@camstack/system 1.2.434 → 1.2.435

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Dt as deriveBatteryPresence, Un as snapshotCapability, Yn as streamQualityLabel, Zr as nodePin, br as BaseAddon, fi as EventCategory, gr as DeviceFeature, it as batteryCapability, pn as memoizePinnedFfmpeg, rt as bareAddonId, s as BatteryStatusSchema, vr as DeviceType, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
+import { Ot as deriveBatteryPresence, Qr as nodePin, Wn as snapshotCapability, Xn as streamQualityLabel, _r as DeviceFeature, at as batteryCapability, br as errMsg, it as bareAddonId, mn as memoizePinnedFfmpeg, pi as EventCategory, s as BatteryStatusSchema, xr as BaseAddon, yr as DeviceType } from "../../dist-Bz4_y8Xy.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Ht as filesystemBrowseCapability, br as BaseAddon, qn as storageProviderCapability } from "../../dist-CYcBqnXk.mjs";
+import { Jn as storageProviderCapability, Ut as filesystemBrowseCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-LZYd8iT-.js");
+const require_wal_maintenance = require("../../wal-maintenance-D3gwRj1B.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-DgLLPK14.mjs";
+import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-DLrbapzi.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-CEiCaI_j.js");
-const require_wal_maintenance = require("../../wal-maintenance-LZYd8iT-.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-CO3RqsDw.js");
+const require_wal_maintenance = require("../../wal-maintenance-D3gwRj1B.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { Ct as databaseSnapshotCapability, St as dataStoreProviderCapability, Tr as RUNTIME_DEFAULTS, _ as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, b as DATA_STORE_DATABASES, br as BaseAddon, nr as vectorStoreCapability, rt as bareAddonId, v as DATABASE_SNAPSHOT_SUFFIX, y as DATABASE_SNAPSHOT_TIMEOUT_MS, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
-import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-CyDdyjLP.mjs";
-import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-DgLLPK14.mjs";
+import { Ct as dataStoreProviderCapability, Er as RUNTIME_DEFAULTS, _ as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, b as DATA_STORE_DATABASES, br as errMsg, it as bareAddonId, rr as vectorStoreCapability, v as DATABASE_SNAPSHOT_SUFFIX, wt as databaseSnapshotCapability, xr as BaseAddon, y as DATABASE_SNAPSHOT_TIMEOUT_MS } from "../../dist-Bz4_y8Xy.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-9nA85bwT.mjs";
+import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-DLrbapzi.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { $r as parseJsonObject, Gn as storageMigrationCapability, I as LegacyStorageLocationDefaultSchema, J as StorageLocationTypeSchema, Jr as isSecretMarker, K as StorageCleanupJobSchema, Kt as gbToBytes, Pn as resolveLocationMode, Pr as collectSecretConfigKeys, Rt as evictionPolicyOfLocation, Vn as settingsStoreCapability, Wn as storageCapability, Y as StorageMigrationJobSchema, Zt as isLocationEnabled, br as BaseAddon, di as transformSecretWrite, dn as mayReadLocation, fi as EventCategory, fn as mayWriteToLocation, hn as modeMayWrite, ii as resolveSecretMarkers, in as legacyModeOf, oi as secretTreeFromPaths, q as StorageLocationModeSchema, rr as withLocationMode, wr as REDACTED_SECRET } from "../../dist-CYcBqnXk.mjs";
+import { Fn as resolveLocationMode, Fr as collectSecretConfigKeys, Gn as storageCapability, Hn as settingsStoreCapability, I as LegacyStorageLocationDefaultSchema, J as StorageLocationModeSchema, Kn as storageMigrationCapability, Qt as isLocationEnabled, Tr as REDACTED_SECRET, X as StorageMigrationJobSchema, Y as StorageLocationTypeSchema, Yr as isSecretMarker, ai as resolveSecretMarkers, an as legacyModeOf, ei as parseJsonObject, fi as transformSecretWrite, fn as mayReadLocation, gn as modeMayWrite, ir as withLocationMode, pi as EventCategory, pn as mayWriteToLocation, q as StorageCleanupJobSchema, qt as gbToBytes, si as secretTreeFromPaths, xr as BaseAddon, zt as evictionPolicyOfLocation } from "../../dist-Bz4_y8Xy.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_x509_es = require("../../x509.es-r7Ht1thA.js");
 const require_agent_https = require("../../agent-https-BZIwS4xF.js");
-const require_constants$8 = require("../../constants-CuOfMdYe.js");
+const require_constants$8 = require("../../constants-DL87WgeN.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,9 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Jr as isSecretMarker, Lr as customAction, Rr as defineCustomActions, Ur as hydrateSchema, Xr as makeSecretMarker, br as BaseAddon, di as transformSecretWrite, qr as isSecretClear, si as secretTreeFromSchema, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
+import { Jr as isSecretClear, Rr as customAction, Wr as hydrateSchema, Yr as isSecretMarker, Zr as makeSecretMarker, br as errMsg, ci as secretTreeFromSchema, fi as transformSecretWrite, xr as BaseAddon, zr as defineCustomActions } from "../../dist-Bz4_y8Xy.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-CDvj67p1.mjs";
 import { A as AgentHttpsNames, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, d as isPrivateAddress, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, u as isLocalOnlyHostname } from "../../agent-https-B8lKYVtU.mjs";
-import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-CrMPWOug.mjs";
+import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-DoiTA134.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createHmac, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-CnUtkSwN.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { br as BaseAddon, cn as logDestinationCapability } from "../../dist-CYcBqnXk.mjs";
+import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-B7R1oQnY.js → composition-sources-Cm42mgbv.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CCH3XPqO.js");
+const require_dist = require("./dist-CnUtkSwN.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-CqrDyHM1.mjs → composition-sources-_7W2Ly9s.mjs}

@@ -1,4 +1,4 @@
-import { fr as compositionSourceKey, yr as errMsg } from "./dist-CYcBqnXk.mjs";
+import { br as errMsg, pr as compositionSourceKey } from "./dist-Bz4_y8Xy.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-CuOfMdYe.js → constants-DL87WgeN.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CCH3XPqO.js");
+const require_dist = require("./dist-CnUtkSwN.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{constants-CrMPWOug.mjs → constants-DoiTA134.mjs}

@@ -1,4 +1,4 @@
-import { Nr as buildSecretRef } from "./dist-CYcBqnXk.mjs";
+import { Pr as buildSecretRef } from "./dist-Bz4_y8Xy.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{device-ca-CDjGQQPd.mjs → device-ca-B6YJZus6.mjs}

@@ -1,4 +1,4 @@
-import { E as DEVICE_SAN_USER_PREFIX, Nr as buildSecretRef, T as DEVICE_SAN_CREDENTIAL_PREFIX } from "./dist-CYcBqnXk.mjs";
+import { E as DEVICE_SAN_USER_PREFIX, Pr as buildSecretRef, T as DEVICE_SAN_CREDENTIAL_PREFIX } from "./dist-Bz4_y8Xy.mjs";
 import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CDvj67p1.mjs";
 import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts

package/dist/{device-ca-D21ZP00q.js → device-ca-WXuKc8AX.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CCH3XPqO.js");
+const require_dist = require("./dist-CnUtkSwN.js");
 const require_x509_es = require("./x509.es-r7Ht1thA.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts

package/dist/{dist-CYcBqnXk.mjs → dist-Bz4_y8Xy.mjs}

@@ -39976,10 +39976,14 @@ function isLanIpv4Literal(endpoint) {
 	const host = hostnameOf(endpoint.baseUrl);
 	return host !== null && IPV4_LITERAL.test(host);
 }
+function isUnstable(endpoint) {
+	return endpoint.stable === false;
+}
 /** Lower = better; `null` = never this role's AUTOMATIC answer. */
 function autoRankFor(role, endpoint) {
 	if (endpoint.kind === "loopback" || endpoint.kind === "app-link" || endpoint.kind === "custom") return null;
 	if (hostnameOf(endpoint.baseUrl) === null) return null;
+	if (isUnstable(endpoint)) return null;
 	if (role === "internal") {
 		if (isLanIpv4Literal(endpoint)) return 0;
 		if (isPlausibleLan(endpoint)) return 1;
@@ -40134,6 +40138,7 @@ function resolveNotificationTapAddress(flags) {
 }
 /** AUTO app connections: LAN IPv4 + the public tunnel. Never IPv6, mesh, loopback or custom. */
 function isDefaultAppConnectionEndpoint(endpoint) {
+	if (isUnstable(endpoint)) return false;
 	if (endpoint.kind === "lan-ipv4") return true;
 	return endpoint.kind === "public" && endpoint.interfaceKind === "public";
 }
@@ -41860,7 +41865,25 @@ var NetworkEndpointSchema = z.object({
 	url: z.string(),
 	hostname: z.string(),
 	port: z.number(),
-	protocol: z.enum(["http", "https"])
+	protocol: z.enum(["http", "https"]),
+	/**
+	* Whether this address survives a restart of its provider. `false` = it is
+	* re-issued every time (a Quick tunnel's random `*.trycloudflare.com`); the
+	* hub never selects such an address AUTOMATICALLY for a role (D860), though
+	* it stays visible and an operator may still flag it. Absent = stable: every
+	* provider except a Quick tunnel owns a name that does not change.
+	*/
+	stable: z.boolean().optional()
+});
+/**
+* `data` of a `network.tunnel.started` event — what `local-network` (which
+* tails the bus and cannot import a provider) learns about the new address.
+*/
+var NetworkTunnelStartedDataSchema = z.object({
+	url: z.string(),
+	/** Mirrors {@link NetworkEndpointSchema} `stable`; absent = stable. */
+	stable: z.boolean().optional(),
+	updated: z.boolean().optional()
 });
 var NetworkAccessStatusSchema = z.object({
 	connected: z.boolean(),
@@ -57156,7 +57179,12 @@ var SearchResultSchema = z.object({
 	publishedAt: z.string(),
 	author: z.string(),
 	installed: z.boolean(),
-	installedVersion: z.string().optional()
+	installedVersion: z.string().optional(),
+	/**
+	* Capability names the package's addons declare (from its published
+	* manifest). `null` = the registry lookup failed — unknown, never `[]` (D393).
+	*/
+	capabilities: z.array(z.string()).readonly().nullable()
 });
 var AutoUpdateSettingsSchema = z.object({
 	channel: ChannelSchema,
@@ -57375,7 +57403,11 @@ var addonsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		searchAvailable: method(z.object({ query: z.string().optional() }), z.array(SearchResultSchema)),
+		searchAvailable: method(z.object({
+			query: z.string().optional(),
+			/** Only packages whose addons declare this capability (unknown ones excluded). */
+			capability: z.string().optional()
+		}), z.array(SearchResultSchema)),
 		/**
 		* Available package updates for a node. `nodeId` omitted (or
 		* `'hub'`) checks the hub's own installed packages; an agent
@@ -61482,7 +61514,13 @@ var ConnectionEndpointSchema = z.object({
 	* calls so the client can sort even if the cap returns a new
 	* ordering between polls.
 	*/
-	priority: z.number()
+	priority: z.number(),
+	/**
+	* `false` = the address changes on its own (a Quick tunnel, re-issued on
+	* every respawn). Automatic role resolution skips it (D860); an explicit
+	* operator flag still honours it. Absent = stable.
+	*/
+	stable: z.boolean().optional()
 });
 /**
 * Where the advertised local port came from. Ordered most → least
@@ -85545,4 +85583,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { addonWidgetsCapability as $, validateCustomAddress as $n, parseJsonObject as $r, isVoidInput as $t, FieldClaimModeSchema as A, resolveBucketMs as An, asJsonObject as Ar, deviceExtensionCapability as At, RECORDING_SOURCE_CAMSTACK_ADDON as B, scoreRuntimes as Bn, emitReadiness as Br, expressionContainsBuiltinCall as Bt, DEVICE_ENROLLMENT_TTL_MS as C, planComposition as Cn, DEVICE_STATUS_METHOD as Cr, databaseSnapshotCapability as Ct, DeclaredDevices as D, reducePoints as Dn, ReadinessTimeoutError as Dr, deriveBatteryPresence as Dt, DEVICE_SAN_USER_PREFIX as E, ptzAutotrackCapability as En, ReadinessRegistry as Er, defineExtensionSlotProvider as Et, LOG_LEVEL_RANK as F, resolveMethodAuth as Fn, collectZodSecretPaths as Fr, enumerateItemArrayFields as Ft, SsoBridgeClaimsSchema as G, storageMigrationCapability as Gn, isEvent as Gr, formatMinutes as Gt, STORAGE_ACCESS_FALLBACK as H, siteZoneKey as Hn, formatSecretScope as Hr, filesystemBrowseCapability as Ht, LegacyStorageLocationDefaultSchema as I, resolveNotificationTapAddress as In, createEvent as Ir, enumerateSchemaFields as It, StorageLocationTypeSchema as J, streamCatalogCapability as Jn, isSecretMarker as Jr, isArrayOutputSchema as Jt, StorageCleanupJobSchema as K, storageOccupancyCapability as Kn, isKeychainStoredField as Kr, gbToBytes as Kt, METHOD_ACCESS_MAP as L, runtimeStatePolicyFor as Ln, customAction as Lr, evaluateCompositionField as Lt, HUB_MDNS_SERVICE_TYPE as M, resolveCoreBlockFiles as Mn, asString$1 as Mr, deviceStateCapability as Mt, HUB_MDNS_TXT_KEYS as N, resolveHubAddressRoles as Nn, buildSecretRef as Nr, deviceStatusCapability as Nt, DeviceStatusSchema as O, replacedFieldKeys as On, SECRET_CLEAR as Or, describeComposableCaps as Ot, KEYCHAIN_RESET_TRIGGER_ACTOR as P, resolveLocationMode as Pn, collectSecretConfigKeys as Pr, enumerateInferenceDevices as Pt, addonSettingsCapability as Q, validateComposition as Qn, normalizeSecretOwner as Qr, isObjectInput as Qt, MINUTES_PER_DAY as R, scopesAllowAddon as Rn, defineCustomActions as Rr, evictionPolicyOfLocation as Rt, DERIVED_CAMERA_SILENCED_CAP_NAMES as S, pickAppLinkHub as Sn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Sr, dataStoreProviderCapability as St, DEVICE_SAN_CREDENTIAL_PREFIX as T, procedureAuthKey as Tn, RUNTIME_DEFAULTS as Tr, decodeVectorBase64 as Tt, STREAM_PROFILE_META as U, snapshotCapability as Un, hydrateSchema as Ur, foldSnapshotByFunction as Ut, RecordingStatusSchema as V, settingsStoreCapability as Vn, expandCapMethods as Vr, extractNestedAddonId as Vt, ScopedTokenSchema as W, storageCapability as Wn, isDeviceConfigCap as Wr, formatDeviceRevoker as Wt, UserRecordSchema as X, supportedRuntimes as Xn, makeSecretMarker as Xr, isDefaultAppConnectionEndpoint as Xt, StorageMigrationJobSchema as Y, streamQualityLabel as Yn, isSecretMarkerLike as Yr, isCollectionArrayMethod as Yt, addonPagesCapability as Z, userManagementCapability as Zn, nodePin as Zr, isLocationEnabled as Zt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as _, normalizeCoreBlockWrite as _n, DeviceRole as _r, coreBlockComposition as _t, ApiKeyRecordSchema as a, scopeKey as ai, lifecycleJobSchema as an, buildFfmpegArgs as ar, buildCapabilityLookup as at, DATA_STORE_DATABASES as b, objectInputDeclaresRequiredDeviceId as bn, BaseAddon as br, coreBlocksCapability as bt, CAMERA_SWITCH_ORDER as c, sleep as ci, logDestinationCapability as cn, composedDeviceStableId as cr, buildStreamParamsConfigSchema as ct, COMPOSED_ITEM_FIXED_FIELDS as d, transformSecretWrite as di, mayReadLocation as dn, compositionSliceKey as dr, canonicalIconKey as dt, parseJsonUnknown as ei, kebabToCamel as en, vectorDimFromBase64 as er, alertsCapability as et, COMPOSER_RUNNER_ID as f, EventCategory as fi, mayWriteToLocation as fn, compositionSourceKey as fr, checkRoleAddress as ft, CoreBlockSchema as g, motionCapability as gn, DeviceFeature as gr, coreBlockAddonId as gt, CalendarPreferencesSchema as h, modeMayWrite as hn, toExpressionValue as hr, compositionSourceRefs as ht, AlertSchema as i, resolveSecretMarkers as ii, legacyModeOf as in, COMPOSER_ADDON_ID as ir, batteryCapability as it, FieldClaimSchema as j, resolveCoreBlockEntry as jn, asNumber as jr, deviceManagerCapability as jt, FIRST_LEVEL_MACRO_CLASSES as k, resolveAppConnections as kn, WELL_KNOWN_TAB_MAP as kr, deviceCredentialsCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, toNodeId as li, logLevelAtMost as ln, compositionFeatureEnabled as lr, calendarsCapability as lt, CORE_BLOCK_ADDON_PREFIX as m, metricsProviderCapability as mn, disarmRoseMemory as mr, compositionFieldKey as mt, AGENT_MDNS_TXT_KEYS as n, readinessKey as ni, keychainCapability as nn, vectorStoreCapability as nr, backupCapability as nt, BaseDevice as o, secretTreeFromPaths as oi, localNetworkCapability as on, cloneStatefulExpressionMemory as or, buildDeviceEnrollmentLink as ot, CORE_BLOCKS_ADDON_ID as p, memoizePinnedFfmpeg as pn, createStatefulExpressionMemory as pr, composerCapability as pt, StorageLocationModeSchema as q, storageProviderCapability as qn, isSecretClear as qr, isAppLinkBase as qt, ALL_CAPABILITY_DEFINITIONS as r, resolveCapMount as ri, legacyAutoLinkIds as rn, withLocationMode as rr, bareAddonId as rt, BatteryStatusSchema as s, secretTreeFromSchema as si, locationIconKey as sn, composedDeviceRef as sr, buildDeviceSignatureMessage as st, AGENT_MDNS_SERVICE_TYPE as t, parseSecretRef as ti, keychainAdminCapability as tn, vectorIndexDimConflictError as tr, authProviderCapability as tt, CAP_NAMES_WITH_STATUS as u, toSecretFieldView as ui, looseSchema as un, compositionItemFieldPath as ur, cameraGridLayoutCapability as ut, DATABASE_SNAPSHOT_SUFFIX as v, normalizeUnit as vn, DeviceType as vr, coreBlockIdFromAddonId as vt, DEVICE_NONCE_TTL_MS as w, platformProbeCapability as wn, REDACTED_SECRET as wr, declarationOwnerNodeId as wt, DAY_NAMES as x, parseStreamParamsFormPatch as xn, DATAPLANE_SECRET_HEADER as xr, createDeviceExtensionProvider as xt, DATABASE_SNAPSHOT_TIMEOUT_MS as y, objectInputDeclaresAddonId as yn, errMsg as yr, coreBlockSourceKind as yt, MOTION_CLOSE_AFTER_MS as z, scopesAllowDeviceCap as zn, emitDownForOwnedCaps as zr, expandContainer as zt };
+export { addonSettingsCapability as $, validateComposition as $n, normalizeSecretOwner as $r, isObjectInput as $t, FieldClaimModeSchema as A, resolveAppConnections as An, WELL_KNOWN_TAB_MAP as Ar, deviceCredentialsCapability as At, NetworkTunnelStartedDataSchema as B, scopesAllowDeviceCap as Bn, emitDownForOwnedCaps as Br, expandContainer as Bt, DEVICE_ENROLLMENT_TTL_MS as C, pickAppLinkHub as Cn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Cr, dataStoreProviderCapability as Ct, DeclaredDevices as D, ptzAutotrackCapability as Dn, ReadinessRegistry as Dr, defineExtensionSlotProvider as Dt, DEVICE_SAN_USER_PREFIX as E, procedureAuthKey as En, RUNTIME_DEFAULTS as Er, decodeVectorBase64 as Et, LOG_LEVEL_RANK as F, resolveLocationMode as Fn, collectSecretConfigKeys as Fr, enumerateInferenceDevices as Ft, ScopedTokenSchema as G, storageCapability as Gn, isDeviceConfigCap as Gr, formatDeviceRevoker as Gt, RecordingStatusSchema as H, settingsStoreCapability as Hn, expandCapMethods as Hr, extractNestedAddonId as Ht, LegacyStorageLocationDefaultSchema as I, resolveMethodAuth as In, collectZodSecretPaths as Ir, enumerateItemArrayFields as It, StorageLocationModeSchema as J, storageProviderCapability as Jn, isSecretClear as Jr, isAppLinkBase as Jt, SsoBridgeClaimsSchema as K, storageMigrationCapability as Kn, isEvent as Kr, formatMinutes as Kt, METHOD_ACCESS_MAP as L, resolveNotificationTapAddress as Ln, createEvent as Lr, enumerateSchemaFields as Lt, HUB_MDNS_SERVICE_TYPE as M, resolveCoreBlockEntry as Mn, asNumber as Mr, deviceManagerCapability as Mt, HUB_MDNS_TXT_KEYS as N, resolveCoreBlockFiles as Nn, asString$1 as Nr, deviceStateCapability as Nt, DeviceStatusSchema as O, reducePoints as On, ReadinessTimeoutError as Or, deriveBatteryPresence as Ot, KEYCHAIN_RESET_TRIGGER_ACTOR as P, resolveHubAddressRoles as Pn, buildSecretRef as Pr, deviceStatusCapability as Pt, addonPagesCapability as Q, userManagementCapability as Qn, nodePin as Qr, isLocationEnabled as Qt, MINUTES_PER_DAY as R, runtimeStatePolicyFor as Rn, customAction as Rr, evaluateCompositionField as Rt, DERIVED_CAMERA_SILENCED_CAP_NAMES as S, parseStreamParamsFormPatch as Sn, DATAPLANE_SECRET_HEADER as Sr, createDeviceExtensionProvider as St, DEVICE_SAN_CREDENTIAL_PREFIX as T, platformProbeCapability as Tn, REDACTED_SECRET as Tr, declarationOwnerNodeId as Tt, STORAGE_ACCESS_FALLBACK as U, siteZoneKey as Un, formatSecretScope as Ur, filesystemBrowseCapability as Ut, RECORDING_SOURCE_CAMSTACK_ADDON as V, scoreRuntimes as Vn, emitReadiness as Vr, expressionContainsBuiltinCall as Vt, STREAM_PROFILE_META as W, snapshotCapability as Wn, hydrateSchema as Wr, foldSnapshotByFunction as Wt, StorageMigrationJobSchema as X, streamQualityLabel as Xn, isSecretMarkerLike as Xr, isCollectionArrayMethod as Xt, StorageLocationTypeSchema as Y, streamCatalogCapability as Yn, isSecretMarker as Yr, isArrayOutputSchema as Yt, UserRecordSchema as Z, supportedRuntimes as Zn, makeSecretMarker as Zr, isDefaultAppConnectionEndpoint as Zt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as _, motionCapability as _n, DeviceFeature as _r, coreBlockAddonId as _t, ApiKeyRecordSchema as a, resolveSecretMarkers as ai, legacyModeOf as an, COMPOSER_ADDON_ID as ar, batteryCapability as at, DATA_STORE_DATABASES as b, objectInputDeclaresAddonId as bn, errMsg as br, coreBlockSourceKind as bt, CAMERA_SWITCH_ORDER as c, secretTreeFromSchema as ci, locationIconKey as cn, composedDeviceRef as cr, buildDeviceSignatureMessage as ct, COMPOSED_ITEM_FIXED_FIELDS as d, toSecretFieldView as di, looseSchema as dn, compositionItemFieldPath as dr, cameraGridLayoutCapability as dt, parseJsonObject as ei, isVoidInput as en, validateCustomAddress as er, addonWidgetsCapability as et, COMPOSER_RUNNER_ID as f, transformSecretWrite as fi, mayReadLocation as fn, compositionSliceKey as fr, canonicalIconKey as ft, CoreBlockSchema as g, modeMayWrite as gn, toExpressionValue as gr, compositionSourceRefs as gt, CalendarPreferencesSchema as h, metricsProviderCapability as hn, disarmRoseMemory as hr, compositionFieldKey as ht, AlertSchema as i, resolveCapMount as ii, legacyAutoLinkIds as in, withLocationMode as ir, bareAddonId as it, FieldClaimSchema as j, resolveBucketMs as jn, asJsonObject as jr, deviceExtensionCapability as jt, FIRST_LEVEL_MACRO_CLASSES as k, replacedFieldKeys as kn, SECRET_CLEAR as kr, describeComposableCaps as kt, CAMSTACK_APP_LINK_ORIGIN as l, sleep as li, logDestinationCapability as ln, composedDeviceStableId as lr, buildStreamParamsConfigSchema as lt, CORE_BLOCK_ADDON_PREFIX as m, memoizePinnedFfmpeg as mn, createStatefulExpressionMemory as mr, composerCapability as mt, AGENT_MDNS_TXT_KEYS as n, parseSecretRef as ni, keychainAdminCapability as nn, vectorIndexDimConflictError as nr, authProviderCapability as nt, BaseDevice as o, scopeKey as oi, lifecycleJobSchema as on, buildFfmpegArgs as or, buildCapabilityLookup as ot, CORE_BLOCKS_ADDON_ID as p, EventCategory as pi, mayWriteToLocation as pn, compositionSourceKey as pr, checkRoleAddress as pt, StorageCleanupJobSchema as q, storageOccupancyCapability as qn, isKeychainStoredField as qr, gbToBytes as qt, ALL_CAPABILITY_DEFINITIONS as r, readinessKey as ri, keychainCapability as rn, vectorStoreCapability as rr, backupCapability as rt, BatteryStatusSchema as s, secretTreeFromPaths as si, localNetworkCapability as sn, cloneStatefulExpressionMemory as sr, buildDeviceEnrollmentLink as st, AGENT_MDNS_SERVICE_TYPE as t, parseJsonUnknown as ti, kebabToCamel as tn, vectorDimFromBase64 as tr, alertsCapability as tt, CAP_NAMES_WITH_STATUS as u, toNodeId as ui, logLevelAtMost as un, compositionFeatureEnabled as ur, calendarsCapability as ut, DATABASE_SNAPSHOT_SUFFIX as v, normalizeCoreBlockWrite as vn, DeviceRole as vr, coreBlockComposition as vt, DEVICE_NONCE_TTL_MS as w, planComposition as wn, DEVICE_STATUS_METHOD as wr, databaseSnapshotCapability as wt, DAY_NAMES as x, objectInputDeclaresRequiredDeviceId as xn, BaseAddon as xr, coreBlocksCapability as xt, DATABASE_SNAPSHOT_TIMEOUT_MS as y, normalizeUnit as yn, DeviceType as yr, coreBlockIdFromAddonId as yt, MOTION_CLOSE_AFTER_MS as z, scopesAllowAddon as zn, defineCustomActions as zr, evictionPolicyOfLocation as zt };

package/dist/{dist-CCH3XPqO.js → dist-CnUtkSwN.js}

@@ -39976,10 +39976,14 @@ function isLanIpv4Literal(endpoint) {
 	const host = hostnameOf(endpoint.baseUrl);
 	return host !== null && IPV4_LITERAL.test(host);
 }
+function isUnstable(endpoint) {
+	return endpoint.stable === false;
+}
 /** Lower = better; `null` = never this role's AUTOMATIC answer. */
 function autoRankFor(role, endpoint) {
 	if (endpoint.kind === "loopback" || endpoint.kind === "app-link" || endpoint.kind === "custom") return null;
 	if (hostnameOf(endpoint.baseUrl) === null) return null;
+	if (isUnstable(endpoint)) return null;
 	if (role === "internal") {
 		if (isLanIpv4Literal(endpoint)) return 0;
 		if (isPlausibleLan(endpoint)) return 1;
@@ -40134,6 +40138,7 @@ function resolveNotificationTapAddress(flags) {
 }
 /** AUTO app connections: LAN IPv4 + the public tunnel. Never IPv6, mesh, loopback or custom. */
 function isDefaultAppConnectionEndpoint(endpoint) {
+	if (isUnstable(endpoint)) return false;
 	if (endpoint.kind === "lan-ipv4") return true;
 	return endpoint.kind === "public" && endpoint.interfaceKind === "public";
 }
@@ -41860,7 +41865,25 @@ var NetworkEndpointSchema = zod.z.object({
 	url: zod.z.string(),
 	hostname: zod.z.string(),
 	port: zod.z.number(),
-	protocol: zod.z.enum(["http", "https"])
+	protocol: zod.z.enum(["http", "https"]),
+	/**
+	* Whether this address survives a restart of its provider. `false` = it is
+	* re-issued every time (a Quick tunnel's random `*.trycloudflare.com`); the
+	* hub never selects such an address AUTOMATICALLY for a role (D860), though
+	* it stays visible and an operator may still flag it. Absent = stable: every
+	* provider except a Quick tunnel owns a name that does not change.
+	*/
+	stable: zod.z.boolean().optional()
+});
+/**
+* `data` of a `network.tunnel.started` event — what `local-network` (which
+* tails the bus and cannot import a provider) learns about the new address.
+*/
+var NetworkTunnelStartedDataSchema = zod.z.object({
+	url: zod.z.string(),
+	/** Mirrors {@link NetworkEndpointSchema} `stable`; absent = stable. */
+	stable: zod.z.boolean().optional(),
+	updated: zod.z.boolean().optional()
 });
 var NetworkAccessStatusSchema = zod.z.object({
 	connected: zod.z.boolean(),
@@ -57156,7 +57179,12 @@ var SearchResultSchema = zod.z.object({
 	publishedAt: zod.z.string(),
 	author: zod.z.string(),
 	installed: zod.z.boolean(),
-	installedVersion: zod.z.string().optional()
+	installedVersion: zod.z.string().optional(),
+	/**
+	* Capability names the package's addons declare (from its published
+	* manifest). `null` = the registry lookup failed — unknown, never `[]` (D393).
+	*/
+	capabilities: zod.z.array(zod.z.string()).readonly().nullable()
 });
 var AutoUpdateSettingsSchema = zod.z.object({
 	channel: ChannelSchema,
@@ -57375,7 +57403,11 @@ var addonsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		searchAvailable: method(zod.z.object({ query: zod.z.string().optional() }), zod.z.array(SearchResultSchema)),
+		searchAvailable: method(zod.z.object({
+			query: zod.z.string().optional(),
+			/** Only packages whose addons declare this capability (unknown ones excluded). */
+			capability: zod.z.string().optional()
+		}), zod.z.array(SearchResultSchema)),
 		/**
 		* Available package updates for a node. `nodeId` omitted (or
 		* `'hub'`) checks the hub's own installed packages; an agent
@@ -61482,7 +61514,13 @@ var ConnectionEndpointSchema = zod.z.object({
 	* calls so the client can sort even if the cap returns a new
 	* ordering between polls.
 	*/
-	priority: zod.z.number()
+	priority: zod.z.number(),
+	/**
+	* `false` = the address changes on its own (a Quick tunnel, re-issued on
+	* every respawn). Automatic role resolution skips it (D860); an explicit
+	* operator flag still honours it. Absent = stable.
+	*/
+	stable: zod.z.boolean().optional()
 });
 /**
 * Where the advertised local port came from. Ordered most → least
@@ -85833,6 +85871,12 @@ Object.defineProperty(exports, "MOTION_CLOSE_AFTER_MS", {
 		return MOTION_CLOSE_AFTER_MS;
 	}
 });
+Object.defineProperty(exports, "NetworkTunnelStartedDataSchema", {
+	enumerable: true,
+	get: function() {
+		return NetworkTunnelStartedDataSchema;
+	}
+});
 Object.defineProperty(exports, "RECORDING_SOURCE_CAMSTACK_ADDON", {
 	enumerable: true,
 	get: function() {

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-LZYd8iT-.js");
+const require_wal_maintenance = require("./wal-maintenance-D3gwRj1B.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-DgLLPK14.mjs";
+import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-DLrbapzi.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CCH3XPqO.js");
-const require_device_ca = require("./device-ca-D21ZP00q.js");
+const require_dist = require("./dist-CnUtkSwN.js");
+const require_device_ca = require("./device-ca-WXuKc8AX.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -22,13 +22,13 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-LZYd8iT-.js");
+const require_wal_maintenance = require("./wal-maintenance-D3gwRj1B.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
 const require_agent_https = require("./agent-https-BZIwS4xF.js");
-const require_constants = require("./constants-CuOfMdYe.js");
+const require_constants = require("./constants-DL87WgeN.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
@@ -36,7 +36,7 @@ const require_custom_action_registry = require("./custom-action-registry-Bf_Ynag
 const require_hub_mdns_ciao = require("./hub-mdns-ciao-CBLvq2oj.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-Do0QwAik.js");
+const require_restore_archive = require("./restore-archive-BNoFLAg8.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $r as parseJsonObject, $t as isVoidInput, Ar as asJsonObject$1, Cr as DEVICE_STATUS_METHOD, Dr as ReadinessTimeoutError, Er as ReadinessRegistry, F as LOG_LEVEL_RANK, Fn as resolveMethodAuth, Ir as createEvent$1, Jt as isArrayOutputSchema, L as METHOD_ACCESS_MAP, Mr as asString$1, Q as addonSettingsCapability, Qt as isObjectInput, Rn as scopesAllowAddon, Sr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Tn as procedureAuthKey, Tr as RUNTIME_DEFAULTS, Vr as expandCapMethods, Vt as extractNestedAddonId, Xn as supportedRuntimes, Yt as isCollectionArrayMethod, ai as scopeKey, an as lifecycleJobSchema, bn as objectInputDeclaresRequiredDeviceId, ei as parseJsonUnknown, en as kebabToCamel$1, fi as EventCategory$1, jr as asNumber, ln as logLevelAtMost, n as AGENT_MDNS_TXT_KEYS, ni as readinessKey, r as ALL_CAPABILITY_DEFINITIONS, ri as resolveCapMount, t as AGENT_MDNS_SERVICE_TYPE, un as looseSchema, xr as DATAPLANE_SECRET_HEADER$1, yn as objectInputDeclaresAddonId, yr as errMsg$1, zn as scopesAllowDeviceCap, zr as emitDownForOwnedCaps } from "./dist-CYcBqnXk.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-CDjGQQPd.mjs";
+import { $ as addonSettingsCapability, $t as isObjectInput, Bn as scopesAllowDeviceCap, Br as emitDownForOwnedCaps, Cr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Dr as ReadinessRegistry, En as procedureAuthKey, Er as RUNTIME_DEFAULTS, F as LOG_LEVEL_RANK, Hr as expandCapMethods, Ht as extractNestedAddonId, In as resolveMethodAuth, L as METHOD_ACCESS_MAP, Lr as createEvent$1, Mr as asNumber, Nr as asString$1, Or as ReadinessTimeoutError, Sr as DATAPLANE_SECRET_HEADER$1, Xt as isCollectionArrayMethod, Yt as isArrayOutputSchema, Zn as supportedRuntimes, bn as objectInputDeclaresAddonId, br as errMsg$1, dn as looseSchema, ei as parseJsonObject, en as isVoidInput, ii as resolveCapMount, jr as asJsonObject$1, n as AGENT_MDNS_TXT_KEYS, oi as scopeKey, on as lifecycleJobSchema, pi as EventCategory$1, r as ALL_CAPABILITY_DEFINITIONS, ri as readinessKey, t as AGENT_MDNS_SERVICE_TYPE, ti as parseJsonUnknown, tn as kebabToCamel$1, un as logLevelAtMost, wr as DEVICE_STATUS_METHOD, xn as objectInputDeclaresRequiredDeviceId, zn as scopesAllowAddon } from "./dist-Bz4_y8Xy.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-B6YJZus6.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -21,13 +21,13 @@ import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-DgLLPK14.mjs";
+import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-DLrbapzi.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
 import { A as AgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as isPrivateAddress, f as issueAgentHttpsLeaf, g as CA_COMMON_NAME, h as pinnedHttpsCaFingerprint, i as certificateNames, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, l as isContainerBridgeAddress, m as pemDigest, n as acceptAgentSans, o as createAgentHttpsRequest, p as loadAgentHttps, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isLocalOnlyHostname, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts } from "./agent-https-B8lKYVtU.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-CrMPWOug.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-DoiTA134.mjs";
 import { $ as requireProcessMeshCa, A as dropProcessPeer, At as setProcessMeshAuthStatusSource, B as openMeshTlsWhenRevocationsLoaded, C as Transporters, Ct as MESH_AUTH_MODE_FIELD, D as mintMeshJoinToken, Dt as parseMeshAuthMode, E as JoinTokenJtiStore, Et as isMeshAuthMode, F as onProcessNodeRegistered, Ft as readCidrSetting, G as RENEWAL_ABANDONED, H as MESH_NODE_CERTIFICATES_COLLECTION, I as setProcessMeshPeerTransportLookup, J as setProcessMeshCertificateRegistry, K as describeMeshLeaf, L as renewMeshCertificate, M as getProcessNodeMeshTransport, Mt as createCidrMatcher, N as getProcessPeerLeaf, Nt as normalizeIp, O as processJoinTokenJtiStore, Ot as requestProcessMeshEnforcement, P as isProcessVerifiedMeshPeer, Pt as parseCidrList, Q as getProcessMeshCaState, R as revokeMeshCertificate, S as ServiceBroker, St as verifyAgentUiUnlockTicketEs256, SystemConfigAddon, T as enrollMeshNode, Tt as getProcessMeshAuthStatus, U as MESH_NODE_CERTIFICATES_COLUMNS, V as setProcessMeshTlsListenerState, W as MeshCertificateRegistry, X as processMeshCrl, Y as MeshCrl, Z as MeshCaKeeper, _ as signPairingProof, _t as isAllowedAgentDashboardReturnTo, a as hubHostFromMeshAddress, at as generateMeshKeyPair, b as TlsTcpTransporter, bt as parseAgentDashboardOrigins, c as PAIRING_MAX_SESSIONS, ct as issueMeshLeafFromCsr, d as PAIRING_PROTOCOL, dt as AGENT_UI_UNLOCK_DOMAIN, et as caFingerprint, f as PAIRING_TTL_MS, ft as AGENT_UI_UNLOCK_TTL_MS, g as keyFingerprintShort, gt as UnlockTicketJtiStore, h as describeCsr, ht as AGENT_UI_UNLOCK_VERSION, i as AgentPairing, it as generateMeshCa, j as emitProcessNodeRegistered, jt as setProcessMeshEnforcer, k as verifyMeshJoinToken, kt as setProcessMeshAuthMode, l as PAIRING_PATHS, lt as loadMeshCa, m as computePairingSas, mt as AGENT_UI_UNLOCK_USE, n as HubPairing, nt as createMeshCsrPem, o as PAIRING_CODE_DIGITS, ot as isValidAgentNodeId, p as computePairingCommitment, pt as AGENT_UI_UNLOCK_TYP, q as getProcessMeshCertificateRegistry, r as PairingHttpError, rt as exportMeshPrivateKeyPem, s as PAIRING_MAX_CODE_ATTEMPTS, st as issueMeshLeafForNode, tt as caFingerprintCompact, u as PAIRING_PIN_DIGITS, ut as AGENT_DASHBOARD_ORIGINS_FIELD, v as verifyPairingProof, vt as mintAgentUiUnlockTicket, w as setProcessMeshTlsEnabler, wt as getProcessMeshAuthMode, x as Errors, xt as verifyAgentUiUnlockTicket, y as MESH_TLS_PORT_HELLO_FIELD, yt as mintAgentUiUnlockTicketEs256, z as getProcessMeshTlsListenerState } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
@@ -35,7 +35,7 @@ import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as
 import { C as DEFAULT_LAN_HTTP_PORT, D as closeLanHttp, E as bindPendingLanHttp, O as readLanHttpState, S as reissueTlsLeaf, T as applyLanHttp, _ as splitPemCertificates, a as storeUploadedCertificate, b as ensureTlsCert, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, k as registerLanHttpHandler, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as validateUploadedTls, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as allFamiliesListenHost, x as loadTlsCert, y as writeTlsMode } from "./hub-mdns-ciao-DJRwtlA8.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-5ml7uYMf.mjs";
+import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-DJYuznWP.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";

package/dist/{restore-archive-Do0QwAik.js → restore-archive-BNoFLAg8.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CCH3XPqO.js");
+const require_dist = require("./dist-CnUtkSwN.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{restore-archive-5ml7uYMf.mjs → restore-archive-DJYuznWP.mjs}

@@ -1,4 +1,4 @@
-import { v as DATABASE_SNAPSHOT_SUFFIX } from "./dist-CYcBqnXk.mjs";
+import { v as DATABASE_SNAPSHOT_SUFFIX } from "./dist-Bz4_y8Xy.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{retired-settings-keys-CyDdyjLP.mjs → retired-settings-keys-9nA85bwT.mjs}

@@ -1,4 +1,4 @@
-import { Ar as asJsonObject } from "./dist-CYcBqnXk.mjs";
+import { jr as asJsonObject } from "./dist-Bz4_y8Xy.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-CEiCaI_j.js → retired-settings-keys-CO3RqsDw.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CCH3XPqO.js");
+const require_dist = require("./dist-CnUtkSwN.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.434",
+  "version": "1.2.435",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",