@camstack/system 1.2.455 → 1.2.456

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { $i as normalizeNodeId, Ar as withLocationMode, En as legacyModeOf, G as LegacyStorageLocationDefaultSchema, Li as defineRecordKinds, Ln as modeMayWrite, Nn as mayReadLocation, Pn as mayWriteToLocation, _r as storageCapability, at as StorageCleanupJobSchema, ct as StorageMigrationJobSchema, da as secretTreeFromPaths, dn as gbToBytes, dr as settingsStoreCapability, ga as transformSecretWrite, ir as resolveLocationMode, ki as collectSecretConfigKeys, la as resolveSecretMarkers, ot as StorageLocationModeSchema, qi as isSecretMarker, qr as BaseAddon, rn as evictionPolicyOfLocation, st as StorageLocationTypeSchema, ta as parseJsonObject, ui as REDACTED_SECRET, vr as storageMigrationCapability, ya as EventCategory, yn as isLocationEnabled } from "../../dist-BpSENkRJ.mjs";
+import { $i as isSecretMarker, $r as BaseAddon, Bn as mayWriteToLocation, Cr as storageCapability, Fi as collectSecretConfigKeys, Ir as withLocationMode, K as LegacyStorageLocationDefaultSchema, Mn as legacyModeOf, Sa as transformSecretWrite, Ta as EventCategory, Tn as isLocationEnabled, Ui as defineRecordKinds, Un as modeMayWrite, _a as secretTreeFromPaths, _r as settingsStoreCapability, aa as normalizeNodeId, cn as evictionPolicyOfLocation, dt as StorageLocationModeSchema, ft as StorageLocationTypeSchema, gi as REDACTED_SECRET, gn as gbToBytes, ha as resolveSecretMarkers, pt as StorageMigrationJobSchema, sa as parseJsonObject, ur as resolveLocationMode, ut as StorageCleanupJobSchema, wr as storageMigrationCapability, zn as mayReadLocation } from "../../dist-BSF_C8W2.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_x509_es = require("../../x509.es-C4cOo48M.js");
-const require_constants$8 = require("../../constants-DruwCkfp.js");
-const require_agent_https = require("../../agent-https-CCvlRQKV.js");
+const require_constants$8 = require("../../constants-CavyKfHZ.js");
+const require_agent_https = require("../../agent-https-yjxdfJDA.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,9 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Hi as hydrateSchema, Ii as defineCustomActions, Kr as errMsg, Pi as customAction, fr as shortHostname, qr as BaseAddon, rt as ServerNameSchema } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Bi as customAction, Hi as defineCustomActions, Ji as hydrateSchema, Qr as errMsg, ct as ServerNameSchema, vr as shortHostname } from "../../dist-BSF_C8W2.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { c as Pkcs10CertificateRequest } from "../../x509.es-DK__ETIe.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "../../constants-DOlYt1t1.mjs";
-import { $ as generateMeshKeyPair, B as systemConfigRecordKinds, F as AGENT_HTTPS_NAMES_COLLECTION, G as describeMeshLeaf, H as MESH_NODE_CERTIFICATES_COLUMNS, I as AGENT_HTTPS_NAMES_COLUMNS, L as AgentHttpsNames, Q as generateMeshCa, R as getProcessAgentHttpsNames, U as MeshCertificateRegistry, V as MESH_NODE_CERTIFICATES_COLLECTION, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, et as isValidAgentNodeId, it as subjectCn, j as isLocalOnlyHostname, nt as issueMeshLeafFromCsr, q as setProcessMeshCertificateRegistry, rt as loadMeshCa, tt as issueMeshLeafForNode, u as isPrivateAddress, z as setProcessAgentHttpsNames } from "../../agent-https-CLWrOO3o.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "../../constants-i5oD_gLB.mjs";
+import { $ as generateMeshCa, B as setProcessAgentHttpsNames, H as MESH_NODE_CERTIFICATES_COLLECTION, I as AGENT_HTTPS_NAMES_COLLECTION, J as setProcessMeshCertificateRegistry, K as describeMeshLeaf, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, Q as exportMeshPrivateKeyPem, R as AgentHttpsNames, U as MESH_NODE_CERTIFICATES_COLUMNS, V as systemConfigRecordKinds, W as MeshCertificateRegistry, X as caFingerprintCompact, Z as createMeshCsrPem, at as subjectCn, et as generateMeshKeyPair, it as loadMeshCa, nt as issueMeshLeafForNode, rt as issueMeshLeafFromCsr, tt as isValidAgentNodeId, u as isPrivateAddress, z as getProcessAgentHttpsNames } from "../../agent-https-fm4AR8XL.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { An as logDestinationCapability, qr as BaseAddon } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, In as logDestinationCapability } from "../../dist-BSF_C8W2.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-CSzD5_qX.mjs → composition-sources-Ds0Vr6eD.mjs}

@@ -1,4 +1,4 @@
-import { Kr as errMsg, zr as compositionSourceKey } from "./dist-BpSENkRJ.mjs";
+import { Gr as compositionSourceKey, Qr as errMsg } from "./dist-BSF_C8W2.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-BxUkLNSo.js → composition-sources-gB4coDJR.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DjQ8C-ku.js");
+const require_dist = require("./dist-BpqA2CT0.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-DruwCkfp.js → constants-CavyKfHZ.js}

@@ -1,5 +1,5 @@
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
-var MESH_CA_KEY_REF = require("./dist-DjQ8C-ku.js").buildSecretRef({
+var MESH_CA_KEY_REF = require("./dist-BpqA2CT0.js").buildSecretRef({
 	owner: "system",
 	scope: { kind: "global" },
 	fieldPath: "meshCaKey"

package/dist/{constants-DOlYt1t1.mjs → constants-i5oD_gLB.mjs}

@@ -1,4 +1,4 @@
-import { Oi as buildSecretRef } from "./dist-BpSENkRJ.mjs";
+import { Pi as buildSecretRef } from "./dist-BSF_C8W2.mjs";
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
 var MESH_CA_KEY_REF = buildSecretRef({
 	owner: "system",

package/dist/{device-ca-QPBgfqVY.js → device-ca-bpoEr0zG.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DjQ8C-ku.js");
+const require_dist = require("./dist-BpqA2CT0.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts

package/dist/{device-ca-uFbTyY_o.mjs → device-ca-qz1Pmeu1.mjs}

@@ -1,4 +1,4 @@
-import { O as DEVICE_SAN_CREDENTIAL_PREFIX, Oi as buildSecretRef, k as DEVICE_SAN_USER_PREFIX } from "./dist-BpSENkRJ.mjs";
+import { A as DEVICE_SAN_USER_PREFIX, Pi as buildSecretRef, k as DEVICE_SAN_CREDENTIAL_PREFIX } from "./dist-BSF_C8W2.mjs";
 import { S as backdatedNotBefore, a as KeyUsageFlags, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension } from "./x509.es-DK__ETIe.mjs";
 import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts

package/dist/{dist-BpSENkRJ.mjs → dist-BSF_C8W2.mjs}

@@ -745,7 +745,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-BxjU_fJM.mjs
+//#region ../types/dist/sleep-yKL5gfrH.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -3258,9 +3258,9 @@ function normalizeAddonInitResult(result) {
 */
 var DATAPLANE_SECRET_HEADER = "x-camstack-dataplane-secret";
 /**
-* The share-view scope kinds a `csv_*` share token can carry. The hub mints
-* and validates them (`share-token.service.ts` builds its enum from this
-* list); a data plane names the kinds it ACCEPTS in `share`.
+* The share-view scope kinds a share-link token can carry. The hub mints
+* and validates them (`ShareViewGrantSchema` builds its
+* enum from this list); a data plane names the kinds it ACCEPTS in `share`.
 */
 var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
 /** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
@@ -10420,7 +10420,7 @@ function scopesAllowAddon(scopes, addonId, access) {
 * `super_admin` — collapsed onto the single boolean because every
 * non-admin caller is governed by the same scope-check rules; the
 * distinction was only ever used to route role-specific procedures
-* which we no longer have. CLI / webhook integrations are `cst_*` tokens
+* which we no longer have. CLI / webhook integrations are tokens (`auth.mintToken`)
 * with `isAdmin: false` + an explicit scope list.
 */
 /** Per-method access flavour. Materialised on every cap method via codegen. */
@@ -10609,24 +10609,117 @@ var AddonRoutesScopeSchema = z.object({
 	type: z.literal("addon-routes"),
 	access: z.array(MethodAccessSchema).min(1)
 });
+var PreferencesSelfScopeSchema = z.object({ type: z.literal("preferences-self") });
 var CredentialScopeSchema = z.union([
 	z.literal("*"),
 	ShareViewScopeSchema,
 	AddonRoutesScopeSchema,
+	PreferencesSelfScopeSchema,
 	TokenScopeSchema
 ]);
 /**
+* The `kind` claim of a unified token. It names the TOKEN FAMILY (so every
+* older gate that classifies a hub JWT refuses it — `classifyBearerPrincipal`
+* treats any `kind` it does not know as not-a-credential), never what the
+* token may do: that is its `scopes`, and only its `scopes`.
+*/
+var CREDENTIAL_TOKEN_KIND = "credential";
+/**
+* The `aud` claim every minted token is signed with (D895). The hub's raw JWT
+* verify (`AuthManager.verifyToken`, used by every surface that wants a LOGIN
+* session — the OAuth consent page, the session cookie, health, backups)
+* refuses a token carrying it, so a minted token — a share link above all —
+* can never be replayed as a person's session. Only the credential verifier's
+* own door (`verifyCredentialToken`) accepts it.
+*/
+var CREDENTIAL_TOKEN_AUDIENCE = "camstack:credential";
+/** Does a verified JWT payload belong to the minted-token family? */
+function isCredentialTokenPayload(payload) {
+	if (payload === null || typeof payload !== "object") return false;
+	const kind = Reflect.get(payload, "kind");
+	const aud = Reflect.get(payload, "aud");
+	return kind === "credential" || aud === "camstack:credential" || Array.isArray(aud) && aud.includes("camstack:credential");
+}
+/**
 * The claims of a unified token (`auth.mintToken`). It carries no `exp`: its
 * row (looked up by `jti` on every verify, for revocation) holds the ONE
 * expiry, so a share link can be extended and a JWT clock can never disagree
 * with the row.
 */
 var CredentialTokenClaimsSchema = z.object({
-	kind: z.literal("credential"),
+	kind: z.literal(CREDENTIAL_TOKEN_KIND),
 	sub: z.string().min(1),
 	jti: z.string().min(16),
 	scopes: z.array(CredentialScopeSchema).min(1)
 });
+/**
+* Per-user ACCOUNT preferences (D894): the hub-side half of the viewer's two
+* settings levels.
+*
+*   - DEVICE settings never leave the phone.
+*   - ACCOUNT settings live here: one row per `(user, namespace)`, private to
+*     that user, synced across every device signed in as them, last write wins
+*     unless the writer sends the revision it based its edit on.
+*
+* A setting lives in exactly ONE level; there are no overrides. The caller
+* never names a user: the hub stamps the principal's own id, admin included.
+*
+* The contract the client codes against is the `preferences.*` tRPC router
+* (`server/backend/src/api/core/preferences.router.ts`).
+*/
+/** `viewer.app`, `viewer.cameras`, `viewer.grids` … — lowercase, dot/dash separated. */
+var PREFERENCES_NAMESPACE_PATTERN = /^[a-z][a-z0-9.-]{0,63}$/;
+/** One row's value, measured as UTF-8 JSON. */
+var PREFERENCES_MAX_VALUE_BYTES = 256 * 1024;
+var PreferenceNamespaceSchema = z.string().regex(PREFERENCES_NAMESPACE_PATTERN);
+/** A namespace's value: a JSON object, opaque to the hub. */
+var PreferenceValueSchema = z.record(z.string(), z.unknown());
+var PreferenceDeviceIdSchema = z.string().min(1).max(64);
+/** A stored row, as the owner reads it. */
+var PreferenceRowSchema = z.object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/** Starts at 1, +1 on every write of this namespace. A delete ends the row and its count. */
+	revision: z.number().int().positive(),
+	updatedAt: z.number().int(),
+	/** The client id the last writer sent; `null` when it sent none. */
+	updatedByDevice: PreferenceDeviceIdSchema.nullable()
+});
+z.object({ 
+/** Absent: every namespace the caller holds. */
+namespaces: z.array(PreferenceNamespaceSchema).max(32).optional() });
+z.object({ rows: z.array(PreferenceRowSchema) });
+z.object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/**
+	* The revision the edit was based on. Absent: last write wins. `0`: the
+	* namespace must not exist yet. Any other value that is not the current
+	* revision answers `conflict` and writes nothing.
+	*/
+	baseRevision: z.number().int().nonnegative().optional(),
+	deviceId: PreferenceDeviceIdSchema.optional()
+});
+z.discriminatedUnion("status", [z.object({
+	status: z.literal("saved"),
+	row: PreferenceRowSchema
+}), z.object({
+	status: z.literal("conflict"),
+	current: PreferenceRowSchema.nullable()
+})]);
+z.object({ namespace: PreferenceNamespaceSchema });
+z.object({ 
+/** `false` when the namespace did not exist. */
+deleted: z.boolean() });
+z.object({ 
+/** The revision the client holds per namespace; a namespace it does not list is new to it. */
+revisionByNamespace: z.record(PreferenceNamespaceSchema, z.number().int().nonnegative()).refine((map) => Object.keys(map).length <= 32, { message: `at most 32 namespaces` }) });
+z.object({
+	/** Every row whose revision differs from the client's, and every row it did not list. */
+	rows: z.array(PreferenceRowSchema),
+	/** Namespaces the client listed that no longer exist. */
+	deleted: z.array(PreferenceNamespaceSchema)
+});
 z.enum(["new-session", "step-up"]);
 /** The languages the hub's app landing pages are written in (D858). */
 var AppPageLangSchema = z.enum(["en", "it"]);
@@ -42223,38 +42316,37 @@ var llmRuntimeCapability = {
 		})
 	}
 };
+var LlmProfileKindSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "a kind id is lower-case letters, digits and dashes");
+/** What a model (or, by default, every model of a kind) can do. */
+var LlmModelFeaturesSchema = z.object({
+	vision: z.boolean(),
+	tools: z.boolean(),
+	streaming: z.boolean()
+});
+/** One model a provider offers. `features` overrides the kind's defaults, per field. */
+var LlmModelInfoSchema = z.object({
+	id: z.string(),
+	label: z.string().optional(),
+	contextLength: z.number().int().positive().optional(),
+	features: LlmModelFeaturesSchema.partial().optional()
+});
 /**
-* `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
-* methods concat-fan across providers; single-row methods route to ONE
-* provider by the `addonId` in the call input (the notification-output
-* posture, notification-output.cap.ts:215-250). Provided by `addon-ai`
-* (hub-placed); the cap stays open for future providers.
-*
-* Profiles are ROWS (data), not addons: one row = one usable model endpoint.
-* `apiKey` is a password field — providers REDACT it on read and merge on
-* write; a stored key NEVER round-trips to a client.
-*/
-var LlmProfileKindSchema = z.enum([
-	"openai-compatible",
-	"openai",
-	"anthropic",
-	"google",
-	"managed-local",
-	"apple-foundation"
-]);
+* The provider-specific part of a profile, validated by the provider that owns
+* the kind (`upsertProfile` refuses what it does not accept). A field its
+* `connectionSchema` declares `type: 'password'` is a secret: it is held in the
+* keychain, never in the row, and reads back as the redaction marker.
+*/
+var LlmProviderConfigSchema = z.record(z.string(), z.unknown());
 var LlmProfileSchema = z.object({
 	id: z.string(),
 	name: z.string(),
+	/** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
 	kind: LlmProfileKindSchema,
 	/** Stamped by the provider — keeps the fanned catalog routable. */
 	addonId: z.string(),
 	enabled: z.boolean(),
 	/** Vendor model id, or the managed runtime's loaded model. */
 	model: z.string(),
-	/** Required for openai-compatible; override for cloud kinds. */
-	baseUrl: z.string().optional(),
-	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
-	apiKey: z.string().optional(),
 	/** Vision on/off. A vision call against a `false` profile is REFUSED, never
 	*  degraded to text — that shipped once and produced a confident answer to a
 	*  question about a picture nobody sent. */
@@ -42262,15 +42354,11 @@ var LlmProfileSchema = z.object({
 	temperature: z.number().min(0).max(2).optional(),
 	/** Nucleus sampling. Every wire we speak has it. */
 	topP: z.number().min(0).max(1).optional(),
-	/** Top-k sampling. Carried only by the wires that have it — NEITHER OpenAI
-	*  wire does, and the client drops it there (measured: the request body gets
-	*  `top_p` and no `top_k`). The profile editor hides the field wherever it
-	*  would change nothing; `KINDS_WITH_TOP_K` is the single owner of that list. */
+	/** Top-k sampling. Carried only by the wires that have it — a kind offers the
+	*  field in its editor only when its descriptor lists it in `profileFields`. */
 	topK: z.number().int().positive().optional(),
 	maxTokens: z.number().int().positive().optional(),
-	/** Prompt context window. Advisory for cloud kinds (they enforce their own);
-	*  for `managed-local` it is the llama.cpp `--ctx-size` the runtime starts
-	*  the model with, so it is the one field that changes a PROCESS. */
+	/** Prompt context window. Advisory for cloud kinds (they enforce their own). */
 	contextLength: z.number().int().positive().optional(),
 	/** Default system prompt. A caller's `system` REPLACES it (never appends —
 	*  two system prompts fighting is worse than either alone). */
@@ -42296,16 +42384,37 @@ var LlmProfileSchema = z.object({
 	*  library; the REGISTRY of callable tools is ours and is empty in v1, so a
 	*  `true` here buys the wiring, not behaviour, until tools are registered. */
 	toolsEnabled: z.boolean().default(false),
-	extraHeaders: z.record(z.string(), z.string()).optional(),
-	/** kind === 'managed-local' only (spec §4). */
-	runtime: ManagedRuntimeConfigSchema.optional(),
-	/**
-	* kind === 'apple-foundation' only: WHERE it runs — the only thing there is
-	* to configure (no key, no URL, no download; `model` is `apple-system`).
-	* `supportsVision` on such a row is stamped by the provider from the node's
-	* reported `imageInput`, never taken from the operator (D62).
-	*/
-	appleFoundation: z.object({ nodeId: z.string() }).optional()
+	/** Everything the kind's provider owns (endpoint, key, node, runtime…). */
+	providerConfig: LlmProviderConfigSchema.default({})
+});
+/**
+* The common profile fields a kind's editor offers. The editor owns how each
+* one is drawn; the provider says which of them mean something on its wire.
+*/
+var LlmProfileFieldSchema = z.enum([
+	"temperature",
+	"topP",
+	"topK",
+	"maxTokens",
+	"contextLength",
+	"systemPrompt",
+	"timeoutMs",
+	"connectTimeoutMs",
+	"firstTokenTimeoutMs",
+	"idleTimeoutMs",
+	"retry",
+	"toolsEnabled"
+]);
+/**
+* A provider-drawn part of the editor, by a generic widget id the admin UI
+* registers (`ai/apple-node`). `placement: 'model'` replaces the generic model
+* picker: that widget owns the model choice.
+*/
+var LlmProviderWidgetSchema = z.object({
+	id: z.string(),
+	placement: z.enum(["connection", "model"]),
+	/** `providerConfig` keys this widget must fill before the profile can be saved. */
+	requires: z.array(z.string()).optional()
 });
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
@@ -42314,11 +42423,56 @@ var ConfigSchemaPassthrough$3 = z.unknown();
 var LlmProfileKindDescriptorSchema = z.object({
 	kind: LlmProfileKindSchema,
 	label: z.string(),
+	/** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
 	icon: z.string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: z.string(),
-	configSchema: ConfigSchemaPassthrough$3
+	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
+	connectionSchema: ConfigSchemaPassthrough$3,
+	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
+	advancedSchema: ConfigSchemaPassthrough$3.optional(),
+	/** The kind's defaults; a model from `listModels` may override any of them. */
+	features: LlmModelFeaturesSchema,
+	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
+	visionEditable: z.boolean(),
+	/** Where the model list comes from: `listModels`, `staticModels`, or nowhere. */
+	modelCatalog: z.enum([
+		"fetch",
+		"static",
+		"none"
+	]),
+	staticModels: z.array(LlmModelInfoSchema).optional(),
+	/** The common fields that mean something on this kind's wire. */
+	profileFields: z.array(LlmProfileFieldSchema),
+	providerWidgets: z.array(LlmProviderWidgetSchema).optional()
+});
+/**
+* `listModels` input. `connection` is an UNSAVED draft of `providerConfig`
+* (the editor's form); with `profileId` too, a secret the draft leaves
+* untouched (absent or the redaction marker) is resolved server-side from the
+* stored profile — the browser never receives it.
+*/
+var LlmListModelsInputSchema = z.object({
+	addonId: z.string(),
+	kind: LlmProfileKindSchema,
+	profileId: z.string().optional(),
+	connection: LlmProviderConfigSchema.optional()
 });
+var LlmListModelsErrorCodeSchema = z.enum([
+	"auth",
+	"network",
+	"unsupported",
+	"invalid"
+]);
+/** A RESULT, never a throw: "wrong key" is an answer the editor renders inline. */
+var LlmListModelsResultSchema = z.discriminatedUnion("ok", [z.object({
+	ok: z.literal(true),
+	models: z.array(LlmModelInfoSchema)
+}), z.object({
+	ok: z.literal(false),
+	code: LlmListModelsErrorCodeSchema,
+	message: z.string()
+})]);
 var LlmDefaultSelectorSchema = z.union([z.object({ consumer: z.string() }), z.object({ purpose: z.enum(["text", "vision"]) })]);
 var LlmDefaultSchema = z.object({
 	selector: LlmDefaultSelectorSchema,
@@ -42449,8 +42603,17 @@ var llmCapability = {
 			auth: "admin",
 			timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
 		}),
-		/** Live vendor enumeration (GET /models etc.). */
-		listModels: method(ProfileRefInputSchema, z.array(z.string())),
+		/**
+		* The models a kind offers, for a SAVED profile or an unsaved draft
+		* (`connection`). A mutation, not a query: a draft may carry a key, and a
+		* query's input travels in the URL. Admin: it dials whatever endpoint the
+		* draft names and may resolve a stored key to do it. The answer never
+		* carries a secret — failures are a typed result, never a throw.
+		*/
+		listModels: method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		getDefaults: method(z.object({}), z.array(LlmDefaultSchema)),
 		setDefault: method(z.object({
 			selector: LlmDefaultSelectorSchema,
@@ -71343,26 +71506,6 @@ var ApiKeySummarySchema = z.object({
 	createdAt: z.number(),
 	lastUsedAt: z.number().optional()
 });
-var ScopedTokenSummarySchema = z.object({
-	id: z.string(),
-	userId: z.string(),
-	name: z.string(),
-	tokenPrefix: z.string(),
-	scopes: z.array(TokenScopeSchema),
-	expiresAt: z.number().nullish(),
-	lastUsedAt: z.number().nullish(),
-	createdAt: z.number()
-});
-var CreateScopedTokenInputSchema = z.object({
-	userId: z.string(),
-	name: z.string(),
-	scopes: z.array(TokenScopeSchema),
-	expiresAt: z.number().optional()
-});
-var CreateScopedTokenResultSchema = z.object({
-	token: z.string(),
-	record: ScopedTokenSummarySchema
-});
 var OauthSessionSummarySchema = z.object({
 	id: z.string(),
 	userId: z.string(),
@@ -71384,11 +71527,11 @@ var TotpStatusSchema = z.object({
 	confirmedAt: z.number().nullable()
 });
 /**
-* user-management — singleton capability for user accounts, API keys,
-* and scoped tokens.
+* user-management — singleton capability for user accounts and the
+* legacy API-key rows.
 *
 * v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
-* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* — the subset check on `setUserScopes` is moot
 * because non-admins never reach these. If/when we open non-admin
 * delegation, structural caller-scope subset check goes inside the
 * provider.
@@ -71459,18 +71602,6 @@ var userManagementCapability = {
 			auth: "admin",
 			access: "delete"
 		}),
-		createScopedToken: method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
-		revokeScopedToken: method(z.object({ id: z.string() }), z.object({ success: z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin",
-			access: "delete"
-		}),
-		validateScopedToken: method(z.object({ token: z.string() }), ScopedTokenSummarySchema.nullable(), { access: "view" }),
-		listScopedTokens: method(z.object({ userId: z.string() }), z.array(ScopedTokenSummarySchema), { auth: "admin" }),
 		setupTotp: method(z.object({ userId: z.string() }), TotpSetupResultSchema, {
 			kind: "mutation",
 			auth: "admin",
@@ -77959,7 +78090,7 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		capName: "llm",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
 	"llm.listNodeModels": {
 		capName: "llm",
@@ -82623,12 +82754,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.createScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.createUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -82677,12 +82802,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.listScopedTokens": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.listUsers": {
 		capName: "user-management",
 		capScope: "system",
@@ -82737,12 +82856,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
-	"userManagement.revokeScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"userManagement.setupTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -82773,12 +82886,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.validateScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.verifyTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -88363,4 +88470,4 @@ function armRemovalReconcile(opts) {
 	return () => clearInterval(timer);
 }
 //#endregion
-export { STORAGE_ADMIN_MOVED_COLLECTIONS as $, normalizeNodeId as $i, resolveAppConnections as $n, DeclarationRefusedError as $r, enumerateInferenceDevices as $t, DEVICE_TOMBSTONE_RETENTION_MS as A, collectSecretLeaves as Ai, logDestinationCapability as An, withLocationMode as Ar, composerCapability as At, HUB_MDNS_TXT_KEYS as B, expandCapMethods as Bi, normalizeUnit as Bn, createStatefulExpressionMemory as Br, databaseSnapshotCapability as Bt, DATA_STORE_DATABASES as C, WELL_KNOWN_TAB_MAP as Ci, keychainAdminCapability as Cn, supportedRuntimes as Cr, buildDeviceEnrollmentLink as Ct, DEVICE_NONCE_TTL_MS as D, assertValidDeclaration as Di, lifecycleJobSchema as Dn, vectorDimFromBase64 as Dr, cameraGridLayoutCapability as Dt, DEVICE_ENROLLMENT_TTL_MS as E, asString$1 as Ei, legacyModeOf as En, validateCustomAddress as Er, calendarsCapability as Et, FIRST_LEVEL_MACRO_CLASSES as F, declarationsOf as Fi, memoizePinnedFfmpeg as Fn, composedDeviceStableId as Fr, coreBlockIdFromAddonId as Ft, LegacyStorageLocationDefaultSchema as G, isKeychainStoredField as Gi, planComposition as Gn, DeviceType as Gr, describeComposableCaps as Gt, KeychainAuditEntrySchema as H, hydrateSchema as Hi, objectInputDeclaresRequiredDeviceId as Hn, toExpressionValue as Hr, decodeVectorBase64 as Ht, FieldClaimModeSchema as I, defineCustomActions as Ii, metricsProviderCapability as In, compositionFeatureEnabled as Ir, coreBlockSourceKind as It, MOTION_CLOSE_AFTER_MS as J, isSecretMarkerLike as Ji, ptzAutotrackCapability as Jn, BatchTooLargeError as Jr, deviceHistoryCapability as Jt, METHOD_ACCESS_MAP as K, isSecretClear as Ki, platformProbeCapability as Kn, errMsg as Kr, deviceCredentialsCapability as Kt, FieldClaimSchema as L, defineRecordKinds as Li, modeMayWrite as Ln, compositionItemFieldPath as Lr, coreBlocksCapability as Lt, DeclaredDevices as M, collectZodSecretPaths as Mi, looseSchema as Mn, buildFfmpegArgs as Mr, compositionSourceRefs as Mt, DeviceStatusSchema as N, createEvent as Ni, mayReadLocation as Nn, cloneStatefulExpressionMemory as Nr, coreBlockAddonId as Nt, DEVICE_SAN_CREDENTIAL_PREFIX as O, buildSecretRef as Oi, localNetworkCapability as On, vectorIndexDimConflictError as Or, canonicalIconKey as Ot, DeviceTombstoneSchema as P, customAction as Pi, mayWriteToLocation as Pn, composedDeviceRef as Pr, coreBlockComposition as Pt, STORAGE_ACCESS_FALLBACK as Q, nodePin as Qi, replacedFieldKeys as Qn, DEVICE_STATUS_METHOD as Qr, deviceStatusCapability as Qt, HISTORY_CATALOG as R, emitDownForOwnedCaps as Ri, motionCapability as Rn, compositionSliceKey as Rr, createDeviceExtensionProvider as Rt, DATABASE_SNAPSHOT_TIMEOUT_MS as S, UnknownRecordKindError as Si, kebabToCamel as Sn, streamQualityLabel as Sr, buildCapabilityLookup as St, DERIVED_CAMERA_SILENCED_CAP_NAMES as T, asNumber as Ti, legacyAutoLinkIds as Tn, validateComposition as Tr, buildStreamParamsConfigSchema as Tt, KeychainResetRecordSchema as U, isDeviceConfigCap as Ui, parseStreamParamsFormPatch as Un, DeviceFeature as Ur, defineExtensionSlotProvider as Ut, KEYCHAIN_RESET_TRIGGER_ACTOR as V, formatSecretScope as Vi, objectInputDeclaresAddonId as Vn, disarmRoseMemory as Vr, declarationOwnerNodeId as Vt, LOG_LEVEL_RANK as W, isEvent as Wi, pickAppLinkHub as Wn, DeviceRole as Wr, deriveBatteryPresence as Wt, RECORDING_SOURCE_CAMSTACK_ADDON as X, makeSecretMarker as Xi, recordsCapability as Xn, DATAPLANE_SECRET_HEADER as Xr, deviceRemovalHookCapability as Xt, NetworkTunnelStartedDataSchema as Y, isSecretRefOwnedBy as Yi, recordEntriesCapability as Yn, CALLER_STAMPED_CAPABILITIES as Yr, deviceManagerCapability as Yt, RecordingStatusSchema as Z, mapSecretLeaves as Zi, reducePoints as Zn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Zr, deviceStateCapability as Zt, CatalogFileSchema as _, userError as _a, RecordTooLargeError as _i, isCollectionArrayMethod as _n, storageCapability as _r, armRemovalReconcile as _t, ApiKeyRecordSchema as a, parseSettingsBrokersAdoptsFrom as aa, PlaintextSecretError as ai, expressionContainsBuiltinCall as an, resolveMethodAuth as ar, StorageCleanupJobSchema as at, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as b, SECRET_CLEAR as bi, isObjectInput as bn, storageProviderCapability as br, bareAddonId as bt, CAMERA_SWITCH_ORDER as c, resolveCapMount as ca, RECORD_DELETE_BATCH as ci, foldSnapshotByFunction as cn, scopesAllowAddon as cr, StorageMigrationJobSchema as ct, CATALOG_LANGS as d, secretTreeFromPaths as da, REMOVE_LEAF as di, gbToBytes as dn, settingsStoreCapability as dr, addonPagesCapability as dt, normalizeSecretOwner as ea, FilterRequiredError as ei, enumerateItemArrayFields as en, resolveBucketMs as er, STORAGE_ADMIN_SCOPED_BASES as et, COMPOSED_ITEM_FIXED_FIELDS as f, secretTreeFromSchema as fa, RUNTIME_DEFAULTS as fi, interpolate as fn, shortHostname as fr, addonSettingsCapability as ft, CalendarPreferencesSchema as g, transformSecretWrite as ga, RecordNotFoundError as gi, isArrayOutputSchema as gn, storageAdminCapability as gr, alertsCapability as gt, CORE_BLOCK_ADDON_PREFIX as h, toSecretFieldView as ha, RecordKindDeclarationSchema as hi, isAppLinkBase as hn, splitTranslationRef as hr, alertEpisodePayload as ht, AlertSchema as i, parseSettingsArrayAdoptsFrom as ia, NoCallerError as ii, expandContainer as in, resolveLocationMode as ir, SsoBridgeClaimsSchema as it, DataStoreDatabaseSchema as j, collectSecretMarkerRefs as ji, logLevelAtMost as jn, COMPOSER_ADDON_ID as jr, compositionFieldKey as jt, DEVICE_SAN_USER_PREFIX as k, collectSecretConfigKeys as ki, locationIconKey as kn, vectorStoreCapability as kr, checkRoleAddress as kt, CAMSTACK_APP_LINK_ORIGIN as l, resolveSecretMarkers as la, RECORD_SWEEP_INTERVAL_MS as li, formatDeviceRevoker as ln, scopesAllowDeviceCap as lr, TokenScopeSchema as lt, CORE_BLOCKS_ADDON_ID as m, toNodeId as ma, ReadinessTimeoutError as mi, isAlertEpisodeSeverity as mn, snapshotCapability as mr, alertEpisodeId as mt, AGENT_MDNS_TXT_KEYS as n, parseJsonUnknown as na, HISTORY_DEFAULT_MIN_INTERVAL_MS as ni, evaluateCompositionField as nn, resolveCoreBlockFiles as nr, ScopedTokenSchema as nt, BaseDevice as o, readinessKey as oa, RECORD_BATCH_MAX as oi, extractNestedAddonId as on, resolveNotificationTapAddress as or, StorageLocationModeSchema as ot, COMPOSER_RUNNER_ID as p, sleep as pa, ReadinessRegistry as pi, isAlertEpisodeOpen as pn, siteZoneKey as pr, addonWidgetsCapability as pt, MINUTES_PER_DAY as q, isSecretMarker as qi, procedureAuthKey as qn, BaseAddon as qr, deviceExtensionCapability as qt, ALL_CAPABILITY_DEFINITIONS as r, parseSecretRef as ra, InvalidRecordError as ri, evictionPolicyOfLocation as rn, resolveHubAddressRoles as rr, ServerNameSchema as rt, BatteryStatusSchema as s, recordSecretRef as sa, RECORD_BATCH_MAX_BYTES as si, filesystemBrowseCapability as sn, runtimeStatePolicyFor as sr, StorageLocationTypeSchema as st, AGENT_MDNS_SERVICE_TYPE as t, parseJsonObject as ta, ForeignSecretMarkerError as ti, enumerateSchemaFields as tn, resolveCoreBlockEntry as tr, STREAM_PROFILE_META as tt, CAP_NAMES_WITH_STATUS as u, scopeKey as ua, REDACTED_SECRET as ui, formatMinutes as un, scoreRuntimes as ur, UserRecordSchema as ut, CoreBlockSchema as v, withoutCallerStamp as va, RecordUniqueViolationError as vi, isDefaultAppConnectionEndpoint as vn, storageMigrationCapability as vr, authProviderCapability as vt, DAY_NAMES as w, asJsonObject as wi, keychainCapability as wn, userManagementCapability as wr, buildDeviceSignatureMessage as wt, DATABASE_SNAPSHOT_SUFFIX as x, UnindexedFilterError as xi, isVoidInput as xn, streamCatalogCapability as xr, batteryCapability as xt, CredentialTokenClaimsSchema as y, EventCategory as ya, RevConflictError as yi, isLocationEnabled as yn, storageOccupancyCapability as yr, backupCapability as yt, HUB_MDNS_SERVICE_TYPE as z, emitReadiness as zi, normalizeCoreBlockWrite as zn, compositionSourceKey as zr, dataStoreProviderCapability as zt };
+export { PreferenceNamespaceSchema as $, isSecretMarker as $i, procedureAuthKey as $n, BaseAddon as $r, deviceHistoryCapability as $t, DEVICE_SAN_USER_PREFIX as A, asJsonObject as Ai, keychainCapability as An, userManagementCapability as Ar, buildStreamParamsConfigSchema as At, HUB_MDNS_SERVICE_TYPE as B, customAction as Bi, mayWriteToLocation as Bn, composedDeviceRef as Br, coreBlockIdFromAddonId as Bt, DATABASE_SNAPSHOT_TIMEOUT_MS as C, userError as Ca, RecordTooLargeError as Ci, isCredentialTokenPayload as Cn, storageCapability as Cr, authProviderCapability as Ct, DEVICE_ENROLLMENT_TTL_MS as D, UnindexedFilterError as Di, isVoidInput as Dn, streamCatalogCapability as Dr, buildCapabilityLookup as Dt, DERIVED_CAMERA_SILENCED_CAP_NAMES as E, SECRET_CLEAR as Ei, isObjectInput as En, storageProviderCapability as Er, batteryCapability as Et, DeviceTombstoneSchema as F, collectSecretConfigKeys as Fi, locationIconKey as Fn, vectorStoreCapability as Fr, composerCapability as Ft, LOG_LEVEL_RANK as G, emitReadiness as Gi, normalizeCoreBlockWrite as Gn, compositionSourceKey as Gr, databaseSnapshotCapability as Gt, KEYCHAIN_RESET_TRIGGER_ACTOR as H, defineCustomActions as Hi, metricsProviderCapability as Hn, compositionFeatureEnabled as Hr, coreBlocksCapability as Ht, FIRST_LEVEL_MACRO_CLASSES as I, collectSecretLeaves as Ii, logDestinationCapability as In, withLocationMode as Ir, compositionFieldKey as It, MINUTES_PER_DAY as J, hydrateSchema as Ji, objectInputDeclaresRequiredDeviceId as Jn, toExpressionValue as Jr, defineExtensionSlotProvider as Jt, LegacyStorageLocationDefaultSchema as K, expandCapMethods as Ki, normalizeUnit as Kn, createStatefulExpressionMemory as Kr, declarationOwnerNodeId as Kt, FieldClaimModeSchema as L, collectSecretMarkerRefs as Li, logLevelAtMost as Ln, COMPOSER_ADDON_ID as Lr, compositionSourceRefs as Lt, DataStoreDatabaseSchema as M, asString$1 as Mi, legacyModeOf as Mn, validateCustomAddress as Mr, cameraGridLayoutCapability as Mt, DeclaredDevices as N, assertValidDeclaration as Ni, lifecycleJobSchema as Nn, vectorDimFromBase64 as Nr, canonicalIconKey as Nt, DEVICE_NONCE_TTL_MS as O, UnknownRecordKindError as Oi, kebabToCamel as On, streamQualityLabel as Or, buildDeviceEnrollmentLink as Ot, DeviceStatusSchema as P, buildSecretRef as Pi, localNetworkCapability as Pn, vectorIndexDimConflictError as Pr, checkRoleAddress as Pt, PreferenceDeviceIdSchema as Q, isSecretClear as Qi, platformProbeCapability as Qn, errMsg as Qr, deviceExtensionCapability as Qt, FieldClaimSchema as R, collectZodSecretPaths as Ri, looseSchema as Rn, buildFfmpegArgs as Rr, coreBlockAddonId as Rt, DATABASE_SNAPSHOT_SUFFIX as S, transformSecretWrite as Sa, RecordNotFoundError as Si, isCollectionArrayMethod as Sn, storageAdminCapability as Sr, armRemovalReconcile as St, DAY_NAMES as T, EventCategory as Ta, RevConflictError as Ti, isLocationEnabled as Tn, storageOccupancyCapability as Tr, bareAddonId as Tt, KeychainAuditEntrySchema as U, defineRecordKinds as Ui, modeMayWrite as Un, compositionItemFieldPath as Ur, createDeviceExtensionProvider as Ut, HUB_MDNS_TXT_KEYS as V, declarationsOf as Vi, memoizePinnedFfmpeg as Vn, composedDeviceStableId as Vr, coreBlockSourceKind as Vt, KeychainResetRecordSchema as W, emitDownForOwnedCaps as Wi, motionCapability as Wn, compositionSliceKey as Wr, dataStoreProviderCapability as Wt, NetworkTunnelStartedDataSchema as X, isEvent as Xi, pickAppLinkHub as Xn, DeviceRole as Xr, describeComposableCaps as Xt, MOTION_CLOSE_AFTER_MS as Y, isDeviceConfigCap as Yi, parseStreamParamsFormPatch as Yn, DeviceFeature as Yr, deriveBatteryPresence as Yt, PREFERENCES_MAX_VALUE_BYTES as Z, isKeychainStoredField as Zi, planComposition as Zn, DeviceType as Zr, deviceCredentialsCapability as Zt, CalendarPreferencesSchema as _, secretTreeFromPaths as _a, REMOVE_LEAF as _i, interpolate as _n, settingsStoreCapability as _r, addonSettingsCapability as _t, ApiKeyRecordSchema as a, normalizeNodeId as aa, DeclarationRefusedError as ai, enumerateItemArrayFields as an, resolveAppConnections as ar, STORAGE_ADMIN_SCOPED_BASES as at, CredentialTokenClaimsSchema as b, toNodeId as ba, ReadinessTimeoutError as bi, isAppLinkBase as bn, snapshotCapability as br, alertEpisodePayload as bt, CAMERA_SWITCH_ORDER as c, parseJsonUnknown as ca, HISTORY_DEFAULT_MIN_INTERVAL_MS as ci, evictionPolicyOfLocation as cn, resolveCoreBlockFiles as cr, ServerNameSchema as ct, CATALOG_LANGS as d, parseSettingsBrokersAdoptsFrom as da, PlaintextSecretError as di, extractNestedAddonId as dn, resolveMethodAuth as dr, StorageLocationModeSchema as dt, isSecretMarkerLike as ea, BatchTooLargeError as ei, deviceManagerCapability as en, ptzAutotrackCapability as er, PreferenceValueSchema as et, COMPOSED_ITEM_FIXED_FIELDS as f, readinessKey as fa, RECORD_BATCH_MAX as fi, filesystemBrowseCapability as fn, resolveNotificationTapAddress as fr, StorageLocationTypeSchema as ft, CREDENTIAL_TOKEN_AUDIENCE as g, scopeKey as ga, REDACTED_SECRET as gi, gbToBytes as gn, scoreRuntimes as gr, addonPagesCapability as gt, CORE_BLOCK_ADDON_PREFIX as h, resolveSecretMarkers as ha, RECORD_SWEEP_INTERVAL_MS as hi, formatMinutes as hn, scopesAllowDeviceCap as hr, UserRecordSchema as ht, AlertSchema as i, nodePin as ia, DEVICE_STATUS_METHOD as ii, enumerateInferenceDevices as in, replacedFieldKeys as ir, STORAGE_ADMIN_MOVED_COLLECTIONS as it, DEVICE_TOMBSTONE_RETENTION_MS as j, asNumber as ji, legacyAutoLinkIds as jn, validateComposition as jr, calendarsCapability as jt, DEVICE_SAN_CREDENTIAL_PREFIX as k, WELL_KNOWN_TAB_MAP as ki, keychainAdminCapability as kn, supportedRuntimes as kr, buildDeviceSignatureMessage as kt, CAMSTACK_APP_LINK_ORIGIN as l, parseSecretRef as la, InvalidRecordError as li, expandContainer as ln, resolveHubAddressRoles as lr, SsoBridgeClaimsSchema as lt, CORE_BLOCKS_ADDON_ID as m, resolveCapMount as ma, RECORD_DELETE_BATCH as mi, formatDeviceRevoker as mn, scopesAllowAddon as mr, TokenScopeSchema as mt, AGENT_MDNS_TXT_KEYS as n, makeSecretMarker as na, DATAPLANE_SECRET_HEADER as ni, deviceStateCapability as nn, recordsCapability as nr, RecordingStatusSchema as nt, BaseDevice as o, normalizeSecretOwner as oa, FilterRequiredError as oi, enumerateSchemaFields as on, resolveBucketMs as or, STREAM_PROFILE_META as ot, COMPOSER_RUNNER_ID as p, recordSecretRef as pa, RECORD_BATCH_MAX_BYTES as pi, foldSnapshotByFunction as pn, runtimeStatePolicyFor as pr, StorageMigrationJobSchema as pt, METHOD_ACCESS_MAP as q, formatSecretScope as qi, objectInputDeclaresAddonId as qn, disarmRoseMemory as qr, decodeVectorBase64 as qt, ALL_CAPABILITY_DEFINITIONS as r, mapSecretLeaves as ra, DEVICE_SETTINGS_CONTRIBUTION_METHODS as ri, deviceStatusCapability as rn, reducePoints as rr, STORAGE_ACCESS_FALLBACK as rt, BatteryStatusSchema as s, parseJsonObject as sa, ForeignSecretMarkerError as si, evaluateCompositionField as sn, resolveCoreBlockEntry as sr, ScopedTokenSchema as st, AGENT_MDNS_SERVICE_TYPE as t, isSecretRefOwnedBy as ta, CALLER_STAMPED_CAPABILITIES as ti, deviceRemovalHookCapability as tn, recordEntriesCapability as tr, RECORDING_SOURCE_CAMSTACK_ADDON as tt, CAP_NAMES_WITH_STATUS as u, parseSettingsArrayAdoptsFrom as ua, NoCallerError as ui, expressionContainsBuiltinCall as un, resolveLocationMode as ur, StorageCleanupJobSchema as ut, CatalogFileSchema as v, secretTreeFromSchema as va, RUNTIME_DEFAULTS as vi, isAlertEpisodeOpen as vn, shortHostname as vr, addonWidgetsCapability as vt, DATA_STORE_DATABASES as w, withoutCallerStamp as wa, RecordUniqueViolationError as wi, isDefaultAppConnectionEndpoint as wn, storageMigrationCapability as wr, backupCapability as wt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as x, toSecretFieldView as xa, RecordKindDeclarationSchema as xi, isArrayOutputSchema as xn, splitTranslationRef as xr, alertsCapability as xt, CoreBlockSchema as y, sleep as ya, ReadinessRegistry as yi, isAlertEpisodeSeverity as yn, siteZoneKey as yr, alertEpisodeId as yt, HISTORY_CATALOG as z, createEvent as zi, mayReadLocation as zn, cloneStatefulExpressionMemory as zr, coreBlockComposition as zt };