@camstack/system 1.2.69 → 1.2.71

package/dist/builtins/local-auth/oauth-grants.d.ts

@@ -1,5 +1,13 @@
 import { ISsoBridgeProvider, TokenScope } from '@camstack/types';
 import { OauthSessionManager } from './oauth-session-manager.js';
+/**
+ * The refresh lifetime for an integration whose descriptor declares none.
+ * 30 days — the value every link used before `refreshTokenTtlSec` existed, kept
+ * as the default so an integration that says nothing is unchanged.
+ */
+export declare const DEFAULT_REFRESH_TTL_SEC = 2592000;
+/** Seconds, or `'never'` for a refresh token minted with no `exp` claim. */
+export type RefreshTtl = number | 'never';
 interface IssueCodeInput {
     integrationId: string;
     userId: string;
@@ -8,6 +16,13 @@ interface IssueCodeInput {
     redirectUri: string;
     hubUrl: string;
     codeChallenge?: string;
+    /**
+     * From the integration's `OauthIntegrationDescriptor.refreshTokenTtlSec`.
+     * Baked into the CODE so it travels with the link: re-reading the descriptor
+     * at refresh time would let an edit retroactively change the lifetime of a
+     * grant the operator already consented to.
+     */
+    refreshTtlSec?: RefreshTtl;
 }
 /**
  * PKCE S256 check (RFC 7636 §4.6): `BASE64URL(SHA256(verifier)) === challenge`.

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { K as localNetworkCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-C-QzFJ8v.mjs";
+import { Bt as EventCategory, K as localNetworkCapability, mt as BaseAddon } from "../../dist-Daxx9CB0.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { pt as BaseAddon, q as logDestinationCapability } from "../../dist-C-QzFJ8v.mjs";
+import { mt as BaseAddon, q as logDestinationCapability } from "../../dist-Daxx9CB0.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,13 +3,13 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
-let node_fs = require("node:fs");
-node_fs = require_chunk.__toESM(node_fs);
-let node_util = require("node:util");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_child_process = require("node:child_process");
+let node_util = require("node:util");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
+let node_fs = require("node:fs");
+node_fs = require_chunk.__toESM(node_fs);
 //#region src/builtins/native-metrics/native-metrics-provider.ts
 var IS_DARWIN = node_os.platform() === "darwin";
 var IS_LINUX = node_os.platform() === "linux";
@@ -123,7 +123,7 @@ var NativeMetricsProvider = class {
 		return getCpuTemperatureInternal();
 	}
 	async getProcessStats(input) {
-		const { getPidStats } = await Promise.resolve().then(() => require("../../resource-monitor-DNNomR-i.js")).then((n) => n.resource_monitor_exports);
+		const { getPidStats } = await Promise.resolve().then(() => require("../../resource-monitor-CdnzxBLP.js")).then((n) => n.resource_monitor_exports);
 		const raw = await getPidStats(input.pids);
 		const result = [];
 		for (const [pid, s] of raw) result.push({

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,8 +1,8 @@
-import { Et as createEvent, X as metricsProviderCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-C-QzFJ8v.mjs";
-import * as fs from "node:fs";
-import { promisify } from "node:util";
+import { Bt as EventCategory, Dt as createEvent, X as metricsProviderCapability, mt as BaseAddon } from "../../dist-Daxx9CB0.mjs";
 import { execFile, execFileSync } from "node:child_process";
+import { promisify } from "node:util";
 import * as os from "node:os";
+import * as fs from "node:fs";
 //#region src/builtins/native-metrics/native-metrics-provider.ts
 var IS_DARWIN = os.platform() === "darwin";
 var IS_LINUX = os.platform() === "linux";
@@ -116,7 +116,7 @@ var NativeMetricsProvider = class {
 		return getCpuTemperatureInternal();
 	}
 	async getProcessStats(input) {
-		const { getPidStats } = await import("../../resource-monitor-BkP504Vq.mjs").then((n) => n.r);
+		const { getPidStats } = await import("../../resource-monitor-BWmQ5i-o.mjs").then((n) => n.r);
 		const raw = await getPidStats(input.pids);
 		const result = [];
 		for (const [pid, s] of raw) result.push({

package/dist/builtins/platform-probe/index.js

@@ -3,13 +3,13 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
-let node_fs = require("node:fs");
-node_fs = require_chunk.__toESM(node_fs);
-let node_util = require("node:util");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_child_process = require("node:child_process");
+let node_util = require("node:util");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
+let node_fs = require("node:fs");
+node_fs = require_chunk.__toESM(node_fs);
 //#region src/builtins/platform-probe/coral-accelerators.ts
 /**
 * Coral USB Edge TPU USB identifiers.

package/dist/builtins/platform-probe/index.mjs

@@ -1,9 +1,9 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Ot as emitReadiness, P as enumerateInferenceDevices, ft as errMsg, pt as BaseAddon, rt as scoreRuntimes, tt as platformProbeCapability, zt as EventCategory } from "../../dist-C-QzFJ8v.mjs";
-import * as fs from "node:fs";
-import { promisify } from "node:util";
+import { Bt as EventCategory, P as enumerateInferenceDevices, et as platformProbeCapability, it as scoreRuntimes, kt as emitReadiness, mt as BaseAddon, pt as errMsg } from "../../dist-Daxx9CB0.mjs";
 import { execFile } from "node:child_process";
+import { promisify } from "node:util";
 import * as os from "node:os";
+import * as fs from "node:fs";
 //#region src/builtins/platform-probe/coral-accelerators.ts
 /**
 * Coral USB Edge TPU USB identifiers.

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { pt as BaseAddon, zt as EventCategory } from "../../dist-C-QzFJ8v.mjs";
+import { Bt as EventCategory, mt as BaseAddon } from "../../dist-Daxx9CB0.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
-let _camstack_types_node = require("@camstack/types/node");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
+let _camstack_types_node = require("@camstack/types/node");
 let node_child_process = require("node:child_process");
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/snapshot/index.mjs

@@ -1,7 +1,7 @@
-import { C as bareAddonId, Mt as nodePin, _t as DeviceFeature, at as snapshotCapability, ct as streamQualityLabel, ft as errMsg, i as BatteryStatusSchema, pt as BaseAddon, yt as DeviceType } from "../../dist-C-QzFJ8v.mjs";
-import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";
+import { C as bareAddonId, Nt as nodePin, bt as DeviceType, i as BatteryStatusSchema, lt as streamQualityLabel, mt as BaseAddon, ot as snapshotCapability, pt as errMsg, vt as DeviceFeature } from "../../dist-Daxx9CB0.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
+import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";
 import { execFile, spawn } from "node:child_process";
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,14 +3,14 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_crypto = require("node:crypto");
-let node_fs = require("node:fs");
-node_fs = require_chunk.__toESM(node_fs);
+let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
 let node_os = require("node:os");
-let node_fs_promises = require("node:fs/promises");
+let node_fs = require("node:fs");
+node_fs = require_chunk.__toESM(node_fs);
 //#region src/builtins/sqlite-storage/path-guard.ts
 /**
 * Allowed-root containment guard for the filesystem-browse cap. Pure +

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,10 +1,10 @@
-import { R as filesystemBrowseCapability, pt as BaseAddon, st as storageProviderCapability } from "../../dist-C-QzFJ8v.mjs";
+import { R as filesystemBrowseCapability, ct as storageProviderCapability, mt as BaseAddon } from "../../dist-Daxx9CB0.mjs";
 import { randomUUID } from "node:crypto";
-import * as fs from "node:fs";
+import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { homedir } from "node:os";
-import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
+import * as fs from "node:fs";
 //#region src/builtins/sqlite-storage/path-guard.ts
 /**
 * Allowed-root containment guard for the filesystem-browse cap. Pure +

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_module = require("node:module");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,4 +1,4 @@
-import { C as bareAddonId, Ct as asJsonObject, O as dataStoreProviderCapability, Pt as parseJsonUnknown, dt as vectorStoreCapability, f as RUNTIME_DEFAULTS, ft as errMsg, k as decodeVectorBase64, pt as BaseAddon, ut as vectorDimFromBase64 } from "../../dist-C-QzFJ8v.mjs";
+import { C as bareAddonId, Ft as parseJsonUnknown, O as dataStoreProviderCapability, dt as vectorDimFromBase64, f as RUNTIME_DEFAULTS, ft as vectorStoreCapability, k as decodeVectorBase64, mt as BaseAddon, pt as errMsg, wt as asJsonObject } from "../../dist-Daxx9CB0.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
-let node_path = require("node:path");
-node_path = require_chunk.__toESM(node_path);
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);
+let node_path = require("node:path");
+node_path = require_chunk.__toESM(node_path);
 let _camstack_system = require("@camstack/system");
 //#region src/builtins/storage-orchestrator/storage-orchestrator.service.ts
 var SESSION_VOCABULARY = {

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,6 +1,6 @@
-import { Nt as parseJsonObject, h as StorageLocationTypeSchema, it as settingsStoreCapability, ot as storageCapability, pt as BaseAddon } from "../../dist-C-QzFJ8v.mjs";
-import * as path$1 from "node:path";
+import { Pt as parseJsonObject, at as settingsStoreCapability, h as StorageLocationTypeSchema, mt as BaseAddon, st as storageCapability } from "../../dist-Daxx9CB0.mjs";
 import * as fs from "node:fs/promises";
+import * as path$1 from "node:path";
 import { buildStorageLocationRegistry } from "@camstack/system";
 //#region src/builtins/storage-orchestrator/storage-orchestrator.service.ts
 var SESSION_VOCABULARY = {

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { At as hydrateSchema, ft as errMsg, pt as BaseAddon } from "../../dist-C-QzFJ8v.mjs";
+import { jt as hydrateSchema, mt as BaseAddon, pt as errMsg } from "../../dist-Daxx9CB0.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { pt as BaseAddon, q as logDestinationCapability } from "../../dist-C-QzFJ8v.mjs";
+import { mt as BaseAddon, q as logDestinationCapability } from "../../dist-Daxx9CB0.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-C-QzFJ8v.mjs → dist-Daxx9CB0.mjs}

@@ -4148,6 +4148,24 @@ var ConvertResultSchema = z.object({
 	artifacts: z.array(ConvertArtifactSchema).readonly()
 });
 /**
+* True if the scope set grants `access` on device-scoped capabilities.
+* A `category:device` grant covers every device cap (the broad grant).
+*/
+function scopesAllowDeviceCap(scopes, access) {
+	return scopes.some((s) => s.type === "category" && s.target === "device" && s.access.includes(access));
+}
+/**
+* True if the scope set names this addon with at least `access`.
+*
+* Deliberately NOT satisfied by `category:device`: a grant over per-camera
+* capabilities says nothing about an addon's own HTTP surface, and conflating
+* the two is precisely the confusion that let an Alexa token drive Home
+* Assistant's command route.
+*/
+function scopesAllowAddon(scopes, addonId, access) {
+	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
+}
+/**
 * Error types for the safe expression engine. Two distinct classes so callers
 * can tell a compile-time (grammar) failure from a runtime (evaluation)
 * failure — both are non-fatal to the host: read paths degrade to "skip link".
@@ -13022,6 +13040,76 @@ var ScopedTokenSchema = z.object({
 * Each provider returns a static descriptor; the core enumerates them
 * to validate the `integration=` query param and resolve the consent
 * label + the scopes baked into the issued token.
+*
+* ## Declaring one
+*
+* An OAuth client is integration-specific knowledge — who the client is, what
+* it may ask for, where it may be sent — so it is declared by the ADDON that
+* owns the integration, never by the kernel and never as a branch inside
+* `oauth2-routes.ts` ([D101](../../../../docs/decisions/adr-0101.md)). Three
+* steps, no others:
+*
+* 1. Add `{ "name": "oauth-integration" }` to the addon's `camstack.addons[]`
+*    manifest entry. This is also what tells the hub, at addon-LOAD time, that
+*    a descriptor is owed — see "the boot window" below.
+* 2. Return a provider from `onInitialize()`:
+*
+*    ```ts
+*    const provider: IOauthIntegrationProvider = {
+*      getDescriptor: async () => ({
+*        integrationId: 'my-thing',      // the `integration=` query param
+*        displayName: 'My Thing',
+*        requestedScopes: [ … ],         // see below
+*        allowedRedirectPrefixes: ['https://callback.example/'],
+*      }),
+*    }
+*    return [{ capability: oauthIntegrationCapability, provider }]
+*    ```
+*
+*    The descriptor must be **static** — it is read on the authorize path, so
+*    never put an await on network or disk behind it, and never register it
+*    behind one either (a provider is registered only once `onInitialize`
+*    RETURNS, so anything awaited before the return delays linking).
+* 3. Nothing else. There is no allow-list to join, no id to register with the
+*    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
+*    `/api/oauth2/integrations` are built from this collection alone.
+*
+* **Scopes. `requestedScopes` has exactly ONE meaning: what the integration
+* NEEDS to function.** Not a blast radius, not a conservative
+* under-declaration, not a description of some other path the addon happens to
+* have. Derive it from what the client actually calls **with this token** —
+* every tRPC path against `METHOD_ACCESS_MAP`, plus an `addon:` grant for every
+* addon HTTP route it posts to — and write the call that justifies each entry
+* next to it. Two integrations once used this field to mean two different
+* things; the operator ruled there is one meaning, and any third integration
+* inherits it (2026-08-09).
+*
+* This is not documentation, it is the ENFORCEMENT INPUT. Since
+* [D103](../../../../docs/decisions/adr-0103.md) the `/addon/:addonId/*` gate
+* checks an integration token's grant before letting it reach an
+* `access: 'authenticated'` route, so an **under-declaration is an integration
+* that stops working** — a missing `addon:` entry means `403 Token scope
+* mismatch` on every control the client tries to actuate. Widen the descriptor
+* honestly rather than weakening a check to make a route pass.
+*
+* Prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family; a category scope grants every future member
+* of that category too. `category:system [create]` has been rejected once and
+* should stay rejected: it hands `addons.installPackage` to an integration.
+*
+* Calls the ADDON itself makes over `ctx.api` run as the addon and are not
+* scope-checked, so they are not what this field describes — but reaching the
+* addon's route in the first place IS, and that is the entry to declare.
+*
+* **The boot window.** An addon registers its provider after its runner forks
+* and initialises, so between hub start and that moment this collection is
+* incomplete and an `integrationId` can be legitimately absent. The core does
+* not wait, poll or cache around this ([D3](../../../../docs/decisions/adr-0003.md)):
+* it compares the manifest declarers against the registered providers and
+* answers `503 temporarily_unavailable` (with `Retry-After` and the pending
+* addon ids) instead of `400 unknown integration`, and reports
+* `complete: false` on `GET /api/oauth2/integrations`. A client should retry
+* while the list is incomplete rather than conclude the hub cannot do OAuth.
 */
 var OauthIntegrationDescriptorSchema = z.object({
 	/** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
@@ -13052,7 +13140,30 @@ var OauthIntegrationDescriptorSchema = z.object({
 	*  present, /api/oauth2/authorize bakes THIS into the code instead of the
 	*  hub-global `publicHubUrl()`, so a forked exporter addon (which can't set
 	*  the hub's env) drives the claim that its cloud Lambda routes back on. */
-	hubUrl: z.string().optional()
+	hubUrl: z.string().optional(),
+	/**
+	* How long a REFRESH token issued for this integration lives — seconds, or
+	* `'never'` for a token minted with no `exp` claim at all. Omit to keep the
+	* 30-day default, which is what every link used before this field existed.
+	*
+	* Declared here for the same reason `requestedScopes` is: the integration
+	* knows what it needs. Amazon's account linking and a Home Assistant config
+	* entry are both meant to survive indefinitely, and re-linking is a manual
+	* user action, so a 30-day expiry silently unlinks a working integration.
+	*
+	* **The security posture, stated so it is owned deliberately.** A refresh
+	* token that never expires is permanent access if it leaks. What bounds it is
+	* revocation, not time: `oauthRefresh` re-reads the session on every use and
+	* returns `null` once `revokedAt` is set, as does `oauthVerifyAccessToken`.
+	* The one gap is the ACCESS token — it is a plain signed JWT that nothing
+	* re-checks against the session on the `/trpc` and `/addon/*` paths, so
+	* revoking a link takes effect there only after its remaining hour. That hour
+	* is why the access TTL is not configurable.
+	*
+	* The value is baked into the authorization code at `/authorize` and travels
+	* on the tokens, so editing this field changes FUTURE links only.
+	*/
+	refreshTokenTtlSec: z.union([z.number().int().positive(), z.literal("never")]).optional()
 });
 var oauthIntegrationCapability = {
 	name: "oauth-integration",
@@ -17357,7 +17468,16 @@ var SsoBridgeClaimsSchema = z.object({
 	codeChallenge: z.string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
-	sessionId: z.string().optional()
+	sessionId: z.string().optional(),
+	/**
+	* The refresh lifetime this LINK was created with, in seconds, or `'never'`.
+	* Baked into the code at `/authorize` from the integration's descriptor and
+	* carried forward so `oauthRefresh` re-mints with the same lifetime. It rides
+	* on the token rather than being re-read from the descriptor on purpose:
+	* editing a descriptor must not retroactively extend or shorten a link the
+	* operator already consented to.
+	*/
+	refreshTtl: z.union([z.number().int().positive(), z.literal("never")]).optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -17367,7 +17487,16 @@ var ssoBridgeCapability = {
 	methods: {
 		signBridgeToken: method(z.object({
 			claims: SsoBridgeClaimsSchema,
-			ttlSec: z.number().int().positive().optional()
+			/**
+			* Seconds, or `'never'` for a token minted with NO `exp` claim.
+			*
+			* `'never'` is a literal rather than `undefined`/`0` because omitting
+			* this field already means "the 5-minute SSO hand-off default", and
+			* `jwt.sign` THROWS on `{ expiresIn: undefined }` — a "no expiry" that
+			* went through the numeric path would fail at mint time and break
+			* linking rather than produce an eternal token.
+			*/
+			ttlSec: z.union([z.number().int().positive(), z.literal("never")]).optional()
 		}), z.object({ token: z.string() })),
 		verifyBridgeToken: method(z.object({ token: z.string() }), SsoBridgeClaimsSchema.nullable())
 	}
@@ -26163,7 +26292,12 @@ var userManagementCapability = {
 			hubUrl: z.string(),
 			/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
 			*  that carries one can ONLY be exchanged with the matching verifier. */
-			codeChallenge: z.string().optional()
+			codeChallenge: z.string().optional(),
+			/** The integration's declared refresh lifetime — seconds, or `'never'`.
+			*  From `OauthIntegrationDescriptor.refreshTokenTtlSec`. Baked into the
+			*  code so the link carries its own lifetime; omit for the 30-day
+			*  default. */
+			refreshTtlSec: z.union([z.number().int().positive(), z.literal("never")]).optional()
 		}), z.object({ code: z.string() }), {
 			kind: "mutation",
 			access: "create"
@@ -33179,4 +33313,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { objectInputDeclaresAddonId as $, deviceManagerCapability as A, hydrateSchema as At, isCollectionArrayMethod as B, bareAddonId as C, asJsonObject as Ct, coreBlocksCapability as D, emitDownForOwnedCaps as Dt, coreBlockIdFromAddonId as E, createEvent as Et, enumerateItemArrayFields as F, readinessKey as Ft, lifecycleJobSchema as G, isSameAddonId as H, enumerateSchemaFields as I, resolveCapMount as It, logLevelAtMost as J, localNetworkCapability as K, extractNestedAddonId as L, scopeKey as Lt, deviceStatusCapability as M, nodePin as Mt, doorbellCapability as N, parseJsonObject as Nt, dataStoreProviderCapability as O, emitReadiness as Ot, enumerateInferenceDevices as P, parseJsonUnknown as Pt, oauthIntegrationCapability as Q, filesystemBrowseCapability as R, sleep as Rt, backupCapability as S, WELL_KNOWN_TAB_MAP as St, coreBlockAddonId as T, asString as Tt, isVoidInput as U, isObjectInput as V, kebabToCamel as W, metricsProviderCapability as X, looseSchema as Y, normalizeUnit as Z, addonPagesCapability as _, DeviceFeature as _t, CAP_NAMES_WITH_STATUS as a, snapshotCapability as at, alertsCapability as b, ReadinessRegistry as bt, CoreBlockSchema as c, streamQualityLabel as ct, METHOD_ACCESS_MAP as d, vectorStoreCapability as dt, parseStreamParamsFormPatch as et, RUNTIME_DEFAULTS as f, errMsg as ft, UserRecordSchema as g, DEVICE_STATUS_METHOD as gt, StorageLocationTypeSchema as h, DEVICE_SETTINGS_CONTRIBUTION_METHODS as ht, BatteryStatusSchema as i, settingsStoreCapability as it, deviceStateCapability as j, isDeviceConfigCap as jt, decodeVectorBase64 as k, expandCapMethods as kt, DeclaredDevices as l, userManagementCapability as lt, ScopedTokenSchema as m, DATAPLANE_SECRET_HEADER as mt, AlertSchema as n, procedureAuthKey as nt, CORE_BLOCKS_ADDON_ID as o, storageCapability as ot, STREAM_PROFILE_META as p, BaseAddon as pt, logDestinationCapability as q, ApiKeyRecordSchema as r, scoreRuntimes as rt, CORE_BLOCK_ADDON_PREFIX as s, storageProviderCapability as st, ALL_CAPABILITY_DEFINITIONS as t, platformProbeCapability as tt, DeviceStatusSchema as u, vectorDimFromBase64 as ut, addonSettingsCapability as v, DeviceRole as vt, buildStreamParamsConfigSchema as w, asNumber as wt, authProviderCapability as x, ReadinessTimeoutError as xt, addonWidgetsCapability as y, DeviceType as yt, isArrayOutputSchema as z, EventCategory as zt };
+export { parseStreamParamsFormPatch as $, deviceManagerCapability as A, expandCapMethods as At, isCollectionArrayMethod as B, EventCategory as Bt, bareAddonId as C, WELL_KNOWN_TAB_MAP as Ct, coreBlocksCapability as D, createEvent as Dt, coreBlockIdFromAddonId as E, asString as Et, enumerateItemArrayFields as F, parseJsonUnknown as Ft, lifecycleJobSchema as G, isSameAddonId as H, enumerateSchemaFields as I, readinessKey as It, logLevelAtMost as J, localNetworkCapability as K, extractNestedAddonId as L, resolveCapMount as Lt, deviceStatusCapability as M, isDeviceConfigCap as Mt, doorbellCapability as N, nodePin as Nt, dataStoreProviderCapability as O, emitDownForOwnedCaps as Ot, enumerateInferenceDevices as P, parseJsonObject as Pt, objectInputDeclaresAddonId as Q, filesystemBrowseCapability as R, scopeKey as Rt, backupCapability as S, ReadinessTimeoutError as St, coreBlockAddonId as T, asNumber as Tt, isVoidInput as U, isObjectInput as V, kebabToCamel as W, metricsProviderCapability as X, looseSchema as Y, normalizeUnit as Z, addonPagesCapability as _, DEVICE_STATUS_METHOD as _t, CAP_NAMES_WITH_STATUS as a, settingsStoreCapability as at, alertsCapability as b, DeviceType as bt, CoreBlockSchema as c, storageProviderCapability as ct, METHOD_ACCESS_MAP as d, vectorDimFromBase64 as dt, platformProbeCapability as et, RUNTIME_DEFAULTS as f, vectorStoreCapability as ft, UserRecordSchema as g, DEVICE_SETTINGS_CONTRIBUTION_METHODS as gt, StorageLocationTypeSchema as h, DATAPLANE_SECRET_HEADER as ht, BatteryStatusSchema as i, scoreRuntimes as it, deviceStateCapability as j, hydrateSchema as jt, decodeVectorBase64 as k, emitReadiness as kt, DeclaredDevices as l, streamQualityLabel as lt, ScopedTokenSchema as m, BaseAddon as mt, AlertSchema as n, scopesAllowAddon as nt, CORE_BLOCKS_ADDON_ID as o, snapshotCapability as ot, STREAM_PROFILE_META as p, errMsg as pt, logDestinationCapability as q, ApiKeyRecordSchema as r, scopesAllowDeviceCap as rt, CORE_BLOCK_ADDON_PREFIX as s, storageCapability as st, ALL_CAPABILITY_DEFINITIONS as t, procedureAuthKey as tt, DeviceStatusSchema as u, userManagementCapability as ut, addonSettingsCapability as v, DeviceFeature as vt, buildStreamParamsConfigSchema as w, asJsonObject as wt, authProviderCapability as x, ReadinessRegistry as xt, addonWidgetsCapability as y, DeviceRole as yt, isArrayOutputSchema as z, sleep as zt };