@camstack/system 1.2.441 → 1.2.442

package/dist/{dist-BWvkuc31.mjs → dist-DsrQYcLm.mjs}

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import "node:crypto";
-//#region ../types/dist/event-category-C4hVnRo8.mjs
+//#region ../types/dist/event-category-BvOFi6PY.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -64,6 +64,24 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* consumes this category and maps it to the `addon-crash-loop` kind.
 	*/
 	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
+	/**
+	* A runner whose addon refused to start with a typed reason (D877) - parked
+	* in `refused`, never counted by the crash breaker, retried on operator
+	* action. One event per refusal.
+	*/
+	EventCategory["AddonRunnerRefused"] = "addon.runner-refused";
+	/**
+	* A runner settled on a state (D877): `running` (READY), `crashed`, `failed` or
+	* `refused`. In-process telemetry for the boot check (re-evaluate while any
+	* runner is still pending) and the alert centre (close a recovered runner).
+	*/
+	EventCategory["ProcessStateChanged"] = "process.state-changed";
+	/**
+	* The node's one-shot runner boot check (D877): planned runners against the
+	* process service, `degraded` when any is failed, refused or missing. The
+	* alert centre turns it into one alert and a direct critical push.
+	*/
+	EventCategory["SystemRunnerCheck"] = "system.runner-check";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -718,7 +736,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-bwsTj221.mjs
+//#region ../types/dist/sleep-bgZLodYc.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -41046,6 +41064,36 @@ var llmRuntimeCapability = {
 	}
 };
 /**
+* The report of a one-shot "move this owner's plaintext secrets into the
+* keychain" run (D878). COUNTS only - never a value, never a ref.
+*
+* The owner runs it on its own rows, through its own write path; an operator
+* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
+* Dry run (`apply: false`) reports what WOULD move and changes nothing.
+*/
+var RawSecretMigrationInputSchema = z.object({ 
+/** `false` (the default of the script) = report only. */
+apply: z.boolean() });
+var RawSecretMigrationReportSchema = z.object({
+	apply: z.boolean(),
+	/** Rows that can carry a secret (a profile, an enrolment). */
+	rows: z.number().int(),
+	/** Rows whose secret was plaintext when the run started. */
+	raw: z.number().int(),
+	/** Rows that already held a keychain marker when the run started. */
+	markers: z.number().int(),
+	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
+	migrated: z.number().int(),
+	/** Plaintext rows left in place because the move or its read-back failed. */
+	failed: z.number().int(),
+	/** After the run: rows still holding plaintext. */
+	remainingRaw: z.number().int(),
+	/** After the run: markers the keychain could not resolve right now. */
+	unresolvedMarkers: z.number().int(),
+	/** True when nothing is raw and every marker resolves. */
+	verified: z.boolean()
+});
+/**
 * `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
 * methods concat-fan across providers; single-row methods route to ONE
 * provider by the `addonId` in the call input (the notification-output
@@ -41252,6 +41300,16 @@ var llmCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* D878: move every profile's plaintext `apiKey` into the keychain (owner
+		* `ai`), leaving a marker in the row. Dry run unless `apply`; idempotent;
+		* counts only. The plaintext is cleared only after the keychain read-back
+		* matched.
+		*/
+		migrateRawSecrets: method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		deleteProfile: method(ProfileRefInputSchema, z.void(), {
 			kind: "mutation",
 			auth: "admin"
@@ -54032,6 +54090,41 @@ var ServerRollbackInfoSchema = z.object({
 	atMs: z.number(),
 	reason: z.string()
 });
+/**
+* The runner boot check (D877): the runners this node PLANNED (hub: one per
+* `resolveRunnerId` over its forked addons; agent: the runners its process
+* service holds, because only the hub plans) against the states the process
+* service reports. Kept in memory, recomputed by the same one-shot check after
+* every boot, served on `getServerPackageStatus`.
+*
+* `failed` is the D6 breaker's terminal state, `refused` a deterministic Init
+* refusal (an addon that said "I will not start, and here is why"), `missing` a
+* planned runner the process service has no entry for.
+*/
+var RunnerRefusalSchema = z.object({
+	runnerId: z.string(),
+	addonIds: z.array(z.string()),
+	reason: z.string()
+});
+var RunnerBootCheckSchema = z.object({
+	checkedAtMs: z.number(),
+	/** Runners planned for this node. */
+	expected: z.number(),
+	/** Planned runners whose process is `running`. */
+	running: z.number(),
+	failed: z.array(z.string()),
+	refused: z.array(RunnerRefusalSchema),
+	missing: z.array(z.string()),
+	/**
+	* Runners still on their way: `starting`, or `crashed` waiting on a backoff
+	* respawn. The check is FINAL only when this is empty; until then nothing is
+	* pushed and the verdict is re-evaluated on the next runner state change.
+	* Optional for version skew (absent = settled).
+	*/
+	pending: z.array(z.string()).optional(),
+	/** True when the plan is the hub's (`missing` is then meaningful); false on an agent. */
+	planKnown: z.boolean()
+});
 var ServerPackageStatusSchema = z.object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: z.string(),
@@ -54094,7 +54187,14 @@ var ServerPackageStatusSchema = z.object({
 	* for version skew: an older provider's payload simply omits it, and an
 	* absent wrapper is unknown — never `native`.
 	*/
-	wrapper: WrapperIdentitySchema.optional()
+	wrapper: WrapperIdentitySchema.optional(),
+	/**
+	* What this node PLANNED to run against what its process service reports
+	* (D877). Absent until the one-shot boot check has run (~60 s after boot) and
+	* on a provider that predates it. Absent is "not checked yet", never "all
+	* well": a consumer that needs the answer treats it as pending.
+	*/
+	runners: RunnerBootCheckSchema.optional()
 });
 var ServerUpdateCheckResultSchema = z.object({
 	packageName: z.string(),
@@ -54145,6 +54245,13 @@ var ServerUpdateOutcomeSchema = z.enum([
 	"refused",
 	"failed"
 ]);
+/** One addon the pre-flight found the target version would refuse (D877). */
+var UpdateBlockerSchema = z.object({
+	addonId: z.string(),
+	reason: z.string(),
+	/** What the operator does about it. */
+	remedy: z.string()
+});
 var ServerUpdateActionResultSchema = z.object({
 	accepted: z.boolean(),
 	targetVersion: z.string().nullable(),
@@ -54162,7 +54269,13 @@ var ServerUpdateActionResultSchema = z.object({
 	* The failure itself, verbatim enough to act on (the npm output for a
 	* staging install). Non-null only for `failed`.
 	*/
-	error: z.string().nullable().optional()
+	error: z.string().nullable().optional(),
+	/**
+	* The addons the target version would refuse to start on this node's live
+	* store (D877), present when the pre-flight refused the update
+	* (`reason: 'addon-would-refuse'`). Optional for version skew.
+	*/
+	blockers: z.array(UpdateBlockerSchema).optional()
 });
 var serverManagementCapability = {
 	name: "server-management",
@@ -54174,9 +54287,16 @@ var serverManagementCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		applyServerUpdate: method(z.object({ 
-		/** Explicit target version; omitted = latest from the registry. */
-version: z.string().optional() }), ServerUpdateActionResultSchema, {
+		applyServerUpdate: method(z.object({
+			/** Explicit target version; omitted = latest from the registry. */
+			version: z.string().optional(),
+			/**
+			* Apply even though the pre-flight (D877) found addons the target would
+			* refuse to start. Off by default: those addons stay down until the
+			* remedy is run, which is the incident this gate exists to prevent.
+			*/
+			acknowledgeRefusals: z.boolean().optional()
+		}), ServerUpdateActionResultSchema, {
 			kind: "mutation",
 			auth: "admin",
 			timeoutMs: 16 * 6e4
@@ -57498,7 +57618,9 @@ var ManifestShapeSchema = z.object({
 var AddonProcessSchema = z.object({
 	pid: z.number().optional(),
 	mode: z.string(),
-	state: z.string()
+	state: z.string(),
+	/** Why the runner is `refused` (an addon's own words), when it is (D877). */
+	reason: z.string().optional()
 });
 /**
 * Per-addon health snapshot from the kernel's AddonHealthMonitor.
@@ -70104,6 +70226,16 @@ var userManagementCapability = {
 			access: "delete"
 		}),
 		getTotpStatus: method(z.object({ userId: z.string() }), TotpStatusSchema, { auth: "admin" }),
+		/**
+		* D878: move every TOTP seed stored in plaintext into the keychain (owner
+		* `system`), leaving a marker in the row. Dry run unless `apply`;
+		* idempotent; counts only.
+		*/
+		migrateRawSecrets: method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
+		}),
 		verifyTotp: method(z.object({
 			userId: z.string(),
 			code: z.string()
@@ -76483,6 +76615,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"llm.migrateRawSecrets": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -81025,6 +81163,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.migrateRawSecrets": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.oauthExchangeCode": {
 		capName: "user-management",
 		capScope: "system",
@@ -86126,4 +86270,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { StorageCleanupJobSchema as $, splitTranslationRef as $n, formatSecretScope as $r, gbToBytes as $t, DeclaredDevices as A, pickAppLinkHub as An, errMsg as Ar, databaseSnapshotCapability as At, METHOD_ACCESS_MAP as B, resolveCoreBlockFiles as Bn, WELL_KNOWN_TAB_MAP as Br, deviceStatusCapability as Bt, DAY_NAMES as C, modeMayWrite as Cn, compositionSourceKey as Cr, coreBlockAddonId as Ct, DEVICE_SAN_CREDENTIAL_PREFIX as D, objectInputDeclaresAddonId as Dn, DeviceFeature as Dr, coreBlocksCapability as Dt, DEVICE_NONCE_TTL_MS as E, normalizeUnit as En, toExpressionValue as Er, coreBlockSourceKind as Et, HUB_MDNS_SERVICE_TYPE as F, reducePoints as Fn, REDACTED_SECRET as Fr, describeComposableCaps as Ft, RecordingStatusSchema as G, runtimeStatePolicyFor as Gn, collectSecretConfigKeys as Gr, evictionPolicyOfLocation as Gt, MOTION_CLOSE_AFTER_MS as H, resolveLocationMode as Hn, asNumber as Hr, enumerateItemArrayFields as Ht, HUB_MDNS_TXT_KEYS as I, replacedFieldKeys as In, RUNTIME_DEFAULTS as Ir, deviceCredentialsCapability as It, STORAGE_ADMIN_SCOPED_BASES as J, scoreRuntimes as Jn, customAction as Jr, extractNestedAddonId as Jt, STORAGE_ACCESS_FALLBACK as K, scopesAllowAddon as Kn, collectZodSecretPaths as Kr, expandContainer as Kt, KEYCHAIN_RESET_TRIGGER_ACTOR as L, resolveAppConnections as Ln, ReadinessRegistry as Lr, deviceExtensionCapability as Lt, FIRST_LEVEL_MACRO_CLASSES as M, platformProbeCapability as Mn, DATAPLANE_SECRET_HEADER as Mr, decodeVectorBase64 as Mt, FieldClaimModeSchema as N, procedureAuthKey as Nn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Nr, defineExtensionSlotProvider as Nt, DEVICE_SAN_USER_PREFIX as O, objectInputDeclaresRequiredDeviceId as On, DeviceRole as Or, createDeviceExtensionProvider as Ot, FieldClaimSchema as P, ptzAutotrackCapability as Pn, DEVICE_STATUS_METHOD as Pr, deriveBatteryPresence as Pt, SsoBridgeClaimsSchema as Q, snapshotCapability as Qn, expandCapMethods as Qr, formatMinutes as Qt, LOG_LEVEL_RANK as R, resolveBucketMs as Rn, ReadinessTimeoutError as Rr, deviceManagerCapability as Rt, DATA_STORE_DATABASES as S, EventCategory as Si, metricsProviderCapability as Sn, compositionSliceKey as Sr, compositionSourceRefs as St, DEVICE_ENROLLMENT_TTL_MS as T, normalizeCoreBlockWrite as Tn, disarmRoseMemory as Tr, coreBlockIdFromAddonId as Tt, NetworkTunnelStartedDataSchema as U, resolveMethodAuth as Un, asString$1 as Ur, enumerateSchemaFields as Ut, MINUTES_PER_DAY as V, resolveHubAddressRoles as Vn, asJsonObject as Vr, enumerateInferenceDevices as Vt, RECORDING_SOURCE_CAMSTACK_ADDON as W, resolveNotificationTapAddress as Wn, buildSecretRef as Wr, evaluateCompositionField as Wt, ScopedTokenSchema as X, shortHostname as Xn, emitDownForOwnedCaps as Xr, foldSnapshotByFunction as Xt, STREAM_PROFILE_META as Y, settingsStoreCapability as Yn, defineCustomActions as Yr, filesystemBrowseCapability as Yt, ServerNameSchema as Z, siteZoneKey as Zn, emitReadiness as Zr, formatDeviceRevoker as Zt, CatalogFileSchema as _, sleep as _i, logLevelAtMost as _n, cloneStatefulExpressionMemory as _r, cameraGridLayoutCapability as _t, ApiKeyRecordSchema as a, isSecretMarker as ai, isLocationEnabled as an, streamCatalogCapability as ar, addonSettingsCapability as at, DATABASE_SNAPSHOT_SUFFIX as b, transformSecretWrite as bi, mayWriteToLocation as bn, compositionFeatureEnabled as br, composerCapability as bt, CAMERA_SWITCH_ORDER as c, normalizeSecretOwner as ci, kebabToCamel as cn, userManagementCapability as cr, authProviderCapability as ct, CATALOG_LANGS as d, parseSecretRef as di, legacyAutoLinkIds as dn, vectorDimFromBase64 as dr, batteryCapability as dt, hydrateSchema as ei, interpolate as en, storageAdminCapability as er, StorageLocationModeSchema as et, COMPOSED_ITEM_FIXED_FIELDS as f, readinessKey as fi, legacyModeOf as fn, vectorIndexDimConflictError as fr, buildCapabilityLookup as ft, CalendarPreferencesSchema as g, secretTreeFromPaths as gi, logDestinationCapability as gn, buildFfmpegArgs as gr, calendarsCapability as gt, CORE_BLOCK_ADDON_PREFIX as h, scopeKey as hi, locationIconKey as hn, COMPOSER_ADDON_ID as hr, buildStreamParamsConfigSchema as ht, AlertSchema as i, isSecretClear as ii, isDefaultAppConnectionEndpoint as in, storageProviderCapability as ir, addonPagesCapability as it, DeviceStatusSchema as j, planComposition as jn, BaseAddon as jr, declarationOwnerNodeId as jt, DEVICE_TOMBSTONE_RETENTION_MS as k, parseStreamParamsFormPatch as kn, DeviceType as kr, dataStoreProviderCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, parseJsonObject as li, keychainAdminCapability as ln, validateComposition as lr, backupCapability as lt, CORE_BLOCKS_ADDON_ID as m, resolveSecretMarkers as mi, localNetworkCapability as mn, withLocationMode as mr, buildDeviceSignatureMessage as mt, AGENT_MDNS_TXT_KEYS as n, isEvent as ni, isArrayOutputSchema as nn, storageMigrationCapability as nr, StorageMigrationJobSchema as nt, BaseDevice as o, isSecretMarkerLike as oi, isObjectInput as on, streamQualityLabel as or, addonWidgetsCapability as ot, COMPOSER_RUNNER_ID as p, resolveCapMount as pi, lifecycleJobSchema as pn, vectorStoreCapability as pr, buildDeviceEnrollmentLink as pt, STORAGE_ADMIN_MOVED_COLLECTIONS as q, scopesAllowDeviceCap as qn, createEvent as qr, expressionContainsBuiltinCall as qt, ALL_CAPABILITY_DEFINITIONS as r, isKeychainStoredField as ri, isCollectionArrayMethod as rn, storageOccupancyCapability as rr, UserRecordSchema as rt, BatteryStatusSchema as s, nodePin as si, isVoidInput as sn, supportedRuntimes as sr, alertsCapability as st, AGENT_MDNS_SERVICE_TYPE as t, isDeviceConfigCap as ti, isAppLinkBase as tn, storageCapability as tr, StorageLocationTypeSchema as tt, CAP_NAMES_WITH_STATUS as u, parseJsonUnknown as ui, keychainCapability as un, validateCustomAddress as ur, bareAddonId as ut, CoreBlockSchema as v, toNodeId as vi, looseSchema as vn, composedDeviceRef as vr, canonicalIconKey as vt, DERIVED_CAMERA_SILENCED_CAP_NAMES as w, motionCapability as wn, createStatefulExpressionMemory as wr, coreBlockComposition as wt, DATABASE_SNAPSHOT_TIMEOUT_MS as x, userError as xi, memoizePinnedFfmpeg as xn, compositionItemFieldPath as xr, compositionFieldKey as xt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as y, toSecretFieldView as yi, mayReadLocation as yn, composedDeviceStableId as yr, checkRoleAddress as yt, LegacyStorageLocationDefaultSchema as z, resolveCoreBlockEntry as zn, SECRET_CLEAR as zr, deviceStateCapability as zt };
+export { StorageCleanupJobSchema as $, splitTranslationRef as $n, formatSecretScope as $r, gbToBytes as $t, DeclaredDevices as A, pickAppLinkHub as An, errMsg as Ar, databaseSnapshotCapability as At, METHOD_ACCESS_MAP as B, resolveCoreBlockFiles as Bn, WELL_KNOWN_TAB_MAP as Br, deviceStatusCapability as Bt, DAY_NAMES as C, EventCategory as Ci, modeMayWrite as Cn, compositionSourceKey as Cr, coreBlockAddonId as Ct, DEVICE_SAN_CREDENTIAL_PREFIX as D, objectInputDeclaresAddonId as Dn, DeviceFeature as Dr, coreBlocksCapability as Dt, DEVICE_NONCE_TTL_MS as E, normalizeUnit as En, toExpressionValue as Er, coreBlockSourceKind as Et, HUB_MDNS_SERVICE_TYPE as F, reducePoints as Fn, REDACTED_SECRET as Fr, describeComposableCaps as Ft, RecordingStatusSchema as G, runtimeStatePolicyFor as Gn, collectSecretConfigKeys as Gr, evictionPolicyOfLocation as Gt, MOTION_CLOSE_AFTER_MS as H, resolveLocationMode as Hn, asNumber as Hr, enumerateItemArrayFields as Ht, HUB_MDNS_TXT_KEYS as I, replacedFieldKeys as In, RUNTIME_DEFAULTS as Ir, deviceCredentialsCapability as It, STORAGE_ADMIN_SCOPED_BASES as J, scoreRuntimes as Jn, customAction as Jr, extractNestedAddonId as Jt, STORAGE_ACCESS_FALLBACK as K, scopesAllowAddon as Kn, collectZodSecretPaths as Kr, expandContainer as Kt, KEYCHAIN_RESET_TRIGGER_ACTOR as L, resolveAppConnections as Ln, ReadinessRegistry as Lr, deviceExtensionCapability as Lt, FIRST_LEVEL_MACRO_CLASSES as M, platformProbeCapability as Mn, DATAPLANE_SECRET_HEADER as Mr, decodeVectorBase64 as Mt, FieldClaimModeSchema as N, procedureAuthKey as Nn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Nr, defineExtensionSlotProvider as Nt, DEVICE_SAN_USER_PREFIX as O, objectInputDeclaresRequiredDeviceId as On, DeviceRole as Or, createDeviceExtensionProvider as Ot, FieldClaimSchema as P, ptzAutotrackCapability as Pn, DEVICE_STATUS_METHOD as Pr, deriveBatteryPresence as Pt, SsoBridgeClaimsSchema as Q, snapshotCapability as Qn, expandCapMethods as Qr, formatMinutes as Qt, LOG_LEVEL_RANK as R, resolveBucketMs as Rn, ReadinessTimeoutError as Rr, deviceManagerCapability as Rt, DATA_STORE_DATABASES as S, userError as Si, metricsProviderCapability as Sn, compositionSliceKey as Sr, compositionSourceRefs as St, DEVICE_ENROLLMENT_TTL_MS as T, normalizeCoreBlockWrite as Tn, disarmRoseMemory as Tr, coreBlockIdFromAddonId as Tt, NetworkTunnelStartedDataSchema as U, resolveMethodAuth as Un, asString$1 as Ur, enumerateSchemaFields as Ut, MINUTES_PER_DAY as V, resolveHubAddressRoles as Vn, asJsonObject as Vr, enumerateInferenceDevices as Vt, RECORDING_SOURCE_CAMSTACK_ADDON as W, resolveNotificationTapAddress as Wn, buildSecretRef as Wr, evaluateCompositionField as Wt, ScopedTokenSchema as X, shortHostname as Xn, emitDownForOwnedCaps as Xr, foldSnapshotByFunction as Xt, STREAM_PROFILE_META as Y, settingsStoreCapability as Yn, defineCustomActions as Yr, filesystemBrowseCapability as Yt, ServerNameSchema as Z, siteZoneKey as Zn, emitReadiness as Zr, formatDeviceRevoker as Zt, CatalogFileSchema as _, secretTreeFromPaths as _i, logLevelAtMost as _n, cloneStatefulExpressionMemory as _r, cameraGridLayoutCapability as _t, ApiKeyRecordSchema as a, isSecretMarker as ai, isLocationEnabled as an, streamCatalogCapability as ar, addonSettingsCapability as at, DATABASE_SNAPSHOT_SUFFIX as b, toSecretFieldView as bi, mayWriteToLocation as bn, compositionFeatureEnabled as br, composerCapability as bt, CAMERA_SWITCH_ORDER as c, nodePin as ci, kebabToCamel as cn, userManagementCapability as cr, authProviderCapability as ct, CATALOG_LANGS as d, parseJsonUnknown as di, legacyAutoLinkIds as dn, vectorDimFromBase64 as dr, batteryCapability as dt, hydrateSchema as ei, interpolate as en, storageAdminCapability as er, StorageLocationModeSchema as et, COMPOSED_ITEM_FIXED_FIELDS as f, parseSecretRef as fi, legacyModeOf as fn, vectorIndexDimConflictError as fr, buildCapabilityLookup as ft, CalendarPreferencesSchema as g, scopeKey as gi, logDestinationCapability as gn, buildFfmpegArgs as gr, calendarsCapability as gt, CORE_BLOCK_ADDON_PREFIX as h, resolveSecretMarkers as hi, locationIconKey as hn, COMPOSER_ADDON_ID as hr, buildStreamParamsConfigSchema as ht, AlertSchema as i, isSecretClear as ii, isDefaultAppConnectionEndpoint as in, storageProviderCapability as ir, addonPagesCapability as it, DeviceStatusSchema as j, planComposition as jn, BaseAddon as jr, declarationOwnerNodeId as jt, DEVICE_TOMBSTONE_RETENTION_MS as k, parseStreamParamsFormPatch as kn, DeviceType as kr, dataStoreProviderCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, normalizeSecretOwner as li, keychainAdminCapability as ln, validateComposition as lr, backupCapability as lt, CORE_BLOCKS_ADDON_ID as m, resolveCapMount as mi, localNetworkCapability as mn, withLocationMode as mr, buildDeviceSignatureMessage as mt, AGENT_MDNS_TXT_KEYS as n, isEvent as ni, isArrayOutputSchema as nn, storageMigrationCapability as nr, StorageMigrationJobSchema as nt, BaseDevice as o, isSecretMarkerLike as oi, isObjectInput as on, streamQualityLabel as or, addonWidgetsCapability as ot, COMPOSER_RUNNER_ID as p, readinessKey as pi, lifecycleJobSchema as pn, vectorStoreCapability as pr, buildDeviceEnrollmentLink as pt, STORAGE_ADMIN_MOVED_COLLECTIONS as q, scopesAllowDeviceCap as qn, createEvent as qr, expressionContainsBuiltinCall as qt, ALL_CAPABILITY_DEFINITIONS as r, isKeychainStoredField as ri, isCollectionArrayMethod as rn, storageOccupancyCapability as rr, UserRecordSchema as rt, BatteryStatusSchema as s, makeSecretMarker as si, isVoidInput as sn, supportedRuntimes as sr, alertsCapability as st, AGENT_MDNS_SERVICE_TYPE as t, isDeviceConfigCap as ti, isAppLinkBase as tn, storageCapability as tr, StorageLocationTypeSchema as tt, CAP_NAMES_WITH_STATUS as u, parseJsonObject as ui, keychainCapability as un, validateCustomAddress as ur, bareAddonId as ut, CoreBlockSchema as v, sleep as vi, looseSchema as vn, composedDeviceRef as vr, canonicalIconKey as vt, DERIVED_CAMERA_SILENCED_CAP_NAMES as w, motionCapability as wn, createStatefulExpressionMemory as wr, coreBlockComposition as wt, DATABASE_SNAPSHOT_TIMEOUT_MS as x, transformSecretWrite as xi, memoizePinnedFfmpeg as xn, compositionItemFieldPath as xr, compositionFieldKey as xt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as y, toNodeId as yi, mayReadLocation as yn, composedDeviceStableId as yr, checkRoleAddress as yt, LegacyStorageLocationDefaultSchema as z, resolveCoreBlockEntry as zn, SECRET_CLEAR as zr, deviceStateCapability as zt };

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-CgZTNWAz.js");
+const require_wal_maintenance = require("./wal-maintenance-C-bmkDhm.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as callData, S as callControl, T as controlTargetOf, a as WalMaintenance, b as trustInput, c as SqliteSettingsBackend, g as collectTransferables, m as serializeError, o as createVectorIndex, s as vectorProviderOf, v as isFileHostRequest, w as callVector, y as isFileHostWorkerData } from "./wal-maintenance-B57SAp4a.mjs";
+import { C as callData, S as callControl, T as controlTargetOf, a as WalMaintenance, b as trustInput, c as SqliteSettingsBackend, g as collectTransferables, m as serializeError, o as createVectorIndex, s as vectorProviderOf, v as isFileHostRequest, w as callVector, y as isFileHostWorkerData } from "./wal-maintenance-DE8QrreK.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/{hub-mdns-ciao-Cnd0bTB9.mjs → hub-mdns-ciao-BS2akjWx.mjs}

@@ -1,5 +1,5 @@
 import { o as __toESM } from "./chunk-CNf5ZN-e.mjs";
-import { xi as userError } from "./dist-BWvkuc31.mjs";
+import { Si as userError } from "./dist-DsrQYcLm.mjs";
 import { f as X509Certificate$1 } from "./x509.es-DK__ETIe.mjs";
 import { A as isConstrainedCa, E as reasonRequiresNewCa, M as permitsIdentity, P as readNameConstraints, T as evaluateExistingCert, _ as issueLeaf, g as generateCa, v as loadCa, y as collectCertIdentity } from "./agent-https-U0d4uvn2.mjs";
 import { X509Certificate, createPrivateKey } from "node:crypto";

package/dist/{hub-mdns-ciao-DOBTq8qr.js → hub-mdns-ciao-Da-0NEyr.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BiTCcaf-.js");
+const require_dist = require("./dist-CyIHDLCg.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
 const require_agent_https = require("./agent-https-DlpTMDqA.js");
 let node_crypto = require("node:crypto");

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BiTCcaf-.js");
-const require_device_ca = require("./device-ca-196DAEZT.js");
+const require_dist = require("./dist-CyIHDLCg.js");
+const require_device_ca = require("./device-ca-tKY_ZS9H.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -25,21 +25,21 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-CgZTNWAz.js");
+const require_wal_maintenance = require("./wal-maintenance-C-bmkDhm.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
 const require_agent_https = require("./agent-https-DlpTMDqA.js");
-const require_constants = require("./constants-UojhAJcm.js");
+const require_constants = require("./constants-b7kpjuO4.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-BKmoaqG0.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-DOBTq8qr.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-Da-0NEyr.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-CfSSjKnA.js");
+const require_restore_archive = require("./restore-archive-Cdf09dHm.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -23020,6 +23020,50 @@ function createRunnerAddonSettings(client, addonId, before = async () => {}) {
 	};
 }
 //#endregion
+//#region src/kernel/addon-refused-error.ts
+/**
+* A deterministic Init refusal (D877): an addon that says, in a typed way,
+* "I will not start, and here is why" - as opposed to a crash.
+*
+* The difference matters to the supervisor. A crash may be transient (a camera
+* dropping mid-handshake) and is bounded by the D6 circuit-breaker; a refusal
+* repeats identically until somebody changes the world (runs a migration,
+* fixes a setting), so counting it toward the breaker only turns "waiting for
+* the operator" into a terminal `failed` with a stack trace nobody needed.
+* On 2026-10-17 twenty-eight addons refused on an unmigrated store, exited five
+* times in ten seconds and were marked `failed` as if they had crashed.
+*
+* The runner reports a refusal to its parent (see `runner-refusal.ts`); the
+* process service parks the runner in `refused` with the reason and retries it
+* only when an operator acts.
+*/
+var AddonRefusedError = class extends Error {
+	/** Stable, greppable cause, e.g. `unmigrated-settings`. */
+	code;
+	/** What the operator does about it. */
+	remedy;
+	constructor(code, message, remedy, options) {
+		super(message, options);
+		this.name = "AddonRefusedError";
+		this.code = code;
+		this.remedy = remedy;
+	}
+};
+/**
+* The refusal in `err`'s cause chain, if any. An addon that wraps the error it
+* got from the kernel (`new Error('init failed', { cause })`) is still refusing.
+*/
+function findAddonRefusal(err) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = err;
+	while (current !== null && current !== void 0 && !seen.has(current)) {
+		if (current instanceof AddonRefusedError) return current;
+		seen.add(current);
+		current = current instanceof Error ? current.cause : void 0;
+	}
+	return null;
+}
+//#endregion
 //#region src/kernel/legacy-blob-guard.ts
 /** Root keys retired long before D870: they never count as "settings still to migrate". */
 var OWN_RETIRED_ROOT_KEYS = new Set([
@@ -23035,9 +23079,13 @@ function isRetiredRootKey(addonId, key) {
 	if (OWN_RETIRED_ROOT_KEYS.has(key)) return true;
 	return require_retired_settings_keys.RETIRED_SETTINGS_KEYS.some((spec) => spec.namespace === addonId && (spec.keys.includes(key) || spec.perNodeKeys.some((k) => key === k || key.startsWith(`${k}@`))));
 }
-var UnmigratedSettingsError = class extends Error {
+/** Stable `code` of the D870 refusal. */
+var UNMIGRATED_SETTINGS_CODE = "unmigrated-settings";
+/** The remedy the refusal (and the update pre-flight) names. */
+var UNMIGRATED_SETTINGS_REMEDY = "Run scripts/hub/migrate-device-store.ts --copy --apply (D870), then restart the addon.";
+var UnmigratedSettingsError = class extends AddonRefusedError {
 	constructor(addonId, what) {
-		super(`addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`);
+		super(UNMIGRATED_SETTINGS_CODE, `addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`, UNMIGRATED_SETTINGS_REMEDY);
 		this.name = "UnmigratedSettingsError";
 	}
 };
@@ -25010,6 +25058,27 @@ var AddonHealthMonitor = class {
 	}
 };
 //#endregion
+//#region src/kernel/moleculer/runner-refusal.ts
+var REFUSED_PREFIX = "REFUSED:";
+function isReport(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const rec = value;
+	return typeof rec["addonId"] === "string" && typeof rec["code"] === "string" && typeof rec["reason"] === "string" && typeof rec["remedy"] === "string";
+}
+/** The refusals announced in a chunk of runner stdout; lines that are not one are ignored. */
+function parseRunnerRefusals(nodeId, chunk) {
+	const prefix = `${REFUSED_PREFIX}${nodeId}:`;
+	const out = [];
+	for (const line of chunk.split("\n")) {
+		if (!line.startsWith(prefix)) continue;
+		try {
+			const parsed = JSON.parse(line.slice(prefix.length));
+			if (isReport(parsed)) out.push(parsed);
+		} catch {}
+	}
+	return out;
+}
+//#endregion
 //#region src/kernel/moleculer/crash-supervisor.ts
 /** Per-runner crash circuit-breaker. Replaces the old infinite-respawn loop. */
 var CrashSupervisor = class {
@@ -25648,6 +25717,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 	const groupOps = deps?.processGroups ?? defaultProcessGroupOps;
 	const runnersOwnGroups = runnerOwnsProcessGroup(deps?.platform ?? process.platform);
 	const processes = /* @__PURE__ */ new Map();
+	const backingOff = /* @__PURE__ */ new Map();
 	const pendingGroupReaps = /* @__PURE__ */ new Map();
 	const runnerLocks = /* @__PURE__ */ new Map();
 	function withRunnerLock(runnerId, fn) {
@@ -25688,6 +25758,19 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 		}, data));
 	}
 	/**
+	* Every transition a supervisor or a boot check can settle on (D877):
+	* `running` (READY), `crashed`, `failed`, `refused`. In-process telemetry - the
+	* boot check re-evaluates on it and the alert centre closes a recovered runner.
+	*/
+	function emitStateChange(entry) {
+		emitRunnerEvent(require_dist.EventCategory.ProcessStateChanged, entry.name, {
+			runnerId: entry.name,
+			nodeId: parentNodeId,
+			addonIds: entry.runnerAddons.map((addon) => addon.addonId),
+			state: entry.state
+		});
+	}
+	/**
 	* One line per reap that found something, or that failed. An empty group is the
 	* normal case after a clean stop and stays quiet at debug. The kernel cannot say
 	* which device a child served — the runner id is the finest attribution it has.
@@ -25752,6 +25835,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 	*/
 	function spawnRunner(runnerId, addons, env) {
 		const nodeId = buildNodeId(runnerId);
+		backingOff.delete(runnerId);
 		const runnerPath = node_path.resolve(__dirname, "addon-runner.js");
 		const heavy = isHeavyRunner(addons);
 		const rssBudgetMb = runnerRssBudgetMb(addons);
@@ -25792,6 +25876,8 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			startedAt: Date.now(),
 			restartCount: 0,
 			state: "starting",
+			refusal: null,
+			announcedRefusal: null,
 			child,
 			ownsGroup,
 			groupReap: null
@@ -25801,7 +25887,13 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			kill: groupOps.kill
 		});
 		child.stdout?.on("data", (data) => {
-			if (data.toString().includes(`READY:${nodeId}`) && entry.state === "starting") entry.state = "running";
+			const text = data.toString();
+			const refusals = parseRunnerRefusals(nodeId, text);
+			if (refusals[0] !== void 0) entry.announcedRefusal = refusals[0];
+			if (text.includes(`READY:${nodeId}`) && entry.state === "starting") {
+				entry.state = "running";
+				emitStateChange(entry);
+			}
 		});
 		child.stderr?.on("data", (data) => {
 			process.stderr.write(`[${runnerId}] ${data.toString()}`);
@@ -25810,7 +25902,33 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			console.error(`[process-service EXIT] runner=${runnerId} code=${String(code)} signal=${String(signal)} state=${entry.state}`);
 			const groupReap = reapRunnerGroup(entry);
 			if (entry.state === "stopped") return;
+			const announced = entry.announcedRefusal;
+			entry.announcedRefusal = null;
+			if (code === 78) {
+				const refusal = announced ?? {
+					addonId: entry.runnerAddons[0]?.addonId ?? runnerId,
+					code: "unknown",
+					reason: "the runner exited with the refusal code without saying why",
+					remedy: "Read the runner log, fix the cause, then restart the addon."
+				};
+				entry.refusal = refusal;
+				entry.state = "refused";
+				capturedBroker?.logger.error(`[${runnerId}] Addon refused to start (${refusal.code}): ${refusal.reason} Not respawning; ${refusal.remedy}`, { tags: { runnerId } });
+				processes.set(runnerId, entry);
+				if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
+				emitRunnerEvent(require_dist.EventCategory.AddonRunnerRefused, runnerId, {
+					runnerId,
+					nodeId: parentNodeId,
+					addonIds: entry.runnerAddons.map((addon) => addon.addonId),
+					code: refusal.code,
+					reason: refusal.reason,
+					remedy: refusal.remedy
+				});
+				emitStateChange(entry);
+				return;
+			}
 			entry.state = "crashed";
+			emitStateChange(entry);
 			capturedBroker?.logger.error(`[${runnerId}] Process exited (code=${code}, signal=${signal})`);
 			const decision = crashSupervisor.recordCrash(runnerId);
 			emitRunnerEvent(require_dist.EventCategory.ProcessCrashed, runnerId, {
@@ -25820,6 +25938,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			});
 			if (decision.action === "failed") {
 				entry.state = "failed";
+				emitStateChange(entry);
 				capturedBroker?.logger.error(`[${runnerId}] Crash circuit-breaker tripped — ${decision.crashesInWindow} crashes in ${CRASH_WINDOW_MS}ms. Not respawning.`);
 				processes.set(runnerId, entry);
 				if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
@@ -25844,10 +25963,12 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 				delayMs: decision.backoffMs
 			});
 			processes.delete(runnerId);
+			backingOff.set(runnerId, entry);
 			if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
 			setTimeout(() => {
 				withRunnerLock(runnerId, async () => {
 					await groupReap;
+					backingOff.delete(runnerId);
 					if (processes.has(runnerId)) return;
 					const restarted = spawnRunner(runnerId, addons, env);
 					restarted.restartCount = entry.restartCount + 1;
@@ -25887,7 +26008,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						reason: "not found"
 					};
 					const deadNodeId = target.nodeId;
-					const alreadyDead = target.state === "failed" || target.child.exitCode !== null || target.child.signalCode !== null;
+					const alreadyDead = target.state === "failed" || target.state === "refused" || target.child.exitCode !== null || target.child.signalCode !== null;
 					target.state = "stopped";
 					if (!alreadyDead) {
 						target.child.kill("SIGTERM");
@@ -25924,7 +26045,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 					const { runnerAddons } = target;
 					const deadNodeId = target.nodeId;
 					const prevRestartCount = target.restartCount;
-					const alreadyDead = target.state === "failed" || target.child.exitCode !== null || target.child.signalCode !== null;
+					const alreadyDead = target.state === "failed" || target.state === "refused" || target.child.exitCode !== null || target.child.signalCode !== null;
 					target.state = "stopped";
 					if (!alreadyDead) {
 						target.child.kill("SIGTERM");
@@ -25953,7 +26074,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 				});
 			} },
 			list: { async handler() {
-				const entries = [...processes.values()];
+				const entries = [...processes.values(), ...backingOff.values()];
 				const stats = await getPidStats$1(entries.filter((p) => p.pid > 0).map((p) => p.pid));
 				return entries.map((p) => {
 					const s = stats.get(p.pid);
@@ -25969,6 +26090,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						startedAt: p.startedAt,
 						restartCount: p.restartCount,
 						state: p.state,
+						...p.refusal !== null ? { refusal: p.refusal } : {},
 						cpuPercent: s?.cpu ?? 0,
 						memoryRss: s?.memoryRss ?? 0,
 						uptimeSeconds: Math.floor((Date.now() - p.startedAt) / 1e3)
@@ -25985,7 +26107,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						if (!entry) return;
 						const { runnerAddons } = entry;
 						const prevRestartCount = entry.restartCount;
-						if (!(entry.state === "failed" || entry.child.exitCode !== null || entry.child.signalCode !== null)) {
+						if (!(entry.state === "failed" || entry.state === "refused" || entry.child.exitCode !== null || entry.child.signalCode !== null)) {
 							entry.state = "stopped";
 							entry.child.kill("SIGTERM");
 							await new Promise((resolve) => {
@@ -26040,6 +26162,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						startedAt: p.startedAt,
 						restartCount: p.restartCount,
 						state: p.state,
+						...p.refusal !== null ? { refusal: p.refusal } : {},
 						cpuPercent: s?.cpu ?? 0,
 						memoryRss: s?.memoryRss ?? 0,
 						uptimeSeconds: Math.floor((Date.now() - p.startedAt) / 1e3)
@@ -27176,6 +27299,7 @@ exports.AddonHealthMonitor = AddonHealthMonitor;
 exports.AddonInstaller = AddonInstaller;
 exports.AddonLoader = AddonLoader;
 exports.AddonManifest = AddonManifest;
+exports.AddonRefusedError = AddonRefusedError;
 exports.AddonRouteRegistry = AddonRouteRegistry;
 exports.AdminTokenManager = require_builtins_local_auth_local_auth_addon.AdminTokenManager;
 exports.AgentHttpsInstallError = require_agent_https.AgentHttpsInstallError;
@@ -27366,11 +27490,14 @@ exports.TlsTcpTransporter = require_builtins_system_config_system_config_addon.T
 exports.ToastService = ToastService;
 exports.UDS_NO_ROUTE_PREFIX = UDS_NO_ROUTE_PREFIX;
 exports.UNCLAIMED = UNCLAIMED;
+exports.UNMIGRATED_SETTINGS_CODE = UNMIGRATED_SETTINGS_CODE;
+exports.UNMIGRATED_SETTINGS_REMEDY = UNMIGRATED_SETTINGS_REMEDY;
 exports.UPLOADED_CA_FILE = require_hub_mdns_ciao.UPLOADED_CA_FILE;
 exports.USER_MANAGEMENT_INTERNAL = require_builtins_local_auth_local_auth_addon.USER_MANAGEMENT_INTERNAL;
 exports.UdsLocalTransportClient = UdsLocalTransportClient;
 exports.UdsLocalTransportServer = UdsLocalTransportServer;
 exports.UnlockTicketJtiStore = require_builtins_system_config_system_config_addon.UnlockTicketJtiStore;
+exports.UnmigratedSettingsError = UnmigratedSettingsError;
 exports.UserManager = require_builtins_local_auth_local_auth_addon.UserManager;
 exports.WinstonDestination = require_builtins_winston_logging_index.WinstonDestination$1;
 exports.WinstonLoggingAddon = require_builtins_winston_logging_index.WinstonLoggingAddon$1;
@@ -27387,6 +27514,7 @@ exports.allFamiliesListenHost = require_hub_mdns_ciao.allFamiliesListenHost;
 exports.answerClaimedGetStatus = answerClaimedGetStatus;
 exports.applyCertificateToListener = require_hub_mdns_ciao.applyCertificateToListener;
 exports.applyLanHttp = require_hub_mdns_ciao.applyLanHttp;
+exports.assertLegacyBlobsMigrated = assertLegacyBlobsMigrated;
 exports.attachUserManagementInternal = require_builtins_local_auth_local_auth_addon.attachUserManagementInternal;
 exports.attributeStall = require_custom_action_registry.attributeStall;
 exports.bindPendingLanHttp = require_hub_mdns_ciao.bindPendingLanHttp;
@@ -27544,6 +27672,7 @@ exports.evaluateExistingCert = require_agent_https.evaluateExistingCert;
 exports.expandCapMethods = require_dist.expandCapMethods;
 exports.exportMeshPrivateKeyPem = require_builtins_system_config_system_config_addon.exportMeshPrivateKeyPem;
 exports.fetchJson = require_custom_action_registry.fetchJson;
+exports.findAddonRefusal = findAddonRefusal;
 Object.defineProperty(exports, "findInPath", {
 	enumerable: true,
 	get: function() {