@camstack/system 1.2.433 → 1.2.435

package/dist/{agent-https-DtRU9A7I.mjs → agent-https-B8lKYVtU.mjs}

@@ -1,4 +1,4 @@
-import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CAjSsrkk.mjs";
+import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CDvj67p1.mjs";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { isIP } from "node:net";
@@ -301,11 +301,39 @@ function collectCertIdentity(options) {
 }
 //#endregion
 //#region src/tls/cert-issue.ts
+/**
+* Certificate issuance. Isolated so `cert-manager.ts` reads as policy and
+* this file reads as mechanics.
+*
+* **In-process, by decision (D551).** This used to shell out to `openssl`
+* three times. The hub's own TLS identity is not allowed to be a function
+* of which openssl happens to sit on the host: this fleet alone runs four
+* of them, and one — Ubuntu 20.04's 1.1.1f — silently ADDED the ambient
+* `/etc/ssl/openssl.cnf` `[req] x509_extensions = v3_ca` block on top of
+* our `-addext` flags, producing a root with two `basicConstraints` and
+* two `subjectKeyIdentifier` extensions. RFC 5280 §4.2 allows each at
+* most once, so OpenSSL 3 (which is what `node:crypto` is) marked that
+* root invalid: `X509Certificate.ca` read `false` on our own CA and
+* `checkIssued()` refused the pair. Under D227 that means "not issued by
+* the local CA", i.e. rotate the root — on every boot, forever, voiding
+* every trust an operator had granted by hand.
+*
+* Keys come from WebCrypto (`node:crypto`'s own implementation) and the
+* DER is assembled by `@peculiar/x509`. Nothing here reads the host.
+*/
 cryptoProvider.set(webcrypto);
 /** Subject of the local root. Distinct from the leaf's CN by construction. */
 var CA_COMMON_NAME = "CamStack Local CA";
 var MS_PER_DAY = 864e5;
 /**
+* Expiry of a served leaf. Browsers cap the TOTAL span (notBefore to notAfter) at 397 days, so
+* the span is `validDays` counted from the backdated start: the backdate costs five minutes of
+* expiry here, never extra span.
+*/
+function leafNotAfter(now, validDays) {
+	return new Date(backdatedNotBefore(now).getTime() + validDays * MS_PER_DAY);
+}
+/**
 * RSA-2048 / SHA-256. Unchanged from the openssl invocation this replaces:
 * every client that trusted the previous material still understands this.
 */
@@ -364,7 +392,7 @@ async function generateCa(now) {
 	const cert = await X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
 		signingAlgorithm: SIGNING_ALGORITHM,
@@ -406,8 +434,8 @@ async function issueLeaf(ca, identity, commonName, validDays, now) {
 			serialNumber: freshSerial(),
 			subject: `CN=${commonName}`,
 			issuer: ca.cert.subject,
-			notBefore: now,
-			notAfter: new Date(now.getTime() + validDays * MS_PER_DAY),
+			notBefore: backdatedNotBefore(now),
+			notAfter: leafNotAfter(now, validDays),
 			publicKey: keys.publicKey,
 			signingKey: ca.privateKey,
 			signingAlgorithm: SIGNING_ALGORITHM,
@@ -437,8 +465,8 @@ async function issueLeafFromCsr(ca, csrPem, identity, commonName, validDays, now
 		serialNumber: freshSerial(),
 		subject: `CN=${commonName}`,
 		issuer: ca.cert.subject,
-		notBefore: now,
-		notAfter: new Date(now.getTime() + validDays * MS_PER_DAY),
+		notBefore: backdatedNotBefore(now),
+		notAfter: leafNotAfter(now, validDays),
 		publicKey: csr.publicKey,
 		signingKey: ca.privateKey,
 		signingAlgorithm: SIGNING_ALGORITHM,

package/dist/{agent-https-CHZTxK-q.js → agent-https-BZIwS4xF.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_x509_es = require("./x509.es-Dzl0BbmG.js");
+const require_x509_es = require("./x509.es-r7Ht1thA.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_net = require("node:net");
@@ -303,11 +303,39 @@ function collectCertIdentity(options) {
 }
 //#endregion
 //#region src/tls/cert-issue.ts
+/**
+* Certificate issuance. Isolated so `cert-manager.ts` reads as policy and
+* this file reads as mechanics.
+*
+* **In-process, by decision (D551).** This used to shell out to `openssl`
+* three times. The hub's own TLS identity is not allowed to be a function
+* of which openssl happens to sit on the host: this fleet alone runs four
+* of them, and one — Ubuntu 20.04's 1.1.1f — silently ADDED the ambient
+* `/etc/ssl/openssl.cnf` `[req] x509_extensions = v3_ca` block on top of
+* our `-addext` flags, producing a root with two `basicConstraints` and
+* two `subjectKeyIdentifier` extensions. RFC 5280 §4.2 allows each at
+* most once, so OpenSSL 3 (which is what `node:crypto` is) marked that
+* root invalid: `X509Certificate.ca` read `false` on our own CA and
+* `checkIssued()` refused the pair. Under D227 that means "not issued by
+* the local CA", i.e. rotate the root — on every boot, forever, voiding
+* every trust an operator had granted by hand.
+*
+* Keys come from WebCrypto (`node:crypto`'s own implementation) and the
+* DER is assembled by `@peculiar/x509`. Nothing here reads the host.
+*/
 require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
 /** Subject of the local root. Distinct from the leaf's CN by construction. */
 var CA_COMMON_NAME = "CamStack Local CA";
 var MS_PER_DAY = 864e5;
 /**
+* Expiry of a served leaf. Browsers cap the TOTAL span (notBefore to notAfter) at 397 days, so
+* the span is `validDays` counted from the backdated start: the backdate costs five minutes of
+* expiry here, never extra span.
+*/
+function leafNotAfter(now, validDays) {
+	return new Date(require_x509_es.backdatedNotBefore(now).getTime() + validDays * MS_PER_DAY);
+}
+/**
 * RSA-2048 / SHA-256. Unchanged from the openssl invocation this replaces:
 * every client that trusted the previous material still understands this.
 */
@@ -366,7 +394,7 @@ async function generateCa(now) {
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: require_x509_es.backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
 		signingAlgorithm: SIGNING_ALGORITHM,
@@ -408,8 +436,8 @@ async function issueLeaf(ca, identity, commonName, validDays, now) {
 			serialNumber: freshSerial(),
 			subject: `CN=${commonName}`,
 			issuer: ca.cert.subject,
-			notBefore: now,
-			notAfter: new Date(now.getTime() + validDays * MS_PER_DAY),
+			notBefore: require_x509_es.backdatedNotBefore(now),
+			notAfter: leafNotAfter(now, validDays),
 			publicKey: keys.publicKey,
 			signingKey: ca.privateKey,
 			signingAlgorithm: SIGNING_ALGORITHM,
@@ -439,8 +467,8 @@ async function issueLeafFromCsr(ca, csrPem, identity, commonName, validDays, now
 		serialNumber: freshSerial(),
 		subject: `CN=${commonName}`,
 		issuer: ca.cert.subject,
-		notBefore: now,
-		notAfter: new Date(now.getTime() + validDays * MS_PER_DAY),
+		notBefore: require_x509_es.backdatedNotBefore(now),
+		notAfter: leafNotAfter(now, validDays),
 		publicKey: csr.publicKey,
 		signingKey: ca.privateKey,
 		signingAlgorithm: SIGNING_ALGORITHM,

package/dist/auth/device-ca.d.ts

@@ -1,13 +1,3 @@
-/**
-* Device CA (D855) — the THIRD certificate authority, distinct from the HTTPS
-* local CA (`tls/cert-issue.ts`, RSA) and the mesh CA
-* (`kernel/moleculer/mesh-mtls/mesh-ca.ts`). EC P-256, key in the keychain
-* (owner `system`), certificate persisted like `cluster.meshCa`.
-*
-* It signs ONE kind of leaf: a device credential. The device generated the key
-* pair; the hub only ever sees the public half (an SPKI). Same library and
-* WebCrypto path as the other two CAs, same pinned `@peculiar/x509`.
-*/
 import type { webcrypto as WebCrypto } from "node:crypto";
 import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
 /** `secret://system/global/deviceCaKey` — EC P-256 PKCS#8 PEM of the device CA. */

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { X as addonPagesCapability, di as EventCategory, vr as errMsg, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { Q as addonPagesCapability, br as errMsg, pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Q as addonWidgetsCapability, di as EventCategory, vr as errMsg, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { br as errMsg, et as addonWidgetsCapability, pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as alertsCapability, Fr as createEvent, di as EventCategory, i as AlertSchema, vr as errMsg, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { Lr as createEvent, br as errMsg, i as AlertSchema, pi as EventCategory, tt as alertsCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Tn as ptzAutotrackCapability, Wr as isEvent, di as EventCategory, k as FIRST_LEVEL_MACRO_CLASSES, nt as bareAddonId, vr as errMsg, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { Dn as ptzAutotrackCapability, Kr as isEvent, br as errMsg, it as bareAddonId, k as FIRST_LEVEL_MACRO_CLASSES, pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
-const require_restore_archive = require("../../restore-archive-DqPaRjjY.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
+const require_restore_archive = require("../../restore-archive-BNoFLAg8.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
-import { Gn as storageOccupancyCapability, Xr as nodePin, ci as toNodeId, di as EventCategory, dn as mayWriteToLocation, tt as backupCapability, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
-import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-C3_rzOCx.mjs";
+import { Qr as nodePin, pi as EventCategory, pn as mayWriteToLocation, qn as storageOccupancyCapability, rt as backupCapability, ui as toNodeId, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-DJYuznWP.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { ct as calendarsCapability, h as CalendarPreferencesSchema, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { h as CalendarPreferencesSchema, ut as calendarsCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { Ct as declarationOwnerNodeId, D as DeclaredDevices, Fr as createEvent, Hn as snapshotCapability, Hr as hydrateSchema, S as DERIVED_CAMERA_SILENCED_CAP_NAMES, _r as DeviceType, di as EventCategory, fn as memoizePinnedFfmpeg, hn as motionCapability, hr as DeviceFeature, ir as buildFfmpegArgs, lt as cameraGridLayoutCapability, o as BaseDevice, qn as streamCatalogCapability, vr as errMsg, yr as BaseAddon, z as MOTION_CLOSE_AFTER_MS } from "../../dist-DJnlnL7P.mjs";
+import { D as DeclaredDevices, Lr as createEvent, S as DERIVED_CAMERA_SILENCED_CAP_NAMES, Tt as declarationOwnerNodeId, Wn as snapshotCapability, Wr as hydrateSchema, Yn as streamCatalogCapability, _n as motionCapability, _r as DeviceFeature, br as errMsg, dt as cameraGridLayoutCapability, mn as memoizePinnedFfmpeg, o as BaseDevice, or as buildFfmpegArgs, pi as EventCategory, xr as BaseAddon, yr as DeviceType, z as MOTION_CLOSE_AFTER_MS } from "../../dist-Bz4_y8Xy.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
-const require_composition_sources = require("../../composition-sources-BgJWQMjr.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
+const require_composition_sources = require("../../composition-sources-Cm42mgbv.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { D as DeclaredDevices, Fr as createEvent, It as evaluateCompositionField, Sn as planComposition, _r as DeviceType, ar as cloneStatefulExpressionMemory, cr as compositionFeatureEnabled, d as COMPOSED_ITEM_FIXED_FIELDS, di as EventCategory, dr as compositionSourceKey, fr as createStatefulExpressionMemory, ft as composerCapability, it as buildCapabilityLookup, lr as compositionItemFieldPath, mr as toExpressionValue, o as BaseDevice, or as composedDeviceRef, pr as disarmRoseMemory, pt as compositionFieldKey, r as ALL_CAPABILITY_DEFINITIONS, rr as COMPOSER_ADDON_ID, sr as composedDeviceStableId, ur as compositionSliceKey, vr as errMsg, yr as BaseAddon, zt as expressionContainsBuiltinCall } from "../../dist-DJnlnL7P.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-8-cpAt1c.mjs";
+import { D as DeclaredDevices, Lr as createEvent, Rt as evaluateCompositionField, Vt as expressionContainsBuiltinCall, ar as COMPOSER_ADDON_ID, br as errMsg, cr as composedDeviceRef, d as COMPOSED_ITEM_FIXED_FIELDS, dr as compositionItemFieldPath, fr as compositionSliceKey, gr as toExpressionValue, hr as disarmRoseMemory, ht as compositionFieldKey, lr as composedDeviceStableId, mr as createStatefulExpressionMemory, mt as composerCapability, o as BaseDevice, ot as buildCapabilityLookup, pi as EventCategory, pr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, sr as cloneStatefulExpressionMemory, ur as compositionFeatureEnabled, wn as planComposition, xr as BaseAddon, yr as DeviceType } from "../../dist-Bz4_y8Xy.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-_7W2Ly9s.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { sn as logDestinationCapability, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
-const require_composition_sources = require("../../composition-sources-BgJWQMjr.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
+const require_composition_sources = require("../../composition-sources-Cm42mgbv.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { An as resolveCoreBlockEntry, D as DeclaredDevices, Dn as replacedFieldKeys, Dt as describeComposableCaps, Hr as hydrateSchema, Sn as planComposition, Zn as validateComposition, _t as coreBlockIdFromAddonId, dr as compositionSourceKey, f as COMPOSER_RUNNER_ID, g as CoreBlockSchema, gn as normalizeCoreBlockWrite, gt as coreBlockComposition, ht as coreBlockAddonId, it as buildCapabilityLookup, jn as resolveCoreBlockFiles, m as CORE_BLOCK_ADDON_PREFIX, mt as compositionSourceRefs, or as composedDeviceRef, p as CORE_BLOCKS_ADDON_ID, r as ALL_CAPABILITY_DEFINITIONS, vr as errMsg, vt as coreBlockSourceKind, yr as BaseAddon, yt as coreBlocksCapability } from "../../dist-DJnlnL7P.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-8-cpAt1c.mjs";
+import { $n as validateComposition, D as DeclaredDevices, Mn as resolveCoreBlockEntry, Nn as resolveCoreBlockFiles, Wr as hydrateSchema, _t as coreBlockAddonId, br as errMsg, bt as coreBlockSourceKind, cr as composedDeviceRef, f as COMPOSER_RUNNER_ID, g as CoreBlockSchema, gt as compositionSourceRefs, kn as replacedFieldKeys, kt as describeComposableCaps, m as CORE_BLOCK_ADDON_PREFIX, ot as buildCapabilityLookup, p as CORE_BLOCKS_ADDON_ID, pr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, vn as normalizeCoreBlockWrite, vt as coreBlockComposition, wn as planComposition, xr as BaseAddon, xt as coreBlocksCapability, yt as coreBlockIdFromAddonId } from "../../dist-Bz4_y8Xy.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-_7W2Ly9s.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-DJBQkZok.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-CO3RqsDw.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { A as FieldClaimModeSchema, At as deviceManagerCapability, Dr as SECRET_CLEAR, Ft as enumerateSchemaFields, Gr as isKeychainStoredField, In as runtimeStatePolicyFor, Jr as isSecretMarkerLike, Kr as isSecretClear, Mt as deviceStatusCapability, O as DeviceStatusSchema, Or as WELL_KNOWN_TAB_MAP, Pr as collectZodSecretPaths, Pt as enumerateItemArrayFields, R as MINUTES_PER_DAY, Rt as expandContainer, Tt as defineExtensionSlotProvider, U as STREAM_PROFILE_META, Ur as isDeviceConfigCap, Vn as siteZoneKey, Wt as formatMinutes, _n as normalizeUnit, _r as DeviceType, ai as secretTreeFromPaths, bn as parseStreamParamsFormPatch, bt as createDeviceExtensionProvider, c as CAMERA_SWITCH_ORDER, di as EventCategory, gr as DeviceRole, hr as DeviceFeature, j as FieldClaimSchema, jt as deviceStateCapability, kt as deviceExtensionCapability, li as toSecretFieldView, nn as legacyAutoLinkIds, on as locationIconKey, qr as isSecretMarker, r as ALL_CAPABILITY_DEFINITIONS, ri as resolveSecretMarkers, si as sleep$1, st as buildStreamParamsConfigSchema, u as CAP_NAMES_WITH_STATUS, ui as transformSecretWrite, ut as canonicalIconKey, vr as errMsg, x as DAY_NAMES, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CAWHWDwy.mjs";
+import { A as FieldClaimModeSchema, Ar as WELL_KNOWN_TAB_MAP, Bt as expandContainer, Dt as defineExtensionSlotProvider, Gr as isDeviceConfigCap, Ir as collectZodSecretPaths, It as enumerateItemArrayFields, Jr as isSecretClear, Kt as formatMinutes, Lt as enumerateSchemaFields, Mt as deviceManagerCapability, Nt as deviceStateCapability, O as DeviceStatusSchema, Pt as deviceStatusCapability, R as MINUTES_PER_DAY, Rn as runtimeStatePolicyFor, Sn as parseStreamParamsFormPatch, St as createDeviceExtensionProvider, Un as siteZoneKey, W as STREAM_PROFILE_META, Xr as isSecretMarkerLike, Yr as isSecretMarker, _r as DeviceFeature, ai as resolveSecretMarkers, br as errMsg, c as CAMERA_SWITCH_ORDER, cn as locationIconKey, di as toSecretFieldView, fi as transformSecretWrite, ft as canonicalIconKey, in as legacyAutoLinkIds, j as FieldClaimSchema, jt as deviceExtensionCapability, kr as SECRET_CLEAR, li as sleep$1, lt as buildStreamParamsConfigSchema, pi as EventCategory, qr as isKeychainStoredField, r as ALL_CAPABILITY_DEFINITIONS, si as secretTreeFromPaths, u as CAP_NAMES_WITH_STATUS, vr as DeviceRole, x as DAY_NAMES, xr as BaseAddon, yn as normalizeUnit, yr as DeviceType } from "../../dist-Bz4_y8Xy.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-9nA85bwT.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { sn as logDestinationCapability, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
-const require_device_ca = require("../../device-ca-NNP4Jz0P.js");
-const require_constants = require("../../constants-Ah3T_KAW.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
+const require_device_ca = require("../../device-ca-WXuKc8AX.js");
+const require_constants = require("../../constants-DL87WgeN.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { P as KEYCHAIN_RESET_TRIGGER_ACTOR, Vr as formatSecretScope, Zr as normalizeSecretOwner, di as EventCategory, ei as parseSecretRef, en as keychainAdminCapability, tn as keychainCapability, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-DUrcTW5h.mjs";
-import { a as MESH_CA_KEY_REF, p as CLUSTER_SECRET_SETTINGS_KEY } from "../../constants-Cg9ve13y.mjs";
+import { $r as normalizeSecretOwner, P as KEYCHAIN_RESET_TRIGGER_ACTOR, Ur as formatSecretScope, ni as parseSecretRef, nn as keychainAdminCapability, pi as EventCategory, rn as keychainCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-B6YJZus6.mjs";
+import { a as MESH_CA_KEY_REF, p as CLUSTER_SECRET_SETTINGS_KEY } from "../../constants-DoiTA134.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { B as RECORDING_SOURCE_CAMSTACK_ADDON, Fr as createEvent, V as RecordingStatusSchema, di as EventCategory, vr as errMsg, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { H as RecordingStatusSchema, Lr as createEvent, V as RECORDING_SOURCE_CAMSTACK_ADDON, br as errMsg, pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-NNP4Jz0P.js");
+const require_device_ca = require("../../device-ca-WXuKc8AX.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -6125,7 +6125,8 @@ var AuthManager = class {
 			...payload.refreshTtl !== void 0 ? { refreshTtl: payload.refreshTtl } : {},
 			...payload.linkIntent !== void 0 ? { linkIntent: payload.linkIntent } : {},
 			...payload.issuer !== void 0 ? { issuer: payload.issuer } : {},
-			...payload.browserBinding !== void 0 ? { browserBinding: payload.browserBinding } : {}
+			...payload.browserBinding !== void 0 ? { browserBinding: payload.browserBinding } : {},
+			...payload.app !== void 0 ? { app: payload.app } : {}
 		};
 		/**
 		* `'never'` mints with NO `exp` claim, and the option must be OMITTED to do
@@ -6170,6 +6171,9 @@ var AuthManager = class {
 			const linkIntent = typeof decoded["linkIntent"] === "string" ? decoded["linkIntent"] : void 0;
 			const issuer = typeof decoded["issuer"] === "string" ? decoded["issuer"] : void 0;
 			const browserBinding = typeof decoded["browserBinding"] === "string" ? decoded["browserBinding"] : void 0;
+			const appParsed = require_dist.SsoBridgeClaimsSchema.shape.app.safeParse(decoded["app"]);
+			if (!appParsed.success) return null;
+			const app = appParsed.data;
 			const rawRefreshTtl = decoded["refreshTtl"];
 			const refreshTtl = rawRefreshTtl === "never" || typeof rawRefreshTtl === "number" && rawRefreshTtl > 0 ? rawRefreshTtl : void 0;
 			return {
@@ -6188,7 +6192,8 @@ var AuthManager = class {
 				...refreshTtl !== void 0 ? { refreshTtl } : {},
 				...linkIntent !== void 0 ? { linkIntent } : {},
 				...issuer !== void 0 ? { issuer } : {},
-				...browserBinding !== void 0 ? { browserBinding } : {}
+				...browserBinding !== void 0 ? { browserBinding } : {},
+				...app !== void 0 ? { app } : {}
 			};
 		} catch {
 			return null;

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { C as DEVICE_ENROLLMENT_TTL_MS, Ot as deviceCredentialsCapability, Ut as formatDeviceRevoker, W as ScopedTokenSchema, Xn as userManagementCapability, Y as UserRecordSchema, a as ApiKeyRecordSchema, at as buildDeviceEnrollmentLink, et as authProviderCapability, ot as buildDeviceSignatureMessage, w as DEVICE_NONCE_TTL_MS, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { At as deviceCredentialsCapability, C as DEVICE_ENROLLMENT_TTL_MS, G as ScopedTokenSchema, Gt as formatDeviceRevoker, K as SsoBridgeClaimsSchema, Qn as userManagementCapability, Z as UserRecordSchema, a as ApiKeyRecordSchema, ct as buildDeviceSignatureMessage, nt as authProviderCapability, st as buildDeviceEnrollmentLink, w as DEVICE_NONCE_TTL_MS, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-DUrcTW5h.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-B6YJZus6.mjs";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -6115,7 +6115,8 @@ var AuthManager = class {
 			...payload.refreshTtl !== void 0 ? { refreshTtl: payload.refreshTtl } : {},
 			...payload.linkIntent !== void 0 ? { linkIntent: payload.linkIntent } : {},
 			...payload.issuer !== void 0 ? { issuer: payload.issuer } : {},
-			...payload.browserBinding !== void 0 ? { browserBinding: payload.browserBinding } : {}
+			...payload.browserBinding !== void 0 ? { browserBinding: payload.browserBinding } : {},
+			...payload.app !== void 0 ? { app: payload.app } : {}
 		};
 		/**
 		* `'never'` mints with NO `exp` claim, and the option must be OMITTED to do
@@ -6160,6 +6161,9 @@ var AuthManager = class {
 			const linkIntent = typeof decoded["linkIntent"] === "string" ? decoded["linkIntent"] : void 0;
 			const issuer = typeof decoded["issuer"] === "string" ? decoded["issuer"] : void 0;
 			const browserBinding = typeof decoded["browserBinding"] === "string" ? decoded["browserBinding"] : void 0;
+			const appParsed = SsoBridgeClaimsSchema.shape.app.safeParse(decoded["app"]);
+			if (!appParsed.success) return null;
+			const app = appParsed.data;
 			const rawRefreshTtl = decoded["refreshTtl"];
 			const refreshTtl = rawRefreshTtl === "never" || typeof rawRefreshTtl === "number" && rawRefreshTtl > 0 ? rawRefreshTtl : void 0;
 			return {
@@ -6178,7 +6182,8 @@ var AuthManager = class {
 				...refreshTtl !== void 0 ? { refreshTtl } : {},
 				...linkIntent !== void 0 ? { linkIntent } : {},
 				...issuer !== void 0 ? { issuer } : {},
-				...browserBinding !== void 0 ? { browserBinding } : {}
+				...browserBinding !== void 0 ? { browserBinding } : {},
+				...app !== void 0 ? { app } : {}
 			};
 		} catch {
 			return null;

package/dist/builtins/local-network/address-book.d.ts

@@ -80,6 +80,19 @@ export declare function customEndpoint(entry: CustomAddress): ConnectionEndpoint
 * addresses flagged `appConnections` (a detected URL is never listed twice).
 */
 export declare function withAppConnectionCustomEndpoints(detected: readonly ConnectionEndpoint[], state: AddressBookState): ConnectionEndpoint[];
+/**
+* The HTTPS counterpart of every LAN address advertised over plain HTTP
+* (D859): `http://<lan>:<httpPort>` gains `https://<lan>:<httpsPort>`, the hub's
+* TLS listener, as its own row straight after it. The twin is an ordinary
+* detected LAN row — ticked, unticked and flagged like any other, on by default
+* (a LAN row is an automatic app connection). A phone that does not trust the
+* hub's local CA fails that candidate in the race it already runs; one that
+* does reaches it. Only the app-connection palette and the table carry twins:
+* the palette `internal` and `publicEndpoint` resolve over never does, so those
+* roles keep their answer. Rows already on https (LAN HTTP off), the public
+* tunnel, the mesh, custom addresses and loopback have no twin.
+*/
+export declare function withLanHttpsCounterparts(palette: readonly ConnectionEndpoint[], httpsPort: number): ConnectionEndpoint[];
 export interface AddressBookInputs {
 	/** Detected endpoints in the scheme the rows are shown in. */
 	readonly rowsPalette: readonly ConnectionEndpoint[];

package/dist/builtins/local-network/local-network.addon.d.ts

@@ -75,6 +75,8 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
 	/** Optional public hostname tracked from `NetworkTunnelStarted`/
 	*  `Stopped` events on the bus. */
 	private publicHostname;
+	/** False for a Quick tunnel: shown in the palette, never picked automatically (D860). */
+	private publicHostnameStable;
 	/**
 	* Mesh-reachable endpoint (Tailscale MagicDNS / 100.x), learned from
 	* the `MeshNetworkChanged` event-tail and refreshed by a pull-reconcile
@@ -142,7 +144,7 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
 	* `onInitialize`. This setter exists for tests + future direct
 	* callers; cleared by passing an empty string.
 	*/
-	setPublicHostname(hostname: string): void;
+	setPublicHostname(hostname: string, stable?: boolean): void;
 	/**
 	* Replace the cached mesh endpoint. Set from the `MeshNetworkChanged`
 	* event-tail + the pull-reconcile; exposed for tests + future direct
@@ -270,7 +272,7 @@ export interface LanHttpAdvertisement {
 * only emitted on `includeAppLink: true`.
 */
 export declare function appLinkEndpoint(): ConnectionEndpoint;
-export declare function buildEndpoints(interfaces: readonly LocalInterface[], port: number, includeLoopback: boolean, ipv4Only: boolean, publicHostname: string, scheme?: "http" | "https", meshEndpoint?: MeshEndpointCache | null, lanHttp?: LanHttpAdvertisement | null): ConnectionEndpoint[];
+export declare function buildEndpoints(interfaces: readonly LocalInterface[], port: number, includeLoopback: boolean, ipv4Only: boolean, publicHostname: string, scheme?: "http" | "https", meshEndpoint?: MeshEndpointCache | null, lanHttp?: LanHttpAdvertisement | null, publicHostnameStable?: boolean): ConnectionEndpoint[];
 /**
 * First-boot heuristic: which addresses should the allowlist start
 * with? Includes LAN + Wi-Fi IPv4 addresses + plausible IPv6: