@camstack/system 1.2.438 → 1.2.440

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-GgG-7amw.js");
+const require_dist = require("../../dist-BKhlcYz6.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Or as BaseAddon, mn as logDestinationCapability } from "../../dist-Dc8GKC5H.mjs";
+import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-9fcsrFU3.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-DpHGCjdL.mjs → composition-sources-CS0D7imL.mjs}

@@ -1,4 +1,4 @@
-import { Dr as errMsg, br as compositionSourceKey } from "./dist-Dc8GKC5H.mjs";
+import { Ar as errMsg, Cr as compositionSourceKey } from "./dist-9fcsrFU3.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-DI3Z83vG.js → composition-sources-cBG8fBTu.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-GgG-7amw.js");
+const require_dist = require("./dist-BKhlcYz6.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-DQK705Sb.mjs → constants-CIzPjw7L.mjs}

@@ -1,4 +1,4 @@
-import { Vr as buildSecretRef } from "./dist-Dc8GKC5H.mjs";
+import { Wr as buildSecretRef } from "./dist-9fcsrFU3.mjs";
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
 var MESH_CA_KEY_REF = buildSecretRef({
 	owner: "system",

package/dist/{constants-wkcn5Ij3.js → constants-CRI3QzT4.js}

@@ -1,5 +1,5 @@
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
-var MESH_CA_KEY_REF = require("./dist-GgG-7amw.js").buildSecretRef({
+var MESH_CA_KEY_REF = require("./dist-BKhlcYz6.js").buildSecretRef({
 	owner: "system",
 	scope: { kind: "global" },
 	fieldPath: "meshCaKey"

package/dist/{device-ca-DvIZjXIl.mjs → device-ca-DLKXYseS.mjs}

@@ -1,5 +1,5 @@
-import { D as DEVICE_SAN_CREDENTIAL_PREFIX, O as DEVICE_SAN_USER_PREFIX, Vr as buildSecretRef } from "./dist-Dc8GKC5H.mjs";
-import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CDvj67p1.mjs";
+import { D as DEVICE_SAN_CREDENTIAL_PREFIX, O as DEVICE_SAN_USER_PREFIX, Wr as buildSecretRef } from "./dist-9fcsrFU3.mjs";
+import { S as backdatedNotBefore, a as KeyUsageFlags, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension } from "./x509.es-DK__ETIe.mjs";
 import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{device-ca-BSvkXqyI.js → device-ca-DNHjts4_.js}

@@ -1,5 +1,5 @@
-const require_dist = require("./dist-GgG-7amw.js");
-const require_x509_es = require("./x509.es-r7Ht1thA.js");
+const require_dist = require("./dist-BKhlcYz6.js");
+const require_x509_es = require("./x509.es-C4cOo48M.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{dist-Dc8GKC5H.mjs → dist-9fcsrFU3.mjs}

@@ -718,7 +718,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-DRqxtc0C.mjs
+//#region ../types/dist/sleep-bwsTj221.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -2079,7 +2079,6 @@ function createHandle(raw, opts) {
 	const writeAddon = (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p));
 	const readAddonStoreResult = raw.readAddonStoreResult;
 	const readAddonStoreKeyResult = raw.readAddonStoreKeyResult;
-	const readDeviceStoreBatch = raw.readDeviceStoreBatch;
 	const overrides = {
 		readAddonStore: async () => resolveRead("addon", await raw.readAddonStore()),
 		...readAddonStoreResult !== void 0 ? { readAddonStoreResult: async () => {
@@ -2103,12 +2102,12 @@ function createHandle(raw, opts) {
 			};
 		} } : {},
 		readDeviceStore: async (deviceId) => resolveRead(`device:${deviceId}`, await raw.readDeviceStore(deviceId)),
-		...readDeviceStoreBatch !== void 0 ? { readDeviceStoreBatch: async (deviceIds) => {
-			const rows = await readDeviceStoreBatch.call(raw, deviceIds);
+		readDeviceStoreBatch: async (deviceIds) => {
+			const rows = await raw.readDeviceStoreBatch(deviceIds);
 			const out = /* @__PURE__ */ new Map();
 			for (const [deviceId, blob] of rows) out.set(deviceId, await resolveRead(`device:${deviceId}`, blob));
 			return out;
-		} } : {},
+		},
 		writeAddonStore: async (patch) => {
 			await writeAddon(patch);
 		},
@@ -2948,7 +2947,7 @@ var BaseAddon = class {
 		return this._addonSecretTree;
 	}
 	deviceSecretTree() {
-		this._deviceSecretTree ??= secretTreeFromSchema(this.deviceSettingsSchema());
+		this._deviceSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.deviceSettingsSchema()), this.secretStatePaths);
 		return this._deviceSecretTree;
 	}
 	/**
@@ -3024,42 +3023,135 @@ var BaseAddon = class {
 		this[timerOf] = timer;
 	}
 	/**
-	* Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
-	* transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
-	* swap, or any race where the SqliteSettingsBackend is between shutdown and
-	* re-initialize) doesn't propagate up into `initialize()` and leave the
+	* Wrap `ctx.settings.readAddonStore()` with a retry budget so a transient
+	* settings-store outage doesn't propagate up into `initialize()` and leave the
 	* addon permanently broken.
 	*
-	* Retry only the two known infra fingerprints. Anything else propagates so
-	* real bugs surface immediately. After the budget expires we fall back to
-	* `{}` (defaults) — the addon's first successful patch will rehydrate.
+	* Two kinds of outage, two budgets:
+	*  - the store's own restart fingerprints (`SqliteSettingsBackend not
+	*    initialized`, `provider not available`): a short budget, then the addon
+	*    falls back to `{}` (defaults) - its first successful patch rehydrates;
+	*  - a TRANSPORT failure (the hub is restarting while this runner boots:
+	*    `discovery deadline exceeded`, `parent could not route`, a refused or
+	*    timed-out connection). Since D870 a runner's settings read THROWS instead
+	*    of answering `{}`, so without a budget a hub restart ends in a respawn
+	*    loop. A long, bounded budget; only after it the error propagates - the
+	*    addon never runs on defaults for a store it could not ask.
+	* Anything else propagates immediately so real bugs surface.
 	*/
 	async readAddonStoreWithRetry() {
 		const settings = this.rawSettings();
 		if (!settings) return {};
-		const delaysMs = [
-			150,
-			350,
-			600,
-			900
-		];
 		let lastErr;
-		for (let attempt = 0; attempt <= delaysMs.length; attempt++) try {
+		for (let attempt = 0;; attempt++) try {
 			const stored = await settings.readAddonStore() ?? {};
 			this.settingsStoreReady = true;
 			return stored;
 		} catch (err) {
 			lastErr = err;
-			const msg = err instanceof Error ? err.message : String(err);
-			if (!(msg.includes("SqliteSettingsBackend not initialized") || msg.includes("provider not available"))) throw err;
-			if (attempt === delaysMs.length) break;
-			await new Promise((r) => setTimeout(r, delaysMs[attempt]));
+			const kind = classifyStoreError(err);
+			if (kind === "permanent") throw err;
+			const delay = (kind === "transport" ? TRANSPORT_RETRY_DELAYS_MS : RESTART_RETRY_DELAYS_MS)[attempt];
+			if (delay === void 0) {
+				if (kind === "transport") throw err;
+				break;
+			}
+			await new Promise((r) => setTimeout(r, delay));
 		}
 		this.settingsStoreReady = false;
 		this._ctx?.logger?.warn?.("readAddonStore: settings-store unavailable after retries — using defaults", { meta: { error: lastErr instanceof Error ? lastErr.message : String(lastErr) } });
 		return {};
 	}
 };
+/** The settings store's own restart fingerprints. */
+var RESTART_RETRY_DELAYS_MS = [
+	150,
+	350,
+	600,
+	900
+];
+/** A hub restarting under a booting runner: ~100 s in total. */
+var TRANSPORT_RETRY_DELAYS_MS = [
+	150,
+	350,
+	600,
+	900,
+	2e3,
+	5e3,
+	1e4,
+	2e4,
+	3e4,
+	3e4
+];
+var RESTART_FINGERPRINTS = ["SqliteSettingsBackend not initialized", "provider not available"];
+/** Node / socket error codes of a connection that did not happen or broke. */
+var TRANSPORT_CODES = new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ETIMEDOUT",
+	"EPIPE",
+	"EHOSTUNREACH",
+	"ENETUNREACH"
+]);
+/** tRPC error codes that mean "the other side is not answering now", not "your call is wrong". */
+var UNAVAILABLE_TRPC_CODES = new Set([
+	"TIMEOUT",
+	"SERVICE_UNAVAILABLE",
+	"BAD_GATEWAY",
+	"GATEWAY_TIMEOUT"
+]);
+/** The exact phrases OUR transport raises when it cannot reach the hub. */
+var TRANSPORT_PHRASES = [
+	"discovery deadline exceeded",
+	"parent could not route child unowned cap call",
+	"UDS request timed out after",
+	"channel closed"
+];
+/** Moleculer error `type`s of a call that could not be served right now. */
+var MOLECULER_TRANSIENT_TYPES = new Set([
+	"REQUEST_TIMEOUT",
+	"SERVICE_NOT_FOUND",
+	"SERVICE_NOT_AVAILABLE",
+	"REQUEST_REJECTED",
+	"BROKER_DISCONNECTED"
+]);
+function stringProp(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const found = Reflect.get(value, key);
+	return typeof found === "string" ? found : void 0;
+}
+/** The code an error carries: its own, its cause's, or a tRPC `data.code`. */
+function errorCode(err) {
+	const out = {};
+	const cause = typeof err === "object" && err !== null ? Reflect.get(err, "cause") : void 0;
+	const data = typeof err === "object" && err !== null ? Reflect.get(err, "data") : void 0;
+	const node = stringProp(err, "code") ?? stringProp(cause, "code");
+	if (node !== void 0) out.node = node;
+	const trpc = stringProp(data, "code");
+	if (trpc !== void 0) out.trpc = trpc;
+	return out;
+}
+/**
+* Is a settings read failure worth retrying, and with which budget? Only
+* EXPLICIT signals count: a socket error code, a tRPC "unavailable" code, or
+* one of the exact phrases our own transport raises. A message that merely
+* contains "timed out" or "unreachable" is not evidence of anything, and
+* `settings store not wired` is a wiring bug that retrying cannot fix.
+*/
+function classifyStoreError(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	if (RESTART_FINGERPRINTS.some((f) => message.includes(f))) return "restart";
+	const code = errorCode(err);
+	if (code.node !== void 0 && TRANSPORT_CODES.has(code.node)) return "transport";
+	if (code.trpc !== void 0 && UNAVAILABLE_TRPC_CODES.has(code.trpc)) return "transport";
+	if (typeof err === "object" && err !== null) {
+		if (Reflect.get(err, "retryable") === true) return "transport";
+		const type = stringProp(err, "type");
+		if (type !== void 0 && MOLECULER_TRANSIENT_TYPES.has(type)) return "transport";
+	}
+	if (TRANSPORT_PHRASES.some((f) => message.includes(f))) return "transport";
+	return "permanent";
+}
 /**
 * Collect the keys of every field marked `perNode: true`, recursing into
 * layout containers (`group` fields and `sub-tabs` tabs) the same way
@@ -9321,11 +9413,10 @@ var ClipModelMetaSchema = z.object({
 	/**
 	* The `vector-store` index this model's vectors live in. ONE feature space
 	* per index: two models share an index only when their vectors are ranked
-	* against each other, which for CLIP means never across families. MobileCLIP
-	* S1 and S2 share `object-clip` for history (separated by the row's
-	* `modelId`); any other model gets its own.
+	* against each other, which for CLIP means never across families. Every
+	* model gets its own.
 	*/
-	vectorIndex: z.string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	vectorIndex: z.string().regex(/^object-clip-[a-z0-9][a-z0-9-]*$/),
 	/**
 	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
 	* must be unique per tokenizer: every model's siblings land in ONE flat
@@ -16169,6 +16260,89 @@ id: z.union([z.string(), z.number()]) }), {
 		})
 	}
 };
+/** One table of the settings database. */
+var StorageTableSchema = z.object({
+	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
+	name: z.string(),
+	/** The owner prefix of a scoped name (`recorder` for `recorder:addon-settings`), else null. */
+	owner: z.string().nullable(),
+	rows: z.number().int().nonnegative(),
+	/** Bytes the table's pages occupy (`dbstat`); null when the engine cannot measure. */
+	bytes: z.number().int().nonnegative().nullable(),
+	/** Declared by an addon since this engine process started (a running addon claims it). */
+	declaredThisBoot: z.boolean()
+});
+/**
+* The collections retired by exact name: the D870 ones (their data became keys
+* of the camera's settings) and the three D871 leftovers (the `stats-5m` tables
+* superseded by `stats-5m-v2`, and the unread `vec_object_clip`). No addon
+* declares any of them any more; the engine still refuses one a running addon
+* declared this boot. `dropCollection` may remove these, the
+* per-addon scoped `addon-settings` / `addon-devices` / `sections` tables, and
+* the tables of owners that are no longer installed - nothing else.
+*/
+var STORAGE_ADMIN_MOVED_COLLECTIONS = [
+	"stream-broker:probe-snapshots",
+	"stream-broker:profile-map",
+	"stream-broker:rtsp-tokens",
+	"notification-center:device-mutes",
+	"recorder:recording-configs",
+	"pipeline-orchestrator:device-features",
+	"pipeline-analytics:stats-5m",
+	"pipeline-orchestrator:stats-5m",
+	"vec_object_clip"
+];
+/** The per-addon blob tables a scoped name may carry. */
+var STORAGE_ADMIN_SCOPED_BASES = [
+	"addon-settings",
+	"addon-devices",
+	"sections"
+];
+/**
+* storage-admin - the operator's maintenance reach into the settings database:
+* list its tables, drop one that nothing owns any more (D870).
+*
+* Hub-only, internal and `auth: 'admin'` explicitly (`internal` does not gate
+* the mount, see `data-store-provider`). Both methods are LOGGED by the engine
+* with the table and the counts. `dropCollection` is a ONE-SHOT of the D870
+* migration and is marked for removal once the last hub has run it.
+*
+* `listTables` is READ-ONLY: it never creates a table, which `count` and `get`
+* on an undeclared scoped name used to do.
+*/
+var storageAdminCapability = {
+	name: "storage-admin",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/**
+		* Every table of the settings database with its row count and size,
+		* optionally only those owned by `ownerPrefix`. Reads only.
+		*/
+		listTables: method(z.object({ ownerPrefix: z.string().min(1).optional() }), z.object({ tables: z.array(StorageTableSchema) }), { auth: "admin" }),
+		/**
+		* Drop one table. REFUSES when an addon declared it since the engine
+		* started (a running addon still owns it), when it is an engine or
+		* canonical table, when it does not exist, or when its row count is not
+		* `expectRows` - the caller states what it believes it is deleting. The
+		* engine also refuses anything but `<owner>:(addon-settings|addon-devices|
+		* sections)`, the retired collections by name, and tables of owners that
+		* are not installed (and refuses when it cannot read the installed list).
+		* Removed with the D870 migration script once the last hub ran it.
+		*/
+		dropCollection: method(z.object({
+			collection: z.string().min(1),
+			expectRows: z.number().int().nonnegative()
+		}), z.object({
+			dropped: z.literal(true),
+			rows: z.number().int().nonnegative()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 /**
 * `keychain` — the hub's encrypted store of secret values (D787).
 *
@@ -16905,6 +17079,24 @@ var keychainAdminCapability = {
 			auth: "admin",
 			caller: "required"
 		}),
+		/**
+		* Store a value an operator tool carries over from a retired store at an
+		* addon's own ref (`secret://<owner>/<scope>/<path>`) and answer the ref -
+		* the D870 migration moves a camera's restream tokens this way, so they
+		* never sit in a settings row as plaintext. Audited as the operator; the
+		* caller then writes the MARKER of the ref where the value used to be.
+		*/
+		importSecret: method(z.object({
+			ref: z.string().min(1),
+			value: z.string().min(1)
+		}), z.object({
+			ref: z.string(),
+			version: z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
 		/** Delete refs no owner points at any more. Re-checked here; `unknown` is kept. */
 		deleteOrphans: method(z.object({ refs: z.array(z.string().min(1)).max(1e3) }), z.object({
 			deleted: z.array(z.string()).readonly(),
@@ -61888,7 +62080,19 @@ var TlsStatusSchema = z.object({
 	sans: z.array(z.string()),
 	caCertPem: z.string().nullable(),
 	reissueError: z.string().nullable(),
-	restartRequired: z.boolean()
+	restartRequired: z.boolean(),
+	/** An uploaded certificate is served but no CA is kept for it and it is not publicly signed (D873). */
+	caMissing: z.boolean(),
+	/** Does the hub's own generated CA carry a critical name constraint? `null` while it has none. */
+	localCaConstrained: z.boolean().nullable(),
+	/** ISO time the generated CA was replaced by a constrained one; devices must re-download it. */
+	caReplacedAt: z.string().nullable(),
+	/** The uploaded certificate kept on disk, selectable again after "Revert to generated". */
+	storedUpload: z.object({
+		leafFingerprintSha256: z.string(),
+		validTo: z.string(),
+		hasCa: z.boolean()
+	}).nullable()
 });
 var localNetworkCapability = {
 	name: "local-network",
@@ -62082,7 +62286,10 @@ var localNetworkCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Replace the served material with operator-supplied PEMs. */
+		/**
+		* Replace the served material with operator-supplied PEMs. A certificate that does not lead
+		* to a public CA must come with its CA certificate, validated and kept for Download CA (D873).
+		*/
 		uploadCertificate: method(z.object({
 			certPem: z.string().min(1),
 			keyPem: z.string().min(1),
@@ -62093,7 +62300,14 @@ var localNetworkCapability = {
 		}),
 		/** The local CA PEM, or empty when there is none to download. */
 		downloadCa: method(z.void(), z.object({ pem: z.string() })),
-		/** Drop uploaded material and return to the generated local CA. */
+		/**
+		* Serve the kept upload again after "Revert to generated" (D873). Refused when none is kept.
+		*/
+		useStoredUploadedCertificate: method(z.void(), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Return to the generated local CA. The uploaded certificate stays stored (D873). */
 		revertToGeneratedCertificate: method(z.void(), TlsStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -76086,6 +76300,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychainAdmin.importSecret": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.listAudit": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -76482,6 +76702,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.useStoredUploadedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.getStatus": {
 		capName: "lock-control",
 		capScope: "device",
@@ -79866,6 +80092,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageAdmin.dropCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"storageAdmin.listTables": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -81510,6 +81748,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	snapshotCapability,
 	ssoBridgeCapability,
 	storageCapability,
+	storageAdminCapability,
 	storageEvictableCapability,
 	storageMigrationCapability,
 	storageOccupancyCapability,
@@ -85878,4 +86117,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { StorageLocationTypeSchema as $, storageMigrationCapability as $n, isEvent as $r, isAppLinkBase as $t, DeclaredDevices as A, platformProbeCapability as An, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Ar, decodeVectorBase64 as At, METHOD_ACCESS_MAP as B, resolveLocationMode as Bn, asString$1 as Br, enumerateItemArrayFields as Bt, DAY_NAMES as C, normalizeCoreBlockWrite as Cn, toExpressionValue as Cr, coreBlockIdFromAddonId as Ct, DEVICE_SAN_CREDENTIAL_PREFIX as D, parseStreamParamsFormPatch as Dn, errMsg as Dr, dataStoreProviderCapability as Dt, DEVICE_NONCE_TTL_MS as E, objectInputDeclaresRequiredDeviceId as En, DeviceType as Er, createDeviceExtensionProvider as Et, HUB_MDNS_SERVICE_TYPE as F, resolveAppConnections as Fn, ReadinessTimeoutError as Fr, deviceExtensionCapability as Ft, RecordingStatusSchema as G, scopesAllowDeviceCap as Gn, customAction as Gr, expressionContainsBuiltinCall as Gt, MOTION_CLOSE_AFTER_MS as H, resolveNotificationTapAddress as Hn, collectSecretConfigKeys as Hr, evaluateCompositionField as Ht, HUB_MDNS_TXT_KEYS as I, resolveBucketMs as In, SECRET_CLEAR as Ir, deviceManagerCapability as It, ScopedTokenSchema as J, shortHostname as Jn, emitReadiness as Jr, foldSnapshotByFunction as Jt, STORAGE_ACCESS_FALLBACK as K, scoreRuntimes as Kn, defineCustomActions as Kr, extractNestedAddonId as Kt, KEYCHAIN_RESET_TRIGGER_ACTOR as L, resolveCoreBlockEntry as Ln, WELL_KNOWN_TAB_MAP as Lr, deviceStateCapability as Lt, FIRST_LEVEL_MACRO_CLASSES as M, ptzAutotrackCapability as Mn, REDACTED_SECRET as Mr, deriveBatteryPresence as Mt, FieldClaimModeSchema as N, reducePoints as Nn, RUNTIME_DEFAULTS as Nr, describeComposableCaps as Nt, DEVICE_SAN_USER_PREFIX as O, pickAppLinkHub as On, BaseAddon as Or, databaseSnapshotCapability as Ot, FieldClaimSchema as P, replacedFieldKeys as Pn, ReadinessRegistry as Pr, deviceCredentialsCapability as Pt, StorageLocationModeSchema as Q, storageCapability as Qn, isDeviceConfigCap as Qr, interpolate as Qt, LOG_LEVEL_RANK as R, resolveCoreBlockFiles as Rn, asJsonObject as Rr, deviceStatusCapability as Rt, DATA_STORE_DATABASES as S, motionCapability as Sn, disarmRoseMemory as Sr, coreBlockComposition as St, DEVICE_ENROLLMENT_TTL_MS as T, objectInputDeclaresAddonId as Tn, DeviceRole as Tr, coreBlocksCapability as Tt, NetworkTunnelStartedDataSchema as U, runtimeStatePolicyFor as Un, collectZodSecretPaths as Ur, evictionPolicyOfLocation as Ut, MINUTES_PER_DAY as V, resolveMethodAuth as Vn, buildSecretRef as Vr, enumerateSchemaFields as Vt, RECORDING_SOURCE_CAMSTACK_ADDON as W, scopesAllowAddon as Wn, createEvent as Wr, expandContainer as Wt, SsoBridgeClaimsSchema as X, snapshotCapability as Xn, formatSecretScope as Xr, formatMinutes as Xt, ServerNameSchema as Y, siteZoneKey as Yn, expandCapMethods as Yr, formatDeviceRevoker as Yt, StorageCleanupJobSchema as Z, splitTranslationRef as Zn, hydrateSchema as Zr, gbToBytes as Zt, CatalogFileSchema as _, transformSecretWrite as _i, mayReadLocation as _n, compositionFeatureEnabled as _r, checkRoleAddress as _t, ApiKeyRecordSchema as a, normalizeSecretOwner as ai, isVoidInput as an, userManagementCapability as ar, alertsCapability as at, DATABASE_SNAPSHOT_SUFFIX as b, metricsProviderCapability as bn, compositionSourceKey as br, compositionSourceRefs as bt, CAMERA_SWITCH_ORDER as c, parseSecretRef as ci, keychainCapability as cn, vectorDimFromBase64 as cr, bareAddonId as ct, CATALOG_LANGS as d, resolveSecretMarkers as di, lifecycleJobSchema as dn, withLocationMode as dr, buildDeviceEnrollmentLink as dt, isKeychainStoredField as ei, isArrayOutputSchema as en, storageOccupancyCapability as er, StorageMigrationJobSchema as et, COMPOSED_ITEM_FIXED_FIELDS as f, scopeKey as fi, localNetworkCapability as fn, COMPOSER_ADDON_ID as fr, buildDeviceSignatureMessage as ft, CalendarPreferencesSchema as g, toSecretFieldView as gi, looseSchema as gn, composedDeviceStableId as gr, canonicalIconKey as gt, CORE_BLOCK_ADDON_PREFIX as h, toNodeId as hi, logLevelAtMost as hn, composedDeviceRef as hr, cameraGridLayoutCapability as ht, AlertSchema as i, nodePin as ii, isObjectInput as in, supportedRuntimes as ir, addonWidgetsCapability as it, DeviceStatusSchema as j, procedureAuthKey as jn, DEVICE_STATUS_METHOD as jr, defineExtensionSlotProvider as jt, DEVICE_TOMBSTONE_RETENTION_MS as k, planComposition as kn, DATAPLANE_SECRET_HEADER as kr, declarationOwnerNodeId as kt, CAMSTACK_APP_LINK_ORIGIN as l, readinessKey as li, legacyAutoLinkIds as ln, vectorIndexDimConflictError as lr, batteryCapability as lt, CORE_BLOCKS_ADDON_ID as m, sleep as mi, logDestinationCapability as mn, cloneStatefulExpressionMemory as mr, calendarsCapability as mt, AGENT_MDNS_TXT_KEYS as n, isSecretMarker as ni, isDefaultAppConnectionEndpoint as nn, streamCatalogCapability as nr, addonPagesCapability as nt, BaseDevice as o, parseJsonObject as oi, kebabToCamel as on, validateComposition as or, authProviderCapability as ot, COMPOSER_RUNNER_ID as p, secretTreeFromPaths as pi, locationIconKey as pn, buildFfmpegArgs as pr, buildStreamParamsConfigSchema as pt, STREAM_PROFILE_META as q, settingsStoreCapability as qn, emitDownForOwnedCaps as qr, filesystemBrowseCapability as qt, ALL_CAPABILITY_DEFINITIONS as r, isSecretMarkerLike as ri, isLocationEnabled as rn, streamQualityLabel as rr, addonSettingsCapability as rt, BatteryStatusSchema as s, parseJsonUnknown as si, keychainAdminCapability as sn, validateCustomAddress as sr, backupCapability as st, AGENT_MDNS_SERVICE_TYPE as t, isSecretClear as ti, isCollectionArrayMethod as tn, storageProviderCapability as tr, UserRecordSchema as tt, CAP_NAMES_WITH_STATUS as u, resolveCapMount as ui, legacyModeOf as un, vectorStoreCapability as ur, buildCapabilityLookup as ut, CoreBlockSchema as v, userError as vi, mayWriteToLocation as vn, compositionItemFieldPath as vr, composerCapability as vt, DERIVED_CAMERA_SILENCED_CAP_NAMES as w, normalizeUnit as wn, DeviceFeature as wr, coreBlockSourceKind as wt, DATABASE_SNAPSHOT_TIMEOUT_MS as x, modeMayWrite as xn, createStatefulExpressionMemory as xr, coreBlockAddonId as xt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as y, EventCategory as yi, memoizePinnedFfmpeg as yn, compositionSliceKey as yr, compositionFieldKey as yt, LegacyStorageLocationDefaultSchema as z, resolveHubAddressRoles as zn, asNumber as zr, enumerateInferenceDevices as zt };
+export { StorageCleanupJobSchema as $, splitTranslationRef as $n, formatSecretScope as $r, gbToBytes as $t, DeclaredDevices as A, pickAppLinkHub as An, errMsg as Ar, databaseSnapshotCapability as At, METHOD_ACCESS_MAP as B, resolveCoreBlockFiles as Bn, WELL_KNOWN_TAB_MAP as Br, deviceStatusCapability as Bt, DAY_NAMES as C, modeMayWrite as Cn, compositionSourceKey as Cr, coreBlockAddonId as Ct, DEVICE_SAN_CREDENTIAL_PREFIX as D, objectInputDeclaresAddonId as Dn, DeviceFeature as Dr, coreBlocksCapability as Dt, DEVICE_NONCE_TTL_MS as E, normalizeUnit as En, toExpressionValue as Er, coreBlockSourceKind as Et, HUB_MDNS_SERVICE_TYPE as F, reducePoints as Fn, REDACTED_SECRET as Fr, describeComposableCaps as Ft, RecordingStatusSchema as G, runtimeStatePolicyFor as Gn, collectSecretConfigKeys as Gr, evictionPolicyOfLocation as Gt, MOTION_CLOSE_AFTER_MS as H, resolveLocationMode as Hn, asNumber as Hr, enumerateItemArrayFields as Ht, HUB_MDNS_TXT_KEYS as I, replacedFieldKeys as In, RUNTIME_DEFAULTS as Ir, deviceCredentialsCapability as It, STORAGE_ADMIN_SCOPED_BASES as J, scoreRuntimes as Jn, customAction as Jr, extractNestedAddonId as Jt, STORAGE_ACCESS_FALLBACK as K, scopesAllowAddon as Kn, collectZodSecretPaths as Kr, expandContainer as Kt, KEYCHAIN_RESET_TRIGGER_ACTOR as L, resolveAppConnections as Ln, ReadinessRegistry as Lr, deviceExtensionCapability as Lt, FIRST_LEVEL_MACRO_CLASSES as M, platformProbeCapability as Mn, DATAPLANE_SECRET_HEADER as Mr, decodeVectorBase64 as Mt, FieldClaimModeSchema as N, procedureAuthKey as Nn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Nr, defineExtensionSlotProvider as Nt, DEVICE_SAN_USER_PREFIX as O, objectInputDeclaresRequiredDeviceId as On, DeviceRole as Or, createDeviceExtensionProvider as Ot, FieldClaimSchema as P, ptzAutotrackCapability as Pn, DEVICE_STATUS_METHOD as Pr, deriveBatteryPresence as Pt, SsoBridgeClaimsSchema as Q, snapshotCapability as Qn, expandCapMethods as Qr, formatMinutes as Qt, LOG_LEVEL_RANK as R, resolveBucketMs as Rn, ReadinessTimeoutError as Rr, deviceManagerCapability as Rt, DATA_STORE_DATABASES as S, EventCategory as Si, metricsProviderCapability as Sn, compositionSliceKey as Sr, compositionSourceRefs as St, DEVICE_ENROLLMENT_TTL_MS as T, normalizeCoreBlockWrite as Tn, disarmRoseMemory as Tr, coreBlockIdFromAddonId as Tt, NetworkTunnelStartedDataSchema as U, resolveMethodAuth as Un, asString$1 as Ur, enumerateSchemaFields as Ut, MINUTES_PER_DAY as V, resolveHubAddressRoles as Vn, asJsonObject as Vr, enumerateInferenceDevices as Vt, RECORDING_SOURCE_CAMSTACK_ADDON as W, resolveNotificationTapAddress as Wn, buildSecretRef as Wr, evaluateCompositionField as Wt, ScopedTokenSchema as X, shortHostname as Xn, emitDownForOwnedCaps as Xr, foldSnapshotByFunction as Xt, STREAM_PROFILE_META as Y, settingsStoreCapability as Yn, defineCustomActions as Yr, filesystemBrowseCapability as Yt, ServerNameSchema as Z, siteZoneKey as Zn, emitReadiness as Zr, formatDeviceRevoker as Zt, CatalogFileSchema as _, sleep as _i, logLevelAtMost as _n, cloneStatefulExpressionMemory as _r, cameraGridLayoutCapability as _t, ApiKeyRecordSchema as a, isSecretMarker as ai, isLocationEnabled as an, streamCatalogCapability as ar, addonSettingsCapability as at, DATABASE_SNAPSHOT_SUFFIX as b, transformSecretWrite as bi, mayWriteToLocation as bn, compositionFeatureEnabled as br, composerCapability as bt, CAMERA_SWITCH_ORDER as c, normalizeSecretOwner as ci, kebabToCamel as cn, userManagementCapability as cr, authProviderCapability as ct, CATALOG_LANGS as d, parseSecretRef as di, legacyAutoLinkIds as dn, vectorDimFromBase64 as dr, batteryCapability as dt, hydrateSchema as ei, interpolate as en, storageAdminCapability as er, StorageLocationModeSchema as et, COMPOSED_ITEM_FIXED_FIELDS as f, readinessKey as fi, legacyModeOf as fn, vectorIndexDimConflictError as fr, buildCapabilityLookup as ft, CalendarPreferencesSchema as g, secretTreeFromPaths as gi, logDestinationCapability as gn, buildFfmpegArgs as gr, calendarsCapability as gt, CORE_BLOCK_ADDON_PREFIX as h, scopeKey as hi, locationIconKey as hn, COMPOSER_ADDON_ID as hr, buildStreamParamsConfigSchema as ht, AlertSchema as i, isSecretClear as ii, isDefaultAppConnectionEndpoint as in, storageProviderCapability as ir, addonPagesCapability as it, DeviceStatusSchema as j, planComposition as jn, BaseAddon as jr, declarationOwnerNodeId as jt, DEVICE_TOMBSTONE_RETENTION_MS as k, parseStreamParamsFormPatch as kn, DeviceType as kr, dataStoreProviderCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, parseJsonObject as li, keychainAdminCapability as ln, validateComposition as lr, backupCapability as lt, CORE_BLOCKS_ADDON_ID as m, resolveSecretMarkers as mi, localNetworkCapability as mn, withLocationMode as mr, buildDeviceSignatureMessage as mt, AGENT_MDNS_TXT_KEYS as n, isEvent as ni, isArrayOutputSchema as nn, storageMigrationCapability as nr, StorageMigrationJobSchema as nt, BaseDevice as o, isSecretMarkerLike as oi, isObjectInput as on, streamQualityLabel as or, addonWidgetsCapability as ot, COMPOSER_RUNNER_ID as p, resolveCapMount as pi, lifecycleJobSchema as pn, vectorStoreCapability as pr, buildDeviceEnrollmentLink as pt, STORAGE_ADMIN_MOVED_COLLECTIONS as q, scopesAllowDeviceCap as qn, createEvent as qr, expressionContainsBuiltinCall as qt, ALL_CAPABILITY_DEFINITIONS as r, isKeychainStoredField as ri, isCollectionArrayMethod as rn, storageOccupancyCapability as rr, UserRecordSchema as rt, BatteryStatusSchema as s, nodePin as si, isVoidInput as sn, supportedRuntimes as sr, alertsCapability as st, AGENT_MDNS_SERVICE_TYPE as t, isDeviceConfigCap as ti, isAppLinkBase as tn, storageCapability as tr, StorageLocationTypeSchema as tt, CAP_NAMES_WITH_STATUS as u, parseJsonUnknown as ui, keychainCapability as un, validateCustomAddress as ur, bareAddonId as ut, CoreBlockSchema as v, toNodeId as vi, looseSchema as vn, composedDeviceRef as vr, canonicalIconKey as vt, DERIVED_CAMERA_SILENCED_CAP_NAMES as w, motionCapability as wn, createStatefulExpressionMemory as wr, coreBlockComposition as wt, DATABASE_SNAPSHOT_TIMEOUT_MS as x, userError as xi, memoizePinnedFfmpeg as xn, compositionItemFieldPath as xr, compositionFieldKey as xt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as y, toSecretFieldView as yi, mayReadLocation as yn, composedDeviceStableId as yr, checkRoleAddress as yt, LegacyStorageLocationDefaultSchema as z, resolveCoreBlockEntry as zn, SECRET_CLEAR as zr, deviceStateCapability as zt };