@camstack/system 1.2.438 → 1.2.440

package/dist/{dist-GgG-7amw.js → dist-BKhlcYz6.js}

@@ -718,7 +718,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-DRqxtc0C.mjs
+//#region ../types/dist/sleep-bwsTj221.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -2079,7 +2079,6 @@ function createHandle(raw, opts) {
 	const writeAddon = (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p));
 	const readAddonStoreResult = raw.readAddonStoreResult;
 	const readAddonStoreKeyResult = raw.readAddonStoreKeyResult;
-	const readDeviceStoreBatch = raw.readDeviceStoreBatch;
 	const overrides = {
 		readAddonStore: async () => resolveRead("addon", await raw.readAddonStore()),
 		...readAddonStoreResult !== void 0 ? { readAddonStoreResult: async () => {
@@ -2103,12 +2102,12 @@ function createHandle(raw, opts) {
 			};
 		} } : {},
 		readDeviceStore: async (deviceId) => resolveRead(`device:${deviceId}`, await raw.readDeviceStore(deviceId)),
-		...readDeviceStoreBatch !== void 0 ? { readDeviceStoreBatch: async (deviceIds) => {
-			const rows = await readDeviceStoreBatch.call(raw, deviceIds);
+		readDeviceStoreBatch: async (deviceIds) => {
+			const rows = await raw.readDeviceStoreBatch(deviceIds);
 			const out = /* @__PURE__ */ new Map();
 			for (const [deviceId, blob] of rows) out.set(deviceId, await resolveRead(`device:${deviceId}`, blob));
 			return out;
-		} } : {},
+		},
 		writeAddonStore: async (patch) => {
 			await writeAddon(patch);
 		},
@@ -2948,7 +2947,7 @@ var BaseAddon = class {
 		return this._addonSecretTree;
 	}
 	deviceSecretTree() {
-		this._deviceSecretTree ??= secretTreeFromSchema(this.deviceSettingsSchema());
+		this._deviceSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.deviceSettingsSchema()), this.secretStatePaths);
 		return this._deviceSecretTree;
 	}
 	/**
@@ -3024,42 +3023,135 @@ var BaseAddon = class {
 		this[timerOf] = timer;
 	}
 	/**
-	* Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
-	* transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
-	* swap, or any race where the SqliteSettingsBackend is between shutdown and
-	* re-initialize) doesn't propagate up into `initialize()` and leave the
+	* Wrap `ctx.settings.readAddonStore()` with a retry budget so a transient
+	* settings-store outage doesn't propagate up into `initialize()` and leave the
 	* addon permanently broken.
 	*
-	* Retry only the two known infra fingerprints. Anything else propagates so
-	* real bugs surface immediately. After the budget expires we fall back to
-	* `{}` (defaults) — the addon's first successful patch will rehydrate.
+	* Two kinds of outage, two budgets:
+	*  - the store's own restart fingerprints (`SqliteSettingsBackend not
+	*    initialized`, `provider not available`): a short budget, then the addon
+	*    falls back to `{}` (defaults) - its first successful patch rehydrates;
+	*  - a TRANSPORT failure (the hub is restarting while this runner boots:
+	*    `discovery deadline exceeded`, `parent could not route`, a refused or
+	*    timed-out connection). Since D870 a runner's settings read THROWS instead
+	*    of answering `{}`, so without a budget a hub restart ends in a respawn
+	*    loop. A long, bounded budget; only after it the error propagates - the
+	*    addon never runs on defaults for a store it could not ask.
+	* Anything else propagates immediately so real bugs surface.
 	*/
 	async readAddonStoreWithRetry() {
 		const settings = this.rawSettings();
 		if (!settings) return {};
-		const delaysMs = [
-			150,
-			350,
-			600,
-			900
-		];
 		let lastErr;
-		for (let attempt = 0; attempt <= delaysMs.length; attempt++) try {
+		for (let attempt = 0;; attempt++) try {
 			const stored = await settings.readAddonStore() ?? {};
 			this.settingsStoreReady = true;
 			return stored;
 		} catch (err) {
 			lastErr = err;
-			const msg = err instanceof Error ? err.message : String(err);
-			if (!(msg.includes("SqliteSettingsBackend not initialized") || msg.includes("provider not available"))) throw err;
-			if (attempt === delaysMs.length) break;
-			await new Promise((r) => setTimeout(r, delaysMs[attempt]));
+			const kind = classifyStoreError(err);
+			if (kind === "permanent") throw err;
+			const delay = (kind === "transport" ? TRANSPORT_RETRY_DELAYS_MS : RESTART_RETRY_DELAYS_MS)[attempt];
+			if (delay === void 0) {
+				if (kind === "transport") throw err;
+				break;
+			}
+			await new Promise((r) => setTimeout(r, delay));
 		}
 		this.settingsStoreReady = false;
 		this._ctx?.logger?.warn?.("readAddonStore: settings-store unavailable after retries — using defaults", { meta: { error: lastErr instanceof Error ? lastErr.message : String(lastErr) } });
 		return {};
 	}
 };
+/** The settings store's own restart fingerprints. */
+var RESTART_RETRY_DELAYS_MS = [
+	150,
+	350,
+	600,
+	900
+];
+/** A hub restarting under a booting runner: ~100 s in total. */
+var TRANSPORT_RETRY_DELAYS_MS = [
+	150,
+	350,
+	600,
+	900,
+	2e3,
+	5e3,
+	1e4,
+	2e4,
+	3e4,
+	3e4
+];
+var RESTART_FINGERPRINTS = ["SqliteSettingsBackend not initialized", "provider not available"];
+/** Node / socket error codes of a connection that did not happen or broke. */
+var TRANSPORT_CODES = new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ETIMEDOUT",
+	"EPIPE",
+	"EHOSTUNREACH",
+	"ENETUNREACH"
+]);
+/** tRPC error codes that mean "the other side is not answering now", not "your call is wrong". */
+var UNAVAILABLE_TRPC_CODES = new Set([
+	"TIMEOUT",
+	"SERVICE_UNAVAILABLE",
+	"BAD_GATEWAY",
+	"GATEWAY_TIMEOUT"
+]);
+/** The exact phrases OUR transport raises when it cannot reach the hub. */
+var TRANSPORT_PHRASES = [
+	"discovery deadline exceeded",
+	"parent could not route child unowned cap call",
+	"UDS request timed out after",
+	"channel closed"
+];
+/** Moleculer error `type`s of a call that could not be served right now. */
+var MOLECULER_TRANSIENT_TYPES = new Set([
+	"REQUEST_TIMEOUT",
+	"SERVICE_NOT_FOUND",
+	"SERVICE_NOT_AVAILABLE",
+	"REQUEST_REJECTED",
+	"BROKER_DISCONNECTED"
+]);
+function stringProp(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const found = Reflect.get(value, key);
+	return typeof found === "string" ? found : void 0;
+}
+/** The code an error carries: its own, its cause's, or a tRPC `data.code`. */
+function errorCode(err) {
+	const out = {};
+	const cause = typeof err === "object" && err !== null ? Reflect.get(err, "cause") : void 0;
+	const data = typeof err === "object" && err !== null ? Reflect.get(err, "data") : void 0;
+	const node = stringProp(err, "code") ?? stringProp(cause, "code");
+	if (node !== void 0) out.node = node;
+	const trpc = stringProp(data, "code");
+	if (trpc !== void 0) out.trpc = trpc;
+	return out;
+}
+/**
+* Is a settings read failure worth retrying, and with which budget? Only
+* EXPLICIT signals count: a socket error code, a tRPC "unavailable" code, or
+* one of the exact phrases our own transport raises. A message that merely
+* contains "timed out" or "unreachable" is not evidence of anything, and
+* `settings store not wired` is a wiring bug that retrying cannot fix.
+*/
+function classifyStoreError(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	if (RESTART_FINGERPRINTS.some((f) => message.includes(f))) return "restart";
+	const code = errorCode(err);
+	if (code.node !== void 0 && TRANSPORT_CODES.has(code.node)) return "transport";
+	if (code.trpc !== void 0 && UNAVAILABLE_TRPC_CODES.has(code.trpc)) return "transport";
+	if (typeof err === "object" && err !== null) {
+		if (Reflect.get(err, "retryable") === true) return "transport";
+		const type = stringProp(err, "type");
+		if (type !== void 0 && MOLECULER_TRANSIENT_TYPES.has(type)) return "transport";
+	}
+	if (TRANSPORT_PHRASES.some((f) => message.includes(f))) return "transport";
+	return "permanent";
+}
 /**
 * Collect the keys of every field marked `perNode: true`, recursing into
 * layout containers (`group` fields and `sub-tabs` tabs) the same way
@@ -9321,11 +9413,10 @@ var ClipModelMetaSchema = zod.z.object({
 	/**
 	* The `vector-store` index this model's vectors live in. ONE feature space
 	* per index: two models share an index only when their vectors are ranked
-	* against each other, which for CLIP means never across families. MobileCLIP
-	* S1 and S2 share `object-clip` for history (separated by the row's
-	* `modelId`); any other model gets its own.
+	* against each other, which for CLIP means never across families. Every
+	* model gets its own.
 	*/
-	vectorIndex: zod.z.string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	vectorIndex: zod.z.string().regex(/^object-clip-[a-z0-9][a-z0-9-]*$/),
 	/**
 	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
 	* must be unique per tokenizer: every model's siblings land in ONE flat
@@ -16169,6 +16260,89 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 		})
 	}
 };
+/** One table of the settings database. */
+var StorageTableSchema = zod.z.object({
+	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
+	name: zod.z.string(),
+	/** The owner prefix of a scoped name (`recorder` for `recorder:addon-settings`), else null. */
+	owner: zod.z.string().nullable(),
+	rows: zod.z.number().int().nonnegative(),
+	/** Bytes the table's pages occupy (`dbstat`); null when the engine cannot measure. */
+	bytes: zod.z.number().int().nonnegative().nullable(),
+	/** Declared by an addon since this engine process started (a running addon claims it). */
+	declaredThisBoot: zod.z.boolean()
+});
+/**
+* The collections retired by exact name: the D870 ones (their data became keys
+* of the camera's settings) and the three D871 leftovers (the `stats-5m` tables
+* superseded by `stats-5m-v2`, and the unread `vec_object_clip`). No addon
+* declares any of them any more; the engine still refuses one a running addon
+* declared this boot. `dropCollection` may remove these, the
+* per-addon scoped `addon-settings` / `addon-devices` / `sections` tables, and
+* the tables of owners that are no longer installed - nothing else.
+*/
+var STORAGE_ADMIN_MOVED_COLLECTIONS = [
+	"stream-broker:probe-snapshots",
+	"stream-broker:profile-map",
+	"stream-broker:rtsp-tokens",
+	"notification-center:device-mutes",
+	"recorder:recording-configs",
+	"pipeline-orchestrator:device-features",
+	"pipeline-analytics:stats-5m",
+	"pipeline-orchestrator:stats-5m",
+	"vec_object_clip"
+];
+/** The per-addon blob tables a scoped name may carry. */
+var STORAGE_ADMIN_SCOPED_BASES = [
+	"addon-settings",
+	"addon-devices",
+	"sections"
+];
+/**
+* storage-admin - the operator's maintenance reach into the settings database:
+* list its tables, drop one that nothing owns any more (D870).
+*
+* Hub-only, internal and `auth: 'admin'` explicitly (`internal` does not gate
+* the mount, see `data-store-provider`). Both methods are LOGGED by the engine
+* with the table and the counts. `dropCollection` is a ONE-SHOT of the D870
+* migration and is marked for removal once the last hub has run it.
+*
+* `listTables` is READ-ONLY: it never creates a table, which `count` and `get`
+* on an undeclared scoped name used to do.
+*/
+var storageAdminCapability = {
+	name: "storage-admin",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/**
+		* Every table of the settings database with its row count and size,
+		* optionally only those owned by `ownerPrefix`. Reads only.
+		*/
+		listTables: method(zod.z.object({ ownerPrefix: zod.z.string().min(1).optional() }), zod.z.object({ tables: zod.z.array(StorageTableSchema) }), { auth: "admin" }),
+		/**
+		* Drop one table. REFUSES when an addon declared it since the engine
+		* started (a running addon still owns it), when it is an engine or
+		* canonical table, when it does not exist, or when its row count is not
+		* `expectRows` - the caller states what it believes it is deleting. The
+		* engine also refuses anything but `<owner>:(addon-settings|addon-devices|
+		* sections)`, the retired collections by name, and tables of owners that
+		* are not installed (and refuses when it cannot read the installed list).
+		* Removed with the D870 migration script once the last hub ran it.
+		*/
+		dropCollection: method(zod.z.object({
+			collection: zod.z.string().min(1),
+			expectRows: zod.z.number().int().nonnegative()
+		}), zod.z.object({
+			dropped: zod.z.literal(true),
+			rows: zod.z.number().int().nonnegative()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 /**
 * `keychain` — the hub's encrypted store of secret values (D787).
 *
@@ -16905,6 +17079,24 @@ var keychainAdminCapability = {
 			auth: "admin",
 			caller: "required"
 		}),
+		/**
+		* Store a value an operator tool carries over from a retired store at an
+		* addon's own ref (`secret://<owner>/<scope>/<path>`) and answer the ref -
+		* the D870 migration moves a camera's restream tokens this way, so they
+		* never sit in a settings row as plaintext. Audited as the operator; the
+		* caller then writes the MARKER of the ref where the value used to be.
+		*/
+		importSecret: method(zod.z.object({
+			ref: zod.z.string().min(1),
+			value: zod.z.string().min(1)
+		}), zod.z.object({
+			ref: zod.z.string(),
+			version: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
 		/** Delete refs no owner points at any more. Re-checked here; `unknown` is kept. */
 		deleteOrphans: method(zod.z.object({ refs: zod.z.array(zod.z.string().min(1)).max(1e3) }), zod.z.object({
 			deleted: zod.z.array(zod.z.string()).readonly(),
@@ -61888,7 +62080,19 @@ var TlsStatusSchema = zod.z.object({
 	sans: zod.z.array(zod.z.string()),
 	caCertPem: zod.z.string().nullable(),
 	reissueError: zod.z.string().nullable(),
-	restartRequired: zod.z.boolean()
+	restartRequired: zod.z.boolean(),
+	/** An uploaded certificate is served but no CA is kept for it and it is not publicly signed (D873). */
+	caMissing: zod.z.boolean(),
+	/** Does the hub's own generated CA carry a critical name constraint? `null` while it has none. */
+	localCaConstrained: zod.z.boolean().nullable(),
+	/** ISO time the generated CA was replaced by a constrained one; devices must re-download it. */
+	caReplacedAt: zod.z.string().nullable(),
+	/** The uploaded certificate kept on disk, selectable again after "Revert to generated". */
+	storedUpload: zod.z.object({
+		leafFingerprintSha256: zod.z.string(),
+		validTo: zod.z.string(),
+		hasCa: zod.z.boolean()
+	}).nullable()
 });
 var localNetworkCapability = {
 	name: "local-network",
@@ -62082,7 +62286,10 @@ var localNetworkCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Replace the served material with operator-supplied PEMs. */
+		/**
+		* Replace the served material with operator-supplied PEMs. A certificate that does not lead
+		* to a public CA must come with its CA certificate, validated and kept for Download CA (D873).
+		*/
 		uploadCertificate: method(zod.z.object({
 			certPem: zod.z.string().min(1),
 			keyPem: zod.z.string().min(1),
@@ -62093,7 +62300,14 @@ var localNetworkCapability = {
 		}),
 		/** The local CA PEM, or empty when there is none to download. */
 		downloadCa: method(zod.z.void(), zod.z.object({ pem: zod.z.string() })),
-		/** Drop uploaded material and return to the generated local CA. */
+		/**
+		* Serve the kept upload again after "Revert to generated" (D873). Refused when none is kept.
+		*/
+		useStoredUploadedCertificate: method(zod.z.void(), TlsStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Return to the generated local CA. The uploaded certificate stays stored (D873). */
 		revertToGeneratedCertificate: method(zod.z.void(), TlsStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -76086,6 +76300,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychainAdmin.importSecret": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.listAudit": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -76482,6 +76702,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.useStoredUploadedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.getStatus": {
 		capName: "lock-control",
 		capScope: "device",
@@ -79866,6 +80092,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageAdmin.dropCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"storageAdmin.listTables": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -81510,6 +81748,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	snapshotCapability,
 	ssoBridgeCapability,
 	storageCapability,
+	storageAdminCapability,
 	storageEvictableCapability,
 	storageMigrationCapability,
 	storageOccupancyCapability,
@@ -86238,6 +86477,18 @@ Object.defineProperty(exports, "STORAGE_ACCESS_FALLBACK", {
 		return STORAGE_ACCESS_FALLBACK;
 	}
 });
+Object.defineProperty(exports, "STORAGE_ADMIN_MOVED_COLLECTIONS", {
+	enumerable: true,
+	get: function() {
+		return STORAGE_ADMIN_MOVED_COLLECTIONS;
+	}
+});
+Object.defineProperty(exports, "STORAGE_ADMIN_SCOPED_BASES", {
+	enumerable: true,
+	get: function() {
+		return STORAGE_ADMIN_SCOPED_BASES;
+	}
+});
 Object.defineProperty(exports, "STREAM_PROFILE_META", {
 	enumerable: true,
 	get: function() {
@@ -87174,6 +87425,12 @@ Object.defineProperty(exports, "splitTranslationRef", {
 		return splitTranslationRef;
 	}
 });
+Object.defineProperty(exports, "storageAdminCapability", {
+	enumerable: true,
+	get: function() {
+		return storageAdminCapability;
+	}
+});
 Object.defineProperty(exports, "storageCapability", {
 	enumerable: true,
 	get: function() {

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-mjB2i-VR.js");
+const require_wal_maintenance = require("./wal-maintenance-C041zn6V.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-Bx3lcVA7.mjs";
+import { C as callData, S as callControl, T as controlTargetOf, a as WalMaintenance, b as trustInput, c as SqliteSettingsBackend, g as collectTransferables, m as serializeError, o as createVectorIndex, s as vectorProviderOf, v as isFileHostRequest, w as callVector, y as isFileHostWorkerData } from "./wal-maintenance-BZGmF-3U.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**