@camstack/system 1.2.432 → 1.2.434

package/dist/auth/device-ca.d.ts

@@ -1,13 +1,3 @@
-/**
-* Device CA (D855) — the THIRD certificate authority, distinct from the HTTPS
-* local CA (`tls/cert-issue.ts`, RSA) and the mesh CA
-* (`kernel/moleculer/mesh-mtls/mesh-ca.ts`). EC P-256, key in the keychain
-* (owner `system`), certificate persisted like `cluster.meshCa`.
-*
-* It signs ONE kind of leaf: a device credential. The device generated the key
-* pair; the hub only ever sees the public half (an SPKI). Same library and
-* WebCrypto path as the other two CAs, same pinned `@peculiar/x509`.
-*/
 import type { webcrypto as WebCrypto } from "node:crypto";
 import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
 /** `secret://system/global/deviceCaKey` — EC P-256 PKCS#8 PEM of the device CA. */

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { J as addonPagesCapability, _r as BaseAddon, gr as errMsg, li as EventCategory } from "../../dist-Bt8GTRHB.mjs";
+import { Z as addonPagesCapability, br as BaseAddon, fi as EventCategory, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { X as addonWidgetsCapability, _r as BaseAddon, gr as errMsg, li as EventCategory } from "../../dist-Bt8GTRHB.mjs";
+import { $ as addonWidgetsCapability, br as BaseAddon, fi as EventCategory, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Nr as createEvent, Z as alertsCapability, _r as BaseAddon, gr as errMsg, li as EventCategory, n as AlertSchema } from "../../dist-Bt8GTRHB.mjs";
+import { Ir as createEvent, br as BaseAddon, et as alertsCapability, fi as EventCategory, i as AlertSchema, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Cn as ptzAutotrackCapability, D as FIRST_LEVEL_MACRO_CLASSES, Hr as isEvent, _r as BaseAddon, et as bareAddonId, gr as errMsg, li as EventCategory } from "../../dist-Bt8GTRHB.mjs";
+import { En as ptzAutotrackCapability, Gr as isEvent, br as BaseAddon, fi as EventCategory, k as FIRST_LEVEL_MACRO_CLASSES, rt as bareAddonId, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
-const require_restore_archive = require("../../restore-archive-DhHH7VQp.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
+const require_restore_archive = require("../../restore-archive-Do0QwAik.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as backupCapability, Jr as nodePin, Un as storageOccupancyCapability, _r as BaseAddon, li as EventCategory, ln as mayWriteToLocation, oi as toNodeId } from "../../dist-Bt8GTRHB.mjs";
-import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-Bh34W8J8.mjs";
+import { Kn as storageOccupancyCapability, Zr as nodePin, br as BaseAddon, fi as EventCategory, fn as mayWriteToLocation, li as toNodeId, nt as backupCapability } from "../../dist-CYcBqnXk.mjs";
+import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-5ml7uYMf.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { _r as BaseAddon, ot as calendarsCapability, p as CalendarPreferencesSchema } from "../../dist-Bt8GTRHB.mjs";
+import { br as BaseAddon, h as CalendarPreferencesSchema, lt as calendarsCapability } from "../../dist-CYcBqnXk.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { Bn as snapshotCapability, Br as hydrateSchema, Gn as streamCatalogCapability, L as MOTION_CLOSE_AFTER_MS, Nr as createEvent, T as DeclaredDevices, _r as BaseAddon, b as DERIVED_CAMERA_SILENCED_CAP_NAMES, gr as errMsg, hr as DeviceType, i as BaseDevice, li as EventCategory, nr as buildFfmpegArgs, pn as motionCapability, pr as DeviceFeature, st as cameraGridLayoutCapability, un as memoizePinnedFfmpeg, xt as declarationOwnerNodeId } from "../../dist-Bt8GTRHB.mjs";
+import { D as DeclaredDevices, Ir as createEvent, Jn as streamCatalogCapability, S as DERIVED_CAMERA_SILENCED_CAP_NAMES, Un as snapshotCapability, Ur as hydrateSchema, ar as buildFfmpegArgs, br as BaseAddon, fi as EventCategory, gn as motionCapability, gr as DeviceFeature, o as BaseDevice, pn as memoizePinnedFfmpeg, ut as cameraGridLayoutCapability, vr as DeviceType, wt as declarationOwnerNodeId, yr as errMsg, z as MOTION_CLOSE_AFTER_MS } from "../../dist-CYcBqnXk.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
-const require_composition_sources = require("../../composition-sources-CFlUdpO7.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
+const require_composition_sources = require("../../composition-sources-B7R1oQnY.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { Lt as expressionContainsBuiltinCall, Nr as createEvent, Pt as evaluateCompositionField, T as DeclaredDevices, _r as BaseAddon, ar as composedDeviceStableId, bn as planComposition, cr as compositionSliceKey, dr as disarmRoseMemory, dt as compositionFieldKey, fr as toExpressionValue, gr as errMsg, hr as DeviceType, i as BaseDevice, ir as composedDeviceRef, l as COMPOSED_ITEM_FIXED_FIELDS, li as EventCategory, lr as compositionSourceKey, nt as buildCapabilityLookup, or as compositionFeatureEnabled, rr as cloneStatefulExpressionMemory, sr as compositionItemFieldPath, t as ALL_CAPABILITY_DEFINITIONS, tr as COMPOSER_ADDON_ID, ur as createStatefulExpressionMemory, ut as composerCapability } from "../../dist-Bt8GTRHB.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-DpbL38z3.mjs";
+import { Bt as expressionContainsBuiltinCall, Cn as planComposition, D as DeclaredDevices, Ir as createEvent, Lt as evaluateCompositionField, at as buildCapabilityLookup, br as BaseAddon, cr as composedDeviceStableId, d as COMPOSED_ITEM_FIXED_FIELDS, dr as compositionSliceKey, fi as EventCategory, fr as compositionSourceKey, hr as toExpressionValue, ir as COMPOSER_ADDON_ID, lr as compositionFeatureEnabled, mr as disarmRoseMemory, mt as compositionFieldKey, o as BaseDevice, or as cloneStatefulExpressionMemory, pr as createStatefulExpressionMemory, pt as composerCapability, r as ALL_CAPABILITY_DEFINITIONS, sr as composedDeviceRef, ur as compositionItemFieldPath, vr as DeviceType, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-CqrDyHM1.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { _r as BaseAddon, an as logDestinationCapability } from "../../dist-Bt8GTRHB.mjs";
+import { br as BaseAddon, cn as logDestinationCapability } from "../../dist-CYcBqnXk.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
-const require_composition_sources = require("../../composition-sources-CFlUdpO7.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
+const require_composition_sources = require("../../composition-sources-B7R1oQnY.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { Br as hydrateSchema, On as resolveCoreBlockEntry, T as DeclaredDevices, Tn as replacedFieldKeys, Tt as describeComposableCaps, Yn as validateComposition, _r as BaseAddon, _t as coreBlocksCapability, bn as planComposition, d as CORE_BLOCKS_ADDON_ID, f as CORE_BLOCK_ADDON_PREFIX, ft as compositionSourceRefs, gr as errMsg, gt as coreBlockSourceKind, ht as coreBlockIdFromAddonId, ir as composedDeviceRef, kn as resolveCoreBlockFiles, lr as compositionSourceKey, m as CoreBlockSchema, mn as normalizeCoreBlockWrite, mt as coreBlockComposition, nt as buildCapabilityLookup, pt as coreBlockAddonId, t as ALL_CAPABILITY_DEFINITIONS, u as COMPOSER_RUNNER_ID } from "../../dist-Bt8GTRHB.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-DpbL38z3.mjs";
+import { Cn as planComposition, D as DeclaredDevices, Mn as resolveCoreBlockFiles, On as replacedFieldKeys, Ot as describeComposableCaps, Qn as validateComposition, Ur as hydrateSchema, _n as normalizeCoreBlockWrite, _t as coreBlockComposition, at as buildCapabilityLookup, br as BaseAddon, bt as coreBlocksCapability, f as COMPOSER_RUNNER_ID, fr as compositionSourceKey, g as CoreBlockSchema, gt as coreBlockAddonId, ht as compositionSourceRefs, jn as resolveCoreBlockEntry, m as CORE_BLOCK_ADDON_PREFIX, p as CORE_BLOCKS_ADDON_ID, r as ALL_CAPABILITY_DEFINITIONS, sr as composedDeviceRef, vt as coreBlockIdFromAddonId, yr as errMsg, yt as coreBlockSourceKind } from "../../dist-CYcBqnXk.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-CqrDyHM1.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-u3Wwkdrq.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-CEiCaI_j.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { At as deviceStatusCapability, Ct as defineExtensionSlotProvider, Dt as deviceExtensionCapability, E as DeviceStatusSchema, Er as WELL_KNOWN_TAB_MAP, Gr as isSecretMarker, Ht as formatMinutes, I as MINUTES_PER_DAY, It as expandContainer, Kr as isSecretMarkerLike, Mr as collectZodSecretPaths, Mt as enumerateItemArrayFields, Nt as enumerateSchemaFields, O as FieldClaimModeSchema, Ot as deviceManagerCapability, Pn as runtimeStatePolicyFor, Tr as SECRET_CLEAR, Ur as isKeychainStoredField, V as STREAM_PROFILE_META, Vr as isDeviceConfigCap, Wr as isSecretClear, _r as BaseAddon, ai as sleep$1, at as buildStreamParamsConfigSchema, c as CAP_NAMES_WITH_STATUS, ci as transformSecretWrite, ct as canonicalIconKey, en as legacyAutoLinkIds, gr as errMsg, hn as normalizeUnit, hr as DeviceType, in as locationIconKey, k as FieldClaimSchema, kt as deviceStateCapability, li as EventCategory, mr as DeviceRole, o as CAMERA_SWITCH_ORDER, pr as DeviceFeature, ri as secretTreeFromPaths, si as toSecretFieldView, t as ALL_CAPABILITY_DEFINITIONS, ti as resolveSecretMarkers, vn as parseStreamParamsFormPatch, vt as createDeviceExtensionProvider, y as DAY_NAMES, zn as siteZoneKey } from "../../dist-Bt8GTRHB.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CmcEitC2.mjs";
+import { A as FieldClaimModeSchema, At as deviceExtensionCapability, Et as defineExtensionSlotProvider, Fr as collectZodSecretPaths, Ft as enumerateItemArrayFields, Gt as formatMinutes, Hn as siteZoneKey, It as enumerateSchemaFields, Jr as isSecretMarker, Kr as isKeychainStoredField, Ln as runtimeStatePolicyFor, Mt as deviceStateCapability, Nt as deviceStatusCapability, O as DeviceStatusSchema, Or as SECRET_CLEAR, R as MINUTES_PER_DAY, U as STREAM_PROFILE_META, Wr as isDeviceConfigCap, Yr as isSecretMarkerLike, _r as DeviceRole, br as BaseAddon, c as CAMERA_SWITCH_ORDER, ci as sleep$1, ct as buildStreamParamsConfigSchema, di as transformSecretWrite, dt as canonicalIconKey, fi as EventCategory, gr as DeviceFeature, ii as resolveSecretMarkers, j as FieldClaimSchema, jt as deviceManagerCapability, kr as WELL_KNOWN_TAB_MAP, oi as secretTreeFromPaths, qr as isSecretClear, r as ALL_CAPABILITY_DEFINITIONS, rn as legacyAutoLinkIds, sn as locationIconKey, u as CAP_NAMES_WITH_STATUS, ui as toSecretFieldView, vn as normalizeUnit, vr as DeviceType, x as DAY_NAMES, xn as parseStreamParamsFormPatch, xt as createDeviceExtensionProvider, yr as errMsg, zt as expandContainer } from "../../dist-CYcBqnXk.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CyDdyjLP.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { _r as BaseAddon, an as logDestinationCapability } from "../../dist-Bt8GTRHB.mjs";
+import { br as BaseAddon, cn as logDestinationCapability } from "../../dist-CYcBqnXk.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
-const require_device_ca = require("../../device-ca-BCyAPmIj.js");
-const require_constants = require("../../constants-DfP8V3eX.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
+const require_device_ca = require("../../device-ca-D21ZP00q.js");
+const require_constants = require("../../constants-CuOfMdYe.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { $t as keychainCapability, M as KEYCHAIN_RESET_TRIGGER_ACTOR, Qr as parseSecretRef, Qt as keychainAdminCapability, Yr as normalizeSecretOwner, _r as BaseAddon, li as EventCategory, zr as formatSecretScope } from "../../dist-Bt8GTRHB.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-4IY98a_-.mjs";
-import { a as MESH_CA_KEY_REF, p as CLUSTER_SECRET_SETTINGS_KEY } from "../../constants-B89vjrSm.mjs";
+import { Hr as formatSecretScope, P as KEYCHAIN_RESET_TRIGGER_ACTOR, Qr as normalizeSecretOwner, br as BaseAddon, fi as EventCategory, nn as keychainCapability, ti as parseSecretRef, tn as keychainAdminCapability } from "../../dist-CYcBqnXk.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-CDjGQQPd.mjs";
+import { a as MESH_CA_KEY_REF, p as CLUSTER_SECRET_SETTINGS_KEY } from "../../constants-CrMPWOug.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Nr as createEvent, R as RECORDING_SOURCE_CAMSTACK_ADDON, _r as BaseAddon, gr as errMsg, li as EventCategory, z as RecordingStatusSchema } from "../../dist-Bt8GTRHB.mjs";
+import { B as RECORDING_SOURCE_CAMSTACK_ADDON, Ir as createEvent, V as RecordingStatusSchema, br as BaseAddon, fi as EventCategory, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-BCyAPmIj.js");
+const require_device_ca = require("../../device-ca-D21ZP00q.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -6125,7 +6125,8 @@ var AuthManager = class {
 			...payload.refreshTtl !== void 0 ? { refreshTtl: payload.refreshTtl } : {},
 			...payload.linkIntent !== void 0 ? { linkIntent: payload.linkIntent } : {},
 			...payload.issuer !== void 0 ? { issuer: payload.issuer } : {},
-			...payload.browserBinding !== void 0 ? { browserBinding: payload.browserBinding } : {}
+			...payload.browserBinding !== void 0 ? { browserBinding: payload.browserBinding } : {},
+			...payload.app !== void 0 ? { app: payload.app } : {}
 		};
 		/**
 		* `'never'` mints with NO `exp` claim, and the option must be OMITTED to do
@@ -6170,6 +6171,9 @@ var AuthManager = class {
 			const linkIntent = typeof decoded["linkIntent"] === "string" ? decoded["linkIntent"] : void 0;
 			const issuer = typeof decoded["issuer"] === "string" ? decoded["issuer"] : void 0;
 			const browserBinding = typeof decoded["browserBinding"] === "string" ? decoded["browserBinding"] : void 0;
+			const appParsed = require_dist.SsoBridgeClaimsSchema.shape.app.safeParse(decoded["app"]);
+			if (!appParsed.success) return null;
+			const app = appParsed.data;
 			const rawRefreshTtl = decoded["refreshTtl"];
 			const refreshTtl = rawRefreshTtl === "never" || typeof rawRefreshTtl === "number" && rawRefreshTtl > 0 ? rawRefreshTtl : void 0;
 			return {
@@ -6188,7 +6192,8 @@ var AuthManager = class {
 				...refreshTtl !== void 0 ? { refreshTtl } : {},
 				...linkIntent !== void 0 ? { linkIntent } : {},
 				...issuer !== void 0 ? { issuer } : {},
-				...browserBinding !== void 0 ? { browserBinding } : {}
+				...browserBinding !== void 0 ? { browserBinding } : {},
+				...app !== void 0 ? { app } : {}
 			};
 		} catch {
 			return null;

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Et as deviceCredentialsCapability, H as ScopedTokenSchema, Jn as userManagementCapability, Q as authProviderCapability, S as DEVICE_NONCE_TTL_MS, Vt as formatDeviceRevoker, _r as BaseAddon, it as buildDeviceSignatureMessage, q as UserRecordSchema, r as ApiKeyRecordSchema, rt as buildDeviceEnrollmentLink, x as DEVICE_ENROLLMENT_TTL_MS } from "../../dist-Bt8GTRHB.mjs";
+import { C as DEVICE_ENROLLMENT_TTL_MS, G as SsoBridgeClaimsSchema, W as ScopedTokenSchema, Wt as formatDeviceRevoker, X as UserRecordSchema, Zn as userManagementCapability, a as ApiKeyRecordSchema, br as BaseAddon, kt as deviceCredentialsCapability, ot as buildDeviceEnrollmentLink, st as buildDeviceSignatureMessage, tt as authProviderCapability, w as DEVICE_NONCE_TTL_MS } from "../../dist-CYcBqnXk.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-4IY98a_-.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-CDjGQQPd.mjs";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -6115,7 +6115,8 @@ var AuthManager = class {
 			...payload.refreshTtl !== void 0 ? { refreshTtl: payload.refreshTtl } : {},
 			...payload.linkIntent !== void 0 ? { linkIntent: payload.linkIntent } : {},
 			...payload.issuer !== void 0 ? { issuer: payload.issuer } : {},
-			...payload.browserBinding !== void 0 ? { browserBinding: payload.browserBinding } : {}
+			...payload.browserBinding !== void 0 ? { browserBinding: payload.browserBinding } : {},
+			...payload.app !== void 0 ? { app: payload.app } : {}
 		};
 		/**
 		* `'never'` mints with NO `exp` claim, and the option must be OMITTED to do
@@ -6160,6 +6161,9 @@ var AuthManager = class {
 			const linkIntent = typeof decoded["linkIntent"] === "string" ? decoded["linkIntent"] : void 0;
 			const issuer = typeof decoded["issuer"] === "string" ? decoded["issuer"] : void 0;
 			const browserBinding = typeof decoded["browserBinding"] === "string" ? decoded["browserBinding"] : void 0;
+			const appParsed = SsoBridgeClaimsSchema.shape.app.safeParse(decoded["app"]);
+			if (!appParsed.success) return null;
+			const app = appParsed.data;
 			const rawRefreshTtl = decoded["refreshTtl"];
 			const refreshTtl = rawRefreshTtl === "never" || typeof rawRefreshTtl === "number" && rawRefreshTtl > 0 ? rawRefreshTtl : void 0;
 			return {
@@ -6178,7 +6182,8 @@ var AuthManager = class {
 				...refreshTtl !== void 0 ? { refreshTtl } : {},
 				...linkIntent !== void 0 ? { linkIntent } : {},
 				...issuer !== void 0 ? { issuer } : {},
-				...browserBinding !== void 0 ? { browserBinding } : {}
+				...browserBinding !== void 0 ? { browserBinding } : {},
+				...app !== void 0 ? { app } : {}
 			};
 		} catch {
 			return null;

package/dist/builtins/local-network/address-book.d.ts

@@ -80,6 +80,19 @@ export declare function customEndpoint(entry: CustomAddress): ConnectionEndpoint
 * addresses flagged `appConnections` (a detected URL is never listed twice).
 */
 export declare function withAppConnectionCustomEndpoints(detected: readonly ConnectionEndpoint[], state: AddressBookState): ConnectionEndpoint[];
+/**
+* The HTTPS counterpart of every LAN address advertised over plain HTTP
+* (D859): `http://<lan>:<httpPort>` gains `https://<lan>:<httpsPort>`, the hub's
+* TLS listener, as its own row straight after it. The twin is an ordinary
+* detected LAN row — ticked, unticked and flagged like any other, on by default
+* (a LAN row is an automatic app connection). A phone that does not trust the
+* hub's local CA fails that candidate in the race it already runs; one that
+* does reaches it. Only the app-connection palette and the table carry twins:
+* the palette `internal` and `publicEndpoint` resolve over never does, so those
+* roles keep their answer. Rows already on https (LAN HTTP off), the public
+* tunnel, the mesh, custom addresses and loopback have no twin.
+*/
+export declare function withLanHttpsCounterparts(palette: readonly ConnectionEndpoint[], httpsPort: number): ConnectionEndpoint[];
 export interface AddressBookInputs {
 	/** Detected endpoints in the scheme the rows are shown in. */
 	readonly rowsPalette: readonly ConnectionEndpoint[];

package/dist/builtins/local-network/agent-mdns.d.ts

@@ -0,0 +1,51 @@
+/**
+* Agent mDNS advertisement (D857) — how a hub finds agents to pair.
+*
+* Every agent publishes ONE `_camstack-agent._tcp` service for its API port,
+* paired or not. The TXT record carries only public facts: the node id, the
+* version, the pairing state and — once paired — a short fingerprint of its
+* mesh leaf. Finding an agent grants nothing: pairing still needs the code
+* confirmed on both screens. The state is re-announced when it changes, so the
+* hub's list never shows an agent as free that is already paired.
+*
+* The pairing key is generated per pairing attempt (a fresh key for every
+* offer), so before pairing there is no key to advertise; `fp` appears only
+* after, as the leaf fingerprint.
+*
+* The responder is injected, exactly as for the hub's own advertisement
+* (`hub-mdns.ts`); the real one is `createCiaoPublisher()`.
+*/
+import type { IScopedLogger } from "@camstack/types";
+import type { HubMdnsAnnouncement, HubMdnsPublisher } from "./hub-mdns.js";
+import type { AgentPairingState } from "../../kernel/moleculer/mesh-mtls/pairing/pairing-protocol.js";
+export interface AgentMdnsInputs {
+	readonly nodeId: string;
+	readonly version: string | null;
+	readonly port: number;
+	readonly state: AgentPairingState;
+	/** Short fingerprint of the agent's mesh leaf, `null` while unpaired. */
+	readonly leafFingerprint: string | null;
+}
+export declare function buildAgentAnnouncement(inputs: AgentMdnsInputs): HubMdnsAnnouncement;
+export interface AgentMdnsAdvertiserOptions {
+	readonly publisher: HubMdnsPublisher;
+	readonly logger: Pick<IScopedLogger, "info" | "warn">;
+}
+/**
+* Keeps one mDNS service in step with the agent's pairing state. `sync()` is safe
+* to call on any change; it never throws — a failure to advertise is logged and
+* the agent goes on (a typed address still pairs it).
+*/
+export declare class AgentMdnsAdvertiser {
+	private readonly options;
+	private current;
+	private running;
+	private chain;
+	constructor(options: AgentMdnsAdvertiserOptions);
+	start(inputs: AgentMdnsInputs): Promise<void>;
+	/** Announce `inputs` if they differ from what is announced. Serialised. */
+	sync(inputs: AgentMdnsInputs): Promise<void>;
+	stop(): Promise<void>;
+	private syncOnce;
+	private withdraw;
+}