@camstack/system 1.2.432 → 1.2.434

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BCKOeWu_.js");
+const require_dist = require("../../dist-CCH3XPqO.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { _r as BaseAddon, an as logDestinationCapability } from "../../dist-Bt8GTRHB.mjs";
+import { br as BaseAddon, cn as logDestinationCapability } from "../../dist-CYcBqnXk.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-CFlUdpO7.js → composition-sources-B7R1oQnY.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BCKOeWu_.js");
+const require_dist = require("./dist-CCH3XPqO.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-DpbL38z3.mjs → composition-sources-CqrDyHM1.mjs}

@@ -1,4 +1,4 @@
-import { gr as errMsg, lr as compositionSourceKey } from "./dist-Bt8GTRHB.mjs";
+import { fr as compositionSourceKey, yr as errMsg } from "./dist-CYcBqnXk.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-B89vjrSm.mjs → constants-CrMPWOug.mjs}

@@ -1,4 +1,4 @@
-import { Ar as buildSecretRef } from "./dist-Bt8GTRHB.mjs";
+import { Nr as buildSecretRef } from "./dist-CYcBqnXk.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**
@@ -87,7 +87,7 @@ var MESH_CA_KEY_REF = buildSecretRef({
 });
 /** `system-settings` key holding the public CA certificate PEM. */
 var MESH_CA_SETTINGS_KEY = "cluster.meshCa";
-/** Field inside the `cluster` section (same row as the secret). */
+/** Field inside the `cluster` section. */
 var MESH_CA_FIELD = "meshCa";
 /** Join-token / leaf lifetimes. */
 var MESH_JOIN_TOKEN_MAX_TTL_SEC = 3600;

package/dist/{constants-DfP8V3eX.js → constants-CuOfMdYe.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BCKOeWu_.js");
+const require_dist = require("./dist-CCH3XPqO.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**
@@ -87,7 +87,7 @@ var MESH_CA_KEY_REF = require_dist.buildSecretRef({
 });
 /** `system-settings` key holding the public CA certificate PEM. */
 var MESH_CA_SETTINGS_KEY = "cluster.meshCa";
-/** Field inside the `cluster` section (same row as the secret). */
+/** Field inside the `cluster` section. */
 var MESH_CA_FIELD = "meshCa";
 /** Join-token / leaf lifetimes. */
 var MESH_JOIN_TOKEN_MAX_TTL_SEC = 3600;

package/dist/{device-ca-4IY98a_-.mjs → device-ca-CDjGQQPd.mjs}

@@ -1,5 +1,5 @@
-import { Ar as buildSecretRef, C as DEVICE_SAN_CREDENTIAL_PREFIX, w as DEVICE_SAN_USER_PREFIX } from "./dist-Bt8GTRHB.mjs";
-import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CAjSsrkk.mjs";
+import { E as DEVICE_SAN_USER_PREFIX, Nr as buildSecretRef, T as DEVICE_SAN_CREDENTIAL_PREFIX } from "./dist-CYcBqnXk.mjs";
+import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CDvj67p1.mjs";
 import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**
@@ -126,6 +126,16 @@ async function loadJwtSigningKey(deps) {
 }
 //#endregion
 //#region src/auth/device-ca.ts
+/**
+* Device CA (D855) — the THIRD certificate authority, distinct from the HTTPS
+* local CA (`tls/cert-issue.ts`, RSA) and the mesh CA
+* (`kernel/moleculer/mesh-mtls/mesh-ca.ts`). EC P-256, key in the keychain
+* (owner `system`), certificate persisted like `cluster.meshCa`.
+*
+* It signs ONE kind of leaf: a device credential. The device generated the key
+* pair; the hub only ever sees the public half (an SPKI). Same library and
+* WebCrypto path as the other two CAs, same pinned `@peculiar/x509`.
+*/
 cryptoProvider.set(webcrypto);
 var MS_PER_DAY = 864e5;
 var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
@@ -164,7 +174,7 @@ async function generateDeviceCa(now = /* @__PURE__ */ new Date()) {
 	const cert = await X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
 		signingAlgorithm: SIGNING_ALGORITHM,
@@ -204,7 +214,7 @@ async function rebuildDeviceCaCertificate(keyPem) {
 	const cert = await X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys: {
 			privateKey,
@@ -234,8 +244,9 @@ async function importDevicePublicKey(spki) {
 */
 async function issueDeviceLeaf(ca, input) {
 	const publicKey = await importDevicePublicKey(input.publicKeySpki);
-	const notBefore = input.now ?? /* @__PURE__ */ new Date();
-	const notAfter = new Date(notBefore.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
+	const issuedAt = input.now ?? /* @__PURE__ */ new Date();
+	const notBefore = backdatedNotBefore(issuedAt);
+	const notAfter = new Date(issuedAt.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
 	const serialNumber = freshSerial();
 	const extensions = [
 		new BasicConstraintsExtension(false, void 0, true),

package/dist/{device-ca-BCyAPmIj.js → device-ca-D21ZP00q.js}

@@ -1,5 +1,5 @@
-const require_dist = require("./dist-BCKOeWu_.js");
-const require_x509_es = require("./x509.es-Dzl0BbmG.js");
+const require_dist = require("./dist-CCH3XPqO.js");
+const require_x509_es = require("./x509.es-r7Ht1thA.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**
@@ -126,6 +126,16 @@ async function loadJwtSigningKey(deps) {
 }
 //#endregion
 //#region src/auth/device-ca.ts
+/**
+* Device CA (D855) — the THIRD certificate authority, distinct from the HTTPS
+* local CA (`tls/cert-issue.ts`, RSA) and the mesh CA
+* (`kernel/moleculer/mesh-mtls/mesh-ca.ts`). EC P-256, key in the keychain
+* (owner `system`), certificate persisted like `cluster.meshCa`.
+*
+* It signs ONE kind of leaf: a device credential. The device generated the key
+* pair; the hub only ever sees the public half (an SPKI). Same library and
+* WebCrypto path as the other two CAs, same pinned `@peculiar/x509`.
+*/
 require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
 var MS_PER_DAY = 864e5;
 var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
@@ -164,7 +174,7 @@ async function generateDeviceCa(now = /* @__PURE__ */ new Date()) {
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: require_x509_es.backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
 		signingAlgorithm: SIGNING_ALGORITHM,
@@ -204,7 +214,7 @@ async function rebuildDeviceCaCertificate(keyPem) {
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: require_x509_es.backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys: {
 			privateKey,
@@ -234,8 +244,9 @@ async function importDevicePublicKey(spki) {
 */
 async function issueDeviceLeaf(ca, input) {
 	const publicKey = await importDevicePublicKey(input.publicKeySpki);
-	const notBefore = input.now ?? /* @__PURE__ */ new Date();
-	const notAfter = new Date(notBefore.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
+	const issuedAt = input.now ?? /* @__PURE__ */ new Date();
+	const notBefore = require_x509_es.backdatedNotBefore(issuedAt);
+	const notAfter = new Date(issuedAt.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
 	const serialNumber = freshSerial();
 	const extensions = [
 		new require_x509_es.BasicConstraintsExtension(false, void 0, true),

package/dist/{dist-BCKOeWu_.js → dist-CCH3XPqO.js}

@@ -718,7 +718,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep--g-h2_c_.mjs
+//#region ../types/dist/sleep-DAX0-2v9.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -9768,6 +9768,12 @@ function scopesAllowDeviceCap(scopes, access) {
 function scopesAllowAddon(scopes, addonId, access) {
 	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
 }
+zod.z.enum(["new-session", "step-up"]);
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = zod.z.discriminatedUnion("kind", [zod.z.object({ kind: zod.z.literal("native") }), zod.z.object({
+	kind: zod.z.literal("browser"),
+	startPath: zod.z.string().startsWith("/")
+})]);
 /**
 * Device certificates (D855) — the wire contract shared by the hub, the admin
 * UI and the native viewer.
@@ -9966,7 +9972,9 @@ zod.z.object({
 	signature: zod.z.literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: zod.z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: zod.z.array(zod.z.enum(["native", "web"]))
+	clients: zod.z.array(zod.z.enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 /**
 * What an expression's named bindings READ from.
@@ -16645,6 +16653,16 @@ var nodeCertificatesCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* The hub unpairs this node (D857): it erases its mesh material, goes back to the
+		* unpaired state and advertises itself again. The call is answered first; the wire
+		* goes down right after, so the hub revokes the node's certificates BEFORE this
+		* connection drops, never after.
+		*/
+		forgetHub: method(zod.z.object({}), zod.z.object({ ok: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Install the hub-signed HTTPS leaf and hot-swap the serving context (no restart). */
 		installHttpsCertificate: method(zod.z.object({
 			certPem: zod.z.string().min(1),
@@ -40172,6 +40190,21 @@ var HUB_MDNS_TXT_KEYS = {
 	url: "url"
 };
 /**
+* How a hub finds agents to pair (D857): every agent publishes ONE mDNS service for its API
+* port, paired or not. The TXT record carries only public facts. Finding an agent grants
+* nothing: pairing still needs the six-digit code confirmed on both screens.
+*/
+var AGENT_MDNS_SERVICE_TYPE = "camstack-agent";
+/** The TXT keys of the agent advertisement. Every value is public. */
+var AGENT_MDNS_TXT_KEYS = {
+	nodeId: "nodeId",
+	version: "version",
+	/** `unpaired` | `pending` | `paired`. */
+	state: "state",
+	/** First 16 hex chars of the SHA-256 of the agent's mesh leaf; present once paired. */
+	keyFingerprint: "fp"
+};
+/**
 * Transport bounds for AI capability methods.
 *
 * Its own module because `llm.cap.ts` and `llm-runtime.cap.ts` already import
@@ -41142,7 +41175,13 @@ var RedirectLoginMethodSchema = zod.z.object({
 	* `beginExternalLink` offer exactly the redirect methods that set this,
 	* whatever their id. Absent / false — a login button only.
 	*/
-	linkable: zod.z.boolean().optional()
+	linkable: zod.z.boolean().optional(),
+	/**
+	* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+	* when the route understands the app flow query (`app=1&code_challenge=…`),
+	* `null`/absent when there is no app path - the app hides the method.
+	*/
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A Module-Federation widget the login page mounts for an in-page
@@ -41161,7 +41200,9 @@ var WidgetLoginMethodSchema = zod.z.object({
 	bundle: zod.z.string(),
 	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 	remote: WidgetRemoteSchema,
-	stage: LoginStageEnum
+	stage: LoginStageEnum,
+	/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A declarative WebAuthn ceremony the shell renders natively (no remote
@@ -41179,7 +41220,9 @@ var PasskeyLoginMethodSchema = zod.z.object({
 	/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 	rpId: zod.z.string(),
 	/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-	origin: zod.z.string().nullable()
+	origin: zod.z.string().nullable(),
+	/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
 var LoginMethodContributionSchema = zod.z.discriminatedUnion("kind", [
@@ -54115,7 +54158,20 @@ var SsoBridgeClaimsSchema = zod.z.object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: zod.z.string().optional()
+	browserBinding: zod.z.string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: zod.z.object({
+		codeChallenge: zod.z.string(),
+		state: zod.z.string(),
+		purpose: zod.z.enum(["new-session", "step-up"]),
+		redirect: zod.z.string()
+	}).optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -76652,6 +76708,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.forgetHub": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"nodeCertificates.getCertificates": {
 		capName: "node-certificates",
 		capScope: "system",
@@ -85483,6 +85545,18 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
+Object.defineProperty(exports, "AGENT_MDNS_SERVICE_TYPE", {
+	enumerable: true,
+	get: function() {
+		return AGENT_MDNS_SERVICE_TYPE;
+	}
+});
+Object.defineProperty(exports, "AGENT_MDNS_TXT_KEYS", {
+	enumerable: true,
+	get: function() {
+		return AGENT_MDNS_TXT_KEYS;
+	}
+});
 Object.defineProperty(exports, "ALL_CAPABILITY_DEFINITIONS", {
 	enumerable: true,
 	get: function() {
@@ -85819,6 +85893,12 @@ Object.defineProperty(exports, "ScopedTokenSchema", {
 		return ScopedTokenSchema;
 	}
 });
+Object.defineProperty(exports, "SsoBridgeClaimsSchema", {
+	enumerable: true,
+	get: function() {
+		return SsoBridgeClaimsSchema;
+	}
+});
 Object.defineProperty(exports, "StorageCleanupJobSchema", {
 	enumerable: true,
 	get: function() {

package/dist/{dist-Bt8GTRHB.mjs → dist-CYcBqnXk.mjs}

@@ -718,7 +718,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep--g-h2_c_.mjs
+//#region ../types/dist/sleep-DAX0-2v9.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -9768,6 +9768,12 @@ function scopesAllowDeviceCap(scopes, access) {
 function scopesAllowAddon(scopes, addonId, access) {
 	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
 }
+z.enum(["new-session", "step-up"]);
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = z.discriminatedUnion("kind", [z.object({ kind: z.literal("native") }), z.object({
+	kind: z.literal("browser"),
+	startPath: z.string().startsWith("/")
+})]);
 /**
 * Device certificates (D855) — the wire contract shared by the hub, the admin
 * UI and the native viewer.
@@ -9966,7 +9972,9 @@ z.object({
 	signature: z.literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: z.array(z.enum(["native", "web"]))
+	clients: z.array(z.enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 /**
 * What an expression's named bindings READ from.
@@ -16645,6 +16653,16 @@ var nodeCertificatesCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* The hub unpairs this node (D857): it erases its mesh material, goes back to the
+		* unpaired state and advertises itself again. The call is answered first; the wire
+		* goes down right after, so the hub revokes the node's certificates BEFORE this
+		* connection drops, never after.
+		*/
+		forgetHub: method(z.object({}), z.object({ ok: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Install the hub-signed HTTPS leaf and hot-swap the serving context (no restart). */
 		installHttpsCertificate: method(z.object({
 			certPem: z.string().min(1),
@@ -40172,6 +40190,21 @@ var HUB_MDNS_TXT_KEYS = {
 	url: "url"
 };
 /**
+* How a hub finds agents to pair (D857): every agent publishes ONE mDNS service for its API
+* port, paired or not. The TXT record carries only public facts. Finding an agent grants
+* nothing: pairing still needs the six-digit code confirmed on both screens.
+*/
+var AGENT_MDNS_SERVICE_TYPE = "camstack-agent";
+/** The TXT keys of the agent advertisement. Every value is public. */
+var AGENT_MDNS_TXT_KEYS = {
+	nodeId: "nodeId",
+	version: "version",
+	/** `unpaired` | `pending` | `paired`. */
+	state: "state",
+	/** First 16 hex chars of the SHA-256 of the agent's mesh leaf; present once paired. */
+	keyFingerprint: "fp"
+};
+/**
 * Transport bounds for AI capability methods.
 *
 * Its own module because `llm.cap.ts` and `llm-runtime.cap.ts` already import
@@ -41142,7 +41175,13 @@ var RedirectLoginMethodSchema = z.object({
 	* `beginExternalLink` offer exactly the redirect methods that set this,
 	* whatever their id. Absent / false — a login button only.
 	*/
-	linkable: z.boolean().optional()
+	linkable: z.boolean().optional(),
+	/**
+	* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+	* when the route understands the app flow query (`app=1&code_challenge=…`),
+	* `null`/absent when there is no app path - the app hides the method.
+	*/
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A Module-Federation widget the login page mounts for an in-page
@@ -41161,7 +41200,9 @@ var WidgetLoginMethodSchema = z.object({
 	bundle: z.string(),
 	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 	remote: WidgetRemoteSchema,
-	stage: LoginStageEnum
+	stage: LoginStageEnum,
+	/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A declarative WebAuthn ceremony the shell renders natively (no remote
@@ -41179,7 +41220,9 @@ var PasskeyLoginMethodSchema = z.object({
 	/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 	rpId: z.string(),
 	/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-	origin: z.string().nullable()
+	origin: z.string().nullable(),
+	/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
 var LoginMethodContributionSchema = z.discriminatedUnion("kind", [
@@ -54115,7 +54158,20 @@ var SsoBridgeClaimsSchema = z.object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: z.string().optional()
+	browserBinding: z.string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: z.object({
+		codeChallenge: z.string(),
+		state: z.string(),
+		purpose: z.enum(["new-session", "step-up"]),
+		redirect: z.string()
+	}).optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -76652,6 +76708,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.forgetHub": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"nodeCertificates.getCertificates": {
 		capName: "node-certificates",
 		capScope: "system",
@@ -85483,4 +85545,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { backupCapability as $, vectorStoreCapability as $n, readinessKey as $r, keychainCapability as $t, HUB_MDNS_SERVICE_TYPE as A, resolveHubAddressRoles as An, buildSecretRef as Ar, deviceStatusCapability as At, STORAGE_ACCESS_FALLBACK as B, snapshotCapability as Bn, hydrateSchema as Br, foldSnapshotByFunction as Bt, DEVICE_SAN_CREDENTIAL_PREFIX as C, ptzAutotrackCapability as Cn, ReadinessRegistry as Cr, defineExtensionSlotProvider as Ct, FIRST_LEVEL_MACRO_CLASSES as D, resolveBucketMs as Dn, asJsonObject as Dr, deviceExtensionCapability as Dt, DeviceStatusSchema as E, resolveAppConnections as En, WELL_KNOWN_TAB_MAP as Er, deviceCredentialsCapability as Et, METHOD_ACCESS_MAP as F, scopesAllowAddon as Fn, defineCustomActions as Fr, evictionPolicyOfLocation as Ft, StorageLocationTypeSchema as G, streamCatalogCapability as Gn, isSecretMarker as Gr, isArrayOutputSchema as Gt, ScopedTokenSchema as H, storageMigrationCapability as Hn, isEvent as Hr, formatMinutes as Ht, MINUTES_PER_DAY as I, scopesAllowDeviceCap as In, emitDownForOwnedCaps as Ir, expandContainer as It, addonPagesCapability as J, userManagementCapability as Jn, nodePin as Jr, isLocationEnabled as Jt, StorageMigrationJobSchema as K, streamQualityLabel as Kn, isSecretMarkerLike as Kr, isCollectionArrayMethod as Kt, MOTION_CLOSE_AFTER_MS as L, scoreRuntimes as Ln, emitReadiness as Lr, expressionContainsBuiltinCall as Lt, KEYCHAIN_RESET_TRIGGER_ACTOR as M, resolveMethodAuth as Mn, collectZodSecretPaths as Mr, enumerateItemArrayFields as Mt, LOG_LEVEL_RANK as N, resolveNotificationTapAddress as Nn, createEvent as Nr, enumerateSchemaFields as Nt, FieldClaimModeSchema as O, resolveCoreBlockEntry as On, asNumber as Or, deviceManagerCapability as Ot, LegacyStorageLocationDefaultSchema as P, runtimeStatePolicyFor as Pn, customAction as Pr, evaluateCompositionField as Pt, authProviderCapability as Q, vectorIndexDimConflictError as Qn, parseSecretRef as Qr, keychainAdminCapability as Qt, RECORDING_SOURCE_CAMSTACK_ADDON as R, settingsStoreCapability as Rn, expandCapMethods as Rr, extractNestedAddonId as Rt, DEVICE_NONCE_TTL_MS as S, procedureAuthKey as Sn, RUNTIME_DEFAULTS as Sr, decodeVectorBase64 as St, DeclaredDevices as T, replacedFieldKeys as Tn, SECRET_CLEAR as Tr, describeComposableCaps as Tt, StorageCleanupJobSchema as U, storageOccupancyCapability as Un, isKeychainStoredField as Ur, gbToBytes as Ut, STREAM_PROFILE_META as V, storageCapability as Vn, isDeviceConfigCap as Vr, formatDeviceRevoker as Vt, StorageLocationModeSchema as W, storageProviderCapability as Wn, isSecretClear as Wr, isAppLinkBase as Wt, addonWidgetsCapability as X, validateCustomAddress as Xn, parseJsonObject as Xr, isVoidInput as Xt, addonSettingsCapability as Y, validateComposition as Yn, normalizeSecretOwner as Yr, isObjectInput as Yt, alertsCapability as Z, vectorDimFromBase64 as Zn, parseJsonUnknown as Zr, kebabToCamel as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, objectInputDeclaresRequiredDeviceId as _n, BaseAddon as _r, coreBlocksCapability as _t, BatteryStatusSchema as a, sleep as ai, logDestinationCapability as an, composedDeviceStableId as ar, buildStreamParamsConfigSchema as at, DERIVED_CAMERA_SILENCED_CAP_NAMES as b, planComposition as bn, DEVICE_STATUS_METHOD as br, databaseSnapshotCapability as bt, CAP_NAMES_WITH_STATUS as c, transformSecretWrite as ci, mayReadLocation as cn, compositionSliceKey as cr, canonicalIconKey as ct, CORE_BLOCKS_ADDON_ID as d, metricsProviderCapability as dn, disarmRoseMemory as dr, compositionFieldKey as dt, resolveCapMount as ei, legacyAutoLinkIds as en, withLocationMode as er, bareAddonId as et, CORE_BLOCK_ADDON_PREFIX as f, modeMayWrite as fn, toExpressionValue as fr, compositionSourceRefs as ft, DATABASE_SNAPSHOT_SUFFIX as g, objectInputDeclaresAddonId as gn, errMsg as gr, coreBlockSourceKind as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, normalizeUnit as hn, DeviceType as hr, coreBlockIdFromAddonId as ht, BaseDevice as i, secretTreeFromSchema as ii, locationIconKey as in, composedDeviceRef as ir, buildDeviceSignatureMessage as it, HUB_MDNS_TXT_KEYS as j, resolveLocationMode as jn, collectSecretConfigKeys as jr, enumerateInferenceDevices as jt, FieldClaimSchema as k, resolveCoreBlockFiles as kn, asString$1 as kr, deviceStateCapability as kt, COMPOSED_ITEM_FIXED_FIELDS as l, EventCategory as li, mayWriteToLocation as ln, compositionSourceKey as lr, checkRoleAddress as lt, CoreBlockSchema as m, normalizeCoreBlockWrite as mn, DeviceRole as mr, coreBlockComposition as mt, AlertSchema as n, scopeKey as ni, lifecycleJobSchema as nn, buildFfmpegArgs as nr, buildCapabilityLookup as nt, CAMERA_SWITCH_ORDER as o, toNodeId as oi, logLevelAtMost as on, compositionFeatureEnabled as or, calendarsCapability as ot, CalendarPreferencesSchema as p, motionCapability as pn, DeviceFeature as pr, coreBlockAddonId as pt, UserRecordSchema as q, supportedRuntimes as qn, makeSecretMarker as qr, isDefaultAppConnectionEndpoint as qt, ApiKeyRecordSchema as r, secretTreeFromPaths as ri, localNetworkCapability as rn, cloneStatefulExpressionMemory as rr, buildDeviceEnrollmentLink as rt, CAMSTACK_APP_LINK_ORIGIN as s, toSecretFieldView as si, looseSchema as sn, compositionItemFieldPath as sr, cameraGridLayoutCapability as st, ALL_CAPABILITY_DEFINITIONS as t, resolveSecretMarkers as ti, legacyModeOf as tn, COMPOSER_ADDON_ID as tr, batteryCapability as tt, COMPOSER_RUNNER_ID as u, memoizePinnedFfmpeg as un, createStatefulExpressionMemory as ur, composerCapability as ut, DATA_STORE_DATABASES as v, parseStreamParamsFormPatch as vn, DATAPLANE_SECRET_HEADER as vr, createDeviceExtensionProvider as vt, DEVICE_SAN_USER_PREFIX as w, reducePoints as wn, ReadinessTimeoutError as wr, deriveBatteryPresence as wt, DEVICE_ENROLLMENT_TTL_MS as x, platformProbeCapability as xn, REDACTED_SECRET as xr, declarationOwnerNodeId as xt, DAY_NAMES as y, pickAppLinkHub as yn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as yr, dataStoreProviderCapability as yt, RecordingStatusSchema as z, siteZoneKey as zn, formatSecretScope as zr, filesystemBrowseCapability as zt };
+export { addonWidgetsCapability as $, validateCustomAddress as $n, parseJsonObject as $r, isVoidInput as $t, FieldClaimModeSchema as A, resolveBucketMs as An, asJsonObject as Ar, deviceExtensionCapability as At, RECORDING_SOURCE_CAMSTACK_ADDON as B, scoreRuntimes as Bn, emitReadiness as Br, expressionContainsBuiltinCall as Bt, DEVICE_ENROLLMENT_TTL_MS as C, planComposition as Cn, DEVICE_STATUS_METHOD as Cr, databaseSnapshotCapability as Ct, DeclaredDevices as D, reducePoints as Dn, ReadinessTimeoutError as Dr, deriveBatteryPresence as Dt, DEVICE_SAN_USER_PREFIX as E, ptzAutotrackCapability as En, ReadinessRegistry as Er, defineExtensionSlotProvider as Et, LOG_LEVEL_RANK as F, resolveMethodAuth as Fn, collectZodSecretPaths as Fr, enumerateItemArrayFields as Ft, SsoBridgeClaimsSchema as G, storageMigrationCapability as Gn, isEvent as Gr, formatMinutes as Gt, STORAGE_ACCESS_FALLBACK as H, siteZoneKey as Hn, formatSecretScope as Hr, filesystemBrowseCapability as Ht, LegacyStorageLocationDefaultSchema as I, resolveNotificationTapAddress as In, createEvent as Ir, enumerateSchemaFields as It, StorageLocationTypeSchema as J, streamCatalogCapability as Jn, isSecretMarker as Jr, isArrayOutputSchema as Jt, StorageCleanupJobSchema as K, storageOccupancyCapability as Kn, isKeychainStoredField as Kr, gbToBytes as Kt, METHOD_ACCESS_MAP as L, runtimeStatePolicyFor as Ln, customAction as Lr, evaluateCompositionField as Lt, HUB_MDNS_SERVICE_TYPE as M, resolveCoreBlockFiles as Mn, asString$1 as Mr, deviceStateCapability as Mt, HUB_MDNS_TXT_KEYS as N, resolveHubAddressRoles as Nn, buildSecretRef as Nr, deviceStatusCapability as Nt, DeviceStatusSchema as O, replacedFieldKeys as On, SECRET_CLEAR as Or, describeComposableCaps as Ot, KEYCHAIN_RESET_TRIGGER_ACTOR as P, resolveLocationMode as Pn, collectSecretConfigKeys as Pr, enumerateInferenceDevices as Pt, addonSettingsCapability as Q, validateComposition as Qn, normalizeSecretOwner as Qr, isObjectInput as Qt, MINUTES_PER_DAY as R, scopesAllowAddon as Rn, defineCustomActions as Rr, evictionPolicyOfLocation as Rt, DERIVED_CAMERA_SILENCED_CAP_NAMES as S, pickAppLinkHub as Sn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Sr, dataStoreProviderCapability as St, DEVICE_SAN_CREDENTIAL_PREFIX as T, procedureAuthKey as Tn, RUNTIME_DEFAULTS as Tr, decodeVectorBase64 as Tt, STREAM_PROFILE_META as U, snapshotCapability as Un, hydrateSchema as Ur, foldSnapshotByFunction as Ut, RecordingStatusSchema as V, settingsStoreCapability as Vn, expandCapMethods as Vr, extractNestedAddonId as Vt, ScopedTokenSchema as W, storageCapability as Wn, isDeviceConfigCap as Wr, formatDeviceRevoker as Wt, UserRecordSchema as X, supportedRuntimes as Xn, makeSecretMarker as Xr, isDefaultAppConnectionEndpoint as Xt, StorageMigrationJobSchema as Y, streamQualityLabel as Yn, isSecretMarkerLike as Yr, isCollectionArrayMethod as Yt, addonPagesCapability as Z, userManagementCapability as Zn, nodePin as Zr, isLocationEnabled as Zt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as _, normalizeCoreBlockWrite as _n, DeviceRole as _r, coreBlockComposition as _t, ApiKeyRecordSchema as a, scopeKey as ai, lifecycleJobSchema as an, buildFfmpegArgs as ar, buildCapabilityLookup as at, DATA_STORE_DATABASES as b, objectInputDeclaresRequiredDeviceId as bn, BaseAddon as br, coreBlocksCapability as bt, CAMERA_SWITCH_ORDER as c, sleep as ci, logDestinationCapability as cn, composedDeviceStableId as cr, buildStreamParamsConfigSchema as ct, COMPOSED_ITEM_FIXED_FIELDS as d, transformSecretWrite as di, mayReadLocation as dn, compositionSliceKey as dr, canonicalIconKey as dt, parseJsonUnknown as ei, kebabToCamel as en, vectorDimFromBase64 as er, alertsCapability as et, COMPOSER_RUNNER_ID as f, EventCategory as fi, mayWriteToLocation as fn, compositionSourceKey as fr, checkRoleAddress as ft, CoreBlockSchema as g, motionCapability as gn, DeviceFeature as gr, coreBlockAddonId as gt, CalendarPreferencesSchema as h, modeMayWrite as hn, toExpressionValue as hr, compositionSourceRefs as ht, AlertSchema as i, resolveSecretMarkers as ii, legacyModeOf as in, COMPOSER_ADDON_ID as ir, batteryCapability as it, FieldClaimSchema as j, resolveCoreBlockEntry as jn, asNumber as jr, deviceManagerCapability as jt, FIRST_LEVEL_MACRO_CLASSES as k, resolveAppConnections as kn, WELL_KNOWN_TAB_MAP as kr, deviceCredentialsCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, toNodeId as li, logLevelAtMost as ln, compositionFeatureEnabled as lr, calendarsCapability as lt, CORE_BLOCK_ADDON_PREFIX as m, metricsProviderCapability as mn, disarmRoseMemory as mr, compositionFieldKey as mt, AGENT_MDNS_TXT_KEYS as n, readinessKey as ni, keychainCapability as nn, vectorStoreCapability as nr, backupCapability as nt, BaseDevice as o, secretTreeFromPaths as oi, localNetworkCapability as on, cloneStatefulExpressionMemory as or, buildDeviceEnrollmentLink as ot, CORE_BLOCKS_ADDON_ID as p, memoizePinnedFfmpeg as pn, createStatefulExpressionMemory as pr, composerCapability as pt, StorageLocationModeSchema as q, storageProviderCapability as qn, isSecretClear as qr, isAppLinkBase as qt, ALL_CAPABILITY_DEFINITIONS as r, resolveCapMount as ri, legacyAutoLinkIds as rn, withLocationMode as rr, bareAddonId as rt, BatteryStatusSchema as s, secretTreeFromSchema as si, locationIconKey as sn, composedDeviceRef as sr, buildDeviceSignatureMessage as st, AGENT_MDNS_SERVICE_TYPE as t, parseSecretRef as ti, keychainAdminCapability as tn, vectorIndexDimConflictError as tr, authProviderCapability as tt, CAP_NAMES_WITH_STATUS as u, toSecretFieldView as ui, looseSchema as un, compositionItemFieldPath as ur, cameraGridLayoutCapability as ut, DATABASE_SNAPSHOT_SUFFIX as v, normalizeUnit as vn, DeviceType as vr, coreBlockIdFromAddonId as vt, DEVICE_NONCE_TTL_MS as w, platformProbeCapability as wn, REDACTED_SECRET as wr, declarationOwnerNodeId as wt, DAY_NAMES as x, parseStreamParamsFormPatch as xn, DATAPLANE_SECRET_HEADER as xr, createDeviceExtensionProvider as xt, DATABASE_SNAPSHOT_TIMEOUT_MS as y, objectInputDeclaresAddonId as yn, errMsg as yr, coreBlockSourceKind as yt, MOTION_CLOSE_AFTER_MS as z, scopesAllowDeviceCap as zn, emitDownForOwnedCaps as zr, expandContainer as zt };

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-ChzCPUi2.js");
+const require_wal_maintenance = require("./wal-maintenance-LZYd8iT-.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-uQGuStFW.mjs";
+import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-DgLLPK14.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**