@camstack/system 1.2.472 → 1.2.473

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (84) hide show
  1. package/dist/{agent-https-bnyFRK7Y.js → agent-https-B9Q3-IKd.js} +2 -5
  2. package/dist/{agent-https-JhvY1axF.mjs → agent-https-DOwn4pqL.mjs} +3 -6
  3. package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js +1 -1
  4. package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs +1 -1
  5. package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js +1 -1
  6. package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs +1 -1
  7. package/dist/builtins/alerts/alerts.addon.js +1 -1
  8. package/dist/builtins/alerts/alerts.addon.mjs +1 -1
  9. package/dist/builtins/autotrack/index.js +1 -1
  10. package/dist/builtins/autotrack/index.mjs +1 -1
  11. package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js +2 -2
  12. package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs +2 -2
  13. package/dist/builtins/calendars/calendars.addon.js +1 -1
  14. package/dist/builtins/calendars/calendars.addon.mjs +1 -1
  15. package/dist/builtins/camera-grid/index.js +1 -1
  16. package/dist/builtins/camera-grid/index.mjs +1 -1
  17. package/dist/builtins/composer/composer.addon.js +2 -2
  18. package/dist/builtins/composer/composer.addon.mjs +2 -2
  19. package/dist/builtins/console-logging/index.js +1 -1
  20. package/dist/builtins/console-logging/index.mjs +1 -1
  21. package/dist/builtins/core-blocks/core-blocks.addon.js +2 -2
  22. package/dist/builtins/core-blocks/core-blocks.addon.mjs +2 -2
  23. package/dist/builtins/device-history/device-history.addon.js +1 -1
  24. package/dist/builtins/device-history/device-history.addon.mjs +1 -1
  25. package/dist/builtins/device-manager/device-manager.addon.js +2 -2
  26. package/dist/builtins/device-manager/device-manager.addon.mjs +2 -2
  27. package/dist/builtins/hub-forwarder/index.js +1 -1
  28. package/dist/builtins/hub-forwarder/index.mjs +1 -1
  29. package/dist/builtins/keychain/index.js +3 -3
  30. package/dist/builtins/keychain/index.mjs +3 -3
  31. package/dist/builtins/liveness-monitor/liveness-monitor.addon.js +1 -1
  32. package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs +1 -1
  33. package/dist/builtins/local-auth/local-auth.addon.js +16 -2
  34. package/dist/builtins/local-auth/local-auth.addon.mjs +16 -2
  35. package/dist/builtins/local-auth/person-scopes.d.ts +7 -0
  36. package/dist/builtins/local-network/local-network.addon.js +2 -2
  37. package/dist/builtins/local-network/local-network.addon.mjs +2 -2
  38. package/dist/builtins/loki-logging/index.js +1 -1
  39. package/dist/builtins/loki-logging/index.mjs +1 -1
  40. package/dist/builtins/native-metrics/native-metrics.addon.js +1 -1
  41. package/dist/builtins/native-metrics/native-metrics.addon.mjs +1 -1
  42. package/dist/builtins/platform-probe/accelerator-facts-probe.d.ts +24 -0
  43. package/dist/builtins/platform-probe/index.js +110 -10
  44. package/dist/builtins/platform-probe/index.mjs +109 -10
  45. package/dist/builtins/platform-probe/platform-scorer.d.ts +10 -2
  46. package/dist/builtins/record-entries/index.js +1 -1
  47. package/dist/builtins/record-entries/index.mjs +1 -1
  48. package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js +1 -1
  49. package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs +1 -1
  50. package/dist/builtins/snapshot/index.js +1 -1
  51. package/dist/builtins/snapshot/index.mjs +1 -1
  52. package/dist/builtins/sqlite-storage/filesystem-storage.addon.js +1 -1
  53. package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs +1 -1
  54. package/dist/builtins/sqlite-storage/index.js +1 -1
  55. package/dist/builtins/sqlite-storage/index.mjs +1 -1
  56. package/dist/builtins/sqlite-storage/sqlite-settings.addon.js +3 -3
  57. package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs +3 -3
  58. package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js +1 -1
  59. package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs +1 -1
  60. package/dist/builtins/system-config/system-config.addon.js +3 -3
  61. package/dist/builtins/system-config/system-config.addon.mjs +3 -3
  62. package/dist/builtins/winston-logging/index.js +1 -1
  63. package/dist/builtins/winston-logging/index.mjs +1 -1
  64. package/dist/{composition-sources-D3h-tNoJ.js → composition-sources-Dj_nInUQ.js} +1 -1
  65. package/dist/{composition-sources-BY6rFuAE.mjs → composition-sources-cwD35HB0.mjs} +1 -1
  66. package/dist/{constants-CqbO6e9i.js → constants-XkWSVvgY.js} +1 -1
  67. package/dist/{constants-zBiEodEM.mjs → constants-p5mPM1iL.mjs} +1 -1
  68. package/dist/{device-ca-CfiIg3a9.js → device-ca-BXzQ1pYj.js} +1 -1
  69. package/dist/{device-ca-BWTWWBcc.mjs → device-ca-DyUtcpf4.mjs} +1 -1
  70. package/dist/{dist-DX5Fu3mV.js → dist-Bmah6waF.js} +109 -12
  71. package/dist/{dist-CdFkkmXW.mjs → dist-C9lbdBL5.mjs} +104 -13
  72. package/dist/file-host-worker.js +1 -1
  73. package/dist/file-host-worker.mjs +1 -1
  74. package/dist/{hub-mdns-ciao-CYp1Gipm.mjs → hub-mdns-ciao-BemeCNGe.mjs} +2 -2
  75. package/dist/{hub-mdns-ciao-C174UDzO.js → hub-mdns-ciao-CUr6ewsX.js} +2 -2
  76. package/dist/index.js +9 -7
  77. package/dist/index.mjs +9 -7
  78. package/dist/{restore-archive-BX0gaKtG.mjs → restore-archive-C0aohmAK.mjs} +1 -1
  79. package/dist/{restore-archive-B2jIFfu_.js → restore-archive-DbPmyjiM.js} +1 -1
  80. package/dist/{retired-settings-keys-C_Kjp-Bj.mjs → retired-settings-keys-CWp7ZSeA.mjs} +8 -0
  81. package/dist/{retired-settings-keys-CGUqX-Oz.js → retired-settings-keys-DorakcxV.js} +8 -0
  82. package/dist/{wal-maintenance-Dxqd5igw.js → wal-maintenance-BT8Ns0W3.js} +0 -0
  83. package/dist/{wal-maintenance-KHzJXlF2.mjs → wal-maintenance-BuB731DK.mjs} +0 -0
  84. package/package.json +6 -6
@@ -1,5 +1,5 @@
1
1
  const require_chunk = require("./chunk-Cek0wNdY.js");
2
- const require_dist = require("./dist-DX5Fu3mV.js");
2
+ const require_dist = require("./dist-Bmah6waF.js");
3
3
  const require_x509_es = require("./x509.es-C4cOo48M.js");
4
4
  let zod = require("zod");
5
5
  let node_crypto = require("node:crypto");
@@ -917,14 +917,11 @@ function installAgentHttps(dataDir, input) {
917
917
  if (!leaf.verify(ca.publicKey)) throw new AgentHttpsInstallError("the certificate is not signed by the CA that came with it");
918
918
  if (new Date(leaf.validTo).getTime() <= Date.now()) throw new AgentHttpsInstallError("the certificate is already expired");
919
919
  (0, node_fs.mkdirSync)(paths.dir, { recursive: true });
920
- const tmp = `${paths.bundlePath}.tmp`;
921
- (0, _camstack_types_node.writeOwnerOnlyFileSync)(tmp, JSON.stringify({
920
+ (0, _camstack_types_node.writeOwnerOnlyFileSync)(paths.bundlePath, JSON.stringify({
922
921
  keyPem,
923
922
  certPem: input.certPem,
924
923
  caCertPem: input.caCertPem
925
924
  }));
926
- (0, node_fs.renameSync)(tmp, paths.bundlePath);
927
- (0, node_fs.chmodSync)(paths.bundlePath, 384);
928
925
  writeFileAtomic(paths.certPath, input.certPem.endsWith("\n") ? input.certPem : `${input.certPem}\n`);
929
926
  return {
930
927
  keyPem,
@@ -1,4 +1,4 @@
1
- import { Ki as defineRecordKinds } from "./dist-CdFkkmXW.mjs";
1
+ import { qi as defineRecordKinds } from "./dist-C9lbdBL5.mjs";
2
2
  import { S as backdatedNotBefore, _ as NameConstraints, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, g as GeneralSubtrees, h as GeneralSubtree, i as Extension, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension, v as GeneralName, x as AsnConvert } from "./x509.es-DK__ETIe.mjs";
3
3
  import { z } from "zod";
4
4
  import { X509Certificate, createHash, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
@@ -6,7 +6,7 @@ import { writeOwnerOnlyFileSync } from "@camstack/types/node";
6
6
  import { isIP } from "node:net";
7
7
  import { join } from "node:path";
8
8
  import * as os$1 from "node:os";
9
- import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
9
+ import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
10
10
  var MeshNodeCertificateBodySchema = z.object({
11
11
  nodeId: z.string(),
12
12
  serial: z.string(),
@@ -915,14 +915,11 @@ function installAgentHttps(dataDir, input) {
915
915
  if (!leaf.verify(ca.publicKey)) throw new AgentHttpsInstallError("the certificate is not signed by the CA that came with it");
916
916
  if (new Date(leaf.validTo).getTime() <= Date.now()) throw new AgentHttpsInstallError("the certificate is already expired");
917
917
  mkdirSync(paths.dir, { recursive: true });
918
- const tmp = `${paths.bundlePath}.tmp`;
919
- writeOwnerOnlyFileSync(tmp, JSON.stringify({
918
+ writeOwnerOnlyFileSync(paths.bundlePath, JSON.stringify({
920
919
  keyPem,
921
920
  certPem: input.certPem,
922
921
  caCertPem: input.caCertPem
923
922
  }));
924
- renameSync(tmp, paths.bundlePath);
925
- chmodSync(paths.bundlePath, 384);
926
923
  writeFileAtomic(paths.certPath, input.certPem.endsWith("\n") ? input.certPem : `${input.certPem}\n`);
927
924
  return {
928
925
  keyPem,
@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  const require_chunk = require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
8
8
  let node_crypto = require("node:crypto");
9
9
  let node_path = require("node:path");
@@ -1,4 +1,4 @@
1
- import { $r as errMsg, Da as EventCategory, _t as addonPagesCapability, ei as BaseAddon } from "../../dist-CdFkkmXW.mjs";
1
+ import { Oa as EventCategory, _t as addonPagesCapability, ei as errMsg, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
2
2
  import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
3
3
  import { createHash, randomUUID } from "node:crypto";
4
4
  import * as path$1 from "node:path";
@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  const require_chunk = require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
8
8
  let node_crypto = require("node:crypto");
9
9
  let node_path = require("node:path");
@@ -1,4 +1,4 @@
1
- import { $r as errMsg, Da as EventCategory, ei as BaseAddon, yt as addonWidgetsCapability } from "../../dist-CdFkkmXW.mjs";
1
+ import { Oa as EventCategory, ei as errMsg, ti as BaseAddon, yt as addonWidgetsCapability } from "../../dist-C9lbdBL5.mjs";
2
2
  import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
3
3
  import { createHash, randomUUID } from "node:crypto";
4
4
  import * as path$1 from "node:path";
@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
8
8
  //#region src/builtins/alerts/alert-episode-policy.ts
9
9
  /**
@@ -1,4 +1,4 @@
1
- import { $r as errMsg, Da as EventCategory, Ki as defineRecordKinds, St as alertsCapability, Ui as createEvent, bn as isAlertEpisodeSeverity, bt as alertEpisodeId, ei as BaseAddon, i as AlertSchema, xt as alertEpisodePayload, yn as isAlertEpisodeOpen } from "../../dist-CdFkkmXW.mjs";
1
+ import { Oa as EventCategory, St as alertsCapability, Wi as createEvent, bn as isAlertEpisodeSeverity, bt as alertEpisodeId, ei as errMsg, i as AlertSchema, qi as defineRecordKinds, ti as BaseAddon, xt as alertEpisodePayload, yn as isAlertEpisodeOpen } from "../../dist-C9lbdBL5.mjs";
2
2
  import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
3
3
  //#region src/builtins/alerts/alert-episode-policy.ts
4
4
  /**
@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  //#region src/builtins/autotrack/autotrack-config.ts
8
8
  var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
9
9
  deadZoneFraction: .5,
@@ -1,4 +1,4 @@
1
- import { $r as errMsg, Da as EventCategory, Et as bareAddonId, I as FIRST_LEVEL_MACRO_CLASSES, ea as isEvent, ei as BaseAddon, tr as ptzAutotrackCapability } from "../../dist-CdFkkmXW.mjs";
1
+ import { Et as bareAddonId, I as FIRST_LEVEL_MACRO_CLASSES, Oa as EventCategory, ei as errMsg, nr as ptzAutotrackCapability, ta as isEvent, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
2
2
  //#region src/builtins/autotrack/autotrack-config.ts
3
3
  var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
4
4
  deadZoneFraction: .5,
@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  const require_chunk = require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
8
- const require_restore_archive = require("../../restore-archive-B2jIFfu_.js");
8
+ const require_restore_archive = require("../../restore-archive-DbPmyjiM.js");
9
9
  let node_crypto = require("node:crypto");
10
10
  let node_fs_promises = require("node:fs/promises");
11
11
  node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -1,6 +1,6 @@
1
- import { Da as EventCategory, Er as storageOccupancyCapability, Sa as toNodeId, Tt as backupCapability, Vn as mayWriteToLocation, ca as nodePin, ei as BaseAddon } from "../../dist-CdFkkmXW.mjs";
1
+ import { Ca as toNodeId, Dr as storageOccupancyCapability, Oa as EventCategory, Tt as backupCapability, Vn as mayWriteToLocation, la as nodePin, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
2
2
  import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
3
- import { _ as backupRecordStoresOf, a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-BX0gaKtG.mjs";
3
+ import { _ as backupRecordStoresOf, a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-C0aohmAK.mjs";
4
4
  import { randomUUID } from "node:crypto";
5
5
  import * as fsp from "node:fs/promises";
6
6
  import * as path$1 from "node:path";
@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
8
8
  let zod = require("zod");
9
9
  //#region src/builtins/calendars/calendar-color.ts
@@ -1,4 +1,4 @@
1
- import { Ki as defineRecordKinds, Mt as calendarsCapability, ei as BaseAddon, g as CalendarPreferencesSchema } from "../../dist-CdFkkmXW.mjs";
1
+ import { Mt as calendarsCapability, g as CalendarPreferencesSchema, qi as defineRecordKinds, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
2
2
  import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
3
3
  import { z } from "zod";
4
4
  //#region src/builtins/calendars/calendar-color.ts
@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  let zod = require("zod");
8
8
  let _camstack_types_node = require("@camstack/types/node");
9
9
  let node_path = require("node:path");
@@ -1,4 +1,4 @@
1
- import { $r as errMsg, Da as EventCategory, Gn as motionCapability, Hn as memoizePinnedFfmpeg, N as DeclaredDevices, Nt as cameraGridLayoutCapability, Or as streamCatalogCapability, Qi as hydrateSchema, Qr as DeviceType, T as DERIVED_CAMERA_SILENCED_CAP_NAMES, Ui as createEvent, X as MOTION_CLOSE_AFTER_MS, Xr as DeviceFeature, a as BaseDevice, ei as BaseAddon, qt as declarationOwnerNodeId, xr as snapshotCapability, zr as buildFfmpegArgs } from "../../dist-CdFkkmXW.mjs";
1
+ import { $i as hydrateSchema, $r as DeviceType, Br as buildFfmpegArgs, Gn as motionCapability, Hn as memoizePinnedFfmpeg, N as DeclaredDevices, Nt as cameraGridLayoutCapability, Oa as EventCategory, Sr as snapshotCapability, T as DERIVED_CAMERA_SILENCED_CAP_NAMES, Wi as createEvent, X as MOTION_CLOSE_AFTER_MS, Zr as DeviceFeature, a as BaseDevice, ei as errMsg, kr as streamCatalogCapability, qt as declarationOwnerNodeId, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
2
2
  import { z } from "zod";
3
3
  import { FfmpegProcess } from "@camstack/types/node";
4
4
  import { join } from "node:path";
@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
7
- const require_composition_sources = require("../../composition-sources-D3h-tNoJ.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
+ const require_composition_sources = require("../../composition-sources-Dj_nInUQ.js");
8
8
  let zod = require("zod");
9
9
  //#region src/builtins/shared/device-state-changed.ts
10
10
  /** Structural narrowing helper for untrusted bus payloads. */
@@ -1,5 +1,5 @@
1
- import { $r as errMsg, Br as cloneStatefulExpressionMemory, Da as EventCategory, Gr as compositionSliceKey, Hr as composedDeviceStableId, It as composerCapability, Jr as disarmRoseMemory, Kr as compositionSourceKey, Lt as compositionFieldKey, N as DeclaredDevices, Ot as buildCapabilityLookup, Qn as planComposition, Qr as DeviceType, Rr as COMPOSER_ADDON_ID, Ui as createEvent, Ur as compositionFeatureEnabled, Vr as composedDeviceRef, Wr as compositionItemFieldPath, Yr as toExpressionValue, a as BaseDevice, cn as evaluateCompositionField, d as COMPOSED_ITEM_FIXED_FIELDS, dn as expressionContainsBuiltinCall, ei as BaseAddon, qr as createStatefulExpressionMemory, r as ALL_CAPABILITY_DEFINITIONS } from "../../dist-CdFkkmXW.mjs";
2
- import { n as normalizedNativeOwner } from "../../composition-sources-BY6rFuAE.mjs";
1
+ import { $n as planComposition, $r as DeviceType, Gr as compositionItemFieldPath, Hr as composedDeviceRef, It as composerCapability, Jr as createStatefulExpressionMemory, Kr as compositionSliceKey, Lt as compositionFieldKey, N as DeclaredDevices, Oa as EventCategory, Ot as buildCapabilityLookup, Ur as composedDeviceStableId, Vr as cloneStatefulExpressionMemory, Wi as createEvent, Wr as compositionFeatureEnabled, Xr as toExpressionValue, Yr as disarmRoseMemory, a as BaseDevice, cn as evaluateCompositionField, d as COMPOSED_ITEM_FIXED_FIELDS, dn as expressionContainsBuiltinCall, ei as errMsg, qr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, ti as BaseAddon, zr as COMPOSER_ADDON_ID } from "../../dist-C9lbdBL5.mjs";
2
+ import { n as normalizedNativeOwner } from "../../composition-sources-cwD35HB0.mjs";
3
3
  import { z } from "zod";
4
4
  //#region src/builtins/shared/device-state-changed.ts
5
5
  /** Structural narrowing helper for untrusted bus payloads. */
@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  const require_formatter = require("../../formatter-DqAKDlvN.js");
8
8
  //#region src/builtins/console-logging/console-destination.ts
9
9
  var LEVEL_RANK = {
@@ -1,4 +1,4 @@
1
- import { Ln as logDestinationCapability, ei as BaseAddon } from "../../dist-CdFkkmXW.mjs";
1
+ import { Ln as logDestinationCapability, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
2
2
  import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
3
3
  //#region src/builtins/console-logging/console-destination.ts
4
4
  var LEVEL_RANK = {
@@ -1,8 +1,8 @@
1
1
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
2
2
  const require_chunk = require("../../chunk-Cek0wNdY.js");
3
- const require_dist = require("../../dist-DX5Fu3mV.js");
3
+ const require_dist = require("../../dist-Bmah6waF.js");
4
4
  const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
5
- const require_composition_sources = require("../../composition-sources-D3h-tNoJ.js");
5
+ const require_composition_sources = require("../../composition-sources-Dj_nInUQ.js");
6
6
  const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
7
7
  const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");
8
8
  let zod = require("zod");
@@ -1,6 +1,6 @@
1
- import { $r as errMsg, Bt as coreBlockComposition, Ht as coreBlockSourceKind, Ki as defineRecordKinds, Kn as normalizeCoreBlockWrite, Kr as compositionSourceKey, Mr as validateComposition, N as DeclaredDevices, Ot as buildCapabilityLookup, Qi as hydrateSchema, Qn as planComposition, Rt as compositionSourceRefs, Ut as coreBlocksCapability, Vi as collectSecretMarkerRefs, Vr as composedDeviceRef, Vt as coreBlockIdFromAddonId, Zt as describeComposableCaps, _a as resolveSecretMarkers, aa as isSecretRefOwnedBy, ar as replacedFieldKeys, ba as secretTreeFromSchema, cr as resolveCoreBlockEntry, ei as BaseAddon, f as COMPOSER_RUNNER_ID, lr as resolveCoreBlockFiles, m as CORE_BLOCK_ADDON_PREFIX, p as CORE_BLOCKS_ADDON_ID, r as ALL_CAPABILITY_DEFINITIONS, ra as isSecretMarker, v as CoreBlockSchema, wa as transformSecretWrite, zt as coreBlockAddonId } from "../../dist-CdFkkmXW.mjs";
1
+ import { $i as hydrateSchema, $n as planComposition, Bt as coreBlockComposition, Hi as collectSecretMarkerRefs, Hr as composedDeviceRef, Ht as coreBlockSourceKind, Kn as normalizeCoreBlockWrite, N as DeclaredDevices, Nr as validateComposition, Ot as buildCapabilityLookup, Rt as compositionSourceRefs, Ta as transformSecretWrite, Ut as coreBlocksCapability, Vt as coreBlockIdFromAddonId, Zt as describeComposableCaps, ei as errMsg, f as COMPOSER_RUNNER_ID, ia as isSecretMarker, lr as resolveCoreBlockEntry, m as CORE_BLOCK_ADDON_PREFIX, oa as isSecretRefOwnedBy, or as replacedFieldKeys, p as CORE_BLOCKS_ADDON_ID, qi as defineRecordKinds, qr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, ti as BaseAddon, ur as resolveCoreBlockFiles, v as CoreBlockSchema, va as resolveSecretMarkers, xa as secretTreeFromSchema, zt as coreBlockAddonId } from "../../dist-C9lbdBL5.mjs";
2
2
  import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
3
- import { t as describeCompositionSources } from "../../composition-sources-BY6rFuAE.mjs";
3
+ import { t as describeCompositionSources } from "../../composition-sources-cwD35HB0.mjs";
4
4
  import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
5
5
  import { n as unwrapStoredValue, t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";
6
6
  import { createRequire } from "node:module";
@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  //#region src/builtins/device-history/time/bucket-time.ts
8
8
  /**
9
9
  * Bucket arithmetic for the three rollup tiers (D850, plan §4/§5.5).
@@ -1,4 +1,4 @@
1
- import { B as HISTORY_ITEM_CATALOG, Ct as armRemovalReconcile, D as DEVICE_HISTORY_ENERGY_KEY, Da as EventCategory, Ji as emitReadiness, Qr as DeviceType, Zi as historyItemFieldPath, ei as BaseAddon, en as deviceHistoryCapability, li as HISTORY_DEFAULT_MIN_INTERVAL_MS, nn as deviceRemovalHookCapability, z as HISTORY_CATALOG } from "../../dist-CdFkkmXW.mjs";
1
+ import { $r as DeviceType, B as HISTORY_ITEM_CATALOG, Ct as armRemovalReconcile, D as DEVICE_HISTORY_ENERGY_KEY, Oa as EventCategory, Qi as historyItemFieldPath, Yi as emitReadiness, en as deviceHistoryCapability, nn as deviceRemovalHookCapability, ti as BaseAddon, ui as HISTORY_DEFAULT_MIN_INTERVAL_MS, z as HISTORY_CATALOG } from "../../dist-C9lbdBL5.mjs";
2
2
  //#region src/builtins/device-history/time/bucket-time.ts
3
3
  /**
4
4
  * Bucket arithmetic for the three rollup tiers (D850, plan §4/§5.5).
@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
8
8
  const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
9
9
  const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");
10
- const require_retired_settings_keys = require("../../retired-settings-keys-CGUqX-Oz.js");
10
+ const require_retired_settings_keys = require("../../retired-settings-keys-DorakcxV.js");
11
11
  let zod = require("zod");
12
12
  let node_crypto = require("node:crypto");
13
13
  let _camstack_types_node = require("@camstack/types/node");
@@ -1,8 +1,8 @@
1
- import { $i as isDeviceConfigCap, $r as errMsg, $t as deviceExtensionCapability, Ca as toSecretFieldView, Da as EventCategory, Di as SECRET_CLEAR, F as DeviceTombstoneSchema, Hi as collectZodSecretPaths, In as locationIconKey, Ki as defineRecordKinds, L as FieldClaimModeSchema, Mi as WELL_KNOWN_TAB_MAP, Mn as legacyAutoLinkIds, P as DeviceStatusSchema, Pt as canonicalIconKey, Qr as DeviceType, R as FieldClaimSchema, Ta as userError, Wt as createDeviceExtensionProvider, Xn as parseStreamParamsFormPatch, Xr as DeviceFeature, Y as MINUTES_PER_DAY, Yt as defineExtensionSlotProvider, Zr as DeviceRole, _a as resolveSecretMarkers, br as siteZoneKey, ei as BaseAddon, gn as formatMinutes, ia as isSecretMarkerLike, in as deviceStatusCapability, jt as buildStreamParamsConfigSchema, l as CAP_NAMES_WITH_STATUS, mr as runtimeStatePolicyFor, na as isSecretClear, on as enumerateItemArrayFields, ot as STREAM_PROFILE_META, qn as normalizeUnit, r as ALL_CAPABILITY_DEFINITIONS, ra as isSecretMarker, rn as deviceStateCapability, s as CAMERA_SWITCH_ORDER, sn as enumerateSchemaFields, ta as isKeychainStoredField, tn as deviceManagerCapability, un as expandContainer, w as DAY_NAMES, wa as transformSecretWrite, xa as sleep$1, ya as secretTreeFromPaths } from "../../dist-CdFkkmXW.mjs";
1
+ import { $r as DeviceType, $t as deviceExtensionCapability, Ea as userError, F as DeviceTombstoneSchema, In as locationIconKey, L as FieldClaimModeSchema, Mn as legacyAutoLinkIds, Ni as WELL_KNOWN_TAB_MAP, Oa as EventCategory, Oi as SECRET_CLEAR, P as DeviceStatusSchema, Pt as canonicalIconKey, Qr as DeviceRole, R as FieldClaimSchema, Sa as sleep$1, Ta as transformSecretWrite, Ui as collectZodSecretPaths, Wt as createDeviceExtensionProvider, Y as MINUTES_PER_DAY, Yt as defineExtensionSlotProvider, Zn as parseStreamParamsFormPatch, Zr as DeviceFeature, aa as isSecretMarkerLike, ba as secretTreeFromPaths, ea as isDeviceConfigCap, ei as errMsg, gn as formatMinutes, hr as runtimeStatePolicyFor, ia as isSecretMarker, in as deviceStatusCapability, jt as buildStreamParamsConfigSchema, l as CAP_NAMES_WITH_STATUS, na as isKeychainStoredField, on as enumerateItemArrayFields, ot as STREAM_PROFILE_META, qi as defineRecordKinds, qn as normalizeUnit, r as ALL_CAPABILITY_DEFINITIONS, ra as isSecretClear, rn as deviceStateCapability, s as CAMERA_SWITCH_ORDER, sn as enumerateSchemaFields, ti as BaseAddon, tn as deviceManagerCapability, un as expandContainer, va as resolveSecretMarkers, w as DAY_NAMES, wa as toSecretFieldView, xr as siteZoneKey } from "../../dist-C9lbdBL5.mjs";
2
2
  import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
3
3
  import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
4
4
  import { t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";
5
- import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-C_Kjp-Bj.mjs";
5
+ import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CWp7ZSeA.mjs";
6
6
  import { z } from "zod";
7
7
  import { randomUUID } from "node:crypto";
8
8
  import { canonicalDeviceFingerprint } from "@camstack/types/node";
@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  const require_formatter = require("../../formatter-DqAKDlvN.js");
8
8
  //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
9
9
  var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
@@ -1,4 +1,4 @@
1
- import { Ln as logDestinationCapability, ei as BaseAddon } from "../../dist-CdFkkmXW.mjs";
1
+ import { Ln as logDestinationCapability, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
2
2
  import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
3
3
  //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
4
4
  var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  const require_chunk = require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
7
- const require_device_ca = require("../../device-ca-CfiIg3a9.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
+ const require_device_ca = require("../../device-ca-BXzQ1pYj.js");
8
8
  const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
9
- const require_constants = require("../../constants-CqbO6e9i.js");
9
+ const require_constants = require("../../constants-XkWSVvgY.js");
10
10
  const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
11
11
  let node_crypto = require("node:crypto");
12
12
  let _camstack_types_node = require("@camstack/types/node");
@@ -1,7 +1,7 @@
1
- import { An as keychainAdminCapability, Da as EventCategory, G as KeychainResetRecordSchema, Ki as defineRecordKinds, U as KEYCHAIN_RESET_TRIGGER_ACTOR, W as KeychainAuditEntrySchema, Xi as formatSecretScope, ei as BaseAddon, jn as keychainCapability, pa as parseSecretRef, ua as normalizeSecretOwner } from "../../dist-CdFkkmXW.mjs";
2
- import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-BWTWWBcc.mjs";
1
+ import { An as keychainAdminCapability, G as KeychainResetRecordSchema, Oa as EventCategory, U as KEYCHAIN_RESET_TRIGGER_ACTOR, W as KeychainAuditEntrySchema, Zi as formatSecretScope, da as normalizeSecretOwner, jn as keychainCapability, ma as parseSecretRef, qi as defineRecordKinds, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
2
+ import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-DyUtcpf4.mjs";
3
3
  import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
4
- import { a as MESH_CA_KEY_REF } from "../../constants-zBiEodEM.mjs";
4
+ import { a as MESH_CA_KEY_REF } from "../../constants-p5mPM1iL.mjs";
5
5
  import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
6
6
  import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
7
7
  import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";
@@ -1,6 +1,6 @@
1
1
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
2
2
  const require_chunk = require("../../chunk-Cek0wNdY.js");
3
- const require_dist = require("../../dist-DX5Fu3mV.js");
3
+ const require_dist = require("../../dist-Bmah6waF.js");
4
4
  let node_fs_promises = require("node:fs/promises");
5
5
  node_fs_promises = require_chunk.__toESM(node_fs_promises);
6
6
  let node_path = require("node:path");
@@ -1,4 +1,4 @@
1
- import { $r as errMsg, Da as EventCategory, Ui as createEvent, Vn as mayWriteToLocation, ei as BaseAddon, it as RecordingStatusSchema, nt as RECORDING_SOURCE_CAMSTACK_ADDON } from "../../dist-CdFkkmXW.mjs";
1
+ import { Oa as EventCategory, Vn as mayWriteToLocation, Wi as createEvent, ei as errMsg, it as RecordingStatusSchema, nt as RECORDING_SOURCE_CAMSTACK_ADDON, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
2
2
  import * as fsp from "node:fs/promises";
3
3
  import path from "node:path";
4
4
  import { constants } from "node:fs";
@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  const require_chunk = require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
8
8
  const require_ms$1 = require("../../ms-LB3giGoU.js");
9
- const require_device_ca = require("../../device-ca-CfiIg3a9.js");
9
+ const require_device_ca = require("../../device-ca-BXzQ1pYj.js");
10
10
  const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
11
11
  let zod = require("zod");
12
12
  let node_crypto = require("node:crypto");
@@ -8821,6 +8821,19 @@ var UserManager = class {
8821
8821
  return this.auth.comparePassword(password, user.passwordHash);
8822
8822
  }
8823
8823
  };
8824
+ //#endregion
8825
+ //#region src/builtins/local-auth/person-scopes.ts
8826
+ /**
8827
+ * What `userManagement.setUserScopes` may store for a person (D921, amended
8828
+ * 2026-10-24): nothing (an admin) or exactly one viewer row. Any other row
8829
+ * is refused. There is no conversion of an older grant set (D900).
8830
+ */
8831
+ function assertPersonScopes(scopes) {
8832
+ if (scopes.length === 0) return;
8833
+ const only = scopes[0];
8834
+ if (scopes.length === 1 && only !== void 0 && only.type === "viewer") return;
8835
+ throw require_dist.userError("auth.person-scopes-refused", void 0, "A person is an admin, with no scope rows, or holds exactly one viewer grant");
8836
+ }
8824
8837
  var JwtSigningKeyKeeper = class {
8825
8838
  deps;
8826
8839
  retryTimer = null;
@@ -12179,6 +12192,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
12179
12192
  },
12180
12193
  setUserScopes: async (input) => {
12181
12194
  if (!this.userManager) throw new Error("User management not available");
12195
+ assertPersonScopes(input.scopes);
12182
12196
  await this.userManager.update(input.userId, { scopes: input.scopes });
12183
12197
  return { success: true };
12184
12198
  },
@@ -1,8 +1,8 @@
1
1
  import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
2
- import { $ as PreferenceDeviceIdSchema, At as buildDeviceSignatureMessage, E as DEVICE_ENROLLMENT_TTL_MS, Ki as defineRecordKinds, O as DEVICE_NONCE_TTL_MS, Q as PREFERENCES_MAX_VALUE_BYTES, Qt as deviceCredentialsCapability, Ta as userError, ei as BaseAddon, et as PreferenceNamespaceSchema, gt as UserRecordSchema, h as CREDENTIAL_TOKEN_AUDIENCE, hn as formatDeviceRevoker, jr as userManagementCapability, kt as buildDeviceEnrollmentLink, lt as SsoBridgeClaimsSchema, mt as TokenScopeSchema, oa as makeSecretMarker, ra as isSecretMarker, st as ScopedTokenSchema, tt as PreferenceValueSchema, wn as isCredentialTokenPayload, wt as authProviderCapability, y as CredentialTokenClaimsSchema } from "../../dist-CdFkkmXW.mjs";
2
+ import { $ as PreferenceDeviceIdSchema, At as buildDeviceSignatureMessage, E as DEVICE_ENROLLMENT_TTL_MS, Ea as userError, Mr as userManagementCapability, O as DEVICE_NONCE_TTL_MS, Q as PREFERENCES_MAX_VALUE_BYTES, Qt as deviceCredentialsCapability, et as PreferenceNamespaceSchema, gt as UserRecordSchema, h as CREDENTIAL_TOKEN_AUDIENCE, hn as formatDeviceRevoker, ia as isSecretMarker, kt as buildDeviceEnrollmentLink, lt as SsoBridgeClaimsSchema, mt as TokenScopeSchema, qi as defineRecordKinds, sa as makeSecretMarker, st as ScopedTokenSchema, ti as BaseAddon, tt as PreferenceValueSchema, wn as isCredentialTokenPayload, wt as authProviderCapability, y as CredentialTokenClaimsSchema } from "../../dist-C9lbdBL5.mjs";
3
3
  import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
4
4
  import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
5
- import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-BWTWWBcc.mjs";
5
+ import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-DyUtcpf4.mjs";
6
6
  import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
7
7
  import { z } from "zod";
8
8
  import * as crypto$1 from "node:crypto";
@@ -8810,6 +8810,19 @@ var UserManager = class {
8810
8810
  return this.auth.comparePassword(password, user.passwordHash);
8811
8811
  }
8812
8812
  };
8813
+ //#endregion
8814
+ //#region src/builtins/local-auth/person-scopes.ts
8815
+ /**
8816
+ * What `userManagement.setUserScopes` may store for a person (D921, amended
8817
+ * 2026-10-24): nothing (an admin) or exactly one viewer row. Any other row
8818
+ * is refused. There is no conversion of an older grant set (D900).
8819
+ */
8820
+ function assertPersonScopes(scopes) {
8821
+ if (scopes.length === 0) return;
8822
+ const only = scopes[0];
8823
+ if (scopes.length === 1 && only !== void 0 && only.type === "viewer") return;
8824
+ throw userError("auth.person-scopes-refused", void 0, "A person is an admin, with no scope rows, or holds exactly one viewer grant");
8825
+ }
8813
8826
  var JwtSigningKeyKeeper = class {
8814
8827
  deps;
8815
8828
  retryTimer = null;
@@ -12168,6 +12181,7 @@ var LocalAuthAddon = class extends BaseAddon {
12168
12181
  },
12169
12182
  setUserScopes: async (input) => {
12170
12183
  if (!this.userManager) throw new Error("User management not available");
12184
+ assertPersonScopes(input.scopes);
12171
12185
  await this.userManager.update(input.userId, { scopes: input.scopes });
12172
12186
  return { success: true };
12173
12187
  },
@@ -0,0 +1,7 @@
1
+ /**
2
+ * What `userManagement.setUserScopes` may store for a person (D921, amended
3
+ * 2026-10-24): nothing (an admin) or exactly one viewer row. Any other row
4
+ * is refused. There is no conversion of an older grant set (D900).
5
+ */
6
+ import { type UserScope } from "@camstack/types";
7
+ export declare function assertPersonScopes(scopes: readonly UserScope[]): void;
@@ -1,7 +1,7 @@
1
1
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
2
2
  const require_chunk = require("../../chunk-Cek0wNdY.js");
3
- const require_dist = require("../../dist-DX5Fu3mV.js");
4
- const require_hub_mdns_ciao = require("../../hub-mdns-ciao-C174UDzO.js");
3
+ const require_dist = require("../../dist-Bmah6waF.js");
4
+ const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CUr6ewsX.js");
5
5
  let zod = require("zod");
6
6
  let node_net = require("node:net");
7
7
  let node_os = require("node:os");
@@ -1,5 +1,5 @@
1
- import { $r as errMsg, Da as EventCategory, Fn as localNetworkCapability, Ft as checkRoleAddress, H as HUB_MDNS_TXT_KEYS, Nr as validateCustomAddress, Tn as isDefaultAppConnectionEndpoint, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, Zn as pickAppLinkHub, c as CAMSTACK_APP_LINK_ORIGIN, ei as BaseAddon, or as resolveAppConnections, pr as resolveNotificationTapAddress, ur as resolveHubAddressRoles, xn as isAppLinkBase, yr as shortHostname } from "../../dist-CdFkkmXW.mjs";
2
- import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-CYp1Gipm.mjs";
1
+ import { Fn as localNetworkCapability, Ft as checkRoleAddress, H as HUB_MDNS_TXT_KEYS, Oa as EventCategory, Pr as validateCustomAddress, Qn as pickAppLinkHub, Tn as isDefaultAppConnectionEndpoint, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, br as shortHostname, c as CAMSTACK_APP_LINK_ORIGIN, dr as resolveHubAddressRoles, ei as errMsg, mr as resolveNotificationTapAddress, sr as resolveAppConnections, ti as BaseAddon, xn as isAppLinkBase } from "../../dist-C9lbdBL5.mjs";
2
+ import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-BemeCNGe.mjs";
3
3
  import { z } from "zod";
4
4
  import { isIP } from "node:net";
5
5
  import * as os$1 from "node:os";
@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  const require_log_read_filter = require("../../log-read-filter-Bi066jwU.js");
8
8
  let zod = require("zod");
9
9
  //#region src/builtins/loki-logging/loki-payload.ts
@@ -1,4 +1,4 @@
1
- import { Ln as logDestinationCapability, ei as BaseAddon } from "../../dist-CdFkkmXW.mjs";
1
+ import { Ln as logDestinationCapability, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
2
2
  import { n as compileLogFilter, o as lineMatches } from "../../log-read-filter-D7Ev3zm-.mjs";
3
3
  import { z } from "zod";
4
4
  //#region src/builtins/loki-logging/loki-payload.ts
@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
3
3
  [Symbol.toStringTag]: { value: "Module" }
4
4
  });
5
5
  const require_chunk = require("../../chunk-Cek0wNdY.js");
6
- const require_dist = require("../../dist-DX5Fu3mV.js");
6
+ const require_dist = require("../../dist-Bmah6waF.js");
7
7
  let node_fs_promises = require("node:fs/promises");
8
8
  let node_util = require("node:util");
9
9
  let node_os = require("node:os");
@@ -1,4 +1,4 @@
1
- import { $r as errMsg, Da as EventCategory, Ui as createEvent, Un as metricsProviderCapability, ei as BaseAddon, ht as UNATTRIBUTED_BUCKET_KEY, ir as reducePoints, mn as foldSnapshotByFunction, rt as ROOT_BUCKET_KEY, sr as resolveBucketMs } from "../../dist-CdFkkmXW.mjs";
1
+ import { Oa as EventCategory, Un as metricsProviderCapability, Wi as createEvent, ar as reducePoints, cr as resolveBucketMs, ei as errMsg, ht as UNATTRIBUTED_BUCKET_KEY, mn as foldSnapshotByFunction, rt as ROOT_BUCKET_KEY, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
2
2
  import { access, readFile, readdir } from "node:fs/promises";
3
3
  import { promisify } from "node:util";
4
4
  import * as os$1 from "node:os";
@@ -0,0 +1,24 @@
1
+ import { type AcceleratorCompute } from "@camstack/types";
2
+ /** Same name `accelerator_facts.FACTS_FILENAME` writes under the system temp dir. */
3
+ export declare const ACCELERATOR_FACTS_FILENAME = "camstack-accelerator-facts.json";
4
+ /** OpenVINO import is a few seconds; past this the estimate waits for the pool's file. */
5
+ export declare const ACCELERATOR_FACTS_TIMEOUT_MS = 8e3;
6
+ export declare function publishedAcceleratorFactsPath(): string;
7
+ /** `null` when the file is absent, unreadable, or not a facts payload. */
8
+ export declare function readPublishedAcceleratorFacts(filePath: string): readonly AcceleratorCompute[] | null;
9
+ /** Where `accelerator_facts.py` lives, or null when this process cannot see the addon. */
10
+ export declare function findAcceleratorFactsScript(dataDir: string | null | undefined, cwd?: string): string | null;
11
+ export interface AcceleratorFactsExec {
12
+ (command: string, args: readonly string[], timeoutMs: number): Promise<string>;
13
+ }
14
+ export interface AcceleratorFactsProbeInput {
15
+ readonly pythonPath: string | null;
16
+ readonly scriptPath: string | null;
17
+ readonly exec?: AcceleratorFactsExec;
18
+ readonly timeoutMs?: number;
19
+ }
20
+ /**
21
+ * Run the facts script. `null` when there is no interpreter, no script, or
22
+ * the script could not ask the device (it prints `{"accelerators": null}`).
23
+ */
24
+ export declare function runAcceleratorFactsProbe(input: AcceleratorFactsProbeInput): Promise<readonly AcceleratorCompute[] | null>;