@camstack/system 1.2.411 → 1.2.413

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-DpQYxjCT.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-fnYkJDjG.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { Ct as setWorkerNativeCapsChangeListener, G as createUdsLoggerWithControl, K as LocalChildClient, Mn as emitHeapDiagnosticReport, Rt as installManifestNativeDeps, Tt as validateProviderRegistrations, bn as startRunnerHeapWatch, bt as getWorkerNativeCapProvider, f as installManifestSystemDeps, g as createUdsAddonContext, i as killOwnRunnerGroupAfterParentLoss, n as createChildCapDispatch, p as installManifestPythonDeps, sn as RUNNER_RSS_BUDGET_ENV, u as startRunnerParentDeathWatchdog, xt as getWorkerNativeCapSnapshot, zt as resolveAddonClass } from "./child-cap-dispatch-DIXACzJZ.mjs";
+import { Ct as setWorkerNativeCapsChangeListener, G as createUdsLoggerWithControl, K as LocalChildClient, Mn as emitHeapDiagnosticReport, Rt as installManifestNativeDeps, Tt as validateProviderRegistrations, bn as startRunnerHeapWatch, bt as getWorkerNativeCapProvider, f as installManifestSystemDeps, g as createUdsAddonContext, i as killOwnRunnerGroupAfterParentLoss, n as createChildCapDispatch, p as installManifestPythonDeps, sn as RUNNER_RSS_BUDGET_ENV, u as startRunnerParentDeathWatchdog, xt as getWorkerNativeCapSnapshot, zt as resolveAddonClass } from "./child-cap-dispatch-CpYnlLNt.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/addon-utils.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-Cek0wNdY.js");
-const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-IeiQqOdV.js");
+const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-DoFaUgFf.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 const require_snapshot_courtesy = require("./snapshot-courtesy-D_C5-nC0.js");
 exports.COURTESY_DEFAULT_WIDTH = require_snapshot_courtesy.COURTESY_DEFAULT_WIDTH;

package/dist/addon-utils.mjs

@@ -1,4 +1,4 @@
-import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-dbJ_rR8a.mjs";
+import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-CogzcENb.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg, t as COURTESY_DEFAULT_WIDTH } from "./snapshot-courtesy-CyFs1M3I.mjs";
 export { COURTESY_DEFAULT_WIDTH, CustomActionRegistry, ModelDownloadHttpError, ModelDownloadService, STALL_REPORT_MS, STALL_TICK_MS, adoptModelRevisions, attributeStall, collectModelFiles, contentTypeFor, courtesyCacheKey, createFileDataPlaneHandler, deleteModelFromDisk, downloadFile, ensureModel, getModelFilePath, isModelDownloadHttpError, isModelDownloaded, parseRangeHeader, renderCourtesyJpeg, renderCourtesyOverlayJpeg, resolveFormatRevision, startEventLoopStallMonitor };

package/dist/auth/scoped-token-manager.d.ts

@@ -18,7 +18,11 @@ export declare class ScopedTokenManager {
 	* `protectedProcedure`.
 	*/
 	matchesScope(token: ScopedToken, addonId?: string, capability?: string): boolean;
-	revoke(tokenId: string): Promise<void>;
+	/**
+	* Delete the token row. `true` when a row was removed; `false` when the id
+	* was already gone (unknown or previously revoked).
+	*/
+	revoke(tokenId: string): Promise<boolean>;
 	listForUser(userId: string): Promise<ScopedToken[]>;
 	updateLastUsed(tokenId: string): Promise<void>;
 	/**

package/dist/auth/user-management-internal.d.ts

@@ -51,9 +51,25 @@ export interface UserManagementInternal {
 	setPassword(input: SetPasswordInput): Promise<void>;
 	/** Admin tokens (`csa_`) — the hub router gates creation (admin + re-auth). */
 	readonly adminTokens: AdminTokensInternal;
+	/**
+	* Scoped tokens (`cst_`) — hub bulk revoke (`auth.revokeCredentials`).
+	* `revoke` deletes the row; `false` when the id was already gone.
+	*/
+	readonly scopedTokens: ScopedTokensInternal;
+	/**
+	* OAuth account-link sessions — hub bulk revoke. Active → mark revoked;
+	* already revoked → delete the row (so "Remove revoked" clears the list).
+	*/
+	readonly oauthSessions: OauthSessionsInternal;
 	/** The authentication audit trail. */
 	readonly audit: AuthAuditInternal;
 }
+export interface ScopedTokensInternal {
+	revoke(id: string): Promise<boolean>;
+}
+export interface OauthSessionsInternal {
+	revoke(id: string): Promise<boolean>;
+}
 export interface AdminTokensInternal {
 	create(input: {
 		readonly createdBy: string;

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { G as addonPagesCapability, dr as BaseAddon, ri as EventCategory, ur as errMsg } from "../../dist-rbHhiEZA.mjs";
+import { G as addonPagesCapability, dr as BaseAddon, ri as EventCategory, ur as errMsg } from "../../dist-ItJ3qAAA.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { dr as BaseAddon, q as addonWidgetsCapability, ri as EventCategory, ur as errMsg } from "../../dist-rbHhiEZA.mjs";
+import { dr as BaseAddon, q as addonWidgetsCapability, ri as EventCategory, ur as errMsg } from "../../dist-ItJ3qAAA.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Er as createEvent, J as alertsCapability, dr as BaseAddon, n as AlertSchema, ri as EventCategory, ur as errMsg } from "../../dist-rbHhiEZA.mjs";
+import { Er as createEvent, J as alertsCapability, dr as BaseAddon, n as AlertSchema, ri as EventCategory, ur as errMsg } from "../../dist-ItJ3qAAA.mjs";
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Fr as isEvent, S as FIRST_LEVEL_MACRO_CLASSES, Z as bareAddonId, _n as ptzAutotrackCapability, dr as BaseAddon, ri as EventCategory, ur as errMsg } from "../../dist-rbHhiEZA.mjs";
+import { Fr as isEvent, S as FIRST_LEVEL_MACRO_CLASSES, Z as bareAddonId, _n as ptzAutotrackCapability, dr as BaseAddon, ri as EventCategory, ur as errMsg } from "../../dist-ItJ3qAAA.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
-const require_restore_archive = require("../../restore-archive-COzu_h0N.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
+const require_restore_archive = require("../../restore-archive-pSlTKRgU.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
-import { Ln as storageOccupancyCapability, Vr as nodePin, X as backupCapability, dr as BaseAddon, ei as toNodeId, ri as EventCategory, rn as mayWriteToLocation } from "../../dist-rbHhiEZA.mjs";
-import { a as BackupSnapshotRefusedError, c as BackupKeyFormatError, d as generateBackupKeyPair, f as parseBackupPublicKey, i as BackupCancelledError, n as precheckRestoreKey, o as SystemBackupService, p as parseBackupSecretKey, r as prepareRestoreArchive, u as ENCRYPTED_BACKUP_SUFFIX } from "../../restore-archive-DqozDqhZ.mjs";
+import { Ln as storageOccupancyCapability, Vr as nodePin, X as backupCapability, dr as BaseAddon, ei as toNodeId, ri as EventCategory, rn as mayWriteToLocation } from "../../dist-ItJ3qAAA.mjs";
+import { a as BackupSnapshotRefusedError, c as BackupKeyFormatError, d as generateBackupKeyPair, f as parseBackupPublicKey, i as BackupCancelledError, n as precheckRestoreKey, o as SystemBackupService, p as parseBackupSecretKey, r as prepareRestoreArchive, u as ENCRYPTED_BACKUP_SUFFIX } from "../../restore-archive-8F_M_wW0.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { dr as BaseAddon, p as CalendarPreferencesSchema, tt as calendarsCapability } from "../../dist-rbHhiEZA.mjs";
+import { dr as BaseAddon, p as CalendarPreferencesSchema, tt as calendarsCapability } from "../../dist-ItJ3qAAA.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { Er as createEvent, N as MOTION_CLOSE_AFTER_MS, Nr as hydrateSchema, Pn as snapshotCapability, Xn as buildFfmpegArgs, b as DeclaredDevices, dr as BaseAddon, ht as declarationOwnerNodeId, i as BaseDevice, in as memoizePinnedFfmpeg, lr as DeviceType, nt as cameraGridLayoutCapability, ri as EventCategory, sn as motionCapability, sr as DeviceFeature, ur as errMsg, y as DERIVED_CAMERA_SILENCED_CAP_NAMES, zn as streamCatalogCapability } from "../../dist-rbHhiEZA.mjs";
+import { Er as createEvent, N as MOTION_CLOSE_AFTER_MS, Nr as hydrateSchema, Pn as snapshotCapability, Xn as buildFfmpegArgs, b as DeclaredDevices, dr as BaseAddon, ht as declarationOwnerNodeId, i as BaseDevice, in as memoizePinnedFfmpeg, lr as DeviceType, nt as cameraGridLayoutCapability, ri as EventCategory, sn as motionCapability, sr as DeviceFeature, ur as errMsg, y as DERIVED_CAMERA_SILENCED_CAP_NAMES, zn as streamCatalogCapability } from "../../dist-ItJ3qAAA.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
-const require_composition_sources = require("../../composition-sources-BWt1BQhu.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
+const require_composition_sources = require("../../composition-sources-BX6Caql_.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as buildCapabilityLookup, $n as composedDeviceStableId, At as expressionContainsBuiltinCall, Dt as evaluateCompositionField, Er as createEvent, Qn as composedDeviceRef, Yn as COMPOSER_ADDON_ID, Zn as cloneStatefulExpressionMemory, ar as disarmRoseMemory, at as compositionFieldKey, b as DeclaredDevices, dr as BaseAddon, er as compositionFeatureEnabled, i as BaseDevice, ir as createStatefulExpressionMemory, it as composerCapability, l as COMPOSED_ITEM_FIXED_FIELDS, lr as DeviceType, mn as planComposition, nr as compositionSliceKey, or as toExpressionValue, ri as EventCategory, rr as compositionSourceKey, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionItemFieldPath, ur as errMsg } from "../../dist-rbHhiEZA.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-B9uGTwzQ.mjs";
+import { $ as buildCapabilityLookup, $n as composedDeviceStableId, At as expressionContainsBuiltinCall, Dt as evaluateCompositionField, Er as createEvent, Qn as composedDeviceRef, Yn as COMPOSER_ADDON_ID, Zn as cloneStatefulExpressionMemory, ar as disarmRoseMemory, at as compositionFieldKey, b as DeclaredDevices, dr as BaseAddon, er as compositionFeatureEnabled, i as BaseDevice, ir as createStatefulExpressionMemory, it as composerCapability, l as COMPOSED_ITEM_FIXED_FIELDS, lr as DeviceType, mn as planComposition, nr as compositionSliceKey, or as toExpressionValue, ri as EventCategory, rr as compositionSourceKey, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionItemFieldPath, ur as errMsg } from "../../dist-ItJ3qAAA.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-QndhKNb5.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Qt as logDestinationCapability, dr as BaseAddon } from "../../dist-rbHhiEZA.mjs";
+import { Qt as logDestinationCapability, dr as BaseAddon } from "../../dist-ItJ3qAAA.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
-const require_composition_sources = require("../../composition-sources-BWt1BQhu.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
+const require_composition_sources = require("../../composition-sources-BX6Caql_.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as buildCapabilityLookup, Cn as resolveCoreBlockFiles, Nr as hydrateSchema, Qn as composedDeviceRef, Sn as resolveCoreBlockEntry, Un as validateComposition, b as DeclaredDevices, cn as normalizeCoreBlockWrite, ct as coreBlockComposition, d as CORE_BLOCKS_ADDON_ID, dr as BaseAddon, dt as coreBlocksCapability, f as CORE_BLOCK_ADDON_PREFIX, lt as coreBlockIdFromAddonId, m as CoreBlockSchema, mn as planComposition, ot as compositionSourceRefs, rr as compositionSourceKey, st as coreBlockAddonId, t as ALL_CAPABILITY_DEFINITIONS, u as COMPOSER_RUNNER_ID, ur as errMsg, ut as coreBlockSourceKind, yn as replacedFieldKeys, yt as describeComposableCaps } from "../../dist-rbHhiEZA.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-B9uGTwzQ.mjs";
+import { $ as buildCapabilityLookup, Cn as resolveCoreBlockFiles, Nr as hydrateSchema, Qn as composedDeviceRef, Sn as resolveCoreBlockEntry, Un as validateComposition, b as DeclaredDevices, cn as normalizeCoreBlockWrite, ct as coreBlockComposition, d as CORE_BLOCKS_ADDON_ID, dr as BaseAddon, dt as coreBlocksCapability, f as CORE_BLOCK_ADDON_PREFIX, lt as coreBlockIdFromAddonId, m as CoreBlockSchema, mn as planComposition, ot as compositionSourceRefs, rr as compositionSourceKey, st as coreBlockAddonId, t as ALL_CAPABILITY_DEFINITIONS, u as COMPOSER_RUNNER_ID, ur as errMsg, ut as coreBlockSourceKind, yn as replacedFieldKeys, yt as describeComposableCaps } from "../../dist-ItJ3qAAA.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-QndhKNb5.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-WcubTmKK.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-D3E47aR_.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { $r as sleep$1, C as FieldClaimModeSchema, Ct as deviceStatusCapability, Et as enumerateSchemaFields, Ir as isKeychainStoredField, Jr as resolveSecretMarkers, Lr as isSecretClear, Nn as siteZoneKey, On as runtimeStatePolicyFor, Pr as isDeviceConfigCap, Pt as formatMinutes, R as STREAM_PROFILE_META, Rr as isSecretMarker, St as deviceStateCapability, Tr as collectZodSecretPaths, Tt as enumerateItemArrayFields, Zr as secretTreeFromPaths, Zt as locationIconKey, _t as defineExtensionSlotProvider, bt as deviceExtensionCapability, c as CAP_NAMES_WITH_STATUS, cr as DeviceRole, dr as BaseAddon, et as buildStreamParamsConfigSchema, fn as parseStreamParamsFormPatch, ft as createDeviceExtensionProvider, j as MINUTES_PER_DAY, k as LocationIconIdSchema, kt as expandContainer, ln as normalizeUnit, lr as DeviceType, ni as transformSecretWrite, o as CAMERA_SWITCH_ORDER, qt as legacyAutoLinkIds, ri as EventCategory, sr as DeviceFeature, t as ALL_CAPABILITY_DEFINITIONS, ti as toSecretFieldView, ur as errMsg, v as DAY_NAMES, vr as SECRET_CLEAR, w as FieldClaimSchema, x as DeviceStatusSchema, xt as deviceManagerCapability, yr as WELL_KNOWN_TAB_MAP, zr as isSecretMarkerLike } from "../../dist-rbHhiEZA.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-BtpL65F2.mjs";
+import { $r as sleep$1, C as FieldClaimModeSchema, Ct as deviceStatusCapability, Et as enumerateSchemaFields, Ir as isKeychainStoredField, Jr as resolveSecretMarkers, Lr as isSecretClear, Nn as siteZoneKey, On as runtimeStatePolicyFor, Pr as isDeviceConfigCap, Pt as formatMinutes, R as STREAM_PROFILE_META, Rr as isSecretMarker, St as deviceStateCapability, Tr as collectZodSecretPaths, Tt as enumerateItemArrayFields, Zr as secretTreeFromPaths, Zt as locationIconKey, _t as defineExtensionSlotProvider, bt as deviceExtensionCapability, c as CAP_NAMES_WITH_STATUS, cr as DeviceRole, dr as BaseAddon, et as buildStreamParamsConfigSchema, fn as parseStreamParamsFormPatch, ft as createDeviceExtensionProvider, j as MINUTES_PER_DAY, k as LocationIconIdSchema, kt as expandContainer, ln as normalizeUnit, lr as DeviceType, ni as transformSecretWrite, o as CAMERA_SWITCH_ORDER, qt as legacyAutoLinkIds, ri as EventCategory, sr as DeviceFeature, t as ALL_CAPABILITY_DEFINITIONS, ti as toSecretFieldView, ur as errMsg, v as DAY_NAMES, vr as SECRET_CLEAR, w as FieldClaimSchema, x as DeviceStatusSchema, xt as deviceManagerCapability, yr as WELL_KNOWN_TAB_MAP, zr as isSecretMarkerLike } from "../../dist-ItJ3qAAA.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CbkMnFXg.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Qt as logDestinationCapability, dr as BaseAddon } from "../../dist-rbHhiEZA.mjs";
+import { Qt as logDestinationCapability, dr as BaseAddon } from "../../dist-ItJ3qAAA.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
-const require_jwt_signing_key = require("../../jwt-signing-key-DiBm2MuN.js");
-const require_constants = require("../../constants-Dq3Xlo3-.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
+const require_jwt_signing_key = require("../../jwt-signing-key-CST1LdM6.js");
+const require_constants = require("../../constants-CMXQ1QIC.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { E as KEYCHAIN_RESET_TRIGGER_ACTOR, Gr as parseSecretRef, Gt as keychainAdminCapability, Hr as normalizeSecretOwner, Kt as keychainCapability, Mr as formatSecretScope, dr as BaseAddon, ri as EventCategory } from "../../dist-rbHhiEZA.mjs";
-import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-2T2J63Bz.mjs";
-import { a as MESH_CA_KEY_REF, p as CLUSTER_SECRET_SETTINGS_KEY } from "../../constants-WWxjfUOV.mjs";
+import { E as KEYCHAIN_RESET_TRIGGER_ACTOR, Gr as parseSecretRef, Gt as keychainAdminCapability, Hr as normalizeSecretOwner, Kt as keychainCapability, Mr as formatSecretScope, dr as BaseAddon, ri as EventCategory } from "../../dist-ItJ3qAAA.mjs";
+import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-CpMSrZuI.mjs";
+import { a as MESH_CA_KEY_REF, p as CLUSTER_SECRET_SETTINGS_KEY } from "../../constants-vMEWqCqG.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Er as createEvent, I as RecordingStatusSchema, P as RECORDING_SOURCE_CAMSTACK_ADDON, dr as BaseAddon, ri as EventCategory, ur as errMsg } from "../../dist-rbHhiEZA.mjs";
+import { Er as createEvent, I as RecordingStatusSchema, P as RECORDING_SOURCE_CAMSTACK_ADDON, dr as BaseAddon, ri as EventCategory, ur as errMsg } from "../../dist-ItJ3qAAA.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 const require_ms$1 = require("../../ms-t68_FaqE.js");
-const require_jwt_signing_key = require("../../jwt-signing-key-DiBm2MuN.js");
+const require_jwt_signing_key = require("../../jwt-signing-key-CST1LdM6.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -6349,11 +6349,20 @@ var ScopedTokenManager = class {
 		}
 		return false;
 	}
+	/**
+	* Delete the token row. `true` when a row was removed; `false` when the id
+	* was already gone (unknown or previously revoked).
+	*/
 	async revoke(tokenId) {
+		if ((await this.store.query.query({
+			collection: TOKENS_COLLECTION,
+			filter: { where: { id: tokenId } }
+		})).length === 0) return false;
 		await this.store.delete.mutate({
 			collection: TOKENS_COLLECTION,
 			key: tokenId
 		});
+		return true;
 	}
 	async listForUser(userId) {
 		return (await this.store.query.query({
@@ -7138,10 +7147,11 @@ var RETENTION_MS = 90 * 864e5;
 var MAX_LIST = 500;
 function parseRecord(data) {
 	const id = data["id"];
-	const at = data["at"];
+	const rawAt = data["at"];
+	const at = typeof rawAt === "number" ? rawAt : typeof rawAt === "string" && rawAt.trim() !== "" && Number.isFinite(Number(rawAt)) ? Number(rawAt) : null;
 	const action = data["action"];
 	const known = AUTH_AUDIT_ACTIONS.find((a) => a === action);
-	if (typeof id !== "string" || typeof at !== "number" || known === void 0) return null;
+	if (typeof id !== "string" || at === null || known === void 0) return null;
 	let detail;
 	if (typeof data["detail"] === "string") try {
 		const parsed = JSON.parse(data["detail"]);
@@ -10641,6 +10651,19 @@ var OauthSessionManager = class {
 		return true;
 	}
 	/**
+	* Delete one session row. Used by hub bulk revoke when the link is already
+	* revoked ("Remove revoked"): absence fails closed the same way as a
+	* revoked row, so dropping it only clears the list.
+	*/
+	async remove(id) {
+		if (await this.getById(id) === null) return false;
+		await this.store.delete.mutate({
+			collection: SESSIONS_COLLECTION,
+			key: id
+		});
+		return true;
+	}
+	/**
 	* Delete sessions revoked longer ago than `horizonMs`.
 	*
 	* Safe because an ABSENT session already fails closed exactly like a revoked
@@ -10899,8 +10922,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			},
 			revokeScopedToken: async (input) => {
 				if (!this.scopedTokenManager) throw new Error("Scoped token management not available");
-				await this.scopedTokenManager.revoke(input.id);
-				return { success: true };
+				return { success: await this.scopedTokenManager.revoke(input.id) };
 			},
 			validateScopedToken: async (input) => {
 				if (!this.scopedTokenManager || !this.userManager) return null;
@@ -11031,6 +11053,14 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 				list: async () => this.adminTokens === null ? [] : this.adminTokens.list(),
 				revoke: async (id) => this.adminTokens === null ? false : this.adminTokens.revoke(id)
 			},
+			scopedTokens: { revoke: async (id) => this.scopedTokenManager === null ? false : this.scopedTokenManager.revoke(id) },
+			oauthSessions: { revoke: async (id) => {
+				if (this.oauthSessionManager === null) return false;
+				const session = await this.oauthSessionManager.getById(id);
+				if (session === null) return false;
+				if (session.revokedAt !== null) return this.oauthSessionManager.remove(id);
+				return this.oauthSessionManager.markRevoked(id);
+			} },
 			audit: {
 				record: async (event) => {
 					await this.auditLog?.record(event);

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,7 +1,7 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Hn as userManagementCapability, W as UserRecordSchema, Y as authProviderCapability, dr as BaseAddon, r as ApiKeyRecordSchema, z as ScopedTokenSchema } from "../../dist-rbHhiEZA.mjs";
+import { Hn as userManagementCapability, W as UserRecordSchema, Y as authProviderCapability, dr as BaseAddon, r as ApiKeyRecordSchema, z as ScopedTokenSchema } from "../../dist-ItJ3qAAA.mjs";
 import { n as require_safe_buffer, t as require_ms } from "../../ms-DlIWNkkk.mjs";
-import { a as loadJwtSigningKey, i as getProcessJwtSigningKeyState, o as processJwtSigningKey, s as setProcessJwtSigningKey, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-2T2J63Bz.mjs";
+import { a as loadJwtSigningKey, i as getProcessJwtSigningKeyState, o as processJwtSigningKey, s as setProcessJwtSigningKey, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-CpMSrZuI.mjs";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -6339,11 +6339,20 @@ var ScopedTokenManager = class {
 		}
 		return false;
 	}
+	/**
+	* Delete the token row. `true` when a row was removed; `false` when the id
+	* was already gone (unknown or previously revoked).
+	*/
 	async revoke(tokenId) {
+		if ((await this.store.query.query({
+			collection: TOKENS_COLLECTION,
+			filter: { where: { id: tokenId } }
+		})).length === 0) return false;
 		await this.store.delete.mutate({
 			collection: TOKENS_COLLECTION,
 			key: tokenId
 		});
+		return true;
 	}
 	async listForUser(userId) {
 		return (await this.store.query.query({
@@ -7128,10 +7137,11 @@ var RETENTION_MS = 90 * 864e5;
 var MAX_LIST = 500;
 function parseRecord(data) {
 	const id = data["id"];
-	const at = data["at"];
+	const rawAt = data["at"];
+	const at = typeof rawAt === "number" ? rawAt : typeof rawAt === "string" && rawAt.trim() !== "" && Number.isFinite(Number(rawAt)) ? Number(rawAt) : null;
 	const action = data["action"];
 	const known = AUTH_AUDIT_ACTIONS.find((a) => a === action);
-	if (typeof id !== "string" || typeof at !== "number" || known === void 0) return null;
+	if (typeof id !== "string" || at === null || known === void 0) return null;
 	let detail;
 	if (typeof data["detail"] === "string") try {
 		const parsed = JSON.parse(data["detail"]);
@@ -10631,6 +10641,19 @@ var OauthSessionManager = class {
 		return true;
 	}
 	/**
+	* Delete one session row. Used by hub bulk revoke when the link is already
+	* revoked ("Remove revoked"): absence fails closed the same way as a
+	* revoked row, so dropping it only clears the list.
+	*/
+	async remove(id) {
+		if (await this.getById(id) === null) return false;
+		await this.store.delete.mutate({
+			collection: SESSIONS_COLLECTION,
+			key: id
+		});
+		return true;
+	}
+	/**
 	* Delete sessions revoked longer ago than `horizonMs`.
 	*
 	* Safe because an ABSENT session already fails closed exactly like a revoked
@@ -10889,8 +10912,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			},
 			revokeScopedToken: async (input) => {
 				if (!this.scopedTokenManager) throw new Error("Scoped token management not available");
-				await this.scopedTokenManager.revoke(input.id);
-				return { success: true };
+				return { success: await this.scopedTokenManager.revoke(input.id) };
 			},
 			validateScopedToken: async (input) => {
 				if (!this.scopedTokenManager || !this.userManager) return null;
@@ -11021,6 +11043,14 @@ var LocalAuthAddon = class extends BaseAddon {
 				list: async () => this.adminTokens === null ? [] : this.adminTokens.list(),
 				revoke: async (id) => this.adminTokens === null ? false : this.adminTokens.revoke(id)
 			},
+			scopedTokens: { revoke: async (id) => this.scopedTokenManager === null ? false : this.scopedTokenManager.revoke(id) },
+			oauthSessions: { revoke: async (id) => {
+				if (this.oauthSessionManager === null) return false;
+				const session = await this.oauthSessionManager.getById(id);
+				if (session === null) return false;
+				if (session.revokedAt !== null) return this.oauthSessionManager.remove(id);
+				return this.oauthSessionManager.markRevoked(id);
+			} },
 			audit: {
 				record: async (event) => {
 					await this.auditLog?.record(event);

package/dist/builtins/local-auth/oauth-session-manager.d.ts

@@ -41,6 +41,12 @@ export declare class OauthSessionManager {
 	*/
 	markRevoked(id: string): Promise<boolean>;
 	/**
+	* Delete one session row. Used by hub bulk revoke when the link is already
+	* revoked ("Remove revoked"): absence fails closed the same way as a
+	* revoked row, so dropping it only clears the list.
+	*/
+	remove(id: string): Promise<boolean>;
+	/**
 	* Delete sessions revoked longer ago than `horizonMs`.
 	*
 	* Safe because an ABSENT session already fails closed exactly like a revoked

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 const require_tls = require("../../tls-BWpwU-d5.js");
 let zod = require("zod");
 let node_net = require("node:net");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Bt as isDefaultAppConnectionEndpoint, Dn as resolveNotificationTapAddress, Lt as isAppLinkBase, Wn as validateCustomAddress, Xt as localNetworkCapability, bn as resolveAppConnections, dr as BaseAddon, pn as pickAppLinkHub, ri as EventCategory, rt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, wn as resolveHubAddressRoles } from "../../dist-rbHhiEZA.mjs";
+import { Bt as isDefaultAppConnectionEndpoint, Dn as resolveNotificationTapAddress, Lt as isAppLinkBase, Wn as validateCustomAddress, Xt as localNetworkCapability, bn as resolveAppConnections, dr as BaseAddon, pn as pickAppLinkHub, ri as EventCategory, rt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, wn as resolveHubAddressRoles } from "../../dist-ItJ3qAAA.mjs";
 import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-C2NT-Orr.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Qt as logDestinationCapability, dr as BaseAddon } from "../../dist-rbHhiEZA.mjs";
+import { Qt as logDestinationCapability, dr as BaseAddon } from "../../dist-ItJ3qAAA.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Er as createEvent, Nt as foldSnapshotByFunction, an as metricsProviderCapability, dr as BaseAddon, ri as EventCategory, ur as errMsg, vn as reducePoints, xn as resolveBucketMs } from "../../dist-rbHhiEZA.mjs";
+import { Er as createEvent, Nt as foldSnapshotByFunction, an as metricsProviderCapability, dr as BaseAddon, ri as EventCategory, ur as errMsg, vn as reducePoints, xn as resolveBucketMs } from "../../dist-ItJ3qAAA.mjs";
 import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Ar as emitReadiness, dr as BaseAddon, hn as platformProbeCapability, jn as scoreRuntimes, ri as EventCategory, ur as errMsg, wt as enumerateInferenceDevices } from "../../dist-rbHhiEZA.mjs";
+import { Ar as emitReadiness, dr as BaseAddon, hn as platformProbeCapability, jn as scoreRuntimes, ri as EventCategory, ur as errMsg, wt as enumerateInferenceDevices } from "../../dist-ItJ3qAAA.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { dr as BaseAddon, ri as EventCategory } from "../../dist-rbHhiEZA.mjs";
+import { dr as BaseAddon, ri as EventCategory } from "../../dist-ItJ3qAAA.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Bn as streamQualityLabel, Pn as snapshotCapability, Q as batteryCapability, Vr as nodePin, Z as bareAddonId, a as BatteryStatusSchema, dr as BaseAddon, in as memoizePinnedFfmpeg, lr as DeviceType, ri as EventCategory, sr as DeviceFeature, ur as errMsg, vt as deriveBatteryPresence } from "../../dist-rbHhiEZA.mjs";
+import { Bn as streamQualityLabel, Pn as snapshotCapability, Q as batteryCapability, Vr as nodePin, Z as bareAddonId, a as BatteryStatusSchema, dr as BaseAddon, in as memoizePinnedFfmpeg, lr as DeviceType, ri as EventCategory, sr as DeviceFeature, ur as errMsg, vt as deriveBatteryPresence } from "../../dist-ItJ3qAAA.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as filesystemBrowseCapability, Rn as storageProviderCapability, dr as BaseAddon } from "../../dist-rbHhiEZA.mjs";
+import { Mt as filesystemBrowseCapability, Rn as storageProviderCapability, dr as BaseAddon } from "../../dist-ItJ3qAAA.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 const require_hub_cap_forward = require("../../hub-cap-forward-W8oEm4ME.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { B as StorageCleanupJobSchema, Fn as storageCapability, Ft as gbToBytes, H as StorageLocationTypeSchema, In as storageMigrationCapability, Jn as withLocationMode, Jr as resolveSecretMarkers, Jt as legacyModeOf, Mn as settingsStoreCapability, O as LegacyStorageLocationDefaultSchema, Ot as evictionPolicyOfLocation, Rr as isSecretMarker, Tn as resolveLocationMode, U as StorageMigrationJobSchema, Ur as parseJsonObject, V as StorageLocationModeSchema, Vt as isLocationEnabled, Zr as secretTreeFromPaths, dr as BaseAddon, hr as REDACTED_SECRET, ni as transformSecretWrite, nn as mayReadLocation, on as modeMayWrite, ri as EventCategory, rn as mayWriteToLocation, wr as collectSecretConfigKeys } from "../../dist-rbHhiEZA.mjs";
+import { B as StorageCleanupJobSchema, Fn as storageCapability, Ft as gbToBytes, H as StorageLocationTypeSchema, In as storageMigrationCapability, Jn as withLocationMode, Jr as resolveSecretMarkers, Jt as legacyModeOf, Mn as settingsStoreCapability, O as LegacyStorageLocationDefaultSchema, Ot as evictionPolicyOfLocation, Rr as isSecretMarker, Tn as resolveLocationMode, U as StorageMigrationJobSchema, Ur as parseJsonObject, V as StorageLocationModeSchema, Vt as isLocationEnabled, Zr as secretTreeFromPaths, dr as BaseAddon, hr as REDACTED_SECRET, ni as transformSecretWrite, nn as mayReadLocation, on as modeMayWrite, ri as EventCategory, rn as mayWriteToLocation, wr as collectSecretConfigKeys } from "../../dist-ItJ3qAAA.mjs";
 import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-CDiN1p98.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 const require_ms$1 = require("../../ms-t68_FaqE.js");
-const require_constants$8 = require("../../constants-Dq3Xlo3-.js");
+const require_constants$8 = require("../../constants-CMXQ1QIC.js");
 const require_x509_es = require("../../x509.es-BhTzcFhZ.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,7 +1,7 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Br as makeSecretMarker, Dr as customAction, Lr as isSecretClear, Nr as hydrateSchema, Or as defineCustomActions, Qr as secretTreeFromSchema, Rr as isSecretMarker, dr as BaseAddon, ni as transformSecretWrite, ur as errMsg } from "../../dist-rbHhiEZA.mjs";
+import { Br as makeSecretMarker, Dr as customAction, Lr as isSecretClear, Nr as hydrateSchema, Or as defineCustomActions, Qr as secretTreeFromSchema, Rr as isSecretMarker, dr as BaseAddon, ni as transformSecretWrite, ur as errMsg } from "../../dist-ItJ3qAAA.mjs";
 import { n as require_safe_buffer, t as require_ms } from "../../ms-DlIWNkkk.mjs";
-import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-WWxjfUOV.mjs";
+import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-vMEWqCqG.mjs";
 import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-Xf3K_brW.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createHmac, randomBytes, timingSafeEqual, webcrypto } from "node:crypto";

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CpYg1PaO.js");
+const require_dist = require("../../dist-BcnmH70Z.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Qt as logDestinationCapability, dr as BaseAddon } from "../../dist-rbHhiEZA.mjs";
+import { Qt as logDestinationCapability, dr as BaseAddon } from "../../dist-ItJ3qAAA.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{child-cap-dispatch-DIXACzJZ.mjs → child-cap-dispatch-CpYnlLNt.mjs}

@@ -1,4 +1,4 @@
-import { Er as createEvent, Xr as scrubKnownSecrets, ri as EventCategory$1, tn as maskUrlCredentials } from "./dist-rbHhiEZA.mjs";
+import { Er as createEvent, Xr as scrubKnownSecrets, ri as EventCategory$1, tn as maskUrlCredentials } from "./dist-ItJ3qAAA.mjs";
 import { a as parseProcStat, i as nodeProcReader } from "./proc-stat-CbC55Kqi.mjs";
 import "./hub-cap-forward-CDiN1p98.mjs";
 import * as crypto$1 from "node:crypto";

package/dist/{child-cap-dispatch-DpQYxjCT.js → child-cap-dispatch-fnYkJDjG.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CpYg1PaO.js");
+const require_dist = require("./dist-BcnmH70Z.js");
 const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
 require("./hub-cap-forward-W8oEm4ME.js");
 let node_crypto = require("node:crypto");

package/dist/{composition-sources-BWt1BQhu.js → composition-sources-BX6Caql_.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CpYg1PaO.js");
+const require_dist = require("./dist-BcnmH70Z.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-B9uGTwzQ.mjs → composition-sources-QndhKNb5.mjs}

@@ -1,4 +1,4 @@
-import { rr as compositionSourceKey, ur as errMsg } from "./dist-rbHhiEZA.mjs";
+import { rr as compositionSourceKey, ur as errMsg } from "./dist-ItJ3qAAA.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-Dq3Xlo3-.js → constants-CMXQ1QIC.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CpYg1PaO.js");
+const require_dist = require("./dist-BcnmH70Z.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{constants-WWxjfUOV.mjs → constants-vMEWqCqG.mjs}

@@ -1,4 +1,4 @@
-import { Cr as buildSecretRef } from "./dist-rbHhiEZA.mjs";
+import { Cr as buildSecretRef } from "./dist-ItJ3qAAA.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{dist-CpYg1PaO.js → dist-BcnmH70Z.js}

@@ -11558,7 +11558,14 @@ var BrokerProviderInfoSchema = zod.z.object({
 	/** Broker kinds this provider can create, with a display label. */
 	kinds: zod.z.array(zod.z.object({
 		kind: zod.z.string(),
-		label: zod.z.string()
+		label: zod.z.string(),
+		/**
+		* Relative hub path to start an interactive account link (OAuth popup).
+		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
+		*/
+		interactiveConnectPath: zod.z.string().min(1).optional(),
+		/** Relative hub path to disconnect the linked account (same popup pattern). */
+		interactiveDisconnectPath: zod.z.string().min(1).optional()
 	}))
 });
 var ListInputSchema = zod.z.object({ 

package/dist/{dist-rbHhiEZA.mjs → dist-ItJ3qAAA.mjs}

@@ -11558,7 +11558,14 @@ var BrokerProviderInfoSchema = z.object({
 	/** Broker kinds this provider can create, with a display label. */
 	kinds: z.array(z.object({
 		kind: z.string(),
-		label: z.string()
+		label: z.string(),
+		/**
+		* Relative hub path to start an interactive account link (OAuth popup).
+		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
+		*/
+		interactiveConnectPath: z.string().min(1).optional(),
+		/** Relative hub path to disconnect the linked account (same popup pattern). */
+		interactiveDisconnectPath: z.string().min(1).optional()
 	}))
 });
 var ListInputSchema = z.object({ 

package/dist/{event-loop-stall-monitor-dbJ_rR8a.mjs → event-loop-stall-monitor-CogzcENb.mjs}

@@ -1,4 +1,4 @@
-import { It as hfModelUrl, M as MODEL_FORMATS, T as HF_REPO } from "./dist-rbHhiEZA.mjs";
+import { It as hfModelUrl, M as MODEL_FORMATS, T as HF_REPO } from "./dist-ItJ3qAAA.mjs";
 import { createHash } from "node:crypto";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{event-loop-stall-monitor-IeiQqOdV.js → event-loop-stall-monitor-DoFaUgFf.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CpYg1PaO.js");
+const require_dist = require("./dist-BcnmH70Z.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CpYg1PaO.js");
-const require_jwt_signing_key = require("./jwt-signing-key-DiBm2MuN.js");
+const require_dist = require("./dist-BcnmH70Z.js");
+const require_jwt_signing_key = require("./jwt-signing-key-CST1LdM6.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -27,17 +27,17 @@ const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage
 const require_hub_cap_forward = require("./hub-cap-forward-W8oEm4ME.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-Dq3Xlo3-.js");
+const require_constants = require("./constants-CMXQ1QIC.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
-const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-IeiQqOdV.js");
+const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-DoFaUgFf.js");
 const require_tls = require("./tls-BWpwU-d5.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-DpQYxjCT.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-fnYkJDjG.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-BgWGRxN5.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
-const require_restore_archive = require("./restore-archive-COzu_h0N.js");
+const require_restore_archive = require("./restore-archive-pSlTKRgU.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $t as logLevelAtMost, A as METHOD_ACCESS_MAP, An as scopesAllowDeviceCap, D as LOG_LEVEL_RANK, En as resolveMethodAuth, Er as createEvent, F as RUNTIME_DEFAULTS, Ht as isObjectInput, K as addonSettingsCapability, Kr as readinessKey, Rt as isArrayOutputSchema, Sr as asString$1, Ur as parseJsonObject, Ut as isVoidInput, Vn as supportedRuntimes, Wr as parseJsonUnknown, Wt as kebabToCamel, Yr as scopeKey, Yt as lifecycleJobSchema, _r as ReadinessTimeoutError, br as asJsonObject$1, dn as objectInputDeclaresRequiredDeviceId, en as looseSchema, fr as DATAPLANE_SECRET_HEADER$1, gn as procedureAuthKey, gr as ReadinessRegistry, jr as expandCapMethods, jt as extractNestedAddonId, kn as scopesAllowAddon, kr as emitDownForOwnedCaps, mr as DEVICE_STATUS_METHOD, pr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, qr as resolveCapMount, ri as EventCategory$1, t as ALL_CAPABILITY_DEFINITIONS, un as objectInputDeclaresAddonId, ur as errMsg$1, xr as asNumber, zt as isCollectionArrayMethod } from "./dist-rbHhiEZA.mjs";
-import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-2T2J63Bz.mjs";
+import { $t as logLevelAtMost, A as METHOD_ACCESS_MAP, An as scopesAllowDeviceCap, D as LOG_LEVEL_RANK, En as resolveMethodAuth, Er as createEvent, F as RUNTIME_DEFAULTS, Ht as isObjectInput, K as addonSettingsCapability, Kr as readinessKey, Rt as isArrayOutputSchema, Sr as asString$1, Ur as parseJsonObject, Ut as isVoidInput, Vn as supportedRuntimes, Wr as parseJsonUnknown, Wt as kebabToCamel, Yr as scopeKey, Yt as lifecycleJobSchema, _r as ReadinessTimeoutError, br as asJsonObject$1, dn as objectInputDeclaresRequiredDeviceId, en as looseSchema, fr as DATAPLANE_SECRET_HEADER$1, gn as procedureAuthKey, gr as ReadinessRegistry, jr as expandCapMethods, jt as extractNestedAddonId, kn as scopesAllowAddon, kr as emitDownForOwnedCaps, mr as DEVICE_STATUS_METHOD, pr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, qr as resolveCapMount, ri as EventCategory$1, t as ALL_CAPABILITY_DEFINITIONS, un as objectInputDeclaresAddonId, ur as errMsg$1, xr as asNumber, zt as isCollectionArrayMethod } from "./dist-ItJ3qAAA.mjs";
+import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-CpMSrZuI.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -26,17 +26,17 @@ import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { i as stripForwardedCaller, n as HUB_CAP_FWD_SERVICE, r as createHubCapForwardService, t as HUB_CAP_FWD_ACTION } from "./hub-cap-forward-CDiN1p98.mjs";
 import { StorageOrchestratorAddon, n as buildStorageLocationRegistry, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-WWxjfUOV.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-vMEWqCqG.mjs";
 import { A as AGENT_UI_UNLOCK_VERSION, B as parseMeshAuthMode, C as generateMeshKeyPair, D as AGENT_DASHBOARD_ORIGINS_FIELD, E as loadMeshCa, F as verifyAgentUiUnlockTicket, G as createCidrMatcher, H as setProcessMeshAuthMode, I as MESH_AUTH_MODE_FIELD, J as readCidrSetting, K as normalizeIp, L as getProcessMeshAuthMode, M as isAllowedAgentDashboardReturnTo, N as mintAgentUiUnlockTicket, O as AGENT_UI_UNLOCK_DOMAIN, P as parseAgentDashboardOrigins, R as getProcessMeshAuthStatus, S as generateMeshCa, SystemConfigAddon, T as issueMeshLeafFromCsr, U as setProcessMeshAuthStatusSource, V as requestProcessMeshEnforcement, W as setProcessMeshEnforcer, _ as requireProcessMeshCa, a as setProcessMeshTlsEnabler, b as createMeshCsrPem, c as mintMeshJoinToken, d as getProcessNodeMeshTransport, f as setProcessMeshPeerTransportLookup, g as getProcessMeshCaState, h as MeshCaKeeper, i as ServiceBroker, j as UnlockTicketJtiStore, k as AGENT_UI_UNLOCK_TTL_MS, l as processJoinTokenJtiStore, m as processMeshCrl, n as TlsTcpTransporter, o as enrollMeshNode, p as MeshCrl, q as parseCidrList, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as caFingerprint, w as issueMeshLeafForNode, x as exportMeshPrivateKeyPem, y as caFingerprintCompact, z as isMeshAuthMode } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
-import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-dbJ_rR8a.mjs";
+import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-CogzcENb.mjs";
 import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-C2NT-Orr.mjs";
-import { $ as AGENT_CAP_FWD_ACTION, $n as EMPTY_SOCKET_DIRECTION, $t as HEAP_WATCH_INTERVAL_MS, A as mapSignalsToInferenceHardware, An as DECISIVE_HEAP_SPACES, At as capServiceName, B as createParentUnownedCallHandler, Bn as createOutboundQueueGate, Bt as buildNpmChildEnv, C as getBrokerEventBus, Cn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, D as subscribePassthrough, Dn as createInspectorArrayBufferCensus, Dt as capActionName, E as setNodeEventInterest, En as createArrayBufferCensusGate, Et as NATIVE_PROVIDER_SERVICE_INFIX, F as brokerTransportLink, Fn as readHeapSpaces, Ft as CapabilityHandle, G as createUdsLoggerWithControl, Gn as EMPTY_SOCKET_PLANE_BASELINE, Gt as redactLogMeta, H as createUdsEventBus, Hn as MESH_QUEUE_TOP_N, Ht as runNpm, I as buildLinkChain, In as selectReportedSpaces, It as CapabilityUnavailableError, J as UDS_NO_ROUTE_PREFIX, Jn as createSocketPlaneMeter, Jt as hostNodeIdOf, K as LocalChildClient, Kn as SOCKET_PLANE_TOP_N, Kt as redactLogText, L as deviceCapResolverLink, Ln as OUTBOUND_QUEUE_COOLDOWN_MS, Lt as copyBundledNativeModules, M as probePlatform, Mn as emitHeapDiagnosticReport, Mt as deserializeTypedArrays, N as resolveHwAccel, Nn as formatHeapSpaces, Nt as serializeTypedArrays, O as AddonDepsManager, On as formatArrayBufferCensus, Ot as capActionSuffix, P as brokerCallForCap, Pn as heapSpaceField, Pt as DeviceRegistry, Q as deviceOfGetStatus, Qn as readSocketQueues, Qt as HEAP_RECLAIM_TRIGGER_MB, R as ipcParentLink, Rn as OUTBOUND_QUEUE_SUSTAIN_MS, Rt as installManifestNativeDeps, S as clusterEventTopic, Sn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, St as mountNativeCapService, T as registerEventBusService, Tn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, Tt as validateProviderRegistrations, U as udsChildLogToWorkerEntry, Un as createMeshQueueReader, Ut as isCredentialKeyName, V as createUdsEventBridge, Vn as formatOutboundQueueVerdict, Vt as resolveNpmInvocation, W as createUdsLogger, Wn as formatMeshQueue, Wt as redactLogEntry, X as GET_STATUS_METHOD, Xn as diffSocketPlane, Xt as HEAP_RECLAIM_MIN_INTERVAL_MS, Y as afterWorkerOnlineAnnounce, Yn as createSocketPlaneReader, Yt as createAddonDataPlaneFacility, Z as answerClaimedGetStatus, Zn as formatSocketPlane, Zt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, _ as getWorkerDeviceRegistry, _n as reclaimIntervalMs, _t as encodeFrame, a as reapProcessGroup, an as RSS_BUDGET_RELEASE_RATIO, ar as CAP_ACTION_OVERFLOW_LABEL, at as callWithServiceDiscovery, b as setHubConnected, bn as startRunnerHeapWatch, c as runnerOwnsProcessGroup, cn as ZERO_LOOP_DELAY, cr as MAX_CAP_ACTIONS_PER_PEER, ct as __resetCapUsageRegistryForTests, d as summarizeMembers, dn as createLoopDelayMeter, dr as diffCapActionCensus, dt as UdsLocalTransportClient, en as HEAP_WATCH_WARN_RATIO, er as createSocketDirectionCounters, et as AGENT_CAP_FWD_SERVICE, f as installManifestSystemDeps, fn as createV8Reclaimer, fr as EVENT_PLANE_TOP_N, ft as UdsLocalTransportServer, g as createUdsAddonContext, gn as parseRssBudgetMb, gr as formatEventPlane, gt as FrameDecoder, h as createAddonContext, hn as nextRssBudgetState, hr as diffEventPlane, ht as localEndpointPath, in as RSS_BUDGET_REANNOUNCE_MIN_MS, ir as socketDirectionMessages, it as classifyCapRoute, j as createKernelHwAccel, jn as HEAP_SPACE_REPORT_MIN_MB, jt as parseCapAction, k as createKernelInferenceEngine, kn as isArrayBufferCensusReport, kt as capBareAction, l as signalAllRunnerGroups, ln as buildHeapSample, lr as capActionLabel, lt as getCapUsageRegistry, m as adaptBrokerToCluster, mn as hubMainRssBudget, mr as createEventPlaneReader, mt as PeerAnsweredError, nn as HUB_MAIN_RSS_BUDGET_MB, nr as sampleSocketDirection, nt as stampCallerAddonId, o as registerRunnerGroup, on as RUNNER_HEAP_WATCH_INTERVAL_MS, or as CAP_ACTION_UNLABELLED, ot as CapUsageRegistry, p as installManifestPythonDeps, pn as describeRss, pr as createEventPlaneMeter, pt as SocketChannel, q as LocalChildRegistry, qn as SOCKET_QUEUE_TOP_N, qt as createAddonPeerBytesFacility, r as defaultProcessGroupOps, rn as HUB_RSS_BUDGET_ENV, rr as socketDirectionBytes, rt as CapRouteError, s as releaseRunnerGroup, sn as RUNNER_RSS_BUDGET_ENV, sr as EMPTY_CAP_ACTION_READING, st as PARENT_ROUTED_PROVIDER_ADDON_ID, t as CAP_METHOD_NOT_IMPLEMENTED, tn as HUB_MAIN_HEAP_WATCH_LABEL, tr as recordSocketFrame, tt as CapRouteResolver, un as createDeferredHeapWatchSink, ur as createCapActionCensus, ut as createLocalTransport, v as getOrInitReadinessRegistry, vn as shouldReclaim, vt as buildNativeCapProxy, w as getMoleculerEventStats, wn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, wt as createAddonService, x as EVENT_TOPIC_PREFIX, xn as strandedMb, y as getOrInitReadinessRegistryForClient, yn as startHeapWatch, yt as createBrokerDeviceManagerApi, z as localProviderLink, zn as OUTBOUND_QUEUE_THRESHOLD_BYTES, zt as resolveAddonClass } from "./child-cap-dispatch-DIXACzJZ.mjs";
+import { $ as AGENT_CAP_FWD_ACTION, $n as EMPTY_SOCKET_DIRECTION, $t as HEAP_WATCH_INTERVAL_MS, A as mapSignalsToInferenceHardware, An as DECISIVE_HEAP_SPACES, At as capServiceName, B as createParentUnownedCallHandler, Bn as createOutboundQueueGate, Bt as buildNpmChildEnv, C as getBrokerEventBus, Cn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, D as subscribePassthrough, Dn as createInspectorArrayBufferCensus, Dt as capActionName, E as setNodeEventInterest, En as createArrayBufferCensusGate, Et as NATIVE_PROVIDER_SERVICE_INFIX, F as brokerTransportLink, Fn as readHeapSpaces, Ft as CapabilityHandle, G as createUdsLoggerWithControl, Gn as EMPTY_SOCKET_PLANE_BASELINE, Gt as redactLogMeta, H as createUdsEventBus, Hn as MESH_QUEUE_TOP_N, Ht as runNpm, I as buildLinkChain, In as selectReportedSpaces, It as CapabilityUnavailableError, J as UDS_NO_ROUTE_PREFIX, Jn as createSocketPlaneMeter, Jt as hostNodeIdOf, K as LocalChildClient, Kn as SOCKET_PLANE_TOP_N, Kt as redactLogText, L as deviceCapResolverLink, Ln as OUTBOUND_QUEUE_COOLDOWN_MS, Lt as copyBundledNativeModules, M as probePlatform, Mn as emitHeapDiagnosticReport, Mt as deserializeTypedArrays, N as resolveHwAccel, Nn as formatHeapSpaces, Nt as serializeTypedArrays, O as AddonDepsManager, On as formatArrayBufferCensus, Ot as capActionSuffix, P as brokerCallForCap, Pn as heapSpaceField, Pt as DeviceRegistry, Q as deviceOfGetStatus, Qn as readSocketQueues, Qt as HEAP_RECLAIM_TRIGGER_MB, R as ipcParentLink, Rn as OUTBOUND_QUEUE_SUSTAIN_MS, Rt as installManifestNativeDeps, S as clusterEventTopic, Sn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, St as mountNativeCapService, T as registerEventBusService, Tn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, Tt as validateProviderRegistrations, U as udsChildLogToWorkerEntry, Un as createMeshQueueReader, Ut as isCredentialKeyName, V as createUdsEventBridge, Vn as formatOutboundQueueVerdict, Vt as resolveNpmInvocation, W as createUdsLogger, Wn as formatMeshQueue, Wt as redactLogEntry, X as GET_STATUS_METHOD, Xn as diffSocketPlane, Xt as HEAP_RECLAIM_MIN_INTERVAL_MS, Y as afterWorkerOnlineAnnounce, Yn as createSocketPlaneReader, Yt as createAddonDataPlaneFacility, Z as answerClaimedGetStatus, Zn as formatSocketPlane, Zt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, _ as getWorkerDeviceRegistry, _n as reclaimIntervalMs, _t as encodeFrame, a as reapProcessGroup, an as RSS_BUDGET_RELEASE_RATIO, ar as CAP_ACTION_OVERFLOW_LABEL, at as callWithServiceDiscovery, b as setHubConnected, bn as startRunnerHeapWatch, c as runnerOwnsProcessGroup, cn as ZERO_LOOP_DELAY, cr as MAX_CAP_ACTIONS_PER_PEER, ct as __resetCapUsageRegistryForTests, d as summarizeMembers, dn as createLoopDelayMeter, dr as diffCapActionCensus, dt as UdsLocalTransportClient, en as HEAP_WATCH_WARN_RATIO, er as createSocketDirectionCounters, et as AGENT_CAP_FWD_SERVICE, f as installManifestSystemDeps, fn as createV8Reclaimer, fr as EVENT_PLANE_TOP_N, ft as UdsLocalTransportServer, g as createUdsAddonContext, gn as parseRssBudgetMb, gr as formatEventPlane, gt as FrameDecoder, h as createAddonContext, hn as nextRssBudgetState, hr as diffEventPlane, ht as localEndpointPath, in as RSS_BUDGET_REANNOUNCE_MIN_MS, ir as socketDirectionMessages, it as classifyCapRoute, j as createKernelHwAccel, jn as HEAP_SPACE_REPORT_MIN_MB, jt as parseCapAction, k as createKernelInferenceEngine, kn as isArrayBufferCensusReport, kt as capBareAction, l as signalAllRunnerGroups, ln as buildHeapSample, lr as capActionLabel, lt as getCapUsageRegistry, m as adaptBrokerToCluster, mn as hubMainRssBudget, mr as createEventPlaneReader, mt as PeerAnsweredError, nn as HUB_MAIN_RSS_BUDGET_MB, nr as sampleSocketDirection, nt as stampCallerAddonId, o as registerRunnerGroup, on as RUNNER_HEAP_WATCH_INTERVAL_MS, or as CAP_ACTION_UNLABELLED, ot as CapUsageRegistry, p as installManifestPythonDeps, pn as describeRss, pr as createEventPlaneMeter, pt as SocketChannel, q as LocalChildRegistry, qn as SOCKET_QUEUE_TOP_N, qt as createAddonPeerBytesFacility, r as defaultProcessGroupOps, rn as HUB_RSS_BUDGET_ENV, rr as socketDirectionBytes, rt as CapRouteError, s as releaseRunnerGroup, sn as RUNNER_RSS_BUDGET_ENV, sr as EMPTY_CAP_ACTION_READING, st as PARENT_ROUTED_PROVIDER_ADDON_ID, t as CAP_METHOD_NOT_IMPLEMENTED, tn as HUB_MAIN_HEAP_WATCH_LABEL, tr as recordSocketFrame, tt as CapRouteResolver, un as createDeferredHeapWatchSink, ur as createCapActionCensus, ut as createLocalTransport, v as getOrInitReadinessRegistry, vn as shouldReclaim, vt as buildNativeCapProxy, w as getMoleculerEventStats, wn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, wt as createAddonService, x as EVENT_TOPIC_PREFIX, xn as strandedMb, y as getOrInitReadinessRegistryForClient, yn as startHeapWatch, yt as createBrokerDeviceManagerApi, z as localProviderLink, zn as OUTBOUND_QUEUE_THRESHOLD_BYTES, zt as resolveAddonClass } from "./child-cap-dispatch-CpYnlLNt.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
-import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-DqozDqhZ.mjs";
+import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-8F_M_wW0.mjs";
 import { z } from "zod";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";

package/dist/{jwt-signing-key-DiBm2MuN.js → jwt-signing-key-CST1LdM6.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CpYg1PaO.js");
+const require_dist = require("./dist-BcnmH70Z.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{jwt-signing-key-2T2J63Bz.mjs → jwt-signing-key-CpMSrZuI.mjs}

@@ -1,4 +1,4 @@
-import { Cr as buildSecretRef } from "./dist-rbHhiEZA.mjs";
+import { Cr as buildSecretRef } from "./dist-ItJ3qAAA.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{restore-archive-DqozDqhZ.mjs → restore-archive-8F_M_wW0.mjs}

@@ -1,4 +1,4 @@
-import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-rbHhiEZA.mjs";
+import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-ItJ3qAAA.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{restore-archive-COzu_h0N.js → restore-archive-pSlTKRgU.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CpYg1PaO.js");
+const require_dist = require("./dist-BcnmH70Z.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{retired-settings-keys-BtpL65F2.mjs → retired-settings-keys-CbkMnFXg.mjs}

@@ -1,4 +1,4 @@
-import { br as asJsonObject } from "./dist-rbHhiEZA.mjs";
+import { br as asJsonObject } from "./dist-ItJ3qAAA.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-WcubTmKK.js → retired-settings-keys-D3E47aR_.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CpYg1PaO.js");
+const require_dist = require("./dist-BcnmH70Z.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.411",
+  "version": "1.2.413",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",