@camstack/system 1.2.454 → 1.2.455

package/dist/{dist-7ZciHCIp.mjs → dist-BpSENkRJ.mjs}

@@ -3257,6 +3257,12 @@ function normalizeAddonInitResult(result) {
 * core proxy and the kernel listener) to keep both off a kernel↔core import.
 */
 var DATAPLANE_SECRET_HEADER = "x-camstack-dataplane-secret";
+/**
+* The share-view scope kinds a `csv_*` share token can carry. The hub mints
+* and validates them (`share-token.service.ts` builds its enum from this
+* list); a data plane names the kinds it ACCEPTS in `share`.
+*/
+var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
 /** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
 var PeerBytesTicketSchema = z.object({
 	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
@@ -10392,6 +10398,235 @@ function scopesAllowDeviceCap(scopes, access) {
 function scopesAllowAddon(scopes, addonId, access) {
 	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
 }
+/**
+* Zod schemas for persisted record types.
+*
+* These schemas serve as the single source of truth for types that are
+* stored in the settings-store backend and retrieved via tRPC. They
+* replace the manual TypeScript interfaces with schema-derived types,
+* enabling runtime validation when reading from the backend.
+*
+* Convention: each schema is named `<Type>Schema`, the inferred TS type
+* keeps the original name for backward compatibility.
+*/
+/**
+* Auth model (v2 — 2026-05-12 caps-only):
+*
+* Two principals:
+*   - `isAdmin: true`  — full bypass. Admin scope set is ignored.
+*   - `isAdmin: false` — every call gated by `scopes` (see TokenScope).
+*
+* No role enum. There used to be `viewer / agent / scoped` and earlier
+* `super_admin` — collapsed onto the single boolean because every
+* non-admin caller is governed by the same scope-check rules; the
+* distinction was only ever used to route role-specific procedures
+* which we no longer have. CLI / webhook integrations are `cst_*` tokens
+* with `isAdmin: false` + an explicit scope list.
+*/
+/** Per-method access flavour. Materialised on every cap method via codegen. */
+var MethodAccessSchema = z.enum([
+	"view",
+	"create",
+	"delete"
+]);
+/**
+* A single scope grant. Three forms — checked in matcher with OR
+* semantics; the first match decides whether the call passes:
+*
+*   - `category` — broadest. `target: 'device' | 'system'` selects every
+*     cap with the matching `scope` declaration. New caps inherit grants
+*     automatically — adding a device cap to the codebase makes it
+*     reachable to every user with `category:device [...]` without a
+*     re-grant. Use this for "family viewer" / "operator" tiers.
+*
+*   - `addon` — every cap that ships inside a given addon id. Niche;
+*     useful when an integration needs to interact with one specific
+*     addon's surface regardless of how many caps it exports.
+*
+*   - `capability` — the most precise form. Single cap name. Use for
+*     integration tokens where you want to grant `addons.installPackage`
+*     and nothing else.
+*
+* `access` is REQUIRED with min 1 element. `admin` bypass is the
+* "give me everything" escape; there is no wildcard scope.
+*/
+var AllowedProviderSchema = z.union([z.literal("*"), z.array(z.string())]);
+var AllowedDevicesSchema = z.record(z.string(), z.union([z.literal("*"), z.array(z.string())]));
+var CapScopeSchema = z.enum(["device", "system"]);
+/**
+* DeviceSelector (scope model v3 — 2026-08-12).
+*
+* A `device` grant no longer carries a frozen list of deviceIds. It carries
+* a SELECTOR the matcher resolves against the live fleet, so the grant can be
+* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
+* AFTER the grant was minted — no re-grant, no re-login.
+*
+*   - `all`       — every device in the deployment. The broad viewer/operator
+*     lever without a `category` grant (a `category` grant also covers device
+*     caps that carry no deviceId; `all` is specifically the device set).
+*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
+*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
+*     is NOT covered until the grant is edited.
+*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
+*     DYNAMIC. A device that changes type, or a new device of the type,
+*     re-resolves on the next request.
+*   - `locations` — every device whose operator-assigned `location` label is
+*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
+*     null/unset location matches NO `locations` selector.
+*/
+var DeviceSelectorSchema = z.discriminatedUnion("kind", [
+	z.object({ kind: z.literal("all") }),
+	z.object({
+		kind: z.literal("ids"),
+		ids: z.array(z.number().int()).min(1)
+	}),
+	z.object({
+		kind: z.literal("types"),
+		types: z.array(z.enum(DeviceType)).min(1)
+	}),
+	z.object({
+		kind: z.literal("locations"),
+		locations: z.array(z.string().min(1)).min(1)
+	})
+]);
+var DeviceTokenScopeSchema = z.object({
+	type: z.literal("device"),
+	/** The device SET this grant covers — resolved against the live fleet. */
+	selector: DeviceSelectorSchema,
+	access: z.array(MethodAccessSchema).min(1),
+	/**
+	* Whether a grant on a PARENT device transparently covers its accessory
+	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
+	* Direction is parent → children ONLY.
+	*
+	* Absent → the matcher DERIVES it from the access flavour: `view`
+	* inherits (a camera viewer sees the camera's accessories), `create` /
+	* `delete` do NOT (actuating/removing a child is an explicit act the
+	* operator must grant on the child, not inherit from the parent). Set it
+	* explicitly to override that default per grant.
+	*/
+	includeLinked: z.boolean().optional()
+});
+/**
+* v2 → v3 lazy migration. A pre-v3 `device` grant carried
+* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
+* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
+* EVERY parse path — stored records AND the JWT-carried scope arrays
+* normalised at the request boundary ({@link normalizeTokenScopes} in
+* `device-selector.ts`). Chosen over a one-time DB migration because a
+* migration cannot reach a JWT already in a client's hands; parse-time
+* migration covers both without a flag day. No cast — the raw object is read
+* through `Reflect.get` (its static type is `unknown`).
+*/
+function migrateLegacyTokenScope(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
+	if (Reflect.get(raw, "type") !== "device") return raw;
+	if (Reflect.get(raw, "selector") !== void 0) return raw;
+	const targets = Reflect.get(raw, "targets");
+	if (!Array.isArray(targets)) return raw;
+	return {
+		type: "device",
+		selector: {
+			kind: "ids",
+			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
+		},
+		access: Reflect.get(raw, "access")
+	};
+}
+var TokenScopeSchema = z.preprocess(migrateLegacyTokenScope, z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("category"),
+		target: CapScopeSchema,
+		access: z.array(MethodAccessSchema).min(1)
+	}),
+	z.object({
+		type: z.literal("capability"),
+		target: z.string(),
+		access: z.array(MethodAccessSchema).min(1)
+	}),
+	z.object({
+		type: z.literal("addon"),
+		target: z.string(),
+		access: z.array(MethodAccessSchema).min(1)
+	}),
+	DeviceTokenScopeSchema
+]));
+var UserRecordSchema = z.object({
+	id: z.string(),
+	username: z.string(),
+	passwordHash: z.string(),
+	/**
+	* Admin bypass. When true, the middleware skips the scope-access
+	* check entirely. There is no other axis of privilege; the legacy
+	* role enum collapsed onto this boolean in v2.
+	*/
+	isAdmin: z.boolean().default(false),
+	allowedProviders: AllowedProviderSchema,
+	allowedDevices: AllowedDevicesSchema,
+	/**
+	* Scopes granted to this user. Admins bypass; their `scopes` is
+	* ignored. Non-admins without scopes are locked out of every
+	* protected call.
+	*/
+	scopes: z.array(TokenScopeSchema).default([]),
+	createdAt: z.number(),
+	updatedAt: z.number()
+});
+var ApiKeyRecordSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	isAdmin: z.boolean().default(false),
+	allowedProviders: AllowedProviderSchema,
+	allowedDevices: AllowedDevicesSchema,
+	tokenHash: z.string(),
+	tokenPrefix: z.string(),
+	createdAt: z.number(),
+	lastUsedAt: z.number().optional()
+});
+var ScopedTokenSchema = z.object({
+	id: z.string(),
+	userId: z.string(),
+	name: z.string(),
+	tokenHash: z.string(),
+	tokenPrefix: z.string(),
+	scopes: z.array(TokenScopeSchema),
+	expiresAt: z.number().nullish(),
+	lastUsedAt: z.number().nullish(),
+	createdAt: z.number()
+});
+/** What a share-view grant lets its holder see. */
+var ShareViewGrantSchema = z.object({
+	kind: z.enum(SHARE_VIEW_KINDS),
+	deviceIds: z.array(z.number().int().nonnegative()).min(1).max(64),
+	/** Talk-back, opt-in at mint time; absent means off. */
+	talk: z.boolean().optional()
+});
+var ShareViewScopeSchema = z.object({
+	type: z.literal("share-view"),
+	grant: ShareViewGrantSchema
+});
+var AddonRoutesScopeSchema = z.object({
+	type: z.literal("addon-routes"),
+	access: z.array(MethodAccessSchema).min(1)
+});
+var CredentialScopeSchema = z.union([
+	z.literal("*"),
+	ShareViewScopeSchema,
+	AddonRoutesScopeSchema,
+	TokenScopeSchema
+]);
+/**
+* The claims of a unified token (`auth.mintToken`). It carries no `exp`: its
+* row (looked up by `jti` on every verify, for revocation) holds the ONE
+* expiry, so a share link can be extended and a JWT clock can never disagree
+* with the row.
+*/
+var CredentialTokenClaimsSchema = z.object({
+	kind: z.literal("credential"),
+	sub: z.string().min(1),
+	jti: z.string().min(16),
+	scopes: z.array(CredentialScopeSchema).min(1)
+});
 z.enum(["new-session", "step-up"]);
 /** The languages the hub's app landing pages are written in (D858). */
 var AppPageLangSchema = z.enum(["en", "it"]);
@@ -46812,202 +47047,6 @@ var notificationRulesCapability = {
 	}
 };
 /**
-* Zod schemas for persisted record types.
-*
-* These schemas serve as the single source of truth for types that are
-* stored in the settings-store backend and retrieved via tRPC. They
-* replace the manual TypeScript interfaces with schema-derived types,
-* enabling runtime validation when reading from the backend.
-*
-* Convention: each schema is named `<Type>Schema`, the inferred TS type
-* keeps the original name for backward compatibility.
-*/
-/**
-* Auth model (v2 — 2026-05-12 caps-only):
-*
-* Two principals:
-*   - `isAdmin: true`  — full bypass. Admin scope set is ignored.
-*   - `isAdmin: false` — every call gated by `scopes` (see TokenScope).
-*
-* No role enum. There used to be `viewer / agent / scoped` and earlier
-* `super_admin` — collapsed onto the single boolean because every
-* non-admin caller is governed by the same scope-check rules; the
-* distinction was only ever used to route role-specific procedures
-* which we no longer have. CLI / webhook integrations are `cst_*` tokens
-* with `isAdmin: false` + an explicit scope list.
-*/
-/** Per-method access flavour. Materialised on every cap method via codegen. */
-var MethodAccessSchema = z.enum([
-	"view",
-	"create",
-	"delete"
-]);
-/**
-* A single scope grant. Three forms — checked in matcher with OR
-* semantics; the first match decides whether the call passes:
-*
-*   - `category` — broadest. `target: 'device' | 'system'` selects every
-*     cap with the matching `scope` declaration. New caps inherit grants
-*     automatically — adding a device cap to the codebase makes it
-*     reachable to every user with `category:device [...]` without a
-*     re-grant. Use this for "family viewer" / "operator" tiers.
-*
-*   - `addon` — every cap that ships inside a given addon id. Niche;
-*     useful when an integration needs to interact with one specific
-*     addon's surface regardless of how many caps it exports.
-*
-*   - `capability` — the most precise form. Single cap name. Use for
-*     integration tokens where you want to grant `addons.installPackage`
-*     and nothing else.
-*
-* `access` is REQUIRED with min 1 element. `admin` bypass is the
-* "give me everything" escape; there is no wildcard scope.
-*/
-var AllowedProviderSchema = z.union([z.literal("*"), z.array(z.string())]);
-var AllowedDevicesSchema = z.record(z.string(), z.union([z.literal("*"), z.array(z.string())]));
-var CapScopeSchema = z.enum(["device", "system"]);
-/**
-* DeviceSelector (scope model v3 — 2026-08-12).
-*
-* A `device` grant no longer carries a frozen list of deviceIds. It carries
-* a SELECTOR the matcher resolves against the live fleet, so the grant can be
-* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
-* AFTER the grant was minted — no re-grant, no re-login.
-*
-*   - `all`       — every device in the deployment. The broad viewer/operator
-*     lever without a `category` grant (a `category` grant also covers device
-*     caps that carry no deviceId; `all` is specifically the device set).
-*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
-*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
-*     is NOT covered until the grant is edited.
-*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
-*     DYNAMIC. A device that changes type, or a new device of the type,
-*     re-resolves on the next request.
-*   - `locations` — every device whose operator-assigned `location` label is
-*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
-*     null/unset location matches NO `locations` selector.
-*/
-var DeviceSelectorSchema = z.discriminatedUnion("kind", [
-	z.object({ kind: z.literal("all") }),
-	z.object({
-		kind: z.literal("ids"),
-		ids: z.array(z.number().int()).min(1)
-	}),
-	z.object({
-		kind: z.literal("types"),
-		types: z.array(z.enum(DeviceType)).min(1)
-	}),
-	z.object({
-		kind: z.literal("locations"),
-		locations: z.array(z.string().min(1)).min(1)
-	})
-]);
-var DeviceTokenScopeSchema = z.object({
-	type: z.literal("device"),
-	/** The device SET this grant covers — resolved against the live fleet. */
-	selector: DeviceSelectorSchema,
-	access: z.array(MethodAccessSchema).min(1),
-	/**
-	* Whether a grant on a PARENT device transparently covers its accessory
-	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
-	* Direction is parent → children ONLY.
-	*
-	* Absent → the matcher DERIVES it from the access flavour: `view`
-	* inherits (a camera viewer sees the camera's accessories), `create` /
-	* `delete` do NOT (actuating/removing a child is an explicit act the
-	* operator must grant on the child, not inherit from the parent). Set it
-	* explicitly to override that default per grant.
-	*/
-	includeLinked: z.boolean().optional()
-});
-/**
-* v2 → v3 lazy migration. A pre-v3 `device` grant carried
-* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
-* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
-* EVERY parse path — stored records AND the JWT-carried scope arrays
-* normalised at the request boundary ({@link normalizeTokenScopes} in
-* `device-selector.ts`). Chosen over a one-time DB migration because a
-* migration cannot reach a JWT already in a client's hands; parse-time
-* migration covers both without a flag day. No cast — the raw object is read
-* through `Reflect.get` (its static type is `unknown`).
-*/
-function migrateLegacyTokenScope(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
-	if (Reflect.get(raw, "type") !== "device") return raw;
-	if (Reflect.get(raw, "selector") !== void 0) return raw;
-	const targets = Reflect.get(raw, "targets");
-	if (!Array.isArray(targets)) return raw;
-	return {
-		type: "device",
-		selector: {
-			kind: "ids",
-			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
-		},
-		access: Reflect.get(raw, "access")
-	};
-}
-var TokenScopeSchema = z.preprocess(migrateLegacyTokenScope, z.discriminatedUnion("type", [
-	z.object({
-		type: z.literal("category"),
-		target: CapScopeSchema,
-		access: z.array(MethodAccessSchema).min(1)
-	}),
-	z.object({
-		type: z.literal("capability"),
-		target: z.string(),
-		access: z.array(MethodAccessSchema).min(1)
-	}),
-	z.object({
-		type: z.literal("addon"),
-		target: z.string(),
-		access: z.array(MethodAccessSchema).min(1)
-	}),
-	DeviceTokenScopeSchema
-]));
-var UserRecordSchema = z.object({
-	id: z.string(),
-	username: z.string(),
-	passwordHash: z.string(),
-	/**
-	* Admin bypass. When true, the middleware skips the scope-access
-	* check entirely. There is no other axis of privilege; the legacy
-	* role enum collapsed onto this boolean in v2.
-	*/
-	isAdmin: z.boolean().default(false),
-	allowedProviders: AllowedProviderSchema,
-	allowedDevices: AllowedDevicesSchema,
-	/**
-	* Scopes granted to this user. Admins bypass; their `scopes` is
-	* ignored. Non-admins without scopes are locked out of every
-	* protected call.
-	*/
-	scopes: z.array(TokenScopeSchema).default([]),
-	createdAt: z.number(),
-	updatedAt: z.number()
-});
-var ApiKeyRecordSchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	isAdmin: z.boolean().default(false),
-	allowedProviders: AllowedProviderSchema,
-	allowedDevices: AllowedDevicesSchema,
-	tokenHash: z.string(),
-	tokenPrefix: z.string(),
-	createdAt: z.number(),
-	lastUsedAt: z.number().optional()
-});
-var ScopedTokenSchema = z.object({
-	id: z.string(),
-	userId: z.string(),
-	name: z.string(),
-	tokenHash: z.string(),
-	tokenPrefix: z.string(),
-	scopes: z.array(TokenScopeSchema),
-	expiresAt: z.number().nullish(),
-	lastUsedAt: z.number().nullish(),
-	createdAt: z.number()
-});
-/**
 * `oauth-integration` — a collection cap by which an addon declares
 * itself a linkable OAuth client of the hub's core `/oauth2/*` server.
 * Each provider returns a static descriptor; the core enumerates them
@@ -88324,4 +88363,4 @@ function armRemovalReconcile(opts) {
 	return () => clearInterval(timer);
 }
 //#endregion
-export { STORAGE_ADMIN_SCOPED_BASES as $, normalizeSecretOwner as $i, resolveBucketMs as $n, FilterRequiredError as $r, enumerateItemArrayFields as $t, DataStoreDatabaseSchema as A, collectSecretMarkerRefs as Ai, logLevelAtMost as An, COMPOSER_ADDON_ID as Ar, compositionFieldKey as At, KEYCHAIN_RESET_TRIGGER_ACTOR as B, formatSecretScope as Bi, objectInputDeclaresAddonId as Bn, disarmRoseMemory as Br, declarationOwnerNodeId as Bt, DAY_NAMES as C, asJsonObject as Ci, keychainCapability as Cn, userManagementCapability as Cr, buildDeviceSignatureMessage as Ct, DEVICE_SAN_CREDENTIAL_PREFIX as D, buildSecretRef as Di, localNetworkCapability as Dn, vectorIndexDimConflictError as Dr, canonicalIconKey as Dt, DEVICE_NONCE_TTL_MS as E, assertValidDeclaration as Ei, lifecycleJobSchema as En, vectorDimFromBase64 as Er, cameraGridLayoutCapability as Et, FieldClaimModeSchema as F, defineCustomActions as Fi, metricsProviderCapability as Fn, compositionFeatureEnabled as Fr, coreBlockSourceKind as Ft, METHOD_ACCESS_MAP as G, isSecretClear as Gi, platformProbeCapability as Gn, errMsg as Gr, deviceCredentialsCapability as Gt, KeychainResetRecordSchema as H, isDeviceConfigCap as Hi, parseStreamParamsFormPatch as Hn, DeviceFeature as Hr, defineExtensionSlotProvider as Ht, FieldClaimSchema as I, defineRecordKinds as Ii, modeMayWrite as In, compositionItemFieldPath as Ir, coreBlocksCapability as It, NetworkTunnelStartedDataSchema as J, isSecretRefOwnedBy as Ji, recordEntriesCapability as Jn, CALLER_STAMPED_CAPABILITIES as Jr, deviceManagerCapability as Jt, MINUTES_PER_DAY as K, isSecretMarker as Ki, procedureAuthKey as Kn, BaseAddon as Kr, deviceExtensionCapability as Kt, HISTORY_CATALOG as L, emitDownForOwnedCaps as Li, motionCapability as Ln, compositionSliceKey as Lr, createDeviceExtensionProvider as Lt, DeviceStatusSchema as M, createEvent as Mi, mayReadLocation as Mn, cloneStatefulExpressionMemory as Mr, coreBlockAddonId as Mt, DeviceTombstoneSchema as N, customAction as Ni, mayWriteToLocation as Nn, composedDeviceRef as Nr, coreBlockComposition as Nt, DEVICE_SAN_USER_PREFIX as O, collectSecretConfigKeys as Oi, locationIconKey as On, vectorStoreCapability as Or, checkRoleAddress as Ot, FIRST_LEVEL_MACRO_CLASSES as P, declarationsOf as Pi, memoizePinnedFfmpeg as Pn, composedDeviceStableId as Pr, coreBlockIdFromAddonId as Pt, STORAGE_ADMIN_MOVED_COLLECTIONS as Q, normalizeNodeId as Qi, resolveAppConnections as Qn, DeclarationRefusedError as Qr, enumerateInferenceDevices as Qt, HUB_MDNS_SERVICE_TYPE as R, emitReadiness as Ri, normalizeCoreBlockWrite as Rn, compositionSourceKey as Rr, dataStoreProviderCapability as Rt, DATA_STORE_DATABASES as S, WELL_KNOWN_TAB_MAP as Si, keychainAdminCapability as Sn, supportedRuntimes as Sr, buildDeviceEnrollmentLink as St, DEVICE_ENROLLMENT_TTL_MS as T, asString$1 as Ti, legacyModeOf as Tn, validateCustomAddress as Tr, calendarsCapability as Tt, LOG_LEVEL_RANK as U, isEvent as Ui, pickAppLinkHub as Un, DeviceRole as Ur, deriveBatteryPresence as Ut, KeychainAuditEntrySchema as V, hydrateSchema as Vi, objectInputDeclaresRequiredDeviceId as Vn, toExpressionValue as Vr, decodeVectorBase64 as Vt, LegacyStorageLocationDefaultSchema as W, isKeychainStoredField as Wi, planComposition as Wn, DeviceType as Wr, describeComposableCaps as Wt, RecordingStatusSchema as X, mapSecretLeaves as Xi, reducePoints as Xn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Xr, deviceStateCapability as Xt, RECORDING_SOURCE_CAMSTACK_ADDON as Y, makeSecretMarker as Yi, recordsCapability as Yn, DATAPLANE_SECRET_HEADER as Yr, deviceRemovalHookCapability as Yt, STORAGE_ACCESS_FALLBACK as Z, nodePin as Zi, replacedFieldKeys as Zn, DEVICE_STATUS_METHOD as Zr, deviceStatusCapability as Zt, CatalogFileSchema as _, withoutCallerStamp as _a, RecordUniqueViolationError as _i, isDefaultAppConnectionEndpoint as _n, storageMigrationCapability as _r, authProviderCapability as _t, ApiKeyRecordSchema as a, readinessKey as aa, RECORD_BATCH_MAX as ai, extractNestedAddonId as an, resolveNotificationTapAddress as ar, StorageLocationModeSchema as at, DATABASE_SNAPSHOT_SUFFIX as b, UnindexedFilterError as bi, isVoidInput as bn, streamCatalogCapability as br, batteryCapability as bt, CAMERA_SWITCH_ORDER as c, resolveSecretMarkers as ca, RECORD_SWEEP_INTERVAL_MS as ci, formatDeviceRevoker as cn, scopesAllowDeviceCap as cr, TokenScopeSchema as ct, CATALOG_LANGS as d, secretTreeFromSchema as da, RUNTIME_DEFAULTS as di, interpolate as dn, shortHostname as dr, addonSettingsCapability as dt, parseJsonObject as ea, ForeignSecretMarkerError as ei, enumerateSchemaFields as en, resolveCoreBlockEntry as er, STREAM_PROFILE_META as et, COMPOSED_ITEM_FIXED_FIELDS as f, sleep as fa, ReadinessRegistry as fi, isAlertEpisodeOpen as fn, siteZoneKey as fr, addonWidgetsCapability as ft, CalendarPreferencesSchema as g, userError as ga, RecordTooLargeError as gi, isCollectionArrayMethod as gn, storageCapability as gr, armRemovalReconcile as gt, CORE_BLOCK_ADDON_PREFIX as h, transformSecretWrite as ha, RecordNotFoundError as hi, isArrayOutputSchema as hn, storageAdminCapability as hr, alertsCapability as ht, AlertSchema as i, parseSettingsBrokersAdoptsFrom as ia, PlaintextSecretError as ii, expressionContainsBuiltinCall as in, resolveMethodAuth as ir, StorageCleanupJobSchema as it, DeclaredDevices as j, collectZodSecretPaths as ji, looseSchema as jn, buildFfmpegArgs as jr, compositionSourceRefs as jt, DEVICE_TOMBSTONE_RETENTION_MS as k, collectSecretLeaves as ki, logDestinationCapability as kn, withLocationMode as kr, composerCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, scopeKey as la, REDACTED_SECRET as li, formatMinutes as ln, scoreRuntimes as lr, UserRecordSchema as lt, CORE_BLOCKS_ADDON_ID as m, toSecretFieldView as ma, RecordKindDeclarationSchema as mi, isAppLinkBase as mn, splitTranslationRef as mr, alertEpisodePayload as mt, AGENT_MDNS_TXT_KEYS as n, parseSecretRef as na, InvalidRecordError as ni, evictionPolicyOfLocation as nn, resolveHubAddressRoles as nr, ServerNameSchema as nt, BaseDevice as o, recordSecretRef as oa, RECORD_BATCH_MAX_BYTES as oi, filesystemBrowseCapability as on, runtimeStatePolicyFor as or, StorageLocationTypeSchema as ot, COMPOSER_RUNNER_ID as p, toNodeId as pa, ReadinessTimeoutError as pi, isAlertEpisodeSeverity as pn, snapshotCapability as pr, alertEpisodeId as pt, MOTION_CLOSE_AFTER_MS as q, isSecretMarkerLike as qi, ptzAutotrackCapability as qn, BatchTooLargeError as qr, deviceHistoryCapability as qt, ALL_CAPABILITY_DEFINITIONS as r, parseSettingsArrayAdoptsFrom as ra, NoCallerError as ri, expandContainer as rn, resolveLocationMode as rr, SsoBridgeClaimsSchema as rt, BatteryStatusSchema as s, resolveCapMount as sa, RECORD_DELETE_BATCH as si, foldSnapshotByFunction as sn, scopesAllowAddon as sr, StorageMigrationJobSchema as st, AGENT_MDNS_SERVICE_TYPE as t, parseJsonUnknown as ta, HISTORY_DEFAULT_MIN_INTERVAL_MS as ti, evaluateCompositionField as tn, resolveCoreBlockFiles as tr, ScopedTokenSchema as tt, CAP_NAMES_WITH_STATUS as u, secretTreeFromPaths as ua, REMOVE_LEAF as ui, gbToBytes as un, settingsStoreCapability as ur, addonPagesCapability as ut, CoreBlockSchema as v, EventCategory as va, RevConflictError as vi, isLocationEnabled as vn, storageOccupancyCapability as vr, backupCapability as vt, DERIVED_CAMERA_SILENCED_CAP_NAMES as w, asNumber as wi, legacyAutoLinkIds as wn, validateComposition as wr, buildStreamParamsConfigSchema as wt, DATABASE_SNAPSHOT_TIMEOUT_MS as x, UnknownRecordKindError as xi, kebabToCamel as xn, streamQualityLabel as xr, buildCapabilityLookup as xt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as y, SECRET_CLEAR as yi, isObjectInput as yn, storageProviderCapability as yr, bareAddonId as yt, HUB_MDNS_TXT_KEYS as z, expandCapMethods as zi, normalizeUnit as zn, createStatefulExpressionMemory as zr, databaseSnapshotCapability as zt };
+export { STORAGE_ADMIN_MOVED_COLLECTIONS as $, normalizeNodeId as $i, resolveAppConnections as $n, DeclarationRefusedError as $r, enumerateInferenceDevices as $t, DEVICE_TOMBSTONE_RETENTION_MS as A, collectSecretLeaves as Ai, logDestinationCapability as An, withLocationMode as Ar, composerCapability as At, HUB_MDNS_TXT_KEYS as B, expandCapMethods as Bi, normalizeUnit as Bn, createStatefulExpressionMemory as Br, databaseSnapshotCapability as Bt, DATA_STORE_DATABASES as C, WELL_KNOWN_TAB_MAP as Ci, keychainAdminCapability as Cn, supportedRuntimes as Cr, buildDeviceEnrollmentLink as Ct, DEVICE_NONCE_TTL_MS as D, assertValidDeclaration as Di, lifecycleJobSchema as Dn, vectorDimFromBase64 as Dr, cameraGridLayoutCapability as Dt, DEVICE_ENROLLMENT_TTL_MS as E, asString$1 as Ei, legacyModeOf as En, validateCustomAddress as Er, calendarsCapability as Et, FIRST_LEVEL_MACRO_CLASSES as F, declarationsOf as Fi, memoizePinnedFfmpeg as Fn, composedDeviceStableId as Fr, coreBlockIdFromAddonId as Ft, LegacyStorageLocationDefaultSchema as G, isKeychainStoredField as Gi, planComposition as Gn, DeviceType as Gr, describeComposableCaps as Gt, KeychainAuditEntrySchema as H, hydrateSchema as Hi, objectInputDeclaresRequiredDeviceId as Hn, toExpressionValue as Hr, decodeVectorBase64 as Ht, FieldClaimModeSchema as I, defineCustomActions as Ii, metricsProviderCapability as In, compositionFeatureEnabled as Ir, coreBlockSourceKind as It, MOTION_CLOSE_AFTER_MS as J, isSecretMarkerLike as Ji, ptzAutotrackCapability as Jn, BatchTooLargeError as Jr, deviceHistoryCapability as Jt, METHOD_ACCESS_MAP as K, isSecretClear as Ki, platformProbeCapability as Kn, errMsg as Kr, deviceCredentialsCapability as Kt, FieldClaimSchema as L, defineRecordKinds as Li, modeMayWrite as Ln, compositionItemFieldPath as Lr, coreBlocksCapability as Lt, DeclaredDevices as M, collectZodSecretPaths as Mi, looseSchema as Mn, buildFfmpegArgs as Mr, compositionSourceRefs as Mt, DeviceStatusSchema as N, createEvent as Ni, mayReadLocation as Nn, cloneStatefulExpressionMemory as Nr, coreBlockAddonId as Nt, DEVICE_SAN_CREDENTIAL_PREFIX as O, buildSecretRef as Oi, localNetworkCapability as On, vectorIndexDimConflictError as Or, canonicalIconKey as Ot, DeviceTombstoneSchema as P, customAction as Pi, mayWriteToLocation as Pn, composedDeviceRef as Pr, coreBlockComposition as Pt, STORAGE_ACCESS_FALLBACK as Q, nodePin as Qi, replacedFieldKeys as Qn, DEVICE_STATUS_METHOD as Qr, deviceStatusCapability as Qt, HISTORY_CATALOG as R, emitDownForOwnedCaps as Ri, motionCapability as Rn, compositionSliceKey as Rr, createDeviceExtensionProvider as Rt, DATABASE_SNAPSHOT_TIMEOUT_MS as S, UnknownRecordKindError as Si, kebabToCamel as Sn, streamQualityLabel as Sr, buildCapabilityLookup as St, DERIVED_CAMERA_SILENCED_CAP_NAMES as T, asNumber as Ti, legacyAutoLinkIds as Tn, validateComposition as Tr, buildStreamParamsConfigSchema as Tt, KeychainResetRecordSchema as U, isDeviceConfigCap as Ui, parseStreamParamsFormPatch as Un, DeviceFeature as Ur, defineExtensionSlotProvider as Ut, KEYCHAIN_RESET_TRIGGER_ACTOR as V, formatSecretScope as Vi, objectInputDeclaresAddonId as Vn, disarmRoseMemory as Vr, declarationOwnerNodeId as Vt, LOG_LEVEL_RANK as W, isEvent as Wi, pickAppLinkHub as Wn, DeviceRole as Wr, deriveBatteryPresence as Wt, RECORDING_SOURCE_CAMSTACK_ADDON as X, makeSecretMarker as Xi, recordsCapability as Xn, DATAPLANE_SECRET_HEADER as Xr, deviceRemovalHookCapability as Xt, NetworkTunnelStartedDataSchema as Y, isSecretRefOwnedBy as Yi, recordEntriesCapability as Yn, CALLER_STAMPED_CAPABILITIES as Yr, deviceManagerCapability as Yt, RecordingStatusSchema as Z, mapSecretLeaves as Zi, reducePoints as Zn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Zr, deviceStateCapability as Zt, CatalogFileSchema as _, userError as _a, RecordTooLargeError as _i, isCollectionArrayMethod as _n, storageCapability as _r, armRemovalReconcile as _t, ApiKeyRecordSchema as a, parseSettingsBrokersAdoptsFrom as aa, PlaintextSecretError as ai, expressionContainsBuiltinCall as an, resolveMethodAuth as ar, StorageCleanupJobSchema as at, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as b, SECRET_CLEAR as bi, isObjectInput as bn, storageProviderCapability as br, bareAddonId as bt, CAMERA_SWITCH_ORDER as c, resolveCapMount as ca, RECORD_DELETE_BATCH as ci, foldSnapshotByFunction as cn, scopesAllowAddon as cr, StorageMigrationJobSchema as ct, CATALOG_LANGS as d, secretTreeFromPaths as da, REMOVE_LEAF as di, gbToBytes as dn, settingsStoreCapability as dr, addonPagesCapability as dt, normalizeSecretOwner as ea, FilterRequiredError as ei, enumerateItemArrayFields as en, resolveBucketMs as er, STORAGE_ADMIN_SCOPED_BASES as et, COMPOSED_ITEM_FIXED_FIELDS as f, secretTreeFromSchema as fa, RUNTIME_DEFAULTS as fi, interpolate as fn, shortHostname as fr, addonSettingsCapability as ft, CalendarPreferencesSchema as g, transformSecretWrite as ga, RecordNotFoundError as gi, isArrayOutputSchema as gn, storageAdminCapability as gr, alertsCapability as gt, CORE_BLOCK_ADDON_PREFIX as h, toSecretFieldView as ha, RecordKindDeclarationSchema as hi, isAppLinkBase as hn, splitTranslationRef as hr, alertEpisodePayload as ht, AlertSchema as i, parseSettingsArrayAdoptsFrom as ia, NoCallerError as ii, expandContainer as in, resolveLocationMode as ir, SsoBridgeClaimsSchema as it, DataStoreDatabaseSchema as j, collectSecretMarkerRefs as ji, logLevelAtMost as jn, COMPOSER_ADDON_ID as jr, compositionFieldKey as jt, DEVICE_SAN_USER_PREFIX as k, collectSecretConfigKeys as ki, locationIconKey as kn, vectorStoreCapability as kr, checkRoleAddress as kt, CAMSTACK_APP_LINK_ORIGIN as l, resolveSecretMarkers as la, RECORD_SWEEP_INTERVAL_MS as li, formatDeviceRevoker as ln, scopesAllowDeviceCap as lr, TokenScopeSchema as lt, CORE_BLOCKS_ADDON_ID as m, toNodeId as ma, ReadinessTimeoutError as mi, isAlertEpisodeSeverity as mn, snapshotCapability as mr, alertEpisodeId as mt, AGENT_MDNS_TXT_KEYS as n, parseJsonUnknown as na, HISTORY_DEFAULT_MIN_INTERVAL_MS as ni, evaluateCompositionField as nn, resolveCoreBlockFiles as nr, ScopedTokenSchema as nt, BaseDevice as o, readinessKey as oa, RECORD_BATCH_MAX as oi, extractNestedAddonId as on, resolveNotificationTapAddress as or, StorageLocationModeSchema as ot, COMPOSER_RUNNER_ID as p, sleep as pa, ReadinessRegistry as pi, isAlertEpisodeOpen as pn, siteZoneKey as pr, addonWidgetsCapability as pt, MINUTES_PER_DAY as q, isSecretMarker as qi, procedureAuthKey as qn, BaseAddon as qr, deviceExtensionCapability as qt, ALL_CAPABILITY_DEFINITIONS as r, parseSecretRef as ra, InvalidRecordError as ri, evictionPolicyOfLocation as rn, resolveHubAddressRoles as rr, ServerNameSchema as rt, BatteryStatusSchema as s, recordSecretRef as sa, RECORD_BATCH_MAX_BYTES as si, filesystemBrowseCapability as sn, runtimeStatePolicyFor as sr, StorageLocationTypeSchema as st, AGENT_MDNS_SERVICE_TYPE as t, parseJsonObject as ta, ForeignSecretMarkerError as ti, enumerateSchemaFields as tn, resolveCoreBlockEntry as tr, STREAM_PROFILE_META as tt, CAP_NAMES_WITH_STATUS as u, scopeKey as ua, REDACTED_SECRET as ui, formatMinutes as un, scoreRuntimes as ur, UserRecordSchema as ut, CoreBlockSchema as v, withoutCallerStamp as va, RecordUniqueViolationError as vi, isDefaultAppConnectionEndpoint as vn, storageMigrationCapability as vr, authProviderCapability as vt, DAY_NAMES as w, asJsonObject as wi, keychainCapability as wn, userManagementCapability as wr, buildDeviceSignatureMessage as wt, DATABASE_SNAPSHOT_SUFFIX as x, UnindexedFilterError as xi, isVoidInput as xn, streamCatalogCapability as xr, batteryCapability as xt, CredentialTokenClaimsSchema as y, EventCategory as ya, RevConflictError as yi, isLocationEnabled as yn, storageOccupancyCapability as yr, backupCapability as yt, HUB_MDNS_SERVICE_TYPE as z, emitReadiness as zi, normalizeCoreBlockWrite as zn, compositionSourceKey as zr, dataStoreProviderCapability as zt };