@camstack/types 1.2.309 → 1.2.311

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-C3gDpn7G.js");
+const require_sleep = require("./sleep-DyF95STh.js");
 const require_event_category = require("./event-category-DmS_tLsU.js");
 const require_composition = require("./composition-BLWAivB2.js");
 const require_err_msg = require("./err-msg-Dx2Kor0g.js");
@@ -16116,7 +16116,143 @@ var filesystemBrowseCapability = {
 	}
 };
 //#endregion
+//#region src/capabilities/viewer-link-url.ts
+/** The central link domain the viewer app claims (Universal Links / App Links). */
+var CAMSTACK_APP_LINK_ORIGIN = "https://camstack.zentik.app";
+/** Where the hub serves the viewer SPA. */
+var HUB_VIEWER_MOUNT = "/viewer/camstack";
+/** True when `baseUrl` names the CamStack app link rather than a hub address. */
+function isAppLinkBase(baseUrl) {
+	if (baseUrl === null || baseUrl === void 0 || baseUrl === "") return false;
+	try {
+		return new URL(baseUrl).origin === CAMSTACK_APP_LINK_ORIGIN;
+	} catch {
+		return false;
+	}
+}
+/**
+* The base a viewer link is built on, from the flagged notification address:
+* the effective address is the explicit choice, else AUTO's `resolved`. The
+* one reading of that answer — the NC's tap and the Network page's preview
+* both go through it.
+*/
+function viewerLinkBaseOf(endpoint) {
+	const flagged = endpoint.baseUrl ?? endpoint.resolved;
+	return isAppLinkBase(flagged) ? {
+		form: "app",
+		hubBaseUrl: endpoint.appLinkHub ?? null
+	} : {
+		form: "hub",
+		hubBaseUrl: flagged
+	};
+}
+/**
+* Reduce a base URL to the bare origin the central page accepts as `hub=`,
+* or `null` when it cannot be one: not http(s), carries credentials, or does
+* not parse. A path/query/fragment is dropped — the central page mounts the
+* viewer under the origin itself.
+*/
+function toAppLinkHubOrigin(baseUrl) {
+	let parsed;
+	try {
+		parsed = new URL(baseUrl);
+	} catch {
+		return null;
+	}
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+	if (parsed.username !== "" || parsed.password !== "") return null;
+	if (parsed.hostname === "") return null;
+	return parsed.origin;
+}
+/**
+* The hub address an app link carries as `hub=`, chosen from the hub's OWN
+* advertised palette so it always agrees with what the Network page lists:
+* the public tunnel first, then the mesh (Tailscale MagicDNS) — HTTPS only,
+* because the app and the hosted viewer reach it from off the LAN. `null`
+* when the hub advertises neither.
+*/
+function pickAppLinkHub(endpoints) {
+	const rank = (e) => {
+		if (e.kind !== "public" || !e.baseUrl.startsWith("https://")) return null;
+		if (e.interfaceKind === "public") return 0;
+		if (e.interfaceKind === "vpn") return 1;
+		return null;
+	};
+	return endpoints.flatMap((e) => {
+		const r = rank(e);
+		const origin = toAppLinkHubOrigin(e.baseUrl);
+		return r === null || origin === null ? [] : [{
+			r,
+			p: e.priority,
+			origin
+		}];
+	}).toSorted((a, b) => a.r - b.r || a.p - b.p)[0]?.origin ?? null;
+}
+/** The viewer route for a destination, or null when it names nothing. */
+function viewerRoute(destination) {
+	switch (destination.kind) {
+		case "camera": {
+			if (!Number.isInteger(destination.deviceId) || destination.deviceId <= 0) return null;
+			const at = destination.atMs;
+			return {
+				path: `/camera/${String(destination.deviceId)}`,
+				query: at !== void 0 && Number.isFinite(at) ? [["at", String(Math.trunc(at))]] : []
+			};
+		}
+		case "events": return {
+			path: "/events",
+			query: []
+		};
+		case "notifications": return {
+			path: "/notifications",
+			query: []
+		};
+	}
+}
+function encodeQuery(query) {
+	if (query.length === 0) return "";
+	return `?${query.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&")}`;
+}
+/**
+* The link for a viewer destination, or `null` when none can be minted: an
+* unknown destination, or the `hub` form with no reachable base (a dead link
+* is worse than none).
+*/
+function buildViewerLink(input) {
+	const route = viewerRoute(input.destination);
+	if (route === null) return null;
+	const raw = input.base.hubBaseUrl;
+	const base = raw === null ? "" : raw.replace(/\/+$/, "");
+	if (input.base.form === "app") {
+		const origin = base === "" ? null : toAppLinkHubOrigin(base);
+		const query = origin === null ? route.query : [...route.query, ["hub", origin]];
+		return `${CAMSTACK_APP_LINK_ORIGIN}${route.path}${encodeQuery(query)}`;
+	}
+	if (base === "" || isAppLinkBase(base)) return null;
+	return `${base}${HUB_VIEWER_MOUNT}${route.path}${encodeQuery(route.query)}`;
+}
+//#endregion
 //#region src/capabilities/hub-address.ts
+var HUB_ADDRESS_ROLES = [
+	"appConnections",
+	"notificationTaps",
+	"internal",
+	"publicEndpoint"
+];
+var SINGLE_HUB_ADDRESS_ROLES = [
+	"notificationTaps",
+	"internal",
+	"publicEndpoint"
+];
+function isSingleHubAddressRole(role) {
+	return role !== "appConnections";
+}
+var AUTOMATIC_HUB_ADDRESS_FLAGS = {
+	appConnections: [],
+	notificationTaps: null,
+	internal: null,
+	publicEndpoint: null
+};
 var IPV4_LITERAL = /^\d{1,3}(?:\.\d{1,3}){3}$/;
 function hostnameOf(baseUrl) {
 	try {
@@ -16126,6 +16262,9 @@ function hostnameOf(baseUrl) {
 		return null;
 	}
 }
+function trimSlash(baseUrl) {
+	return baseUrl.replace(/\/+$/, "");
+}
 function isMesh(endpoint) {
 	return endpoint.kind === "public" && endpoint.interfaceKind === "vpn";
 }
@@ -16140,11 +16279,11 @@ function isLanIpv4Literal(endpoint) {
 	const host = hostnameOf(endpoint.baseUrl);
 	return host !== null && IPV4_LITERAL.test(host);
 }
-/** Lower = better; `null` = never this audience's answer. */
-function rankFor(audience, endpoint) {
-	if (endpoint.kind === "loopback" || endpoint.kind === "app-link") return null;
+/** Lower = better; `null` = never this role's AUTOMATIC answer. */
+function autoRankFor(role, endpoint) {
+	if (endpoint.kind === "loopback" || endpoint.kind === "app-link" || endpoint.kind === "custom") return null;
 	if (hostnameOf(endpoint.baseUrl) === null) return null;
-	if (audience === "cluster") {
+	if (role === "internal") {
 		if (isLanIpv4Literal(endpoint)) return 0;
 		if (isPlausibleLan(endpoint)) return 1;
 		if (isMesh(endpoint)) return 2;
@@ -16170,11 +16309,11 @@ function isLoopbackHost(hostname) {
 	return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
 }
 /**
-* Validate an operator-typed override: an http(s) URL with a host, no
+* Validate an operator-typed address: an http(s) URL with a host, no
 * credentials, no path, and never loopback (it would name whoever dials it).
 * Answers the normalised origin (`scheme://host[:port]`).
 */
-function validateHubAddressOverride(raw) {
+function validateCustomAddress(raw) {
 	const trimmed = raw.trim();
 	if (trimmed === "") return {
 		ok: false,
@@ -16214,47 +16353,130 @@ function validateHubAddressOverride(raw) {
 		baseUrl: parsed.origin
 	};
 }
+/** The reason a plain-http public endpoint is refused unless accepted. */
+var PUBLIC_ENDPOINT_HTTP_REASON = "The public endpoint needs an https:// address: passkeys and most identity providers refuse a plain-http origin. Accept http only when sign-in and notification links never leave your own network.";
 /**
-* The hub's base URL for `audience`, without a trailing slash, or `null` when
-* the palette holds nothing that audience can reach. A valid operator
-* `override` wins outright; an empty one means automatic. Ties inside a rank
-* go to the palette's own `priority` (its preferred interface first).
+* May `baseUrl` carry `role`? The address check above, plus two role rules:
+* the app link carries `notificationTaps` only (it is not a hub address), and
+* a plain-http address carries `publicEndpoint` only when the operator
+* explicitly accepted it (`acceptInsecureHttp`) — a LAN-only password or
+* magic-link sign-in works over http, a passkey or an OIDC callback does not.
 */
-function pickHubBaseUrl(endpoints, audience, override = null) {
-	return resolveHubAddress(endpoints, audience, override).resolved;
-}
-/** {@link pickHubBaseUrl}, saying where the answer came from. */
-function resolveHubAddress(endpoints, audience, override) {
-	if (override !== null && override !== "") {
-		const check = validateHubAddressOverride(override);
-		if (check.ok) return {
-			override,
-			resolved: check.baseUrl,
-			source: "override"
-		};
-	}
-	const auto = pickFromPalette(endpoints, audience);
-	return {
-		override: override === null || override === "" ? null : override,
-		resolved: auto,
-		source: auto === null ? "none" : "auto"
+function checkRoleAddress(role, baseUrl, options = {}) {
+	if (isAppLinkBase(baseUrl)) return role === "notificationTaps" ? {
+		ok: true,
+		baseUrl: CAMSTACK_APP_LINK_ORIGIN
+	} : {
+		ok: false,
+		reason: "The CamStack app link is not a hub address — only notification taps can use it."
 	};
+	const check = validateCustomAddress(baseUrl);
+	if (!check.ok) return check;
+	if (role === "publicEndpoint" && check.baseUrl.startsWith("http:") && options.acceptInsecureHttp !== true) return {
+		ok: false,
+		reason: PUBLIC_ENDPOINT_HTTP_REASON
+	};
+	return check;
+}
+/** A stored flag that still validates (stored values are external data). */
+function validFlag(role, flag) {
+	if (flag === null || flag === "") return null;
+	const check = checkRoleAddress(role, flag, { acceptInsecureHttp: true });
+	return check.ok ? check.baseUrl : null;
 }
-function pickFromPalette(endpoints, audience) {
+function pickAuto(endpoints, role) {
 	const best = endpoints.flatMap((endpoint) => {
-		const rank = rankFor(audience, endpoint);
+		const rank = autoRankFor(role, endpoint);
 		return rank === null ? [] : [{
 			rank,
 			priority: endpoint.priority,
 			endpoint
 		}];
 	}).toSorted((a, b) => a.rank - b.rank || a.priority - b.priority)[0];
-	return best === void 0 ? null : best.endpoint.baseUrl.replace(/\/+$/, "");
+	return best === void 0 ? null : trimSlash(best.endpoint.baseUrl);
+}
+function resolveHubRole(endpoints, role, flag) {
+	const flagged = validFlag(role, flag);
+	if (flagged !== null) return {
+		flagged,
+		resolved: flagged,
+		source: "flagged"
+	};
+	const auto = pickAuto(endpoints, role);
+	return {
+		flagged: null,
+		resolved: auto,
+		source: auto === null ? "none" : "auto"
+	};
 }
-/** The bare hostname of {@link pickHubBaseUrl}'s answer, or `null`. */
-function pickHubHostname(endpoints, audience, override = null) {
-	const baseUrl = pickHubBaseUrl(endpoints, audience, override);
-	return baseUrl === null ? null : hostnameOf(baseUrl);
+/** `internal`: what agents and LAN devices download from. */
+function resolveInternalAddress(endpoints, flags) {
+	return resolveHubRole(endpoints, "internal", flags.internal);
+}
+/**
+* `publicEndpoint`: every URL that must work off the LAN — sign-in links, OIDC
+* / OAuth2 callbacks, the relying party, and notification buttons,
+* attachments, media and admin links.
+*/
+function resolvePublicEndpoint(endpoints, flags) {
+	return resolveHubRole(endpoints, "publicEndpoint", flags.publicEndpoint);
+}
+/** `notificationTaps`: the flagged address, else the CamStack app link (D709). */
+function resolveNotificationTapAddress(flags) {
+	const flagged = validFlag("notificationTaps", flags.notificationTaps);
+	if (flagged !== null && !isAppLinkBase(flagged)) return {
+		flagged,
+		resolved: flagged,
+		source: "flagged"
+	};
+	return {
+		flagged: null,
+		resolved: CAMSTACK_APP_LINK_ORIGIN,
+		source: "auto"
+	};
+}
+/** AUTO app connections: LAN IPv4 + the public tunnel. Never IPv6, mesh, loopback or custom. */
+function isDefaultAppConnectionEndpoint(endpoint) {
+	if (endpoint.kind === "lan-ipv4") return true;
+	return endpoint.kind === "public" && endpoint.interfaceKind === "public";
+}
+/**
+* The endpoints the apps race: the flagged ones that are in `endpoints`
+* (which carries the custom addresses flagged `appConnections`), else AUTO. A flagged
+* set none of which is currently up falls back to AUTO rather than racing
+* nothing.
+*/
+function selectAppConnectionEndpoints(endpoints, flags) {
+	const auto = endpoints.filter(isDefaultAppConnectionEndpoint);
+	if (flags.appConnections.length === 0) return auto;
+	const wanted = new Set(flags.appConnections);
+	const explicit = endpoints.filter((e) => wanted.has(e.baseUrl));
+	return explicit.length > 0 ? explicit : auto;
+}
+/** `appConnections`: what the apps try when connecting. */
+function resolveAppConnections(endpoints, flags) {
+	const wanted = new Set(flags.appConnections);
+	const selected = selectAppConnectionEndpoints(endpoints, flags);
+	const usedFlags = selected.some((e) => wanted.has(e.baseUrl));
+	return {
+		flagged: flags.appConnections,
+		resolved: selected.map((e) => e.baseUrl),
+		source: selected.length === 0 ? "none" : usedFlags ? "flagged" : "auto"
+	};
+}
+/**
+* Every role at once, each through its own resolver. `appPalette` is what
+* the apps race (it carries the custom addresses flagged `appConnections`);
+* `hubPalette` is the detected HTTPS palette `internal` and `publicEndpoint`
+* resolve over.
+*/
+function resolveHubAddressRoles(appPalette, hubPalette, flags) {
+	return {
+		appConnections: resolveAppConnections(appPalette, flags),
+		notificationTaps: resolveNotificationTapAddress(flags),
+		internal: resolveInternalAddress(hubPalette, flags),
+		publicEndpoint: resolvePublicEndpoint(hubPalette, flags)
+	};
 }
 /** The bare hostname of a base URL, or `null` when it does not parse. */
 function hubAddressHostname(baseUrl) {
@@ -22058,7 +22280,13 @@ var NcAlarmModeDelaysSchema = zod.z.object({
 	* Absent = false (logged, not sent). Even when true it is not sent when that same sensor
 	* is the one that starts the entry delay — the entry-delay notification already names it.
 	*/
-	notifySensorRewatched: zod.z.boolean().optional()
+	notifySensorRewatched: zod.z.boolean().optional(),
+	/**
+	* D735: notify "ignored" when a sensor this arm bypassed really MOVED while armed (its own
+	* change time is after the arm) and set nothing off. Absent = false (logged, not sent). A
+	* re-sync, a recovery from `unavailable` or a duplicate is never announced, switch or not.
+	*/
+	notifySensorIgnored: zod.z.boolean().optional()
 });
 var NcAlarmModeDelaysListSchema = zod.z.array(NcAlarmModeDelaysSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
 /**
@@ -22077,7 +22305,9 @@ var NcAlarmModeDelaysEditSchema = zod.z.object({
 	/** D706: set the switch, or `null` to clear it (back to the default, false). */
 	notifyDuringEntryDelay: zod.z.boolean().nullable().optional(),
 	/** D706: set the switch, or `null` to clear it (back to the default, false). */
-	notifySensorRewatched: zod.z.boolean().nullable().optional()
+	notifySensorRewatched: zod.z.boolean().nullable().optional(),
+	/** D735: set the switch, or `null` to clear it (back to the default, false). */
+	notifySensorIgnored: zod.z.boolean().nullable().optional()
 });
 var NcAlarmModeDelaysEditListSchema = zod.z.array(NcAlarmModeDelaysEditSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
 /** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
@@ -32796,122 +33026,6 @@ var CLIP_PLAYBACK_OPTIONS = {
 	}
 };
 //#endregion
-//#region src/capabilities/viewer-link-url.ts
-/** The central link domain the viewer app claims (Universal Links / App Links). */
-var CAMSTACK_APP_LINK_ORIGIN = "https://camstack.zentik.app";
-/** Where the hub serves the viewer SPA. */
-var HUB_VIEWER_MOUNT = "/viewer/camstack";
-/** True when `baseUrl` names the CamStack app link rather than a hub address. */
-function isAppLinkBase(baseUrl) {
-	if (baseUrl === null || baseUrl === void 0 || baseUrl === "") return false;
-	try {
-		return new URL(baseUrl).origin === CAMSTACK_APP_LINK_ORIGIN;
-	} catch {
-		return false;
-	}
-}
-/**
-* The base a viewer link is built on, from the flagged notification address:
-* the effective address is the explicit choice, else AUTO's `resolved`. The
-* one reading of that answer — the NC's tap and the Network page's preview
-* both go through it.
-*/
-function viewerLinkBaseOf(endpoint) {
-	const flagged = endpoint.baseUrl ?? endpoint.resolved;
-	return isAppLinkBase(flagged) ? {
-		form: "app",
-		hubBaseUrl: endpoint.appLinkHub ?? null
-	} : {
-		form: "hub",
-		hubBaseUrl: flagged
-	};
-}
-/**
-* Reduce a base URL to the bare origin the central page accepts as `hub=`,
-* or `null` when it cannot be one: not http(s), carries credentials, or does
-* not parse. A path/query/fragment is dropped — the central page mounts the
-* viewer under the origin itself.
-*/
-function toAppLinkHubOrigin(baseUrl) {
-	let parsed;
-	try {
-		parsed = new URL(baseUrl);
-	} catch {
-		return null;
-	}
-	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
-	if (parsed.username !== "" || parsed.password !== "") return null;
-	if (parsed.hostname === "") return null;
-	return parsed.origin;
-}
-/**
-* The hub address an app link carries as `hub=`, chosen from the hub's OWN
-* advertised palette so it always agrees with what the Network page lists:
-* the public tunnel first, then the mesh (Tailscale MagicDNS) — HTTPS only,
-* because the app and the hosted viewer reach it from off the LAN. `null`
-* when the hub advertises neither.
-*/
-function pickAppLinkHub(endpoints) {
-	const rank = (e) => {
-		if (e.kind !== "public" || !e.baseUrl.startsWith("https://")) return null;
-		if (e.interfaceKind === "public") return 0;
-		if (e.interfaceKind === "vpn") return 1;
-		return null;
-	};
-	return endpoints.flatMap((e) => {
-		const r = rank(e);
-		const origin = toAppLinkHubOrigin(e.baseUrl);
-		return r === null || origin === null ? [] : [{
-			r,
-			p: e.priority,
-			origin
-		}];
-	}).toSorted((a, b) => a.r - b.r || a.p - b.p)[0]?.origin ?? null;
-}
-/** The viewer route for a destination, or null when it names nothing. */
-function viewerRoute(destination) {
-	switch (destination.kind) {
-		case "camera": {
-			if (!Number.isInteger(destination.deviceId) || destination.deviceId <= 0) return null;
-			const at = destination.atMs;
-			return {
-				path: `/camera/${String(destination.deviceId)}`,
-				query: at !== void 0 && Number.isFinite(at) ? [["at", String(Math.trunc(at))]] : []
-			};
-		}
-		case "events": return {
-			path: "/events",
-			query: []
-		};
-		case "notifications": return {
-			path: "/notifications",
-			query: []
-		};
-	}
-}
-function encodeQuery(query) {
-	if (query.length === 0) return "";
-	return `?${query.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&")}`;
-}
-/**
-* The link for a viewer destination, or `null` when none can be minted: an
-* unknown destination, or the `hub` form with no reachable base (a dead link
-* is worse than none).
-*/
-function buildViewerLink(input) {
-	const route = viewerRoute(input.destination);
-	if (route === null) return null;
-	const raw = input.base.hubBaseUrl;
-	const base = raw === null ? "" : raw.replace(/\/+$/, "");
-	if (input.base.form === "app") {
-		const origin = base === "" ? null : toAppLinkHubOrigin(base);
-		const query = origin === null ? route.query : [...route.query, ["hub", origin]];
-		return `${CAMSTACK_APP_LINK_ORIGIN}${route.path}${encodeQuery(query)}`;
-	}
-	if (base === "" || isAppLinkBase(base)) return null;
-	return `${base}${HUB_VIEWER_MOUNT}${route.path}${encodeQuery(route.query)}`;
-}
-//#endregion
 //#region src/capabilities/webrtc-session.cap.ts
 /**
 * Optional client-side hints sent at session creation to help the provider
@@ -33419,6 +33533,35 @@ var webrtcSessionCapability = {
 			alive: zod.z.boolean()
 		})),
 		/**
+		* The viewer's downlink probe, for ONE live session (D733).
+		*
+		* The player measures `/adaptive-probe` after the session's first decoded
+		* frame (D635). It used to act on the reading itself, by opening a SECOND
+		* session with `hints.downlinkMbps` — every adaptive live open became two
+		* sessions, two ICE + DTLS handshakes and two server pipelines. It now
+		* hands the measurement to the session it already has; the provider picks
+		* the rung exactly as it would from an offer's hints (same viewport
+		* ceiling) and moves the session there — in place when the negotiated
+		* codec carries the new rendition, by the existing re-offer
+		* (`getSessionState.pendingRenegotiation`) when it cannot.
+		*
+		* A MEASUREMENT, never a tier: the client does not choose. A probe only
+		* raises the rung; lowering it stays the ladder's call on delivery.
+		* `held` answers why nothing moved (`not-adaptive`, `pinned`,
+		* `already-there`, `recorded`, …) — a client that gets ANY answer must not
+		* fall back to a reconnect; only a provider that does not know the method
+		* (an older hub) leaves the client its legacy second session.
+		*/
+		applyDownlinkProbe: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number().int().nonnegative(),
+			sessionId: zod.z.string(),
+			downlinkMbps: zod.z.number().nonnegative()
+		}), zod.z.object({
+			outcome: zod.z.enum(["switching", "held"]),
+			tier: require_sleep.CamProfileSchema.nullable(),
+			reason: zod.z.string()
+		}), { kind: "mutation" }),
+		/**
 		* The SERVER's half of the stream-debug overlay, for one live session.
 		*
 		* The client can measure its own transport (`getStats()`); it cannot see
@@ -37840,7 +37983,8 @@ var ConnectionEndpointSchema = zod.z.object({
 		"lan-ipv6",
 		"public",
 		"loopback",
-		"app-link"
+		"app-link",
+		"custom"
 	]),
 	/**
 	* Originating-interface kind — `lan`/`wifi`/`docker`/`vpn`/`other`/
@@ -37909,7 +38053,7 @@ var GetConnectionEndpointsResultSchema = zod.z.object({
 	localPort: AdvertisedLocalPortSchema
 });
 /**
-* The address flagged for notification links. `baseUrl: null` = AUTO, which
+* The address flagged for notification taps (`notificationTaps`). `baseUrl: null` = AUTO, which
 * since D709 is the CamStack app link; `resolved` reports the effective value,
 * so the UI can show it either way.
 */
@@ -37943,13 +38087,12 @@ var ViewerEndpointsSchema = zod.z.object({
 	resolved: zod.z.array(zod.z.string()).readonly()
 });
 /**
-* One audience's hub address (see `hub-address.ts`): the operator's stored
-* override, the address in use, and where it came from.
+* DEPRECATED compatibility shape of `getHubAddresses` (D729 amendment, kept
+* for addons built against it): `cluster` is the `internal` role, `browser`
+* the `publicEndpoint` role; `override` is the flagged address.
 */
 var HubAddressSnapshotSchema = zod.z.object({
-	/** The operator's override, or null for automatic. */
 	override: zod.z.string().nullable(),
-	/** The address in use, or null when nothing qualifies (never loopback). */
 	resolved: zod.z.string().nullable(),
 	source: zod.z.enum([
 		"override",
@@ -37958,11 +38101,63 @@ var HubAddressSnapshotSchema = zod.z.object({
 	])
 });
 var HubAddressesSchema = zod.z.object({
-	/** "Hub address for agents" — agents' bundle/model pulls, LAN devices. */
 	cluster: HubAddressSnapshotSchema,
-	/** "Public address for sign-in links" — e-mail links, OIDC, WebAuthn, OAuth2. */
 	browser: HubAddressSnapshotSchema
 });
+/**
+* What an address is used for (`hub-address.ts`, D734). `appConnections` is
+* many-valued; `notificationTaps`, `publicEndpoint` and `internal` are carried
+* by at most one address.
+*/
+var HubAddressRoleSchema = zod.z.enum(HUB_ADDRESS_ROLES);
+var RoleSourceSchema = zod.z.enum([
+	"flagged",
+	"auto",
+	"none"
+]);
+/** One single-valued role: the flagged address, the one in use, and why. */
+var HubAddressRoleResolutionSchema = zod.z.object({
+	/** The address carrying the flag, or null = automatic. */
+	flagged: zod.z.string().nullable(),
+	/** The address in use, or null when nothing qualifies (never loopback). */
+	resolved: zod.z.string().nullable(),
+	source: RoleSourceSchema
+});
+var HubAppConnectionsResolutionSchema = zod.z.object({
+	/** The addresses flagged `appConnections`, or empty = automatic. */
+	flagged: zod.z.array(zod.z.string()).readonly(),
+	/** What the apps race right now. */
+	resolved: zod.z.array(zod.z.string()).readonly(),
+	source: RoleSourceSchema
+});
+/**
+* One row of the Network page's Addresses table: a detected endpoint, an
+* operator-entered custom address, or the CamStack app link — flagged the
+* same way. A URL that is both detected and entered is ONE row.
+*/
+var HubAddressRowSchema = ConnectionEndpointSchema.extend({
+	/** In the hub's detected palette right now. */
+	detected: zod.z.boolean(),
+	/** Entered by the operator (removable). */
+	custom: zod.z.boolean(),
+	/** The roles explicitly flagged on this address. */
+	flags: zod.z.array(HubAddressRoleSchema).readonly(),
+	/** The roles this address serves right now — flagged or automatic. */
+	inUse: zod.z.array(HubAddressRoleSchema).readonly(),
+	/** The roles this address may be flagged with. */
+	eligible: zod.z.array(HubAddressRoleSchema).readonly()
+});
+var HubAddressBookSchema = zod.z.object({
+	rows: zod.z.array(HubAddressRowSchema).readonly(),
+	roles: zod.z.object({
+		appConnections: HubAppConnectionsResolutionSchema,
+		notificationTaps: HubAddressRoleResolutionSchema,
+		internal: HubAddressRoleResolutionSchema,
+		publicEndpoint: HubAddressRoleResolutionSchema
+	}),
+	/** The `hub=` an app link carries (D709), or null. */
+	appLinkHub: zod.z.string().nullable()
+});
 var AllowedAddressesSchema = zod.z.object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -38053,19 +38248,18 @@ var localNetworkCapability = {
 			*  tunnel always emits `https://` regardless. */
 			scheme: zod.z.enum(["http", "https"]).optional(),
 			/** Append the CamStack app link entry (`kind: 'app-link'`, D709) —
-			*  an address notification links can be flagged with, not a hub
+			*  an address notification taps can be flagged with, not a hub
 			*  route. Default `false`: racers and rankers never see it. */
 			includeAppLink: zod.z.boolean().optional()
 		}), GetConnectionEndpointsResultSchema),
 		/**
-		* The address notification links are flagged with. `baseUrl: null` means
-		* AUTO, which is the CamStack app link (D709): viewer taps go through
-		* `https://camstack.zentik.app/…?hub=<appLinkHub>` and open the app. Any
-		* hub address the palette lists can be flagged instead; then viewer taps,
-		* attachment links and action buttons all use it. Signed media and
-		* buttons never use the app link — with it flagged (or AUTO) they keep
-		* the ranked hub ladder (a configured origin, a connected tunnel, then
-		* the LAN), never loopback.
+		* The `notificationTaps` role (D734): where TAPPING a notification opens.
+		* `baseUrl: null` means AUTO, which is the CamStack app link (D709): taps
+		* go through `https://camstack.zentik.app/…?hub=<appLinkHub>` and open the
+		* app. Any hub address the palette lists can be flagged instead; then a
+		* tap opens that address. Only the tap: action buttons, attachment /
+		* media links and admin links follow the `publicEndpoint` role
+		* (`getAddresses().roles.publicEndpoint`), never this one.
 		*
 		* Why an explicit marker: the automatic ranking cannot know which of
 		* several reachable addresses the RECIPIENT can actually open. A link is
@@ -38075,46 +38269,80 @@ var localNetworkCapability = {
 		*/
 		getNotificationEndpoint: require_sleep.method(zod.z.void(), NotificationEndpointSchema),
 		/**
-		* Mark which endpoint notification artifacts use. `baseUrl: null` restores
-		* AUTO. The value is stored verbatim (not an index into the candidate
-		* list): interfaces come and go, and an index would silently re-point at a
-		* different address after a reboot.
+		* @deprecated Use `setAddressRole({ role: 'notificationTaps', … })`. It
+		* writes the same `notificationTaps` flag, with the same validation. `baseUrl: null` restores automatic; an
+		* address that is not detected becomes a custom address.
 		*/
 		setNotificationEndpoint: require_sleep.method(zod.z.object({ baseUrl: zod.z.string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }),
 		/**
-		* The endpoints the SDK / viewer races for API access. Empty `baseUrls`
-		* means AUTO: every LAN IPv4 address plus the public tunnel, never IPv6,
-		* never mesh, never loopback. `resolved` is that set (or the operator's
-		* explicit subset) as it stands right now.
+		* The `appConnections` role as shipped apps read it: the flagged addresses
+		* (detected or custom), or empty for AUTO — every LAN IPv4 address plus
+		* the public tunnel, never IPv6, mesh, loopback or a custom address.
+		* `resolved` is the set as it stands right now; the custom ones in it are
+		* also in `getConnectionEndpoints`, which the apps filter by it.
 		*/
 		getViewerEndpoints: require_sleep.method(zod.z.void(), ViewerEndpointsSchema),
 		/**
-		* Replace the viewer race set. Empty `baseUrls` restores AUTO. Stored
-		* verbatim (not indices) so a temporarily-down tunnel is not silently
-		* dropped from the operator's choice.
+		* @deprecated Use `setAddressRole({ role: 'appConnections', … })`. It
+		* replaces the same `appConnections` flags.
+		* Empty `baseUrls` restores automatic.
 		*/
 		setViewerEndpoints: require_sleep.method(zod.z.object({ baseUrls: zod.z.array(zod.z.string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }),
 		/**
-		* The hub's address for each audience — agents (`cluster`) and sign-in
-		* links (`browser`) — as every consumer must read it: the operator's
-		* override when set, else the automatic pick from this cap's palette,
-		* never loopback. The ONE answer to "at which address is this hub
-		* reached?"; there is no environment variable for it.
+		* The Network page's Addresses table and every role's answer — the ONE
+		* reading of "which address is this hub reached at, for what": detected
+		* endpoints and custom addresses with their role flags, and per role the
+		* flagged address, the one in use and whether it is automatic. Agent
+		* deliveries and LAN devices read `roles.internal`; sign-in, OAuth2 and
+		* the notification centre's buttons / media / admin links read
+		* `roles.publicEndpoint`; nothing ranks the palette itself. `scheme` is
+		* the one the caller shows LAN rows in (as `getConnectionEndpoints`);
+		* `internal` and `publicEndpoint` are always resolved over the HTTPS
+		* palette.
 		*/
-		getHubAddresses: require_sleep.method(zod.z.void(), HubAddressesSchema),
+		getAddresses: require_sleep.method(zod.z.object({ scheme: zod.z.enum(["http", "https"]).optional() }).optional(), HubAddressBookSchema),
 		/**
-		* Set or clear (`baseUrl: null`) one audience's override. Validated: an
-		* http(s) origin with a host, no credentials, no path, never loopback —
-		* an invalid value is refused with the reason, nothing is stored.
+		* Add a custom address. Validated: an http(s) origin with a host, no
+		* credentials, no path, never loopback — an invalid one is refused with
+		* the reason and nothing is stored. Adding an address that already exists
+		* only updates its label.
 		*/
-		setHubAddress: require_sleep.method(zod.z.object({
-			audience: zod.z.enum(["cluster", "browser"]),
-			baseUrl: zod.z.string().nullable()
-		}), HubAddressesSchema, {
+		addCustomAddress: require_sleep.method(zod.z.object({
+			baseUrl: zod.z.string(),
+			label: zod.z.string().max(80)
+		}), HubAddressBookSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Remove a custom address. Its role flags go with it (those roles turn automatic). */
+		removeCustomAddress: require_sleep.method(zod.z.object({ baseUrl: zod.z.string() }), HubAddressBookSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
 		/**
+		* Flag (`enabled: true`) or unflag an address for a role. For a
+		* single-valued role, flagging moves the flag off every other address.
+		* `baseUrl: null` returns the role to automatic. The address must be a row
+		* of the table (detected, custom, or the app link for `notificationTaps`);
+		* `publicEndpoint` on a plain-http address is refused unless
+		* `acceptInsecureHttp`, and never takes the app link.
+		*/
+		setAddressRole: require_sleep.method(zod.z.object({
+			role: HubAddressRoleSchema,
+			baseUrl: zod.z.string().nullable(),
+			enabled: zod.z.boolean(),
+			acceptInsecureHttp: zod.z.boolean().optional()
+		}), HubAddressBookSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* @deprecated Read `getAddresses().roles.internal` / `.publicEndpoint`.
+		* Kept so an addon built against the D729 amendment keeps resolving:
+		* `cluster` = the `internal` role, `browser` = the `publicEndpoint` role.
+		*/
+		getHubAddresses: require_sleep.method(zod.z.void(), HubAddressesSchema),
+		/**
 		* Read the operator's allowlist. Empty = "auto" (no filter). Used
 		* by the admin UI's address selector to seed its checkbox state.
 		*/
@@ -53757,12 +53985,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.addCustomAddress": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.downloadCa": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getAddresses": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -53817,6 +54057,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.removeCustomAddress": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
@@ -53829,13 +54075,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"localNetwork.setAllowedAddresses": {
+	"localNetwork.setAddressRole": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"localNetwork.setHubAddress": {
+	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
@@ -58089,6 +58335,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"webrtcSession.applyDownlinkProbe": {
+		capName: "webrtc-session",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"webrtcSession.closeSession": {
 		capName: "webrtc-session",
 		capScope: "device",
@@ -65363,6 +65615,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"webrtcSession.applyDownlinkProbe": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"webrtcSession.closeSession": [{
 		name: "deviceId",
 		form: "single",
@@ -66403,8 +66660,11 @@ function createSystemProxy(api) {
 			setNotificationEndpoint: (input) => dispatch("localNetwork", "setNotificationEndpoint", "mutation", input),
 			getViewerEndpoints: (input) => dispatch("localNetwork", "getViewerEndpoints", "query", input),
 			setViewerEndpoints: (input) => dispatch("localNetwork", "setViewerEndpoints", "mutation", input),
+			getAddresses: (input) => dispatch("localNetwork", "getAddresses", "query", input),
+			addCustomAddress: (input) => dispatch("localNetwork", "addCustomAddress", "mutation", input),
+			removeCustomAddress: (input) => dispatch("localNetwork", "removeCustomAddress", "mutation", input),
+			setAddressRole: (input) => dispatch("localNetwork", "setAddressRole", "mutation", input),
 			getHubAddresses: (input) => dispatch("localNetwork", "getHubAddresses", "query", input),
-			setHubAddress: (input) => dispatch("localNetwork", "setHubAddress", "mutation", input),
 			getAllowedAddresses: (input) => dispatch("localNetwork", "getAllowedAddresses", "query", input),
 			setAllowedAddresses: (input) => dispatch("localNetwork", "setAllowedAddresses", "mutation", input),
 			resetAllowlistToBestMatch: (input) => dispatch("localNetwork", "resetAllowlistToBestMatch", "mutation", input),
@@ -68657,17 +68917,23 @@ var NC_ALARM_DELAY_FIELDS = [
 * all read this one constant.
 */
 var NC_ALARM_DEFAULT_TRIGGERED_DURATION_SEC = 30;
-var NC_ALARM_NOTIFY_FIELDS = ["notifyDuringEntryDelay", "notifySensorRewatched"];
+var NC_ALARM_NOTIFY_FIELDS = [
+	"notifyDuringEntryDelay",
+	"notifySensorRewatched",
+	"notifySensorIgnored"
+];
 /**
 * The switches `mode` runs on. There is no global value: absent is OFF (operator decision
 * 2026-10-06 — the entry-delay notification is the only one by default, and "watched again"
-* is not sent). An answer from an older hub carries no switch and reads as off.
+* is not sent; 2026-10-07 — nor is "ignored", D735). An answer from an older hub carries no
+* switch and reads as off.
 */
 function resolveModeNotifyPolicy(settings, mode) {
 	const entry = (settings.modeDelays ?? []).find((e) => e.mode === mode);
 	return {
 		notifyDuringEntryDelay: entry?.notifyDuringEntryDelay === true,
-		notifySensorRewatched: entry?.notifySensorRewatched === true
+		notifySensorRewatched: entry?.notifySensorRewatched === true,
+		notifySensorIgnored: entry?.notifySensorIgnored === true
 	};
 }
 /**
@@ -68759,6 +69025,7 @@ function applyModeDelaysEdits(current, edits) {
 		const schedule = editedSchedule(base.schedule, edit.schedule);
 		const duringEntry = editedFlag(base.notifyDuringEntryDelay, edit.notifyDuringEntryDelay);
 		const rewatched = editedFlag(base.notifySensorRewatched, edit.notifySensorRewatched);
+		const ignored = editedFlag(base.notifySensorIgnored, edit.notifySensorIgnored);
 		if (exit !== void 0) next.exitDelaySec = exit;
 		if (entry !== void 0) next.entryDelaySec = entry;
 		if (triggered !== void 0) next.triggeredDurationSec = triggered;
@@ -68766,10 +69033,11 @@ function applyModeDelaysEdits(current, edits) {
 		if (schedule !== void 0) next.schedule = schedule;
 		if (duringEntry !== void 0) next.notifyDuringEntryDelay = duringEntry;
 		if (rewatched !== void 0) next.notifySensorRewatched = rewatched;
+		if (ignored !== void 0) next.notifySensorIgnored = ignored;
 		if (at >= 0) out[at] = next;
 		else out.push(next);
 	}
-	return out.filter((e) => e.exitDelaySec !== void 0 || e.entryDelaySec !== void 0 || e.triggeredDurationSec !== void 0 || e.postTriggeredAction !== void 0 || e.schedule !== void 0 || e.notifyDuringEntryDelay !== void 0 || e.notifySensorRewatched !== void 0);
+	return out.filter((e) => e.exitDelaySec !== void 0 || e.entryDelaySec !== void 0 || e.triggeredDurationSec !== void 0 || e.postTriggeredAction !== void 0 || e.schedule !== void 0 || e.notifyDuringEntryDelay !== void 0 || e.notifySensorRewatched !== void 0 || e.notifySensorIgnored !== void 0);
 }
 /**
 * Put ONE device on, or take it off, ONE mode's device-id list. A no-op answers
@@ -73591,6 +73859,7 @@ exports.AUDIO_NOT_CLASSIFIED_REASONS = AUDIO_NOT_CLASSIFIED_REASONS;
 exports.AUDIO_PRESETS = require_composition.AUDIO_PRESETS;
 exports.AUDIO_SCALE_EPOCH_ISO = AUDIO_SCALE_EPOCH_ISO;
 exports.AUDIO_SCALE_EPOCH_MS = AUDIO_SCALE_EPOCH_MS;
+exports.AUTOMATIC_HUB_ADDRESS_FLAGS = AUTOMATIC_HUB_ADDRESS_FLAGS;
 exports.AccessoriesStatusSchema = AccessoriesStatusSchema;
 exports.AccessoryKind = AccessoryKind;
 exports.AddBrokerInputSchema = AddBrokerInputSchema;
@@ -74158,12 +74427,14 @@ exports.HAP_KEYFRAME_INTERVAL_SEC = HAP_KEYFRAME_INTERVAL_SEC;
 exports.HF_BASE_URL = HF_BASE_URL;
 exports.HF_REPO = HF_REPO;
 exports.HOURS_PER_DAY = HOURS_PER_DAY;
+exports.HUB_ADDRESS_ROLES = HUB_ADDRESS_ROLES;
 exports.HUB_VIEWER_MOUNT = HUB_VIEWER_MOUNT;
 exports.HWACCEL_OPTIONS = HWACCEL_OPTIONS;
 exports.HealthStatusSchema = HealthStatusSchema;
 exports.HfModelResolutionSchema = HfModelResolutionSchema;
 exports.HistoryPointSchema = HistoryPointSchema;
 exports.HistoryResolutionEnum = HistoryResolutionEnum;
+exports.HubAddressRoleSchema = HubAddressRoleSchema;
 exports.HumidifierStatusSchema = HumidifierStatusSchema;
 exports.HumiditySensorStatusSchema = HumiditySensorStatusSchema;
 exports.HvacModeSchema = HvacModeSchema;
@@ -74638,6 +74909,7 @@ exports.PIPELINE_OWNER_CAPABILITY_NAMES = PIPELINE_OWNER_CAPABILITY_NAMES;
 exports.PRIVACY_MASK_CAP_NAME = PRIVACY_MASK_CAP_NAME;
 exports.PROVIDER_KIND_CAP_NAMES = PROVIDER_KIND_CAP_NAMES;
 exports.PROVIDER_PIN_FIELD = require_sleep.PROVIDER_PIN_FIELD;
+exports.PUBLIC_ENDPOINT_HTTP_REASON = PUBLIC_ENDPOINT_HTTP_REASON;
 exports.PYTHON_SCRIPT = PYTHON_SCRIPT;
 exports.PackageUpdateSchema = PackageUpdateSchema;
 exports.PackageVersionInfoSchema = PackageVersionInfoSchema;
@@ -74823,6 +75095,7 @@ exports.SCOPE_PRESETS = SCOPE_PRESETS;
 exports.SENSOR_FEATURES = SENSOR_FEATURES;
 exports.SENSOR_MAP = SENSOR_MAP;
 exports.SHARE_VIEW_KINDS = require_sleep.SHARE_VIEW_KINDS;
+exports.SINGLE_HUB_ADDRESS_ROLES = SINGLE_HUB_ADDRESS_ROLES;
 exports.SOURCE_CAPS = require_composition.SOURCE_CAPS;
 exports.SOURCE_CAP_ACTIVE_FIELD = require_composition.SOURCE_CAP_ACTIVE_FIELD;
 exports.SOURCE_CAP_CHANGED_AT_FIELD = require_composition.SOURCE_CAP_CHANGED_AT_FIELD;
@@ -75170,6 +75443,7 @@ exports.canConvertUnit = canConvertUnit;
 exports.canonicalEgressPlan = canonicalEgressPlan;
 exports.carbonMonoxideCapability = carbonMonoxideCapability;
 exports.cellsToRects = cellsToRects;
+exports.checkRoleAddress = checkRoleAddress;
 exports.classifyBearerPrincipal = classifyBearerPrincipal;
 exports.classifyStream = classifyStream;
 exports.classifyStreams = classifyStreams;
@@ -75404,6 +75678,7 @@ exports.isBatteryPresenceFault = isBatteryPresenceFault;
 exports.isClusterScopedStep = isClusterScopedStep;
 exports.isCollectionArrayMethod = isCollectionArrayMethod;
 exports.isDefaultAlarmProfileId = isDefaultAlarmProfileId;
+exports.isDefaultAppConnectionEndpoint = isDefaultAppConnectionEndpoint;
 exports.isDeployableToAgent = isDeployableToAgent;
 exports.isDetectionMacroClass = isDetectionMacroClass;
 exports.isDeviceConfigCap = require_sleep.isDeviceConfigCap;
@@ -75433,6 +75708,7 @@ exports.isRootSuppliableStepId = isRootSuppliableStepId;
 exports.isSameAddonId = isSameAddonId;
 exports.isScheduleActive = isScheduleActive;
 exports.isSecretConfigField = isSecretConfigField;
+exports.isSingleHubAddressRole = isSingleHubAddressRole;
 exports.isSoftwareDecode = require_composition.isSoftwareDecode;
 exports.isSourceCap = require_composition.isSourceCap;
 exports.isStateLabelKey = isStateLabelKey;
@@ -75549,8 +75825,6 @@ exports.pickAppLinkHub = pickAppLinkHub;
 exports.pickClusterStepModels = pickClusterStepModels;
 exports.pickClusterStepSettings = pickClusterStepSettings;
 exports.pickDetailCropConvention = pickDetailCropConvention;
-exports.pickHubBaseUrl = pickHubBaseUrl;
-exports.pickHubHostname = pickHubHostname;
 exports.pickInvalidClusterStepModels = pickInvalidClusterStepModels;
 exports.pickNativeLeaseOverride = pickNativeLeaseOverride;
 exports.pickPreferredRtspEntry = pickPreferredRtspEntry;
@@ -75611,6 +75885,7 @@ exports.resetPoolBaseline = resetPoolBaseline;
 exports.resolveAddonExecution = resolveAddonExecution;
 exports.resolveAddonGroup = resolveAddonGroup;
 exports.resolveAddonPlacement = resolveAddonPlacement;
+exports.resolveAppConnections = resolveAppConnections;
 exports.resolveBucketMs = resolveBucketMs;
 exports.resolveCapMount = require_sleep.resolveCapMount;
 exports.resolveClipSearchMinScore = resolveClipSearchMinScore;
@@ -75624,15 +75899,18 @@ exports.resolveDeviceProfile = resolveDeviceProfile;
 exports.resolveEgressDecodeHwAccel = resolveEgressDecodeHwAccel;
 exports.resolveExportProfiles = resolveExportProfiles;
 exports.resolveFormat = resolveFormat;
-exports.resolveHubAddress = resolveHubAddress;
+exports.resolveHubAddressRoles = resolveHubAddressRoles;
 exports.resolveHydratedFieldValue = require_sleep.resolveHydratedFieldValue;
+exports.resolveInternalAddress = resolveInternalAddress;
 exports.resolveLocationIcon = resolveLocationIcon;
 exports.resolveLocationMode = resolveLocationMode;
 exports.resolveMethodAuth = resolveMethodAuth;
 exports.resolveModeDelays = resolveModeDelays;
 exports.resolveModeNotifyPolicy = resolveModeNotifyPolicy;
 exports.resolveMutate = resolveMutate;
+exports.resolveNotificationTapAddress = resolveNotificationTapAddress;
 exports.resolvePoolMemoryPolicy = resolvePoolMemoryPolicy;
+exports.resolvePublicEndpoint = resolvePublicEndpoint;
 exports.resolveRecordingProfiles = resolveRecordingProfiles;
 exports.resolveRootSupply = resolveRootSupply;
 exports.resolveRunnerId = resolveRunnerId;
@@ -75671,6 +75949,7 @@ exports.scoreRuntimes = scoreRuntimes;
 exports.scriptRunnerCapability = scriptRunnerCapability;
 exports.searchDisplayIcons = searchDisplayIcons;
 exports.secureActuationFor = secureActuationFor;
+exports.selectAppConnectionEndpoints = selectAppConnectionEndpoints;
 exports.selectAssignedProfileSlots = require_sleep.selectAssignedProfileSlots;
 exports.sendTimesForEditor = sendTimesForEditor;
 exports.sendTimesOfSchedule = sendTimesOfSchedule;
@@ -75763,8 +76042,8 @@ exports.userManagementCapability = userManagementCapability;
 exports.userPasskeysCapability = userPasskeysCapability;
 exports.vacuumControlCapability = vacuumControlCapability;
 exports.validateComposition = validateComposition;
+exports.validateCustomAddress = validateCustomAddress;
 exports.validateExpressionSource = require_composition.validateExpressionSource;
-exports.validateHubAddressOverride = validateHubAddressOverride;
 exports.validateRecipeBounds = validateRecipeBounds;
 exports.valveCapability = valveCapability;
 exports.vectorDimFromBase64 = vectorDimFromBase64;