@camstack/system 1.2.70 → 1.2.71

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-DafB-1hp.js");
+const require_manifest_python_deps = require("./manifest-python-deps-BqIpg0C7.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, xt as resolveAddonClass } from "./manifest-python-deps-DKrHcUZj.mjs";
+import { I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, xt as resolveAddonClass } from "./manifest-python-deps-BdWxKNvu.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/auth/auth-manager.d.ts

@@ -1,4 +1,5 @@
-import { TokenPayload, IScopedLogger, TokenScope } from '@camstack/types';
+import { IScopedLogger, TokenPayload, SsoBridgeClaimsSchema } from '@camstack/types';
+import { z } from 'zod';
 export type { TokenPayload };
 export type AuthConfigReader = {
     get<T>(path: string): T;
@@ -42,7 +43,7 @@ export declare class AuthManager {
      * redirect bounce, short enough that a leaked URL stops being useful
      * before the operator notices.
      */
-    signSsoBridgeToken(payload: SsoBridgeClaims, ttlSec?: number): string;
+    signSsoBridgeToken(payload: SsoBridgeClaims, ttlSec?: number | 'never'): string;
     /**
      * Verify + decode a bridge token minted by `signSsoBridgeToken`.
      * Returns `null` for invalid signature, expired token, or wrong
@@ -75,33 +76,16 @@ export declare class AuthManager {
      */
     verifyTotpChallengeToken(token: string): TotpChallengeClaims | null;
 }
-export interface SsoBridgeClaims {
-    readonly userId: string;
-    readonly username: string;
-    readonly isAdmin: boolean;
-    readonly provider: string;
-    readonly email?: string;
-    readonly displayName?: string;
-    /**
-     * Public HTTPS URL of the hub that minted the token. Carried verbatim
-     * through sign/verify; consumed by cloud-mode OAuth proxies (e.g. the
-     * Alexa Lambda) which need to know which hub to forward to without
-     * keeping per-user routing state. Optional — only the cloud-mode
-     * issuers set it.
-     */
-    readonly hubUrl?: string;
-    /** Permission scopes baked into the token by the OAuth account-linking
-     *  grant. Absent on ordinary SSO-login bridge tokens. */
-    readonly scopes?: readonly TokenScope[];
-    /** OAuth authorization-code binding — set only on `oauth-code` tokens. */
-    readonly redirectUri?: string;
-    readonly integrationId?: string;
-    /** JWT ID — unique per issued code; consumed-set enforces single-use. */
-    readonly jti?: string;
-    /** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
-     *  tokens so the verify path can check the session is not revoked. */
-    readonly sessionId?: string;
-}
+/**
+ * Derived from the cap schema rather than restated.
+ *
+ * This was a hand-written interface duplicating `SsoBridgeClaimsSchema`, and it
+ * had already drifted: `codeChallenge` — the field that makes PKCE mandatory at
+ * exchange — was in the schema and absent here, so the claim travelled through
+ * a type that did not know it existed. That is the failure mode the repo's
+ * `z.infer<>`-never-duplicate-a-shape rule exists to stop.
+ */
+export type SsoBridgeClaims = z.infer<typeof SsoBridgeClaimsSchema>;
 export interface TotpChallengeClaims {
     readonly userId: string;
     readonly username: string;

package/dist/auth/scope-matcher.d.ts

@@ -1,7 +1,8 @@
-import { TokenScope, MethodAccess } from '@camstack/types';
 /**
- * True if the scope set grants `access` on device-scoped capabilities.
- * A `category:device` grant covers every device cap (the broad grant).
- * Mirrors the OR-semantics of the existing token scope matcher.
+ * The scope derivation moved to `@camstack/types`
+ * (`src/auth/principal-scope.ts`) so that ADDONS can reach it — they may not
+ * import `@camstack/system`, which is why `addon-export-alexa` had hand-copied
+ * `scopesAllowDeviceCap` into its `directive-router.ts`. This module is the
+ * kernel-side re-export; there is no second implementation.
  */
-export declare function scopesAllowDeviceCap(scopes: readonly TokenScope[], access: MethodAccess): boolean;
+export { scopesAllowAddon, scopesAllowDeviceCap } from '@camstack/types';

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, _ as addonPagesCapability, dt as errMsg, ft as BaseAddon } from "../../dist-CnQXXnK1.mjs";
+import { Bt as EventCategory, _ as addonPagesCapability, mt as BaseAddon, pt as errMsg } from "../../dist-Daxx9CB0.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, dt as errMsg, ft as BaseAddon, y as addonWidgetsCapability } from "../../dist-CnQXXnK1.mjs";
+import { Bt as EventCategory, mt as BaseAddon, pt as errMsg, y as addonWidgetsCapability } from "../../dist-Daxx9CB0.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, Tt as createEvent, b as alertsCapability, dt as errMsg, ft as BaseAddon, n as AlertSchema } from "../../dist-CnQXXnK1.mjs";
+import { Bt as EventCategory, Dt as createEvent, b as alertsCapability, mt as BaseAddon, n as AlertSchema, pt as errMsg } from "../../dist-Daxx9CB0.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, S as backupCapability, ft as BaseAddon } from "../../dist-CnQXXnK1.mjs";
+import { Bt as EventCategory, S as backupCapability, mt as BaseAddon } from "../../dist-Daxx9CB0.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { ft as BaseAddon, q as logDestinationCapability } from "../../dist-CnQXXnK1.mjs";
+import { mt as BaseAddon, q as logDestinationCapability } from "../../dist-Daxx9CB0.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { D as coreBlocksCapability, E as coreBlockIdFromAddonId, T as coreBlockAddonId, c as CoreBlockSchema, ft as BaseAddon, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX } from "../../dist-CnQXXnK1.mjs";
+import { D as coreBlocksCapability, E as coreBlockIdFromAddonId, T as coreBlockAddonId, c as CoreBlockSchema, l as DeclaredDevices, mt as BaseAddon, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX } from "../../dist-Daxx9CB0.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as parseStreamParamsFormPatch, A as deviceManagerCapability, At as isDeviceConfigCap, F as enumerateItemArrayFields, I as enumerateSchemaFields, Lt as sleep, M as deviceStatusCapability, Rt as EventCategory, Z as normalizeUnit, _t as DeviceRole, a as CAP_NAMES_WITH_STATUS, dt as errMsg, ft as BaseAddon, gt as DeviceFeature, j as deviceStateCapability, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as DeviceType, w as buildStreamParamsConfigSchema, xt as WELL_KNOWN_TAB_MAP } from "../../dist-CnQXXnK1.mjs";
+import { $ as parseStreamParamsFormPatch, A as deviceManagerCapability, Bt as EventCategory, Ct as WELL_KNOWN_TAB_MAP, F as enumerateItemArrayFields, I as enumerateSchemaFields, M as deviceStatusCapability, Mt as isDeviceConfigCap, Z as normalizeUnit, a as CAP_NAMES_WITH_STATUS, bt as DeviceType, j as deviceStateCapability, mt as BaseAddon, p as STREAM_PROFILE_META, pt as errMsg, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as DeviceFeature, w as buildStreamParamsConfigSchema, yt as DeviceRole, zt as sleep } from "../../dist-Daxx9CB0.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { C as bareAddonId, H as isSameAddonId, N as doorbellCapability, Rt as EventCategory, Tt as createEvent, dt as errMsg, ft as BaseAddon, vt as DeviceType } from "../../dist-CnQXXnK1.mjs";
+import { Bt as EventCategory, C as bareAddonId, Dt as createEvent, H as isSameAddonId, N as doorbellCapability, bt as DeviceType, mt as BaseAddon, pt as errMsg } from "../../dist-Daxx9CB0.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { ft as BaseAddon, q as logDestinationCapability } from "../../dist-CnQXXnK1.mjs";
+import { mt as BaseAddon, q as logDestinationCapability } from "../../dist-Daxx9CB0.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, Tt as createEvent, dt as errMsg, ft as BaseAddon } from "../../dist-CnQXXnK1.mjs";
+import { Bt as EventCategory, Dt as createEvent, mt as BaseAddon, pt as errMsg } from "../../dist-Daxx9CB0.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";