@camstack/system 1.2.434 → 1.2.436

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Z as addonPagesCapability, br as BaseAddon, fi as EventCategory, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
+import { Q as addonPagesCapability, br as errMsg, di as EventCategory, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as addonWidgetsCapability, br as BaseAddon, fi as EventCategory, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
+import { br as errMsg, di as EventCategory, et as addonWidgetsCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Ir as createEvent, br as BaseAddon, et as alertsCapability, fi as EventCategory, i as AlertSchema, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
+import { Lr as createEvent, br as errMsg, di as EventCategory, i as AlertSchema, tt as alertsCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { En as ptzAutotrackCapability, Gr as isEvent, br as BaseAddon, fi as EventCategory, k as FIRST_LEVEL_MACRO_CLASSES, rt as bareAddonId, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
+import { Dn as ptzAutotrackCapability, Kr as isEvent, br as errMsg, di as EventCategory, it as bareAddonId, k as FIRST_LEVEL_MACRO_CLASSES, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
-const require_restore_archive = require("../../restore-archive-Do0QwAik.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_restore_archive = require("../../restore-archive-D4h904rb.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
-import { Kn as storageOccupancyCapability, Zr as nodePin, br as BaseAddon, fi as EventCategory, fn as mayWriteToLocation, li as toNodeId, nt as backupCapability } from "../../dist-CYcBqnXk.mjs";
-import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-5ml7uYMf.mjs";
+import { Zr as nodePin, ci as toNodeId, di as EventCategory, pn as mayWriteToLocation, qn as storageOccupancyCapability, rt as backupCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-BxmP1ChO.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { br as BaseAddon, h as CalendarPreferencesSchema, lt as calendarsCapability } from "../../dist-CYcBqnXk.mjs";
+import { h as CalendarPreferencesSchema, ut as calendarsCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { D as DeclaredDevices, Ir as createEvent, Jn as streamCatalogCapability, S as DERIVED_CAMERA_SILENCED_CAP_NAMES, Un as snapshotCapability, Ur as hydrateSchema, ar as buildFfmpegArgs, br as BaseAddon, fi as EventCategory, gn as motionCapability, gr as DeviceFeature, o as BaseDevice, pn as memoizePinnedFfmpeg, ut as cameraGridLayoutCapability, vr as DeviceType, wt as declarationOwnerNodeId, yr as errMsg, z as MOTION_CLOSE_AFTER_MS } from "../../dist-CYcBqnXk.mjs";
+import { D as DeclaredDevices, Lr as createEvent, S as DERIVED_CAMERA_SILENCED_CAP_NAMES, Tt as declarationOwnerNodeId, Wn as snapshotCapability, Wr as hydrateSchema, Yn as streamCatalogCapability, _n as motionCapability, _r as DeviceFeature, br as errMsg, di as EventCategory, dt as cameraGridLayoutCapability, mn as memoizePinnedFfmpeg, o as BaseDevice, or as buildFfmpegArgs, xr as BaseAddon, yr as DeviceType, z as MOTION_CLOSE_AFTER_MS } from "../../dist-DjD2M79P.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
-const require_composition_sources = require("../../composition-sources-B7R1oQnY.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_composition_sources = require("../../composition-sources-BAOlCu4j.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { Bt as expressionContainsBuiltinCall, Cn as planComposition, D as DeclaredDevices, Ir as createEvent, Lt as evaluateCompositionField, at as buildCapabilityLookup, br as BaseAddon, cr as composedDeviceStableId, d as COMPOSED_ITEM_FIXED_FIELDS, dr as compositionSliceKey, fi as EventCategory, fr as compositionSourceKey, hr as toExpressionValue, ir as COMPOSER_ADDON_ID, lr as compositionFeatureEnabled, mr as disarmRoseMemory, mt as compositionFieldKey, o as BaseDevice, or as cloneStatefulExpressionMemory, pr as createStatefulExpressionMemory, pt as composerCapability, r as ALL_CAPABILITY_DEFINITIONS, sr as composedDeviceRef, ur as compositionItemFieldPath, vr as DeviceType, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-CqrDyHM1.mjs";
+import { D as DeclaredDevices, Lr as createEvent, Rt as evaluateCompositionField, Vt as expressionContainsBuiltinCall, ar as COMPOSER_ADDON_ID, br as errMsg, cr as composedDeviceRef, d as COMPOSED_ITEM_FIXED_FIELDS, di as EventCategory, dr as compositionItemFieldPath, fr as compositionSliceKey, gr as toExpressionValue, hr as disarmRoseMemory, ht as compositionFieldKey, lr as composedDeviceStableId, mr as createStatefulExpressionMemory, mt as composerCapability, o as BaseDevice, ot as buildCapabilityLookup, pr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, sr as cloneStatefulExpressionMemory, ur as compositionFeatureEnabled, wn as planComposition, xr as BaseAddon, yr as DeviceType } from "../../dist-DjD2M79P.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-gN_BWUKp.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { br as BaseAddon, cn as logDestinationCapability } from "../../dist-CYcBqnXk.mjs";
+import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
-const require_composition_sources = require("../../composition-sources-B7R1oQnY.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_composition_sources = require("../../composition-sources-BAOlCu4j.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { Cn as planComposition, D as DeclaredDevices, Mn as resolveCoreBlockFiles, On as replacedFieldKeys, Ot as describeComposableCaps, Qn as validateComposition, Ur as hydrateSchema, _n as normalizeCoreBlockWrite, _t as coreBlockComposition, at as buildCapabilityLookup, br as BaseAddon, bt as coreBlocksCapability, f as COMPOSER_RUNNER_ID, fr as compositionSourceKey, g as CoreBlockSchema, gt as coreBlockAddonId, ht as compositionSourceRefs, jn as resolveCoreBlockEntry, m as CORE_BLOCK_ADDON_PREFIX, p as CORE_BLOCKS_ADDON_ID, r as ALL_CAPABILITY_DEFINITIONS, sr as composedDeviceRef, vt as coreBlockIdFromAddonId, yr as errMsg, yt as coreBlockSourceKind } from "../../dist-CYcBqnXk.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-CqrDyHM1.mjs";
+import { $n as validateComposition, D as DeclaredDevices, Mn as resolveCoreBlockEntry, Nn as resolveCoreBlockFiles, Wr as hydrateSchema, _t as coreBlockAddonId, br as errMsg, bt as coreBlockSourceKind, cr as composedDeviceRef, f as COMPOSER_RUNNER_ID, g as CoreBlockSchema, gt as compositionSourceRefs, kn as replacedFieldKeys, kt as describeComposableCaps, m as CORE_BLOCK_ADDON_PREFIX, ot as buildCapabilityLookup, p as CORE_BLOCKS_ADDON_ID, pr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, vn as normalizeCoreBlockWrite, vt as coreBlockComposition, wn as planComposition, xr as BaseAddon, xt as coreBlocksCapability, yt as coreBlockIdFromAddonId } from "../../dist-DjD2M79P.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-gN_BWUKp.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-CEiCaI_j.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-CYP5IZJ5.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { A as FieldClaimModeSchema, At as deviceExtensionCapability, Et as defineExtensionSlotProvider, Fr as collectZodSecretPaths, Ft as enumerateItemArrayFields, Gt as formatMinutes, Hn as siteZoneKey, It as enumerateSchemaFields, Jr as isSecretMarker, Kr as isKeychainStoredField, Ln as runtimeStatePolicyFor, Mt as deviceStateCapability, Nt as deviceStatusCapability, O as DeviceStatusSchema, Or as SECRET_CLEAR, R as MINUTES_PER_DAY, U as STREAM_PROFILE_META, Wr as isDeviceConfigCap, Yr as isSecretMarkerLike, _r as DeviceRole, br as BaseAddon, c as CAMERA_SWITCH_ORDER, ci as sleep$1, ct as buildStreamParamsConfigSchema, di as transformSecretWrite, dt as canonicalIconKey, fi as EventCategory, gr as DeviceFeature, ii as resolveSecretMarkers, j as FieldClaimSchema, jt as deviceManagerCapability, kr as WELL_KNOWN_TAB_MAP, oi as secretTreeFromPaths, qr as isSecretClear, r as ALL_CAPABILITY_DEFINITIONS, rn as legacyAutoLinkIds, sn as locationIconKey, u as CAP_NAMES_WITH_STATUS, ui as toSecretFieldView, vn as normalizeUnit, vr as DeviceType, x as DAY_NAMES, xn as parseStreamParamsFormPatch, xt as createDeviceExtensionProvider, yr as errMsg, zt as expandContainer } from "../../dist-CYcBqnXk.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CyDdyjLP.mjs";
+import { A as FieldClaimModeSchema, Ar as WELL_KNOWN_TAB_MAP, Bt as expandContainer, Dt as defineExtensionSlotProvider, Gr as isDeviceConfigCap, Ir as collectZodSecretPaths, It as enumerateItemArrayFields, Jr as isSecretClear, Kt as formatMinutes, Lt as enumerateSchemaFields, Mt as deviceManagerCapability, Nt as deviceStateCapability, O as DeviceStatusSchema, Pt as deviceStatusCapability, R as MINUTES_PER_DAY, Rn as runtimeStatePolicyFor, Sn as parseStreamParamsFormPatch, St as createDeviceExtensionProvider, Un as siteZoneKey, W as STREAM_PROFILE_META, Xr as isSecretMarkerLike, Yr as isSecretMarker, _r as DeviceFeature, br as errMsg, c as CAMERA_SWITCH_ORDER, cn as locationIconKey, di as EventCategory, ft as canonicalIconKey, ii as resolveSecretMarkers, in as legacyAutoLinkIds, j as FieldClaimSchema, jt as deviceExtensionCapability, kr as SECRET_CLEAR, li as toSecretFieldView, lt as buildStreamParamsConfigSchema, oi as secretTreeFromPaths, qr as isKeychainStoredField, r as ALL_CAPABILITY_DEFINITIONS, si as sleep$1, u as CAP_NAMES_WITH_STATUS, ui as transformSecretWrite, vr as DeviceRole, x as DAY_NAMES, xr as BaseAddon, yn as normalizeUnit, yr as DeviceType } from "../../dist-DjD2M79P.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CQaknvx1.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { br as BaseAddon, cn as logDestinationCapability } from "../../dist-CYcBqnXk.mjs";
+import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
-const require_device_ca = require("../../device-ca-D21ZP00q.js");
-const require_constants = require("../../constants-CuOfMdYe.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_device_ca = require("../../device-ca-CuWuRW9N.js");
+const require_constants = require("../../constants-GENKqk9k.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -336,7 +336,7 @@ async function applyKeychainResetTrigger(input) {
 	}
 	await consume(file, logger);
 	const toReenter = ((await service.resetReport().catch(() => null))?.pendingReentry ?? []).map((m) => `${m.owner}:${m.scope}:${m.fieldPath}`);
-	logger.error("*** KEYCHAIN RESET by the RESET_KEYCHAIN trigger file *** Every stored secret was archived (unreadable without the lost master key) and a new master key and data key were created. Every secret field now reads \"not set\" — re-enter them (System → Secrets lists them). The session signing key is regenerated: everyone signs in again. The cluster secret was cleared: set it again in System → Cluster if agents used one.", {
+	logger.error("*** KEYCHAIN RESET by the RESET_KEYCHAIN trigger file *** Every stored secret was archived (unreadable without the lost master key) and a new master key and data key were created. Every secret field now reads \"not set\" — re-enter them (System → Secrets lists them). The session signing key is regenerated: everyone signs in again.", {
 		lockedReason: state.reason,
 		archived: record.archived,
 		archivedCollection: record.archivedCollection,
@@ -360,7 +360,7 @@ var PROCESS_HELD_SECRET_REFS = new Set([
 	require_device_ca.DEVICE_CA_KEY_REF
 ]);
 /** `system-settings` keys that may hold a system-owned secret's marker. */
-var SYSTEM_SECRET_SETTINGS_KEYS = [require_constants.CLUSTER_SECRET_SETTINGS_KEY];
+var SYSTEM_SECRET_SETTINGS_KEYS = [];
 var KeychainLockedError = class extends Error {
 	reason;
 	constructor(reason) {
@@ -899,8 +899,7 @@ var KeychainService = class {
 	* 2. Archive every value AND every wrapped data key — the archive stays
 	*    openable if the lost master key turns up.
 	* 3. New data key under the new master key ({@link firstBoot}).
-	* 4. Clear the system-held markers (the cluster secret's): a marker pointing
-	*    at an archived value would refuse every agent forever (D797). The
+	* 4. Clear the system-held markers (none remain since D857). The
 	*    session signing key has no marker; it now resolves `missing`, and
 	*    `local-auth` generates a new one (everyone signs in again).
 	* 5. One `delete` event per archived ref, so every keeper reloads.

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { Hr as formatSecretScope, P as KEYCHAIN_RESET_TRIGGER_ACTOR, Qr as normalizeSecretOwner, br as BaseAddon, fi as EventCategory, nn as keychainCapability, ti as parseSecretRef, tn as keychainAdminCapability } from "../../dist-CYcBqnXk.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-CDjGQQPd.mjs";
-import { a as MESH_CA_KEY_REF, p as CLUSTER_SECRET_SETTINGS_KEY } from "../../constants-CrMPWOug.mjs";
+import { P as KEYCHAIN_RESET_TRIGGER_ACTOR, Qr as normalizeSecretOwner, Ur as formatSecretScope, di as EventCategory, nn as keychainAdminCapability, rn as keychainCapability, ti as parseSecretRef, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-BNM5ai4t.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-BFpowodq.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";
@@ -330,7 +330,7 @@ async function applyKeychainResetTrigger(input) {
 	}
 	await consume(file, logger);
 	const toReenter = ((await service.resetReport().catch(() => null))?.pendingReentry ?? []).map((m) => `${m.owner}:${m.scope}:${m.fieldPath}`);
-	logger.error("*** KEYCHAIN RESET by the RESET_KEYCHAIN trigger file *** Every stored secret was archived (unreadable without the lost master key) and a new master key and data key were created. Every secret field now reads \"not set\" — re-enter them (System → Secrets lists them). The session signing key is regenerated: everyone signs in again. The cluster secret was cleared: set it again in System → Cluster if agents used one.", {
+	logger.error("*** KEYCHAIN RESET by the RESET_KEYCHAIN trigger file *** Every stored secret was archived (unreadable without the lost master key) and a new master key and data key were created. Every secret field now reads \"not set\" — re-enter them (System → Secrets lists them). The session signing key is regenerated: everyone signs in again.", {
 		lockedReason: state.reason,
 		archived: record.archived,
 		archivedCollection: record.archivedCollection,
@@ -354,7 +354,7 @@ var PROCESS_HELD_SECRET_REFS = new Set([
 	DEVICE_CA_KEY_REF
 ]);
 /** `system-settings` keys that may hold a system-owned secret's marker. */
-var SYSTEM_SECRET_SETTINGS_KEYS = [CLUSTER_SECRET_SETTINGS_KEY];
+var SYSTEM_SECRET_SETTINGS_KEYS = [];
 var KeychainLockedError = class extends Error {
 	reason;
 	constructor(reason) {
@@ -893,8 +893,7 @@ var KeychainService = class {
 	* 2. Archive every value AND every wrapped data key — the archive stays
 	*    openable if the lost master key turns up.
 	* 3. New data key under the new master key ({@link firstBoot}).
-	* 4. Clear the system-held markers (the cluster secret's): a marker pointing
-	*    at an archived value would refuse every agent forever (D797). The
+	* 4. Clear the system-held markers (none remain since D857). The
 	*    session signing key has no marker; it now resolves `missing`, and
 	*    `local-auth` generates a new one (everyone signs in again).
 	* 5. One `delete` event per archived ref, so every keeper reloads.

package/dist/builtins/keychain/keychain-service.d.ts

@@ -122,8 +122,7 @@ export declare class KeychainService {
 	* 2. Archive every value AND every wrapped data key — the archive stays
 	*    openable if the lost master key turns up.
 	* 3. New data key under the new master key ({@link firstBoot}).
-	* 4. Clear the system-held markers (the cluster secret's): a marker pointing
-	*    at an archived value would refuse every agent forever (D797). The
+	* 4. Clear the system-held markers (none remain since D857). The
 	*    session signing key has no marker; it now resolves `missing`, and
 	*    `local-auth` generates a new one (everyone signs in again).
 	* 5. One `delete` event per archived ref, so every keeper reloads.

package/dist/builtins/keychain/system-held-secrets.d.ts

@@ -7,13 +7,13 @@
 *    offered for deletion as an orphan.
 *  - The mesh CA key is HELD the same way (mesh mTLS issuance); the public
 *    certificate lives in `system-settings` `cluster.meshCa`.
-*  - The cluster secret is a `password` field of `system-config` (System →
-*    Cluster): its marker lives in the `system-settings` row
-*    `cluster.clusterSecret`, like any other form-owned secret.
+*  - No form-owned system secret remains: the cluster secret was removed (D857) and the
+*    mesh certificate is the node identity. A `system/global/clusterSecret` entry left in
+*    the keychain by an older hub is NOT recognised here, so it reads as an orphan the
+*    operator deletes by hand; nothing reads or writes it any more.
 */
 import type { SystemHeldSecretName } from "@camstack/types";
 import { SYSTEM_SECRET_OWNER } from "../../auth/jwt-signing-key.js";
-import { CLUSTER_SECRET_REF } from "../../kernel/moleculer/cluster-secret.js";
 import { MESH_CA_KEY_REF } from "../../kernel/moleculer/mesh-mtls/constants.js";
 export { SYSTEM_SECRET_OWNER };
 /** The refs `keychain-admin.setSystemSecret` may write, by name. */
@@ -22,4 +22,4 @@ export declare const SYSTEM_HELD_SECRET_REFS: Readonly<Record<SystemHeldSecretNa
 export declare const PROCESS_HELD_SECRET_REFS: ReadonlySet<string>;
 /** `system-settings` keys that may hold a system-owned secret's marker. */
 export declare const SYSTEM_SECRET_SETTINGS_KEYS: readonly string[];
-export { CLUSTER_SECRET_REF, MESH_CA_KEY_REF };
+export { MESH_CA_KEY_REF };

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { B as RECORDING_SOURCE_CAMSTACK_ADDON, Ir as createEvent, V as RecordingStatusSchema, br as BaseAddon, fi as EventCategory, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
+import { H as RecordingStatusSchema, Lr as createEvent, V as RECORDING_SOURCE_CAMSTACK_ADDON, br as errMsg, di as EventCategory, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-D21ZP00q.js");
+const require_device_ca = require("../../device-ca-CuWuRW9N.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { C as DEVICE_ENROLLMENT_TTL_MS, G as SsoBridgeClaimsSchema, W as ScopedTokenSchema, Wt as formatDeviceRevoker, X as UserRecordSchema, Zn as userManagementCapability, a as ApiKeyRecordSchema, br as BaseAddon, kt as deviceCredentialsCapability, ot as buildDeviceEnrollmentLink, st as buildDeviceSignatureMessage, tt as authProviderCapability, w as DEVICE_NONCE_TTL_MS } from "../../dist-CYcBqnXk.mjs";
+import { At as deviceCredentialsCapability, C as DEVICE_ENROLLMENT_TTL_MS, G as ScopedTokenSchema, Gt as formatDeviceRevoker, K as SsoBridgeClaimsSchema, Qn as userManagementCapability, Z as UserRecordSchema, a as ApiKeyRecordSchema, ct as buildDeviceSignatureMessage, nt as authProviderCapability, st as buildDeviceEnrollmentLink, w as DEVICE_NONCE_TTL_MS, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-CDjGQQPd.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-BNM5ai4t.mjs";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.d.ts

@@ -75,6 +75,8 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
 	/** Optional public hostname tracked from `NetworkTunnelStarted`/
 	*  `Stopped` events on the bus. */
 	private publicHostname;
+	/** False for a Quick tunnel: shown in the palette, never picked automatically (D860). */
+	private publicHostnameStable;
 	/**
 	* Mesh-reachable endpoint (Tailscale MagicDNS / 100.x), learned from
 	* the `MeshNetworkChanged` event-tail and refreshed by a pull-reconcile
@@ -142,7 +144,7 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
 	* `onInitialize`. This setter exists for tests + future direct
 	* callers; cleared by passing an empty string.
 	*/
-	setPublicHostname(hostname: string): void;
+	setPublicHostname(hostname: string, stable?: boolean): void;
 	/**
 	* Replace the cached mesh endpoint. Set from the `MeshNetworkChanged`
 	* event-tail + the pull-reconcile; exposed for tests + future direct
@@ -270,7 +272,7 @@ export interface LanHttpAdvertisement {
 * only emitted on `includeAppLink: true`.
 */
 export declare function appLinkEndpoint(): ConnectionEndpoint;
-export declare function buildEndpoints(interfaces: readonly LocalInterface[], port: number, includeLoopback: boolean, ipv4Only: boolean, publicHostname: string, scheme?: "http" | "https", meshEndpoint?: MeshEndpointCache | null, lanHttp?: LanHttpAdvertisement | null): ConnectionEndpoint[];
+export declare function buildEndpoints(interfaces: readonly LocalInterface[], port: number, includeLoopback: boolean, ipv4Only: boolean, publicHostname: string, scheme?: "http" | "https", meshEndpoint?: MeshEndpointCache | null, lanHttp?: LanHttpAdvertisement | null, publicHostnameStable?: boolean): ConnectionEndpoint[];
 /**
 * First-boot heuristic: which addresses should the allowlist start
 * with? Includes LAN + Wi-Fi IPv4 addresses + plausible IPv6:

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CCH3XPqO.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CBLvq2oj.js");
 let zod = require("zod");
 let node_net = require("node:net");
@@ -608,6 +608,8 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	/** Optional public hostname tracked from `NetworkTunnelStarted`/
 	*  `Stopped` events on the bus. */
 	publicHostname = "";
+	/** False for a Quick tunnel: shown in the palette, never picked automatically (D860). */
+	publicHostnameStable = true;
 	/**
 	* Mesh-reachable endpoint (Tailscale MagicDNS / 100.x), learned from
 	* the `MeshNetworkChanged` event-tail and refreshed by a pull-reconcile
@@ -783,7 +785,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			httpPort: this.resolvedHttpPort(),
 			httpsPort,
 			localHostname: this.config.localHostname || null
-		} : null);
+		} : null, this.publicHostnameStable);
 	}
 	async onInitialize() {
 		if (!this.config.bootSeeded) {
@@ -916,11 +918,14 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		}, ALLOWLIST_RECONCILE_INTERVAL_MS);
 		this.allowlistTimer.unref?.();
 		this.ctx.eventBus?.subscribe({ category: require_dist.EventCategory.NetworkTunnelStarted }, (event) => {
-			const data = event.data ?? {};
-			if (typeof data.url === "string") try {
-				const hostname = new URL(data.url).hostname;
-				if (hostname && !hostname.endsWith(".placeholder") && !hostname.startsWith("pending.")) this.setPublicHostname(hostname);
-			} catch {}
+			const parsed = require_dist.NetworkTunnelStartedDataSchema.safeParse(event.data ?? {});
+			if (parsed.success) {
+				const data = parsed.data;
+				try {
+					const hostname = new URL(data.url).hostname;
+					if (hostname && !hostname.endsWith(".placeholder") && !hostname.startsWith("pending.")) this.setPublicHostname(hostname, data.stable !== false);
+				} catch {}
+			}
 		});
 		this.ctx.eventBus?.subscribe({ category: require_dist.EventCategory.NetworkTunnelStopped }, () => this.setPublicHostname(""));
 		this.ctx.eventBus?.subscribe({ category: require_dist.EventCategory.MeshNetworkChanged }, (event) => {
@@ -1031,10 +1036,14 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	* `onInitialize`. This setter exists for tests + future direct
 	* callers; cleared by passing an empty string.
 	*/
-	setPublicHostname(hostname) {
-		if (this.publicHostname === hostname) return;
+	setPublicHostname(hostname, stable = true) {
+		if (this.publicHostname === hostname && this.publicHostnameStable === stable) return;
 		this.publicHostname = hostname;
-		this.ctx.logger.info("local-network: public hostname updated", { meta: { hostname: hostname || "(cleared)" } });
+		this.publicHostnameStable = stable;
+		this.ctx.logger.info("local-network: public hostname updated", { meta: {
+			hostname: hostname || "(cleared)",
+			stable
+		} });
 	}
 	/**
 	* Replace the cached mesh endpoint. Set from the `MeshNetworkChanged`
@@ -1363,7 +1372,7 @@ function appLinkEndpoint() {
 		priority: -1
 	};
 }
-function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostname, scheme = "http", meshEndpoint = null, lanHttp = null) {
+function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostname, scheme = "http", meshEndpoint = null, lanHttp = null, publicHostnameStable = true) {
 	const out = [];
 	let priority = 0;
 	const preferred = pickPreferred(interfaces);
@@ -1406,13 +1415,14 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 		emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, 10 + priority++);
 	}
 	if (publicHostname) out.push({
-		label: "Public tunnel",
+		label: publicHostnameStable ? "Public tunnel" : "Public tunnel (temporary address)",
 		baseUrl: `https://${publicHostname}`,
 		kind: "public",
 		interfaceKind: "public",
 		plausible: true,
 		plausibleReason: "",
-		priority: 100
+		priority: 100,
+		...publicHostnameStable ? {} : { stable: false }
 	});
 	if (meshEndpoint && meshEndpoint.host) out.push({
 		label: "Mesh (Tailscale)",