@camstack/system 1.2.442 → 1.2.443

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,14 +3,14 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
 let node_fs_promises = require("node:fs/promises");
+let node_util = require("node:util");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");
-let node_util = require("node:util");
 //#region src/builtins/native-metrics/cgroup-memory.ts
 /** `readFileSync`, with every failure flattened to `null`. */
 var nodeCgroupFileReader = { read(path) {

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,11 +1,11 @@
-import { Ar as errMsg, Ci as EventCategory, Fn as reducePoints, Rn as resolveBucketMs, Sn as metricsProviderCapability, Xt as foldSnapshotByFunction, jr as BaseAddon, qr as createEvent } from "../../dist-DsrQYcLm.mjs";
+import { Ar as errMsg, Ei as EventCategory, Fn as reducePoints, Jr as createEvent, Rn as resolveBucketMs, Sn as metricsProviderCapability, Xt as foldSnapshotByFunction, jr as BaseAddon } from "../../dist-Bxt_S-9a.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
+import { promisify } from "node:util";
 import * as os$1 from "node:os";
 import { platform } from "node:os";
 import * as fs from "node:fs";
 import { constants, readFileSync } from "node:fs";
 import { execFile, execFileSync } from "node:child_process";
-import { promisify } from "node:util";
 //#region src/builtins/native-metrics/cgroup-memory.ts
 /** `readFileSync`, with every failure flattened to `null`. */
 var nodeCgroupFileReader = { read(path) {

package/dist/builtins/platform-probe/index.js

@@ -3,13 +3,13 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
+let node_util = require("node:util");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");
-let node_util = require("node:util");
 //#region src/builtins/platform-probe/coral-accelerators.ts
 /**
 * Coral USB Edge TPU USB identifiers.

package/dist/builtins/platform-probe/index.mjs

@@ -1,9 +1,9 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { Ar as errMsg, Ci as EventCategory, Jn as scoreRuntimes, Mn as platformProbeCapability, Vt as enumerateInferenceDevices, Zr as emitReadiness, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
+import { Ar as errMsg, Ei as EventCategory, Jn as scoreRuntimes, Mn as platformProbeCapability, Qr as emitReadiness, Vt as enumerateInferenceDevices, jr as BaseAddon } from "../../dist-Bxt_S-9a.mjs";
+import { promisify } from "node:util";
 import * as os$1 from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
-import { promisify } from "node:util";
 //#region src/builtins/platform-probe/coral-accelerators.ts
 /**
 * Coral USB Edge TPU USB identifiers.

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ci as EventCategory, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
+import { Ei as EventCategory, jr as BaseAddon } from "../../dist-Bxt_S-9a.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Ar as errMsg, Ci as EventCategory, Dr as DeviceFeature, Pt as deriveBatteryPresence, Qn as snapshotCapability, ci as nodePin, dt as batteryCapability, jr as BaseAddon, kr as DeviceType, or as streamQualityLabel, s as BatteryStatusSchema, ut as bareAddonId, xn as memoizePinnedFfmpeg } from "../../dist-DsrQYcLm.mjs";
+import { Ar as errMsg, Dr as DeviceFeature, Ei as EventCategory, Pt as deriveBatteryPresence, Qn as snapshotCapability, dt as batteryCapability, jr as BaseAddon, kr as DeviceType, or as streamQualityLabel, s as BatteryStatusSchema, ui as nodePin, ut as bareAddonId, xn as memoizePinnedFfmpeg } from "../../dist-Bxt_S-9a.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Yt as filesystemBrowseCapability, ir as storageProviderCapability, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
+import { Yt as filesystemBrowseCapability, ir as storageProviderCapability, jr as BaseAddon } from "../../dist-Bxt_S-9a.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-C-bmkDhm.js");
+const require_wal_maintenance = require("../../wal-maintenance-cRHR4rUY.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_PAGE_CACHE_FLOOR_KIB, D as SQLITE_MMAP_CEILING_BYTES, E as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_INTERVAL_MS, I as SQLITE_PROFILE_TOP_N, L as SQLITE_SLOW_CALL_MS, M as sqlitePageCacheKibFor, N as SQLITE_ENGINE_STORM_WALL_SHARE, O as SQLITE_MMAP_FLOOR_BYTES, P as SQLITE_PROFILE_REPORT_FLOOR_MS, R as SqliteOpProfiler, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as sqliteMmapSizeFor, k as SQLITE_PAGE_CACHE_CEILING_KIB, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as sqliteEngineStorm } from "../../wal-maintenance-DE8QrreK.mjs";
+import { A as SQLITE_PAGE_CACHE_FLOOR_KIB, D as SQLITE_MMAP_CEILING_BYTES, E as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_INTERVAL_MS, I as SQLITE_PROFILE_TOP_N, L as SQLITE_SLOW_CALL_MS, M as sqlitePageCacheKibFor, N as SQLITE_ENGINE_STORM_WALL_SHARE, O as SQLITE_MMAP_FLOOR_BYTES, P as SQLITE_PROFILE_REPORT_FLOOR_MS, R as SqliteOpProfiler, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as sqliteMmapSizeFor, k as SQLITE_PAGE_CACHE_CEILING_KIB, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as sqliteEngineStorm } from "../../wal-maintenance-sIB32ONp.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
 const require_retired_settings_keys = require("../../retired-settings-keys-D_VwZiDt.js");
-const require_wal_maintenance = require("../../wal-maintenance-C-bmkDhm.js");
+const require_wal_maintenance = require("../../wal-maintenance-cRHR4rUY.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { Ar as errMsg, At as databaseSnapshotCapability, Ir as RUNTIME_DEFAULTS, J as STORAGE_ADMIN_SCOPED_BASES, S as DATA_STORE_DATABASES, b as DATABASE_SNAPSHOT_SUFFIX, er as storageAdminCapability, jr as BaseAddon, kt as dataStoreProviderCapability, pr as vectorStoreCapability, q as STORAGE_ADMIN_MOVED_COLLECTIONS, ut as bareAddonId, x as DATABASE_SNAPSHOT_TIMEOUT_MS, y as DATABASE_SNAPSHOT_PARTIAL_SUFFIX } from "../../dist-DsrQYcLm.mjs";
+import { Ar as errMsg, At as databaseSnapshotCapability, Ir as RUNTIME_DEFAULTS, J as STORAGE_ADMIN_SCOPED_BASES, S as DATA_STORE_DATABASES, b as DATABASE_SNAPSHOT_SUFFIX, er as storageAdminCapability, jr as BaseAddon, kt as dataStoreProviderCapability, pr as vectorStoreCapability, q as STORAGE_ADMIN_MOVED_COLLECTIONS, ut as bareAddonId, x as DATABASE_SNAPSHOT_TIMEOUT_MS, y as DATABASE_SNAPSHOT_PARTIAL_SUFFIX } from "../../dist-Bxt_S-9a.mjs";
 import { i as retiredKeyStoreOf, n as purgeRetiredSettingsKeys } from "../../retired-settings-keys-Bhwe4ymb.mjs";
-import { C as callData, S as callControl, T as controlTargetOf, _ as isFileHostMessage, a as WalMaintenance, c as SqliteSettingsBackend, d as DatabaseBusyError, f as DuplicatePlacementError, g as collectTransferables, l as CollectionPlacementError, o as createVectorIndex, p as rehydrateError, s as vectorProviderOf, u as CrossDatabaseTransactError, w as callVector, x as trustResult } from "../../wal-maintenance-DE8QrreK.mjs";
+import { C as callData, S as callControl, T as controlTargetOf, _ as isFileHostMessage, a as WalMaintenance, c as SqliteSettingsBackend, d as DatabaseBusyError, f as DuplicatePlacementError, g as collectTransferables, l as CollectionPlacementError, o as createVectorIndex, p as rehydrateError, s as vectorProviderOf, u as CrossDatabaseTransactError, w as callVector, x as trustResult } from "../../wal-maintenance-sIB32ONp.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as StorageCleanupJobSchema, $t as gbToBytes, Ci as EventCategory, Cn as modeMayWrite, Fr as REDACTED_SECRET, Gr as collectSecretConfigKeys, Gt as evictionPolicyOfLocation, Hn as resolveLocationMode, Yn as settingsStoreCapability, _i as secretTreeFromPaths, ai as isSecretMarker, an as isLocationEnabled, bn as mayWriteToLocation, et as StorageLocationModeSchema, fn as legacyModeOf, hi as resolveSecretMarkers, jr as BaseAddon, mr as withLocationMode, nr as storageMigrationCapability, nt as StorageMigrationJobSchema, tr as storageCapability, tt as StorageLocationTypeSchema, ui as parseJsonObject, xi as transformSecretWrite, yn as mayReadLocation, z as LegacyStorageLocationDefaultSchema } from "../../dist-DsrQYcLm.mjs";
+import { $ as StorageCleanupJobSchema, $t as gbToBytes, Cn as modeMayWrite, Ei as EventCategory, Fr as REDACTED_SECRET, Gr as collectSecretConfigKeys, Gt as evictionPolicyOfLocation, Hn as resolveLocationMode, Yn as settingsStoreCapability, _i as resolveSecretMarkers, an as isLocationEnabled, bn as mayWriteToLocation, et as StorageLocationModeSchema, fi as parseJsonObject, fn as legacyModeOf, jr as BaseAddon, mr as withLocationMode, nr as storageMigrationCapability, nt as StorageMigrationJobSchema, oi as isSecretMarker, tr as storageCapability, tt as StorageLocationTypeSchema, wi as transformSecretWrite, yi as secretTreeFromPaths, yn as mayReadLocation, z as LegacyStorageLocationDefaultSchema } from "../../dist-Bxt_S-9a.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_x509_es = require("../../x509.es-C4cOo48M.js");
 const require_agent_https = require("../../agent-https-DlpTMDqA.js");
-const require_constants$8 = require("../../constants-b7kpjuO4.js");
+const require_constants$8 = require("../../constants-DWmm7_of.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,9 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Ar as errMsg, Jr as customAction, Xn as shortHostname, Yr as defineCustomActions, Z as ServerNameSchema, ei as hydrateSchema, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
+import { Ar as errMsg, Xn as shortHostname, Xr as defineCustomActions, Yr as customAction, Z as ServerNameSchema, jr as BaseAddon, ti as hydrateSchema } from "../../dist-Bxt_S-9a.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { S as backdatedNotBefore, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension } from "../../x509.es-DK__ETIe.mjs";
 import { F as AGENT_HTTPS_NAMES_COLLECTION, I as AGENT_HTTPS_NAMES_COLUMNS, L as AgentHttpsNames, R as getProcessAgentHttpsNames, j as isLocalOnlyHostname, u as isPrivateAddress, z as setProcessAgentHttpsNames } from "../../agent-https-U0d4uvn2.mjs";
-import { a as MESH_CA_KEY_REF, c as SERVER_AUTH_OID, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "../../constants-2iWQ-Nx-.mjs";
+import { a as MESH_CA_KEY_REF, c as SERVER_AUTH_OID, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "../../constants-CGwVaAV3.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
+import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-Bxt_S-9a.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-DmSEMtUD.js → composition-sources-BUXX1e8j.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CyIHDLCg.js");
+const require_dist = require("./dist-D9qT3jHr.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-CftPpY4O.mjs → composition-sources-C8tUG2uL.mjs}

@@ -1,4 +1,4 @@
-import { Ar as errMsg, Cr as compositionSourceKey } from "./dist-DsrQYcLm.mjs";
+import { Ar as errMsg, Cr as compositionSourceKey } from "./dist-Bxt_S-9a.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-2iWQ-Nx-.mjs → constants-CGwVaAV3.mjs}

@@ -1,4 +1,4 @@
-import { Wr as buildSecretRef } from "./dist-DsrQYcLm.mjs";
+import { Wr as buildSecretRef } from "./dist-Bxt_S-9a.mjs";
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
 var MESH_CA_KEY_REF = buildSecretRef({
 	owner: "system",

package/dist/{constants-b7kpjuO4.js → constants-DWmm7_of.js}

@@ -1,5 +1,5 @@
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
-var MESH_CA_KEY_REF = require("./dist-CyIHDLCg.js").buildSecretRef({
+var MESH_CA_KEY_REF = require("./dist-D9qT3jHr.js").buildSecretRef({
 	owner: "system",
 	scope: { kind: "global" },
 	fieldPath: "meshCaKey"

package/dist/{device-ca-BJpYTAPg.mjs → device-ca-DBfiJ_SB.mjs}

@@ -1,4 +1,4 @@
-import { D as DEVICE_SAN_CREDENTIAL_PREFIX, O as DEVICE_SAN_USER_PREFIX, Wr as buildSecretRef } from "./dist-DsrQYcLm.mjs";
+import { D as DEVICE_SAN_CREDENTIAL_PREFIX, O as DEVICE_SAN_USER_PREFIX, Wr as buildSecretRef } from "./dist-Bxt_S-9a.mjs";
 import { S as backdatedNotBefore, a as KeyUsageFlags, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension } from "./x509.es-DK__ETIe.mjs";
 import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts

package/dist/{device-ca-tKY_ZS9H.js → device-ca-DGayRmC0.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CyIHDLCg.js");
+const require_dist = require("./dist-D9qT3jHr.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts

package/dist/{dist-DsrQYcLm.mjs → dist-Bxt_S-9a.mjs}

@@ -736,7 +736,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-bgZLodYc.mjs
+//#region ../types/dist/sleep-D-Q2_Mcd.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -15476,6 +15476,41 @@ function describeComposableCaps(defs, deviceType) {
 	}).toSorted((a, b) => a.cap.localeCompare(b.cap));
 }
 /**
+* The report of a one-shot "move this owner's plaintext secrets into the
+* keychain" run (D878). COUNTS only - never a value, never a ref.
+*
+* The owner runs it on its own rows, through its own write path; an operator
+* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
+* Dry run (`apply: false`) reports what WOULD move and changes nothing.
+*/
+var RawSecretMigrationInputSchema = z.object({ 
+/** `false` (the default of the script) = report only. */
+apply: z.boolean() });
+var RawSecretMigrationReportSchema = z.object({
+	apply: z.boolean(),
+	/** Rows that can carry a secret (a profile, an enrolment). */
+	rows: z.number().int(),
+	/** Rows whose secret was plaintext when the run started. */
+	raw: z.number().int(),
+	/** Rows that already held a keychain marker when the run started. */
+	markers: z.number().int(),
+	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
+	migrated: z.number().int(),
+	/** Plaintext rows left in place because the move or its read-back failed. */
+	failed: z.number().int(),
+	/** After the run: rows still holding plaintext. */
+	remainingRaw: z.number().int(),
+	/** After the run: markers the keychain could not resolve right now. */
+	unresolvedMarkers: z.number().int(),
+	/**
+	* A second, redundant copy of the secrets' rows that the run found (and, on
+	* `apply`, deleted after verifying the first). Owners with a single copy omit it.
+	*/
+	redundantCopies: z.number().int().optional(),
+	/** True when nothing is raw and every marker resolves. */
+	verified: z.boolean()
+});
+/**
 * core-blocks — user-authored TypeScript, stored in the kernel and executed in
 * its own process.
 *
@@ -15839,14 +15874,16 @@ var coreBlocksCapability = {
 		/**
 		* Hydrated settings form for one block, or null until a `settingsSchema`
 		* is known (extracted from the compiled entry's named export, or set on
-		* the block). Values live in the `core-blocks:settings` collection.
+		* the block). Values live in the block addon's `addon-settings` rows (D880);
+		* a password field answers as a "set" view, never the value.
 		*/
 		getBlockSettings: method(z.object({ blockId: z.string() }), SettingsSchemaWithValuesSchema.nullable(), { auth: "admin" }),
 		/**
 		* Patch persisted preference values for one block. The schema is not
-		* rewritten here — only values. Scripts read the same blob via
-		* `ctx.settings.readAddonStore()` (mirrored into the block addon's
-		* `addon-settings` namespace on every patch).
+		* rewritten here — only values. Scripts read the same rows via
+		* `ctx.settings.readAddonStore()`. A field the schema declares `password` /
+		* `secret: true` is stored in the keychain (owner = the block's addon id)
+		* and the row holds a marker; a REDACTED or view value keeps the stored one.
 		*/
 		updateBlockSettings: method(z.object({
 			blockId: z.string(),
@@ -15856,6 +15893,16 @@ var coreBlocksCapability = {
 			auth: "admin"
 		}),
 		/**
+		* D880: move every plaintext password a block's `settingsSchema` declares
+		* into the keychain and delete the legacy `core-blocks:settings` copy. Dry
+		* run unless `apply`; idempotent; counts only. A secret is read back from
+		* the keychain before its row is rewritten.
+		*/
+		migrateRawSecrets: method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* The declaration files the editor type-checks against.
 		*
 		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
@@ -41064,36 +41111,6 @@ var llmRuntimeCapability = {
 	}
 };
 /**
-* The report of a one-shot "move this owner's plaintext secrets into the
-* keychain" run (D878). COUNTS only - never a value, never a ref.
-*
-* The owner runs it on its own rows, through its own write path; an operator
-* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
-* Dry run (`apply: false`) reports what WOULD move and changes nothing.
-*/
-var RawSecretMigrationInputSchema = z.object({ 
-/** `false` (the default of the script) = report only. */
-apply: z.boolean() });
-var RawSecretMigrationReportSchema = z.object({
-	apply: z.boolean(),
-	/** Rows that can carry a secret (a profile, an enrolment). */
-	rows: z.number().int(),
-	/** Rows whose secret was plaintext when the run started. */
-	raw: z.number().int(),
-	/** Rows that already held a keychain marker when the run started. */
-	markers: z.number().int(),
-	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
-	migrated: z.number().int(),
-	/** Plaintext rows left in place because the move or its read-back failed. */
-	failed: z.number().int(),
-	/** After the run: rows still holding plaintext. */
-	remainingRaw: z.number().int(),
-	/** After the run: markers the keychain could not resolve right now. */
-	unresolvedMarkers: z.number().int(),
-	/** True when nothing is raw and every marker resolves. */
-	verified: z.boolean()
-});
-/**
 * `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
 * methods concat-fan across providers; single-row methods route to ONE
 * provider by the `addonId` in the call input (the notification-output
@@ -74755,6 +74772,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.migrateRawSecrets": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -86270,4 +86293,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { StorageCleanupJobSchema as $, splitTranslationRef as $n, formatSecretScope as $r, gbToBytes as $t, DeclaredDevices as A, pickAppLinkHub as An, errMsg as Ar, databaseSnapshotCapability as At, METHOD_ACCESS_MAP as B, resolveCoreBlockFiles as Bn, WELL_KNOWN_TAB_MAP as Br, deviceStatusCapability as Bt, DAY_NAMES as C, EventCategory as Ci, modeMayWrite as Cn, compositionSourceKey as Cr, coreBlockAddonId as Ct, DEVICE_SAN_CREDENTIAL_PREFIX as D, objectInputDeclaresAddonId as Dn, DeviceFeature as Dr, coreBlocksCapability as Dt, DEVICE_NONCE_TTL_MS as E, normalizeUnit as En, toExpressionValue as Er, coreBlockSourceKind as Et, HUB_MDNS_SERVICE_TYPE as F, reducePoints as Fn, REDACTED_SECRET as Fr, describeComposableCaps as Ft, RecordingStatusSchema as G, runtimeStatePolicyFor as Gn, collectSecretConfigKeys as Gr, evictionPolicyOfLocation as Gt, MOTION_CLOSE_AFTER_MS as H, resolveLocationMode as Hn, asNumber as Hr, enumerateItemArrayFields as Ht, HUB_MDNS_TXT_KEYS as I, replacedFieldKeys as In, RUNTIME_DEFAULTS as Ir, deviceCredentialsCapability as It, STORAGE_ADMIN_SCOPED_BASES as J, scoreRuntimes as Jn, customAction as Jr, extractNestedAddonId as Jt, STORAGE_ACCESS_FALLBACK as K, scopesAllowAddon as Kn, collectZodSecretPaths as Kr, expandContainer as Kt, KEYCHAIN_RESET_TRIGGER_ACTOR as L, resolveAppConnections as Ln, ReadinessRegistry as Lr, deviceExtensionCapability as Lt, FIRST_LEVEL_MACRO_CLASSES as M, platformProbeCapability as Mn, DATAPLANE_SECRET_HEADER as Mr, decodeVectorBase64 as Mt, FieldClaimModeSchema as N, procedureAuthKey as Nn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Nr, defineExtensionSlotProvider as Nt, DEVICE_SAN_USER_PREFIX as O, objectInputDeclaresRequiredDeviceId as On, DeviceRole as Or, createDeviceExtensionProvider as Ot, FieldClaimSchema as P, ptzAutotrackCapability as Pn, DEVICE_STATUS_METHOD as Pr, deriveBatteryPresence as Pt, SsoBridgeClaimsSchema as Q, snapshotCapability as Qn, expandCapMethods as Qr, formatMinutes as Qt, LOG_LEVEL_RANK as R, resolveBucketMs as Rn, ReadinessTimeoutError as Rr, deviceManagerCapability as Rt, DATA_STORE_DATABASES as S, userError as Si, metricsProviderCapability as Sn, compositionSliceKey as Sr, compositionSourceRefs as St, DEVICE_ENROLLMENT_TTL_MS as T, normalizeCoreBlockWrite as Tn, disarmRoseMemory as Tr, coreBlockIdFromAddonId as Tt, NetworkTunnelStartedDataSchema as U, resolveMethodAuth as Un, asString$1 as Ur, enumerateSchemaFields as Ut, MINUTES_PER_DAY as V, resolveHubAddressRoles as Vn, asJsonObject as Vr, enumerateInferenceDevices as Vt, RECORDING_SOURCE_CAMSTACK_ADDON as W, resolveNotificationTapAddress as Wn, buildSecretRef as Wr, evaluateCompositionField as Wt, ScopedTokenSchema as X, shortHostname as Xn, emitDownForOwnedCaps as Xr, foldSnapshotByFunction as Xt, STREAM_PROFILE_META as Y, settingsStoreCapability as Yn, defineCustomActions as Yr, filesystemBrowseCapability as Yt, ServerNameSchema as Z, siteZoneKey as Zn, emitReadiness as Zr, formatDeviceRevoker as Zt, CatalogFileSchema as _, secretTreeFromPaths as _i, logLevelAtMost as _n, cloneStatefulExpressionMemory as _r, cameraGridLayoutCapability as _t, ApiKeyRecordSchema as a, isSecretMarker as ai, isLocationEnabled as an, streamCatalogCapability as ar, addonSettingsCapability as at, DATABASE_SNAPSHOT_SUFFIX as b, toSecretFieldView as bi, mayWriteToLocation as bn, compositionFeatureEnabled as br, composerCapability as bt, CAMERA_SWITCH_ORDER as c, nodePin as ci, kebabToCamel as cn, userManagementCapability as cr, authProviderCapability as ct, CATALOG_LANGS as d, parseJsonUnknown as di, legacyAutoLinkIds as dn, vectorDimFromBase64 as dr, batteryCapability as dt, hydrateSchema as ei, interpolate as en, storageAdminCapability as er, StorageLocationModeSchema as et, COMPOSED_ITEM_FIXED_FIELDS as f, parseSecretRef as fi, legacyModeOf as fn, vectorIndexDimConflictError as fr, buildCapabilityLookup as ft, CalendarPreferencesSchema as g, scopeKey as gi, logDestinationCapability as gn, buildFfmpegArgs as gr, calendarsCapability as gt, CORE_BLOCK_ADDON_PREFIX as h, resolveSecretMarkers as hi, locationIconKey as hn, COMPOSER_ADDON_ID as hr, buildStreamParamsConfigSchema as ht, AlertSchema as i, isSecretClear as ii, isDefaultAppConnectionEndpoint as in, storageProviderCapability as ir, addonPagesCapability as it, DeviceStatusSchema as j, planComposition as jn, BaseAddon as jr, declarationOwnerNodeId as jt, DEVICE_TOMBSTONE_RETENTION_MS as k, parseStreamParamsFormPatch as kn, DeviceType as kr, dataStoreProviderCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, normalizeSecretOwner as li, keychainAdminCapability as ln, validateComposition as lr, backupCapability as lt, CORE_BLOCKS_ADDON_ID as m, resolveCapMount as mi, localNetworkCapability as mn, withLocationMode as mr, buildDeviceSignatureMessage as mt, AGENT_MDNS_TXT_KEYS as n, isEvent as ni, isArrayOutputSchema as nn, storageMigrationCapability as nr, StorageMigrationJobSchema as nt, BaseDevice as o, isSecretMarkerLike as oi, isObjectInput as on, streamQualityLabel as or, addonWidgetsCapability as ot, COMPOSER_RUNNER_ID as p, readinessKey as pi, lifecycleJobSchema as pn, vectorStoreCapability as pr, buildDeviceEnrollmentLink as pt, STORAGE_ADMIN_MOVED_COLLECTIONS as q, scopesAllowDeviceCap as qn, createEvent as qr, expressionContainsBuiltinCall as qt, ALL_CAPABILITY_DEFINITIONS as r, isKeychainStoredField as ri, isCollectionArrayMethod as rn, storageOccupancyCapability as rr, UserRecordSchema as rt, BatteryStatusSchema as s, makeSecretMarker as si, isVoidInput as sn, supportedRuntimes as sr, alertsCapability as st, AGENT_MDNS_SERVICE_TYPE as t, isDeviceConfigCap as ti, isAppLinkBase as tn, storageCapability as tr, StorageLocationTypeSchema as tt, CAP_NAMES_WITH_STATUS as u, parseJsonObject as ui, keychainCapability as un, validateCustomAddress as ur, bareAddonId as ut, CoreBlockSchema as v, sleep as vi, looseSchema as vn, composedDeviceRef as vr, canonicalIconKey as vt, DERIVED_CAMERA_SILENCED_CAP_NAMES as w, motionCapability as wn, createStatefulExpressionMemory as wr, coreBlockComposition as wt, DATABASE_SNAPSHOT_TIMEOUT_MS as x, transformSecretWrite as xi, memoizePinnedFfmpeg as xn, compositionItemFieldPath as xr, compositionFieldKey as xt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as y, toNodeId as yi, mayReadLocation as yn, composedDeviceStableId as yr, checkRoleAddress as yt, LegacyStorageLocationDefaultSchema as z, resolveCoreBlockEntry as zn, SECRET_CLEAR as zr, deviceStateCapability as zt };
+export { StorageCleanupJobSchema as $, splitTranslationRef as $n, expandCapMethods as $r, gbToBytes as $t, DeclaredDevices as A, pickAppLinkHub as An, errMsg as Ar, databaseSnapshotCapability as At, METHOD_ACCESS_MAP as B, resolveCoreBlockFiles as Bn, WELL_KNOWN_TAB_MAP as Br, deviceStatusCapability as Bt, DAY_NAMES as C, toSecretFieldView as Ci, modeMayWrite as Cn, compositionSourceKey as Cr, coreBlockAddonId as Ct, DEVICE_SAN_CREDENTIAL_PREFIX as D, objectInputDeclaresAddonId as Dn, DeviceFeature as Dr, coreBlocksCapability as Dt, DEVICE_NONCE_TTL_MS as E, EventCategory as Ei, normalizeUnit as En, toExpressionValue as Er, coreBlockSourceKind as Et, HUB_MDNS_SERVICE_TYPE as F, reducePoints as Fn, REDACTED_SECRET as Fr, describeComposableCaps as Ft, RecordingStatusSchema as G, runtimeStatePolicyFor as Gn, collectSecretConfigKeys as Gr, evictionPolicyOfLocation as Gt, MOTION_CLOSE_AFTER_MS as H, resolveLocationMode as Hn, asNumber as Hr, enumerateItemArrayFields as Ht, HUB_MDNS_TXT_KEYS as I, replacedFieldKeys as In, RUNTIME_DEFAULTS as Ir, deviceCredentialsCapability as It, STORAGE_ADMIN_SCOPED_BASES as J, scoreRuntimes as Jn, createEvent as Jr, extractNestedAddonId as Jt, STORAGE_ACCESS_FALLBACK as K, scopesAllowAddon as Kn, collectSecretMarkerRefs as Kr, expandContainer as Kt, KEYCHAIN_RESET_TRIGGER_ACTOR as L, resolveAppConnections as Ln, ReadinessRegistry as Lr, deviceExtensionCapability as Lt, FIRST_LEVEL_MACRO_CLASSES as M, platformProbeCapability as Mn, DATAPLANE_SECRET_HEADER as Mr, decodeVectorBase64 as Mt, FieldClaimModeSchema as N, procedureAuthKey as Nn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Nr, defineExtensionSlotProvider as Nt, DEVICE_SAN_USER_PREFIX as O, objectInputDeclaresRequiredDeviceId as On, DeviceRole as Or, createDeviceExtensionProvider as Ot, FieldClaimSchema as P, ptzAutotrackCapability as Pn, DEVICE_STATUS_METHOD as Pr, deriveBatteryPresence as Pt, SsoBridgeClaimsSchema as Q, snapshotCapability as Qn, emitReadiness as Qr, formatMinutes as Qt, LOG_LEVEL_RANK as R, resolveBucketMs as Rn, ReadinessTimeoutError as Rr, deviceManagerCapability as Rt, DATA_STORE_DATABASES as S, toNodeId as Si, metricsProviderCapability as Sn, compositionSliceKey as Sr, compositionSourceRefs as St, DEVICE_ENROLLMENT_TTL_MS as T, userError as Ti, normalizeCoreBlockWrite as Tn, disarmRoseMemory as Tr, coreBlockIdFromAddonId as Tt, NetworkTunnelStartedDataSchema as U, resolveMethodAuth as Un, asString$1 as Ur, enumerateSchemaFields as Ut, MINUTES_PER_DAY as V, resolveHubAddressRoles as Vn, asJsonObject as Vr, enumerateInferenceDevices as Vt, RECORDING_SOURCE_CAMSTACK_ADDON as W, resolveNotificationTapAddress as Wn, buildSecretRef as Wr, evaluateCompositionField as Wt, ScopedTokenSchema as X, shortHostname as Xn, defineCustomActions as Xr, foldSnapshotByFunction as Xt, STREAM_PROFILE_META as Y, settingsStoreCapability as Yn, customAction as Yr, filesystemBrowseCapability as Yt, ServerNameSchema as Z, siteZoneKey as Zn, emitDownForOwnedCaps as Zr, formatDeviceRevoker as Zt, CatalogFileSchema as _, resolveSecretMarkers as _i, logLevelAtMost as _n, cloneStatefulExpressionMemory as _r, cameraGridLayoutCapability as _t, ApiKeyRecordSchema as a, isSecretClear as ai, isLocationEnabled as an, streamCatalogCapability as ar, addonSettingsCapability as at, DATABASE_SNAPSHOT_SUFFIX as b, secretTreeFromSchema as bi, mayWriteToLocation as bn, compositionFeatureEnabled as br, composerCapability as bt, CAMERA_SWITCH_ORDER as c, isSecretRefOwnedBy as ci, kebabToCamel as cn, userManagementCapability as cr, authProviderCapability as ct, CATALOG_LANGS as d, normalizeSecretOwner as di, legacyAutoLinkIds as dn, vectorDimFromBase64 as dr, batteryCapability as dt, formatSecretScope as ei, interpolate as en, storageAdminCapability as er, StorageLocationModeSchema as et, COMPOSED_ITEM_FIXED_FIELDS as f, parseJsonObject as fi, legacyModeOf as fn, vectorIndexDimConflictError as fr, buildCapabilityLookup as ft, CalendarPreferencesSchema as g, resolveCapMount as gi, logDestinationCapability as gn, buildFfmpegArgs as gr, calendarsCapability as gt, CORE_BLOCK_ADDON_PREFIX as h, readinessKey as hi, locationIconKey as hn, COMPOSER_ADDON_ID as hr, buildStreamParamsConfigSchema as ht, AlertSchema as i, isKeychainStoredField as ii, isDefaultAppConnectionEndpoint as in, storageProviderCapability as ir, addonPagesCapability as it, DeviceStatusSchema as j, planComposition as jn, BaseAddon as jr, declarationOwnerNodeId as jt, DEVICE_TOMBSTONE_RETENTION_MS as k, parseStreamParamsFormPatch as kn, DeviceType as kr, dataStoreProviderCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, makeSecretMarker as li, keychainAdminCapability as ln, validateComposition as lr, backupCapability as lt, CORE_BLOCKS_ADDON_ID as m, parseSecretRef as mi, localNetworkCapability as mn, withLocationMode as mr, buildDeviceSignatureMessage as mt, AGENT_MDNS_TXT_KEYS as n, isDeviceConfigCap as ni, isArrayOutputSchema as nn, storageMigrationCapability as nr, StorageMigrationJobSchema as nt, BaseDevice as o, isSecretMarker as oi, isObjectInput as on, streamQualityLabel as or, addonWidgetsCapability as ot, COMPOSER_RUNNER_ID as p, parseJsonUnknown as pi, lifecycleJobSchema as pn, vectorStoreCapability as pr, buildDeviceEnrollmentLink as pt, STORAGE_ADMIN_MOVED_COLLECTIONS as q, scopesAllowDeviceCap as qn, collectZodSecretPaths as qr, expressionContainsBuiltinCall as qt, ALL_CAPABILITY_DEFINITIONS as r, isEvent as ri, isCollectionArrayMethod as rn, storageOccupancyCapability as rr, UserRecordSchema as rt, BatteryStatusSchema as s, isSecretMarkerLike as si, isVoidInput as sn, supportedRuntimes as sr, alertsCapability as st, AGENT_MDNS_SERVICE_TYPE as t, hydrateSchema as ti, isAppLinkBase as tn, storageCapability as tr, StorageLocationTypeSchema as tt, CAP_NAMES_WITH_STATUS as u, nodePin as ui, keychainCapability as un, validateCustomAddress as ur, bareAddonId as ut, CoreBlockSchema as v, scopeKey as vi, looseSchema as vn, composedDeviceRef as vr, canonicalIconKey as vt, DERIVED_CAMERA_SILENCED_CAP_NAMES as w, transformSecretWrite as wi, motionCapability as wn, createStatefulExpressionMemory as wr, coreBlockComposition as wt, DATABASE_SNAPSHOT_TIMEOUT_MS as x, sleep as xi, memoizePinnedFfmpeg as xn, compositionItemFieldPath as xr, compositionFieldKey as xt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as y, secretTreeFromPaths as yi, mayReadLocation as yn, composedDeviceStableId as yr, checkRoleAddress as yt, LegacyStorageLocationDefaultSchema as z, resolveCoreBlockEntry as zn, SECRET_CLEAR as zr, deviceStateCapability as zt };

package/dist/{dist-CyIHDLCg.js → dist-D9qT3jHr.js}

@@ -736,7 +736,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-bgZLodYc.mjs
+//#region ../types/dist/sleep-D-Q2_Mcd.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -15476,6 +15476,41 @@ function describeComposableCaps(defs, deviceType) {
 	}).toSorted((a, b) => a.cap.localeCompare(b.cap));
 }
 /**
+* The report of a one-shot "move this owner's plaintext secrets into the
+* keychain" run (D878). COUNTS only - never a value, never a ref.
+*
+* The owner runs it on its own rows, through its own write path; an operator
+* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
+* Dry run (`apply: false`) reports what WOULD move and changes nothing.
+*/
+var RawSecretMigrationInputSchema = zod.z.object({ 
+/** `false` (the default of the script) = report only. */
+apply: zod.z.boolean() });
+var RawSecretMigrationReportSchema = zod.z.object({
+	apply: zod.z.boolean(),
+	/** Rows that can carry a secret (a profile, an enrolment). */
+	rows: zod.z.number().int(),
+	/** Rows whose secret was plaintext when the run started. */
+	raw: zod.z.number().int(),
+	/** Rows that already held a keychain marker when the run started. */
+	markers: zod.z.number().int(),
+	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
+	migrated: zod.z.number().int(),
+	/** Plaintext rows left in place because the move or its read-back failed. */
+	failed: zod.z.number().int(),
+	/** After the run: rows still holding plaintext. */
+	remainingRaw: zod.z.number().int(),
+	/** After the run: markers the keychain could not resolve right now. */
+	unresolvedMarkers: zod.z.number().int(),
+	/**
+	* A second, redundant copy of the secrets' rows that the run found (and, on
+	* `apply`, deleted after verifying the first). Owners with a single copy omit it.
+	*/
+	redundantCopies: zod.z.number().int().optional(),
+	/** True when nothing is raw and every marker resolves. */
+	verified: zod.z.boolean()
+});
+/**
 * core-blocks — user-authored TypeScript, stored in the kernel and executed in
 * its own process.
 *
@@ -15839,14 +15874,16 @@ var coreBlocksCapability = {
 		/**
 		* Hydrated settings form for one block, or null until a `settingsSchema`
 		* is known (extracted from the compiled entry's named export, or set on
-		* the block). Values live in the `core-blocks:settings` collection.
+		* the block). Values live in the block addon's `addon-settings` rows (D880);
+		* a password field answers as a "set" view, never the value.
 		*/
 		getBlockSettings: method(zod.z.object({ blockId: zod.z.string() }), SettingsSchemaWithValuesSchema.nullable(), { auth: "admin" }),
 		/**
 		* Patch persisted preference values for one block. The schema is not
-		* rewritten here — only values. Scripts read the same blob via
-		* `ctx.settings.readAddonStore()` (mirrored into the block addon's
-		* `addon-settings` namespace on every patch).
+		* rewritten here — only values. Scripts read the same rows via
+		* `ctx.settings.readAddonStore()`. A field the schema declares `password` /
+		* `secret: true` is stored in the keychain (owner = the block's addon id)
+		* and the row holds a marker; a REDACTED or view value keeps the stored one.
 		*/
 		updateBlockSettings: method(zod.z.object({
 			blockId: zod.z.string(),
@@ -15856,6 +15893,16 @@ var coreBlocksCapability = {
 			auth: "admin"
 		}),
 		/**
+		* D880: move every plaintext password a block's `settingsSchema` declares
+		* into the keychain and delete the legacy `core-blocks:settings` copy. Dry
+		* run unless `apply`; idempotent; counts only. A secret is read back from
+		* the keychain before its row is rewritten.
+		*/
+		migrateRawSecrets: method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* The declaration files the editor type-checks against.
 		*
 		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
@@ -41064,36 +41111,6 @@ var llmRuntimeCapability = {
 	}
 };
 /**
-* The report of a one-shot "move this owner's plaintext secrets into the
-* keychain" run (D878). COUNTS only - never a value, never a ref.
-*
-* The owner runs it on its own rows, through its own write path; an operator
-* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
-* Dry run (`apply: false`) reports what WOULD move and changes nothing.
-*/
-var RawSecretMigrationInputSchema = zod.z.object({ 
-/** `false` (the default of the script) = report only. */
-apply: zod.z.boolean() });
-var RawSecretMigrationReportSchema = zod.z.object({
-	apply: zod.z.boolean(),
-	/** Rows that can carry a secret (a profile, an enrolment). */
-	rows: zod.z.number().int(),
-	/** Rows whose secret was plaintext when the run started. */
-	raw: zod.z.number().int(),
-	/** Rows that already held a keychain marker when the run started. */
-	markers: zod.z.number().int(),
-	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
-	migrated: zod.z.number().int(),
-	/** Plaintext rows left in place because the move or its read-back failed. */
-	failed: zod.z.number().int(),
-	/** After the run: rows still holding plaintext. */
-	remainingRaw: zod.z.number().int(),
-	/** After the run: markers the keychain could not resolve right now. */
-	unresolvedMarkers: zod.z.number().int(),
-	/** True when nothing is raw and every marker resolves. */
-	verified: zod.z.boolean()
-});
-/**
 * `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
 * methods concat-fan across providers; single-row methods route to ONE
 * provider by the `addonId` in the call input (the notification-output
@@ -74755,6 +74772,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.migrateRawSecrets": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -86840,6 +86863,12 @@ Object.defineProperty(exports, "collectSecretConfigKeys", {
 		return collectSecretConfigKeys;
 	}
 });
+Object.defineProperty(exports, "collectSecretMarkerRefs", {
+	enumerable: true,
+	get: function() {
+		return collectSecretMarkerRefs;
+	}
+});
 Object.defineProperty(exports, "collectZodSecretPaths", {
 	enumerable: true,
 	get: function() {
@@ -87230,6 +87259,12 @@ Object.defineProperty(exports, "isSecretMarkerLike", {
 		return isSecretMarkerLike;
 	}
 });
+Object.defineProperty(exports, "isSecretRefOwnedBy", {
+	enumerable: true,
+	get: function() {
+		return isSecretRefOwnedBy;
+	}
+});
 Object.defineProperty(exports, "isVoidInput", {
 	enumerable: true,
 	get: function() {
@@ -87548,6 +87583,12 @@ Object.defineProperty(exports, "secretTreeFromPaths", {
 		return secretTreeFromPaths;
 	}
 });
+Object.defineProperty(exports, "secretTreeFromSchema", {
+	enumerable: true,
+	get: function() {
+		return secretTreeFromSchema;
+	}
+});
 Object.defineProperty(exports, "settingsStoreCapability", {
 	enumerable: true,
 	get: function() {