@camstack/system 1.2.410 → 1.2.412

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CrznXkOZ.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Qt as logDestinationCapability, dr as BaseAddon } from "../../dist-CvjyPlVK.mjs";
+import { Qt as logDestinationCapability, dr as BaseAddon } from "../../dist-ItJ3qAAA.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{child-cap-dispatch-C-t9A5bd.mjs → child-cap-dispatch-CpYnlLNt.mjs}

@@ -1,4 +1,4 @@
-import { Er as createEvent, Xr as scrubKnownSecrets, ri as EventCategory$1, tn as maskUrlCredentials } from "./dist-CvjyPlVK.mjs";
+import { Er as createEvent, Xr as scrubKnownSecrets, ri as EventCategory$1, tn as maskUrlCredentials } from "./dist-ItJ3qAAA.mjs";
 import { a as parseProcStat, i as nodeProcReader } from "./proc-stat-CbC55Kqi.mjs";
 import "./hub-cap-forward-CDiN1p98.mjs";
 import * as crypto$1 from "node:crypto";

package/dist/{child-cap-dispatch-BymegE_4.js → child-cap-dispatch-fnYkJDjG.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CrznXkOZ.js");
+const require_dist = require("./dist-BcnmH70Z.js");
 const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
 require("./hub-cap-forward-W8oEm4ME.js");
 let node_crypto = require("node:crypto");

package/dist/{composition-sources-D2TB0T_2.js → composition-sources-BX6Caql_.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CrznXkOZ.js");
+const require_dist = require("./dist-BcnmH70Z.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-DfGBDGDf.mjs → composition-sources-QndhKNb5.mjs}

@@ -1,4 +1,4 @@
-import { rr as compositionSourceKey, ur as errMsg } from "./dist-CvjyPlVK.mjs";
+import { rr as compositionSourceKey, ur as errMsg } from "./dist-ItJ3qAAA.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-C9RU0W0k.js → constants-CMXQ1QIC.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CrznXkOZ.js");
+const require_dist = require("./dist-BcnmH70Z.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{constants-U8qDgboP.mjs → constants-vMEWqCqG.mjs}

@@ -1,4 +1,4 @@
-import { Cr as buildSecretRef } from "./dist-CvjyPlVK.mjs";
+import { Cr as buildSecretRef } from "./dist-ItJ3qAAA.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{dist-CrznXkOZ.js → dist-BcnmH70Z.js}

@@ -11558,7 +11558,14 @@ var BrokerProviderInfoSchema = zod.z.object({
 	/** Broker kinds this provider can create, with a display label. */
 	kinds: zod.z.array(zod.z.object({
 		kind: zod.z.string(),
-		label: zod.z.string()
+		label: zod.z.string(),
+		/**
+		* Relative hub path to start an interactive account link (OAuth popup).
+		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
+		*/
+		interactiveConnectPath: zod.z.string().min(1).optional(),
+		/** Relative hub path to disconnect the linked account (same popup pattern). */
+		interactiveDisconnectPath: zod.z.string().min(1).optional()
 	}))
 });
 var ListInputSchema = zod.z.object({ 
@@ -19900,14 +19907,14 @@ var LlmProfileSchema = zod.z.object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$2 = zod.z.unknown();
+var ConfigSchemaPassthrough$3 = zod.z.unknown();
 var LlmProfileKindDescriptorSchema = zod.z.object({
 	kind: LlmProfileKindSchema,
 	label: zod.z.string(),
 	icon: zod.z.string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: zod.z.string(),
-	configSchema: ConfigSchemaPassthrough$2
+	configSchema: ConfigSchemaPassthrough$3
 });
 var LlmDefaultSelectorSchema = zod.z.union([zod.z.object({ consumer: zod.z.string() }), zod.z.object({ purpose: zod.z.enum(["text", "vision"]) })]);
 var LlmDefaultSchema = zod.z.object({
@@ -21284,7 +21291,7 @@ var TargetKindCapsSchema = zod.z.object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough$1 = zod.z.unknown();
+var ConfigSchemaPassthrough$2 = zod.z.unknown();
 var TargetKindSchema = zod.z.object({
 	kind: zod.z.string(),
 	label: zod.z.string(),
@@ -21321,7 +21328,7 @@ var TargetKindSchema = zod.z.object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: zod.z.string().optional(),
-	configSchema: ConfigSchemaPassthrough$1,
+	configSchema: ConfigSchemaPassthrough$2,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -24930,6 +24937,77 @@ var oauthIntegrationCapability = {
 getDescriptor: method(zod.z.void(), OauthIntegrationDescriptorSchema, { auth: "admin" }) }
 };
 /**
+* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
+*
+* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
+* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
+* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
+* immutable after create.
+*/
+var ConfigSchemaPassthrough$1 = zod.z.unknown();
+var OidcConnectionSchema = zod.z.object({
+	id: zod.z.string().min(1),
+	displayName: zod.z.string(),
+	icon: zod.z.string(),
+	issuerUrl: zod.z.string(),
+	clientId: zod.z.string(),
+	/** Client id + secret present — never the secret value. */
+	configured: zod.z.boolean(),
+	/**
+	* Values for the connection form schema. `clientSecret` is a keychain
+	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
+	*/
+	formValues: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+});
+/**
+* Patch one connection. Omitted or empty `clientSecret` keeps the stored
+* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
+*/
+var OidcConnectionUpdateInputSchema = zod.z.object({
+	id: zod.z.string().min(1),
+	displayName: zod.z.string().min(1),
+	icon: zod.z.string().optional(),
+	issuerUrl: zod.z.string().optional(),
+	clientId: zod.z.string().optional(),
+	clientSecret: zod.z.union([zod.z.string(), zod.z.object({ $secretClear: zod.z.literal(true) })]).optional(),
+	redirectUri: zod.z.string().optional(),
+	scopes: zod.z.string().optional(),
+	usernameClaim: zod.z.enum([
+		"preferred_username",
+		"email",
+		"sub"
+	]).optional()
+});
+var oidcConnectionsCapability = {
+	name: "oidc-connections",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/** Form fields for Add/Edit (ConfigFormBuilder). */
+		connectionFormSchema: method(zod.z.object({}), ConfigSchemaPassthrough$1, { auth: "admin" }),
+		listConnections: method(zod.z.object({}), zod.z.array(OidcConnectionSchema).readonly(), { auth: "admin" }),
+		/**
+		* Create a row with the operator-chosen URL slug. Credentials follow via
+		* `updateConnection` (same Save path as Training Providers).
+		*/
+		createConnection: method(zod.z.object({
+			id: zod.z.string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
+			displayName: zod.z.string().min(1)
+		}), zod.z.object({ id: zod.z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateConnection: method(OidcConnectionUpdateInputSchema, zod.z.object({ ok: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteConnection: method(zod.z.object({ id: zod.z.string().min(1) }), zod.z.object({ ok: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
 * What started a camera's onboard motion (D672). `camera` is the camera's own
 * firmware; `sensor` is a device the operator ATTACHED to it. Absent on the
 * wire means the camera: only the camera-sensors bridge ever says `sensor`.
@@ -55348,6 +55426,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"oidcConnections.connectionFormSchema": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.createConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"oidcConnections.deleteConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"oidcConnections.listConnections": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.updateConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -60662,6 +60770,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	notifierCapability,
 	numericSensorCapability,
 	oauthIntegrationCapability,
+	oidcConnectionsCapability,
 	osdCapability,
 	osdManagerCapability,
 	petFeederCapability,

package/dist/{dist-CvjyPlVK.mjs → dist-ItJ3qAAA.mjs}

@@ -11558,7 +11558,14 @@ var BrokerProviderInfoSchema = z.object({
 	/** Broker kinds this provider can create, with a display label. */
 	kinds: z.array(z.object({
 		kind: z.string(),
-		label: z.string()
+		label: z.string(),
+		/**
+		* Relative hub path to start an interactive account link (OAuth popup).
+		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
+		*/
+		interactiveConnectPath: z.string().min(1).optional(),
+		/** Relative hub path to disconnect the linked account (same popup pattern). */
+		interactiveDisconnectPath: z.string().min(1).optional()
 	}))
 });
 var ListInputSchema = z.object({ 
@@ -19900,14 +19907,14 @@ var LlmProfileSchema = z.object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$2 = z.unknown();
+var ConfigSchemaPassthrough$3 = z.unknown();
 var LlmProfileKindDescriptorSchema = z.object({
 	kind: LlmProfileKindSchema,
 	label: z.string(),
 	icon: z.string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: z.string(),
-	configSchema: ConfigSchemaPassthrough$2
+	configSchema: ConfigSchemaPassthrough$3
 });
 var LlmDefaultSelectorSchema = z.union([z.object({ consumer: z.string() }), z.object({ purpose: z.enum(["text", "vision"]) })]);
 var LlmDefaultSchema = z.object({
@@ -21284,7 +21291,7 @@ var TargetKindCapsSchema = z.object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough$1 = z.unknown();
+var ConfigSchemaPassthrough$2 = z.unknown();
 var TargetKindSchema = z.object({
 	kind: z.string(),
 	label: z.string(),
@@ -21321,7 +21328,7 @@ var TargetKindSchema = z.object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: z.string().optional(),
-	configSchema: ConfigSchemaPassthrough$1,
+	configSchema: ConfigSchemaPassthrough$2,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -24930,6 +24937,77 @@ var oauthIntegrationCapability = {
 getDescriptor: method(z.void(), OauthIntegrationDescriptorSchema, { auth: "admin" }) }
 };
 /**
+* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
+*
+* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
+* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
+* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
+* immutable after create.
+*/
+var ConfigSchemaPassthrough$1 = z.unknown();
+var OidcConnectionSchema = z.object({
+	id: z.string().min(1),
+	displayName: z.string(),
+	icon: z.string(),
+	issuerUrl: z.string(),
+	clientId: z.string(),
+	/** Client id + secret present — never the secret value. */
+	configured: z.boolean(),
+	/**
+	* Values for the connection form schema. `clientSecret` is a keychain
+	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
+	*/
+	formValues: z.record(z.string(), z.unknown()).optional()
+});
+/**
+* Patch one connection. Omitted or empty `clientSecret` keeps the stored
+* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
+*/
+var OidcConnectionUpdateInputSchema = z.object({
+	id: z.string().min(1),
+	displayName: z.string().min(1),
+	icon: z.string().optional(),
+	issuerUrl: z.string().optional(),
+	clientId: z.string().optional(),
+	clientSecret: z.union([z.string(), z.object({ $secretClear: z.literal(true) })]).optional(),
+	redirectUri: z.string().optional(),
+	scopes: z.string().optional(),
+	usernameClaim: z.enum([
+		"preferred_username",
+		"email",
+		"sub"
+	]).optional()
+});
+var oidcConnectionsCapability = {
+	name: "oidc-connections",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/** Form fields for Add/Edit (ConfigFormBuilder). */
+		connectionFormSchema: method(z.object({}), ConfigSchemaPassthrough$1, { auth: "admin" }),
+		listConnections: method(z.object({}), z.array(OidcConnectionSchema).readonly(), { auth: "admin" }),
+		/**
+		* Create a row with the operator-chosen URL slug. Credentials follow via
+		* `updateConnection` (same Save path as Training Providers).
+		*/
+		createConnection: method(z.object({
+			id: z.string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
+			displayName: z.string().min(1)
+		}), z.object({ id: z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateConnection: method(OidcConnectionUpdateInputSchema, z.object({ ok: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteConnection: method(z.object({ id: z.string().min(1) }), z.object({ ok: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
 * What started a camera's onboard motion (D672). `camera` is the camera's own
 * firmware; `sensor` is a device the operator ATTACHED to it. Absent on the
 * wire means the camera: only the camera-sensors bridge ever says `sensor`.
@@ -55348,6 +55426,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"oidcConnections.connectionFormSchema": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.createConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"oidcConnections.deleteConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"oidcConnections.listConnections": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.updateConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -60662,6 +60770,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	notifierCapability,
 	numericSensorCapability,
 	oauthIntegrationCapability,
+	oidcConnectionsCapability,
 	osdCapability,
 	osdManagerCapability,
 	petFeederCapability,

package/dist/{event-loop-stall-monitor-De1uffaC.mjs → event-loop-stall-monitor-CogzcENb.mjs}

@@ -1,4 +1,4 @@
-import { It as hfModelUrl, M as MODEL_FORMATS, T as HF_REPO } from "./dist-CvjyPlVK.mjs";
+import { It as hfModelUrl, M as MODEL_FORMATS, T as HF_REPO } from "./dist-ItJ3qAAA.mjs";
 import { createHash } from "node:crypto";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{event-loop-stall-monitor-CaAcghV2.js → event-loop-stall-monitor-DoFaUgFf.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CrznXkOZ.js");
+const require_dist = require("./dist-BcnmH70Z.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CrznXkOZ.js");
-const require_jwt_signing_key = require("./jwt-signing-key-7JsaDUwM.js");
+const require_dist = require("./dist-BcnmH70Z.js");
+const require_jwt_signing_key = require("./jwt-signing-key-CST1LdM6.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -27,17 +27,17 @@ const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage
 const require_hub_cap_forward = require("./hub-cap-forward-W8oEm4ME.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-C9RU0W0k.js");
+const require_constants = require("./constants-CMXQ1QIC.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
-const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CaAcghV2.js");
+const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-DoFaUgFf.js");
 const require_tls = require("./tls-BWpwU-d5.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-BymegE_4.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-fnYkJDjG.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-BgWGRxN5.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
-const require_restore_archive = require("./restore-archive-BwOOlIex.js");
+const require_restore_archive = require("./restore-archive-pSlTKRgU.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $t as logLevelAtMost, A as METHOD_ACCESS_MAP, An as scopesAllowDeviceCap, D as LOG_LEVEL_RANK, En as resolveMethodAuth, Er as createEvent, F as RUNTIME_DEFAULTS, Ht as isObjectInput, K as addonSettingsCapability, Kr as readinessKey, Rt as isArrayOutputSchema, Sr as asString$1, Ur as parseJsonObject, Ut as isVoidInput, Vn as supportedRuntimes, Wr as parseJsonUnknown, Wt as kebabToCamel, Yr as scopeKey, Yt as lifecycleJobSchema, _r as ReadinessTimeoutError, br as asJsonObject$1, dn as objectInputDeclaresRequiredDeviceId, en as looseSchema, fr as DATAPLANE_SECRET_HEADER$1, gn as procedureAuthKey, gr as ReadinessRegistry, jr as expandCapMethods, jt as extractNestedAddonId, kn as scopesAllowAddon, kr as emitDownForOwnedCaps, mr as DEVICE_STATUS_METHOD, pr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, qr as resolveCapMount, ri as EventCategory$1, t as ALL_CAPABILITY_DEFINITIONS, un as objectInputDeclaresAddonId, ur as errMsg$1, xr as asNumber, zt as isCollectionArrayMethod } from "./dist-CvjyPlVK.mjs";
-import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-Bv9SAJgK.mjs";
+import { $t as logLevelAtMost, A as METHOD_ACCESS_MAP, An as scopesAllowDeviceCap, D as LOG_LEVEL_RANK, En as resolveMethodAuth, Er as createEvent, F as RUNTIME_DEFAULTS, Ht as isObjectInput, K as addonSettingsCapability, Kr as readinessKey, Rt as isArrayOutputSchema, Sr as asString$1, Ur as parseJsonObject, Ut as isVoidInput, Vn as supportedRuntimes, Wr as parseJsonUnknown, Wt as kebabToCamel, Yr as scopeKey, Yt as lifecycleJobSchema, _r as ReadinessTimeoutError, br as asJsonObject$1, dn as objectInputDeclaresRequiredDeviceId, en as looseSchema, fr as DATAPLANE_SECRET_HEADER$1, gn as procedureAuthKey, gr as ReadinessRegistry, jr as expandCapMethods, jt as extractNestedAddonId, kn as scopesAllowAddon, kr as emitDownForOwnedCaps, mr as DEVICE_STATUS_METHOD, pr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, qr as resolveCapMount, ri as EventCategory$1, t as ALL_CAPABILITY_DEFINITIONS, un as objectInputDeclaresAddonId, ur as errMsg$1, xr as asNumber, zt as isCollectionArrayMethod } from "./dist-ItJ3qAAA.mjs";
+import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-CpMSrZuI.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -26,17 +26,17 @@ import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { i as stripForwardedCaller, n as HUB_CAP_FWD_SERVICE, r as createHubCapForwardService, t as HUB_CAP_FWD_ACTION } from "./hub-cap-forward-CDiN1p98.mjs";
 import { StorageOrchestratorAddon, n as buildStorageLocationRegistry, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-U8qDgboP.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-vMEWqCqG.mjs";
 import { A as AGENT_UI_UNLOCK_VERSION, B as parseMeshAuthMode, C as generateMeshKeyPair, D as AGENT_DASHBOARD_ORIGINS_FIELD, E as loadMeshCa, F as verifyAgentUiUnlockTicket, G as createCidrMatcher, H as setProcessMeshAuthMode, I as MESH_AUTH_MODE_FIELD, J as readCidrSetting, K as normalizeIp, L as getProcessMeshAuthMode, M as isAllowedAgentDashboardReturnTo, N as mintAgentUiUnlockTicket, O as AGENT_UI_UNLOCK_DOMAIN, P as parseAgentDashboardOrigins, R as getProcessMeshAuthStatus, S as generateMeshCa, SystemConfigAddon, T as issueMeshLeafFromCsr, U as setProcessMeshAuthStatusSource, V as requestProcessMeshEnforcement, W as setProcessMeshEnforcer, _ as requireProcessMeshCa, a as setProcessMeshTlsEnabler, b as createMeshCsrPem, c as mintMeshJoinToken, d as getProcessNodeMeshTransport, f as setProcessMeshPeerTransportLookup, g as getProcessMeshCaState, h as MeshCaKeeper, i as ServiceBroker, j as UnlockTicketJtiStore, k as AGENT_UI_UNLOCK_TTL_MS, l as processJoinTokenJtiStore, m as processMeshCrl, n as TlsTcpTransporter, o as enrollMeshNode, p as MeshCrl, q as parseCidrList, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as caFingerprint, w as issueMeshLeafForNode, x as exportMeshPrivateKeyPem, y as caFingerprintCompact, z as isMeshAuthMode } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
-import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-De1uffaC.mjs";
+import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-CogzcENb.mjs";
 import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-C2NT-Orr.mjs";
-import { $ as AGENT_CAP_FWD_ACTION, $n as EMPTY_SOCKET_DIRECTION, $t as HEAP_WATCH_INTERVAL_MS, A as mapSignalsToInferenceHardware, An as DECISIVE_HEAP_SPACES, At as capServiceName, B as createParentUnownedCallHandler, Bn as createOutboundQueueGate, Bt as buildNpmChildEnv, C as getBrokerEventBus, Cn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, D as subscribePassthrough, Dn as createInspectorArrayBufferCensus, Dt as capActionName, E as setNodeEventInterest, En as createArrayBufferCensusGate, Et as NATIVE_PROVIDER_SERVICE_INFIX, F as brokerTransportLink, Fn as readHeapSpaces, Ft as CapabilityHandle, G as createUdsLoggerWithControl, Gn as EMPTY_SOCKET_PLANE_BASELINE, Gt as redactLogMeta, H as createUdsEventBus, Hn as MESH_QUEUE_TOP_N, Ht as runNpm, I as buildLinkChain, In as selectReportedSpaces, It as CapabilityUnavailableError, J as UDS_NO_ROUTE_PREFIX, Jn as createSocketPlaneMeter, Jt as hostNodeIdOf, K as LocalChildClient, Kn as SOCKET_PLANE_TOP_N, Kt as redactLogText, L as deviceCapResolverLink, Ln as OUTBOUND_QUEUE_COOLDOWN_MS, Lt as copyBundledNativeModules, M as probePlatform, Mn as emitHeapDiagnosticReport, Mt as deserializeTypedArrays, N as resolveHwAccel, Nn as formatHeapSpaces, Nt as serializeTypedArrays, O as AddonDepsManager, On as formatArrayBufferCensus, Ot as capActionSuffix, P as brokerCallForCap, Pn as heapSpaceField, Pt as DeviceRegistry, Q as deviceOfGetStatus, Qn as readSocketQueues, Qt as HEAP_RECLAIM_TRIGGER_MB, R as ipcParentLink, Rn as OUTBOUND_QUEUE_SUSTAIN_MS, Rt as installManifestNativeDeps, S as clusterEventTopic, Sn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, St as mountNativeCapService, T as registerEventBusService, Tn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, Tt as validateProviderRegistrations, U as udsChildLogToWorkerEntry, Un as createMeshQueueReader, Ut as isCredentialKeyName, V as createUdsEventBridge, Vn as formatOutboundQueueVerdict, Vt as resolveNpmInvocation, W as createUdsLogger, Wn as formatMeshQueue, Wt as redactLogEntry, X as GET_STATUS_METHOD, Xn as diffSocketPlane, Xt as HEAP_RECLAIM_MIN_INTERVAL_MS, Y as afterWorkerOnlineAnnounce, Yn as createSocketPlaneReader, Yt as createAddonDataPlaneFacility, Z as answerClaimedGetStatus, Zn as formatSocketPlane, Zt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, _ as getWorkerDeviceRegistry, _n as reclaimIntervalMs, _t as encodeFrame, a as reapProcessGroup, an as RSS_BUDGET_RELEASE_RATIO, ar as CAP_ACTION_OVERFLOW_LABEL, at as callWithServiceDiscovery, b as setHubConnected, bn as startRunnerHeapWatch, c as runnerOwnsProcessGroup, cn as ZERO_LOOP_DELAY, cr as MAX_CAP_ACTIONS_PER_PEER, ct as __resetCapUsageRegistryForTests, d as summarizeMembers, dn as createLoopDelayMeter, dr as diffCapActionCensus, dt as UdsLocalTransportClient, en as HEAP_WATCH_WARN_RATIO, er as createSocketDirectionCounters, et as AGENT_CAP_FWD_SERVICE, f as installManifestSystemDeps, fn as createV8Reclaimer, fr as EVENT_PLANE_TOP_N, ft as UdsLocalTransportServer, g as createUdsAddonContext, gn as parseRssBudgetMb, gr as formatEventPlane, gt as FrameDecoder, h as createAddonContext, hn as nextRssBudgetState, hr as diffEventPlane, ht as localEndpointPath, in as RSS_BUDGET_REANNOUNCE_MIN_MS, ir as socketDirectionMessages, it as classifyCapRoute, j as createKernelHwAccel, jn as HEAP_SPACE_REPORT_MIN_MB, jt as parseCapAction, k as createKernelInferenceEngine, kn as isArrayBufferCensusReport, kt as capBareAction, l as signalAllRunnerGroups, ln as buildHeapSample, lr as capActionLabel, lt as getCapUsageRegistry, m as adaptBrokerToCluster, mn as hubMainRssBudget, mr as createEventPlaneReader, mt as PeerAnsweredError, nn as HUB_MAIN_RSS_BUDGET_MB, nr as sampleSocketDirection, nt as stampCallerAddonId, o as registerRunnerGroup, on as RUNNER_HEAP_WATCH_INTERVAL_MS, or as CAP_ACTION_UNLABELLED, ot as CapUsageRegistry, p as installManifestPythonDeps, pn as describeRss, pr as createEventPlaneMeter, pt as SocketChannel, q as LocalChildRegistry, qn as SOCKET_QUEUE_TOP_N, qt as createAddonPeerBytesFacility, r as defaultProcessGroupOps, rn as HUB_RSS_BUDGET_ENV, rr as socketDirectionBytes, rt as CapRouteError, s as releaseRunnerGroup, sn as RUNNER_RSS_BUDGET_ENV, sr as EMPTY_CAP_ACTION_READING, st as PARENT_ROUTED_PROVIDER_ADDON_ID, t as CAP_METHOD_NOT_IMPLEMENTED, tn as HUB_MAIN_HEAP_WATCH_LABEL, tr as recordSocketFrame, tt as CapRouteResolver, un as createDeferredHeapWatchSink, ur as createCapActionCensus, ut as createLocalTransport, v as getOrInitReadinessRegistry, vn as shouldReclaim, vt as buildNativeCapProxy, w as getMoleculerEventStats, wn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, wt as createAddonService, x as EVENT_TOPIC_PREFIX, xn as strandedMb, y as getOrInitReadinessRegistryForClient, yn as startHeapWatch, yt as createBrokerDeviceManagerApi, z as localProviderLink, zn as OUTBOUND_QUEUE_THRESHOLD_BYTES, zt as resolveAddonClass } from "./child-cap-dispatch-C-t9A5bd.mjs";
+import { $ as AGENT_CAP_FWD_ACTION, $n as EMPTY_SOCKET_DIRECTION, $t as HEAP_WATCH_INTERVAL_MS, A as mapSignalsToInferenceHardware, An as DECISIVE_HEAP_SPACES, At as capServiceName, B as createParentUnownedCallHandler, Bn as createOutboundQueueGate, Bt as buildNpmChildEnv, C as getBrokerEventBus, Cn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, D as subscribePassthrough, Dn as createInspectorArrayBufferCensus, Dt as capActionName, E as setNodeEventInterest, En as createArrayBufferCensusGate, Et as NATIVE_PROVIDER_SERVICE_INFIX, F as brokerTransportLink, Fn as readHeapSpaces, Ft as CapabilityHandle, G as createUdsLoggerWithControl, Gn as EMPTY_SOCKET_PLANE_BASELINE, Gt as redactLogMeta, H as createUdsEventBus, Hn as MESH_QUEUE_TOP_N, Ht as runNpm, I as buildLinkChain, In as selectReportedSpaces, It as CapabilityUnavailableError, J as UDS_NO_ROUTE_PREFIX, Jn as createSocketPlaneMeter, Jt as hostNodeIdOf, K as LocalChildClient, Kn as SOCKET_PLANE_TOP_N, Kt as redactLogText, L as deviceCapResolverLink, Ln as OUTBOUND_QUEUE_COOLDOWN_MS, Lt as copyBundledNativeModules, M as probePlatform, Mn as emitHeapDiagnosticReport, Mt as deserializeTypedArrays, N as resolveHwAccel, Nn as formatHeapSpaces, Nt as serializeTypedArrays, O as AddonDepsManager, On as formatArrayBufferCensus, Ot as capActionSuffix, P as brokerCallForCap, Pn as heapSpaceField, Pt as DeviceRegistry, Q as deviceOfGetStatus, Qn as readSocketQueues, Qt as HEAP_RECLAIM_TRIGGER_MB, R as ipcParentLink, Rn as OUTBOUND_QUEUE_SUSTAIN_MS, Rt as installManifestNativeDeps, S as clusterEventTopic, Sn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, St as mountNativeCapService, T as registerEventBusService, Tn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, Tt as validateProviderRegistrations, U as udsChildLogToWorkerEntry, Un as createMeshQueueReader, Ut as isCredentialKeyName, V as createUdsEventBridge, Vn as formatOutboundQueueVerdict, Vt as resolveNpmInvocation, W as createUdsLogger, Wn as formatMeshQueue, Wt as redactLogEntry, X as GET_STATUS_METHOD, Xn as diffSocketPlane, Xt as HEAP_RECLAIM_MIN_INTERVAL_MS, Y as afterWorkerOnlineAnnounce, Yn as createSocketPlaneReader, Yt as createAddonDataPlaneFacility, Z as answerClaimedGetStatus, Zn as formatSocketPlane, Zt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, _ as getWorkerDeviceRegistry, _n as reclaimIntervalMs, _t as encodeFrame, a as reapProcessGroup, an as RSS_BUDGET_RELEASE_RATIO, ar as CAP_ACTION_OVERFLOW_LABEL, at as callWithServiceDiscovery, b as setHubConnected, bn as startRunnerHeapWatch, c as runnerOwnsProcessGroup, cn as ZERO_LOOP_DELAY, cr as MAX_CAP_ACTIONS_PER_PEER, ct as __resetCapUsageRegistryForTests, d as summarizeMembers, dn as createLoopDelayMeter, dr as diffCapActionCensus, dt as UdsLocalTransportClient, en as HEAP_WATCH_WARN_RATIO, er as createSocketDirectionCounters, et as AGENT_CAP_FWD_SERVICE, f as installManifestSystemDeps, fn as createV8Reclaimer, fr as EVENT_PLANE_TOP_N, ft as UdsLocalTransportServer, g as createUdsAddonContext, gn as parseRssBudgetMb, gr as formatEventPlane, gt as FrameDecoder, h as createAddonContext, hn as nextRssBudgetState, hr as diffEventPlane, ht as localEndpointPath, in as RSS_BUDGET_REANNOUNCE_MIN_MS, ir as socketDirectionMessages, it as classifyCapRoute, j as createKernelHwAccel, jn as HEAP_SPACE_REPORT_MIN_MB, jt as parseCapAction, k as createKernelInferenceEngine, kn as isArrayBufferCensusReport, kt as capBareAction, l as signalAllRunnerGroups, ln as buildHeapSample, lr as capActionLabel, lt as getCapUsageRegistry, m as adaptBrokerToCluster, mn as hubMainRssBudget, mr as createEventPlaneReader, mt as PeerAnsweredError, nn as HUB_MAIN_RSS_BUDGET_MB, nr as sampleSocketDirection, nt as stampCallerAddonId, o as registerRunnerGroup, on as RUNNER_HEAP_WATCH_INTERVAL_MS, or as CAP_ACTION_UNLABELLED, ot as CapUsageRegistry, p as installManifestPythonDeps, pn as describeRss, pr as createEventPlaneMeter, pt as SocketChannel, q as LocalChildRegistry, qn as SOCKET_QUEUE_TOP_N, qt as createAddonPeerBytesFacility, r as defaultProcessGroupOps, rn as HUB_RSS_BUDGET_ENV, rr as socketDirectionBytes, rt as CapRouteError, s as releaseRunnerGroup, sn as RUNNER_RSS_BUDGET_ENV, sr as EMPTY_CAP_ACTION_READING, st as PARENT_ROUTED_PROVIDER_ADDON_ID, t as CAP_METHOD_NOT_IMPLEMENTED, tn as HUB_MAIN_HEAP_WATCH_LABEL, tr as recordSocketFrame, tt as CapRouteResolver, un as createDeferredHeapWatchSink, ur as createCapActionCensus, ut as createLocalTransport, v as getOrInitReadinessRegistry, vn as shouldReclaim, vt as buildNativeCapProxy, w as getMoleculerEventStats, wn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, wt as createAddonService, x as EVENT_TOPIC_PREFIX, xn as strandedMb, y as getOrInitReadinessRegistryForClient, yn as startHeapWatch, yt as createBrokerDeviceManagerApi, z as localProviderLink, zn as OUTBOUND_QUEUE_THRESHOLD_BYTES, zt as resolveAddonClass } from "./child-cap-dispatch-CpYnlLNt.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
-import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-BxlXOFwo.mjs";
+import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-8F_M_wW0.mjs";
 import { z } from "zod";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";

package/dist/{jwt-signing-key-7JsaDUwM.js → jwt-signing-key-CST1LdM6.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CrznXkOZ.js");
+const require_dist = require("./dist-BcnmH70Z.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{jwt-signing-key-Bv9SAJgK.mjs → jwt-signing-key-CpMSrZuI.mjs}

@@ -1,4 +1,4 @@
-import { Cr as buildSecretRef } from "./dist-CvjyPlVK.mjs";
+import { Cr as buildSecretRef } from "./dist-ItJ3qAAA.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**