@camstack/system 1.2.440 → 1.2.442

package/dist/addon-runner.js

@@ -44,6 +44,65 @@ let node_events = require("node:events");
 let _camstack_types_node = require("@camstack/types/node");
 let node_module = require("node:module");
 let node_url = require("node:url");
+//#region src/kernel/addon-refused-error.ts
+/**
+* A deterministic Init refusal (D877): an addon that says, in a typed way,
+* "I will not start, and here is why" - as opposed to a crash.
+*
+* The difference matters to the supervisor. A crash may be transient (a camera
+* dropping mid-handshake) and is bounded by the D6 circuit-breaker; a refusal
+* repeats identically until somebody changes the world (runs a migration,
+* fixes a setting), so counting it toward the breaker only turns "waiting for
+* the operator" into a terminal `failed` with a stack trace nobody needed.
+* On 2026-10-17 twenty-eight addons refused on an unmigrated store, exited five
+* times in ten seconds and were marked `failed` as if they had crashed.
+*
+* The runner reports a refusal to its parent (see `runner-refusal.ts`); the
+* process service parks the runner in `refused` with the reason and retries it
+* only when an operator acts.
+*/
+var AddonRefusedError = class extends Error {
+	/** Stable, greppable cause, e.g. `unmigrated-settings`. */
+	code;
+	/** What the operator does about it. */
+	remedy;
+	constructor(code, message, remedy, options) {
+		super(message, options);
+		this.name = "AddonRefusedError";
+		this.code = code;
+		this.remedy = remedy;
+	}
+};
+/**
+* The refusal in `err`'s cause chain, if any. An addon that wraps the error it
+* got from the kernel (`new Error('init failed', { cause })`) is still refusing.
+*/
+function findAddonRefusal(err) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = err;
+	while (current !== null && current !== void 0 && !seen.has(current)) {
+		if (current instanceof AddonRefusedError) return current;
+		seen.add(current);
+		current = current instanceof Error ? current.cause : void 0;
+	}
+	return null;
+}
+//#endregion
+//#region src/kernel/moleculer/runner-refusal.ts
+var REFUSED_PREFIX = "REFUSED:";
+/** The stdout line for a refusal. Always one line: JSON has no raw newline. */
+function formatRunnerRefusalLine(nodeId, report) {
+	return `${REFUSED_PREFIX}${nodeId}:${JSON.stringify(report)}\n`;
+}
+function refusalReportOf(addonId, err) {
+	return {
+		addonId,
+		code: err.code,
+		reason: err.message,
+		remedy: err.remedy
+	};
+}
+//#endregion
 //#region src/kernel/addon-class-resolver.ts
 function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -9917,9 +9976,13 @@ function isRetiredRootKey(addonId, key) {
 	if (OWN_RETIRED_ROOT_KEYS.has(key)) return true;
 	return RETIRED_SETTINGS_KEYS.some((spec) => spec.namespace === addonId && (spec.keys.includes(key) || spec.perNodeKeys.some((k) => key === k || key.startsWith(`${k}@`))));
 }
-var UnmigratedSettingsError = class extends Error {
+/** Stable `code` of the D870 refusal. */
+var UNMIGRATED_SETTINGS_CODE = "unmigrated-settings";
+/** The remedy the refusal (and the update pre-flight) names. */
+var UNMIGRATED_SETTINGS_REMEDY = "Run scripts/hub/migrate-device-store.ts --copy --apply (D870), then restart the addon.";
+var UnmigratedSettingsError = class extends AddonRefusedError {
 	constructor(addonId, what) {
-		super(`addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`);
+		super(UNMIGRATED_SETTINGS_CODE, `addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`, UNMIGRATED_SETTINGS_REMEDY);
 		this.name = "UnmigratedSettingsError";
 	}
 };
@@ -11300,6 +11363,13 @@ async function main() {
 		});
 	} catch (err) {
 		console.error(`[addon-runner] Init failed for "${spec.addonId}": ${(0, _camstack_types_addon.errMsg)(err)}`);
+		const refusal = findAddonRefusal(err);
+		if (refusal !== null) {
+			try {
+				node_fs.writeSync(1, formatRunnerRefusalLine(nodeId, refusalReportOf(spec.addonId, refusal)));
+			} catch {}
+			process.exit(78);
+		}
 		process.exit(1);
 	}
 	if (deviceRestorePromises.length > 0 && !shuttingDown) await Promise.allSettled(deviceRestorePromises);

package/dist/addon-runner.mjs

@@ -20,6 +20,65 @@ import { createServer as createServer$1, request } from "node:http";
 import { once } from "node:events";
 import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { pathToFileURL } from "node:url";
+//#region src/kernel/addon-refused-error.ts
+/**
+* A deterministic Init refusal (D877): an addon that says, in a typed way,
+* "I will not start, and here is why" - as opposed to a crash.
+*
+* The difference matters to the supervisor. A crash may be transient (a camera
+* dropping mid-handshake) and is bounded by the D6 circuit-breaker; a refusal
+* repeats identically until somebody changes the world (runs a migration,
+* fixes a setting), so counting it toward the breaker only turns "waiting for
+* the operator" into a terminal `failed` with a stack trace nobody needed.
+* On 2026-10-17 twenty-eight addons refused on an unmigrated store, exited five
+* times in ten seconds and were marked `failed` as if they had crashed.
+*
+* The runner reports a refusal to its parent (see `runner-refusal.ts`); the
+* process service parks the runner in `refused` with the reason and retries it
+* only when an operator acts.
+*/
+var AddonRefusedError = class extends Error {
+	/** Stable, greppable cause, e.g. `unmigrated-settings`. */
+	code;
+	/** What the operator does about it. */
+	remedy;
+	constructor(code, message, remedy, options) {
+		super(message, options);
+		this.name = "AddonRefusedError";
+		this.code = code;
+		this.remedy = remedy;
+	}
+};
+/**
+* The refusal in `err`'s cause chain, if any. An addon that wraps the error it
+* got from the kernel (`new Error('init failed', { cause })`) is still refusing.
+*/
+function findAddonRefusal(err) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = err;
+	while (current !== null && current !== void 0 && !seen.has(current)) {
+		if (current instanceof AddonRefusedError) return current;
+		seen.add(current);
+		current = current instanceof Error ? current.cause : void 0;
+	}
+	return null;
+}
+//#endregion
+//#region src/kernel/moleculer/runner-refusal.ts
+var REFUSED_PREFIX = "REFUSED:";
+/** The stdout line for a refusal. Always one line: JSON has no raw newline. */
+function formatRunnerRefusalLine(nodeId, report) {
+	return `${REFUSED_PREFIX}${nodeId}:${JSON.stringify(report)}\n`;
+}
+function refusalReportOf(addonId, err) {
+	return {
+		addonId,
+		code: err.code,
+		reason: err.message,
+		remedy: err.remedy
+	};
+}
+//#endregion
 //#region src/kernel/addon-class-resolver.ts
 function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -9893,9 +9952,13 @@ function isRetiredRootKey(addonId, key) {
 	if (OWN_RETIRED_ROOT_KEYS.has(key)) return true;
 	return RETIRED_SETTINGS_KEYS.some((spec) => spec.namespace === addonId && (spec.keys.includes(key) || spec.perNodeKeys.some((k) => key === k || key.startsWith(`${k}@`))));
 }
-var UnmigratedSettingsError = class extends Error {
+/** Stable `code` of the D870 refusal. */
+var UNMIGRATED_SETTINGS_CODE = "unmigrated-settings";
+/** The remedy the refusal (and the update pre-flight) names. */
+var UNMIGRATED_SETTINGS_REMEDY = "Run scripts/hub/migrate-device-store.ts --copy --apply (D870), then restart the addon.";
+var UnmigratedSettingsError = class extends AddonRefusedError {
 	constructor(addonId, what) {
-		super(`addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`);
+		super(UNMIGRATED_SETTINGS_CODE, `addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`, UNMIGRATED_SETTINGS_REMEDY);
 		this.name = "UnmigratedSettingsError";
 	}
 };
@@ -11276,6 +11339,13 @@ async function main() {
 		});
 	} catch (err) {
 		console.error(`[addon-runner] Init failed for "${spec.addonId}": ${errMsg(err)}`);
+		const refusal = findAddonRefusal(err);
+		if (refusal !== null) {
+			try {
+				fs.writeSync(1, formatRunnerRefusalLine(nodeId, refusalReportOf(spec.addonId, refusal)));
+			} catch {}
+			process.exit(78);
+		}
 		process.exit(1);
 	}
 	if (deviceRestorePromises.length > 0 && !shuttingDown) await Promise.allSettled(deviceRestorePromises);

package/dist/auth/totp-manager.d.ts

@@ -1,4 +1,16 @@
-import type { SettingsStoreClient } from "@camstack/types";
+import { type RawSecretMigrationReport, type IScopedLogger, type SecretsAccess, type SettingsStoreClient } from "@camstack/types";
+/**
+* The seed cannot be used right now. The message is what a not-yet-logged-in
+* caller sees, so it is generic; `reason` (keychain detail) is for the server log only.
+*/
+export declare class TotpSecretUnavailableError extends Error {
+	readonly reason: string;
+	constructor(reason: string);
+}
+/** A seed cannot be stored: setup is refused, never written as plaintext. */
+export declare class TotpSecretStorageUnavailableError extends Error {
+	constructor(reason: string);
+}
 export interface TotpSetupResult {
 	readonly secret: string;
 	readonly otpauthUrl: string;
@@ -12,9 +24,17 @@ export declare class TotpManager {
 	/** ±N steps of clock-skew tolerance, expressed in seconds for otplib v13's
 	*  per-call `epochTolerance`. Default window 1 = ±30 s. */
 	private readonly epochTolerance;
+	private readonly secrets;
+	private readonly logger;
+	/** Per-user queue: setup / confirm / disable / migration never interleave on one user. */
+	private readonly chains;
 	constructor(store: SettingsStoreClient, opts?: {
 		/** ±N 30-second windows tolerated. Default 1 = ±30 s clock skew. */
 		readonly window?: number;
+		/** Keychain handle for owner `system`; `null` = no keychain door (setup refuses). */
+		readonly secrets?: SecretsAccess | null;
+		/** Server-side log for the keychain detail of a refused read. */
+		readonly logger?: IScopedLogger;
 	});
 	/**
 	* Begin enrollment. Always generates a fresh secret — calling `setup`
@@ -26,6 +46,7 @@ export declare class TotpManager {
 	* recognition. `ISSUER` is the CamStack brand.
 	*/
 	setup(userId: string, username: string): Promise<TotpSetupResult>;
+	private setupLocked;
 	/**
 	* Confirm enrollment by checking a code from the authenticator
 	* against the pending secret. On success, flips `confirmedAt` so
@@ -34,10 +55,12 @@ export declare class TotpManager {
 	* change.
 	*/
 	confirm(userId: string, code: string): Promise<boolean>;
+	private confirmLocked;
 	/**
 	* Remove enrollment. Idempotent — no error if the user had no row.
 	*/
 	disable(userId: string): Promise<void>;
+	private serialize;
 	/**
 	* Verify a code against the confirmed secret. Returns `false` when:
 	*   - The user has no row (not set up).
@@ -50,5 +73,27 @@ export declare class TotpManager {
 	* reported as `enabled: false` — only a confirmed row counts.
 	*/
 	getStatus(userId: string): Promise<TotpStatus>;
+	private refFor;
+	/** A refused read: generic to the caller, the keychain detail to the server log. */
+	private unavailable;
+	/** The seed in clear: from the keychain for a marker row, inline for a pre-D878 row. Throws when unreadable. */
+	private seedOf;
+	/** Remove a user's seed from the keychain; a miss leaves an orphan the Secrets page shows. */
+	private dropSeed;
+	/**
+	* D878: move every inline seed into the keychain. Dry run unless `apply`.
+	* Per row: put -> read back and compare -> only then rewrite the row with the
+	* marker, so the inline seed is cleared by the verified move and nowhere
+	* else. Counts only; idempotent.
+	*/
+	migrateRawSecrets(apply: boolean): Promise<RawSecretMigrationReport>;
+	/**
+	* Compare-and-set under the user's queue: the row is re-read and moved only if
+	* it still holds the very inline seed we planned to move, so a concurrent
+	* `setup` (its seed and marker) is never overwritten. The ref is always the
+	* user's own, never taken from the row.
+	*/
+	private moveRow;
+	private readAll;
 	private find;
 }

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BKhlcYz6.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ar as errMsg, Si as EventCategory, it as addonPagesCapability, jr as BaseAddon } from "../../dist-9fcsrFU3.mjs";
+import { Ar as errMsg, Ci as EventCategory, it as addonPagesCapability, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BKhlcYz6.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ar as errMsg, Si as EventCategory, jr as BaseAddon, ot as addonWidgetsCapability } from "../../dist-9fcsrFU3.mjs";
+import { Ar as errMsg, Ci as EventCategory, jr as BaseAddon, ot as addonWidgetsCapability } from "../../dist-DsrQYcLm.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.d.ts

@@ -3,10 +3,18 @@ import { BaseAddon, type ProviderRegistration } from "@camstack/types";
 interface AlertCenterConfig {
 	readonly maxAlerts: number;
 	readonly retentionDays: number;
+	/** Push critical system alerts (runner failed/refused, runners degraded) straight to the notifiers (D877). */
+	readonly criticalPushEnabled: boolean;
+	/** Comma-separated notifier target ids for that push; empty = every enabled operator-level target. */
+	readonly criticalPushTargetIds: string;
 }
 export declare class AlertCenterAddon extends BaseAddon<AlertCenterConfig> {
 	private unsubscribers;
-	constructor();
+	/** How long a burst of critical findings is gathered into one digest push. */
+	private readonly pushCoalesceMs;
+	constructor(options?: {
+		readonly pushCoalesceMs?: number;
+	});
 	/**
 	* Per `(category, source.id)` counter used to rate-limit chatty
 	* events. Entries are pruned lazily when they age out of
@@ -25,6 +33,38 @@ export declare class AlertCenterAddon extends BaseAddon<AlertCenterConfig> {
 	markAllRead(): Promise<void>;
 	dismiss(alertId: string): Promise<void>;
 	private handleEvent;
+	private readRunnerRecord;
+	private handleRunnerEvent;
+	/**
+	* A runner reached `running`: its episode is over. Close the runner alert so a
+	* later failure opens a NEW episode (new push key), instead of folding into a
+	* stale `refused` record that would never push again.
+	*/
+	private handleRunnerStateChanged;
+	/** The node's one-shot runner boot check: one alert, dismissed when the node is clean. */
+	private handleRunnerCheck;
+	private readAlertRaw;
+	/** Pushes run one at a time so a burst can never send the same state twice. */
+	private pushChain;
+	/** Findings waiting for the next digest, by alert id. */
+	private readonly pushQueue;
+	private pushTimer;
+	private pushPolicy;
+	private pushPorts;
+	/**
+	* Queue a critical finding for the next digest. A burst (every runner of a boot)
+	* arrives within the coalesce window and leaves as ONE message per target.
+	*/
+	private queuePush;
+	/** Send the queued findings now (also the reconcile path). */
+	private flushPushes;
+	private storePushState;
+	/**
+	* Retry every critical alert whose push is still pending - at boot and when
+	* the notifiers or notification-center start. An alert whose state was already
+	* delivered is skipped by its key, so reconciling never sends twice.
+	*/
+	private reconcilePendingPushes;
 	private handleModelDownload;
 	/**
 	* `[ALERT-CENTER-EVENTS]` — rate limit a `(category, source.id)`