homematic-manager 3.0.0-beta.30 → 3.0.0-beta.32

package/node_modules/@homematic-manager/backend/dist/api/backend.js

@@ -25,9 +25,8 @@ import { discoverCcus } from '../discovery/discover.js';
 import { BackendError, configError, connectionError, errorMessage, internalError, isMethodUnsupported, validationError, } from '../errors.js';
 import { DEFAULT_IDLE_UNSUBSCRIBE_MS, InterfaceManager, LOOPBACK_IP, callbackBindHost, firstBidcosInterfaceAddress, } from '../interfaces/manager.js';
 import { HeatingGroupsClient } from '../groups/client.js';
-import { DETECT_TIMEOUT_MS, MetaApiClient } from '../meta/client.js';
 import { MetaService, hostBaseUrl } from '../meta/service.js';
-import { createSystemFetch } from '../meta/systemFetch.js';
+import { DETECT_TIMEOUT_MS, detectSystem, transportFor } from '../meta/system.js';
 import { RegaService } from '../rega/client.js';
 import { listDevicesAnswer } from '../rpc/server.js';
 import { ApiEventEmitter } from '../util/emitter.js';
@@ -709,22 +708,14 @@ export class Backend {
         if (baseUrl === '') {
             return { answer: undefined };
         }
-        const client = new MetaApiClient({ baseUrl, fetch: this.#systemFetch(connection) });
         // B-67: the redirect to https:// is followed, and a certificate nothing trusts is said
-        const found = await client.detect(this.#options.metaOptions?.detectTimeoutMs ?? DETECT_TIMEOUT_MS);
+        const found = await detectSystem(transportFor({ fetch: this.#options.metaOptions?.fetch, trust: connection.systemTrust }), baseUrl, this.#options.metaOptions?.detectTimeoutMs ?? DETECT_TIMEOUT_MS);
         return {
             answer: found.version,
             baseUrl: found.baseUrl,
             ...(found.certificate === undefined ? {} : { certificate: found.certificate }),
         };
     }
-    /**
-     * B-67: the `fetch` for the system's own APIs - with the certificates the profile trusts. The
-     * tests inject theirs through `metaOptions.fetch`, which wins.
-     */
-    #systemFetch(connection) {
-        return this.#options.metaOptions?.fetch ?? createSystemFetch(connection.systemTrust);
-    }
     async #disconnect() {
         this.#clearTimers();
         this.#queue.cancel();
@@ -775,7 +766,6 @@ export class Backend {
                 onNotice: (level, message) => {
                     this.#notice(level, message);
                 },
-                fetch: this.#systemFetch(connection),
                 ...this.#options.metaOptions,
             });
             if (this.#stopped) {
@@ -1342,17 +1332,9 @@ export class Backend {
      */
     async #groupsClient() {
         await this.#metaReady?.catch(() => undefined);
-        const meta = this.#meta;
-        const baseUrl = meta?.boxUrl;
-        if (meta === undefined || baseUrl === undefined) {
-            return undefined;
-        }
-        return new HeatingGroupsClient({
-            baseUrl,
-            credential: () => meta.boxCredential(),
-            // B-67: the same trust as the store's, on the https:// URL the detection found
-            fetch: this.#systemFetch(this.#config.connection),
-        });
+        // B-67: the same transport and trust as the store's, on the https:// URL the detection found
+        const system = this.#meta?.boxLink();
+        return system === undefined ? undefined : new HeatingGroupsClient({ system });
     }
     /** `groups.state`: no box is an answer, not an error - it is what every CCU says. */
     async #groupsState() {

package/node_modules/@homematic-manager/backend/dist/groups/client.d.ts

@@ -8,13 +8,15 @@
  * JSON API with the box's own login - the one this application already has for the metadata store
  * (D-40). This client speaks that API and nothing else; on a CCU it is never built.
  *
- * Like the metadata client: `fetch` and `AbortSignal` only, a typed answer or a thrown
- * {@link BackendError} whose `kind` says what the UI should make of it. The box's error body
+ * The requests are occulite-client's `system.groups` (task 72), on the same transport and with the
+ * same certificate trust as the metadata store; what stays here is the contract's shape and a
+ * thrown {@link BackendError} whose `kind` says what the UI should make of it. The box's error body
  * (`{error, message}`) is kept, because its message is the one worth showing - "there is no group
  * 7", "members: hmipserver's device ids, as GET /groups/types lists them".
  */
 import type { HeatingGroupChange, HeatingGroupDetail, HeatingGroupList, HeatingGroupMember, HeatingGroupType, HeatingGroupsState } from '@homematic-manager/core';
 import { BackendError } from '../errors.js';
+import type { SystemLink } from '../meta/system.js';
 /**
  * How long a call may take. A change makes the box's group process configure direct links, and the
  * box itself waits up to thirty seconds for that process before it answers `502`; this has to
@@ -22,17 +24,14 @@ import { BackendError } from '../errors.js';
  */
 export declare const GROUPS_TIMEOUT_MS = 45000;
 export interface HeatingGroupsClientOptions {
-    /** `http://ccu` or `http://127.0.0.1` - scheme and authority, no path. */
-    readonly baseUrl: string;
     /**
-     * The credential every call goes out with. Reads need the box's `system:read`, changes
-     * `system:write`: the person's session on the box, or the API token off it. Never the addon's
-     * local token by choice - it reads metadata and nothing else, and the box answers 403.
+     * The box, with the credential every call goes out with (its write credential). Reads need the
+     * box's `system:read`, changes `system:write`: the person's session on the box, or the API token
+     * off it. Never the addon's local token by choice - it reads metadata and nothing else, and the
+     * box answers 403.
      */
-    readonly credential: () => string | undefined;
+    readonly system: SystemLink;
     readonly timeoutMs?: number;
-    /** Injected by the tests. */
-    readonly fetch?: typeof globalThis.fetch;
 }
 /** The box refused or could not answer; `status` and `code` are what it said. */
 export declare class HeatingGroupsApiError extends BackendError {

package/node_modules/@homematic-manager/backend/dist/groups/client.js

@@ -8,11 +8,13 @@
  * JSON API with the box's own login - the one this application already has for the metadata store
  * (D-40). This client speaks that API and nothing else; on a CCU it is never built.
  *
- * Like the metadata client: `fetch` and `AbortSignal` only, a typed answer or a thrown
- * {@link BackendError} whose `kind` says what the UI should make of it. The box's error body
+ * The requests are occulite-client's `system.groups` (task 72), on the same transport and with the
+ * same certificate trust as the metadata store; what stays here is the contract's shape and a
+ * thrown {@link BackendError} whose `kind` says what the UI should make of it. The box's error body
  * (`{error, message}`) is kept, because its message is the one worth showing - "there is no group
  * 7", "members: hmipserver's device ids, as GET /groups/types lists them".
  */
+import { OccuLiteError } from 'occulite-client';
 import { BackendError } from '../errors.js';
 /**
  * How long a call may take. A change makes the box's group process configure direct links, and the
@@ -51,13 +53,11 @@ function kindOf(status, code) {
 }
 export class HeatingGroupsClient {
     #options;
-    #fetch;
     constructor(options) {
         this.#options = options;
-        this.#fetch = options.fetch ?? globalThis.fetch;
     }
     get baseUrl() {
-        return this.#options.baseUrl;
+        return this.#options.system.baseUrl;
     }
     /**
      * Does this box have the groups API, and may this credential read it? One `GET /groups`; the
@@ -65,7 +65,7 @@ export class HeatingGroupsClient {
      */
     async probe() {
         try {
-            await this.#json('GET', '/groups');
+            await this.#call((groups, options) => groups.list(options));
             return { available: true };
         }
         catch (error) {
@@ -90,8 +90,8 @@ export class HeatingGroupsClient {
      * between the two calls) is listed without members rather than failing the list.
      */
     async list() {
-        const answer = (await this.#json('GET', '/groups'));
-        const groups = await Promise.all((answer.groups ?? []).map(async (wire) => {
+        const answer = (await this.#call((groups, options) => groups.list(options)));
+        const groups = await Promise.all((answer?.groups ?? []).map(async (wire) => {
             let members = [];
             try {
                 members = (await this.get(wire.id)).members;
@@ -101,12 +101,12 @@ export class HeatingGroupsClient {
             }
             return { ...toGroup(wire), members };
         }));
-        return { groups, devicesToConfigure: answer.devices_to_configure ?? [] };
+        return { groups, devicesToConfigure: answer?.devices_to_configure ?? [] };
     }
     /** `GET /groups/types` - what a new group can be, and what each type could take now. */
     async types() {
-        const answer = (await this.#json('GET', '/groups/types'));
-        return (answer.types ?? []).map((type) => ({
+        const types = (await this.#call((groups, options) => groups.types(options)));
+        return (types ?? []).map((type) => ({
             id: type.id ?? '',
             label: type.label ?? type.id ?? '',
             assignable: type.assignable ?? [],
@@ -115,11 +115,11 @@ export class HeatingGroupsClient {
     }
     /** `GET /groups/{id}`. */
     async get(id) {
-        return toDetail((await this.#json('GET', `/groups/${String(id)}`)));
+        return toDetail(await this.#call((groups, options) => groups.get(id, options)));
     }
     /** `POST /groups` - the box's `create` then `save`, and the metadata side effects in one go. */
     async create(name, type, members) {
-        return toChange((await this.#json('POST', '/groups', { name, type, members: [...members] })));
+        return toChange(await this.#call((groups, options) => groups.create({ name, type, members: [...members] }, options)));
     }
     /**
      * `PUT /groups/{id}` - the name and the members as a whole; a field left out keeps its value.
@@ -130,49 +130,22 @@ export class HeatingGroupsClient {
             ...(change.name === undefined ? {} : { name: change.name }),
             ...(change.members === undefined ? {} : { members: [...change.members] }),
         };
-        return toChange((await this.#json('PUT', `/groups/${String(id)}`, body)));
+        return toChange(await this.#call((groups, options) => groups.update(id, body, options)));
     }
     /** `DELETE /groups/{id}` - answers with the former members, whose group membership is gone. */
     async remove(id) {
-        const answer = (await this.#json('DELETE', `/groups/${String(id)}`));
-        return answer.former_members ?? [];
+        const answer = (await this.#call((groups, options) => groups.remove(id, options)));
+        return answer?.former_members ?? [];
     }
-    #url(route) {
-        return `${this.#options.baseUrl.replace(/\/$/, '')}/api/system/v1${route}`;
-    }
-    async #json(method, route, body) {
-        const credential = this.#options.credential();
-        let response;
+    /** One call of the package's `system.groups`, its errors turned into the contract's. */
+    async #call(run) {
         try {
-            response = await this.#fetch(this.#url(route), {
-                method,
-                signal: AbortSignal.timeout(this.#options.timeoutMs ?? GROUPS_TIMEOUT_MS),
-                headers: {
-                    Accept: 'application/json',
-                    ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
-                    ...(credential === undefined ? {} : { Authorization: `Bearer ${credential}` }),
-                },
-                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            return await run(this.#options.system.client('write').system.groups, {
+                timeout: this.#options.timeoutMs ?? GROUPS_TIMEOUT_MS,
             });
         }
         catch (error) {
-            // the box is off, or the change outlasted the timeout above
-            throw new BackendError({
-                message: `the groups API at ${this.#options.baseUrl} did not answer: ${errorText(error)}`,
-                kind: 'connection',
-            }, { cause: error });
-        }
-        if (!response.ok) {
-            throw await refusal(response);
-        }
-        if (response.status === 204) {
-            return {};
-        }
-        try {
-            return await response.json();
-        }
-        catch (error) {
-            throw new BackendError({ message: `the groups API answered ${String(response.status)} without JSON`, kind: 'internal' }, { cause: error });
+            throw refusal(error, this.baseUrl);
         }
     }
 }
@@ -206,26 +179,26 @@ function toDetail(wire) {
 function toChange(wire) {
     return { ...toDetail(wire), devicesToConfigure: wire.devices_to_configure ?? [] };
 }
-/** The API's `{error, message}` body as the error, or the status when there is none. */
-async function refusal(response) {
-    let code = response.status === 401 || response.status === 403 ? 'forbidden' : 'error';
-    let message = `${String(response.status)} ${response.statusText}`.trim();
-    try {
-        const body = (await response.json());
-        if (typeof body.error === 'string') {
-            code = body.error;
-        }
-        if (typeof body.message === 'string') {
-            message = body.message;
-        }
-    }
-    catch {
-        // not JSON: lighttpd's own error page, or a box that is not openccu-lite at all
-    }
-    if (response.status === 401 || response.status === 403) {
-        message = `the system refused the credential for the heating groups (${String(response.status)}): ${message}`;
-    }
-    return new HeatingGroupsApiError(response.status, code, message);
+/**
+ * The API's `{error, message}` answer as the error; a box that did not answer (off, the change
+ * outlasted the timeout above, a certificate nobody trusts) as a connection error.
+ */
+function refusal(error, baseUrl) {
+    if (!(error instanceof OccuLiteError) || error.status === undefined) {
+        return new BackendError({ message: `the groups API at ${baseUrl} did not answer: ${errorText(error)}`, kind: 'connection' }, { cause: error });
+    }
+    const status = error.status;
+    const detail = error.detail;
+    let message = typeof detail?.message === 'string' ? detail.message : error.message;
+    const code = error.code.startsWith('http-')
+        ? status === 401 || status === 403
+            ? 'forbidden'
+            : 'error'
+        : error.code;
+    if (status === 401 || status === 403) {
+        message = `the system refused the credential for the heating groups (${String(status)}): ${message}`;
+    }
+    return new HeatingGroupsApiError(status, code, message);
 }
 function errorText(error) {
     return error instanceof Error ? error.message : String(error);

package/node_modules/@homematic-manager/backend/dist/meta/index.d.ts

@@ -1,12 +1,11 @@
 /**
- * D-40: the metadata store - names, rooms, functions and any taxonomy a user adds - with the two
- * providers behind it, the HTTP client for openccu-lite's API and where the credentials come from.
+ * D-40: the metadata store - names, rooms, functions and any taxonomy a user adds - with the
+ * providers behind it and the connection to openccu-lite's API (occulite-client, task 72).
  */
-export * from './client.js';
-export * from './credentials.js';
 export * from './provider.js';
 export * from './localProvider.js';
 export * from './occuliteProvider.js';
 export * from './regaProvider.js';
 export * from './service.js';
+export * from './system.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@homematic-manager/backend/dist/meta/index.js

@@ -1,12 +1,11 @@
 /**
- * D-40: the metadata store - names, rooms, functions and any taxonomy a user adds - with the two
- * providers behind it, the HTTP client for openccu-lite's API and where the credentials come from.
+ * D-40: the metadata store - names, rooms, functions and any taxonomy a user adds - with the
+ * providers behind it and the connection to openccu-lite's API (occulite-client, task 72).
  */
-export * from './client.js';
-export * from './credentials.js';
 export * from './provider.js';
 export * from './localProvider.js';
 export * from './occuliteProvider.js';
 export * from './regaProvider.js';
 export * from './service.js';
+export * from './system.js';
 //# sourceMappingURL=index.js.map

package/node_modules/@homematic-manager/backend/dist/meta/occuliteProvider.d.ts

@@ -19,16 +19,23 @@
  *
  * The snapshot is persisted where the ReGa provider persists its names, for the same reason: a
  * restart while the box is unreachable must not leave the grid nameless.
+ *
+ * The wire is occulite-client's (task 72): the requests, the writes on the API's routes, the
+ * certificate trust and the Server-Sent Events parser are the package's, reached through
+ * {@link SystemLink}. What stays here is the policy - when to re-read, how long to wait, what the
+ * state says - and the document itself, which is core's and follows the stream with core's
+ * `applyEvent`, the code the conformance corpus runs against.
  */
 import { summariseAll, type MetaDocument, type MetaImportMode, type MetaNodePatch, type MetaState } from '@homematic-manager/core';
-import { MetaApiClient } from './client.js';
 import type { MetadataProvider, MetaMembershipEntry, MetaNameEntry, MetaProviderEvents } from './provider.js';
+import type { SystemLink } from './system.js';
 /** First wait before the event stream is opened again, in milliseconds. */
 export declare const RECONNECT_MIN_MS = 2000;
 /** Longest wait between two attempts. A box that is being updated is back well inside a minute. */
 export declare const RECONNECT_MAX_MS = 60000;
 export interface OcculiteProviderOptions extends MetaProviderEvents {
-    readonly client: MetaApiClient;
+    /** The box, with the read and the write credential (occulite-client underneath). */
+    readonly system: SystemLink;
     /** `<cacheDir>/occulite-meta.json`: the last snapshot, so a restart without the box has names. */
     readonly cacheFile?: string;
     /** `occulited 0.1.0`, from the detection call. */

package/node_modules/@homematic-manager/backend/dist/meta/occuliteProvider.js

@@ -19,11 +19,16 @@
  *
  * The snapshot is persisted where the ReGa provider persists its names, for the same reason: a
  * restart while the box is unreachable must not leave the grid nameless.
+ *
+ * The wire is occulite-client's (task 72): the requests, the writes on the API's routes, the
+ * certificate trust and the Server-Sent Events parser are the package's, reached through
+ * {@link SystemLink}. What stays here is the policy - when to re-read, how long to wait, what the
+ * state says - and the document itself, which is core's and follows the stream with core's
+ * `applyEvent`, the code the conformance corpus runs against.
  */
 import { applyEvent, emptyDocument, isMetaError, parseDocument, summariseAll, } from '@homematic-manager/core';
 import { errorMessage } from '../errors.js';
 import { readJsonFile, writeJsonFile } from '../util/jsonFile.js';
-import { MetaApiClient } from './client.js';
 /** First wait before the event stream is opened again, in milliseconds. */
 export const RECONNECT_MIN_MS = 2000;
 /** Longest wait between two attempts. A box that is being updated is back well inside a minute. */
@@ -31,7 +36,7 @@ export const RECONNECT_MAX_MS = 60_000;
 export class OcculiteProvider {
     kind = 'occulite';
     #options;
-    #client;
+    #system;
     #document = emptyDocument();
     #reachable = false;
     #writable = true;
@@ -44,7 +49,7 @@ export class OcculiteProvider {
     #wake;
     constructor(options) {
         this.#options = options;
-        this.#client = options.client;
+        this.#system = options.system;
     }
     state() {
         return {
@@ -53,7 +58,7 @@ export class OcculiteProvider {
             writable: this.#writable,
             revision: this.#document.revision,
             objects: Object.keys(this.#document.objects).length,
-            url: this.#client.baseUrl,
+            url: this.#system.baseUrl,
             ...(this.#options.implementation === undefined ? {} : { implementation: this.#options.implementation }),
             ...(this.#error === undefined ? {} : { error: this.#error }),
         };
@@ -105,7 +110,7 @@ export class OcculiteProvider {
         for (const entry of entries) {
             sets[entry.ref] = { name: entry.name };
         }
-        await this.#write(() => this.#client.bulk(sets));
+        await this.#write((meta) => meta.objects.bulk({ set: sets }));
     }
     async setMembership(entries) {
         if (entries.length === 0) {
@@ -113,21 +118,21 @@ export class OcculiteProvider {
         }
         const sets = {};
         for (const entry of entries) {
-            sets[entry.ref] = { enums: entry.paths };
+            sets[entry.ref] = { enums: [...entry.paths] };
         }
-        await this.#write(() => this.#client.bulk(sets));
+        await this.#write((meta) => meta.objects.bulk({ set: sets }));
     }
     async createEnum(id, name) {
-        await this.#write(() => this.#client.createEnum(id, name));
+        await this.#write((meta) => meta.enums.create(id, { ...name }));
     }
     async updateEnum(id, name) {
-        await this.#write(() => this.#client.updateEnum(id, name));
+        await this.#write((meta) => meta.enums.update(id, { name: { ...name } }));
     }
     async deleteEnum(id, detach) {
-        await this.#write(() => this.#client.deleteEnum(id, detach ? 'detach' : 'refuse'));
+        await this.#write((meta) => meta.enums.delete(id, { detach }));
     }
     async createNode(enumId, parent, id, name, options) {
-        await this.#write(() => this.#client.createNode(enumId, {
+        await this.#write((meta) => meta.tree.create(enumId, {
             parent,
             id,
             name,
@@ -137,13 +142,19 @@ export class OcculiteProvider {
         return `${parent ?? enumId}/${id}`;
     }
     async updateNode(path, patch) {
-        await this.#write(() => this.#client.updateNode(path, patch));
+        await this.#write((meta) => meta.tree.update(path, {
+            ...(patch.name === undefined ? {} : { name: patch.name }),
+            ...(patch.icon === undefined ? {} : { icon: patch.icon }),
+            ...(patch.parent === undefined ? {} : { parent: patch.parent }),
+            ...(patch.position === undefined ? {} : { position: patch.position }),
+        }));
     }
     async deleteNode(path, detach) {
-        await this.#write(() => this.#client.deleteNode(path, detach ? 'detach' : 'refuse'));
+        await this.#write((meta) => meta.tree.delete(path, { detach }));
     }
     async import(document, mode) {
-        await this.#write(() => this.#client.import(document, mode));
+        // a document object as JSON; a string goes as it is, which the API reads as YAML
+        await this.#write((meta) => meta.import(document, { mode }));
     }
     /**
      * One write, then a fresh snapshot.
@@ -155,7 +166,7 @@ export class OcculiteProvider {
      */
     async #write(call) {
         try {
-            const answer = await call();
+            const answer = await this.#system.write(call);
             if (!this.#writable) {
                 this.#writable = true;
                 this.#options.onStateChanged(this.state());
@@ -175,7 +186,7 @@ export class OcculiteProvider {
     /** `GET /snapshot`, with every failure turned into a state instead of an exception. */
     async #refresh() {
         try {
-            const document = await this.#client.snapshot();
+            const document = await this.#system.snapshot();
             this.#document = document;
             this.#reachable = true;
             this.#error = undefined;
@@ -205,7 +216,7 @@ export class OcculiteProvider {
         let wait = this.#options.reconnectMinMs ?? RECONNECT_MIN_MS;
         while (!aborted()) {
             try {
-                for await (const event of this.#client.events(this.#document.revision, signal)) {
+                for await (const event of this.#system.events(this.#document.revision, signal)) {
                     wait = this.#options.reconnectMinMs ?? RECONNECT_MIN_MS;
                     if (!this.#reachable) {
                         this.#reachable = true;

package/node_modules/@homematic-manager/backend/dist/meta/service.d.ts

@@ -19,6 +19,7 @@
 import { type ConnectionConfig, type MetaDocument, type MetaEnum, type MetaHmipPairing, type MetaImportMode, type MetaNodePatch, type MetaObjectView, type MetaState, type MetaVersion, type SystemCertificateProblem } from '@homematic-manager/core';
 import type { NameStore } from '../cache/names.js';
 import { type RegaScriptRunner } from './regaProvider.js';
+import { SystemLink } from './system.js';
 /** What the service needs to know about ReGa to offer it as a provider (task 27). */
 export interface MetaRegaLink {
     /** ReGa is on and has answered at least once - the `auto` choice takes it only then. */
@@ -56,11 +57,28 @@ export interface MetaServiceOptions {
      * common case probes once; a store at another `metaUrl` is still probed on its own.
      */
     readonly hostProbe?: HostProbe | undefined;
-    /** Injected by the tests. */
+    /**
+     * Injected by the tests: the local token file (occulite-client's `LOCAL_TOKEN_FILE` otherwise),
+     * and a `fetch` in place of the transport that carries the profile's certificate trust.
+     */
     readonly localTokenFile?: string | undefined;
     readonly fetch?: typeof globalThis.fetch;
     readonly detectTimeoutMs?: number;
 }
+/**
+ * A session id as the box hands it over: `@xxxxxxxxxx@`, the CCU convention, or bare.
+ *
+ * The API accepts both spellings; this normalises to the bare one so that one shape goes on the
+ * wire and a log line stays readable.
+ */
+export declare function normaliseSid(value: string | undefined): string | undefined;
+/**
+ * The box's local token, or `undefined` when there is no file - which is every installation that
+ * is not the addon on an openccu-lite box. On the box it is the token for programs running there:
+ * it reads everything and writes nothing, on purpose (the addon reads as itself and writes as the
+ * person looking at the page). Read by occulite-client's credential resolution; never throws.
+ */
+export declare function readLocalToken(file?: string): Promise<string | undefined>;
 /**
  * B-62, B-67: what the connect found at the host - the version answer (undefined for a CCU), the
  * base URL after the system's redirect to `https://`, and the certificate problem there.
@@ -173,11 +191,12 @@ export declare class MetaService {
      */
     get boxUrl(): string | undefined;
     /**
-     * Task 57: the credential a call to the box's system API goes out with. The same order as a
-     * write to the store: the person's session first, then the token the profile configured, then
-     * the local token - which the box refuses there, as it should: an addon's local token reads
-     * metadata and nothing else, and a group is changed by a person.
+     * Task 57: the box's other APIs, while the store is the box's - `undefined` otherwise. A call
+     * to its system API goes out with the credential of a write to the store: the person's session
+     * first, then the token the profile configured, then the local token - which the box refuses
+     * there, as it should: an addon's local token reads metadata and nothing else, and a group is
+     * changed by a person. The same transport, so the same certificate trust (B-67).
      */
-    boxCredential(): string | undefined;
+    boxLink(): SystemLink | undefined;
 }
 //# sourceMappingURL=service.d.ts.map