbC55Kqi.mjs";
 import "./hub-cap-forward-CH6_VWVO.mjs";
 import * as crypto$1 from "node:crypto";

package/dist/{child-cap-dispatch-CZeRUgYF.js → child-cap-dispatch-hf-Gce_4.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Cc6KOdY-.js");
+const require_dist = require("./dist-BugrtARh.js");
 const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
 require("./hub-cap-forward-COCmYaup.js");
 let node_crypto = require("node:crypto");

package/dist/{cluster-secret-Dg0OOOSr.js → cluster-secret-BUiG8DCo.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-Cc6KOdY-.js");
+const require_dist = require("./dist-BugrtARh.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{cluster-secret-BDue-uJj.mjs → cluster-secret-DgJTZ4qY.mjs}

@@ -1,4 +1,4 @@
-import { br as buildSecretRef } from "./dist-B9oFw2jh.mjs";
+import { xr as buildSecretRef } from "./dist-BC0GnGeg.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{composition-sources-CHvLMrFI.js → composition-sources-4SmsP0O4.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-Cc6KOdY-.js");
+const require_dist = require("./dist-BugrtARh.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-DT_uJwI3.mjs → composition-sources-CgOQVIwa.mjs}

@@ -1,4 +1,4 @@
-import { cr as errMsg, tr as compositionSourceKey } from "./dist-B9oFw2jh.mjs";
+import { cr as errMsg, tr as compositionSourceKey } from "./dist-BC0GnGeg.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{dist-B9oFw2jh.mjs → dist-BC0GnGeg.mjs}

@@ -887,6 +887,10 @@ function isSecretMarker(value) {
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
+/** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
+function isSecretMarkerLike(value) {
+	return isRecord$1(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+}
 function isSecretClear(value) {
 	return isRecord$1(value) && value["$secretClear"] === true;
 }
@@ -63105,4 +63109,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { buildStreamParamsConfigSchema as $, compositionItemFieldPath as $n, looseSchema as $t, MINUTES_PER_DAY as A, scoreRuntimes as An, isEvent as Ar, extractNestedAddonId as At, StorageLocationModeSchema as B, userManagementCapability as Bn, scopeKey as Br, isLocationEnabled as Bt, FieldClaimModeSchema as C, resolveHubAddressRoles as Cn, createEvent as Cr, enumerateInferenceDevices as Ct, LegacyStorageLocationDefaultSchema as D, runtimeStatePolicyFor as Dn, formatSecretScope as Dr, evictionPolicyOfLocation as Dt, LOG_LEVEL_RANK as E, resolveNotificationTapAddress as En, expandCapMethods as Er, evaluateCompositionField as Et, RecordingStatusSchema as F, storageMigrationCapability as Fn, parseJsonUnknown as Fr, hfModelUrl as Ft, addonSettingsCapability as G, vectorStoreCapability as Gn, toNodeId as Gr, keychainCapability as Gt, StorageMigrationJobSchema as H, validateCustomAddress as Hn, secretTreeFromPaths as Hr, isVoidInput as Ht, STORAGE_ACCESS_FALLBACK as I, storageOccupancyCapability as In, parseSecretRef as Ir, isAppLinkBase as It, authProviderCapability as J, buildFfmpegArgs as Jn, lifecycleJobSchema as Jt, addonWidgetsCapability as K, withLocationMode as Kn, transformSecretWrite as Kr, legacyAutoLinkIds as Kt, STREAM_PROFILE_META as L, storageProviderCapability as Ln, readinessKey as Lr, isArrayOutputSchema as Lt, MOTION_CLOSE_AFTER_MS as M, siteZoneKey as Mn, nodePin as Mr, foldSnapshotByFunction as Mt, RECORDING_SOURCE_CAMSTACK_ADDON as N, snapshotCapability as Nn, normalizeSecretOwner as Nr, formatMinutes as Nt, LocationIconIdSchema as O, scopesAllowAddon as On, hydrateSchema as Or, expandContainer as Ot, RUNTIME_DEFAULTS as P, storageCapability as Pn, parseJsonObject as Pr, gbToBytes as Pt, buildCapabilityLookup as Q, compositionFeatureEnabled as Qn, logLevelAtMost as Qt, ScopedTokenSchema as R, streamCatalogCapability as Rn, resolveCapMount as Rr, isCollectionArrayMethod as Rt, FIRST_LEVEL_MACRO_CLASSES as S, resolveCoreBlockFiles as Sn, collectZodSecretPaths as Sr, deviceStatusCapability as St, HF_REPO as T, resolveMethodAuth as Tn, emitReadiness as Tr, enumerateSchemaFields as Tt, UserRecordSchema as U, vectorDimFromBase64 as Un, secretTreeFromSchema as Ur, kebabToCamel as Ut, StorageLocationTypeSchema as V, validateComposition as Vn, scrubKnownSecrets as Vr, isObjectInput as Vt, addonPagesCapability as W, vectorIndexDimConflictError as Wn, sleep as Wr, keychainAdminCapability as Wt, bareAddonId as X, composedDeviceRef as Xn, locationIconKey as Xt, backupCapability as Y, cloneStatefulExpressionMemory as Yn, localNetworkCapability as Yt, batteryCapability as Z, composedDeviceStableId as Zn, logDestinationCapability as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, reducePoints as _n, asJsonObject as _r, deriveBatteryPresence as _t, BatteryStatusSchema as a, modeMayWrite as an, DeviceFeature as ar, compositionSourceRefs as at, DeclaredDevices as b, resolveBucketMs as bn, buildSecretRef as br, deviceManagerCapability as bt, CAP_NAMES_WITH_STATUS as c, normalizeUnit as cn, errMsg as cr, coreBlockIdFromAddonId as ct, CORE_BLOCKS_ADDON_ID as d, parseStreamParamsFormPatch as dn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as dr, createDeviceExtensionProvider as dt, maskUrlCredentials as en, compositionSliceKey as er, calendarsCapability as et, CORE_BLOCK_ADDON_PREFIX as f, pickAppLinkHub as fn, DEVICE_STATUS_METHOD as fr, dataStoreProviderCapability as ft, DATABASE_SNAPSHOT_SUFFIX as g, ptzAutotrackCapability as gn, WELL_KNOWN_TAB_MAP as gr, defineExtensionSlotProvider as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, procedureAuthKey as hn, ReadinessTimeoutError as hr, decodeVectorBase64 as ht, BaseDevice as i, metricsProviderCapability as in, toExpressionValue as ir, compositionFieldKey as it, MODEL_FORMATS as j, settingsStoreCapability as jn, isSecretMarker as jr, filesystemBrowseCapability as jt, METHOD_ACCESS_MAP as k, scopesAllowDeviceCap as kn, isDeviceConfigCap as kr, expressionContainsBuiltinCall as kt, COMPOSED_ITEM_FIXED_FIELDS as l, objectInputDeclaresAddonId as ln, BaseAddon as lr, coreBlockSourceKind as lt, CoreBlockSchema as m, platformProbeCapability as mn, ReadinessRegistry as mr, declarationOwnerNodeId as mt, AlertSchema as n, mayWriteToLocation as nn, createStatefulExpressionMemory as nr, checkRoleAddress as nt, CAMERA_SWITCH_ORDER as o, motionCapability as on, DeviceRole as or, coreBlockAddonId as ot, CalendarPreferencesSchema as p, planComposition as pn, REDACTED_SECRET as pr, databaseSnapshotCapability as pt, alertsCapability as q, COMPOSER_ADDON_ID as qn, EventCategory as qr, legacyModeOf as qt, ApiKeyRecordSchema as r, memoizePinnedFfmpeg as rn, disarmRoseMemory as rr, composerCapability as rt, CAMSTACK_APP_LINK_ORIGIN as s, normalizeCoreBlockWrite as sn, DeviceType as sr, coreBlockComposition as st, ALL_CAPABILITY_DEFINITIONS as t, mayReadLocation as tn, compositionSourceKey as tr, cameraGridLayoutCapability as tt, COMPOSER_RUNNER_ID as u, objectInputDeclaresRequiredDeviceId as un, DATAPLANE_SECRET_HEADER as ur, coreBlocksCapability as ut, DAY_NAMES as v, replacedFieldKeys as vn, asNumber as vr, describeComposableCaps as vt, FieldClaimSchema as w, resolveLocationMode as wn, emitDownForOwnedCaps as wr, enumerateItemArrayFields as wt, DeviceStatusSchema as x, resolveCoreBlockEntry as xn, collectSecretConfigKeys as xr, deviceStateCapability as xt, DERIVED_CAMERA_SILENCED_CAP_NAMES as y, resolveAppConnections as yn, asString$1 as yr, deviceExtensionCapability as yt, StorageCleanupJobSchema as z, streamQualityLabel as zn, resolveSecretMarkers as zr, isDefaultAppConnectionEndpoint as zt };
+export { buildStreamParamsConfigSchema as $, compositionItemFieldPath as $n, looseSchema as $t, MINUTES_PER_DAY as A, scoreRuntimes as An, isDeviceConfigCap as Ar, extractNestedAddonId as At, StorageLocationModeSchema as B, userManagementCapability as Bn, parseSecretRef as Br, isLocationEnabled as Bt, FieldClaimModeSchema as C, resolveHubAddressRoles as Cn, collectZodSecretPaths as Cr, enumerateInferenceDevices as Ct, LegacyStorageLocationDefaultSchema as D, runtimeStatePolicyFor as Dn, expandCapMethods as Dr, evictionPolicyOfLocation as Dt, LOG_LEVEL_RANK as E, resolveNotificationTapAddress as En, emitReadiness as Er, evaluateCompositionField as Et, RecordingStatusSchema as F, storageMigrationCapability as Fn, isSecretMarkerLike as Fr, hfModelUrl as Ft, addonSettingsCapability as G, vectorStoreCapability as Gn, scrubKnownSecrets as Gr, keychainCapability as Gt, StorageMigrationJobSchema as H, validateCustomAddress as Hn, resolveCapMount as Hr, isVoidInput as Ht, STORAGE_ACCESS_FALLBACK as I, storageOccupancyCapability as In, nodePin as Ir, isAppLinkBase as It, authProviderCapability as J, buildFfmpegArgs as Jn, sleep as Jr, lifecycleJobSchema as Jt, addonWidgetsCapability as K, withLocationMode as Kn, secretTreeFromPaths as Kr, legacyAutoLinkIds as Kt, STREAM_PROFILE_META as L, storageProviderCapability as Ln, normalizeSecretOwner as Lr, isArrayOutputSchema as Lt, MOTION_CLOSE_AFTER_MS as M, siteZoneKey as Mn, isKeychainStoredField as Mr, foldSnapshotByFunction as Mt, RECORDING_SOURCE_CAMSTACK_ADDON as N, snapshotCapability as Nn, isSecretClear as Nr, formatMinutes as Nt, LocationIconIdSchema as O, scopesAllowAddon as On, formatSecretScope as Or, expandContainer as Ot, RUNTIME_DEFAULTS as P, storageCapability as Pn, isSecretMarker as Pr, gbToBytes as Pt, buildCapabilityLookup as Q, compositionFeatureEnabled as Qn, EventCategory as Qr, logLevelAtMost as Qt, ScopedTokenSchema as R, streamCatalogCapability as Rn, parseJsonObject as Rr, isCollectionArrayMethod as Rt, FIRST_LEVEL_MACRO_CLASSES as S, resolveCoreBlockFiles as Sn, collectSecretConfigKeys as Sr, deviceStatusCapability as St, HF_REPO as T, resolveMethodAuth as Tn, emitDownForOwnedCaps as Tr, enumerateSchemaFields as Tt, UserRecordSchema as U, vectorDimFromBase64 as Un, resolveSecretMarkers as Ur, kebabToCamel as Ut, StorageLocationTypeSchema as V, validateComposition as Vn, readinessKey as Vr, isObjectInput as Vt, addonPagesCapability as W, vectorIndexDimConflictError as Wn, scopeKey as Wr, keychainAdminCapability as Wt, bareAddonId as X, composedDeviceRef as Xn, toSecretFieldView as Xr, locationIconKey as Xt, backupCapability as Y, cloneStatefulExpressionMemory as Yn, toNodeId as Yr, localNetworkCapability as Yt, batteryCapability as Z, composedDeviceStableId as Zn, transformSecretWrite as Zr, logDestinationCapability as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, reducePoints as _n, WELL_KNOWN_TAB_MAP as _r, deriveBatteryPresence as _t, BatteryStatusSchema as a, modeMayWrite as an, DeviceFeature as ar, compositionSourceRefs as at, DeclaredDevices as b, resolveBucketMs as bn, asString$1 as br, deviceManagerCapability as bt, CAP_NAMES_WITH_STATUS as c, normalizeUnit as cn, errMsg as cr, coreBlockIdFromAddonId as ct, CORE_BLOCKS_ADDON_ID as d, parseStreamParamsFormPatch as dn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as dr, createDeviceExtensionProvider as dt, maskUrlCredentials as en, compositionSliceKey as er, calendarsCapability as et, CORE_BLOCK_ADDON_PREFIX as f, pickAppLinkHub as fn, DEVICE_STATUS_METHOD as fr, dataStoreProviderCapability as ft, DATABASE_SNAPSHOT_SUFFIX as g, ptzAutotrackCapability as gn, SECRET_CLEAR as gr, defineExtensionSlotProvider as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, procedureAuthKey as hn, ReadinessTimeoutError as hr, decodeVectorBase64 as ht, BaseDevice as i, metricsProviderCapability as in, toExpressionValue as ir, compositionFieldKey as it, MODEL_FORMATS as j, settingsStoreCapability as jn, isEvent as jr, filesystemBrowseCapability as jt, METHOD_ACCESS_MAP as k, scopesAllowDeviceCap as kn, hydrateSchema as kr, expressionContainsBuiltinCall as kt, COMPOSED_ITEM_FIXED_FIELDS as l, objectInputDeclaresAddonId as ln, BaseAddon as lr, coreBlockSourceKind as lt, CoreBlockSchema as m, platformProbeCapability as mn, ReadinessRegistry as mr, declarationOwnerNodeId as mt, AlertSchema as n, mayWriteToLocation as nn, createStatefulExpressionMemory as nr, checkRoleAddress as nt, CAMERA_SWITCH_ORDER as o, motionCapability as on, DeviceRole as or, coreBlockAddonId as ot, CalendarPreferencesSchema as p, planComposition as pn, REDACTED_SECRET as pr, databaseSnapshotCapability as pt, alertsCapability as q, COMPOSER_ADDON_ID as qn, secretTreeFromSchema as qr, legacyModeOf as qt, ApiKeyRecordSchema as r, memoizePinnedFfmpeg as rn, disarmRoseMemory as rr, composerCapability as rt, CAMSTACK_APP_LINK_ORIGIN as s, normalizeCoreBlockWrite as sn, DeviceType as sr, coreBlockComposition as st, ALL_CAPABILITY_DEFINITIONS as t, mayReadLocation as tn, compositionSourceKey as tr, cameraGridLayoutCapability as tt, COMPOSER_RUNNER_ID as u, objectInputDeclaresRequiredDeviceId as un, DATAPLANE_SECRET_HEADER as ur, coreBlocksCapability as ut, DAY_NAMES as v, replacedFieldKeys as vn, asJsonObject as vr, describeComposableCaps as vt, FieldClaimSchema as w, resolveLocationMode as wn, createEvent as wr, enumerateItemArrayFields as wt, DeviceStatusSchema as x, resolveCoreBlockEntry as xn, buildSecretRef as xr, deviceStateCapability as xt, DERIVED_CAMERA_SILENCED_CAP_NAMES as y, resolveAppConnections as yn, asNumber as yr, deviceExtensionCapability as yt, StorageCleanupJobSchema as z, streamQualityLabel as zn, parseJsonUnknown as zr, isDefaultAppConnectionEndpoint as zt };