@camstack/system 1.2.441 → 1.2.443

package/dist/builtins/alerts/critical-push.d.ts

@@ -0,0 +1,86 @@
+/**
+* Critical system alerts reach the operator without depending on the addons
+* that just failed (D877).
+*
+* On 2026-10-17 the hub-main alert centre recorded the crash loops, but the
+* only PUSH path ran through notification-center, which was itself one of the
+* refused runners: nothing arrived for four hours. hub-main is now the SOLE
+* pusher of runner failures (`addon.runner-failed`, `addon.runner-refused`) and
+* of a degraded boot check, straight through `notification-output` (the
+* notifiers). There is no presence heuristic and no second sender:
+* notification-center keeps the state-summary row of `addon-crash-loop` and
+* pushes nothing for it.
+*
+*  - A burst is ONE digest per target: 28 runners refusing in the same boot are
+*    one message listing them, not 28.
+*  - The message names the addon, the state and the remedy line - never raw
+*    internal error text.
+*  - Delivery is a durable fact on each alert (`metadata.push`), tracked PER
+*    TARGET: a retry sends only to the targets that did not get it, and a state
+*    already delivered to every target is never sent again. A push that could not
+*    be sent stays `pending` and is retried when the notifiers (or
+*    notification-center) start - event plus reconcile (D11). If the notifiers
+*    are down, the alert and the boot-check status remain the record.
+*/
+export interface PushState {
+	readonly state: "pending" | "delivered" | "disabled";
+	/** What was pushed: the finding's episode + cause. A new key is a new push. */
+	readonly key: string;
+	readonly at?: number;
+	readonly attempts: number;
+	readonly lastError?: string;
+	/** Targets that already got this key's message. */
+	readonly sentTo?: readonly string[];
+}
+/** The slice of a notifier target the policy reads. */
+export interface PushTarget {
+	readonly id: string;
+	readonly addonId: string;
+	readonly enabled: boolean;
+	/** A personal target carries its owner; an operator-level one does not. */
+	readonly ownerUserId?: string;
+}
+export interface PushMessage {
+	readonly title: string;
+	readonly body: string;
+}
+export interface CriticalPushPorts {
+	/** Throws when the notifiers cannot be asked. */
+	readonly listTargets: () => Promise<readonly PushTarget[]>;
+	readonly send: (target: PushTarget, message: PushMessage) => Promise<{
+		readonly success: boolean;
+		readonly error?: string;
+	}>;
+}
+export interface PushPolicy {
+	readonly enabled: boolean;
+	/** Explicit target ids; empty = every enabled operator-level (not personal) target. */
+	readonly targetIds: readonly string[];
+}
+/** Alert categories that are critical system findings. */
+export declare const CRITICAL_CATEGORIES: ReadonlySet<string>;
+export declare function isPushState(value: unknown): value is PushState;
+export declare function selectPushTargets(targets: readonly PushTarget[], policy: PushPolicy): readonly PushTarget[];
+/** One critical finding waiting for its push. */
+export interface CriticalItem {
+	readonly alertId: string;
+	readonly key: string;
+	readonly title: string;
+	/** ONE line: addon id, state, remedy. Never raw internal error text. */
+	readonly line: string;
+	readonly previous: PushState | null;
+}
+/** The one message a target gets for a set of findings. */
+export declare function composeDigest(items: readonly CriticalItem[]): PushMessage;
+export interface DeliverDigestInput {
+	readonly items: readonly CriticalItem[];
+	readonly policy: PushPolicy;
+	readonly ports: CriticalPushPorts;
+	readonly now: number;
+}
+/**
+* Push every item that still needs it, as ONE message per target. Returns the new
+* state of each item whose state changed (an item already delivered/disabled for
+* its key is absent from the result).
+*/
+export declare function deliverDigest(input: DeliverDigestInput): Promise<ReadonlyMap<string, PushState>>;

package/dist/builtins/alerts/runner-alert.d.ts

@@ -0,0 +1,71 @@
+/**
+* ONE alert per runner (D877).
+*
+* A runner that dies produces a burst: `process.crashed` per exit,
+* `addon.crashed` per hosted addon, then `addon.runner-failed` when the D6
+* breaker gives up (or `addon.runner-refused` for a typed Init refusal). On
+* 2026-10-17 28 runners made 28 "Addon crash loop" + 140 "Process crashed" +
+* 34 "Addon crashed" alerts in one minute - the alerts ring (500) was a third
+* full and the one alert that mattered was 1 of 202.
+*
+* Here the burst folds into ONE record per `(node, runner)` that updates its
+* count and state. `refused` and `failed` are TERMINAL markers: a later plain
+* crash bumps the count but never downgrades them. A dismissed record starts
+* a fresh one.
+*/
+import type { AlertSeverity } from "@camstack/types";
+export type RunnerAlertState = "crashed" | "failed" | "refused";
+export interface RunnerAlertRecord {
+	readonly nodeId: string;
+	readonly runnerId: string;
+	readonly state: RunnerAlertState;
+	/** When this EPISODE began (ms). A runner that recovered and fails again opens a new one. */
+	readonly since: number;
+	/** Events folded into this record. */
+	readonly count: number;
+	readonly addonIds: readonly string[];
+	/** Last error text a plain crash carried. */
+	readonly lastError?: string;
+	/** Refusal: the addon's own words, and what the operator does. */
+	readonly reason?: string;
+	readonly remedy?: string;
+	/** Breaker: crashes inside the window. */
+	readonly crashesInWindow?: number;
+}
+export type RunnerAlertCategory = "process.crashed" | "addon.crashed" | "addon.runner-failed" | "addon.runner-refused";
+export declare const RUNNER_ALERT_CATEGORIES: readonly RunnerAlertCategory[];
+export declare function isRunnerAlertCategory(category: string): category is RunnerAlertCategory;
+/** Stable alert id of a runner on a node. */
+export declare function runnerAlertId(nodeId: string, runnerId: string): string;
+/** Which runner an event is about; `null` when it names none. */
+export declare function runnerKeyOf(category: RunnerAlertCategory, data: Record<string, unknown>, source: {
+	readonly id?: string;
+	readonly nodeId?: string;
+} | undefined): {
+	readonly nodeId: string;
+	readonly runnerId: string;
+} | null;
+/** Fold one event into the runner's record. */
+export declare function foldRunnerEvent(previous: RunnerAlertRecord | null, category: RunnerAlertCategory, data: Record<string, unknown>, key: {
+	readonly nodeId: string;
+	readonly runnerId: string;
+}, now: number): RunnerAlertRecord;
+export interface RenderedRunnerAlert {
+	readonly severity: AlertSeverity;
+	readonly title: string;
+	readonly message: string;
+}
+export declare function renderRunnerAlert(record: RunnerAlertRecord): RenderedRunnerAlert;
+/** Is the record in a state an operator must act on (terminal)? */
+export declare function isTerminalRunnerState(state: RunnerAlertState): boolean;
+/**
+* The push key of a record: its episode and its cause. The same refusal of the
+* same episode is never pushed twice; a refusal with another reason, a breaker
+* trip, or any failure after a recovery (a new episode) is a new push.
+*/
+export declare function runnerPushKey(record: RunnerAlertRecord): string;
+/**
+* The one line a push carries: runner, state and the remedy. Deliberately NOT
+* the raw reason or error text - those stay on the alert.
+*/
+export declare function runnerPushLine(record: RunnerAlertRecord): string;

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Ar as errMsg, M as FIRST_LEVEL_MACRO_CLASSES, Pn as ptzAutotrackCapability, Si as EventCategory, jr as BaseAddon, ni as isEvent, ut as bareAddonId } from "../../dist-BWvkuc31.mjs";
+import { Ar as errMsg, Ei as EventCategory, M as FIRST_LEVEL_MACRO_CLASSES, Pn as ptzAutotrackCapability, jr as BaseAddon, ri as isEvent, ut as bareAddonId } from "../../dist-Bxt_S-9a.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
-const require_restore_archive = require("../../restore-archive-CfSSjKnA.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
+const require_restore_archive = require("../../restore-archive-BMNXwWWD.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
-import { Si as EventCategory, bn as mayWriteToLocation, jr as BaseAddon, lt as backupCapability, rr as storageOccupancyCapability, si as nodePin, vi as toNodeId } from "../../dist-BWvkuc31.mjs";
-import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-4ziluTU3.mjs";
+import { Ei as EventCategory, Si as toNodeId, bn as mayWriteToLocation, jr as BaseAddon, lt as backupCapability, rr as storageOccupancyCapability, ui as nodePin } from "../../dist-Bxt_S-9a.mjs";
+import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-9CGgeBzD.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { g as CalendarPreferencesSchema, gt as calendarsCapability, jr as BaseAddon } from "../../dist-BWvkuc31.mjs";
+import { g as CalendarPreferencesSchema, gt as calendarsCapability, jr as BaseAddon } from "../../dist-Bxt_S-9a.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { A as DeclaredDevices, Ar as errMsg, Dr as DeviceFeature, H as MOTION_CLOSE_AFTER_MS, Qn as snapshotCapability, Si as EventCategory, _t as cameraGridLayoutCapability, ar as streamCatalogCapability, ei as hydrateSchema, gr as buildFfmpegArgs, jr as BaseAddon, jt as declarationOwnerNodeId, kr as DeviceType, o as BaseDevice, qr as createEvent, w as DERIVED_CAMERA_SILENCED_CAP_NAMES, wn as motionCapability, xn as memoizePinnedFfmpeg } from "../../dist-BWvkuc31.mjs";
+import { A as DeclaredDevices, Ar as errMsg, Dr as DeviceFeature, Ei as EventCategory, H as MOTION_CLOSE_AFTER_MS, Jr as createEvent, Qn as snapshotCapability, _t as cameraGridLayoutCapability, ar as streamCatalogCapability, gr as buildFfmpegArgs, jr as BaseAddon, jt as declarationOwnerNodeId, kr as DeviceType, o as BaseDevice, ti as hydrateSchema, w as DERIVED_CAMERA_SILENCED_CAP_NAMES, wn as motionCapability, xn as memoizePinnedFfmpeg } from "../../dist-Bxt_S-9a.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
-const require_composition_sources = require("../../composition-sources-BG-W2U0d.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
+const require_composition_sources = require("../../composition-sources-BUXX1e8j.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { A as DeclaredDevices, Ar as errMsg, Cr as compositionSourceKey, Er as toExpressionValue, Si as EventCategory, Sr as compositionSliceKey, Tr as disarmRoseMemory, Wt as evaluateCompositionField, _r as cloneStatefulExpressionMemory, br as compositionFeatureEnabled, bt as composerCapability, f as COMPOSED_ITEM_FIXED_FIELDS, ft as buildCapabilityLookup, hr as COMPOSER_ADDON_ID, jn as planComposition, jr as BaseAddon, kr as DeviceType, o as BaseDevice, qr as createEvent, qt as expressionContainsBuiltinCall, r as ALL_CAPABILITY_DEFINITIONS, vr as composedDeviceRef, wr as createStatefulExpressionMemory, xr as compositionItemFieldPath, xt as compositionFieldKey, yr as composedDeviceStableId } from "../../dist-BWvkuc31.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-ByNISOnW.mjs";
+import { A as DeclaredDevices, Ar as errMsg, Cr as compositionSourceKey, Ei as EventCategory, Er as toExpressionValue, Jr as createEvent, Sr as compositionSliceKey, Tr as disarmRoseMemory, Wt as evaluateCompositionField, _r as cloneStatefulExpressionMemory, br as compositionFeatureEnabled, bt as composerCapability, f as COMPOSED_ITEM_FIXED_FIELDS, ft as buildCapabilityLookup, hr as COMPOSER_ADDON_ID, jn as planComposition, jr as BaseAddon, kr as DeviceType, o as BaseDevice, qt as expressionContainsBuiltinCall, r as ALL_CAPABILITY_DEFINITIONS, vr as composedDeviceRef, wr as createStatefulExpressionMemory, xr as compositionItemFieldPath, xt as compositionFieldKey, yr as composedDeviceStableId } from "../../dist-Bxt_S-9a.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-C8tUG2uL.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-BWvkuc31.mjs";
+import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-Bxt_S-9a.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/block-package.d.ts

@@ -1,4 +1,4 @@
-import { coreBlockAddonId, coreBlockIdFromAddonId } from "@camstack/types";
+import { type ConfigUISchema, coreBlockAddonId, coreBlockIdFromAddonId } from "@camstack/types";
 /**
 * The runner id lives on the CAPABILITY, not here.
 *
@@ -24,6 +24,8 @@ export interface MaterializeBlockInput {
 	* loads. Absent for a legacy single-file materialize.
 	*/
 	readonly files?: Readonly<Record<string, string>>;
+	/** The block's settings form: its secret fields are keychain-backed at runtime (D880). */
+	readonly settingsSchema?: ConfigUISchema | undefined;
 }
 export interface MaterializedBlock {
 	/** What `$process.spawnRunner` gets as `addonDir` — the package root. */
@@ -32,7 +34,7 @@ export interface MaterializedBlock {
 }
 /** Build the wrapper for one block. Exported for the test that asserts the
 *  generated source actually carries the block's identity. */
-export declare function renderBlockWrapper(blockId: string, blockName: string): string;
+export declare function renderBlockWrapper(blockId: string, blockName: string, settingsSchema?: ConfigUISchema | undefined): string;
 /** The package manifest the addon runner reads to find the entry point. */
 export declare function renderBlockManifest(blockId: string, blockName: string): string;
 /**

package/dist/builtins/core-blocks/block-settings-store.d.ts

@@ -1,21 +1,8 @@
-/**
-* Preference values for core blocks.
-*
-* Schema lives on the block record (`settingsSchema`, extracted from the
-* compiled entry's named export or set by the editor). Values live HERE —
-* one JSON blob per blockId — so a settings patch never rewrites the
-* operator's source, and so a block that has not yet declared a schema still
-* keeps any values the UI already wrote.
-*
-* On every patch the same values are mirrored into the block addon's
-* `addon-settings` rows so a running script reads them the same way any
-* addon does: `ctx.settings.readAddonStore()`.
-*/
-import type { SettingsStoreClient } from "@camstack/types";
+import { type ConfigUISchema, type RawSecretMigrationReport, type SecretsAccess, type SettingsStoreClient } from "@camstack/types";
 /**
 * @durable class=config owner=core-blocks
-*   write="`setValues` / `mergeValues` persist the operator's prefs for one block"
-*   retention="`delete` when the block is deleted. Nothing ages out."
+*   write="NOTHING since D880 - the values live in the block addon's `addon-settings` rows. Only the one-shot `migrateRawSecrets` reads it, then deletes each row."
+*   retention="legacy: every row is deleted by the verified operator migration; the declaration goes with it once every hub ran it."
 */
 export declare const CORE_BLOCK_SETTINGS_COLLECTION = "core-blocks:settings";
 export declare const CORE_BLOCK_SETTINGS_COLUMNS: readonly [{
@@ -29,15 +16,74 @@ export declare const CORE_BLOCK_SETTINGS_COLUMNS: readonly [{
 	readonly notNull: true;
 	readonly defaultValue: "{}";
 }];
+/** The keychain door for a given owner, or null when this process has none. */
+export type SecretsForOwner = (owner: string) => SecretsAccess | null;
 export interface BlockSettingsStoreDeps {
 	readonly store: SettingsStoreClient;
+	readonly keychainFor: SecretsForOwner;
+	/** Told about keychain refs a write dropped but could not delete (they are now orphans). */
+	readonly onOrphaned?: (blockId: string, refs: readonly string[]) => void;
+}
+/** The block declares a secret, but this process has no keychain door to put it in. */
+export declare class BlockSecretsUnavailableError extends Error {
+	readonly blockId: string;
+	constructor(blockId: string);
+}
+/** The block addon's settings rows could not be read: never answered as "empty". */
+export declare class BlockSettingsUnreadableError extends Error {
+	readonly blockId: string;
+	constructor(blockId: string, reason: string);
+}
+/** One block as the migration sees it. */
+export interface BlockSecretsSubject {
+	readonly id: string;
+	readonly settingsSchema?: ConfigUISchema | undefined;
 }
 export declare class BlockSettingsStore {
 	private readonly store;
+	private readonly keychainFor;
+	private readonly onOrphaned;
 	constructor(deps: BlockSettingsStoreDeps);
+	/** Declares the LEGACY collection, so the migration can read it. */
 	static declare(store: SettingsStoreClient): Promise<void>;
-	getValues(blockId: string): Promise<Record<string, unknown>>;
-	mergeValues(blockId: string, patch: Record<string, unknown>): Promise<Record<string, unknown>>;
+	private rows;
+	/**
+	* The block's stored values - markers, NOT resolved. For the admin form
+	* (`hydrateSchema` turns a marker into a "set" view) and as the `stored`
+	* side of a write. Absent answers `{}`; an unreadable store THROWS.
+	*/
+	readStored(blockId: string): Promise<Record<string, unknown>>;
+	/**
+	* Patch the block's values. Secret fields (by the schema TYPE) go to the
+	* keychain first and the row gets the marker; a keychain that cannot take
+	* them refuses the whole patch.
+	*/
+	mergeValues(blockId: string, schema: ConfigUISchema | undefined, patch: Record<string, unknown>): Promise<void>;
+	/** The block is gone: its rows, its keychain values and the legacy blob go with it. */
 	delete(blockId: string): Promise<void>;
-	private mirrorToBlockAddon;
+	/**
+	* D880: move every plaintext secret a block's `settingsSchema` declares into
+	* the keychain, and delete the legacy `core-blocks:settings` blob.
+	*
+	* Per block: gather the values (the addon-settings rows win; a key only the
+	* blob holds is carried over), put each secret, READ IT BACK and compare,
+	* and only then write the marker. The legacy row is deleted only after the
+	* block's rows hold every key it had and every secret resolves. A block that
+	* fails stays exactly as it was. Dry run unless `apply`; idempotent; counts
+	* only - never a value, a ref or a block id.
+	*/
+	migrateRawSecrets(blocks: readonly BlockSecretsSubject[], apply: boolean): Promise<RawSecretMigrationReport>;
+	/**
+	* The keys of the legacy blob that may be copied into the block's rows: not in
+	* the rows already, not a secret the tree moves, not a credential-named value no
+	* schema declares (flagged instead), and not a marker that points at another
+	* owner's secret (counted as `foreign`, never copied).
+	*/
+	private carryable;
+	private dropLegacy;
+	/** put -> read back -> compare -> only then the marker rows. */
+	private moveBlock;
+	/** Remove the values a failed move put, never one the row already pointed at. */
+	private discard;
+	private report;
 }