@camstack/system 1.2.420 → 1.2.421

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DLHPmdoV.js");
+const require_dist = require("../../dist-Df7s77se.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Xt as logDestinationCapability, cr as BaseAddon } from "../../dist-C0wYvAHC.mjs";
+import { Xt as logDestinationCapability, cr as BaseAddon } from "../../dist-0OD9ue39.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-562ib2dL.mjs → composition-sources-DoYpCPtl.mjs}

@@ -1,4 +1,4 @@
-import { er as compositionSourceKey, sr as errMsg } from "./dist-C0wYvAHC.mjs";
+import { er as compositionSourceKey, sr as errMsg } from "./dist-0OD9ue39.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-OaDYklhR.js → composition-sources-DxlTUSI1.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DLHPmdoV.js");
+const require_dist = require("./dist-Df7s77se.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-BeQWXybC.mjs → constants-CtxNK2QJ.mjs}

@@ -1,4 +1,4 @@
-import { xr as buildSecretRef } from "./dist-C0wYvAHC.mjs";
+import { xr as buildSecretRef } from "./dist-0OD9ue39.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{constants-ik5xtasS.js → constants-GXZQRcjB.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DLHPmdoV.js");
+const require_dist = require("./dist-Df7s77se.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{dist-C0wYvAHC.mjs → dist-0OD9ue39.mjs}

@@ -718,7 +718,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-vWTnHq9G.mjs
+//#region ../types/dist/sleep-B_3F_YwS.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -12004,6 +12004,16 @@ var BrokerClientsSchema = z.object({
 	/** Total encoded + raw-RTP callback subscriber count (sum of `encoded[].length`). */
 	encodedSubscribers: z.number()
 });
+/**
+* How many people are watching one camera LIVE right now — see
+* `getLiveViewerCounts`. A camera with nobody watching is absent from the list
+* (so `viewers` is always at least 1): the listing carries the cameras that
+* have viewers, never a row of zeros.
+*/
+var LiveViewerCountSchema = z.object({
+	deviceId: z.number().int().nonnegative(),
+	viewers: z.number().int().positive()
+});
 z.enum([
 	"reconnecting",
 	"sleeping",
@@ -12487,6 +12497,24 @@ var streamBrokerCapability = {
 			auth: "admin"
 		}),
 		listClients: method(z.object({ brokerId: z.string() }), BrokerClientsSchema),
+		/**
+		* People watching each camera LIVE right now, for every camera at once —
+		* cheap enough to poll (a walk of the live session maps, no I/O).
+		*
+		* Counts EXTERNAL viewers only: WebRTC sessions of a viewer kind
+		* (`webrtc-browser` / `-mobile` / `-whep`, `alexa`, `homekit`) that are on
+		* the live edge, plus RTSP restream clients from outside that are playing.
+		* The system's own consumers are never counted: the detection decoder, the
+		* recorder, snapshots, the prebuffer hold, audio analysis, and the RTSP
+		* dials an agent's derived broker makes. One WebRTC session or RTSP
+		* connection is one viewer, so two tabs on one camera read 2.
+		*
+		* The count is read off the live session maps at call time, so a session
+		* that ends — cleanly or by the peer vanishing — stops counting with no
+		* counter to leak. It covers the sessions THIS provider serves; a node
+		* with its own stream-broker is asked with a `nodeId` pin.
+		*/
+		getLiveViewerCounts: method(z.void(), z.array(LiveViewerCountSchema).readonly()),
 		killClient: method(z.object({
 			brokerId: z.string(),
 			channel: z.enum(["rtsp", "audio"]),
@@ -31304,6 +31332,12 @@ var CameraStepOverridePatchSchema = z.object({
 	settings: z.record(z.string(), z.unknown()).readonly().optional()
 });
 var CameraStepSettingsSchema = z.record(z.string(), z.record(z.string(), z.unknown()).readonly());
+/** The three root-detector choices a camera has (D507: at most one root). */
+var CameraDetectionSourceSchema = z.enum([
+	"pipeline",
+	"onboard",
+	"none"
+]);
 var CameraPipelineSettingsSchema = z.object({
 	stepToggles: z.record(z.string(), z.boolean()).optional(),
 	stepSettings: CameraStepSettingsSchema.optional(),
@@ -32232,6 +32266,41 @@ var pipelineOrchestratorCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Where this camera's first-level detections come from: this node's own
+		* root step (`pipeline`), the camera's onboard detector alone (`onboard`),
+		* or no root detector (`none`). A camera runs at most one root detector
+		* (D507), so there is no "both". Read from the camera's stored
+		* `detectionSources` — the one authority; `explicit` is false while the
+		* operator has never picked and the default stands.
+		*/
+		getCameraDetectionSource: method(z.object({ deviceId: z.number() }), z.object({
+			source: CameraDetectionSourceSchema,
+			explicit: z.boolean(),
+			onboard: z.object({
+				/** The camera has an onboard detector this system can read. */
+				available: z.boolean(),
+				/** What its detections carry — a camera with no box cannot be a root step. */
+				geometry: z.enum([
+					"boxed",
+					"while-streaming",
+					"flag-only",
+					"unknown"
+				])
+			})
+		})),
+		/**
+		* Pick where this camera's detections come from. Writes `detectionSources`
+		* and arms (or disarms) the vendor's boxed sub-stream that the choice
+		* drives. Refuses `onboard` on a camera with no onboard detector.
+		*/
+		setCameraDetectionSource: method(z.object({
+			deviceId: z.number(),
+			source: CameraDetectionSourceSchema
+		}), z.object({ success: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Read every per-(node,device) override map for a device. Null when device has no overrides. */
 		getCameraStepOverrides: method(z.object({ deviceId: z.number() }), z.record(z.string(), z.record(z.string(), z.record(z.string(), CameraStepOverridePatchSchema))).nullable()),
 		/**
@@ -42089,7 +42158,14 @@ var TopologyNodeSchema = z.object({
 	* completed a mutual-TLS handshake, `clear` otherwise. Absent for the hub,
 	* for offline rows and when the hub cannot tell.
 	*/
-	meshTransport: z.enum(["tls", "clear"]).optional()
+	meshTransport: z.enum(["tls", "clear"]).optional(),
+	/**
+	* Whether the hub holds this online AGENT's capability registration (its
+	* `registerNode` manifest). `false` = online in the mesh but not ready: the
+	* hub dropped the registration on a disconnect only it saw and the agent has
+	* not re-sent it. Absent for the hub and offline rows.
+	*/
+	capabilitiesRegistered: z.boolean().optional()
 });
 var CapUsageEdgeSchema = z.object({
 	callerAddonId: z.string(),
@@ -56425,6 +56501,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getCameraDetectionSource": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getCameraMetrics": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -56653,6 +56735,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraDetectionSource": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraPipelineForAgent": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -58105,6 +58193,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"streamBroker.getLiveViewerCounts": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"streamBroker.getPreBufferInfo": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -62510,6 +62604,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.getCameraDetectionSource": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.getCameraMetrics": [{
 		name: "deviceId",
 		form: "single",
@@ -62570,6 +62669,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.setCameraDetectionSource": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.setCameraPipelineForAgent": [{
 		name: "deviceId",
 		form: "single",

package/dist/{dist-DLHPmdoV.js → dist-Df7s77se.js}

@@ -718,7 +718,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-vWTnHq9G.mjs
+//#region ../types/dist/sleep-B_3F_YwS.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -12004,6 +12004,16 @@ var BrokerClientsSchema = zod.z.object({
 	/** Total encoded + raw-RTP callback subscriber count (sum of `encoded[].length`). */
 	encodedSubscribers: zod.z.number()
 });
+/**
+* How many people are watching one camera LIVE right now — see
+* `getLiveViewerCounts`. A camera with nobody watching is absent from the list
+* (so `viewers` is always at least 1): the listing carries the cameras that
+* have viewers, never a row of zeros.
+*/
+var LiveViewerCountSchema = zod.z.object({
+	deviceId: zod.z.number().int().nonnegative(),
+	viewers: zod.z.number().int().positive()
+});
 zod.z.enum([
 	"reconnecting",
 	"sleeping",
@@ -12487,6 +12497,24 @@ var streamBrokerCapability = {
 			auth: "admin"
 		}),
 		listClients: method(zod.z.object({ brokerId: zod.z.string() }), BrokerClientsSchema),
+		/**
+		* People watching each camera LIVE right now, for every camera at once —
+		* cheap enough to poll (a walk of the live session maps, no I/O).
+		*
+		* Counts EXTERNAL viewers only: WebRTC sessions of a viewer kind
+		* (`webrtc-browser` / `-mobile` / `-whep`, `alexa`, `homekit`) that are on
+		* the live edge, plus RTSP restream clients from outside that are playing.
+		* The system's own consumers are never counted: the detection decoder, the
+		* recorder, snapshots, the prebuffer hold, audio analysis, and the RTSP
+		* dials an agent's derived broker makes. One WebRTC session or RTSP
+		* connection is one viewer, so two tabs on one camera read 2.
+		*
+		* The count is read off the live session maps at call time, so a session
+		* that ends — cleanly or by the peer vanishing — stops counting with no
+		* counter to leak. It covers the sessions THIS provider serves; a node
+		* with its own stream-broker is asked with a `nodeId` pin.
+		*/
+		getLiveViewerCounts: method(zod.z.void(), zod.z.array(LiveViewerCountSchema).readonly()),
 		killClient: method(zod.z.object({
 			brokerId: zod.z.string(),
 			channel: zod.z.enum(["rtsp", "audio"]),
@@ -31304,6 +31332,12 @@ var CameraStepOverridePatchSchema = zod.z.object({
 	settings: zod.z.record(zod.z.string(), zod.z.unknown()).readonly().optional()
 });
 var CameraStepSettingsSchema = zod.z.record(zod.z.string(), zod.z.record(zod.z.string(), zod.z.unknown()).readonly());
+/** The three root-detector choices a camera has (D507: at most one root). */
+var CameraDetectionSourceSchema = zod.z.enum([
+	"pipeline",
+	"onboard",
+	"none"
+]);
 var CameraPipelineSettingsSchema = zod.z.object({
 	stepToggles: zod.z.record(zod.z.string(), zod.z.boolean()).optional(),
 	stepSettings: CameraStepSettingsSchema.optional(),
@@ -32232,6 +32266,41 @@ var pipelineOrchestratorCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Where this camera's first-level detections come from: this node's own
+		* root step (`pipeline`), the camera's onboard detector alone (`onboard`),
+		* or no root detector (`none`). A camera runs at most one root detector
+		* (D507), so there is no "both". Read from the camera's stored
+		* `detectionSources` — the one authority; `explicit` is false while the
+		* operator has never picked and the default stands.
+		*/
+		getCameraDetectionSource: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.object({
+			source: CameraDetectionSourceSchema,
+			explicit: zod.z.boolean(),
+			onboard: zod.z.object({
+				/** The camera has an onboard detector this system can read. */
+				available: zod.z.boolean(),
+				/** What its detections carry — a camera with no box cannot be a root step. */
+				geometry: zod.z.enum([
+					"boxed",
+					"while-streaming",
+					"flag-only",
+					"unknown"
+				])
+			})
+		})),
+		/**
+		* Pick where this camera's detections come from. Writes `detectionSources`
+		* and arms (or disarms) the vendor's boxed sub-stream that the choice
+		* drives. Refuses `onboard` on a camera with no onboard detector.
+		*/
+		setCameraDetectionSource: method(zod.z.object({
+			deviceId: zod.z.number(),
+			source: CameraDetectionSourceSchema
+		}), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Read every per-(node,device) override map for a device. Null when device has no overrides. */
 		getCameraStepOverrides: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.record(zod.z.string(), zod.z.record(zod.z.string(), zod.z.record(zod.z.string(), CameraStepOverridePatchSchema))).nullable()),
 		/**
@@ -42089,7 +42158,14 @@ var TopologyNodeSchema = zod.z.object({
 	* completed a mutual-TLS handshake, `clear` otherwise. Absent for the hub,
 	* for offline rows and when the hub cannot tell.
 	*/
-	meshTransport: zod.z.enum(["tls", "clear"]).optional()
+	meshTransport: zod.z.enum(["tls", "clear"]).optional(),
+	/**
+	* Whether the hub holds this online AGENT's capability registration (its
+	* `registerNode` manifest). `false` = online in the mesh but not ready: the
+	* hub dropped the registration on a disconnect only it saw and the agent has
+	* not re-sent it. Absent for the hub and offline rows.
+	*/
+	capabilitiesRegistered: zod.z.boolean().optional()
 });
 var CapUsageEdgeSchema = zod.z.object({
 	callerAddonId: zod.z.string(),
@@ -56425,6 +56501,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getCameraDetectionSource": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getCameraMetrics": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -56653,6 +56735,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraDetectionSource": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraPipelineForAgent": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -58105,6 +58193,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"streamBroker.getLiveViewerCounts": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"streamBroker.getPreBufferInfo": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -62510,6 +62604,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.getCameraDetectionSource": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.getCameraMetrics": [{
 		name: "deviceId",
 		form: "single",
@@ -62570,6 +62669,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.setCameraDetectionSource": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.setCameraPipelineForAgent": [{
 		name: "deviceId",
 		form: "single",

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DLHPmdoV.js");
-const require_jwt_signing_key = require("./jwt-signing-key-CWmNKLQi.js");
+const require_dist = require("./dist-Df7s77se.js");
+const require_jwt_signing_key = require("./jwt-signing-key-BmyvxlDJ.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -26,7 +26,7 @@ const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtin
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-ik5xtasS.js");
+const require_constants = require("./constants-GXZQRcjB.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
@@ -34,7 +34,7 @@ const require_custom_action_registry = require("./custom-action-registry-Bf_Ynag
 const require_tls = require("./tls-BgImdxCO.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-DZeFVS2l.js");
+const require_restore_archive = require("./restore-archive-W1Cg5y6C.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { At as extractNestedAddonId, Bt as isObjectInput, Cn as resolveMethodAuth, Dn as scopesAllowDeviceCap, Dr as emitDownForOwnedCaps, En as scopesAllowAddon, G as addonSettingsCapability, Gr as resolveCapMount, Hr as parseJsonUnknown, Ht as kebabToCamel$1, It as isArrayOutputSchema, Lt as isCollectionArrayMethod, O as LOG_LEVEL_RANK, Qt as looseSchema, Rn as supportedRuntimes, Vr as parseJsonObject, Vt as isVoidInput, Wr as readinessKey, Zt as logLevelAtMost, br as asString$1, cn as objectInputDeclaresRequiredDeviceId, dr as DEVICE_STATUS_METHOD, ei as EventCategory$1, hr as ReadinessTimeoutError, j as METHOD_ACCESS_MAP, kr as expandCapMethods, lr as DATAPLANE_SECRET_HEADER$1, mr as ReadinessRegistry, pn as procedureAuthKey, pr as RUNTIME_DEFAULTS, qr as scopeKey, qt as lifecycleJobSchema, sn as objectInputDeclaresAddonId, sr as errMsg$1, t as ALL_CAPABILITY_DEFINITIONS, ur as DEVICE_SETTINGS_CONTRIBUTION_METHODS, vr as asJsonObject$1, wr as createEvent$1, yr as asNumber } from "./dist-C0wYvAHC.mjs";
-import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-dkTVfsLI.mjs";
+import { At as extractNestedAddonId, Bt as isObjectInput, Cn as resolveMethodAuth, Dn as scopesAllowDeviceCap, Dr as emitDownForOwnedCaps, En as scopesAllowAddon, G as addonSettingsCapability, Gr as resolveCapMount, Hr as parseJsonUnknown, Ht as kebabToCamel$1, It as isArrayOutputSchema, Lt as isCollectionArrayMethod, O as LOG_LEVEL_RANK, Qt as looseSchema, Rn as supportedRuntimes, Vr as parseJsonObject, Vt as isVoidInput, Wr as readinessKey, Zt as logLevelAtMost, br as asString$1, cn as objectInputDeclaresRequiredDeviceId, dr as DEVICE_STATUS_METHOD, ei as EventCategory$1, hr as ReadinessTimeoutError, j as METHOD_ACCESS_MAP, kr as expandCapMethods, lr as DATAPLANE_SECRET_HEADER$1, mr as ReadinessRegistry, pn as procedureAuthKey, pr as RUNTIME_DEFAULTS, qr as scopeKey, qt as lifecycleJobSchema, sn as objectInputDeclaresAddonId, sr as errMsg$1, t as ALL_CAPABILITY_DEFINITIONS, ur as DEVICE_SETTINGS_CONTRIBUTION_METHODS, vr as asJsonObject$1, wr as createEvent$1, yr as asNumber } from "./dist-0OD9ue39.mjs";
+import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-W-WFzAoK.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -25,7 +25,7 @@ import { SqliteSettingsAddon, o as SqliteSettingsBackend, s as prefixRange } fro
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-BeQWXybC.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-CtxNK2QJ.mjs";
 import { A as AGENT_UI_UNLOCK_TTL_MS, B as isMeshAuthMode, C as generateMeshCa, D as loadMeshCa, E as issueMeshLeafFromCsr, F as parseAgentDashboardOrigins, G as setProcessMeshEnforcer, H as requestProcessMeshEnforcement, I as verifyAgentUiUnlockTicket, J as parseCidrList, K as createCidrMatcher, L as MESH_AUTH_MODE_FIELD, M as UnlockTicketJtiStore, N as isAllowedAgentDashboardReturnTo, O as AGENT_DASHBOARD_ORIGINS_FIELD, P as mintAgentUiUnlockTicket, R as getProcessMeshAuthMode, S as exportMeshPrivateKeyPem, SystemConfigAddon, T as issueMeshLeafForNode, U as setProcessMeshAuthMode, V as parseMeshAuthMode, W as setProcessMeshAuthStatusSource, Y as readCidrSetting, _ as getProcessMeshCaState, a as ServiceBroker, b as caFingerprintCompact, c as JoinTokenJtiStore, d as verifyMeshJoinToken, f as getProcessNodeMeshTransport, g as MeshCaKeeper, h as processMeshCrl, i as Errors, j as AGENT_UI_UNLOCK_VERSION, k as AGENT_UI_UNLOCK_DOMAIN, l as mintMeshJoinToken, m as MeshCrl, n as MESH_TLS_PORT_HELLO_FIELD, o as setProcessMeshTlsEnabler, p as setProcessMeshPeerTransportLookup, q as normalizeIp, r as TlsTcpTransporter, s as enrollMeshNode, u as processJoinTokenJtiStore, v as requireProcessMeshCa, w as generateMeshKeyPair, x as createMeshCsrPem, y as caFingerprint, z as getProcessMeshAuthStatus } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
@@ -33,7 +33,7 @@ import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as
 import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-CaOLZ09W.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-Bt65Em24.mjs";
+import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-BUMSox6L.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";

package/dist/{jwt-signing-key-CWmNKLQi.js → jwt-signing-key-BmyvxlDJ.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DLHPmdoV.js");
+const require_dist = require("./dist-Df7s77se.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{jwt-signing-key-dkTVfsLI.mjs → jwt-signing-key-W-WFzAoK.mjs}

@@ -1,4 +1,4 @@
-import { xr as buildSecretRef } from "./dist-C0wYvAHC.mjs";
+import { xr as buildSecretRef } from "./dist-0OD9ue39.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**