@camstack/system 1.2.452 → 1.2.454

package/dist/builtins/alerts/emit-alert-policy.d.ts

@@ -1,5 +1,4 @@
 import type { Alert } from "@camstack/types";
-import { type PushState } from "./critical-push.js";
 export declare function episodeKeyFromMetadata(metadata: Record<string, unknown> | undefined): string | undefined;
 export interface EmitMergeInput {
 	readonly existing: {
@@ -9,20 +8,8 @@ export interface EmitMergeInput {
 	} | null;
 	readonly incoming: Alert;
 }
-export interface EmitMergeResult {
-	readonly alert: Alert;
-	readonly queuePush: boolean;
-}
-/** Completed episodes start fresh — prior push must not suppress the next digest. */
-export declare function shouldDropPriorPush(existingStatus: string | undefined): boolean;
-export declare function alertWithRetainedPush(toStore: Alert, existingPush: PushState | undefined, existingStatus: string | undefined): Alert;
 /**
-* Re-emit of the same alert id: preserve read when the episode is unchanged
-* and still active. A completed episode starts again. Queue a critical push
-* only for active, unread critical findings.
+* Re-emit of the same alert id: preserve `read` when the episode is unchanged
+* and still active. A completed episode starts again.
 */
-export declare function mergeEmitAlert(input: EmitMergeInput): EmitMergeResult;
-export declare function criticalPushPayload(alert: Alert): {
-	readonly key: string;
-	readonly line: string;
-};
+export declare function mergeEmitAlert(input: EmitMergeInput): Alert;

package/dist/builtins/alerts/runner-alert.d.ts

@@ -56,16 +56,3 @@ export interface RenderedRunnerAlert {
 	readonly message: string;
 }
 export declare function renderRunnerAlert(record: RunnerAlertRecord): RenderedRunnerAlert;
-/** Is the record in a state an operator must act on (terminal)? */
-export declare function isTerminalRunnerState(state: RunnerAlertState): boolean;
-/**
-* The push key of a record: its episode and its cause. The same refusal of the
-* same episode is never pushed twice; a refusal with another reason, a breaker
-* trip, or any failure after a recovery (a new episode) is a new push.
-*/
-export declare function runnerPushKey(record: RunnerAlertRecord): string;
-/**
-* The one line a push carries: runner, state and the remedy. Deliberately NOT
-* the raw reason or error text - those stay on the alert.
-*/
-export declare function runnerPushLine(record: RunnerAlertRecord): string;

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Hr as BaseAddon, P as FIRST_LEVEL_MACRO_CLASSES, Un as ptzAutotrackCapability, Vr as errMsg, _t as bareAddonId, ma as EventCategory, zi as isEvent } from "../../dist-DV2ll9Hi.mjs";
+import { Gr as errMsg, Kr as BaseAddon, P as FIRST_LEVEL_MACRO_CLASSES, Ui as isEvent, qn as ptzAutotrackCapability, va as EventCategory, yt as bareAddonId } from "../../dist-7ZciHCIp.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_restore_archive = require("../../restore-archive-Cprdh3P9.js");
+const require_restore_archive = require("../../restore-archive-C0ymYQk7.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,6 +1,6 @@
-import { Hr as BaseAddon, gt as backupCapability, kn as mayWriteToLocation, la as toNodeId, ma as EventCategory, mr as storageOccupancyCapability, qi as nodePin } from "../../dist-DV2ll9Hi.mjs";
+import { Kr as BaseAddon, Nn as mayWriteToLocation, Zi as nodePin, pa as toNodeId, va as EventCategory, vr as storageOccupancyCapability, vt as backupCapability } from "../../dist-7ZciHCIp.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { _ as parseBackupSecretKey, a as BackupSnapshotRefusedError, c as backupOrchestratorRecordKinds, d as BackupEncryptionKeyStore, g as generateBackupKeyPair, h as ENCRYPTED_BACKUP_SUFFIX, i as BackupCancelledError, l as backupRecordStoresOf, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, u as BackupSeedMarkerStore } from "../../restore-archive-Jiz63mVB.mjs";
+import { _ as parseBackupSecretKey, a as BackupSnapshotRefusedError, c as backupOrchestratorRecordKinds, d as BackupEncryptionKeyStore, g as generateBackupKeyPair, h as ENCRYPTED_BACKUP_SUFFIX, i as BackupCancelledError, l as backupRecordStoresOf, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, u as BackupSeedMarkerStore } from "../../restore-archive-UVZv_hmr.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { Ct as calendarsCapability, Hr as BaseAddon, Mi as defineRecordKinds, g as CalendarPreferencesSchema } from "../../dist-DV2ll9Hi.mjs";
+import { Ii as defineRecordKinds, Kr as BaseAddon, Tt as calendarsCapability, g as CalendarPreferencesSchema } from "../../dist-7ZciHCIp.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { An as memoizePinnedFfmpeg, Br as DeviceType, Dr as buildFfmpegArgs, Hr as BaseAddon, Li as hydrateSchema, Nn as motionCapability, Oi as createEvent, Rr as DeviceFeature, Rt as declarationOwnerNodeId, Vr as errMsg, gr as streamCatalogCapability, j as DeclaredDevices, lr as snapshotCapability, ma as EventCategory, o as BaseDevice, q as MOTION_CLOSE_AFTER_MS, w as DERIVED_CAMERA_SILENCED_CAP_NAMES, wt as cameraGridLayoutCapability } from "../../dist-DV2ll9Hi.mjs";
+import { Bt as declarationOwnerNodeId, Et as cameraGridLayoutCapability, Gr as errMsg, Hr as DeviceFeature, Kr as BaseAddon, Ln as motionCapability, Mi as createEvent, Pn as memoizePinnedFfmpeg, Vi as hydrateSchema, Wr as DeviceType, br as streamCatalogCapability, j as DeclaredDevices, jr as buildFfmpegArgs, o as BaseDevice, pr as snapshotCapability, q as MOTION_CLOSE_AFTER_MS, va as EventCategory, w as DERIVED_CAMERA_SILENCED_CAP_NAMES } from "../../dist-7ZciHCIp.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
-const require_composition_sources = require("../../composition-sources-BQmhc3se.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
+const require_composition_sources = require("../../composition-sources-Cukc78eu.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { $t as evaluateCompositionField, Ar as composedDeviceStableId, Bn as planComposition, Br as DeviceType, Dt as composerCapability, Er as COMPOSER_ADDON_ID, Fr as createStatefulExpressionMemory, Hr as BaseAddon, Ir as disarmRoseMemory, Lr as toExpressionValue, Mr as compositionItemFieldPath, Nr as compositionSliceKey, Oi as createEvent, Or as cloneStatefulExpressionMemory, Ot as compositionFieldKey, Pr as compositionSourceKey, Vr as errMsg, f as COMPOSED_ITEM_FIXED_FIELDS, j as DeclaredDevices, jr as compositionFeatureEnabled, kr as composedDeviceRef, ma as EventCategory, nn as expressionContainsBuiltinCall, o as BaseDevice, r as ALL_CAPABILITY_DEFINITIONS, yt as buildCapabilityLookup } from "../../dist-DV2ll9Hi.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-DzuruDVY.mjs";
+import { Ar as COMPOSER_ADDON_ID, At as compositionFieldKey, Br as disarmRoseMemory, Fr as compositionFeatureEnabled, Gr as errMsg, Ir as compositionItemFieldPath, Kr as BaseAddon, Lr as compositionSliceKey, Mi as createEvent, Mr as cloneStatefulExpressionMemory, Nr as composedDeviceRef, Pr as composedDeviceStableId, Rr as compositionSourceKey, Vr as toExpressionValue, Wn as planComposition, Wr as DeviceType, f as COMPOSED_ITEM_FIXED_FIELDS, in as expressionContainsBuiltinCall, j as DeclaredDevices, kt as composerCapability, o as BaseDevice, r as ALL_CAPABILITY_DEFINITIONS, tn as evaluateCompositionField, va as EventCategory, xt as buildCapabilityLookup, zr as createStatefulExpressionMemory } from "../../dist-7ZciHCIp.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-bt6IQDLu.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Hr as BaseAddon, Tn as logDestinationCapability } from "../../dist-DV2ll9Hi.mjs";
+import { Kr as BaseAddon, kn as logDestinationCapability } from "../../dist-7ZciHCIp.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_composition_sources = require("../../composition-sources-BQmhc3se.js");
+const require_composition_sources = require("../../composition-sources-Cukc78eu.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");
 let zod = require("zod");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,6 +1,6 @@
-import { At as coreBlockAddonId, Bn as planComposition, Ei as collectSecretMarkerRefs, Hi as isSecretMarker, Hr as BaseAddon, Ht as describeComposableCaps, Li as hydrateSchema, Mi as defineRecordKinds, Mt as coreBlockIdFromAddonId, Nt as coreBlockSourceKind, Pn as normalizeCoreBlockWrite, Pr as compositionSourceKey, Pt as coreBlocksCapability, Vr as errMsg, Wi as isSecretRefOwnedBy, Xn as resolveCoreBlockEntry, Zn as resolveCoreBlockFiles, br as validateComposition, da as transformSecretWrite, h as CORE_BLOCK_ADDON_PREFIX, ia as resolveSecretMarkers, j as DeclaredDevices, jt as coreBlockComposition, kr as composedDeviceRef, kt as compositionSourceRefs, m as CORE_BLOCKS_ADDON_ID, p as COMPOSER_RUNNER_ID, qn as replacedFieldKeys, r as ALL_CAPABILITY_DEFINITIONS, sa as secretTreeFromSchema, v as CoreBlockSchema, yt as buildCapabilityLookup } from "../../dist-DV2ll9Hi.mjs";
+import { Ai as collectSecretMarkerRefs, Ft as coreBlockSourceKind, Gr as errMsg, Ii as defineRecordKinds, It as coreBlocksCapability, Ji as isSecretRefOwnedBy, Ki as isSecretMarker, Kr as BaseAddon, Mt as coreBlockAddonId, Nr as composedDeviceRef, Nt as coreBlockComposition, Pt as coreBlockIdFromAddonId, Rn as normalizeCoreBlockWrite, Rr as compositionSourceKey, Vi as hydrateSchema, Wn as planComposition, Wt as describeComposableCaps, Zn as replacedFieldKeys, ca as resolveSecretMarkers, da as secretTreeFromSchema, er as resolveCoreBlockEntry, h as CORE_BLOCK_ADDON_PREFIX, ha as transformSecretWrite, j as DeclaredDevices, jt as compositionSourceRefs, m as CORE_BLOCKS_ADDON_ID, p as COMPOSER_RUNNER_ID, r as ALL_CAPABILITY_DEFINITIONS, tr as resolveCoreBlockFiles, v as CoreBlockSchema, wr as validateComposition, xt as buildCapabilityLookup } from "../../dist-7ZciHCIp.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-DzuruDVY.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-bt6IQDLu.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { n as unwrapStoredValue, t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/device-history/device-history.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 //#region src/builtins/device-history/store/series-registry.ts
 function subjectIdOf(subject) {
 	return subject.kind === "device" ? `d:${subject.deviceId}` : `n:${subject.nodeId}`;

package/dist/builtins/device-history/device-history.addon.mjs

@@ -1,4 +1,4 @@
-import { Br as DeviceType, Gt as deviceHistoryCapability, Hr as BaseAddon, L as HISTORY_CATALOG, Zr as HISTORY_DEFAULT_MIN_INTERVAL_MS, ma as EventCategory, mt as armRemovalReconcile, qt as deviceRemovalHookCapability } from "../../dist-DV2ll9Hi.mjs";
+import { Kr as BaseAddon, L as HISTORY_CATALOG, Wr as DeviceType, Yt as deviceRemovalHookCapability, gt as armRemovalReconcile, qt as deviceHistoryCapability, ti as HISTORY_DEFAULT_MIN_INTERVAL_MS, va as EventCategory } from "../../dist-7ZciHCIp.mjs";
 //#region src/builtins/device-history/store/series-registry.ts
 function subjectIdOf(subject) {
 	return subject.kind === "device" ? `d:${subject.deviceId}` : `n:${subject.nodeId}`;

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { Bi as isKeychainStoredField, Br as DeviceType, Bt as defineExtensionSlotProvider, C as DAY_NAMES, Di as collectZodSecretPaths, F as FieldClaimModeSchema, Fn as normalizeUnit, Ft as createDeviceExtensionProvider, Hi as isSecretMarker, Hr as BaseAddon, I as FieldClaimSchema, Jt as deviceStateCapability, K as MINUTES_PER_DAY, Kt as deviceManagerCapability, M as DeviceStatusSchema, Mi as defineRecordKinds, N as DeviceTombstoneSchema, Qt as enumerateSchemaFields, Ri as isDeviceConfigCap, Rn as parseStreamParamsFormPatch, Rr as DeviceFeature, St as buildStreamParamsConfigSchema, Tt as canonicalIconKey, Ui as isSecretMarkerLike, Vi as isSecretClear, Vr as errMsg, Wt as deviceExtensionCapability, Yt as deviceStatusCapability, Zt as enumerateItemArrayFields, bn as legacyAutoLinkIds, c as CAMERA_SWITCH_ORDER, ca as sleep$1, cr as siteZoneKey, da as transformSecretWrite, et as STREAM_PROFILE_META, fa as userError, hi as SECRET_CLEAR, ia as resolveSecretMarkers, ma as EventCategory, nr as runtimeStatePolicyFor, oa as secretTreeFromPaths, r as ALL_CAPABILITY_DEFINITIONS, sn as formatMinutes, tn as expandContainer, u as CAP_NAMES_WITH_STATUS, ua as toSecretFieldView, vi as WELL_KNOWN_TAB_MAP, wn as locationIconKey, zr as DeviceRole } from "../../dist-DV2ll9Hi.mjs";
+import { $t as enumerateItemArrayFields, C as DAY_NAMES, Dt as canonicalIconKey, F as FieldClaimModeSchema, Gi as isSecretClear, Gr as errMsg, Hi as isDeviceConfigCap, Hn as parseStreamParamsFormPatch, Hr as DeviceFeature, Ht as defineExtensionSlotProvider, I as FieldClaimSchema, Ii as defineRecordKinds, Jt as deviceManagerCapability, K as MINUTES_PER_DAY, Ki as isSecretMarker, Kr as BaseAddon, Kt as deviceExtensionCapability, Lt as createDeviceExtensionProvider, M as DeviceStatusSchema, N as DeviceTombstoneSchema, On as locationIconKey, Si as WELL_KNOWN_TAB_MAP, Ur as DeviceRole, Wi as isKeychainStoredField, Wr as DeviceType, Xt as deviceStateCapability, Zt as deviceStatusCapability, c as CAMERA_SWITCH_ORDER, ca as resolveSecretMarkers, en as enumerateSchemaFields, et as STREAM_PROFILE_META, fa as sleep$1, fr as siteZoneKey, ga as userError, ha as transformSecretWrite, ji as collectZodSecretPaths, ln as formatMinutes, ma as toSecretFieldView, or as runtimeStatePolicyFor, qi as isSecretMarkerLike, r as ALL_CAPABILITY_DEFINITIONS, rn as expandContainer, u as CAP_NAMES_WITH_STATUS, ua as secretTreeFromPaths, va as EventCategory, wn as legacyAutoLinkIds, wt as buildStreamParamsConfigSchema, yi as SECRET_CLEAR, zn as normalizeUnit } from "../../dist-7ZciHCIp.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Hr as BaseAddon, Tn as logDestinationCapability } from "../../dist-DV2ll9Hi.mjs";
+import { Kr as BaseAddon, kn as logDestinationCapability } from "../../dist-7ZciHCIp.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_device_ca = require("../../device-ca-75rt3U_U.js");
-const require_phase6_declare_gate = require("../../phase6-declare-gate-C6WqagkC.js");
-const require_constants = require("../../constants-BPWA-r-Y.js");
+const require_device_ca = require("../../device-ca-B3hUVfYk.js");
+const require_phase6_declare_gate = require("../../phase6-declare-gate-DwYAep7y.js");
+const require_constants = require("../../constants-DBGG6Zu5.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/keychain/index.mjs

@@ -1,8 +1,8 @@
-import { B as KEYCHAIN_RESET_TRIGGER_ACTOR, H as KeychainResetRecordSchema, Hr as BaseAddon, Ii as formatSecretScope, Mi as defineRecordKinds, Qi as parseSecretRef, V as KeychainAuditEntrySchema, Yi as normalizeSecretOwner, ma as EventCategory, vn as keychainAdminCapability, yn as keychainCapability } from "../../dist-DV2ll9Hi.mjs";
+import { $i as normalizeSecretOwner, B as KEYCHAIN_RESET_TRIGGER_ACTOR, Bi as formatSecretScope, Cn as keychainCapability, H as KeychainResetRecordSchema, Ii as defineRecordKinds, Kr as BaseAddon, Sn as keychainAdminCapability, V as KeychainAuditEntrySchema, na as parseSecretRef, va as EventCategory } from "../../dist-7ZciHCIp.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-D05nqNXE.mjs";
-import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-BJplW6tX.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants-gzGZbnwO.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-Utfvsx5x.mjs";
+import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-D-2LMw9o.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-DQcVrhVI.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Hr as BaseAddon, Oi as createEvent, Vr as errMsg, X as RecordingStatusSchema, Y as RECORDING_SOURCE_CAMSTACK_ADDON, ma as EventCategory } from "../../dist-DV2ll9Hi.mjs";
+import { Gr as errMsg, Kr as BaseAddon, Mi as createEvent, X as RecordingStatusSchema, Y as RECORDING_SOURCE_CAMSTACK_ADDON, va as EventCategory } from "../../dist-7ZciHCIp.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,12 +3,12 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-75rt3U_U.js");
-const require_phase6_declare_gate = require("../../phase6-declare-gate-C6WqagkC.js");
+const require_device_ca = require("../../device-ca-B3hUVfYk.js");
+const require_phase6_declare_gate = require("../../phase6-declare-gate-DwYAep7y.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,10 +1,10 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { E as DEVICE_NONCE_TTL_MS, Gi as makeSecretMarker, Hi as isSecretMarker, Hr as BaseAddon, Mi as defineRecordKinds, T as DEVICE_ENROLLMENT_TTL_MS, Ut as deviceCredentialsCapability, a as ApiKeyRecordSchema, bt as buildDeviceEnrollmentLink, ct as TokenScopeSchema, fa as userError, ht as authProviderCapability, lt as UserRecordSchema, on as formatDeviceRevoker, rt as SsoBridgeClaimsSchema, tt as ScopedTokenSchema, xt as buildDeviceSignatureMessage, yr as userManagementCapability } from "../../dist-DV2ll9Hi.mjs";
+import { Cr as userManagementCapability, Ct as buildDeviceSignatureMessage, E as DEVICE_NONCE_TTL_MS, Gt as deviceCredentialsCapability, Ii as defineRecordKinds, Ki as isSecretMarker, Kr as BaseAddon, St as buildDeviceEnrollmentLink, T as DEVICE_ENROLLMENT_TTL_MS, Yi as makeSecretMarker, _t as authProviderCapability, a as ApiKeyRecordSchema, cn as formatDeviceRevoker, ct as TokenScopeSchema, ga as userError, lt as UserRecordSchema, rt as SsoBridgeClaimsSchema, tt as ScopedTokenSchema } from "../../dist-7ZciHCIp.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-D05nqNXE.mjs";
-import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-BJplW6tX.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-Utfvsx5x.mjs";
+import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-D-2LMw9o.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-DAU1WttG.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-2FzLWfbD.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { Cn as localNetworkCapability, Et as checkRoleAddress, Hr as BaseAddon, J as NetworkTunnelStartedDataSchema, Jn as resolveAppConnections, Qn as resolveHubAddressRoles, R as HUB_MDNS_SERVICE_TYPE, l as CAMSTACK_APP_LINK_ORIGIN, ma as EventCategory, pn as isDefaultAppConnectionEndpoint, tr as resolveNotificationTapAddress, un as isAppLinkBase, xr as validateCustomAddress, z as HUB_MDNS_TXT_KEYS, zn as pickAppLinkHub } from "../../dist-DV2ll9Hi.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-BPOg2iyc.mjs";
+import { Dn as localNetworkCapability, J as NetworkTunnelStartedDataSchema, Kr as BaseAddon, Ot as checkRoleAddress, Qn as resolveAppConnections, R as HUB_MDNS_SERVICE_TYPE, Tr as validateCustomAddress, Un as pickAppLinkHub, _n as isDefaultAppConnectionEndpoint, ar as resolveNotificationTapAddress, l as CAMSTACK_APP_LINK_ORIGIN, mn as isAppLinkBase, nr as resolveHubAddressRoles, va as EventCategory, z as HUB_MDNS_TXT_KEYS } from "../../dist-7ZciHCIp.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-BRs3DUT-.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Hr as BaseAddon, Tn as logDestinationCapability } from "../../dist-DV2ll9Hi.mjs";
+import { Kr as BaseAddon, kn as logDestinationCapability } from "../../dist-7ZciHCIp.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 let node_fs_promises = require("node:fs/promises");
 let node_util = require("node:util");
 let node_os = require("node:os");
@@ -1045,6 +1045,11 @@ function nodeMetricsHistoryClient(api) {
 		}
 	};
 }
+function refusalCounts(result) {
+	const counts = {};
+	for (const r of result.refused) counts[r.reason] = (counts[r.reason] ?? 0) + r.count;
+	return counts;
+}
 var NodeMetricsHistoryRecorder = class {
 	deps;
 	declared = false;
@@ -1118,7 +1123,15 @@ var NodeMetricsHistoryRecorder = class {
 		});
 		if (points.length === 0) return;
 		try {
-			await this.deps.deviceHistory.record({ points });
+			const result = await this.deps.deviceHistory.record({ points });
+			if (result.refused.length > 0) {
+				if (result.refused.some((r) => r.reason === "undeclared")) this.declared = false;
+				this.deps.logger.warn("node metrics history points refused", { meta: {
+					nodeId,
+					accepted: result.accepted,
+					refused: refusalCounts(result)
+				} });
+			}
 		} catch (err) {
 			this.deps.logger.warn("node metrics history sample not stored", { meta: {
 				nodeId,

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Hr as BaseAddon, Kn as reducePoints, Oi as createEvent, Vr as errMsg, Yn as resolveBucketMs, an as foldSnapshotByFunction, jn as metricsProviderCapability, ma as EventCategory } from "../../dist-DV2ll9Hi.mjs";
+import { $n as resolveBucketMs, Fn as metricsProviderCapability, Gr as errMsg, Kr as BaseAddon, Mi as createEvent, Xn as reducePoints, sn as foldSnapshotByFunction, va as EventCategory } from "../../dist-7ZciHCIp.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";
@@ -1040,6 +1040,11 @@ function nodeMetricsHistoryClient(api) {
 		}
 	};
 }
+function refusalCounts(result) {
+	const counts = {};
+	for (const r of result.refused) counts[r.reason] = (counts[r.reason] ?? 0) + r.count;
+	return counts;
+}
 var NodeMetricsHistoryRecorder = class {
 	deps;
 	declared = false;
@@ -1113,7 +1118,15 @@ var NodeMetricsHistoryRecorder = class {
 		});
 		if (points.length === 0) return;
 		try {
-			await this.deps.deviceHistory.record({ points });
+			const result = await this.deps.deviceHistory.record({ points });
+			if (result.refused.length > 0) {
+				if (result.refused.some((r) => r.reason === "undeclared")) this.declared = false;
+				this.deps.logger.warn("node metrics history points refused", { meta: {
+					nodeId,
+					accepted: result.accepted,
+					refused: refusalCounts(result)
+				} });
+			}
 		} catch (err) {
 			this.deps.logger.warn("node metrics history sample not stored", { meta: {
 				nodeId,

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 let node_util = require("node:util");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { Hr as BaseAddon, Pi as emitReadiness, Vn as platformProbeCapability, Vr as errMsg, Xt as enumerateInferenceDevices, ar as scoreRuntimes, ma as EventCategory } from "../../dist-DV2ll9Hi.mjs";
+import { Gn as platformProbeCapability, Gr as errMsg, Kr as BaseAddon, Qt as enumerateInferenceDevices, Ri as emitReadiness, lr as scoreRuntimes, va as EventCategory } from "../../dist-7ZciHCIp.mjs";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";
 import * as fs from "node:fs";

package/dist/builtins/record-entries/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 //#region src/builtins/record-entries/entries-service.ts
@@ -23,6 +23,26 @@ var ENTRIES_LIST_MAX = 2e3;
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/**
+* A stored secret, as an entries read shows it: a VIEW naming the row's own
+* keychain ref (`set: true`), never the value and no longer the bare redaction
+* token. The form hands it to the secret field, which reveals the value by
+* ref through the audited `keychain-admin.reveal`; sent back untouched it
+* keeps the stored secret (the records door reads a view as KEEP).
+*/
+function secretViewsOf(owner, kind, id, info, data) {
+	const decl = info.declaration;
+	if (decl.secretPaths.length === 0) return data;
+	const shown = require_dist.mapSecretLeaves(data, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+		if (leaf.value !== "__camstack_redacted__") return leaf.value;
+		return {
+			$secret: require_dist.recordSecretRef(owner, kind, id, leaf.concrete),
+			v: 1,
+			set: true
+		};
+	});
+	return isRecord(shown) ? shown : data;
+}
 var EntriesService = class {
 	deps;
 	constructor(deps) {
@@ -77,7 +97,7 @@ var EntriesService = class {
 					name: typeof name === "string" ? name : row.id,
 					rev: row.rev,
 					updatedAt: row.updatedAt,
-					data: row.data
+					data: secretViewsOf(input.owner, input.kind, row.id, info, row.data)
 				});
 			}
 			cursor = page.nextCursor ?? void 0;

package/dist/builtins/record-entries/index.mjs

@@ -1,4 +1,4 @@
-import { Hr as BaseAddon, Qr as InvalidRecordError, Wn as recordEntriesCapability, _i as UnknownRecordKindError } from "../../dist-DV2ll9Hi.mjs";
+import { Jn as recordEntriesCapability, Kr as BaseAddon, Xi as mapSecretLeaves, ni as InvalidRecordError, oa as recordSecretRef, xi as UnknownRecordKindError } from "../../dist-7ZciHCIp.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 //#region src/builtins/record-entries/entries-service.ts
@@ -18,6 +18,26 @@ var ENTRIES_LIST_MAX = 2e3;
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/**
+* A stored secret, as an entries read shows it: a VIEW naming the row's own
+* keychain ref (`set: true`), never the value and no longer the bare redaction
+* token. The form hands it to the secret field, which reveals the value by
+* ref through the audited `keychain-admin.reveal`; sent back untouched it
+* keeps the stored secret (the records door reads a view as KEEP).
+*/
+function secretViewsOf(owner, kind, id, info, data) {
+	const decl = info.declaration;
+	if (decl.secretPaths.length === 0) return data;
+	const shown = mapSecretLeaves(data, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+		if (leaf.value !== "__camstack_redacted__") return leaf.value;
+		return {
+			$secret: recordSecretRef(owner, kind, id, leaf.concrete),
+			v: 1,
+			set: true
+		};
+	});
+	return isRecord(shown) ? shown : data;
+}
 var EntriesService = class {
 	deps;
 	constructor(deps) {
@@ -72,7 +92,7 @@ var EntriesService = class {
 					name: typeof name === "string" ? name : row.id,
 					rev: row.rev,
 					updatedAt: row.updatedAt,
-					data: row.data
+					data: secretViewsOf(input.owner, input.kind, row.id, info, row.data)
 				});
 			}
 			cursor = page.nextCursor ?? void 0;

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Hr as BaseAddon, ma as EventCategory } from "../../dist-DV2ll9Hi.mjs";
+import { Kr as BaseAddon, va as EventCategory } from "../../dist-7ZciHCIp.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");