@camstack/system 1.2.441 → 1.2.442

package/dist/builtins/alerts/critical-push.d.ts

@@ -0,0 +1,86 @@
+/**
+* Critical system alerts reach the operator without depending on the addons
+* that just failed (D877).
+*
+* On 2026-10-17 the hub-main alert centre recorded the crash loops, but the
+* only PUSH path ran through notification-center, which was itself one of the
+* refused runners: nothing arrived for four hours. hub-main is now the SOLE
+* pusher of runner failures (`addon.runner-failed`, `addon.runner-refused`) and
+* of a degraded boot check, straight through `notification-output` (the
+* notifiers). There is no presence heuristic and no second sender:
+* notification-center keeps the state-summary row of `addon-crash-loop` and
+* pushes nothing for it.
+*
+*  - A burst is ONE digest per target: 28 runners refusing in the same boot are
+*    one message listing them, not 28.
+*  - The message names the addon, the state and the remedy line - never raw
+*    internal error text.
+*  - Delivery is a durable fact on each alert (`metadata.push`), tracked PER
+*    TARGET: a retry sends only to the targets that did not get it, and a state
+*    already delivered to every target is never sent again. A push that could not
+*    be sent stays `pending` and is retried when the notifiers (or
+*    notification-center) start - event plus reconcile (D11). If the notifiers
+*    are down, the alert and the boot-check status remain the record.
+*/
+export interface PushState {
+	readonly state: "pending" | "delivered" | "disabled";
+	/** What was pushed: the finding's episode + cause. A new key is a new push. */
+	readonly key: string;
+	readonly at?: number;
+	readonly attempts: number;
+	readonly lastError?: string;
+	/** Targets that already got this key's message. */
+	readonly sentTo?: readonly string[];
+}
+/** The slice of a notifier target the policy reads. */
+export interface PushTarget {
+	readonly id: string;
+	readonly addonId: string;
+	readonly enabled: boolean;
+	/** A personal target carries its owner; an operator-level one does not. */
+	readonly ownerUserId?: string;
+}
+export interface PushMessage {
+	readonly title: string;
+	readonly body: string;
+}
+export interface CriticalPushPorts {
+	/** Throws when the notifiers cannot be asked. */
+	readonly listTargets: () => Promise<readonly PushTarget[]>;
+	readonly send: (target: PushTarget, message: PushMessage) => Promise<{
+		readonly success: boolean;
+		readonly error?: string;
+	}>;
+}
+export interface PushPolicy {
+	readonly enabled: boolean;
+	/** Explicit target ids; empty = every enabled operator-level (not personal) target. */
+	readonly targetIds: readonly string[];
+}
+/** Alert categories that are critical system findings. */
+export declare const CRITICAL_CATEGORIES: ReadonlySet<string>;
+export declare function isPushState(value: unknown): value is PushState;
+export declare function selectPushTargets(targets: readonly PushTarget[], policy: PushPolicy): readonly PushTarget[];
+/** One critical finding waiting for its push. */
+export interface CriticalItem {
+	readonly alertId: string;
+	readonly key: string;
+	readonly title: string;
+	/** ONE line: addon id, state, remedy. Never raw internal error text. */
+	readonly line: string;
+	readonly previous: PushState | null;
+}
+/** The one message a target gets for a set of findings. */
+export declare function composeDigest(items: readonly CriticalItem[]): PushMessage;
+export interface DeliverDigestInput {
+	readonly items: readonly CriticalItem[];
+	readonly policy: PushPolicy;
+	readonly ports: CriticalPushPorts;
+	readonly now: number;
+}
+/**
+* Push every item that still needs it, as ONE message per target. Returns the new
+* state of each item whose state changed (an item already delivered/disabled for
+* its key is absent from the result).
+*/
+export declare function deliverDigest(input: DeliverDigestInput): Promise<ReadonlyMap<string, PushState>>;

package/dist/builtins/alerts/runner-alert.d.ts

@@ -0,0 +1,71 @@
+/**
+* ONE alert per runner (D877).
+*
+* A runner that dies produces a burst: `process.crashed` per exit,
+* `addon.crashed` per hosted addon, then `addon.runner-failed` when the D6
+* breaker gives up (or `addon.runner-refused` for a typed Init refusal). On
+* 2026-10-17 28 runners made 28 "Addon crash loop" + 140 "Process crashed" +
+* 34 "Addon crashed" alerts in one minute - the alerts ring (500) was a third
+* full and the one alert that mattered was 1 of 202.
+*
+* Here the burst folds into ONE record per `(node, runner)` that updates its
+* count and state. `refused` and `failed` are TERMINAL markers: a later plain
+* crash bumps the count but never downgrades them. A dismissed record starts
+* a fresh one.
+*/
+import type { AlertSeverity } from "@camstack/types";
+export type RunnerAlertState = "crashed" | "failed" | "refused";
+export interface RunnerAlertRecord {
+	readonly nodeId: string;
+	readonly runnerId: string;
+	readonly state: RunnerAlertState;
+	/** When this EPISODE began (ms). A runner that recovered and fails again opens a new one. */
+	readonly since: number;
+	/** Events folded into this record. */
+	readonly count: number;
+	readonly addonIds: readonly string[];
+	/** Last error text a plain crash carried. */
+	readonly lastError?: string;
+	/** Refusal: the addon's own words, and what the operator does. */
+	readonly reason?: string;
+	readonly remedy?: string;
+	/** Breaker: crashes inside the window. */
+	readonly crashesInWindow?: number;
+}
+export type RunnerAlertCategory = "process.crashed" | "addon.crashed" | "addon.runner-failed" | "addon.runner-refused";
+export declare const RUNNER_ALERT_CATEGORIES: readonly RunnerAlertCategory[];
+export declare function isRunnerAlertCategory(category: string): category is RunnerAlertCategory;
+/** Stable alert id of a runner on a node. */
+export declare function runnerAlertId(nodeId: string, runnerId: string): string;
+/** Which runner an event is about; `null` when it names none. */
+export declare function runnerKeyOf(category: RunnerAlertCategory, data: Record<string, unknown>, source: {
+	readonly id?: string;
+	readonly nodeId?: string;
+} | undefined): {
+	readonly nodeId: string;
+	readonly runnerId: string;
+} | null;
+/** Fold one event into the runner's record. */
+export declare function foldRunnerEvent(previous: RunnerAlertRecord | null, category: RunnerAlertCategory, data: Record<string, unknown>, key: {
+	readonly nodeId: string;
+	readonly runnerId: string;
+}, now: number): RunnerAlertRecord;
+export interface RenderedRunnerAlert {
+	readonly severity: AlertSeverity;
+	readonly title: string;
+	readonly message: string;
+}
+export declare function renderRunnerAlert(record: RunnerAlertRecord): RenderedRunnerAlert;
+/** Is the record in a state an operator must act on (terminal)? */
+export declare function isTerminalRunnerState(state: RunnerAlertState): boolean;
+/**
+* The push key of a record: its episode and its cause. The same refusal of the
+* same episode is never pushed twice; a refusal with another reason, a breaker
+* trip, or any failure after a recovery (a new episode) is a new push.
+*/
+export declare function runnerPushKey(record: RunnerAlertRecord): string;
+/**
+* The one line a push carries: runner, state and the remedy. Deliberately NOT
+* the raw reason or error text - those stay on the alert.
+*/
+export declare function runnerPushLine(record: RunnerAlertRecord): string;

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Ar as errMsg, M as FIRST_LEVEL_MACRO_CLASSES, Pn as ptzAutotrackCapability, Si as EventCategory, jr as BaseAddon, ni as isEvent, ut as bareAddonId } from "../../dist-BWvkuc31.mjs";
+import { Ar as errMsg, Ci as EventCategory, M as FIRST_LEVEL_MACRO_CLASSES, Pn as ptzAutotrackCapability, jr as BaseAddon, ni as isEvent, ut as bareAddonId } from "../../dist-DsrQYcLm.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
-const require_restore_archive = require("../../restore-archive-CfSSjKnA.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
+const require_restore_archive = require("../../restore-archive-Cdf09dHm.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
-import { Si as EventCategory, bn as mayWriteToLocation, jr as BaseAddon, lt as backupCapability, rr as storageOccupancyCapability, si as nodePin, vi as toNodeId } from "../../dist-BWvkuc31.mjs";
-import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-4ziluTU3.mjs";
+import { Ci as EventCategory, bn as mayWriteToLocation, ci as nodePin, jr as BaseAddon, lt as backupCapability, rr as storageOccupancyCapability, yi as toNodeId } from "../../dist-DsrQYcLm.mjs";
+import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-RaA3uZ7H.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { g as CalendarPreferencesSchema, gt as calendarsCapability, jr as BaseAddon } from "../../dist-BWvkuc31.mjs";
+import { g as CalendarPreferencesSchema, gt as calendarsCapability, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { A as DeclaredDevices, Ar as errMsg, Dr as DeviceFeature, H as MOTION_CLOSE_AFTER_MS, Qn as snapshotCapability, Si as EventCategory, _t as cameraGridLayoutCapability, ar as streamCatalogCapability, ei as hydrateSchema, gr as buildFfmpegArgs, jr as BaseAddon, jt as declarationOwnerNodeId, kr as DeviceType, o as BaseDevice, qr as createEvent, w as DERIVED_CAMERA_SILENCED_CAP_NAMES, wn as motionCapability, xn as memoizePinnedFfmpeg } from "../../dist-BWvkuc31.mjs";
+import { A as DeclaredDevices, Ar as errMsg, Ci as EventCategory, Dr as DeviceFeature, H as MOTION_CLOSE_AFTER_MS, Qn as snapshotCapability, _t as cameraGridLayoutCapability, ar as streamCatalogCapability, ei as hydrateSchema, gr as buildFfmpegArgs, jr as BaseAddon, jt as declarationOwnerNodeId, kr as DeviceType, o as BaseDevice, qr as createEvent, w as DERIVED_CAMERA_SILENCED_CAP_NAMES, wn as motionCapability, xn as memoizePinnedFfmpeg } from "../../dist-DsrQYcLm.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
-const require_composition_sources = require("../../composition-sources-BG-W2U0d.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
+const require_composition_sources = require("../../composition-sources-DmSEMtUD.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { A as DeclaredDevices, Ar as errMsg, Cr as compositionSourceKey, Er as toExpressionValue, Si as EventCategory, Sr as compositionSliceKey, Tr as disarmRoseMemory, Wt as evaluateCompositionField, _r as cloneStatefulExpressionMemory, br as compositionFeatureEnabled, bt as composerCapability, f as COMPOSED_ITEM_FIXED_FIELDS, ft as buildCapabilityLookup, hr as COMPOSER_ADDON_ID, jn as planComposition, jr as BaseAddon, kr as DeviceType, o as BaseDevice, qr as createEvent, qt as expressionContainsBuiltinCall, r as ALL_CAPABILITY_DEFINITIONS, vr as composedDeviceRef, wr as createStatefulExpressionMemory, xr as compositionItemFieldPath, xt as compositionFieldKey, yr as composedDeviceStableId } from "../../dist-BWvkuc31.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-ByNISOnW.mjs";
+import { A as DeclaredDevices, Ar as errMsg, Ci as EventCategory, Cr as compositionSourceKey, Er as toExpressionValue, Sr as compositionSliceKey, Tr as disarmRoseMemory, Wt as evaluateCompositionField, _r as cloneStatefulExpressionMemory, br as compositionFeatureEnabled, bt as composerCapability, f as COMPOSED_ITEM_FIXED_FIELDS, ft as buildCapabilityLookup, hr as COMPOSER_ADDON_ID, jn as planComposition, jr as BaseAddon, kr as DeviceType, o as BaseDevice, qr as createEvent, qt as expressionContainsBuiltinCall, r as ALL_CAPABILITY_DEFINITIONS, vr as composedDeviceRef, wr as createStatefulExpressionMemory, xr as compositionItemFieldPath, xt as compositionFieldKey, yr as composedDeviceStableId } from "../../dist-DsrQYcLm.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-CftPpY4O.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-BWvkuc31.mjs";
+import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
-const require_composition_sources = require("../../composition-sources-BG-W2U0d.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
+const require_composition_sources = require("../../composition-sources-DmSEMtUD.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");
 let node_crypto = require("node:crypto");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { A as DeclaredDevices, Ar as errMsg, Bn as resolveCoreBlockFiles, Cr as compositionSourceKey, Ct as coreBlockAddonId, Dt as coreBlocksCapability, Et as coreBlockSourceKind, Ft as describeComposableCaps, In as replacedFieldKeys, St as compositionSourceRefs, Tn as normalizeCoreBlockWrite, Tt as coreBlockIdFromAddonId, ei as hydrateSchema, ft as buildCapabilityLookup, h as CORE_BLOCK_ADDON_PREFIX, jn as planComposition, jr as BaseAddon, lr as validateComposition, m as CORE_BLOCKS_ADDON_ID, p as COMPOSER_RUNNER_ID, r as ALL_CAPABILITY_DEFINITIONS, v as CoreBlockSchema, vr as composedDeviceRef, wt as coreBlockComposition, zn as resolveCoreBlockEntry } from "../../dist-BWvkuc31.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-ByNISOnW.mjs";
+import { A as DeclaredDevices, Ar as errMsg, Bn as resolveCoreBlockFiles, Cr as compositionSourceKey, Ct as coreBlockAddonId, Dt as coreBlocksCapability, Et as coreBlockSourceKind, Ft as describeComposableCaps, In as replacedFieldKeys, St as compositionSourceRefs, Tn as normalizeCoreBlockWrite, Tt as coreBlockIdFromAddonId, ei as hydrateSchema, ft as buildCapabilityLookup, h as CORE_BLOCK_ADDON_PREFIX, jn as planComposition, jr as BaseAddon, lr as validateComposition, m as CORE_BLOCKS_ADDON_ID, p as COMPOSER_RUNNER_ID, r as ALL_CAPABILITY_DEFINITIONS, v as CoreBlockSchema, vr as composedDeviceRef, wt as coreBlockComposition, zn as resolveCoreBlockEntry } from "../../dist-DsrQYcLm.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-CftPpY4O.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { n as unwrapStoredValue, t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");
 const require_retired_settings_keys = require("../../retired-settings-keys-D_VwZiDt.js");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { Ar as errMsg, Br as WELL_KNOWN_TAB_MAP, Bt as deviceStatusCapability, C as DAY_NAMES, Dr as DeviceFeature, En as normalizeUnit, Gn as runtimeStatePolicyFor, Ht as enumerateItemArrayFields, Kr as collectZodSecretPaths, Kt as expandContainer, Lt as deviceExtensionCapability, N as FieldClaimModeSchema, Nt as defineExtensionSlotProvider, Or as DeviceRole, Ot as createDeviceExtensionProvider, P as FieldClaimSchema, Qt as formatMinutes, Rt as deviceManagerCapability, Si as EventCategory, Ut as enumerateSchemaFields, V as MINUTES_PER_DAY, Y as STREAM_PROFILE_META, Zn as siteZoneKey, _i as sleep$1, ai as isSecretMarker, bi as transformSecretWrite, c as CAMERA_SWITCH_ORDER, dn as legacyAutoLinkIds, gi as secretTreeFromPaths, hn as locationIconKey, ht as buildStreamParamsConfigSchema, ii as isSecretClear, j as DeviceStatusSchema, jr as BaseAddon, kn as parseStreamParamsFormPatch, kr as DeviceType, mi as resolveSecretMarkers, oi as isSecretMarkerLike, r as ALL_CAPABILITY_DEFINITIONS, ri as isKeychainStoredField, ti as isDeviceConfigCap, u as CAP_NAMES_WITH_STATUS, vt as canonicalIconKey, xi as userError, yi as toSecretFieldView, zr as SECRET_CLEAR, zt as deviceStateCapability } from "../../dist-BWvkuc31.mjs";
+import { Ar as errMsg, Br as WELL_KNOWN_TAB_MAP, Bt as deviceStatusCapability, C as DAY_NAMES, Ci as EventCategory, Dr as DeviceFeature, En as normalizeUnit, Gn as runtimeStatePolicyFor, Ht as enumerateItemArrayFields, Kr as collectZodSecretPaths, Kt as expandContainer, Lt as deviceExtensionCapability, N as FieldClaimModeSchema, Nt as defineExtensionSlotProvider, Or as DeviceRole, Ot as createDeviceExtensionProvider, P as FieldClaimSchema, Qt as formatMinutes, Rt as deviceManagerCapability, Si as userError, Ut as enumerateSchemaFields, V as MINUTES_PER_DAY, Y as STREAM_PROFILE_META, Zn as siteZoneKey, _i as secretTreeFromPaths, ai as isSecretMarker, bi as toSecretFieldView, c as CAMERA_SWITCH_ORDER, dn as legacyAutoLinkIds, hi as resolveSecretMarkers, hn as locationIconKey, ht as buildStreamParamsConfigSchema, ii as isSecretClear, j as DeviceStatusSchema, jr as BaseAddon, kn as parseStreamParamsFormPatch, kr as DeviceType, oi as isSecretMarkerLike, r as ALL_CAPABILITY_DEFINITIONS, ri as isKeychainStoredField, ti as isDeviceConfigCap, u as CAP_NAMES_WITH_STATUS, vi as sleep$1, vt as canonicalIconKey, xi as transformSecretWrite, zr as SECRET_CLEAR, zt as deviceStateCapability } from "../../dist-DsrQYcLm.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";
 import { r as purgeRetiredSettingsRows } from "../../retired-settings-keys-Bhwe4ymb.mjs";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-BWvkuc31.mjs";
+import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
-const require_device_ca = require("../../device-ca-196DAEZT.js");
-const require_constants = require("../../constants-UojhAJcm.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
+const require_device_ca = require("../../device-ca-tKY_ZS9H.js");
+const require_constants = require("../../constants-b7kpjuO4.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { $r as formatSecretScope, L as KEYCHAIN_RESET_TRIGGER_ACTOR, Si as EventCategory, ci as normalizeSecretOwner, di as parseSecretRef, jr as BaseAddon, ln as keychainAdminCapability, un as keychainCapability } from "../../dist-BWvkuc31.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-D8Ri9TVz.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants-DJILnUSb.mjs";
+import { $r as formatSecretScope, Ci as EventCategory, L as KEYCHAIN_RESET_TRIGGER_ACTOR, fi as parseSecretRef, jr as BaseAddon, li as normalizeSecretOwner, ln as keychainAdminCapability, un as keychainCapability } from "../../dist-DsrQYcLm.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-BJpYTAPg.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-2iWQ-Nx-.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Ar as errMsg, G as RecordingStatusSchema, Si as EventCategory, W as RECORDING_SOURCE_CAMSTACK_ADDON, jr as BaseAddon, qr as createEvent } from "../../dist-BWvkuc31.mjs";
+import { Ar as errMsg, Ci as EventCategory, G as RecordingStatusSchema, W as RECORDING_SOURCE_CAMSTACK_ADDON, jr as BaseAddon, qr as createEvent } from "../../dist-DsrQYcLm.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/auth-schema.d.ts

@@ -76,7 +76,7 @@ export declare const OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
 * = null`) is INACTIVE — `verifyTotp` returns false until confirmation.
 *
 * @durable class=config owner=local-auth
-*   write="`setup` inserts a fresh secret for the user (deleting any pending row
+*   write="`setup` inserts a keychain marker for the user's seed (D878; deleting any pending row
 *     first); `confirm` flips `confirmedAt` once a valid code proves possession"
 *   retention="`disable` deletes the row, and `setup` deletes before re-inserting.
 *     Nothing else prunes — deleting a USER does not cascade here, so their