@camstack/system 1.2.441 → 1.2.443

package/dist/{dist-BiTCcaf-.js → dist-D9qT3jHr.js}

@@ -1,6 +1,6 @@
 let zod = require("zod");
 require("node:crypto");
-//#region ../types/dist/event-category-C4hVnRo8.mjs
+//#region ../types/dist/event-category-BvOFi6PY.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -64,6 +64,24 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* consumes this category and maps it to the `addon-crash-loop` kind.
 	*/
 	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
+	/**
+	* A runner whose addon refused to start with a typed reason (D877) - parked
+	* in `refused`, never counted by the crash breaker, retried on operator
+	* action. One event per refusal.
+	*/
+	EventCategory["AddonRunnerRefused"] = "addon.runner-refused";
+	/**
+	* A runner settled on a state (D877): `running` (READY), `crashed`, `failed` or
+	* `refused`. In-process telemetry for the boot check (re-evaluate while any
+	* runner is still pending) and the alert centre (close a recovered runner).
+	*/
+	EventCategory["ProcessStateChanged"] = "process.state-changed";
+	/**
+	* The node's one-shot runner boot check (D877): planned runners against the
+	* process service, `degraded` when any is failed, refused or missing. The
+	* alert centre turns it into one alert and a direct critical push.
+	*/
+	EventCategory["SystemRunnerCheck"] = "system.runner-check";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -718,7 +736,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-bwsTj221.mjs
+//#region ../types/dist/sleep-D-Q2_Mcd.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -15458,6 +15476,41 @@ function describeComposableCaps(defs, deviceType) {
 	}).toSorted((a, b) => a.cap.localeCompare(b.cap));
 }
 /**
+* The report of a one-shot "move this owner's plaintext secrets into the
+* keychain" run (D878). COUNTS only - never a value, never a ref.
+*
+* The owner runs it on its own rows, through its own write path; an operator
+* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
+* Dry run (`apply: false`) reports what WOULD move and changes nothing.
+*/
+var RawSecretMigrationInputSchema = zod.z.object({ 
+/** `false` (the default of the script) = report only. */
+apply: zod.z.boolean() });
+var RawSecretMigrationReportSchema = zod.z.object({
+	apply: zod.z.boolean(),
+	/** Rows that can carry a secret (a profile, an enrolment). */
+	rows: zod.z.number().int(),
+	/** Rows whose secret was plaintext when the run started. */
+	raw: zod.z.number().int(),
+	/** Rows that already held a keychain marker when the run started. */
+	markers: zod.z.number().int(),
+	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
+	migrated: zod.z.number().int(),
+	/** Plaintext rows left in place because the move or its read-back failed. */
+	failed: zod.z.number().int(),
+	/** After the run: rows still holding plaintext. */
+	remainingRaw: zod.z.number().int(),
+	/** After the run: markers the keychain could not resolve right now. */
+	unresolvedMarkers: zod.z.number().int(),
+	/**
+	* A second, redundant copy of the secrets' rows that the run found (and, on
+	* `apply`, deleted after verifying the first). Owners with a single copy omit it.
+	*/
+	redundantCopies: zod.z.number().int().optional(),
+	/** True when nothing is raw and every marker resolves. */
+	verified: zod.z.boolean()
+});
+/**
 * core-blocks — user-authored TypeScript, stored in the kernel and executed in
 * its own process.
 *
@@ -15821,14 +15874,16 @@ var coreBlocksCapability = {
 		/**
 		* Hydrated settings form for one block, or null until a `settingsSchema`
 		* is known (extracted from the compiled entry's named export, or set on
-		* the block). Values live in the `core-blocks:settings` collection.
+		* the block). Values live in the block addon's `addon-settings` rows (D880);
+		* a password field answers as a "set" view, never the value.
 		*/
 		getBlockSettings: method(zod.z.object({ blockId: zod.z.string() }), SettingsSchemaWithValuesSchema.nullable(), { auth: "admin" }),
 		/**
 		* Patch persisted preference values for one block. The schema is not
-		* rewritten here — only values. Scripts read the same blob via
-		* `ctx.settings.readAddonStore()` (mirrored into the block addon's
-		* `addon-settings` namespace on every patch).
+		* rewritten here — only values. Scripts read the same rows via
+		* `ctx.settings.readAddonStore()`. A field the schema declares `password` /
+		* `secret: true` is stored in the keychain (owner = the block's addon id)
+		* and the row holds a marker; a REDACTED or view value keeps the stored one.
 		*/
 		updateBlockSettings: method(zod.z.object({
 			blockId: zod.z.string(),
@@ -15838,6 +15893,16 @@ var coreBlocksCapability = {
 			auth: "admin"
 		}),
 		/**
+		* D880: move every plaintext password a block's `settingsSchema` declares
+		* into the keychain and delete the legacy `core-blocks:settings` copy. Dry
+		* run unless `apply`; idempotent; counts only. A secret is read back from
+		* the keychain before its row is rewritten.
+		*/
+		migrateRawSecrets: method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* The declaration files the editor type-checks against.
 		*
 		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
@@ -41252,6 +41317,16 @@ var llmCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* D878: move every profile's plaintext `apiKey` into the keychain (owner
+		* `ai`), leaving a marker in the row. Dry run unless `apply`; idempotent;
+		* counts only. The plaintext is cleared only after the keychain read-back
+		* matched.
+		*/
+		migrateRawSecrets: method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		deleteProfile: method(ProfileRefInputSchema, zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
@@ -54032,6 +54107,41 @@ var ServerRollbackInfoSchema = zod.z.object({
 	atMs: zod.z.number(),
 	reason: zod.z.string()
 });
+/**
+* The runner boot check (D877): the runners this node PLANNED (hub: one per
+* `resolveRunnerId` over its forked addons; agent: the runners its process
+* service holds, because only the hub plans) against the states the process
+* service reports. Kept in memory, recomputed by the same one-shot check after
+* every boot, served on `getServerPackageStatus`.
+*
+* `failed` is the D6 breaker's terminal state, `refused` a deterministic Init
+* refusal (an addon that said "I will not start, and here is why"), `missing` a
+* planned runner the process service has no entry for.
+*/
+var RunnerRefusalSchema = zod.z.object({
+	runnerId: zod.z.string(),
+	addonIds: zod.z.array(zod.z.string()),
+	reason: zod.z.string()
+});
+var RunnerBootCheckSchema = zod.z.object({
+	checkedAtMs: zod.z.number(),
+	/** Runners planned for this node. */
+	expected: zod.z.number(),
+	/** Planned runners whose process is `running`. */
+	running: zod.z.number(),
+	failed: zod.z.array(zod.z.string()),
+	refused: zod.z.array(RunnerRefusalSchema),
+	missing: zod.z.array(zod.z.string()),
+	/**
+	* Runners still on their way: `starting`, or `crashed` waiting on a backoff
+	* respawn. The check is FINAL only when this is empty; until then nothing is
+	* pushed and the verdict is re-evaluated on the next runner state change.
+	* Optional for version skew (absent = settled).
+	*/
+	pending: zod.z.array(zod.z.string()).optional(),
+	/** True when the plan is the hub's (`missing` is then meaningful); false on an agent. */
+	planKnown: zod.z.boolean()
+});
 var ServerPackageStatusSchema = zod.z.object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: zod.z.string(),
@@ -54094,7 +54204,14 @@ var ServerPackageStatusSchema = zod.z.object({
 	* for version skew: an older provider's payload simply omits it, and an
 	* absent wrapper is unknown — never `native`.
 	*/
-	wrapper: WrapperIdentitySchema.optional()
+	wrapper: WrapperIdentitySchema.optional(),
+	/**
+	* What this node PLANNED to run against what its process service reports
+	* (D877). Absent until the one-shot boot check has run (~60 s after boot) and
+	* on a provider that predates it. Absent is "not checked yet", never "all
+	* well": a consumer that needs the answer treats it as pending.
+	*/
+	runners: RunnerBootCheckSchema.optional()
 });
 var ServerUpdateCheckResultSchema = zod.z.object({
 	packageName: zod.z.string(),
@@ -54145,6 +54262,13 @@ var ServerUpdateOutcomeSchema = zod.z.enum([
 	"refused",
 	"failed"
 ]);
+/** One addon the pre-flight found the target version would refuse (D877). */
+var UpdateBlockerSchema = zod.z.object({
+	addonId: zod.z.string(),
+	reason: zod.z.string(),
+	/** What the operator does about it. */
+	remedy: zod.z.string()
+});
 var ServerUpdateActionResultSchema = zod.z.object({
 	accepted: zod.z.boolean(),
 	targetVersion: zod.z.string().nullable(),
@@ -54162,7 +54286,13 @@ var ServerUpdateActionResultSchema = zod.z.object({
 	* The failure itself, verbatim enough to act on (the npm output for a
 	* staging install). Non-null only for `failed`.
 	*/
-	error: zod.z.string().nullable().optional()
+	error: zod.z.string().nullable().optional(),
+	/**
+	* The addons the target version would refuse to start on this node's live
+	* store (D877), present when the pre-flight refused the update
+	* (`reason: 'addon-would-refuse'`). Optional for version skew.
+	*/
+	blockers: zod.z.array(UpdateBlockerSchema).optional()
 });
 var serverManagementCapability = {
 	name: "server-management",
@@ -54174,9 +54304,16 @@ var serverManagementCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		applyServerUpdate: method(zod.z.object({ 
-		/** Explicit target version; omitted = latest from the registry. */
-version: zod.z.string().optional() }), ServerUpdateActionResultSchema, {
+		applyServerUpdate: method(zod.z.object({
+			/** Explicit target version; omitted = latest from the registry. */
+			version: zod.z.string().optional(),
+			/**
+			* Apply even though the pre-flight (D877) found addons the target would
+			* refuse to start. Off by default: those addons stay down until the
+			* remedy is run, which is the incident this gate exists to prevent.
+			*/
+			acknowledgeRefusals: zod.z.boolean().optional()
+		}), ServerUpdateActionResultSchema, {
 			kind: "mutation",
 			auth: "admin",
 			timeoutMs: 16 * 6e4
@@ -57498,7 +57635,9 @@ var ManifestShapeSchema = zod.z.object({
 var AddonProcessSchema = zod.z.object({
 	pid: zod.z.number().optional(),
 	mode: zod.z.string(),
-	state: zod.z.string()
+	state: zod.z.string(),
+	/** Why the runner is `refused` (an addon's own words), when it is (D877). */
+	reason: zod.z.string().optional()
 });
 /**
 * Per-addon health snapshot from the kernel's AddonHealthMonitor.
@@ -70104,6 +70243,16 @@ var userManagementCapability = {
 			access: "delete"
 		}),
 		getTotpStatus: method(zod.z.object({ userId: zod.z.string() }), TotpStatusSchema, { auth: "admin" }),
+		/**
+		* D878: move every TOTP seed stored in plaintext into the keychain (owner
+		* `system`), leaving a marker in the row. Dry run unless `apply`;
+		* idempotent; counts only.
+		*/
+		migrateRawSecrets: method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
+		}),
 		verifyTotp: method(zod.z.object({
 			userId: zod.z.string(),
 			code: zod.z.string()
@@ -74623,6 +74772,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.migrateRawSecrets": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -76483,6 +76638,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"llm.migrateRawSecrets": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -81025,6 +81186,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.migrateRawSecrets": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.oauthExchangeCode": {
 		capName: "user-management",
 		capScope: "system",
@@ -86696,6 +86863,12 @@ Object.defineProperty(exports, "collectSecretConfigKeys", {
 		return collectSecretConfigKeys;
 	}
 });
+Object.defineProperty(exports, "collectSecretMarkerRefs", {
+	enumerable: true,
+	get: function() {
+		return collectSecretMarkerRefs;
+	}
+});
 Object.defineProperty(exports, "collectZodSecretPaths", {
 	enumerable: true,
 	get: function() {
@@ -87086,6 +87259,12 @@ Object.defineProperty(exports, "isSecretMarkerLike", {
 		return isSecretMarkerLike;
 	}
 });
+Object.defineProperty(exports, "isSecretRefOwnedBy", {
+	enumerable: true,
+	get: function() {
+		return isSecretRefOwnedBy;
+	}
+});
 Object.defineProperty(exports, "isVoidInput", {
 	enumerable: true,
 	get: function() {
@@ -87158,6 +87337,12 @@ Object.defineProperty(exports, "looseSchema", {
 		return looseSchema;
 	}
 });
+Object.defineProperty(exports, "makeSecretMarker", {
+	enumerable: true,
+	get: function() {
+		return makeSecretMarker;
+	}
+});
 Object.defineProperty(exports, "mayReadLocation", {
 	enumerable: true,
 	get: function() {
@@ -87398,6 +87583,12 @@ Object.defineProperty(exports, "secretTreeFromPaths", {
 		return secretTreeFromPaths;
 	}
 });
+Object.defineProperty(exports, "secretTreeFromSchema", {
+	enumerable: true,
+	get: function() {
+		return secretTreeFromSchema;
+	}
+});
 Object.defineProperty(exports, "settingsStoreCapability", {
 	enumerable: true,
 	get: function() {

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-CgZTNWAz.js");
+const require_wal_maintenance = require("./wal-maintenance-cRHR4rUY.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as callData, S as callControl, T as controlTargetOf, a as WalMaintenance, b as trustInput, c as SqliteSettingsBackend, g as collectTransferables, m as serializeError, o as createVectorIndex, s as vectorProviderOf, v as isFileHostRequest, w as callVector, y as isFileHostWorkerData } from "./wal-maintenance-B57SAp4a.mjs";
+import { C as callData, S as callControl, T as controlTargetOf, a as WalMaintenance, b as trustInput, c as SqliteSettingsBackend, g as collectTransferables, m as serializeError, o as createVectorIndex, s as vectorProviderOf, v as isFileHostRequest, w as callVector, y as isFileHostWorkerData } from "./wal-maintenance-sIB32ONp.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/{hub-mdns-ciao-DOBTq8qr.js → hub-mdns-ciao-B-wk9nzx.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BiTCcaf-.js");
+const require_dist = require("./dist-D9qT3jHr.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
 const require_agent_https = require("./agent-https-DlpTMDqA.js");
 let node_crypto = require("node:crypto");

package/dist/{hub-mdns-ciao-Cnd0bTB9.mjs → hub-mdns-ciao-DpPcQDg-.mjs}

@@ -1,5 +1,5 @@
 import { o as __toESM } from "./chunk-CNf5ZN-e.mjs";
-import { xi as userError } from "./dist-BWvkuc31.mjs";
+import { Ti as userError } from "./dist-Bxt_S-9a.mjs";
 import { f as X509Certificate$1 } from "./x509.es-DK__ETIe.mjs";
 import { A as isConstrainedCa, E as reasonRequiresNewCa, M as permitsIdentity, P as readNameConstraints, T as evaluateExistingCert, _ as issueLeaf, g as generateCa, v as loadCa, y as collectCertIdentity } from "./agent-https-U0d4uvn2.mjs";
 import { X509Certificate, createPrivateKey } from "node:crypto";