@camstack/system 1.2.440 → 1.2.442

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BKhlcYz6.js");
-const require_device_ca = require("./device-ca-DNHjts4_.js");
+const require_dist = require("./dist-CyIHDLCg.js");
+const require_device_ca = require("./device-ca-tKY_ZS9H.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -25,21 +25,21 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-C041zn6V.js");
+const require_wal_maintenance = require("./wal-maintenance-C-bmkDhm.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
 const require_agent_https = require("./agent-https-DlpTMDqA.js");
-const require_constants = require("./constants-CRI3QzT4.js");
+const require_constants = require("./constants-b7kpjuO4.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-BKmoaqG0.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-3Zc9G9MS.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-Da-0NEyr.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-49aZwkp8.js");
+const require_restore_archive = require("./restore-archive-Cdf09dHm.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -23020,6 +23020,50 @@ function createRunnerAddonSettings(client, addonId, before = async () => {}) {
 	};
 }
 //#endregion
+//#region src/kernel/addon-refused-error.ts
+/**
+* A deterministic Init refusal (D877): an addon that says, in a typed way,
+* "I will not start, and here is why" - as opposed to a crash.
+*
+* The difference matters to the supervisor. A crash may be transient (a camera
+* dropping mid-handshake) and is bounded by the D6 circuit-breaker; a refusal
+* repeats identically until somebody changes the world (runs a migration,
+* fixes a setting), so counting it toward the breaker only turns "waiting for
+* the operator" into a terminal `failed` with a stack trace nobody needed.
+* On 2026-10-17 twenty-eight addons refused on an unmigrated store, exited five
+* times in ten seconds and were marked `failed` as if they had crashed.
+*
+* The runner reports a refusal to its parent (see `runner-refusal.ts`); the
+* process service parks the runner in `refused` with the reason and retries it
+* only when an operator acts.
+*/
+var AddonRefusedError = class extends Error {
+	/** Stable, greppable cause, e.g. `unmigrated-settings`. */
+	code;
+	/** What the operator does about it. */
+	remedy;
+	constructor(code, message, remedy, options) {
+		super(message, options);
+		this.name = "AddonRefusedError";
+		this.code = code;
+		this.remedy = remedy;
+	}
+};
+/**
+* The refusal in `err`'s cause chain, if any. An addon that wraps the error it
+* got from the kernel (`new Error('init failed', { cause })`) is still refusing.
+*/
+function findAddonRefusal(err) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = err;
+	while (current !== null && current !== void 0 && !seen.has(current)) {
+		if (current instanceof AddonRefusedError) return current;
+		seen.add(current);
+		current = current instanceof Error ? current.cause : void 0;
+	}
+	return null;
+}
+//#endregion
 //#region src/kernel/legacy-blob-guard.ts
 /** Root keys retired long before D870: they never count as "settings still to migrate". */
 var OWN_RETIRED_ROOT_KEYS = new Set([
@@ -23035,9 +23079,13 @@ function isRetiredRootKey(addonId, key) {
 	if (OWN_RETIRED_ROOT_KEYS.has(key)) return true;
 	return require_retired_settings_keys.RETIRED_SETTINGS_KEYS.some((spec) => spec.namespace === addonId && (spec.keys.includes(key) || spec.perNodeKeys.some((k) => key === k || key.startsWith(`${k}@`))));
 }
-var UnmigratedSettingsError = class extends Error {
+/** Stable `code` of the D870 refusal. */
+var UNMIGRATED_SETTINGS_CODE = "unmigrated-settings";
+/** The remedy the refusal (and the update pre-flight) names. */
+var UNMIGRATED_SETTINGS_REMEDY = "Run scripts/hub/migrate-device-store.ts --copy --apply (D870), then restart the addon.";
+var UnmigratedSettingsError = class extends AddonRefusedError {
 	constructor(addonId, what) {
-		super(`addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`);
+		super(UNMIGRATED_SETTINGS_CODE, `addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`, UNMIGRATED_SETTINGS_REMEDY);
 		this.name = "UnmigratedSettingsError";
 	}
 };
@@ -25010,6 +25058,27 @@ var AddonHealthMonitor = class {
 	}
 };
 //#endregion
+//#region src/kernel/moleculer/runner-refusal.ts
+var REFUSED_PREFIX = "REFUSED:";
+function isReport(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const rec = value;
+	return typeof rec["addonId"] === "string" && typeof rec["code"] === "string" && typeof rec["reason"] === "string" && typeof rec["remedy"] === "string";
+}
+/** The refusals announced in a chunk of runner stdout; lines that are not one are ignored. */
+function parseRunnerRefusals(nodeId, chunk) {
+	const prefix = `${REFUSED_PREFIX}${nodeId}:`;
+	const out = [];
+	for (const line of chunk.split("\n")) {
+		if (!line.startsWith(prefix)) continue;
+		try {
+			const parsed = JSON.parse(line.slice(prefix.length));
+			if (isReport(parsed)) out.push(parsed);
+		} catch {}
+	}
+	return out;
+}
+//#endregion
 //#region src/kernel/moleculer/crash-supervisor.ts
 /** Per-runner crash circuit-breaker. Replaces the old infinite-respawn loop. */
 var CrashSupervisor = class {
@@ -25648,6 +25717,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 	const groupOps = deps?.processGroups ?? defaultProcessGroupOps;
 	const runnersOwnGroups = runnerOwnsProcessGroup(deps?.platform ?? process.platform);
 	const processes = /* @__PURE__ */ new Map();
+	const backingOff = /* @__PURE__ */ new Map();
 	const pendingGroupReaps = /* @__PURE__ */ new Map();
 	const runnerLocks = /* @__PURE__ */ new Map();
 	function withRunnerLock(runnerId, fn) {
@@ -25688,6 +25758,19 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 		}, data));
 	}
 	/**
+	* Every transition a supervisor or a boot check can settle on (D877):
+	* `running` (READY), `crashed`, `failed`, `refused`. In-process telemetry - the
+	* boot check re-evaluates on it and the alert centre closes a recovered runner.
+	*/
+	function emitStateChange(entry) {
+		emitRunnerEvent(require_dist.EventCategory.ProcessStateChanged, entry.name, {
+			runnerId: entry.name,
+			nodeId: parentNodeId,
+			addonIds: entry.runnerAddons.map((addon) => addon.addonId),
+			state: entry.state
+		});
+	}
+	/**
 	* One line per reap that found something, or that failed. An empty group is the
 	* normal case after a clean stop and stays quiet at debug. The kernel cannot say
 	* which device a child served — the runner id is the finest attribution it has.
@@ -25752,6 +25835,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 	*/
 	function spawnRunner(runnerId, addons, env) {
 		const nodeId = buildNodeId(runnerId);
+		backingOff.delete(runnerId);
 		const runnerPath = node_path.resolve(__dirname, "addon-runner.js");
 		const heavy = isHeavyRunner(addons);
 		const rssBudgetMb = runnerRssBudgetMb(addons);
@@ -25792,6 +25876,8 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			startedAt: Date.now(),
 			restartCount: 0,
 			state: "starting",
+			refusal: null,
+			announcedRefusal: null,
 			child,
 			ownsGroup,
 			groupReap: null
@@ -25801,7 +25887,13 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			kill: groupOps.kill
 		});
 		child.stdout?.on("data", (data) => {
-			if (data.toString().includes(`READY:${nodeId}`) && entry.state === "starting") entry.state = "running";
+			const text = data.toString();
+			const refusals = parseRunnerRefusals(nodeId, text);
+			if (refusals[0] !== void 0) entry.announcedRefusal = refusals[0];
+			if (text.includes(`READY:${nodeId}`) && entry.state === "starting") {
+				entry.state = "running";
+				emitStateChange(entry);
+			}
 		});
 		child.stderr?.on("data", (data) => {
 			process.stderr.write(`[${runnerId}] ${data.toString()}`);
@@ -25810,7 +25902,33 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			console.error(`[process-service EXIT] runner=${runnerId} code=${String(code)} signal=${String(signal)} state=${entry.state}`);
 			const groupReap = reapRunnerGroup(entry);
 			if (entry.state === "stopped") return;
+			const announced = entry.announcedRefusal;
+			entry.announcedRefusal = null;
+			if (code === 78) {
+				const refusal = announced ?? {
+					addonId: entry.runnerAddons[0]?.addonId ?? runnerId,
+					code: "unknown",
+					reason: "the runner exited with the refusal code without saying why",
+					remedy: "Read the runner log, fix the cause, then restart the addon."
+				};
+				entry.refusal = refusal;
+				entry.state = "refused";
+				capturedBroker?.logger.error(`[${runnerId}] Addon refused to start (${refusal.code}): ${refusal.reason} Not respawning; ${refusal.remedy}`, { tags: { runnerId } });
+				processes.set(runnerId, entry);
+				if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
+				emitRunnerEvent(require_dist.EventCategory.AddonRunnerRefused, runnerId, {
+					runnerId,
+					nodeId: parentNodeId,
+					addonIds: entry.runnerAddons.map((addon) => addon.addonId),
+					code: refusal.code,
+					reason: refusal.reason,
+					remedy: refusal.remedy
+				});
+				emitStateChange(entry);
+				return;
+			}
 			entry.state = "crashed";
+			emitStateChange(entry);
 			capturedBroker?.logger.error(`[${runnerId}] Process exited (code=${code}, signal=${signal})`);
 			const decision = crashSupervisor.recordCrash(runnerId);
 			emitRunnerEvent(require_dist.EventCategory.ProcessCrashed, runnerId, {
@@ -25820,6 +25938,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			});
 			if (decision.action === "failed") {
 				entry.state = "failed";
+				emitStateChange(entry);
 				capturedBroker?.logger.error(`[${runnerId}] Crash circuit-breaker tripped — ${decision.crashesInWindow} crashes in ${CRASH_WINDOW_MS}ms. Not respawning.`);
 				processes.set(runnerId, entry);
 				if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
@@ -25844,10 +25963,12 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 				delayMs: decision.backoffMs
 			});
 			processes.delete(runnerId);
+			backingOff.set(runnerId, entry);
 			if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
 			setTimeout(() => {
 				withRunnerLock(runnerId, async () => {
 					await groupReap;
+					backingOff.delete(runnerId);
 					if (processes.has(runnerId)) return;
 					const restarted = spawnRunner(runnerId, addons, env);
 					restarted.restartCount = entry.restartCount + 1;
@@ -25887,7 +26008,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						reason: "not found"
 					};
 					const deadNodeId = target.nodeId;
-					const alreadyDead = target.state === "failed" || target.child.exitCode !== null || target.child.signalCode !== null;
+					const alreadyDead = target.state === "failed" || target.state === "refused" || target.child.exitCode !== null || target.child.signalCode !== null;
 					target.state = "stopped";
 					if (!alreadyDead) {
 						target.child.kill("SIGTERM");
@@ -25924,7 +26045,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 					const { runnerAddons } = target;
 					const deadNodeId = target.nodeId;
 					const prevRestartCount = target.restartCount;
-					const alreadyDead = target.state === "failed" || target.child.exitCode !== null || target.child.signalCode !== null;
+					const alreadyDead = target.state === "failed" || target.state === "refused" || target.child.exitCode !== null || target.child.signalCode !== null;
 					target.state = "stopped";
 					if (!alreadyDead) {
 						target.child.kill("SIGTERM");
@@ -25953,7 +26074,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 				});
 			} },
 			list: { async handler() {
-				const entries = [...processes.values()];
+				const entries = [...processes.values(), ...backingOff.values()];
 				const stats = await getPidStats$1(entries.filter((p) => p.pid > 0).map((p) => p.pid));
 				return entries.map((p) => {
 					const s = stats.get(p.pid);
@@ -25969,6 +26090,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						startedAt: p.startedAt,
 						restartCount: p.restartCount,
 						state: p.state,
+						...p.refusal !== null ? { refusal: p.refusal } : {},
 						cpuPercent: s?.cpu ?? 0,
 						memoryRss: s?.memoryRss ?? 0,
 						uptimeSeconds: Math.floor((Date.now() - p.startedAt) / 1e3)
@@ -25985,7 +26107,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						if (!entry) return;
 						const { runnerAddons } = entry;
 						const prevRestartCount = entry.restartCount;
-						if (!(entry.state === "failed" || entry.child.exitCode !== null || entry.child.signalCode !== null)) {
+						if (!(entry.state === "failed" || entry.state === "refused" || entry.child.exitCode !== null || entry.child.signalCode !== null)) {
 							entry.state = "stopped";
 							entry.child.kill("SIGTERM");
 							await new Promise((resolve) => {
@@ -26040,6 +26162,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						startedAt: p.startedAt,
 						restartCount: p.restartCount,
 						state: p.state,
+						...p.refusal !== null ? { refusal: p.refusal } : {},
 						cpuPercent: s?.cpu ?? 0,
 						memoryRss: s?.memoryRss ?? 0,
 						uptimeSeconds: Math.floor((Date.now() - p.startedAt) / 1e3)
@@ -27176,6 +27299,7 @@ exports.AddonHealthMonitor = AddonHealthMonitor;
 exports.AddonInstaller = AddonInstaller;
 exports.AddonLoader = AddonLoader;
 exports.AddonManifest = AddonManifest;
+exports.AddonRefusedError = AddonRefusedError;
 exports.AddonRouteRegistry = AddonRouteRegistry;
 exports.AdminTokenManager = require_builtins_local_auth_local_auth_addon.AdminTokenManager;
 exports.AgentHttpsInstallError = require_agent_https.AgentHttpsInstallError;
@@ -27366,11 +27490,14 @@ exports.TlsTcpTransporter = require_builtins_system_config_system_config_addon.T
 exports.ToastService = ToastService;
 exports.UDS_NO_ROUTE_PREFIX = UDS_NO_ROUTE_PREFIX;
 exports.UNCLAIMED = UNCLAIMED;
+exports.UNMIGRATED_SETTINGS_CODE = UNMIGRATED_SETTINGS_CODE;
+exports.UNMIGRATED_SETTINGS_REMEDY = UNMIGRATED_SETTINGS_REMEDY;
 exports.UPLOADED_CA_FILE = require_hub_mdns_ciao.UPLOADED_CA_FILE;
 exports.USER_MANAGEMENT_INTERNAL = require_builtins_local_auth_local_auth_addon.USER_MANAGEMENT_INTERNAL;
 exports.UdsLocalTransportClient = UdsLocalTransportClient;
 exports.UdsLocalTransportServer = UdsLocalTransportServer;
 exports.UnlockTicketJtiStore = require_builtins_system_config_system_config_addon.UnlockTicketJtiStore;
+exports.UnmigratedSettingsError = UnmigratedSettingsError;
 exports.UserManager = require_builtins_local_auth_local_auth_addon.UserManager;
 exports.WinstonDestination = require_builtins_winston_logging_index.WinstonDestination$1;
 exports.WinstonLoggingAddon = require_builtins_winston_logging_index.WinstonLoggingAddon$1;
@@ -27387,6 +27514,7 @@ exports.allFamiliesListenHost = require_hub_mdns_ciao.allFamiliesListenHost;
 exports.answerClaimedGetStatus = answerClaimedGetStatus;
 exports.applyCertificateToListener = require_hub_mdns_ciao.applyCertificateToListener;
 exports.applyLanHttp = require_hub_mdns_ciao.applyLanHttp;
+exports.assertLegacyBlobsMigrated = assertLegacyBlobsMigrated;
 exports.attachUserManagementInternal = require_builtins_local_auth_local_auth_addon.attachUserManagementInternal;
 exports.attributeStall = require_custom_action_registry.attributeStall;
 exports.bindPendingLanHttp = require_hub_mdns_ciao.bindPendingLanHttp;
@@ -27544,6 +27672,7 @@ exports.evaluateExistingCert = require_agent_https.evaluateExistingCert;
 exports.expandCapMethods = require_dist.expandCapMethods;
 exports.exportMeshPrivateKeyPem = require_builtins_system_config_system_config_addon.exportMeshPrivateKeyPem;
 exports.fetchJson = require_custom_action_registry.fetchJson;
+exports.findAddonRefusal = findAddonRefusal;
 Object.defineProperty(exports, "findInPath", {
 	enumerable: true,
 	get: function() {