@camstack/system 1.2.70 → 1.2.71

package/dist/builtins/local-auth/oauth-grants.d.ts

@@ -1,5 +1,13 @@
 import { ISsoBridgeProvider, TokenScope } from '@camstack/types';
 import { OauthSessionManager } from './oauth-session-manager.js';
+/**
+ * The refresh lifetime for an integration whose descriptor declares none.
+ * 30 days — the value every link used before `refreshTokenTtlSec` existed, kept
+ * as the default so an integration that says nothing is unchanged.
+ */
+export declare const DEFAULT_REFRESH_TTL_SEC = 2592000;
+/** Seconds, or `'never'` for a refresh token minted with no `exp` claim. */
+export type RefreshTtl = number | 'never';
 interface IssueCodeInput {
     integrationId: string;
     userId: string;
@@ -8,6 +16,13 @@ interface IssueCodeInput {
     redirectUri: string;
     hubUrl: string;
     codeChallenge?: string;
+    /**
+     * From the integration's `OauthIntegrationDescriptor.refreshTokenTtlSec`.
+     * Baked into the CODE so it travels with the link: re-reading the descriptor
+     * at refresh time would let an edit retroactively change the lifetime of a
+     * grant the operator already consented to.
+     */
+    refreshTtlSec?: RefreshTtl;
 }
 /**
  * PKCE S256 check (RFC 7636 §4.6): `BASE64URL(SHA256(verifier)) === challenge`.

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { K as localNetworkCapability, Rt as EventCategory, ft as BaseAddon } from "../../dist-CnQXXnK1.mjs";
+import { Bt as EventCategory, K as localNetworkCapability, mt as BaseAddon } from "../../dist-Daxx9CB0.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { ft as BaseAddon, q as logDestinationCapability } from "../../dist-CnQXXnK1.mjs";
+import { mt as BaseAddon, q as logDestinationCapability } from "../../dist-Daxx9CB0.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, Tt as createEvent, X as metricsProviderCapability, ft as BaseAddon } from "../../dist-CnQXXnK1.mjs";
+import { Bt as EventCategory, Dt as createEvent, X as metricsProviderCapability, mt as BaseAddon } from "../../dist-Daxx9CB0.mjs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Dt as emitReadiness, P as enumerateInferenceDevices, Rt as EventCategory, dt as errMsg, et as platformProbeCapability, ft as BaseAddon, nt as scoreRuntimes } from "../../dist-CnQXXnK1.mjs";
+import { Bt as EventCategory, P as enumerateInferenceDevices, et as platformProbeCapability, it as scoreRuntimes, kt as emitReadiness, mt as BaseAddon, pt as errMsg } from "../../dist-Daxx9CB0.mjs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, ft as BaseAddon } from "../../dist-CnQXXnK1.mjs";
+import { Bt as EventCategory, mt as BaseAddon } from "../../dist-Daxx9CB0.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { C as bareAddonId, dt as errMsg, ft as BaseAddon, gt as DeviceFeature, i as BatteryStatusSchema, it as snapshotCapability, jt as nodePin, st as streamQualityLabel, vt as DeviceType } from "../../dist-CnQXXnK1.mjs";
+import { C as bareAddonId, Nt as nodePin, bt as DeviceType, i as BatteryStatusSchema, lt as streamQualityLabel, mt as BaseAddon, ot as snapshotCapability, pt as errMsg, vt as DeviceFeature } from "../../dist-Daxx9CB0.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { R as filesystemBrowseCapability, ft as BaseAddon, ot as storageProviderCapability } from "../../dist-CnQXXnK1.mjs";
+import { R as filesystemBrowseCapability, ct as storageProviderCapability, mt as BaseAddon } from "../../dist-Daxx9CB0.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_module = require("node:module");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,4 +1,4 @@
-import { C as bareAddonId, Nt as parseJsonUnknown, O as dataStoreProviderCapability, St as asJsonObject, dt as errMsg, f as RUNTIME_DEFAULTS, ft as BaseAddon, k as decodeVectorBase64, lt as vectorDimFromBase64, ut as vectorStoreCapability } from "../../dist-CnQXXnK1.mjs";
+import { C as bareAddonId, Ft as parseJsonUnknown, O as dataStoreProviderCapability, dt as vectorDimFromBase64, f as RUNTIME_DEFAULTS, ft as vectorStoreCapability, k as decodeVectorBase64, mt as BaseAddon, pt as errMsg, wt as asJsonObject } from "../../dist-Daxx9CB0.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);
 let node_path = require("node:path");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as parseJsonObject, at as storageCapability, ft as BaseAddon, h as StorageLocationTypeSchema, rt as settingsStoreCapability } from "../../dist-CnQXXnK1.mjs";
+import { Pt as parseJsonObject, at as settingsStoreCapability, h as StorageLocationTypeSchema, mt as BaseAddon, st as storageCapability } from "../../dist-Daxx9CB0.mjs";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";
 import { buildStorageLocationRegistry } from "@camstack/system";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { dt as errMsg, ft as BaseAddon, kt as hydrateSchema } from "../../dist-CnQXXnK1.mjs";
+import { jt as hydrateSchema, mt as BaseAddon, pt as errMsg } from "../../dist-Daxx9CB0.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DCLoJf2T.js");
+const require_dist = require("../../dist-I0WgqQQ-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { ft as BaseAddon, q as logDestinationCapability } from "../../dist-CnQXXnK1.mjs";
+import { mt as BaseAddon, q as logDestinationCapability } from "../../dist-Daxx9CB0.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-CnQXXnK1.mjs → dist-Daxx9CB0.mjs}

@@ -4148,6 +4148,24 @@ var ConvertResultSchema = z.object({
 	artifacts: z.array(ConvertArtifactSchema).readonly()
 });
 /**
+* True if the scope set grants `access` on device-scoped capabilities.
+* A `category:device` grant covers every device cap (the broad grant).
+*/
+function scopesAllowDeviceCap(scopes, access) {
+	return scopes.some((s) => s.type === "category" && s.target === "device" && s.access.includes(access));
+}
+/**
+* True if the scope set names this addon with at least `access`.
+*
+* Deliberately NOT satisfied by `category:device`: a grant over per-camera
+* capabilities says nothing about an addon's own HTTP surface, and conflating
+* the two is precisely the confusion that let an Alexa token drive Home
+* Assistant's command route.
+*/
+function scopesAllowAddon(scopes, addonId, access) {
+	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
+}
+/**
 * Error types for the safe expression engine. Two distinct classes so callers
 * can tell a compile-time (grammar) failure from a runtime (evaluation)
 * failure — both are non-fatal to the host: read paths degrade to "skip link".
@@ -13056,21 +13074,32 @@ var ScopedTokenSchema = z.object({
 *    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
 *    `/api/oauth2/integrations` are built from this collection alone.
 *
-* **Scopes.** `requestedScopes` is baked into every token this integration is
-* ever issued and the operator consents to it once. Derive it from the tRPC
-* paths the client calls **with that token**, against `METHOD_ACCESS_MAP`, and
-* prefer a narrow `capability:` scope to a `category:` one unless the client
-* genuinely needs a whole family. A category scope grants every future member
+* **Scopes. `requestedScopes` has exactly ONE meaning: what the integration
+* NEEDS to function.** Not a blast radius, not a conservative
+* under-declaration, not a description of some other path the addon happens to
+* have. Derive it from what the client actually calls **with this token** —
+* every tRPC path against `METHOD_ACCESS_MAP`, plus an `addon:` grant for every
+* addon HTTP route it posts to — and write the call that justifies each entry
+* next to it. Two integrations once used this field to mean two different
+* things; the operator ruled there is one meaning, and any third integration
+* inherits it (2026-08-09).
+*
+* This is not documentation, it is the ENFORCEMENT INPUT. Since
+* [D103](../../../../docs/decisions/adr-0103.md) the `/addon/:addonId/*` gate
+* checks an integration token's grant before letting it reach an
+* `access: 'authenticated'` route, so an **under-declaration is an integration
+* that stops working** — a missing `addon:` entry means `403 Token scope
+* mismatch` on every control the client tries to actuate. Widen the descriptor
+* honestly rather than weakening a check to make a route pass.
+*
+* Prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family; a category scope grants every future member
 * of that category too. `category:system [create]` has been rejected once and
 * should stay rejected: it hands `addons.installPackage` to an integration.
 *
-* What it does NOT cover: calls the ADDON makes over `ctx.api`, which run as
-* the addon and are not scope-checked. Alexa's descriptor is narrower than
-* Home Assistant's for exactly that reason — its Lambda posts directives and
-* the addon does the work, while the Home Assistant component calls tRPC
-* directly with the token. So `requestedScopes` describes the blast radius of
-* the GRANT, not the reach of the integration; do not widen one to describe the
-* other.
+* Calls the ADDON itself makes over `ctx.api` run as the addon and are not
+* scope-checked, so they are not what this field describes — but reaching the
+* addon's route in the first place IS, and that is the entry to declare.
 *
 * **The boot window.** An addon registers its provider after its runner forks
 * and initialises, so between hub start and that moment this collection is
@@ -13111,7 +13140,30 @@ var OauthIntegrationDescriptorSchema = z.object({
 	*  present, /api/oauth2/authorize bakes THIS into the code instead of the
 	*  hub-global `publicHubUrl()`, so a forked exporter addon (which can't set
 	*  the hub's env) drives the claim that its cloud Lambda routes back on. */
-	hubUrl: z.string().optional()
+	hubUrl: z.string().optional(),
+	/**
+	* How long a REFRESH token issued for this integration lives — seconds, or
+	* `'never'` for a token minted with no `exp` claim at all. Omit to keep the
+	* 30-day default, which is what every link used before this field existed.
+	*
+	* Declared here for the same reason `requestedScopes` is: the integration
+	* knows what it needs. Amazon's account linking and a Home Assistant config
+	* entry are both meant to survive indefinitely, and re-linking is a manual
+	* user action, so a 30-day expiry silently unlinks a working integration.
+	*
+	* **The security posture, stated so it is owned deliberately.** A refresh
+	* token that never expires is permanent access if it leaks. What bounds it is
+	* revocation, not time: `oauthRefresh` re-reads the session on every use and
+	* returns `null` once `revokedAt` is set, as does `oauthVerifyAccessToken`.
+	* The one gap is the ACCESS token — it is a plain signed JWT that nothing
+	* re-checks against the session on the `/trpc` and `/addon/*` paths, so
+	* revoking a link takes effect there only after its remaining hour. That hour
+	* is why the access TTL is not configurable.
+	*
+	* The value is baked into the authorization code at `/authorize` and travels
+	* on the tokens, so editing this field changes FUTURE links only.
+	*/
+	refreshTokenTtlSec: z.union([z.number().int().positive(), z.literal("never")]).optional()
 });
 var oauthIntegrationCapability = {
 	name: "oauth-integration",
@@ -17416,7 +17468,16 @@ var SsoBridgeClaimsSchema = z.object({
 	codeChallenge: z.string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
-	sessionId: z.string().optional()
+	sessionId: z.string().optional(),
+	/**
+	* The refresh lifetime this LINK was created with, in seconds, or `'never'`.
+	* Baked into the code at `/authorize` from the integration's descriptor and
+	* carried forward so `oauthRefresh` re-mints with the same lifetime. It rides
+	* on the token rather than being re-read from the descriptor on purpose:
+	* editing a descriptor must not retroactively extend or shorten a link the
+	* operator already consented to.
+	*/
+	refreshTtl: z.union([z.number().int().positive(), z.literal("never")]).optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -17426,7 +17487,16 @@ var ssoBridgeCapability = {
 	methods: {
 		signBridgeToken: method(z.object({
 			claims: SsoBridgeClaimsSchema,
-			ttlSec: z.number().int().positive().optional()
+			/**
+			* Seconds, or `'never'` for a token minted with NO `exp` claim.
+			*
+			* `'never'` is a literal rather than `undefined`/`0` because omitting
+			* this field already means "the 5-minute SSO hand-off default", and
+			* `jwt.sign` THROWS on `{ expiresIn: undefined }` — a "no expiry" that
+			* went through the numeric path would fail at mint time and break
+			* linking rather than produce an eternal token.
+			*/
+			ttlSec: z.union([z.number().int().positive(), z.literal("never")]).optional()
 		}), z.object({ token: z.string() })),
 		verifyBridgeToken: method(z.object({ token: z.string() }), SsoBridgeClaimsSchema.nullable())
 	}
@@ -26222,7 +26292,12 @@ var userManagementCapability = {
 			hubUrl: z.string(),
 			/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
 			*  that carries one can ONLY be exchanged with the matching verifier. */
-			codeChallenge: z.string().optional()
+			codeChallenge: z.string().optional(),
+			/** The integration's declared refresh lifetime — seconds, or `'never'`.
+			*  From `OauthIntegrationDescriptor.refreshTokenTtlSec`. Baked into the
+			*  code so the link carries its own lifetime; omit for the 30-day
+			*  default. */
+			refreshTtlSec: z.union([z.number().int().positive(), z.literal("never")]).optional()
 		}), z.object({ code: z.string() }), {
 			kind: "mutation",
 			access: "create"
@@ -33238,4 +33313,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { parseStreamParamsFormPatch as $, deviceManagerCapability as A, isDeviceConfigCap as At, isCollectionArrayMethod as B, bareAddonId as C, asNumber as Ct, coreBlocksCapability as D, emitReadiness as Dt, coreBlockIdFromAddonId as E, emitDownForOwnedCaps as Et, enumerateItemArrayFields as F, resolveCapMount as Ft, lifecycleJobSchema as G, isSameAddonId as H, enumerateSchemaFields as I, scopeKey as It, logLevelAtMost as J, localNetworkCapability as K, extractNestedAddonId as L, sleep as Lt, deviceStatusCapability as M, parseJsonObject as Mt, doorbellCapability as N, parseJsonUnknown as Nt, dataStoreProviderCapability as O, expandCapMethods as Ot, enumerateInferenceDevices as P, readinessKey as Pt, objectInputDeclaresAddonId as Q, filesystemBrowseCapability as R, EventCategory as Rt, backupCapability as S, asJsonObject as St, coreBlockAddonId as T, createEvent as Tt, isVoidInput as U, isObjectInput as V, kebabToCamel as W, metricsProviderCapability as X, looseSchema as Y, normalizeUnit as Z, addonPagesCapability as _, DeviceRole as _t, CAP_NAMES_WITH_STATUS as a, storageCapability as at, alertsCapability as b, ReadinessTimeoutError as bt, CoreBlockSchema as c, userManagementCapability as ct, METHOD_ACCESS_MAP as d, errMsg as dt, platformProbeCapability as et, RUNTIME_DEFAULTS as f, BaseAddon as ft, UserRecordSchema as g, DeviceFeature as gt, StorageLocationTypeSchema as h, DEVICE_STATUS_METHOD as ht, BatteryStatusSchema as i, snapshotCapability as it, deviceStateCapability as j, nodePin as jt, decodeVectorBase64 as k, hydrateSchema as kt, DeclaredDevices as l, vectorDimFromBase64 as lt, ScopedTokenSchema as m, DEVICE_SETTINGS_CONTRIBUTION_METHODS as mt, AlertSchema as n, scoreRuntimes as nt, CORE_BLOCKS_ADDON_ID as o, storageProviderCapability as ot, STREAM_PROFILE_META as p, DATAPLANE_SECRET_HEADER as pt, logDestinationCapability as q, ApiKeyRecordSchema as r, settingsStoreCapability as rt, CORE_BLOCK_ADDON_PREFIX as s, streamQualityLabel as st, ALL_CAPABILITY_DEFINITIONS as t, procedureAuthKey as tt, DeviceStatusSchema as u, vectorStoreCapability as ut, addonSettingsCapability as v, DeviceType as vt, buildStreamParamsConfigSchema as w, asString as wt, authProviderCapability as x, WELL_KNOWN_TAB_MAP as xt, addonWidgetsCapability as y, ReadinessRegistry as yt, isArrayOutputSchema as z };
+export { parseStreamParamsFormPatch as $, deviceManagerCapability as A, expandCapMethods as At, isCollectionArrayMethod as B, EventCategory as Bt, bareAddonId as C, WELL_KNOWN_TAB_MAP as Ct, coreBlocksCapability as D, createEvent as Dt, coreBlockIdFromAddonId as E, asString as Et, enumerateItemArrayFields as F, parseJsonUnknown as Ft, lifecycleJobSchema as G, isSameAddonId as H, enumerateSchemaFields as I, readinessKey as It, logLevelAtMost as J, localNetworkCapability as K, extractNestedAddonId as L, resolveCapMount as Lt, deviceStatusCapability as M, isDeviceConfigCap as Mt, doorbellCapability as N, nodePin as Nt, dataStoreProviderCapability as O, emitDownForOwnedCaps as Ot, enumerateInferenceDevices as P, parseJsonObject as Pt, objectInputDeclaresAddonId as Q, filesystemBrowseCapability as R, scopeKey as Rt, backupCapability as S, ReadinessTimeoutError as St, coreBlockAddonId as T, asNumber as Tt, isVoidInput as U, isObjectInput as V, kebabToCamel as W, metricsProviderCapability as X, looseSchema as Y, normalizeUnit as Z, addonPagesCapability as _, DEVICE_STATUS_METHOD as _t, CAP_NAMES_WITH_STATUS as a, settingsStoreCapability as at, alertsCapability as b, DeviceType as bt, CoreBlockSchema as c, storageProviderCapability as ct, METHOD_ACCESS_MAP as d, vectorDimFromBase64 as dt, platformProbeCapability as et, RUNTIME_DEFAULTS as f, vectorStoreCapability as ft, UserRecordSchema as g, DEVICE_SETTINGS_CONTRIBUTION_METHODS as gt, StorageLocationTypeSchema as h, DATAPLANE_SECRET_HEADER as ht, BatteryStatusSchema as i, scoreRuntimes as it, deviceStateCapability as j, hydrateSchema as jt, decodeVectorBase64 as k, emitReadiness as kt, DeclaredDevices as l, streamQualityLabel as lt, ScopedTokenSchema as m, BaseAddon as mt, AlertSchema as n, scopesAllowAddon as nt, CORE_BLOCKS_ADDON_ID as o, snapshotCapability as ot, STREAM_PROFILE_META as p, errMsg as pt, logDestinationCapability as q, ApiKeyRecordSchema as r, scopesAllowDeviceCap as rt, CORE_BLOCK_ADDON_PREFIX as s, storageCapability as st, ALL_CAPABILITY_DEFINITIONS as t, procedureAuthKey as tt, DeviceStatusSchema as u, userManagementCapability as ut, addonSettingsCapability as v, DeviceFeature as vt, buildStreamParamsConfigSchema as w, asJsonObject as wt, authProviderCapability as x, ReadinessRegistry as xt, addonWidgetsCapability as y, DeviceRole as yt, isArrayOutputSchema as z, sleep as zt };

package/dist/{dist-DCLoJf2T.js → dist-I0WgqQQ-.js}

@@ -4148,6 +4148,24 @@ var ConvertResultSchema = zod.z.object({
 	artifacts: zod.z.array(ConvertArtifactSchema).readonly()
 });
 /**
+* True if the scope set grants `access` on device-scoped capabilities.
+* A `category:device` grant covers every device cap (the broad grant).
+*/
+function scopesAllowDeviceCap(scopes, access) {
+	return scopes.some((s) => s.type === "category" && s.target === "device" && s.access.includes(access));
+}
+/**
+* True if the scope set names this addon with at least `access`.
+*
+* Deliberately NOT satisfied by `category:device`: a grant over per-camera
+* capabilities says nothing about an addon's own HTTP surface, and conflating
+* the two is precisely the confusion that let an Alexa token drive Home
+* Assistant's command route.
+*/
+function scopesAllowAddon(scopes, addonId, access) {
+	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
+}
+/**
 * Error types for the safe expression engine. Two distinct classes so callers
 * can tell a compile-time (grammar) failure from a runtime (evaluation)
 * failure — both are non-fatal to the host: read paths degrade to "skip link".
@@ -13056,21 +13074,32 @@ var ScopedTokenSchema = zod.z.object({
 *    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
 *    `/api/oauth2/integrations` are built from this collection alone.
 *
-* **Scopes.** `requestedScopes` is baked into every token this integration is
-* ever issued and the operator consents to it once. Derive it from the tRPC
-* paths the client calls **with that token**, against `METHOD_ACCESS_MAP`, and
-* prefer a narrow `capability:` scope to a `category:` one unless the client
-* genuinely needs a whole family. A category scope grants every future member
+* **Scopes. `requestedScopes` has exactly ONE meaning: what the integration
+* NEEDS to function.** Not a blast radius, not a conservative
+* under-declaration, not a description of some other path the addon happens to
+* have. Derive it from what the client actually calls **with this token** —
+* every tRPC path against `METHOD_ACCESS_MAP`, plus an `addon:` grant for every
+* addon HTTP route it posts to — and write the call that justifies each entry
+* next to it. Two integrations once used this field to mean two different
+* things; the operator ruled there is one meaning, and any third integration
+* inherits it (2026-08-09).
+*
+* This is not documentation, it is the ENFORCEMENT INPUT. Since
+* [D103](../../../../docs/decisions/adr-0103.md) the `/addon/:addonId/*` gate
+* checks an integration token's grant before letting it reach an
+* `access: 'authenticated'` route, so an **under-declaration is an integration
+* that stops working** — a missing `addon:` entry means `403 Token scope
+* mismatch` on every control the client tries to actuate. Widen the descriptor
+* honestly rather than weakening a check to make a route pass.
+*
+* Prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family; a category scope grants every future member
 * of that category too. `category:system [create]` has been rejected once and
 * should stay rejected: it hands `addons.installPackage` to an integration.
 *
-* What it does NOT cover: calls the ADDON makes over `ctx.api`, which run as
-* the addon and are not scope-checked. Alexa's descriptor is narrower than
-* Home Assistant's for exactly that reason — its Lambda posts directives and
-* the addon does the work, while the Home Assistant component calls tRPC
-* directly with the token. So `requestedScopes` describes the blast radius of
-* the GRANT, not the reach of the integration; do not widen one to describe the
-* other.
+* Calls the ADDON itself makes over `ctx.api` run as the addon and are not
+* scope-checked, so they are not what this field describes — but reaching the
+* addon's route in the first place IS, and that is the entry to declare.
 *
 * **The boot window.** An addon registers its provider after its runner forks
 * and initialises, so between hub start and that moment this collection is
@@ -13111,7 +13140,30 @@ var OauthIntegrationDescriptorSchema = zod.z.object({
 	*  present, /api/oauth2/authorize bakes THIS into the code instead of the
 	*  hub-global `publicHubUrl()`, so a forked exporter addon (which can't set
 	*  the hub's env) drives the claim that its cloud Lambda routes back on. */
-	hubUrl: zod.z.string().optional()
+	hubUrl: zod.z.string().optional(),
+	/**
+	* How long a REFRESH token issued for this integration lives — seconds, or
+	* `'never'` for a token minted with no `exp` claim at all. Omit to keep the
+	* 30-day default, which is what every link used before this field existed.
+	*
+	* Declared here for the same reason `requestedScopes` is: the integration
+	* knows what it needs. Amazon's account linking and a Home Assistant config
+	* entry are both meant to survive indefinitely, and re-linking is a manual
+	* user action, so a 30-day expiry silently unlinks a working integration.
+	*
+	* **The security posture, stated so it is owned deliberately.** A refresh
+	* token that never expires is permanent access if it leaks. What bounds it is
+	* revocation, not time: `oauthRefresh` re-reads the session on every use and
+	* returns `null` once `revokedAt` is set, as does `oauthVerifyAccessToken`.
+	* The one gap is the ACCESS token — it is a plain signed JWT that nothing
+	* re-checks against the session on the `/trpc` and `/addon/*` paths, so
+	* revoking a link takes effect there only after its remaining hour. That hour
+	* is why the access TTL is not configurable.
+	*
+	* The value is baked into the authorization code at `/authorize` and travels
+	* on the tokens, so editing this field changes FUTURE links only.
+	*/
+	refreshTokenTtlSec: zod.z.union([zod.z.number().int().positive(), zod.z.literal("never")]).optional()
 });
 var oauthIntegrationCapability = {
 	name: "oauth-integration",
@@ -17416,7 +17468,16 @@ var SsoBridgeClaimsSchema = zod.z.object({
 	codeChallenge: zod.z.string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
-	sessionId: zod.z.string().optional()
+	sessionId: zod.z.string().optional(),
+	/**
+	* The refresh lifetime this LINK was created with, in seconds, or `'never'`.
+	* Baked into the code at `/authorize` from the integration's descriptor and
+	* carried forward so `oauthRefresh` re-mints with the same lifetime. It rides
+	* on the token rather than being re-read from the descriptor on purpose:
+	* editing a descriptor must not retroactively extend or shorten a link the
+	* operator already consented to.
+	*/
+	refreshTtl: zod.z.union([zod.z.number().int().positive(), zod.z.literal("never")]).optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -17426,7 +17487,16 @@ var ssoBridgeCapability = {
 	methods: {
 		signBridgeToken: method(zod.z.object({
 			claims: SsoBridgeClaimsSchema,
-			ttlSec: zod.z.number().int().positive().optional()
+			/**
+			* Seconds, or `'never'` for a token minted with NO `exp` claim.
+			*
+			* `'never'` is a literal rather than `undefined`/`0` because omitting
+			* this field already means "the 5-minute SSO hand-off default", and
+			* `jwt.sign` THROWS on `{ expiresIn: undefined }` — a "no expiry" that
+			* went through the numeric path would fail at mint time and break
+			* linking rather than produce an eternal token.
+			*/
+			ttlSec: zod.z.union([zod.z.number().int().positive(), zod.z.literal("never")]).optional()
 		}), zod.z.object({ token: zod.z.string() })),
 		verifyBridgeToken: method(zod.z.object({ token: zod.z.string() }), SsoBridgeClaimsSchema.nullable())
 	}
@@ -26222,7 +26292,12 @@ var userManagementCapability = {
 			hubUrl: zod.z.string(),
 			/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
 			*  that carries one can ONLY be exchanged with the matching verifier. */
-			codeChallenge: zod.z.string().optional()
+			codeChallenge: zod.z.string().optional(),
+			/** The integration's declared refresh lifetime — seconds, or `'never'`.
+			*  From `OauthIntegrationDescriptor.refreshTokenTtlSec`. Baked into the
+			*  code so the link carries its own lifetime; omit for the 30-day
+			*  default. */
+			refreshTtlSec: zod.z.union([zod.z.number().int().positive(), zod.z.literal("never")]).optional()
 		}), zod.z.object({ code: zod.z.string() }), {
 			kind: "mutation",
 			access: "create"
@@ -33730,6 +33805,18 @@ Object.defineProperty(exports, "scopeKey", {
 		return scopeKey;
 	}
 });
+Object.defineProperty(exports, "scopesAllowAddon", {
+	enumerable: true,
+	get: function() {
+		return scopesAllowAddon;
+	}
+});
+Object.defineProperty(exports, "scopesAllowDeviceCap", {
+	enumerable: true,
+	get: function() {
+		return scopesAllowDeviceCap;
+	}
+});
 Object.defineProperty(exports, "scoreRuntimes", {
 	enumerable: true,
 	get: function() {

package/dist/index.d.ts

@@ -8,7 +8,7 @@ export type { ApiKeyRecord, ApiKeyStorageAccess } from './auth/api-key-manager.j
 export { ApiKeyManager } from './auth/api-key-manager.js';
 export type { AuthConfigReader, TokenPayload } from './auth/auth-manager.js';
 export { AuthManager } from './auth/auth-manager.js';
-export { scopesAllowDeviceCap } from './auth/scope-matcher.js';
+export { scopesAllowAddon, scopesAllowDeviceCap } from './auth/scope-matcher.js';
 export { ScopedTokenManager } from './auth/scoped-token-manager.js';
 export type { UserConfigReader, UserRecord, UserStorageAccess } from './auth/user-manager.js';
 export { UserManager } from './auth/user-manager.js';

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DCLoJf2T.js");
+const require_dist = require("./dist-I0WgqQQ-.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -25,7 +25,7 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DUHPHa-Y.js");
-const require_manifest_python_deps = require("./manifest-python-deps-DafB-1hp.js");
+const require_manifest_python_deps = require("./manifest-python-deps-BqIpg0C7.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -183,16 +183,6 @@ function matchPath(pattern, path) {
 	return params;
 }
 //#endregion
-//#region src/auth/scope-matcher.ts
-/**
-* True if the scope set grants `access` on device-scoped capabilities.
-* A `category:device` grant covers every device cap (the broad grant).
-* Mirrors the OR-semantics of the existing token scope matcher.
-*/
-function scopesAllowDeviceCap(scopes, access) {
-	return scopes.some((s) => s.type === "category" && s.target === "device" && s.access.includes(access));
-}
-//#endregion
 //#region src/events/event-bus.ts
 var EventBus = class {
 	listeners = /* @__PURE__ */ new Map();
@@ -95239,7 +95229,8 @@ exports.resolveNpmInvocation = require_manifest_python_deps.resolveNpmInvocation
 exports.runNpm = require_manifest_python_deps.runNpm;
 exports.scheduleSelfRestart = scheduleSelfRestart;
 exports.scopeKey = require_dist.scopeKey;
-exports.scopesAllowDeviceCap = scopesAllowDeviceCap;
+exports.scopesAllowAddon = require_dist.scopesAllowAddon;
+exports.scopesAllowDeviceCap = require_dist.scopesAllowDeviceCap;
 exports.selectAddonResidue = selectAddonResidue;
 exports.serializeTypedArrays = require_manifest_python_deps.serializeTypedArrays;
 exports.setHubConnected = require_manifest_python_deps.setHubConnected;