@camstack/system 1.2.440 → 1.2.442

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BKhlcYz6.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-9fcsrFU3.mjs";
+import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-CS0D7imL.mjs → composition-sources-CftPpY4O.mjs}

@@ -1,4 +1,4 @@
-import { Ar as errMsg, Cr as compositionSourceKey } from "./dist-9fcsrFU3.mjs";
+import { Ar as errMsg, Cr as compositionSourceKey } from "./dist-DsrQYcLm.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-cBG8fBTu.js → composition-sources-DmSEMtUD.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BKhlcYz6.js");
+const require_dist = require("./dist-CyIHDLCg.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-CIzPjw7L.mjs → constants-2iWQ-Nx-.mjs}

@@ -1,4 +1,4 @@
-import { Wr as buildSecretRef } from "./dist-9fcsrFU3.mjs";
+import { Wr as buildSecretRef } from "./dist-DsrQYcLm.mjs";
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
 var MESH_CA_KEY_REF = buildSecretRef({
 	owner: "system",

package/dist/{constants-CRI3QzT4.js → constants-b7kpjuO4.js}

@@ -1,5 +1,5 @@
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
-var MESH_CA_KEY_REF = require("./dist-BKhlcYz6.js").buildSecretRef({
+var MESH_CA_KEY_REF = require("./dist-CyIHDLCg.js").buildSecretRef({
 	owner: "system",
 	scope: { kind: "global" },
 	fieldPath: "meshCaKey"

package/dist/{device-ca-DLKXYseS.mjs → device-ca-BJpYTAPg.mjs}

@@ -1,4 +1,4 @@
-import { D as DEVICE_SAN_CREDENTIAL_PREFIX, O as DEVICE_SAN_USER_PREFIX, Wr as buildSecretRef } from "./dist-9fcsrFU3.mjs";
+import { D as DEVICE_SAN_CREDENTIAL_PREFIX, O as DEVICE_SAN_USER_PREFIX, Wr as buildSecretRef } from "./dist-DsrQYcLm.mjs";
 import { S as backdatedNotBefore, a as KeyUsageFlags, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension } from "./x509.es-DK__ETIe.mjs";
 import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts

package/dist/{device-ca-DNHjts4_.js → device-ca-tKY_ZS9H.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BKhlcYz6.js");
+const require_dist = require("./dist-CyIHDLCg.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts

package/dist/{dist-BKhlcYz6.js → dist-CyIHDLCg.js}

@@ -1,6 +1,6 @@
 let zod = require("zod");
 require("node:crypto");
-//#region ../types/dist/event-category-C4hVnRo8.mjs
+//#region ../types/dist/event-category-BvOFi6PY.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -64,6 +64,24 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* consumes this category and maps it to the `addon-crash-loop` kind.
 	*/
 	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
+	/**
+	* A runner whose addon refused to start with a typed reason (D877) - parked
+	* in `refused`, never counted by the crash breaker, retried on operator
+	* action. One event per refusal.
+	*/
+	EventCategory["AddonRunnerRefused"] = "addon.runner-refused";
+	/**
+	* A runner settled on a state (D877): `running` (READY), `crashed`, `failed` or
+	* `refused`. In-process telemetry for the boot check (re-evaluate while any
+	* runner is still pending) and the alert centre (close a recovered runner).
+	*/
+	EventCategory["ProcessStateChanged"] = "process.state-changed";
+	/**
+	* The node's one-shot runner boot check (D877): planned runners against the
+	* process service, `degraded` when any is failed, refused or missing. The
+	* alert centre turns it into one alert and a direct critical push.
+	*/
+	EventCategory["SystemRunnerCheck"] = "system.runner-check";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -718,7 +736,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-bwsTj221.mjs
+//#region ../types/dist/sleep-bgZLodYc.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -4607,7 +4625,7 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/err-msg-DLerKiVO.mjs
+//#region ../types/dist/err-msg--2RrYiLO.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -4876,6 +4894,9 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
 	*  real Switch device for UI rendering / export adapters. */
 	DeviceRole["BinaryHelper"] = "binary-helper";
+	/** A smart plug: a `switch` whose source says it is an outlet (HA
+	*  `device_class: outlet`). The Alexa export shows it as a SMARTPLUG. */
+	DeviceRole["Outlet"] = "outlet";
 	/** Generic motion / occupancy / moving event source. Distinct from
 	*  the camera accessory PirSensor role: that one is a camera child;
 	*  this is a standalone HA / 3rd-party motion sensor. */
@@ -4953,7 +4974,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-EQ9Ok0Ee.mjs
+//#region ../types/dist/composition-DOwQB_Ua.mjs
 var AUDIO_ENCODER_BY_CODEC = {
 	opus: "libopus",
 	aac: "aac",
@@ -41043,6 +41064,36 @@ var llmRuntimeCapability = {
 	}
 };
 /**
+* The report of a one-shot "move this owner's plaintext secrets into the
+* keychain" run (D878). COUNTS only - never a value, never a ref.
+*
+* The owner runs it on its own rows, through its own write path; an operator
+* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
+* Dry run (`apply: false`) reports what WOULD move and changes nothing.
+*/
+var RawSecretMigrationInputSchema = zod.z.object({ 
+/** `false` (the default of the script) = report only. */
+apply: zod.z.boolean() });
+var RawSecretMigrationReportSchema = zod.z.object({
+	apply: zod.z.boolean(),
+	/** Rows that can carry a secret (a profile, an enrolment). */
+	rows: zod.z.number().int(),
+	/** Rows whose secret was plaintext when the run started. */
+	raw: zod.z.number().int(),
+	/** Rows that already held a keychain marker when the run started. */
+	markers: zod.z.number().int(),
+	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
+	migrated: zod.z.number().int(),
+	/** Plaintext rows left in place because the move or its read-back failed. */
+	failed: zod.z.number().int(),
+	/** After the run: rows still holding plaintext. */
+	remainingRaw: zod.z.number().int(),
+	/** After the run: markers the keychain could not resolve right now. */
+	unresolvedMarkers: zod.z.number().int(),
+	/** True when nothing is raw and every marker resolves. */
+	verified: zod.z.boolean()
+});
+/**
 * `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
 * methods concat-fan across providers; single-row methods route to ONE
 * provider by the `addonId` in the call input (the notification-output
@@ -41249,6 +41300,16 @@ var llmCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* D878: move every profile's plaintext `apiKey` into the keychain (owner
+		* `ai`), leaving a marker in the row. Dry run unless `apply`; idempotent;
+		* counts only. The plaintext is cleared only after the keychain read-back
+		* matched.
+		*/
+		migrateRawSecrets: method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		deleteProfile: method(ProfileRefInputSchema, zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
@@ -54029,6 +54090,41 @@ var ServerRollbackInfoSchema = zod.z.object({
 	atMs: zod.z.number(),
 	reason: zod.z.string()
 });
+/**
+* The runner boot check (D877): the runners this node PLANNED (hub: one per
+* `resolveRunnerId` over its forked addons; agent: the runners its process
+* service holds, because only the hub plans) against the states the process
+* service reports. Kept in memory, recomputed by the same one-shot check after
+* every boot, served on `getServerPackageStatus`.
+*
+* `failed` is the D6 breaker's terminal state, `refused` a deterministic Init
+* refusal (an addon that said "I will not start, and here is why"), `missing` a
+* planned runner the process service has no entry for.
+*/
+var RunnerRefusalSchema = zod.z.object({
+	runnerId: zod.z.string(),
+	addonIds: zod.z.array(zod.z.string()),
+	reason: zod.z.string()
+});
+var RunnerBootCheckSchema = zod.z.object({
+	checkedAtMs: zod.z.number(),
+	/** Runners planned for this node. */
+	expected: zod.z.number(),
+	/** Planned runners whose process is `running`. */
+	running: zod.z.number(),
+	failed: zod.z.array(zod.z.string()),
+	refused: zod.z.array(RunnerRefusalSchema),
+	missing: zod.z.array(zod.z.string()),
+	/**
+	* Runners still on their way: `starting`, or `crashed` waiting on a backoff
+	* respawn. The check is FINAL only when this is empty; until then nothing is
+	* pushed and the verdict is re-evaluated on the next runner state change.
+	* Optional for version skew (absent = settled).
+	*/
+	pending: zod.z.array(zod.z.string()).optional(),
+	/** True when the plan is the hub's (`missing` is then meaningful); false on an agent. */
+	planKnown: zod.z.boolean()
+});
 var ServerPackageStatusSchema = zod.z.object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: zod.z.string(),
@@ -54091,7 +54187,14 @@ var ServerPackageStatusSchema = zod.z.object({
 	* for version skew: an older provider's payload simply omits it, and an
 	* absent wrapper is unknown — never `native`.
 	*/
-	wrapper: WrapperIdentitySchema.optional()
+	wrapper: WrapperIdentitySchema.optional(),
+	/**
+	* What this node PLANNED to run against what its process service reports
+	* (D877). Absent until the one-shot boot check has run (~60 s after boot) and
+	* on a provider that predates it. Absent is "not checked yet", never "all
+	* well": a consumer that needs the answer treats it as pending.
+	*/
+	runners: RunnerBootCheckSchema.optional()
 });
 var ServerUpdateCheckResultSchema = zod.z.object({
 	packageName: zod.z.string(),
@@ -54142,6 +54245,13 @@ var ServerUpdateOutcomeSchema = zod.z.enum([
 	"refused",
 	"failed"
 ]);
+/** One addon the pre-flight found the target version would refuse (D877). */
+var UpdateBlockerSchema = zod.z.object({
+	addonId: zod.z.string(),
+	reason: zod.z.string(),
+	/** What the operator does about it. */
+	remedy: zod.z.string()
+});
 var ServerUpdateActionResultSchema = zod.z.object({
 	accepted: zod.z.boolean(),
 	targetVersion: zod.z.string().nullable(),
@@ -54159,7 +54269,13 @@ var ServerUpdateActionResultSchema = zod.z.object({
 	* The failure itself, verbatim enough to act on (the npm output for a
 	* staging install). Non-null only for `failed`.
 	*/
-	error: zod.z.string().nullable().optional()
+	error: zod.z.string().nullable().optional(),
+	/**
+	* The addons the target version would refuse to start on this node's live
+	* store (D877), present when the pre-flight refused the update
+	* (`reason: 'addon-would-refuse'`). Optional for version skew.
+	*/
+	blockers: zod.z.array(UpdateBlockerSchema).optional()
 });
 var serverManagementCapability = {
 	name: "server-management",
@@ -54171,9 +54287,16 @@ var serverManagementCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		applyServerUpdate: method(zod.z.object({ 
-		/** Explicit target version; omitted = latest from the registry. */
-version: zod.z.string().optional() }), ServerUpdateActionResultSchema, {
+		applyServerUpdate: method(zod.z.object({
+			/** Explicit target version; omitted = latest from the registry. */
+			version: zod.z.string().optional(),
+			/**
+			* Apply even though the pre-flight (D877) found addons the target would
+			* refuse to start. Off by default: those addons stay down until the
+			* remedy is run, which is the incident this gate exists to prevent.
+			*/
+			acknowledgeRefusals: zod.z.boolean().optional()
+		}), ServerUpdateActionResultSchema, {
 			kind: "mutation",
 			auth: "admin",
 			timeoutMs: 16 * 6e4
@@ -57495,7 +57618,9 @@ var ManifestShapeSchema = zod.z.object({
 var AddonProcessSchema = zod.z.object({
 	pid: zod.z.number().optional(),
 	mode: zod.z.string(),
-	state: zod.z.string()
+	state: zod.z.string(),
+	/** Why the runner is `refused` (an addon's own words), when it is (D877). */
+	reason: zod.z.string().optional()
 });
 /**
 * Per-addon health snapshot from the kernel's AddonHealthMonitor.
@@ -59183,6 +59308,12 @@ var ClimateControlStatusSchema = zod.z.object({
 	/** Horizontal louver swing on/off. Null when the device has no
 	*  horizontal swing surface (gate with `DeviceFeature.ClimateSwingHorizontal`). */
 	swingHorizontal: zod.z.boolean().nullable(),
+	/** Lowest setpoint the device accepts, Celsius. Absent / null = not reported. */
+	minTemp: zod.z.number().nullable().optional(),
+	/** Highest setpoint the device accepts, Celsius. Absent / null = not reported. */
+	maxTemp: zod.z.number().nullable().optional(),
+	/** Setpoint granularity, Celsius (0.5, 1). Absent / null = not reported. */
+	tempStep: zod.z.number().positive().nullable().optional(),
 	/** Ms epoch when the slice was last updated (push or command). */
 	lastFetchedAt: zod.z.number()
 });
@@ -70095,6 +70226,16 @@ var userManagementCapability = {
 			access: "delete"
 		}),
 		getTotpStatus: method(zod.z.object({ userId: zod.z.string() }), TotpStatusSchema, { auth: "admin" }),
+		/**
+		* D878: move every TOTP seed stored in plaintext into the keychain (owner
+		* `system`), leaving a marker in the row. Dry run unless `apply`;
+		* idempotent; counts only.
+		*/
+		migrateRawSecrets: method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
+		}),
 		verifyTotp: method(zod.z.object({
 			userId: zod.z.string(),
 			code: zod.z.string()
@@ -76474,6 +76615,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"llm.migrateRawSecrets": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -81016,6 +81163,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.migrateRawSecrets": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.oauthExchangeCode": {
 		capName: "user-management",
 		capScope: "system",
@@ -87149,6 +87302,12 @@ Object.defineProperty(exports, "looseSchema", {
 		return looseSchema;
 	}
 });
+Object.defineProperty(exports, "makeSecretMarker", {
+	enumerable: true,
+	get: function() {
+		return makeSecretMarker;
+	}
+});
 Object.defineProperty(exports, "mayReadLocation", {
 	enumerable: true,
 	get: function() {