@camstack/system 1.2.454 → 1.2.455

package/dist/{dist-Bi4Ioxop.js → dist-DjQ8C-ku.js}

@@ -3257,6 +3257,12 @@ function normalizeAddonInitResult(result) {
 * core proxy and the kernel listener) to keep both off a kernel↔core import.
 */
 var DATAPLANE_SECRET_HEADER = "x-camstack-dataplane-secret";
+/**
+* The share-view scope kinds a `csv_*` share token can carry. The hub mints
+* and validates them (`share-token.service.ts` builds its enum from this
+* list); a data plane names the kinds it ACCEPTS in `share`.
+*/
+var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
 /** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
 var PeerBytesTicketSchema = zod.z.object({
 	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
@@ -10392,6 +10398,235 @@ function scopesAllowDeviceCap(scopes, access) {
 function scopesAllowAddon(scopes, addonId, access) {
 	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
 }
+/**
+* Zod schemas for persisted record types.
+*
+* These schemas serve as the single source of truth for types that are
+* stored in the settings-store backend and retrieved via tRPC. They
+* replace the manual TypeScript interfaces with schema-derived types,
+* enabling runtime validation when reading from the backend.
+*
+* Convention: each schema is named `<Type>Schema`, the inferred TS type
+* keeps the original name for backward compatibility.
+*/
+/**
+* Auth model (v2 — 2026-05-12 caps-only):
+*
+* Two principals:
+*   - `isAdmin: true`  — full bypass. Admin scope set is ignored.
+*   - `isAdmin: false` — every call gated by `scopes` (see TokenScope).
+*
+* No role enum. There used to be `viewer / agent / scoped` and earlier
+* `super_admin` — collapsed onto the single boolean because every
+* non-admin caller is governed by the same scope-check rules; the
+* distinction was only ever used to route role-specific procedures
+* which we no longer have. CLI / webhook integrations are `cst_*` tokens
+* with `isAdmin: false` + an explicit scope list.
+*/
+/** Per-method access flavour. Materialised on every cap method via codegen. */
+var MethodAccessSchema = zod.z.enum([
+	"view",
+	"create",
+	"delete"
+]);
+/**
+* A single scope grant. Three forms — checked in matcher with OR
+* semantics; the first match decides whether the call passes:
+*
+*   - `category` — broadest. `target: 'device' | 'system'` selects every
+*     cap with the matching `scope` declaration. New caps inherit grants
+*     automatically — adding a device cap to the codebase makes it
+*     reachable to every user with `category:device [...]` without a
+*     re-grant. Use this for "family viewer" / "operator" tiers.
+*
+*   - `addon` — every cap that ships inside a given addon id. Niche;
+*     useful when an integration needs to interact with one specific
+*     addon's surface regardless of how many caps it exports.
+*
+*   - `capability` — the most precise form. Single cap name. Use for
+*     integration tokens where you want to grant `addons.installPackage`
+*     and nothing else.
+*
+* `access` is REQUIRED with min 1 element. `admin` bypass is the
+* "give me everything" escape; there is no wildcard scope.
+*/
+var AllowedProviderSchema = zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]);
+var AllowedDevicesSchema = zod.z.record(zod.z.string(), zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]));
+var CapScopeSchema = zod.z.enum(["device", "system"]);
+/**
+* DeviceSelector (scope model v3 — 2026-08-12).
+*
+* A `device` grant no longer carries a frozen list of deviceIds. It carries
+* a SELECTOR the matcher resolves against the live fleet, so the grant can be
+* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
+* AFTER the grant was minted — no re-grant, no re-login.
+*
+*   - `all`       — every device in the deployment. The broad viewer/operator
+*     lever without a `category` grant (a `category` grant also covers device
+*     caps that carry no deviceId; `all` is specifically the device set).
+*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
+*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
+*     is NOT covered until the grant is edited.
+*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
+*     DYNAMIC. A device that changes type, or a new device of the type,
+*     re-resolves on the next request.
+*   - `locations` — every device whose operator-assigned `location` label is
+*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
+*     null/unset location matches NO `locations` selector.
+*/
+var DeviceSelectorSchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({ kind: zod.z.literal("all") }),
+	zod.z.object({
+		kind: zod.z.literal("ids"),
+		ids: zod.z.array(zod.z.number().int()).min(1)
+	}),
+	zod.z.object({
+		kind: zod.z.literal("types"),
+		types: zod.z.array(zod.z.enum(DeviceType)).min(1)
+	}),
+	zod.z.object({
+		kind: zod.z.literal("locations"),
+		locations: zod.z.array(zod.z.string().min(1)).min(1)
+	})
+]);
+var DeviceTokenScopeSchema = zod.z.object({
+	type: zod.z.literal("device"),
+	/** The device SET this grant covers — resolved against the live fleet. */
+	selector: DeviceSelectorSchema,
+	access: zod.z.array(MethodAccessSchema).min(1),
+	/**
+	* Whether a grant on a PARENT device transparently covers its accessory
+	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
+	* Direction is parent → children ONLY.
+	*
+	* Absent → the matcher DERIVES it from the access flavour: `view`
+	* inherits (a camera viewer sees the camera's accessories), `create` /
+	* `delete` do NOT (actuating/removing a child is an explicit act the
+	* operator must grant on the child, not inherit from the parent). Set it
+	* explicitly to override that default per grant.
+	*/
+	includeLinked: zod.z.boolean().optional()
+});
+/**
+* v2 → v3 lazy migration. A pre-v3 `device` grant carried
+* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
+* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
+* EVERY parse path — stored records AND the JWT-carried scope arrays
+* normalised at the request boundary ({@link normalizeTokenScopes} in
+* `device-selector.ts`). Chosen over a one-time DB migration because a
+* migration cannot reach a JWT already in a client's hands; parse-time
+* migration covers both without a flag day. No cast — the raw object is read
+* through `Reflect.get` (its static type is `unknown`).
+*/
+function migrateLegacyTokenScope(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
+	if (Reflect.get(raw, "type") !== "device") return raw;
+	if (Reflect.get(raw, "selector") !== void 0) return raw;
+	const targets = Reflect.get(raw, "targets");
+	if (!Array.isArray(targets)) return raw;
+	return {
+		type: "device",
+		selector: {
+			kind: "ids",
+			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
+		},
+		access: Reflect.get(raw, "access")
+	};
+}
+var TokenScopeSchema = zod.z.preprocess(migrateLegacyTokenScope, zod.z.discriminatedUnion("type", [
+	zod.z.object({
+		type: zod.z.literal("category"),
+		target: CapScopeSchema,
+		access: zod.z.array(MethodAccessSchema).min(1)
+	}),
+	zod.z.object({
+		type: zod.z.literal("capability"),
+		target: zod.z.string(),
+		access: zod.z.array(MethodAccessSchema).min(1)
+	}),
+	zod.z.object({
+		type: zod.z.literal("addon"),
+		target: zod.z.string(),
+		access: zod.z.array(MethodAccessSchema).min(1)
+	}),
+	DeviceTokenScopeSchema
+]));
+var UserRecordSchema = zod.z.object({
+	id: zod.z.string(),
+	username: zod.z.string(),
+	passwordHash: zod.z.string(),
+	/**
+	* Admin bypass. When true, the middleware skips the scope-access
+	* check entirely. There is no other axis of privilege; the legacy
+	* role enum collapsed onto this boolean in v2.
+	*/
+	isAdmin: zod.z.boolean().default(false),
+	allowedProviders: AllowedProviderSchema,
+	allowedDevices: AllowedDevicesSchema,
+	/**
+	* Scopes granted to this user. Admins bypass; their `scopes` is
+	* ignored. Non-admins without scopes are locked out of every
+	* protected call.
+	*/
+	scopes: zod.z.array(TokenScopeSchema).default([]),
+	createdAt: zod.z.number(),
+	updatedAt: zod.z.number()
+});
+var ApiKeyRecordSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	isAdmin: zod.z.boolean().default(false),
+	allowedProviders: AllowedProviderSchema,
+	allowedDevices: AllowedDevicesSchema,
+	tokenHash: zod.z.string(),
+	tokenPrefix: zod.z.string(),
+	createdAt: zod.z.number(),
+	lastUsedAt: zod.z.number().optional()
+});
+var ScopedTokenSchema = zod.z.object({
+	id: zod.z.string(),
+	userId: zod.z.string(),
+	name: zod.z.string(),
+	tokenHash: zod.z.string(),
+	tokenPrefix: zod.z.string(),
+	scopes: zod.z.array(TokenScopeSchema),
+	expiresAt: zod.z.number().nullish(),
+	lastUsedAt: zod.z.number().nullish(),
+	createdAt: zod.z.number()
+});
+/** What a share-view grant lets its holder see. */
+var ShareViewGrantSchema = zod.z.object({
+	kind: zod.z.enum(SHARE_VIEW_KINDS),
+	deviceIds: zod.z.array(zod.z.number().int().nonnegative()).min(1).max(64),
+	/** Talk-back, opt-in at mint time; absent means off. */
+	talk: zod.z.boolean().optional()
+});
+var ShareViewScopeSchema = zod.z.object({
+	type: zod.z.literal("share-view"),
+	grant: ShareViewGrantSchema
+});
+var AddonRoutesScopeSchema = zod.z.object({
+	type: zod.z.literal("addon-routes"),
+	access: zod.z.array(MethodAccessSchema).min(1)
+});
+var CredentialScopeSchema = zod.z.union([
+	zod.z.literal("*"),
+	ShareViewScopeSchema,
+	AddonRoutesScopeSchema,
+	TokenScopeSchema
+]);
+/**
+* The claims of a unified token (`auth.mintToken`). It carries no `exp`: its
+* row (looked up by `jti` on every verify, for revocation) holds the ONE
+* expiry, so a share link can be extended and a JWT clock can never disagree
+* with the row.
+*/
+var CredentialTokenClaimsSchema = zod.z.object({
+	kind: zod.z.literal("credential"),
+	sub: zod.z.string().min(1),
+	jti: zod.z.string().min(16),
+	scopes: zod.z.array(CredentialScopeSchema).min(1)
+});
 zod.z.enum(["new-session", "step-up"]);
 /** The languages the hub's app landing pages are written in (D858). */
 var AppPageLangSchema = zod.z.enum(["en", "it"]);
@@ -46812,202 +47047,6 @@ var notificationRulesCapability = {
 	}
 };
 /**
-* Zod schemas for persisted record types.
-*
-* These schemas serve as the single source of truth for types that are
-* stored in the settings-store backend and retrieved via tRPC. They
-* replace the manual TypeScript interfaces with schema-derived types,
-* enabling runtime validation when reading from the backend.
-*
-* Convention: each schema is named `<Type>Schema`, the inferred TS type
-* keeps the original name for backward compatibility.
-*/
-/**
-* Auth model (v2 — 2026-05-12 caps-only):
-*
-* Two principals:
-*   - `isAdmin: true`  — full bypass. Admin scope set is ignored.
-*   - `isAdmin: false` — every call gated by `scopes` (see TokenScope).
-*
-* No role enum. There used to be `viewer / agent / scoped` and earlier
-* `super_admin` — collapsed onto the single boolean because every
-* non-admin caller is governed by the same scope-check rules; the
-* distinction was only ever used to route role-specific procedures
-* which we no longer have. CLI / webhook integrations are `cst_*` tokens
-* with `isAdmin: false` + an explicit scope list.
-*/
-/** Per-method access flavour. Materialised on every cap method via codegen. */
-var MethodAccessSchema = zod.z.enum([
-	"view",
-	"create",
-	"delete"
-]);
-/**
-* A single scope grant. Three forms — checked in matcher with OR
-* semantics; the first match decides whether the call passes:
-*
-*   - `category` — broadest. `target: 'device' | 'system'` selects every
-*     cap with the matching `scope` declaration. New caps inherit grants
-*     automatically — adding a device cap to the codebase makes it
-*     reachable to every user with `category:device [...]` without a
-*     re-grant. Use this for "family viewer" / "operator" tiers.
-*
-*   - `addon` — every cap that ships inside a given addon id. Niche;
-*     useful when an integration needs to interact with one specific
-*     addon's surface regardless of how many caps it exports.
-*
-*   - `capability` — the most precise form. Single cap name. Use for
-*     integration tokens where you want to grant `addons.installPackage`
-*     and nothing else.
-*
-* `access` is REQUIRED with min 1 element. `admin` bypass is the
-* "give me everything" escape; there is no wildcard scope.
-*/
-var AllowedProviderSchema = zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]);
-var AllowedDevicesSchema = zod.z.record(zod.z.string(), zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]));
-var CapScopeSchema = zod.z.enum(["device", "system"]);
-/**
-* DeviceSelector (scope model v3 — 2026-08-12).
-*
-* A `device` grant no longer carries a frozen list of deviceIds. It carries
-* a SELECTOR the matcher resolves against the live fleet, so the grant can be
-* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
-* AFTER the grant was minted — no re-grant, no re-login.
-*
-*   - `all`       — every device in the deployment. The broad viewer/operator
-*     lever without a `category` grant (a `category` grant also covers device
-*     caps that carry no deviceId; `all` is specifically the device set).
-*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
-*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
-*     is NOT covered until the grant is edited.
-*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
-*     DYNAMIC. A device that changes type, or a new device of the type,
-*     re-resolves on the next request.
-*   - `locations` — every device whose operator-assigned `location` label is
-*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
-*     null/unset location matches NO `locations` selector.
-*/
-var DeviceSelectorSchema = zod.z.discriminatedUnion("kind", [
-	zod.z.object({ kind: zod.z.literal("all") }),
-	zod.z.object({
-		kind: zod.z.literal("ids"),
-		ids: zod.z.array(zod.z.number().int()).min(1)
-	}),
-	zod.z.object({
-		kind: zod.z.literal("types"),
-		types: zod.z.array(zod.z.enum(DeviceType)).min(1)
-	}),
-	zod.z.object({
-		kind: zod.z.literal("locations"),
-		locations: zod.z.array(zod.z.string().min(1)).min(1)
-	})
-]);
-var DeviceTokenScopeSchema = zod.z.object({
-	type: zod.z.literal("device"),
-	/** The device SET this grant covers — resolved against the live fleet. */
-	selector: DeviceSelectorSchema,
-	access: zod.z.array(MethodAccessSchema).min(1),
-	/**
-	* Whether a grant on a PARENT device transparently covers its accessory
-	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
-	* Direction is parent → children ONLY.
-	*
-	* Absent → the matcher DERIVES it from the access flavour: `view`
-	* inherits (a camera viewer sees the camera's accessories), `create` /
-	* `delete` do NOT (actuating/removing a child is an explicit act the
-	* operator must grant on the child, not inherit from the parent). Set it
-	* explicitly to override that default per grant.
-	*/
-	includeLinked: zod.z.boolean().optional()
-});
-/**
-* v2 → v3 lazy migration. A pre-v3 `device` grant carried
-* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
-* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
-* EVERY parse path — stored records AND the JWT-carried scope arrays
-* normalised at the request boundary ({@link normalizeTokenScopes} in
-* `device-selector.ts`). Chosen over a one-time DB migration because a
-* migration cannot reach a JWT already in a client's hands; parse-time
-* migration covers both without a flag day. No cast — the raw object is read
-* through `Reflect.get` (its static type is `unknown`).
-*/
-function migrateLegacyTokenScope(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
-	if (Reflect.get(raw, "type") !== "device") return raw;
-	if (Reflect.get(raw, "selector") !== void 0) return raw;
-	const targets = Reflect.get(raw, "targets");
-	if (!Array.isArray(targets)) return raw;
-	return {
-		type: "device",
-		selector: {
-			kind: "ids",
-			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
-		},
-		access: Reflect.get(raw, "access")
-	};
-}
-var TokenScopeSchema = zod.z.preprocess(migrateLegacyTokenScope, zod.z.discriminatedUnion("type", [
-	zod.z.object({
-		type: zod.z.literal("category"),
-		target: CapScopeSchema,
-		access: zod.z.array(MethodAccessSchema).min(1)
-	}),
-	zod.z.object({
-		type: zod.z.literal("capability"),
-		target: zod.z.string(),
-		access: zod.z.array(MethodAccessSchema).min(1)
-	}),
-	zod.z.object({
-		type: zod.z.literal("addon"),
-		target: zod.z.string(),
-		access: zod.z.array(MethodAccessSchema).min(1)
-	}),
-	DeviceTokenScopeSchema
-]));
-var UserRecordSchema = zod.z.object({
-	id: zod.z.string(),
-	username: zod.z.string(),
-	passwordHash: zod.z.string(),
-	/**
-	* Admin bypass. When true, the middleware skips the scope-access
-	* check entirely. There is no other axis of privilege; the legacy
-	* role enum collapsed onto this boolean in v2.
-	*/
-	isAdmin: zod.z.boolean().default(false),
-	allowedProviders: AllowedProviderSchema,
-	allowedDevices: AllowedDevicesSchema,
-	/**
-	* Scopes granted to this user. Admins bypass; their `scopes` is
-	* ignored. Non-admins without scopes are locked out of every
-	* protected call.
-	*/
-	scopes: zod.z.array(TokenScopeSchema).default([]),
-	createdAt: zod.z.number(),
-	updatedAt: zod.z.number()
-});
-var ApiKeyRecordSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	isAdmin: zod.z.boolean().default(false),
-	allowedProviders: AllowedProviderSchema,
-	allowedDevices: AllowedDevicesSchema,
-	tokenHash: zod.z.string(),
-	tokenPrefix: zod.z.string(),
-	createdAt: zod.z.number(),
-	lastUsedAt: zod.z.number().optional()
-});
-var ScopedTokenSchema = zod.z.object({
-	id: zod.z.string(),
-	userId: zod.z.string(),
-	name: zod.z.string(),
-	tokenHash: zod.z.string(),
-	tokenPrefix: zod.z.string(),
-	scopes: zod.z.array(TokenScopeSchema),
-	expiresAt: zod.z.number().nullish(),
-	lastUsedAt: zod.z.number().nullish(),
-	createdAt: zod.z.number()
-});
-/**
 * `oauth-integration` — a collection cap by which an addon declares
 * itself a linkable OAuth client of the hub's core `/oauth2/*` server.
 * Each provider returns a static descriptor; the core enumerates them
@@ -88456,6 +88495,12 @@ Object.defineProperty(exports, "CoreBlockSchema", {
 		return CoreBlockSchema;
 	}
 });
+Object.defineProperty(exports, "CredentialTokenClaimsSchema", {
+	enumerable: true,
+	get: function() {
+		return CredentialTokenClaimsSchema;
+	}
+});
 Object.defineProperty(exports, "DATABASE_SNAPSHOT_PARTIAL_SUFFIX", {
 	enumerable: true,
 	get: function() {

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-Bo_lo3Dh.js");
+const require_wal_maintenance = require("./wal-maintenance-Bl0ZKjVR.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-Df89xxrK.mjs";
+import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-TyuOEVy1.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/{hub-mdns-ciao-2FzLWfbD.js → hub-mdns-ciao-Bkrvgnma.js}

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Bi4Ioxop.js");
+const require_dist = require("./dist-DjQ8C-ku.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
-const require_agent_https = require("./agent-https-B7IjRRzT.js");
+const require_agent_https = require("./agent-https-CCvlRQKV.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/{hub-mdns-ciao-BRs3DUT-.mjs → hub-mdns-ciao-DlgkFJVY.mjs}

@@ -1,7 +1,7 @@
 import { o as __toESM } from "./chunk-CNf5ZN-e.mjs";
-import { ga as userError } from "./dist-7ZciHCIp.mjs";
+import { _a as userError } from "./dist-BpSENkRJ.mjs";
 import { f as X509Certificate$1 } from "./x509.es-DK__ETIe.mjs";
-import { A as isConstrainedCa, E as reasonRequiresNewCa, M as permitsIdentity, P as readNameConstraints, T as evaluateExistingCert, _ as issueLeaf, g as generateCa, v as loadCa, y as collectCertIdentity } from "./agent-https-oXsR24R2.mjs";
+import { A as isConstrainedCa, E as reasonRequiresNewCa, M as permitsIdentity, P as readNameConstraints, T as evaluateExistingCert, _ as issueLeaf, g as generateCa, v as loadCa, y as collectCertIdentity } from "./agent-https-CLWrOO3o.mjs";
 import { X509Certificate, createPrivateKey } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { mkdir, writeFile } from "node:fs/promises";

package/dist/index.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Bi4Ioxop.js");
+const require_dist = require("./dist-DjQ8C-ku.js");
 const require_read_all_rows$1 = require("./read-all-rows-CVoO1ONM.js");
-const require_device_ca = require("./device-ca-B3hUVfYk.js");
+const require_device_ca = require("./device-ca-QPBgfqVY.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -27,21 +27,21 @@ const require_builtins_loki_logging_index = require("./builtins/loki-logging/ind
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_device_history_device_history_addon = require("./builtins/device-history/device-history.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-Bo_lo3Dh.js");
+const require_wal_maintenance = require("./wal-maintenance-Bl0ZKjVR.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-DBGG6Zu5.js");
-const require_agent_https = require("./agent-https-B7IjRRzT.js");
+const require_constants = require("./constants-DruwCkfp.js");
+const require_agent_https = require("./agent-https-CCvlRQKV.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-COyb49zm.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-2FzLWfbD.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-Bkrvgnma.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-C0ymYQk7.js");
+const require_restore_archive = require("./restore-archive-4OP0EYg6.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { An as logLevelAtMost, Bn as objectInputDeclaresAddonId, Ci as asJsonObject$1, En as lifecycleJobSchema, G as METHOD_ACCESS_MAP, Gr as errMsg$1, Ii as defineRecordKinds, Jr as CALLER_STAMPED_CAPABILITIES$1, Kn as procedureAuthKey, Li as emitDownForOwnedCaps, Mi as createEvent$1, Sr as supportedRuntimes, Ti as asString$1, U as LOG_LEVEL_RANK, Vn as objectInputDeclaresRequiredDeviceId, Xr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Yr as DATAPLANE_SECRET_HEADER$1, Zr as DEVICE_STATUS_METHOD, _ as CatalogFileSchema, _a as withoutCallerStamp, aa as readinessKey, an as extractNestedAddonId, bn as isVoidInput, cr as scopesAllowDeviceCap, d as CATALOG_LANGS, di as RUNTIME_DEFAULTS, dn as interpolate, dt as addonSettingsCapability, ea as parseJsonObject, fi as ReadinessRegistry, ga as userError, gn as isCollectionArrayMethod, hn as isArrayOutputSchema, ir as resolveMethodAuth, jn as looseSchema, la as scopeKey, mr as splitTranslationRef, n as AGENT_MDNS_TXT_KEYS, pi as ReadinessTimeoutError, r as ALL_CAPABILITY_DEFINITIONS, sa as resolveCapMount, sr as scopesAllowAddon, t as AGENT_MDNS_SERVICE_TYPE, ta as parseJsonUnknown, va as EventCategory$1, wi as asNumber, xn as kebabToCamel$1, yn as isObjectInput, zi as expandCapMethods } from "./dist-7ZciHCIp.mjs";
+import { Bi as expandCapMethods, Cr as supportedRuntimes, Dn as lifecycleJobSchema, Ei as asString$1, Hn as objectInputDeclaresRequiredDeviceId, K as METHOD_ACCESS_MAP, Kr as errMsg$1, Li as defineRecordKinds, Mn as looseSchema, Ni as createEvent$1, Qr as DEVICE_STATUS_METHOD, Ri as emitDownForOwnedCaps, Sn as kebabToCamel$1, Ti as asNumber, Vn as objectInputDeclaresAddonId, W as LOG_LEVEL_RANK, Xr as DATAPLANE_SECRET_HEADER$1, Yr as CALLER_STAMPED_CAPABILITIES$1, Zr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _ as CatalogFileSchema, _a as userError, _n as isCollectionArrayMethod, ar as resolveMethodAuth, bn as isObjectInput, ca as resolveCapMount, cr as scopesAllowAddon, d as CATALOG_LANGS, fi as RUNTIME_DEFAULTS, fn as interpolate, ft as addonSettingsCapability, gn as isArrayOutputSchema, hr as splitTranslationRef, jn as logLevelAtMost, lr as scopesAllowDeviceCap, mi as ReadinessTimeoutError, n as AGENT_MDNS_TXT_KEYS, na as parseJsonUnknown, oa as readinessKey, on as extractNestedAddonId, pi as ReadinessRegistry, qn as procedureAuthKey, r as ALL_CAPABILITY_DEFINITIONS, t as AGENT_MDNS_SERVICE_TYPE, ta as parseJsonObject, ua as scopeKey, va as withoutCallerStamp, wi as asJsonObject$1, xn as isVoidInput, ya as EventCategory$1 } from "./dist-BpSENkRJ.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-Utfvsx5x.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-uFbTyY_o.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -26,21 +26,21 @@ import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { DeviceHistoryAddon } from "./builtins/device-history/device-history.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { l as SqliteSettingsBackend } from "./wal-maintenance-Df89xxrK.mjs";
+import { l as SqliteSettingsBackend } from "./wal-maintenance-TyuOEVy1.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, l as STORAGE_DRAIN_STATE_LEGACY, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService, u as storageOrchestratorRecordKinds } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-DQcVrhVI.mjs";
-import { $ as generateMeshKeyPair, A as isConstrainedCa, C as MAX_LEAF_VALIDITY_DAYS, D as PERMITTED_DNS_SUFFIXES, F as AGENT_HTTPS_NAMES_COLLECTION, G as describeMeshLeaf, H as MESH_NODE_CERTIFICATES_COLUMNS, I as AGENT_HTTPS_NAMES_COLUMNS, J as caFingerprint, K as getProcessMeshCertificateRegistry, L as AgentHttpsNames, M as permitsIdentity, N as permitsName, O as PERMITTED_IP_RANGES, P as readNameConstraints, Q as generateMeshCa, R as getProcessAgentHttpsNames, S as LEAF_RENEWAL_WINDOW_DAYS, T as evaluateExistingCert, U as MeshCertificateRegistry, V as MESH_NODE_CERTIFICATES_COLLECTION, W as RENEWAL_ABANDONED, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, a as collectAgentNames, b as systemHostFacts, c as installAgentHttps, d as issueAgentHttpsLeaf, et as isValidAgentNodeId, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isLocalOnlyHostname, k as buildNameConstraintSet, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, nt as issueMeshLeafFromCsr, o as createAgentHttpsRequest, p as pemDigest, q as setProcessMeshCertificateRegistry, r as agentHttpsPaths, rt as loadMeshCa, s as describeHttpsLeaf, t as AgentHttpsInstallError, tt as issueMeshLeafForNode, u as isPrivateAddress, w as SERVER_AUTH_OID, x as CA_VALIDITY_DAYS, y as collectCertIdentity, z as setProcessAgentHttpsNames } from "./agent-https-oXsR24R2.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-DOlYt1t1.mjs";
+import { $ as generateMeshKeyPair, A as isConstrainedCa, C as MAX_LEAF_VALIDITY_DAYS, D as PERMITTED_DNS_SUFFIXES, F as AGENT_HTTPS_NAMES_COLLECTION, G as describeMeshLeaf, H as MESH_NODE_CERTIFICATES_COLUMNS, I as AGENT_HTTPS_NAMES_COLUMNS, J as caFingerprint, K as getProcessMeshCertificateRegistry, L as AgentHttpsNames, M as permitsIdentity, N as permitsName, O as PERMITTED_IP_RANGES, P as readNameConstraints, Q as generateMeshCa, R as getProcessAgentHttpsNames, S as LEAF_RENEWAL_WINDOW_DAYS, T as evaluateExistingCert, U as MeshCertificateRegistry, V as MESH_NODE_CERTIFICATES_COLLECTION, W as RENEWAL_ABANDONED, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, a as collectAgentNames, b as systemHostFacts, c as installAgentHttps, d as issueAgentHttpsLeaf, et as isValidAgentNodeId, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isLocalOnlyHostname, k as buildNameConstraintSet, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, nt as issueMeshLeafFromCsr, o as createAgentHttpsRequest, p as pemDigest, q as setProcessMeshCertificateRegistry, r as agentHttpsPaths, rt as loadMeshCa, s as describeHttpsLeaf, t as AgentHttpsInstallError, tt as issueMeshLeafForNode, u as isPrivateAddress, w as SERVER_AUTH_OID, x as CA_VALIDITY_DAYS, y as collectCertIdentity, z as setProcessAgentHttpsNames } from "./agent-https-CLWrOO3o.mjs";
 import { $ as parseCidrList, A as setProcessMeshPeerTransportLookup, B as requireProcessMeshCa, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as AGENT_UI_UNLOCK_VERSION, H as AGENT_UI_UNLOCK_TTL_MS, I as MeshCrl, J as mintAgentUiUnlockTicket, K as UnlockTicketJtiStore, L as processMeshCrl, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as normalizeIp, R as MeshCaKeeper, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as AGENT_UI_UNLOCK_TYP, V as AGENT_DASHBOARD_ORIGINS_FIELD, W as AGENT_UI_UNLOCK_USE, X as verifyAgentUiUnlockTicket, Y as parseAgentDashboardOrigins, Z as createCidrMatcher, _ as signPairingProof, a as hubHostFromMeshAddress, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, d as PAIRING_PROTOCOL, et as readCidrSetting, f as PAIRING_TTL_MS, g as keyFingerprintShort, h as describeCsr, i as AgentPairing, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, m as computePairingSas, n as HubPairing, o as PAIRING_CODE_DIGITS, p as computePairingCommitment, q as isAllowedAgentDashboardReturnTo, r as PairingHttpError, s as PAIRING_MAX_CODE_ATTEMPTS, u as PAIRING_PIN_DIGITS, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as getProcessMeshCaState } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-stpC3Zy-.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-BRs3DUT-.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-DlgkFJVY.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as backupOrchestratorRecordKinds, f as BackupDecryptError, g as generateBackupKeyPair, l as backupRecordStoresOf, m as BackupKeyMismatchError, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, v as readBackupEncryptionHeader } from "./restore-archive-UVZv_hmr.mjs";
+import { c as backupOrchestratorRecordKinds, f as BackupDecryptError, g as generateBackupKeyPair, l as backupRecordStoresOf, m as BackupKeyMismatchError, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, v as readBackupEncryptionHeader } from "./restore-archive-YFSJRtKy.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomBytes, randomUUID } from "node:crypto";

package/dist/{phase6-declare-gate-DwYAep7y.js → phase6-declare-gate-DrmTtz7F.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-Bi4Ioxop.js");
+const require_dist = require("./dist-DjQ8C-ku.js");
 //#region src/builtins/records/legacy-table-row-count.ts
 /** Row count for a physical settings-db table (matches the records engine `legacyRowCount`). */
 function legacyTableRowCountFromList(tables, collection) {

package/dist/{phase6-declare-gate-D-2LMw9o.mjs → phase6-declare-gate-JQUqgQgq.mjs}

@@ -1,4 +1,4 @@
-import { Pi as declarationsOf } from "./dist-7ZciHCIp.mjs";
+import { Fi as declarationsOf } from "./dist-BpSENkRJ.mjs";
 //#region src/builtins/records/legacy-table-row-count.ts
 /** Row count for a physical settings-db table (matches the records engine `legacyRowCount`). */
 function legacyTableRowCountFromList(tables, collection) {

package/dist/{restore-archive-C0ymYQk7.js → restore-archive-4OP0EYg6.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Bi4Ioxop.js");
+const require_dist = require("./dist-DjQ8C-ku.js");
 const require_read_all_rows$1 = require("./read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/{restore-archive-UVZv_hmr.mjs → restore-archive-YFSJRtKy.mjs}

@@ -1,4 +1,4 @@
-import { A as DataStoreDatabaseSchema, Ii as defineRecordKinds, b as DATABASE_SNAPSHOT_SUFFIX } from "./dist-7ZciHCIp.mjs";
+import { Li as defineRecordKinds, j as DataStoreDatabaseSchema, x as DATABASE_SNAPSHOT_SUFFIX } from "./dist-BpSENkRJ.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.454",
+  "version": "1.2.455",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",