@camstack/system 1.2.441 → 1.2.442

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { An as pickAppLinkHub, F as HUB_MDNS_SERVICE_TYPE, I as HUB_MDNS_TXT_KEYS, Ln as resolveAppConnections, Si as EventCategory, U as NetworkTunnelStartedDataSchema, Vn as resolveHubAddressRoles, Wn as resolveNotificationTapAddress, in as isDefaultAppConnectionEndpoint, jr as BaseAddon, l as CAMSTACK_APP_LINK_ORIGIN, mn as localNetworkCapability, tn as isAppLinkBase, ur as validateCustomAddress, yt as checkRoleAddress } from "../../dist-BWvkuc31.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-Cnd0bTB9.mjs";
+import { An as pickAppLinkHub, Ci as EventCategory, F as HUB_MDNS_SERVICE_TYPE, I as HUB_MDNS_TXT_KEYS, Ln as resolveAppConnections, U as NetworkTunnelStartedDataSchema, Vn as resolveHubAddressRoles, Wn as resolveNotificationTapAddress, in as isDefaultAppConnectionEndpoint, jr as BaseAddon, l as CAMSTACK_APP_LINK_ORIGIN, mn as localNetworkCapability, tn as isAppLinkBase, ur as validateCustomAddress, yt as checkRoleAddress } from "../../dist-DsrQYcLm.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-BS2akjWx.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-BWvkuc31.mjs";
+import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Ar as errMsg, Fn as reducePoints, Rn as resolveBucketMs, Si as EventCategory, Sn as metricsProviderCapability, Xt as foldSnapshotByFunction, jr as BaseAddon, qr as createEvent } from "../../dist-BWvkuc31.mjs";
+import { Ar as errMsg, Ci as EventCategory, Fn as reducePoints, Rn as resolveBucketMs, Sn as metricsProviderCapability, Xt as foldSnapshotByFunction, jr as BaseAddon, qr as createEvent } from "../../dist-DsrQYcLm.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os$1 from "node:os";
 import { platform } from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { Ar as errMsg, Jn as scoreRuntimes, Mn as platformProbeCapability, Si as EventCategory, Vt as enumerateInferenceDevices, Zr as emitReadiness, jr as BaseAddon } from "../../dist-BWvkuc31.mjs";
+import { Ar as errMsg, Ci as EventCategory, Jn as scoreRuntimes, Mn as platformProbeCapability, Vt as enumerateInferenceDevices, Zr as emitReadiness, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
 import * as os$1 from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Si as EventCategory, jr as BaseAddon } from "../../dist-BWvkuc31.mjs";
+import { Ci as EventCategory, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Ar as errMsg, Dr as DeviceFeature, Pt as deriveBatteryPresence, Qn as snapshotCapability, Si as EventCategory, dt as batteryCapability, jr as BaseAddon, kr as DeviceType, or as streamQualityLabel, s as BatteryStatusSchema, si as nodePin, ut as bareAddonId, xn as memoizePinnedFfmpeg } from "../../dist-BWvkuc31.mjs";
+import { Ar as errMsg, Ci as EventCategory, Dr as DeviceFeature, Pt as deriveBatteryPresence, Qn as snapshotCapability, ci as nodePin, dt as batteryCapability, jr as BaseAddon, kr as DeviceType, or as streamQualityLabel, s as BatteryStatusSchema, ut as bareAddonId, xn as memoizePinnedFfmpeg } from "../../dist-DsrQYcLm.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Yt as filesystemBrowseCapability, ir as storageProviderCapability, jr as BaseAddon } from "../../dist-BWvkuc31.mjs";
+import { Yt as filesystemBrowseCapability, ir as storageProviderCapability, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-CgZTNWAz.js");
+const require_wal_maintenance = require("../../wal-maintenance-C-bmkDhm.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_PAGE_CACHE_FLOOR_KIB, D as SQLITE_MMAP_CEILING_BYTES, E as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_INTERVAL_MS, I as SQLITE_PROFILE_TOP_N, L as SQLITE_SLOW_CALL_MS, M as sqlitePageCacheKibFor, N as SQLITE_ENGINE_STORM_WALL_SHARE, O as SQLITE_MMAP_FLOOR_BYTES, P as SQLITE_PROFILE_REPORT_FLOOR_MS, R as SqliteOpProfiler, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as sqliteMmapSizeFor, k as SQLITE_PAGE_CACHE_CEILING_KIB, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as sqliteEngineStorm } from "../../wal-maintenance-B57SAp4a.mjs";
+import { A as SQLITE_PAGE_CACHE_FLOOR_KIB, D as SQLITE_MMAP_CEILING_BYTES, E as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_INTERVAL_MS, I as SQLITE_PROFILE_TOP_N, L as SQLITE_SLOW_CALL_MS, M as sqlitePageCacheKibFor, N as SQLITE_ENGINE_STORM_WALL_SHARE, O as SQLITE_MMAP_FLOOR_BYTES, P as SQLITE_PROFILE_REPORT_FLOOR_MS, R as SqliteOpProfiler, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as sqliteMmapSizeFor, k as SQLITE_PAGE_CACHE_CEILING_KIB, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as sqliteEngineStorm } from "../../wal-maintenance-DE8QrreK.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 const require_retired_settings_keys = require("../../retired-settings-keys-D_VwZiDt.js");
-const require_wal_maintenance = require("../../wal-maintenance-CgZTNWAz.js");
+const require_wal_maintenance = require("../../wal-maintenance-C-bmkDhm.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { Ar as errMsg, At as databaseSnapshotCapability, Ir as RUNTIME_DEFAULTS, J as STORAGE_ADMIN_SCOPED_BASES, S as DATA_STORE_DATABASES, b as DATABASE_SNAPSHOT_SUFFIX, er as storageAdminCapability, jr as BaseAddon, kt as dataStoreProviderCapability, pr as vectorStoreCapability, q as STORAGE_ADMIN_MOVED_COLLECTIONS, ut as bareAddonId, x as DATABASE_SNAPSHOT_TIMEOUT_MS, y as DATABASE_SNAPSHOT_PARTIAL_SUFFIX } from "../../dist-BWvkuc31.mjs";
+import { Ar as errMsg, At as databaseSnapshotCapability, Ir as RUNTIME_DEFAULTS, J as STORAGE_ADMIN_SCOPED_BASES, S as DATA_STORE_DATABASES, b as DATABASE_SNAPSHOT_SUFFIX, er as storageAdminCapability, jr as BaseAddon, kt as dataStoreProviderCapability, pr as vectorStoreCapability, q as STORAGE_ADMIN_MOVED_COLLECTIONS, ut as bareAddonId, x as DATABASE_SNAPSHOT_TIMEOUT_MS, y as DATABASE_SNAPSHOT_PARTIAL_SUFFIX } from "../../dist-DsrQYcLm.mjs";
 import { i as retiredKeyStoreOf, n as purgeRetiredSettingsKeys } from "../../retired-settings-keys-Bhwe4ymb.mjs";
-import { C as callData, S as callControl, T as controlTargetOf, _ as isFileHostMessage, a as WalMaintenance, c as SqliteSettingsBackend, d as DatabaseBusyError, f as DuplicatePlacementError, g as collectTransferables, l as CollectionPlacementError, o as createVectorIndex, p as rehydrateError, s as vectorProviderOf, u as CrossDatabaseTransactError, w as callVector, x as trustResult } from "../../wal-maintenance-B57SAp4a.mjs";
+import { C as callData, S as callControl, T as controlTargetOf, _ as isFileHostMessage, a as WalMaintenance, c as SqliteSettingsBackend, d as DatabaseBusyError, f as DuplicatePlacementError, g as collectTransferables, l as CollectionPlacementError, o as createVectorIndex, p as rehydrateError, s as vectorProviderOf, u as CrossDatabaseTransactError, w as callVector, x as trustResult } from "../../wal-maintenance-DE8QrreK.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as StorageCleanupJobSchema, $t as gbToBytes, Cn as modeMayWrite, Fr as REDACTED_SECRET, Gr as collectSecretConfigKeys, Gt as evictionPolicyOfLocation, Hn as resolveLocationMode, Si as EventCategory, Yn as settingsStoreCapability, ai as isSecretMarker, an as isLocationEnabled, bi as transformSecretWrite, bn as mayWriteToLocation, et as StorageLocationModeSchema, fn as legacyModeOf, gi as secretTreeFromPaths, jr as BaseAddon, li as parseJsonObject, mi as resolveSecretMarkers, mr as withLocationMode, nr as storageMigrationCapability, nt as StorageMigrationJobSchema, tr as storageCapability, tt as StorageLocationTypeSchema, yn as mayReadLocation, z as LegacyStorageLocationDefaultSchema } from "../../dist-BWvkuc31.mjs";
+import { $ as StorageCleanupJobSchema, $t as gbToBytes, Ci as EventCategory, Cn as modeMayWrite, Fr as REDACTED_SECRET, Gr as collectSecretConfigKeys, Gt as evictionPolicyOfLocation, Hn as resolveLocationMode, Yn as settingsStoreCapability, _i as secretTreeFromPaths, ai as isSecretMarker, an as isLocationEnabled, bn as mayWriteToLocation, et as StorageLocationModeSchema, fn as legacyModeOf, hi as resolveSecretMarkers, jr as BaseAddon, mr as withLocationMode, nr as storageMigrationCapability, nt as StorageMigrationJobSchema, tr as storageCapability, tt as StorageLocationTypeSchema, ui as parseJsonObject, xi as transformSecretWrite, yn as mayReadLocation, z as LegacyStorageLocationDefaultSchema } from "../../dist-DsrQYcLm.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_x509_es = require("../../x509.es-C4cOo48M.js");
 const require_agent_https = require("../../agent-https-DlpTMDqA.js");
-const require_constants$8 = require("../../constants-UojhAJcm.js");
+const require_constants$8 = require("../../constants-b7kpjuO4.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,9 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Ar as errMsg, Jr as customAction, Xn as shortHostname, Yr as defineCustomActions, Z as ServerNameSchema, ei as hydrateSchema, jr as BaseAddon } from "../../dist-BWvkuc31.mjs";
+import { Ar as errMsg, Jr as customAction, Xn as shortHostname, Yr as defineCustomActions, Z as ServerNameSchema, ei as hydrateSchema, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { S as backdatedNotBefore, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension } from "../../x509.es-DK__ETIe.mjs";
 import { F as AGENT_HTTPS_NAMES_COLLECTION, I as AGENT_HTTPS_NAMES_COLUMNS, L as AgentHttpsNames, R as getProcessAgentHttpsNames, j as isLocalOnlyHostname, u as isPrivateAddress, z as setProcessAgentHttpsNames } from "../../agent-https-U0d4uvn2.mjs";
-import { a as MESH_CA_KEY_REF, c as SERVER_AUTH_OID, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "../../constants-DJILnUSb.mjs";
+import { a as MESH_CA_KEY_REF, c as SERVER_AUTH_OID, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "../../constants-2iWQ-Nx-.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-CyIHDLCg.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-BWvkuc31.mjs";
+import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-ByNISOnW.mjs → composition-sources-CftPpY4O.mjs}

@@ -1,4 +1,4 @@
-import { Ar as errMsg, Cr as compositionSourceKey } from "./dist-BWvkuc31.mjs";
+import { Ar as errMsg, Cr as compositionSourceKey } from "./dist-DsrQYcLm.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-BG-W2U0d.js → composition-sources-DmSEMtUD.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BiTCcaf-.js");
+const require_dist = require("./dist-CyIHDLCg.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-DJILnUSb.mjs → constants-2iWQ-Nx-.mjs}

@@ -1,4 +1,4 @@
-import { Wr as buildSecretRef } from "./dist-BWvkuc31.mjs";
+import { Wr as buildSecretRef } from "./dist-DsrQYcLm.mjs";
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
 var MESH_CA_KEY_REF = buildSecretRef({
 	owner: "system",

package/dist/{constants-UojhAJcm.js → constants-b7kpjuO4.js}

@@ -1,5 +1,5 @@
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
-var MESH_CA_KEY_REF = require("./dist-BiTCcaf-.js").buildSecretRef({
+var MESH_CA_KEY_REF = require("./dist-CyIHDLCg.js").buildSecretRef({
 	owner: "system",
 	scope: { kind: "global" },
 	fieldPath: "meshCaKey"

package/dist/{device-ca-D8Ri9TVz.mjs → device-ca-BJpYTAPg.mjs}

@@ -1,4 +1,4 @@
-import { D as DEVICE_SAN_CREDENTIAL_PREFIX, O as DEVICE_SAN_USER_PREFIX, Wr as buildSecretRef } from "./dist-BWvkuc31.mjs";
+import { D as DEVICE_SAN_CREDENTIAL_PREFIX, O as DEVICE_SAN_USER_PREFIX, Wr as buildSecretRef } from "./dist-DsrQYcLm.mjs";
 import { S as backdatedNotBefore, a as KeyUsageFlags, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension } from "./x509.es-DK__ETIe.mjs";
 import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts

package/dist/{device-ca-196DAEZT.js → device-ca-tKY_ZS9H.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BiTCcaf-.js");
+const require_dist = require("./dist-CyIHDLCg.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts

package/dist/{dist-BiTCcaf-.js → dist-CyIHDLCg.js}

@@ -1,6 +1,6 @@
 let zod = require("zod");
 require("node:crypto");
-//#region ../types/dist/event-category-C4hVnRo8.mjs
+//#region ../types/dist/event-category-BvOFi6PY.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -64,6 +64,24 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* consumes this category and maps it to the `addon-crash-loop` kind.
 	*/
 	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
+	/**
+	* A runner whose addon refused to start with a typed reason (D877) - parked
+	* in `refused`, never counted by the crash breaker, retried on operator
+	* action. One event per refusal.
+	*/
+	EventCategory["AddonRunnerRefused"] = "addon.runner-refused";
+	/**
+	* A runner settled on a state (D877): `running` (READY), `crashed`, `failed` or
+	* `refused`. In-process telemetry for the boot check (re-evaluate while any
+	* runner is still pending) and the alert centre (close a recovered runner).
+	*/
+	EventCategory["ProcessStateChanged"] = "process.state-changed";
+	/**
+	* The node's one-shot runner boot check (D877): planned runners against the
+	* process service, `degraded` when any is failed, refused or missing. The
+	* alert centre turns it into one alert and a direct critical push.
+	*/
+	EventCategory["SystemRunnerCheck"] = "system.runner-check";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -718,7 +736,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-bwsTj221.mjs
+//#region ../types/dist/sleep-bgZLodYc.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -41046,6 +41064,36 @@ var llmRuntimeCapability = {
 	}
 };
 /**
+* The report of a one-shot "move this owner's plaintext secrets into the
+* keychain" run (D878). COUNTS only - never a value, never a ref.
+*
+* The owner runs it on its own rows, through its own write path; an operator
+* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
+* Dry run (`apply: false`) reports what WOULD move and changes nothing.
+*/
+var RawSecretMigrationInputSchema = zod.z.object({ 
+/** `false` (the default of the script) = report only. */
+apply: zod.z.boolean() });
+var RawSecretMigrationReportSchema = zod.z.object({
+	apply: zod.z.boolean(),
+	/** Rows that can carry a secret (a profile, an enrolment). */
+	rows: zod.z.number().int(),
+	/** Rows whose secret was plaintext when the run started. */
+	raw: zod.z.number().int(),
+	/** Rows that already held a keychain marker when the run started. */
+	markers: zod.z.number().int(),
+	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
+	migrated: zod.z.number().int(),
+	/** Plaintext rows left in place because the move or its read-back failed. */
+	failed: zod.z.number().int(),
+	/** After the run: rows still holding plaintext. */
+	remainingRaw: zod.z.number().int(),
+	/** After the run: markers the keychain could not resolve right now. */
+	unresolvedMarkers: zod.z.number().int(),
+	/** True when nothing is raw and every marker resolves. */
+	verified: zod.z.boolean()
+});
+/**
 * `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
 * methods concat-fan across providers; single-row methods route to ONE
 * provider by the `addonId` in the call input (the notification-output
@@ -41252,6 +41300,16 @@ var llmCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* D878: move every profile's plaintext `apiKey` into the keychain (owner
+		* `ai`), leaving a marker in the row. Dry run unless `apply`; idempotent;
+		* counts only. The plaintext is cleared only after the keychain read-back
+		* matched.
+		*/
+		migrateRawSecrets: method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		deleteProfile: method(ProfileRefInputSchema, zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
@@ -54032,6 +54090,41 @@ var ServerRollbackInfoSchema = zod.z.object({
 	atMs: zod.z.number(),
 	reason: zod.z.string()
 });
+/**
+* The runner boot check (D877): the runners this node PLANNED (hub: one per
+* `resolveRunnerId` over its forked addons; agent: the runners its process
+* service holds, because only the hub plans) against the states the process
+* service reports. Kept in memory, recomputed by the same one-shot check after
+* every boot, served on `getServerPackageStatus`.
+*
+* `failed` is the D6 breaker's terminal state, `refused` a deterministic Init
+* refusal (an addon that said "I will not start, and here is why"), `missing` a
+* planned runner the process service has no entry for.
+*/
+var RunnerRefusalSchema = zod.z.object({
+	runnerId: zod.z.string(),
+	addonIds: zod.z.array(zod.z.string()),
+	reason: zod.z.string()
+});
+var RunnerBootCheckSchema = zod.z.object({
+	checkedAtMs: zod.z.number(),
+	/** Runners planned for this node. */
+	expected: zod.z.number(),
+	/** Planned runners whose process is `running`. */
+	running: zod.z.number(),
+	failed: zod.z.array(zod.z.string()),
+	refused: zod.z.array(RunnerRefusalSchema),
+	missing: zod.z.array(zod.z.string()),
+	/**
+	* Runners still on their way: `starting`, or `crashed` waiting on a backoff
+	* respawn. The check is FINAL only when this is empty; until then nothing is
+	* pushed and the verdict is re-evaluated on the next runner state change.
+	* Optional for version skew (absent = settled).
+	*/
+	pending: zod.z.array(zod.z.string()).optional(),
+	/** True when the plan is the hub's (`missing` is then meaningful); false on an agent. */
+	planKnown: zod.z.boolean()
+});
 var ServerPackageStatusSchema = zod.z.object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: zod.z.string(),
@@ -54094,7 +54187,14 @@ var ServerPackageStatusSchema = zod.z.object({
 	* for version skew: an older provider's payload simply omits it, and an
 	* absent wrapper is unknown — never `native`.
 	*/
-	wrapper: WrapperIdentitySchema.optional()
+	wrapper: WrapperIdentitySchema.optional(),
+	/**
+	* What this node PLANNED to run against what its process service reports
+	* (D877). Absent until the one-shot boot check has run (~60 s after boot) and
+	* on a provider that predates it. Absent is "not checked yet", never "all
+	* well": a consumer that needs the answer treats it as pending.
+	*/
+	runners: RunnerBootCheckSchema.optional()
 });
 var ServerUpdateCheckResultSchema = zod.z.object({
 	packageName: zod.z.string(),
@@ -54145,6 +54245,13 @@ var ServerUpdateOutcomeSchema = zod.z.enum([
 	"refused",
 	"failed"
 ]);
+/** One addon the pre-flight found the target version would refuse (D877). */
+var UpdateBlockerSchema = zod.z.object({
+	addonId: zod.z.string(),
+	reason: zod.z.string(),
+	/** What the operator does about it. */
+	remedy: zod.z.string()
+});
 var ServerUpdateActionResultSchema = zod.z.object({
 	accepted: zod.z.boolean(),
 	targetVersion: zod.z.string().nullable(),
@@ -54162,7 +54269,13 @@ var ServerUpdateActionResultSchema = zod.z.object({
 	* The failure itself, verbatim enough to act on (the npm output for a
 	* staging install). Non-null only for `failed`.
 	*/
-	error: zod.z.string().nullable().optional()
+	error: zod.z.string().nullable().optional(),
+	/**
+	* The addons the target version would refuse to start on this node's live
+	* store (D877), present when the pre-flight refused the update
+	* (`reason: 'addon-would-refuse'`). Optional for version skew.
+	*/
+	blockers: zod.z.array(UpdateBlockerSchema).optional()
 });
 var serverManagementCapability = {
 	name: "server-management",
@@ -54174,9 +54287,16 @@ var serverManagementCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		applyServerUpdate: method(zod.z.object({ 
-		/** Explicit target version; omitted = latest from the registry. */
-version: zod.z.string().optional() }), ServerUpdateActionResultSchema, {
+		applyServerUpdate: method(zod.z.object({
+			/** Explicit target version; omitted = latest from the registry. */
+			version: zod.z.string().optional(),
+			/**
+			* Apply even though the pre-flight (D877) found addons the target would
+			* refuse to start. Off by default: those addons stay down until the
+			* remedy is run, which is the incident this gate exists to prevent.
+			*/
+			acknowledgeRefusals: zod.z.boolean().optional()
+		}), ServerUpdateActionResultSchema, {
 			kind: "mutation",
 			auth: "admin",
 			timeoutMs: 16 * 6e4
@@ -57498,7 +57618,9 @@ var ManifestShapeSchema = zod.z.object({
 var AddonProcessSchema = zod.z.object({
 	pid: zod.z.number().optional(),
 	mode: zod.z.string(),
-	state: zod.z.string()
+	state: zod.z.string(),
+	/** Why the runner is `refused` (an addon's own words), when it is (D877). */
+	reason: zod.z.string().optional()
 });
 /**
 * Per-addon health snapshot from the kernel's AddonHealthMonitor.
@@ -70104,6 +70226,16 @@ var userManagementCapability = {
 			access: "delete"
 		}),
 		getTotpStatus: method(zod.z.object({ userId: zod.z.string() }), TotpStatusSchema, { auth: "admin" }),
+		/**
+		* D878: move every TOTP seed stored in plaintext into the keychain (owner
+		* `system`), leaving a marker in the row. Dry run unless `apply`;
+		* idempotent; counts only.
+		*/
+		migrateRawSecrets: method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
+		}),
 		verifyTotp: method(zod.z.object({
 			userId: zod.z.string(),
 			code: zod.z.string()
@@ -76483,6 +76615,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"llm.migrateRawSecrets": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -81025,6 +81163,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.migrateRawSecrets": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.oauthExchangeCode": {
 		capName: "user-management",
 		capScope: "system",
@@ -87158,6 +87302,12 @@ Object.defineProperty(exports, "looseSchema", {
 		return looseSchema;
 	}
 });
+Object.defineProperty(exports, "makeSecretMarker", {
+	enumerable: true,
+	get: function() {
+		return makeSecretMarker;
+	}
+});
 Object.defineProperty(exports, "mayReadLocation", {
 	enumerable: true,
 	get: function() {