@camstack/system 1.2.433 → 1.2.435

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,9 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Hr as hydrateSchema, Ir as customAction, Kr as isSecretClear, Lr as defineCustomActions, Yr as makeSecretMarker, oi as secretTreeFromSchema, qr as isSecretMarker, ui as transformSecretWrite, vr as errMsg, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { Jr as isSecretClear, Rr as customAction, Wr as hydrateSchema, Yr as isSecretMarker, Zr as makeSecretMarker, br as errMsg, ci as secretTreeFromSchema, fi as transformSecretWrite, xr as BaseAddon, zr as defineCustomActions } from "../../dist-Bz4_y8Xy.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
-import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-CAjSsrkk.mjs";
-import { A as AgentHttpsNames, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, d as isPrivateAddress, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, u as isLocalOnlyHostname } from "../../agent-https-DtRU9A7I.mjs";
-import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-Cg9ve13y.mjs";
+import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-CDvj67p1.mjs";
+import { A as AgentHttpsNames, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, d as isPrivateAddress, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, u as isLocalOnlyHostname } from "../../agent-https-B8lKYVtU.mjs";
+import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-DoiTA134.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createHmac, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";
@@ -399,6 +399,15 @@ function parsePayloadEs256(value) {
 }
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
+/**
+* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
+*
+* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
+* signs node leaves (CN = nodeID) and join-token JWS (ES256). Issuance uses
+* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
+* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
+* the pinned range already shipping).
+*/
 cryptoProvider.set(webcrypto);
 var MS_PER_DAY = 864e5;
 /** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
@@ -449,7 +458,7 @@ async function generateMeshCa(now = /* @__PURE__ */ new Date()) {
 	const cert = await X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${MESH_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + MESH_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
 		signingAlgorithm: MESH_SIGNING_ALGORITHM,
@@ -500,7 +509,7 @@ async function issueMeshLeafFromCsr(ca, csrPem, opts = {}) {
 			serialNumber,
 			subject: `CN=${cn}`,
 			issuer: ca.cert.subject,
-			notBefore: now,
+			notBefore: backdatedNotBefore(now),
 			notAfter,
 			publicKey: csr.publicKey,
 			signingKey: ca.privateKey,
@@ -88429,12 +88438,18 @@ function isHttpUrl(value) {
 		return false;
 	}
 }
-/** The hub CA must be a self-signed CA certificate, valid now. */
+/**
+* Clock skew tolerated between the hub that minted a CA and this agent. X.509 dates have
+* one-second resolution and a fresh CA's notBefore is the hub's "now", so an agent whose clock
+* is even a moment behind would otherwise refuse a brand-new CA. Same bound as the offer `iat`.
+*/
+var CA_CLOCK_SKEW_MS = 6e4;
+/** The hub CA must be a self-signed CA certificate, valid now (give or take the skew). */
 function readCaCertificate(pem, nowMs) {
 	try {
 		const cert = new X509Certificate(pem);
 		if (!cert.ca || !cert.verify(cert.publicKey)) return null;
-		if (Date.parse(cert.validTo) <= nowMs || Date.parse(cert.validFrom) > nowMs) return null;
+		if (Date.parse(cert.validTo) <= nowMs || Date.parse(cert.validFrom) > nowMs + CA_CLOCK_SKEW_MS) return null;
 		return cert;
 	} catch {
 		return null;

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C6Yvfhpq.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { sn as logDestinationCapability, yr as BaseAddon } from "../../dist-DJnlnL7P.mjs";
+import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-BgJWQMjr.js → composition-sources-Cm42mgbv.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-C6Yvfhpq.js");
+const require_dist = require("./dist-CnUtkSwN.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-8-cpAt1c.mjs → composition-sources-_7W2Ly9s.mjs}

@@ -1,4 +1,4 @@
-import { dr as compositionSourceKey, vr as errMsg } from "./dist-DJnlnL7P.mjs";
+import { br as errMsg, pr as compositionSourceKey } from "./dist-Bz4_y8Xy.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-Ah3T_KAW.js → constants-DL87WgeN.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-C6Yvfhpq.js");
+const require_dist = require("./dist-CnUtkSwN.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{constants-Cg9ve13y.mjs → constants-DoiTA134.mjs}

@@ -1,4 +1,4 @@
-import { Mr as buildSecretRef } from "./dist-DJnlnL7P.mjs";
+import { Pr as buildSecretRef } from "./dist-Bz4_y8Xy.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{device-ca-DUrcTW5h.mjs → device-ca-B6YJZus6.mjs}

@@ -1,5 +1,5 @@
-import { E as DEVICE_SAN_USER_PREFIX, Mr as buildSecretRef, T as DEVICE_SAN_CREDENTIAL_PREFIX } from "./dist-DJnlnL7P.mjs";
-import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CAjSsrkk.mjs";
+import { E as DEVICE_SAN_USER_PREFIX, Pr as buildSecretRef, T as DEVICE_SAN_CREDENTIAL_PREFIX } from "./dist-Bz4_y8Xy.mjs";
+import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CDvj67p1.mjs";
 import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**
@@ -126,6 +126,16 @@ async function loadJwtSigningKey(deps) {
 }
 //#endregion
 //#region src/auth/device-ca.ts
+/**
+* Device CA (D855) — the THIRD certificate authority, distinct from the HTTPS
+* local CA (`tls/cert-issue.ts`, RSA) and the mesh CA
+* (`kernel/moleculer/mesh-mtls/mesh-ca.ts`). EC P-256, key in the keychain
+* (owner `system`), certificate persisted like `cluster.meshCa`.
+*
+* It signs ONE kind of leaf: a device credential. The device generated the key
+* pair; the hub only ever sees the public half (an SPKI). Same library and
+* WebCrypto path as the other two CAs, same pinned `@peculiar/x509`.
+*/
 cryptoProvider.set(webcrypto);
 var MS_PER_DAY = 864e5;
 var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
@@ -164,7 +174,7 @@ async function generateDeviceCa(now = /* @__PURE__ */ new Date()) {
 	const cert = await X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
 		signingAlgorithm: SIGNING_ALGORITHM,
@@ -204,7 +214,7 @@ async function rebuildDeviceCaCertificate(keyPem) {
 	const cert = await X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys: {
 			privateKey,
@@ -234,8 +244,9 @@ async function importDevicePublicKey(spki) {
 */
 async function issueDeviceLeaf(ca, input) {
 	const publicKey = await importDevicePublicKey(input.publicKeySpki);
-	const notBefore = input.now ?? /* @__PURE__ */ new Date();
-	const notAfter = new Date(notBefore.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
+	const issuedAt = input.now ?? /* @__PURE__ */ new Date();
+	const notBefore = backdatedNotBefore(issuedAt);
+	const notAfter = new Date(issuedAt.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
 	const serialNumber = freshSerial();
 	const extensions = [
 		new BasicConstraintsExtension(false, void 0, true),

package/dist/{device-ca-NNP4Jz0P.js → device-ca-WXuKc8AX.js}

@@ -1,5 +1,5 @@
-const require_dist = require("./dist-C6Yvfhpq.js");
-const require_x509_es = require("./x509.es-Dzl0BbmG.js");
+const require_dist = require("./dist-CnUtkSwN.js");
+const require_x509_es = require("./x509.es-r7Ht1thA.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**
@@ -126,6 +126,16 @@ async function loadJwtSigningKey(deps) {
 }
 //#endregion
 //#region src/auth/device-ca.ts
+/**
+* Device CA (D855) — the THIRD certificate authority, distinct from the HTTPS
+* local CA (`tls/cert-issue.ts`, RSA) and the mesh CA
+* (`kernel/moleculer/mesh-mtls/mesh-ca.ts`). EC P-256, key in the keychain
+* (owner `system`), certificate persisted like `cluster.meshCa`.
+*
+* It signs ONE kind of leaf: a device credential. The device generated the key
+* pair; the hub only ever sees the public half (an SPKI). Same library and
+* WebCrypto path as the other two CAs, same pinned `@peculiar/x509`.
+*/
 require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
 var MS_PER_DAY = 864e5;
 var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
@@ -164,7 +174,7 @@ async function generateDeviceCa(now = /* @__PURE__ */ new Date()) {
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: require_x509_es.backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
 		signingAlgorithm: SIGNING_ALGORITHM,
@@ -204,7 +214,7 @@ async function rebuildDeviceCaCertificate(keyPem) {
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
 		name: `CN=${DEVICE_CA_COMMON_NAME}`,
-		notBefore: now,
+		notBefore: require_x509_es.backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys: {
 			privateKey,
@@ -234,8 +244,9 @@ async function importDevicePublicKey(spki) {
 */
 async function issueDeviceLeaf(ca, input) {
 	const publicKey = await importDevicePublicKey(input.publicKeySpki);
-	const notBefore = input.now ?? /* @__PURE__ */ new Date();
-	const notAfter = new Date(notBefore.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
+	const issuedAt = input.now ?? /* @__PURE__ */ new Date();
+	const notBefore = require_x509_es.backdatedNotBefore(issuedAt);
+	const notAfter = new Date(issuedAt.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
 	const serialNumber = freshSerial();
 	const extensions = [
 		new require_x509_es.BasicConstraintsExtension(false, void 0, true),

package/dist/{dist-DJnlnL7P.mjs → dist-Bz4_y8Xy.mjs}

@@ -718,7 +718,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep--g-h2_c_.mjs
+//#region ../types/dist/sleep-DAX0-2v9.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -9768,6 +9768,12 @@ function scopesAllowDeviceCap(scopes, access) {
 function scopesAllowAddon(scopes, addonId, access) {
 	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
 }
+z.enum(["new-session", "step-up"]);
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = z.discriminatedUnion("kind", [z.object({ kind: z.literal("native") }), z.object({
+	kind: z.literal("browser"),
+	startPath: z.string().startsWith("/")
+})]);
 /**
 * Device certificates (D855) — the wire contract shared by the hub, the admin
 * UI and the native viewer.
@@ -9966,7 +9972,9 @@ z.object({
 	signature: z.literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: z.array(z.enum(["native", "web"]))
+	clients: z.array(z.enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 /**
 * What an expression's named bindings READ from.
@@ -39968,10 +39976,14 @@ function isLanIpv4Literal(endpoint) {
 	const host = hostnameOf(endpoint.baseUrl);
 	return host !== null && IPV4_LITERAL.test(host);
 }
+function isUnstable(endpoint) {
+	return endpoint.stable === false;
+}
 /** Lower = better; `null` = never this role's AUTOMATIC answer. */
 function autoRankFor(role, endpoint) {
 	if (endpoint.kind === "loopback" || endpoint.kind === "app-link" || endpoint.kind === "custom") return null;
 	if (hostnameOf(endpoint.baseUrl) === null) return null;
+	if (isUnstable(endpoint)) return null;
 	if (role === "internal") {
 		if (isLanIpv4Literal(endpoint)) return 0;
 		if (isPlausibleLan(endpoint)) return 1;
@@ -40126,6 +40138,7 @@ function resolveNotificationTapAddress(flags) {
 }
 /** AUTO app connections: LAN IPv4 + the public tunnel. Never IPv6, mesh, loopback or custom. */
 function isDefaultAppConnectionEndpoint(endpoint) {
+	if (isUnstable(endpoint)) return false;
 	if (endpoint.kind === "lan-ipv4") return true;
 	return endpoint.kind === "public" && endpoint.interfaceKind === "public";
 }
@@ -41167,7 +41180,13 @@ var RedirectLoginMethodSchema = z.object({
 	* `beginExternalLink` offer exactly the redirect methods that set this,
 	* whatever their id. Absent / false — a login button only.
 	*/
-	linkable: z.boolean().optional()
+	linkable: z.boolean().optional(),
+	/**
+	* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+	* when the route understands the app flow query (`app=1&code_challenge=…`),
+	* `null`/absent when there is no app path - the app hides the method.
+	*/
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A Module-Federation widget the login page mounts for an in-page
@@ -41186,7 +41205,9 @@ var WidgetLoginMethodSchema = z.object({
 	bundle: z.string(),
 	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 	remote: WidgetRemoteSchema,
-	stage: LoginStageEnum
+	stage: LoginStageEnum,
+	/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A declarative WebAuthn ceremony the shell renders natively (no remote
@@ -41204,7 +41225,9 @@ var PasskeyLoginMethodSchema = z.object({
 	/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 	rpId: z.string(),
 	/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-	origin: z.string().nullable()
+	origin: z.string().nullable(),
+	/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
 var LoginMethodContributionSchema = z.discriminatedUnion("kind", [
@@ -41842,7 +41865,25 @@ var NetworkEndpointSchema = z.object({
 	url: z.string(),
 	hostname: z.string(),
 	port: z.number(),
-	protocol: z.enum(["http", "https"])
+	protocol: z.enum(["http", "https"]),
+	/**
+	* Whether this address survives a restart of its provider. `false` = it is
+	* re-issued every time (a Quick tunnel's random `*.trycloudflare.com`); the
+	* hub never selects such an address AUTOMATICALLY for a role (D860), though
+	* it stays visible and an operator may still flag it. Absent = stable: every
+	* provider except a Quick tunnel owns a name that does not change.
+	*/
+	stable: z.boolean().optional()
+});
+/**
+* `data` of a `network.tunnel.started` event — what `local-network` (which
+* tails the bus and cannot import a provider) learns about the new address.
+*/
+var NetworkTunnelStartedDataSchema = z.object({
+	url: z.string(),
+	/** Mirrors {@link NetworkEndpointSchema} `stable`; absent = stable. */
+	stable: z.boolean().optional(),
+	updated: z.boolean().optional()
 });
 var NetworkAccessStatusSchema = z.object({
 	connected: z.boolean(),
@@ -54140,7 +54181,20 @@ var SsoBridgeClaimsSchema = z.object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: z.string().optional()
+	browserBinding: z.string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: z.object({
+		codeChallenge: z.string(),
+		state: z.string(),
+		purpose: z.enum(["new-session", "step-up"]),
+		redirect: z.string()
+	}).optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -57125,7 +57179,12 @@ var SearchResultSchema = z.object({
 	publishedAt: z.string(),
 	author: z.string(),
 	installed: z.boolean(),
-	installedVersion: z.string().optional()
+	installedVersion: z.string().optional(),
+	/**
+	* Capability names the package's addons declare (from its published
+	* manifest). `null` = the registry lookup failed — unknown, never `[]` (D393).
+	*/
+	capabilities: z.array(z.string()).readonly().nullable()
 });
 var AutoUpdateSettingsSchema = z.object({
 	channel: ChannelSchema,
@@ -57344,7 +57403,11 @@ var addonsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		searchAvailable: method(z.object({ query: z.string().optional() }), z.array(SearchResultSchema)),
+		searchAvailable: method(z.object({
+			query: z.string().optional(),
+			/** Only packages whose addons declare this capability (unknown ones excluded). */
+			capability: z.string().optional()
+		}), z.array(SearchResultSchema)),
 		/**
 		* Available package updates for a node. `nodeId` omitted (or
 		* `'hub'`) checks the hub's own installed packages; an agent
@@ -61451,7 +61514,13 @@ var ConnectionEndpointSchema = z.object({
 	* calls so the client can sort even if the cap returns a new
 	* ordering between polls.
 	*/
-	priority: z.number()
+	priority: z.number(),
+	/**
+	* `false` = the address changes on its own (a Quick tunnel, re-issued on
+	* every respawn). Automatic role resolution skips it (D860); an explicit
+	* operator flag still honours it. Absent = stable.
+	*/
+	stable: z.boolean().optional()
 });
 /**
 * Where the advertised local port came from. Ordered most → least
@@ -85514,4 +85583,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { alertsCapability as $, vectorDimFromBase64 as $n, parseJsonUnknown as $r, kebabToCamel as $t, FieldClaimModeSchema as A, resolveCoreBlockEntry as An, asNumber as Ar, deviceManagerCapability as At, RECORDING_SOURCE_CAMSTACK_ADDON as B, settingsStoreCapability as Bn, expandCapMethods as Br, extractNestedAddonId as Bt, DEVICE_ENROLLMENT_TTL_MS as C, platformProbeCapability as Cn, REDACTED_SECRET as Cr, declarationOwnerNodeId as Ct, DeclaredDevices as D, replacedFieldKeys as Dn, SECRET_CLEAR as Dr, describeComposableCaps as Dt, DEVICE_SAN_USER_PREFIX as E, reducePoints as En, ReadinessTimeoutError as Er, deriveBatteryPresence as Et, LOG_LEVEL_RANK as F, resolveNotificationTapAddress as Fn, createEvent as Fr, enumerateSchemaFields as Ft, StorageCleanupJobSchema as G, storageOccupancyCapability as Gn, isKeychainStoredField as Gr, gbToBytes as Gt, STORAGE_ACCESS_FALLBACK as H, snapshotCapability as Hn, hydrateSchema as Hr, foldSnapshotByFunction as Ht, LegacyStorageLocationDefaultSchema as I, runtimeStatePolicyFor as In, customAction as Ir, evaluateCompositionField as It, StorageMigrationJobSchema as J, streamQualityLabel as Jn, isSecretMarkerLike as Jr, isCollectionArrayMethod as Jt, StorageLocationModeSchema as K, storageProviderCapability as Kn, isSecretClear as Kr, isAppLinkBase as Kt, METHOD_ACCESS_MAP as L, scopesAllowAddon as Ln, defineCustomActions as Lr, evictionPolicyOfLocation as Lt, HUB_MDNS_SERVICE_TYPE as M, resolveHubAddressRoles as Mn, buildSecretRef as Mr, deviceStatusCapability as Mt, HUB_MDNS_TXT_KEYS as N, resolveLocationMode as Nn, collectSecretConfigKeys as Nr, enumerateInferenceDevices as Nt, DeviceStatusSchema as O, resolveAppConnections as On, WELL_KNOWN_TAB_MAP as Or, deviceCredentialsCapability as Ot, KEYCHAIN_RESET_TRIGGER_ACTOR as P, resolveMethodAuth as Pn, collectZodSecretPaths as Pr, enumerateItemArrayFields as Pt, addonWidgetsCapability as Q, validateCustomAddress as Qn, parseJsonObject as Qr, isVoidInput as Qt, MINUTES_PER_DAY as R, scopesAllowDeviceCap as Rn, emitDownForOwnedCaps as Rr, expandContainer as Rt, DERIVED_CAMERA_SILENCED_CAP_NAMES as S, planComposition as Sn, DEVICE_STATUS_METHOD as Sr, databaseSnapshotCapability as St, DEVICE_SAN_CREDENTIAL_PREFIX as T, ptzAutotrackCapability as Tn, ReadinessRegistry as Tr, defineExtensionSlotProvider as Tt, STREAM_PROFILE_META as U, storageCapability as Un, isDeviceConfigCap as Ur, formatDeviceRevoker as Ut, RecordingStatusSchema as V, siteZoneKey as Vn, formatSecretScope as Vr, filesystemBrowseCapability as Vt, ScopedTokenSchema as W, storageMigrationCapability as Wn, isEvent as Wr, formatMinutes as Wt, addonPagesCapability as X, userManagementCapability as Xn, nodePin as Xr, isLocationEnabled as Xt, UserRecordSchema as Y, supportedRuntimes as Yn, makeSecretMarker as Yr, isDefaultAppConnectionEndpoint as Yt, addonSettingsCapability as Z, validateComposition as Zn, normalizeSecretOwner as Zr, isObjectInput as Zt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as _, normalizeUnit as _n, DeviceType as _r, coreBlockIdFromAddonId as _t, ApiKeyRecordSchema as a, secretTreeFromPaths as ai, localNetworkCapability as an, cloneStatefulExpressionMemory as ar, buildDeviceEnrollmentLink as at, DATA_STORE_DATABASES as b, parseStreamParamsFormPatch as bn, DATAPLANE_SECRET_HEADER as br, createDeviceExtensionProvider as bt, CAMERA_SWITCH_ORDER as c, toNodeId as ci, logLevelAtMost as cn, compositionFeatureEnabled as cr, calendarsCapability as ct, COMPOSED_ITEM_FIXED_FIELDS as d, EventCategory as di, mayWriteToLocation as dn, compositionSourceKey as dr, checkRoleAddress as dt, parseSecretRef as ei, keychainAdminCapability as en, vectorIndexDimConflictError as er, authProviderCapability as et, COMPOSER_RUNNER_ID as f, memoizePinnedFfmpeg as fn, createStatefulExpressionMemory as fr, composerCapability as ft, CoreBlockSchema as g, normalizeCoreBlockWrite as gn, DeviceRole as gr, coreBlockComposition as gt, CalendarPreferencesSchema as h, motionCapability as hn, DeviceFeature as hr, coreBlockAddonId as ht, AlertSchema as i, scopeKey as ii, lifecycleJobSchema as in, buildFfmpegArgs as ir, buildCapabilityLookup as it, FieldClaimSchema as j, resolveCoreBlockFiles as jn, asString$1 as jr, deviceStateCapability as jt, FIRST_LEVEL_MACRO_CLASSES as k, resolveBucketMs as kn, asJsonObject as kr, deviceExtensionCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, toSecretFieldView as li, looseSchema as ln, compositionItemFieldPath as lr, cameraGridLayoutCapability as lt, CORE_BLOCK_ADDON_PREFIX as m, modeMayWrite as mn, toExpressionValue as mr, compositionSourceRefs as mt, AGENT_MDNS_TXT_KEYS as n, resolveCapMount as ni, legacyAutoLinkIds as nn, withLocationMode as nr, bareAddonId as nt, BaseDevice as o, secretTreeFromSchema as oi, locationIconKey as on, composedDeviceRef as or, buildDeviceSignatureMessage as ot, CORE_BLOCKS_ADDON_ID as p, metricsProviderCapability as pn, disarmRoseMemory as pr, compositionFieldKey as pt, StorageLocationTypeSchema as q, streamCatalogCapability as qn, isSecretMarker as qr, isArrayOutputSchema as qt, ALL_CAPABILITY_DEFINITIONS as r, resolveSecretMarkers as ri, legacyModeOf as rn, COMPOSER_ADDON_ID as rr, batteryCapability as rt, BatteryStatusSchema as s, sleep as si, logDestinationCapability as sn, composedDeviceStableId as sr, buildStreamParamsConfigSchema as st, AGENT_MDNS_SERVICE_TYPE as t, readinessKey as ti, keychainCapability as tn, vectorStoreCapability as tr, backupCapability as tt, CAP_NAMES_WITH_STATUS as u, transformSecretWrite as ui, mayReadLocation as un, compositionSliceKey as ur, canonicalIconKey as ut, DATABASE_SNAPSHOT_SUFFIX as v, objectInputDeclaresAddonId as vn, errMsg as vr, coreBlockSourceKind as vt, DEVICE_NONCE_TTL_MS as w, procedureAuthKey as wn, RUNTIME_DEFAULTS as wr, decodeVectorBase64 as wt, DAY_NAMES as x, pickAppLinkHub as xn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as xr, dataStoreProviderCapability as xt, DATABASE_SNAPSHOT_TIMEOUT_MS as y, objectInputDeclaresRequiredDeviceId as yn, BaseAddon as yr, coreBlocksCapability as yt, MOTION_CLOSE_AFTER_MS as z, scoreRuntimes as zn, emitReadiness as zr, expressionContainsBuiltinCall as zt };
+export { addonSettingsCapability as $, validateComposition as $n, normalizeSecretOwner as $r, isObjectInput as $t, FieldClaimModeSchema as A, resolveAppConnections as An, WELL_KNOWN_TAB_MAP as Ar, deviceCredentialsCapability as At, NetworkTunnelStartedDataSchema as B, scopesAllowDeviceCap as Bn, emitDownForOwnedCaps as Br, expandContainer as Bt, DEVICE_ENROLLMENT_TTL_MS as C, pickAppLinkHub as Cn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Cr, dataStoreProviderCapability as Ct, DeclaredDevices as D, ptzAutotrackCapability as Dn, ReadinessRegistry as Dr, defineExtensionSlotProvider as Dt, DEVICE_SAN_USER_PREFIX as E, procedureAuthKey as En, RUNTIME_DEFAULTS as Er, decodeVectorBase64 as Et, LOG_LEVEL_RANK as F, resolveLocationMode as Fn, collectSecretConfigKeys as Fr, enumerateInferenceDevices as Ft, ScopedTokenSchema as G, storageCapability as Gn, isDeviceConfigCap as Gr, formatDeviceRevoker as Gt, RecordingStatusSchema as H, settingsStoreCapability as Hn, expandCapMethods as Hr, extractNestedAddonId as Ht, LegacyStorageLocationDefaultSchema as I, resolveMethodAuth as In, collectZodSecretPaths as Ir, enumerateItemArrayFields as It, StorageLocationModeSchema as J, storageProviderCapability as Jn, isSecretClear as Jr, isAppLinkBase as Jt, SsoBridgeClaimsSchema as K, storageMigrationCapability as Kn, isEvent as Kr, formatMinutes as Kt, METHOD_ACCESS_MAP as L, resolveNotificationTapAddress as Ln, createEvent as Lr, enumerateSchemaFields as Lt, HUB_MDNS_SERVICE_TYPE as M, resolveCoreBlockEntry as Mn, asNumber as Mr, deviceManagerCapability as Mt, HUB_MDNS_TXT_KEYS as N, resolveCoreBlockFiles as Nn, asString$1 as Nr, deviceStateCapability as Nt, DeviceStatusSchema as O, reducePoints as On, ReadinessTimeoutError as Or, deriveBatteryPresence as Ot, KEYCHAIN_RESET_TRIGGER_ACTOR as P, resolveHubAddressRoles as Pn, buildSecretRef as Pr, deviceStatusCapability as Pt, addonPagesCapability as Q, userManagementCapability as Qn, nodePin as Qr, isLocationEnabled as Qt, MINUTES_PER_DAY as R, runtimeStatePolicyFor as Rn, customAction as Rr, evaluateCompositionField as Rt, DERIVED_CAMERA_SILENCED_CAP_NAMES as S, parseStreamParamsFormPatch as Sn, DATAPLANE_SECRET_HEADER as Sr, createDeviceExtensionProvider as St, DEVICE_SAN_CREDENTIAL_PREFIX as T, platformProbeCapability as Tn, REDACTED_SECRET as Tr, declarationOwnerNodeId as Tt, STORAGE_ACCESS_FALLBACK as U, siteZoneKey as Un, formatSecretScope as Ur, filesystemBrowseCapability as Ut, RECORDING_SOURCE_CAMSTACK_ADDON as V, scoreRuntimes as Vn, emitReadiness as Vr, expressionContainsBuiltinCall as Vt, STREAM_PROFILE_META as W, snapshotCapability as Wn, hydrateSchema as Wr, foldSnapshotByFunction as Wt, StorageMigrationJobSchema as X, streamQualityLabel as Xn, isSecretMarkerLike as Xr, isCollectionArrayMethod as Xt, StorageLocationTypeSchema as Y, streamCatalogCapability as Yn, isSecretMarker as Yr, isArrayOutputSchema as Yt, UserRecordSchema as Z, supportedRuntimes as Zn, makeSecretMarker as Zr, isDefaultAppConnectionEndpoint as Zt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as _, motionCapability as _n, DeviceFeature as _r, coreBlockAddonId as _t, ApiKeyRecordSchema as a, resolveSecretMarkers as ai, legacyModeOf as an, COMPOSER_ADDON_ID as ar, batteryCapability as at, DATA_STORE_DATABASES as b, objectInputDeclaresAddonId as bn, errMsg as br, coreBlockSourceKind as bt, CAMERA_SWITCH_ORDER as c, secretTreeFromSchema as ci, locationIconKey as cn, composedDeviceRef as cr, buildDeviceSignatureMessage as ct, COMPOSED_ITEM_FIXED_FIELDS as d, toSecretFieldView as di, looseSchema as dn, compositionItemFieldPath as dr, cameraGridLayoutCapability as dt, parseJsonObject as ei, isVoidInput as en, validateCustomAddress as er, addonWidgetsCapability as et, COMPOSER_RUNNER_ID as f, transformSecretWrite as fi, mayReadLocation as fn, compositionSliceKey as fr, canonicalIconKey as ft, CoreBlockSchema as g, modeMayWrite as gn, toExpressionValue as gr, compositionSourceRefs as gt, CalendarPreferencesSchema as h, metricsProviderCapability as hn, disarmRoseMemory as hr, compositionFieldKey as ht, AlertSchema as i, resolveCapMount as ii, legacyAutoLinkIds as in, withLocationMode as ir, bareAddonId as it, FieldClaimSchema as j, resolveBucketMs as jn, asJsonObject as jr, deviceExtensionCapability as jt, FIRST_LEVEL_MACRO_CLASSES as k, replacedFieldKeys as kn, SECRET_CLEAR as kr, describeComposableCaps as kt, CAMSTACK_APP_LINK_ORIGIN as l, sleep as li, logDestinationCapability as ln, composedDeviceStableId as lr, buildStreamParamsConfigSchema as lt, CORE_BLOCK_ADDON_PREFIX as m, memoizePinnedFfmpeg as mn, createStatefulExpressionMemory as mr, composerCapability as mt, AGENT_MDNS_TXT_KEYS as n, parseSecretRef as ni, keychainAdminCapability as nn, vectorIndexDimConflictError as nr, authProviderCapability as nt, BaseDevice as o, scopeKey as oi, lifecycleJobSchema as on, buildFfmpegArgs as or, buildCapabilityLookup as ot, CORE_BLOCKS_ADDON_ID as p, EventCategory as pi, mayWriteToLocation as pn, compositionSourceKey as pr, checkRoleAddress as pt, StorageCleanupJobSchema as q, storageOccupancyCapability as qn, isKeychainStoredField as qr, gbToBytes as qt, ALL_CAPABILITY_DEFINITIONS as r, readinessKey as ri, keychainCapability as rn, vectorStoreCapability as rr, backupCapability as rt, BatteryStatusSchema as s, secretTreeFromPaths as si, localNetworkCapability as sn, cloneStatefulExpressionMemory as sr, buildDeviceEnrollmentLink as st, AGENT_MDNS_SERVICE_TYPE as t, parseJsonUnknown as ti, kebabToCamel as tn, vectorDimFromBase64 as tr, alertsCapability as tt, CAP_NAMES_WITH_STATUS as u, toNodeId as ui, logLevelAtMost as un, compositionFeatureEnabled as ur, calendarsCapability as ut, DATABASE_SNAPSHOT_SUFFIX as v, normalizeCoreBlockWrite as vn, DeviceRole as vr, coreBlockComposition as vt, DEVICE_NONCE_TTL_MS as w, planComposition as wn, DEVICE_STATUS_METHOD as wr, databaseSnapshotCapability as wt, DAY_NAMES as x, objectInputDeclaresRequiredDeviceId as xn, BaseAddon as xr, coreBlocksCapability as xt, DATABASE_SNAPSHOT_TIMEOUT_MS as y, normalizeUnit as yn, DeviceType as yr, coreBlockIdFromAddonId as yt, MOTION_CLOSE_AFTER_MS as z, scopesAllowAddon as zn, defineCustomActions as zr, evictionPolicyOfLocation as zt };

package/dist/{dist-C6Yvfhpq.js → dist-CnUtkSwN.js}

@@ -718,7 +718,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep--g-h2_c_.mjs
+//#region ../types/dist/sleep-DAX0-2v9.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -9768,6 +9768,12 @@ function scopesAllowDeviceCap(scopes, access) {
 function scopesAllowAddon(scopes, addonId, access) {
 	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
 }
+zod.z.enum(["new-session", "step-up"]);
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = zod.z.discriminatedUnion("kind", [zod.z.object({ kind: zod.z.literal("native") }), zod.z.object({
+	kind: zod.z.literal("browser"),
+	startPath: zod.z.string().startsWith("/")
+})]);
 /**
 * Device certificates (D855) — the wire contract shared by the hub, the admin
 * UI and the native viewer.
@@ -9966,7 +9972,9 @@ zod.z.object({
 	signature: zod.z.literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: zod.z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: zod.z.array(zod.z.enum(["native", "web"]))
+	clients: zod.z.array(zod.z.enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 /**
 * What an expression's named bindings READ from.
@@ -39968,10 +39976,14 @@ function isLanIpv4Literal(endpoint) {
 	const host = hostnameOf(endpoint.baseUrl);
 	return host !== null && IPV4_LITERAL.test(host);
 }
+function isUnstable(endpoint) {
+	return endpoint.stable === false;
+}
 /** Lower = better; `null` = never this role's AUTOMATIC answer. */
 function autoRankFor(role, endpoint) {
 	if (endpoint.kind === "loopback" || endpoint.kind === "app-link" || endpoint.kind === "custom") return null;
 	if (hostnameOf(endpoint.baseUrl) === null) return null;
+	if (isUnstable(endpoint)) return null;
 	if (role === "internal") {
 		if (isLanIpv4Literal(endpoint)) return 0;
 		if (isPlausibleLan(endpoint)) return 1;
@@ -40126,6 +40138,7 @@ function resolveNotificationTapAddress(flags) {
 }
 /** AUTO app connections: LAN IPv4 + the public tunnel. Never IPv6, mesh, loopback or custom. */
 function isDefaultAppConnectionEndpoint(endpoint) {
+	if (isUnstable(endpoint)) return false;
 	if (endpoint.kind === "lan-ipv4") return true;
 	return endpoint.kind === "public" && endpoint.interfaceKind === "public";
 }
@@ -41167,7 +41180,13 @@ var RedirectLoginMethodSchema = zod.z.object({
 	* `beginExternalLink` offer exactly the redirect methods that set this,
 	* whatever their id. Absent / false — a login button only.
 	*/
-	linkable: zod.z.boolean().optional()
+	linkable: zod.z.boolean().optional(),
+	/**
+	* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+	* when the route understands the app flow query (`app=1&code_challenge=…`),
+	* `null`/absent when there is no app path - the app hides the method.
+	*/
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A Module-Federation widget the login page mounts for an in-page
@@ -41186,7 +41205,9 @@ var WidgetLoginMethodSchema = zod.z.object({
 	bundle: zod.z.string(),
 	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 	remote: WidgetRemoteSchema,
-	stage: LoginStageEnum
+	stage: LoginStageEnum,
+	/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A declarative WebAuthn ceremony the shell renders natively (no remote
@@ -41204,7 +41225,9 @@ var PasskeyLoginMethodSchema = zod.z.object({
 	/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 	rpId: zod.z.string(),
 	/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-	origin: zod.z.string().nullable()
+	origin: zod.z.string().nullable(),
+	/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
 var LoginMethodContributionSchema = zod.z.discriminatedUnion("kind", [
@@ -41842,7 +41865,25 @@ var NetworkEndpointSchema = zod.z.object({
 	url: zod.z.string(),
 	hostname: zod.z.string(),
 	port: zod.z.number(),
-	protocol: zod.z.enum(["http", "https"])
+	protocol: zod.z.enum(["http", "https"]),
+	/**
+	* Whether this address survives a restart of its provider. `false` = it is
+	* re-issued every time (a Quick tunnel's random `*.trycloudflare.com`); the
+	* hub never selects such an address AUTOMATICALLY for a role (D860), though
+	* it stays visible and an operator may still flag it. Absent = stable: every
+	* provider except a Quick tunnel owns a name that does not change.
+	*/
+	stable: zod.z.boolean().optional()
+});
+/**
+* `data` of a `network.tunnel.started` event — what `local-network` (which
+* tails the bus and cannot import a provider) learns about the new address.
+*/
+var NetworkTunnelStartedDataSchema = zod.z.object({
+	url: zod.z.string(),
+	/** Mirrors {@link NetworkEndpointSchema} `stable`; absent = stable. */
+	stable: zod.z.boolean().optional(),
+	updated: zod.z.boolean().optional()
 });
 var NetworkAccessStatusSchema = zod.z.object({
 	connected: zod.z.boolean(),
@@ -54140,7 +54181,20 @@ var SsoBridgeClaimsSchema = zod.z.object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: zod.z.string().optional()
+	browserBinding: zod.z.string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: zod.z.object({
+		codeChallenge: zod.z.string(),
+		state: zod.z.string(),
+		purpose: zod.z.enum(["new-session", "step-up"]),
+		redirect: zod.z.string()
+	}).optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -57125,7 +57179,12 @@ var SearchResultSchema = zod.z.object({
 	publishedAt: zod.z.string(),
 	author: zod.z.string(),
 	installed: zod.z.boolean(),
-	installedVersion: zod.z.string().optional()
+	installedVersion: zod.z.string().optional(),
+	/**
+	* Capability names the package's addons declare (from its published
+	* manifest). `null` = the registry lookup failed — unknown, never `[]` (D393).
+	*/
+	capabilities: zod.z.array(zod.z.string()).readonly().nullable()
 });
 var AutoUpdateSettingsSchema = zod.z.object({
 	channel: ChannelSchema,
@@ -57344,7 +57403,11 @@ var addonsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		searchAvailable: method(zod.z.object({ query: zod.z.string().optional() }), zod.z.array(SearchResultSchema)),
+		searchAvailable: method(zod.z.object({
+			query: zod.z.string().optional(),
+			/** Only packages whose addons declare this capability (unknown ones excluded). */
+			capability: zod.z.string().optional()
+		}), zod.z.array(SearchResultSchema)),
 		/**
 		* Available package updates for a node. `nodeId` omitted (or
 		* `'hub'`) checks the hub's own installed packages; an agent
@@ -61451,7 +61514,13 @@ var ConnectionEndpointSchema = zod.z.object({
 	* calls so the client can sort even if the cap returns a new
 	* ordering between polls.
 	*/
-	priority: zod.z.number()
+	priority: zod.z.number(),
+	/**
+	* `false` = the address changes on its own (a Quick tunnel, re-issued on
+	* every respawn). Automatic role resolution skips it (D860); an explicit
+	* operator flag still honours it. Absent = stable.
+	*/
+	stable: zod.z.boolean().optional()
 });
 /**
 * Where the advertised local port came from. Ordered most → least
@@ -85802,6 +85871,12 @@ Object.defineProperty(exports, "MOTION_CLOSE_AFTER_MS", {
 		return MOTION_CLOSE_AFTER_MS;
 	}
 });
+Object.defineProperty(exports, "NetworkTunnelStartedDataSchema", {
+	enumerable: true,
+	get: function() {
+		return NetworkTunnelStartedDataSchema;
+	}
+});
 Object.defineProperty(exports, "RECORDING_SOURCE_CAMSTACK_ADDON", {
 	enumerable: true,
 	get: function() {
@@ -85862,6 +85937,12 @@ Object.defineProperty(exports, "ScopedTokenSchema", {
 		return ScopedTokenSchema;
 	}
 });
+Object.defineProperty(exports, "SsoBridgeClaimsSchema", {
+	enumerable: true,
+	get: function() {
+		return SsoBridgeClaimsSchema;
+	}
+});
 Object.defineProperty(exports, "StorageCleanupJobSchema", {
 	enumerable: true,
 	get: function() {