@camstack/types 1.2.326 → 1.2.328

package/dist/addon/base-addon.d.ts

@@ -2,6 +2,7 @@ import type { ZodType } from 'zod';
 import type { AddonContext, AddonInitResult, CapabilitiesAccess, ProviderRegistration, StoredKeyRead } from '../interfaces/addon.js';
 import type { ConfigField, ConfigSection, ConfigUISchema, ConfigUISchemaWithValues } from '../interfaces/config-ui.js';
 import { type DurableState } from './durable-state.js';
+import { type UnresolvedSecret } from './secret-settings-view.js';
 export type { CapabilitiesAccess };
 /**
  * Utility type that constrains a ConfigField's `key` to only accept
@@ -108,6 +109,25 @@ export declare abstract class BaseAddon<TConfig extends object = Record<string,
     protected settingsStoreReady: boolean;
     /** Default config values. Provided via constructor. */
     protected readonly defaults: TConfig;
+    /**
+     * Hidden-state paths that hold secrets (D787) — values the addon writes
+     * itself (`updateGlobalSettings`, `state()`) that no form field declares.
+     * Stored in the keychain exactly like a `password` field. Syntax:
+     * `'snapshotSigningKey'`, `'identity.pincode'`, `'tokens[userId].accessToken'`
+     * (`key[<id field>]` addresses array items by id, never by index).
+     */
+    protected readonly secretStatePaths: readonly string[];
+    private _addonSecretTree;
+    private _deviceSecretTree;
+    /** Refs the last resolved config pointed at — a change to one re-resolves. */
+    private _configSecretRefs;
+    private _unresolvedSecrets;
+    private _secretRetryTimer;
+    private _secretRetryDelayMs;
+    private _secretChangeTimer;
+    private _secretChangeUnsub;
+    /** >0 while an OPERATOR's settings write is being applied. */
+    private _operatorWriteDepth;
     constructor(defaults: TConfig);
     /**
      * Override to opt out of the automatic `system.ready-state` emission.
@@ -269,7 +289,25 @@ export declare abstract class BaseAddon<TConfig extends object = Record<string,
      * not supported here: its stored name is scoped.
      */
     protected readStoredGlobalKey(key: string): Promise<StoredKeyRead>;
+    /**
+     * The OPERATOR's write — a settings form or an admin API call, dispatched by
+     * the kernel. Identical to {@link updateGlobalSettings}, except that a secret
+     * the operator sends is stored as sent even when it equals a pre-keychain
+     * inline value: the operator re-entering a password is a change, an addon
+     * writing back what it read is not (D787).
+     */
+    updateGlobalSettingsAsOperator(patch: Record<string, unknown>, nodeId?: string): Promise<void>;
     updateGlobalSettings(patch: Partial<TConfig>, nodeId?: string): Promise<void>;
+    /**
+     * REMOVE stored secrets — their keychain values and their markers (D787).
+     *
+     * Writing `''` to a secret field KEEPS what is stored (an empty string is
+     * what a defaults fallback writes back, and it must never destroy a
+     * credential), so code that means "forget this token" says so here. Without
+     * a keychain (an older kernel) it writes `''`, as such code always did.
+     */
+    protected clearSecrets(keys: ReadonlyArray<keyof TConfig & string>, nodeId?: string): Promise<void>;
+    private applyGlobalPatch;
     /**
      * The set of field keys the global settings schema declares `perNode: true`
      * — derived once per `cap` argument and memoized (schemas are static
@@ -366,6 +404,26 @@ export declare abstract class BaseAddon<TConfig extends object = Record<string,
     protected state<T>(key: string, schema: ZodType<T>, fallback: T): DurableState<T>;
     /** Per-device variant of {@link state}, backed by the per-device store. */
     protected deviceState<T>(deviceId: number, key: string, schema: ZodType<T>, fallback: T): DurableState<T>;
+    /** The addon store's secret tree: schema fields by TYPE, plus `secretStatePaths`. */
+    private addonSecretTree;
+    private deviceSecretTree;
+    /**
+     * Secrets of this addon's stored config that could not be resolved on the
+     * last read, with why. Non-empty means the addon is running WITHOUT them —
+     * an addon whose function needs one should report itself degraded rather
+     * than start on an empty credential.
+     */
+    protected get unresolvedSecrets(): readonly UnresolvedSecret[];
+    /**
+     * Substitute every keychain marker in a stored blob with its value. With no
+     * keychain (no `ctx.secrets`) or no marker, the blob comes back unchanged.
+     * An unresolvable value is LEFT OUT (never `''`), logged by ref — never by
+     * value — and, when the cause can pass, retried with backoff. Nothing is
+     * ever written back from here.
+     */
+    private resolveStoredSecrets;
+    /** Re-resolve the config (a keychain-only change, or a retry) and apply it. */
+    private scheduleSecretReresolve;
     /**
      * Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
      * transient settings-store outage (mid-restart of sqlite-settings, tsx-watch

package/dist/addon/secret-aware-context.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Wrap an addon context so EVERY write to its settings store goes through the
+ * keychain save path (D787) — `updateGlobalSettings`, `state()` handles, and an
+ * addon's own direct `ctx.settings.writeAddonStore` / `writeDeviceStore` calls
+ * alike. Reads stay raw (markers): a read surface never sees a value, and the
+ * runtime resolves through `BaseAddon`.
+ *
+ * A Proxy rather than a copy: an in-process context carries getters (`api`)
+ * and a spread would freeze them at wrap time; a Proxy forwards every other
+ * property untouched, including to code that spreads the context.
+ */
+import type { AddonContext } from '../interfaces/addon.js';
+import type { SecretsAccess } from '../keychain/secrets-access.js';
+import type { SecretTree } from './secret-paths.js';
+export interface SecretAwareSettingsOptions {
+    readonly secrets: SecretsAccess;
+    /** The addon store's secret tree (schema + `secretStatePaths`). */
+    readonly addonTree: () => SecretTree;
+    /** The per-device store's secret tree. */
+    readonly deviceTree: () => SecretTree;
+    /** Told about refs a write dropped but could not delete (they are now orphans). */
+    readonly onOrphaned: (refs: readonly string[]) => void;
+    /** Is the write in progress the OPERATOR's (see `SecretWriteInput.operatorWrite`)? */
+    readonly isOperatorWrite?: () => boolean;
+}
+/** The context the addon sees: identical, except that its settings writes are secret-aware. */
+export declare function withSecretAwareSettings(context: AddonContext, opts: SecretAwareSettingsOptions): AddonContext;

package/dist/addon/secret-paths.d.ts

@@ -0,0 +1,48 @@
+/**
+ * WHERE an addon's secrets live in its settings blob — derived from the
+ * field TYPE (`type: 'password'` or `secret: true`, `storage` not `'inline'`)
+ * and from the addon's declared `secretStatePaths`, NEVER from a key's name
+ * (operator decision, D787). A text field called `password` is not secret; a
+ * textarea holding a PEM key with `secret: true` is.
+ *
+ * The result is a small tree over the blob's top-level keys:
+ *  - `leaf`   — the value at this key is a secret;
+ *  - `object` — descend into a nested object (`identity.pincode`);
+ *  - `array`  — every item, matched by its id field, has secret members
+ *               (`providers[id].clientSecret`, `tokens[userId].accessToken`).
+ *
+ * `secretStatePaths` syntax: dot-separated keys, an array segment written
+ * `key[<idField>]`: `'snapshotSigningKey'`, `'identity.pincode'`,
+ * `'tokens[userId].accessToken'`.
+ */
+import type { ConfigUISchema } from '../interfaces/config-ui.js';
+import { isKeychainStoredField } from '../interfaces/config-ui-secrets.js';
+export type SecretNode = {
+    readonly kind: 'leaf';
+} | {
+    readonly kind: 'object';
+    readonly children: ReadonlyMap<string, SecretNode>;
+} | {
+    readonly kind: 'array';
+    readonly idKey: string;
+    readonly item: ReadonlyMap<string, SecretNode>;
+};
+export type SecretTree = ReadonlyMap<string, SecretNode>;
+export { isKeychainStoredField };
+/** The secret tree a settings schema declares. */
+export declare function secretTreeFromSchema(schema: ConfigUISchema | null): SecretTree;
+interface PathSegment {
+    readonly key: string;
+    /** Set when the segment is an array: the item id field. */
+    readonly idKey?: string;
+}
+/** Parse `a.b[id].c` into segments; throws on a malformed path (a declaration bug). */
+export declare function parseSecretStatePath(path: string): readonly PathSegment[];
+/** Add hidden-state paths (`secretStatePaths`) to a schema-derived tree. */
+export declare function mergeSecretStatePaths(tree: SecretTree, paths: readonly string[]): SecretTree;
+/**
+ * The tree of a DECLARED path list — a device's `secretConfigPaths`
+ * (`collectZodSecretPaths`: dotted, `[]` for array items). An array segment
+ * without a named id field is addressed by the item's `id`.
+ */
+export declare function secretTreeFromPaths(paths: readonly string[]): SecretTree;

package/dist/addon/secret-settings-view.d.ts

@@ -0,0 +1,80 @@
+/**
+ * The secret-aware half of an addon's settings store (D787).
+ *
+ * WRITE — `transformSecretWrite` rewrites a patch before it reaches the store:
+ * every secret path (see `secret-paths.ts`) is classified by
+ * `classifySecretWrite` and
+ *  - KEEP  (`''`, `null`, a marker, a UI view, a redaction token) — the stored
+ *          value stays exactly as it is; `''` NEVER clears;
+ *  - SET   (a non-empty string) — `put` into the keychain FIRST, then the
+ *          marker goes into the patch. A value equal to what the ref already
+ *          holds is not re-put;
+ *  - CLEAR (`{"$secretClear":true}` only) — the marker becomes `null`, and the
+ *          ref is deleted AFTER the blob write succeeded.
+ * Array items are matched by their id field: a reorder keeps refs, a removed
+ * row's refs are deleted after the write, a copied row's secret is "not set".
+ * Order is always put → blob → delete: a failed blob write can leave an orphan
+ * (the Secrets page collects it), never a marker pointing at nothing.
+ *
+ * STRICT: when a value cannot be stored (keychain locked or unreachable) the
+ * write is REFUSED. It never falls back to writing the plaintext into the blob,
+ * and nothing migrates plaintext silently — a blob that still holds an inline
+ * value keeps it until the operator's one-off migration.
+ *
+ * READ — `resolveSecretMarkers` substitutes every marker at any depth with its
+ * value, in ONE keychain round-trip, before the runtime config is assembled. A
+ * value that cannot be resolved is reported and left OUT (never `''`), so the
+ * caller can say so instead of starting on an empty credential.
+ */
+import type { KeychainUnavailableReason } from '../capabilities/keychain.cap.js';
+import { type SecretScope } from '../keychain/secret-ref.js';
+import type { SecretsAccess } from '../keychain/secrets-access.js';
+import type { SecretTree } from './secret-paths.js';
+/** A write to a secret path could not be stored in the keychain, so it was refused. */
+export declare class KeychainWriteRefusedError extends Error {
+    readonly fieldPath: string;
+    constructor(fieldPath: string, cause: unknown);
+}
+export interface SecretWriteInput {
+    readonly tree: SecretTree;
+    readonly secrets: SecretsAccess;
+    readonly patch: Record<string, unknown>;
+    /** The blob as stored now (markers, not values). */
+    readonly stored: Record<string, unknown>;
+    /** Scope of a non-perNode key: `global` for the addon store, `device/<id>` for a device store. */
+    readonly scope?: SecretScope;
+    readonly mintId?: () => string;
+    /**
+     * The write comes from the OPERATOR (a settings form, an admin API call),
+     * not from the addon's own code: a value equal to an inline pre-keychain one
+     * is then stored as sent — in the keychain. An addon's own write-back of an
+     * unchanged inline value keeps it inline (nothing migrates silently).
+     */
+    readonly operatorWrite?: boolean;
+}
+export interface SecretWriteResult {
+    /** The patch to write: markers in place of values. */
+    readonly patch: Record<string, unknown>;
+    /** Delete the refs this write dropped. Call ONLY after the blob write succeeded. */
+    readonly afterWrite: () => Promise<{
+        readonly orphaned: readonly string[];
+    }>;
+}
+/** Every marker ref anywhere under `value`. */
+export declare function collectSecretMarkerRefs(value: unknown, out?: string[]): string[];
+/** Rewrite a settings patch so no secret value reaches the blob. See the file doc. */
+export declare function transformSecretWrite(input: SecretWriteInput): Promise<SecretWriteResult>;
+export type UnresolvedReason = KeychainUnavailableReason | 'missing' | 'forbidden';
+export interface UnresolvedSecret {
+    readonly ref: string;
+    readonly reason: UnresolvedReason;
+}
+export interface ResolvedSecrets<T> {
+    readonly value: T;
+    readonly unresolved: readonly UnresolvedSecret[];
+}
+/**
+ * Replace every marker in `value` with its keychain value. Returns the SAME
+ * reference when there is no marker (no allocation, no keychain call).
+ */
+export declare function resolveSecretMarkers<T>(value: T, secrets: SecretsAccess): Promise<ResolvedSecrets<T>>;

package/dist/addon.d.ts

@@ -27,6 +27,7 @@ export type { IViewerUiProvider } from './capabilities/viewer-ui.cap.js';
 export { viewerUiCapability } from './capabilities/viewer-ui.cap.js';
 export { DEVICE_CHILDREN_BATCH_MAX } from './device/children-batch-max.js';
 export { DeviceType } from './device/device-type.js';
+export { collectZodSecretPaths, isZodSecret } from './device/zod-secret.js';
 export { DisposerChain } from './disposer-chain.js';
 export { PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, } from './interfaces/addon-peer-bytes.js';
 export type * from './interfaces/addon-peer-bytes.js';
@@ -45,3 +46,4 @@ export { BOOT_RECOVERY_BACKOFF_MS } from './util/boot-recovery-backoff.js';
 export { errMsg } from './utils/err-msg.js';
 export { asJsonObject, asString, parseJsonUnknown } from './utils/json-safe.js';
 export { sleep } from './utils/sleep.js';
+export * from './keychain/index.js';

package/dist/addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-DPar9AHl.js");
-const require_event_category = require("./event-category-CtBAl88K.js");
+const require_sleep = require("./sleep-i3kl-0Na.js");
+const require_event_category = require("./event-category-CHduMGvg.js");
 const require_err_msg = require("./err-msg-Dx2Kor0g.js");
 //#region src/generated/cap-input-defaults.ts
 /**
@@ -16,7 +16,7 @@ const require_err_msg = require("./err-msg-Dx2Kor0g.js");
 * Plain data, zero Zod: a forked runner must not import the schema barrel
 * (~144MB RSS per runner — D28).
 *
-* Coverage: 24 caps, 59 methods with defaults.
+* Coverage: 24 caps, 62 methods with defaults.
 */
 var CAP_INPUT_DEFAULTS = Object.freeze({
 	"addons": { "getLogs": { "limit": 100 } },
@@ -150,6 +150,14 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"headroom": .4,
 			"minSessionsPerDevice": 2
 		},
+		"getNodeBenchmarkPreflight": {
+			"phases": ["device", "pipeline"],
+			"steps": [],
+			"fpsPerStream": 10,
+			"budgetMinutes": 45,
+			"keepDownloadedModels": false,
+			"acceptInsufficientHeadroom": false
+		},
 		"getPlacementStats": { "windowMs": 36e5 },
 		"planAutoTune": {
 			"headroom": .4,
@@ -159,6 +167,14 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"nodes": {},
 			"devices": {}
 		},
+		"startNodeBenchmark": {
+			"phases": ["device", "pipeline"],
+			"steps": [],
+			"fpsPerStream": 10,
+			"budgetMinutes": 45,
+			"keepDownloadedModels": false,
+			"acceptInsufficientHeadroom": false
+		},
 		"suggestShares": {
 			"headroom": .4,
 			"source": "hardware"
@@ -183,7 +199,13 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"occupancyRecheckFrames": 4,
 			"frameSource": { "kind": "local-broker" }
 		},
-		"reportMotion": { "source": "analyzer" }
+		"reportMotion": { "source": "analyzer" },
+		"startNodeBench": {
+			"steps": [],
+			"settleSec": 5,
+			"measureSec": 20,
+			"keepDownloadedModels": false
+		}
 	},
 	"recording-archive": {
 		"renderClip": {
@@ -403,31 +425,59 @@ exports.DEVICE_SCOPED_CAPS = require_sleep.DEVICE_SCOPED_CAPS;
 exports.DeviceType = require_err_msg.DeviceType;
 exports.DisposerChain = require_sleep.DisposerChain;
 exports.EventCategory = require_event_category.EventCategory;
+exports.MIN_SCRUBBED_LENGTH = require_sleep.MIN_SCRUBBED_LENGTH;
 exports.PEER_BYTES_CHUNK_BYTES = require_sleep.PEER_BYTES_CHUNK_BYTES;
 exports.PEER_BYTES_MAX_OUTSTANDING = require_sleep.PEER_BYTES_MAX_OUTSTANDING;
 exports.PEER_BYTES_STALL_MS = require_sleep.PEER_BYTES_STALL_MS;
 exports.PEER_BYTES_TICKET_TTL_MS = require_sleep.PEER_BYTES_TICKET_TTL_MS;
 exports.PROVIDER_OPTIONAL_METHODS = PROVIDER_OPTIONAL_METHODS;
+exports.REVALIDATE_AFTER_MS = require_sleep.REVALIDATE_AFTER_MS;
 exports.ReadinessRegistry = require_sleep.ReadinessRegistry;
 exports.ReadinessTimeoutError = require_sleep.ReadinessTimeoutError;
+exports.SECRET_CLEAR = require_sleep.SECRET_CLEAR;
+exports.SECRET_REF_SCHEME = require_sleep.SECRET_REF_SCHEME;
 exports.adminUiCapability = require_sleep.adminUiCapability;
+exports.arrayItemFieldPath = require_sleep.arrayItemFieldPath;
 exports.asJsonObject = require_sleep.asJsonObject;
 exports.asString = require_sleep.asString;
+exports.buildSecretRef = require_sleep.buildSecretRef;
+exports.classifySecretWrite = require_sleep.classifySecretWrite;
+exports.clearKnownSecrets = require_sleep.clearKnownSecrets;
+exports.collectZodSecretPaths = require_sleep.collectZodSecretPaths;
 exports.createDeviceProxy = require_sleep.createDeviceProxy;
 exports.createEventBusSliceSource = require_sleep.createEventBusSliceSource;
+exports.createSecretsAccess = require_sleep.createSecretsAccess;
 exports.describeCustomActions = require_sleep.describeCustomActions;
 exports.deviceOpsCapability = require_sleep.deviceOpsCapability;
 exports.emitReadiness = require_sleep.emitReadiness;
 exports.errMsg = require_err_msg.errMsg;
 exports.expandCapMethods = require_sleep.expandCapMethods;
+exports.forgetKnownSecret = require_sleep.forgetKnownSecret;
+exports.formatSecretScope = require_sleep.formatSecretScope;
+exports.globalSecretScope = require_sleep.globalSecretScope;
 exports.isCollectionArrayMethodName = isCollectionArrayMethodName;
 exports.isDeviceScopedCap = require_sleep.isDeviceScopedCap;
 exports.isProviderOptionalMethodName = isProviderOptionalMethodName;
+exports.isSecretClear = require_sleep.isSecretClear;
+exports.isSecretFieldView = require_sleep.isSecretFieldView;
+exports.isSecretMarker = require_sleep.isSecretMarker;
+exports.isSecretMarkerLike = require_sleep.isSecretMarkerLike;
+exports.isSecretRef = require_sleep.isSecretRef;
+exports.isZodSecret = require_sleep.isZodSecret;
+exports.knownSecretCount = require_sleep.knownSecretCount;
+exports.makeSecretMarker = require_sleep.makeSecretMarker;
 exports.nodePin = require_sleep.nodePin;
 exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
+exports.normalizeSecretOwner = require_sleep.normalizeSecretOwner;
 exports.parseJsonUnknown = require_sleep.parseJsonUnknown;
+exports.parseSecretRef = require_sleep.parseSecretRef;
 exports.readNodePin = require_sleep.readNodePin;
+exports.registerKnownSecret = require_sleep.registerKnownSecret;
+exports.resolveSecretViewsIn = require_sleep.resolveSecretViewsIn;
 exports.scopeKey = require_sleep.scopeKey;
+exports.scrubKnownSecrets = require_sleep.scrubKnownSecrets;
+exports.shortSecretRefHash = require_sleep.shortSecretRefHash;
 exports.sleep = require_sleep.sleep;
+exports.toSecretFieldView = require_sleep.toSecretFieldView;
 exports.viewerUiCapability = require_sleep.viewerUiCapability;
 exports.withCapInputDefaults = withCapInputDefaults;

package/dist/addon.mjs

@@ -1,5 +1,5 @@
-import { B as nodePin, Ct as DisposerChain, D as adminUiCapability, N as expandCapMethods, S as DEVICE_CHILDREN_BATCH_MAX, T as describeCustomActions, Tt as normalizeAddonInitResult, U as ReadinessRegistry, V as readNodePin, W as ReadinessTimeoutError, _t as PEER_BYTES_MAX_OUTSTANDING, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, gt as PEER_BYTES_CHUNK_BYTES, h as createEventBusSliceSource, kt as emitReadiness, m as createDeviceProxy, p as isDeviceScopedCap, q as scopeKey, s as asString, t as sleep, u as parseJsonUnknown, vt as PEER_BYTES_STALL_MS, wt as BaseAddon, x as viewerUiCapability, xt as DATAPLANE_SECRET_HEADER, yt as PEER_BYTES_TICKET_TTL_MS } from "./sleep-BNeXenvr.mjs";
-import { t as EventCategory } from "./event-category-B_0XEcLF.mjs";
+import { $t as normalizeSecretOwner, A as adminUiCapability, At as PEER_BYTES_MAX_OUTSTANDING, C as deviceOpsCapability, Ct as clearKnownSecrets, Dt as scrubKnownSecrets, Et as registerKnownSecret, I as expandCapMethods, It as DisposerChain, Jt as arrayItemFieldPath, K as ReadinessRegistry, Lt as BaseAddon, Mt as PEER_BYTES_TICKET_TTL_MS, O as describeCustomActions, Ot as shortSecretRefHash, Pt as DATAPLANE_SECRET_HEADER, Qt as isSecretRef, Rt as normalizeAddonInitResult, St as MIN_SCRUBBED_LENGTH, T as DEVICE_CHILDREN_BATCH_MAX, Tt as knownSecretCount, U as nodePin, W as readNodePin, X as scopeKey, Xt as formatSecretScope, Yt as buildSecretRef, Zt as globalSecretScope, _n as isSecretMarkerLike, a as asJsonObject, b as collectZodSecretPaths, bt as REVALIDATE_AFTER_MS, d as BOOT_RECOVERY_BACKOFF_MS, en as parseSecretRef, f as DEVICE_SCOPED_CAPS, fn as SECRET_CLEAR, gn as isSecretMarker, h as createEventBusSliceSource, hn as isSecretFieldView, in as emitReadiness, jt as PEER_BYTES_STALL_MS, kt as PEER_BYTES_CHUNK_BYTES, m as createDeviceProxy, mn as isSecretClear, p as isDeviceScopedCap, pn as classifySecretWrite, q as ReadinessTimeoutError, qt as SECRET_REF_SCHEME, s as asString, t as sleep, u as parseJsonUnknown, vn as makeSecretMarker, w as viewerUiCapability, wt as forgetKnownSecret, x as isZodSecret, xt as createSecretsAccess, yn as toSecretFieldView, yt as resolveSecretViewsIn } from "./sleep-Cr5YOk3m.mjs";
+import { t as EventCategory } from "./event-category-DaIZi00R.mjs";
 import { a as DeviceType, t as errMsg } from "./err-msg-DX6i_MY4.mjs";
 //#region src/generated/cap-input-defaults.ts
 /**
@@ -15,7 +15,7 @@ import { a as DeviceType, t as errMsg } from "./err-msg-DX6i_MY4.mjs";
 * Plain data, zero Zod: a forked runner must not import the schema barrel
 * (~144MB RSS per runner — D28).
 *
-* Coverage: 24 caps, 59 methods with defaults.
+* Coverage: 24 caps, 62 methods with defaults.
 */
 var CAP_INPUT_DEFAULTS = Object.freeze({
 	"addons": { "getLogs": { "limit": 100 } },
@@ -149,6 +149,14 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"headroom": .4,
 			"minSessionsPerDevice": 2
 		},
+		"getNodeBenchmarkPreflight": {
+			"phases": ["device", "pipeline"],
+			"steps": [],
+			"fpsPerStream": 10,
+			"budgetMinutes": 45,
+			"keepDownloadedModels": false,
+			"acceptInsufficientHeadroom": false
+		},
 		"getPlacementStats": { "windowMs": 36e5 },
 		"planAutoTune": {
 			"headroom": .4,
@@ -158,6 +166,14 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"nodes": {},
 			"devices": {}
 		},
+		"startNodeBenchmark": {
+			"phases": ["device", "pipeline"],
+			"steps": [],
+			"fpsPerStream": 10,
+			"budgetMinutes": 45,
+			"keepDownloadedModels": false,
+			"acceptInsufficientHeadroom": false
+		},
 		"suggestShares": {
 			"headroom": .4,
 			"source": "hardware"
@@ -182,7 +198,13 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"occupancyRecheckFrames": 4,
 			"frameSource": { "kind": "local-broker" }
 		},
-		"reportMotion": { "source": "analyzer" }
+		"reportMotion": { "source": "analyzer" },
+		"startNodeBench": {
+			"steps": [],
+			"settleSec": 5,
+			"measureSec": 20,
+			"keepDownloadedModels": false
+		}
 	},
 	"recording-archive": {
 		"renderClip": {
@@ -392,4 +414,4 @@ function isProviderOptionalMethodName(capName, method) {
 	return methods !== void 0 && methods.includes(method);
 }
 //#endregion
-export { BOOT_RECOVERY_BACKOFF_MS, BaseAddon, CAP_INPUT_DEFAULTS, COLLECTION_ARRAY_METHODS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DEVICE_SCOPED_CAPS, DeviceType, DisposerChain, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, PROVIDER_OPTIONAL_METHODS, ReadinessRegistry, ReadinessTimeoutError, adminUiCapability, asJsonObject, asString, createDeviceProxy, createEventBusSliceSource, describeCustomActions, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, isCollectionArrayMethodName, isDeviceScopedCap, isProviderOptionalMethodName, nodePin, normalizeAddonInitResult, parseJsonUnknown, readNodePin, scopeKey, sleep, viewerUiCapability, withCapInputDefaults };
+export { BOOT_RECOVERY_BACKOFF_MS, BaseAddon, CAP_INPUT_DEFAULTS, COLLECTION_ARRAY_METHODS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DEVICE_SCOPED_CAPS, DeviceType, DisposerChain, EventCategory, MIN_SCRUBBED_LENGTH, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, PROVIDER_OPTIONAL_METHODS, REVALIDATE_AFTER_MS, ReadinessRegistry, ReadinessTimeoutError, SECRET_CLEAR, SECRET_REF_SCHEME, adminUiCapability, arrayItemFieldPath, asJsonObject, asString, buildSecretRef, classifySecretWrite, clearKnownSecrets, collectZodSecretPaths, createDeviceProxy, createEventBusSliceSource, createSecretsAccess, describeCustomActions, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, forgetKnownSecret, formatSecretScope, globalSecretScope, isCollectionArrayMethodName, isDeviceScopedCap, isProviderOptionalMethodName, isSecretClear, isSecretFieldView, isSecretMarker, isSecretMarkerLike, isSecretRef, isZodSecret, knownSecretCount, makeSecretMarker, nodePin, normalizeAddonInitResult, normalizeSecretOwner, parseJsonUnknown, parseSecretRef, readNodePin, registerKnownSecret, resolveSecretViewsIn, scopeKey, scrubKnownSecrets, shortSecretRefHash, sleep, toSecretFieldView, viewerUiCapability, withCapInputDefaults };

package/dist/capabilities/addon-routes.cap.d.ts

@@ -37,9 +37,9 @@ export declare const addonRoutesCapability: {
     readonly methods: {
         readonly getRoutes: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodArray<z.ZodObject<{
             method: z.ZodEnum<{
-                GET: "GET";
-                POST: "POST";
                 PUT: "PUT";
+                POST: "POST";
+                GET: "GET";
                 DELETE: "DELETE";
                 PATCH: "PATCH";
             }>;

package/dist/capabilities/addons.cap.d.ts

@@ -16,9 +16,9 @@ import { type InferProvider } from './capability-definition.js';
  * as every other cap.
  */
 declare const LogLevelSchema: z.ZodEnum<{
+    info: "info";
     error: "error";
     debug: "debug";
-    info: "info";
     warn: "warn";
 }>;
 declare const ChannelSchema: z.ZodEnum<{
@@ -386,9 +386,9 @@ export declare const addonsCapability: {
             addonId: z.ZodString;
             limit: z.ZodDefault<z.ZodNumber>;
             level: z.ZodOptional<z.ZodEnum<{
+                info: "info";
                 error: "error";
                 debug: "debug";
-                info: "info";
                 warn: "warn";
             }>>;
         }, z.core.$strip>, z.ZodArray<z.ZodUnknown>, import("./capability-definition.js").CapabilityMethodKind>;
@@ -601,8 +601,8 @@ export declare const addonsCapability: {
         }, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
             addonId: z.ZodString;
             mode: z.ZodEnum<{
-                singleton: "singleton";
                 collection: "collection";
+                singleton: "singleton";
             }>;
             isActive: z.ZodBoolean;
         }, z.core.$strip>>>, import("./capability-definition.js").CapabilityMethodKind>;
@@ -888,9 +888,9 @@ export declare const addonsCapability: {
         readonly onAddonLogs: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             addonId: z.ZodString;
             level: z.ZodOptional<z.ZodEnum<{
+                info: "info";
                 error: "error";
                 debug: "debug";
-                info: "info";
                 warn: "warn";
             }>>;
         }, z.core.$strip>, z.ZodObject<{

package/dist/capabilities/alerts.cap.d.ts

@@ -8,9 +8,9 @@
 import { z } from 'zod';
 import { type InferProvider } from './capability-definition.js';
 export declare const AlertSeveritySchema: z.ZodEnum<{
+    info: "info";
     success: "success";
     error: "error";
-    info: "info";
     warning: "warning";
 }>;
 export declare const AlertStatusSchema: z.ZodEnum<{
@@ -28,9 +28,9 @@ export declare const AlertSchema: z.ZodObject<{
     id: z.ZodString;
     category: z.ZodString;
     severity: z.ZodEnum<{
+        info: "info";
         success: "success";
         error: "error";
-        info: "info";
         warning: "warning";
     }>;
     title: z.ZodString;
@@ -64,9 +64,9 @@ export declare const alertsCapability: {
             id: z.ZodString;
             category: z.ZodString;
             severity: z.ZodEnum<{
+                info: "info";
                 success: "success";
                 error: "error";
-                info: "info";
                 warning: "warning";
             }>;
             title: z.ZodString;
@@ -94,9 +94,9 @@ export declare const alertsCapability: {
                 id: z.ZodOptional<z.ZodString>;
                 category: z.ZodOptional<z.ZodString>;
                 severity: z.ZodOptional<z.ZodEnum<{
+                    info: "info";
                     success: "success";
                     error: "error";
-                    info: "info";
                     warning: "warning";
                 }>>;
                 title: z.ZodOptional<z.ZodString>;
@@ -126,9 +126,9 @@ export declare const alertsCapability: {
             id: z.ZodString;
             category: z.ZodString;
             severity: z.ZodEnum<{
+                info: "info";
                 success: "success";
                 error: "error";
-                info: "info";
                 warning: "warning";
             }>;
             title: z.ZodString;

package/dist/capabilities/control.cap.d.ts

@@ -25,10 +25,10 @@ import { DeviceType } from '../device/device-type.js';
  * separate `sourceInfo` or device-config blob for these values.
  */
 export declare const ControlKindSchema: z.ZodEnum<{
-    datetime: "datetime";
     text: "text";
-    numeric: "numeric";
     select: "select";
+    datetime: "datetime";
+    numeric: "numeric";
 }>;
 export type ControlKind = z.infer<typeof ControlKindSchema>;
 /**
@@ -53,10 +53,10 @@ export type ControlKind = z.infer<typeof ControlKindSchema>;
  */
 export declare const ControlStatusSchema: z.ZodObject<{
     kind: z.ZodEnum<{
-        datetime: "datetime";
         text: "text";
-        numeric: "numeric";
         select: "select";
+        datetime: "datetime";
+        numeric: "numeric";
     }>;
     value: z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>;
     options: z.ZodArray<z.ZodString>;
@@ -67,8 +67,8 @@ export declare const ControlStatusSchema: z.ZodObject<{
     step: z.ZodOptional<z.ZodNumber>;
     precision: z.ZodOptional<z.ZodNumber>;
     format: z.ZodOptional<z.ZodEnum<{
-        date: "date";
         datetime: "datetime";
+        date: "date";
         time: "time";
     }>>;
 }, z.core.$strip>;
@@ -114,10 +114,10 @@ export declare const controlCapability: {
     readonly status: {
         readonly schema: z.ZodObject<{
             kind: z.ZodEnum<{
-                datetime: "datetime";
                 text: "text";
-                numeric: "numeric";
                 select: "select";
+                datetime: "datetime";
+                numeric: "numeric";
             }>;
             value: z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>;
             options: z.ZodArray<z.ZodString>;
@@ -128,8 +128,8 @@ export declare const controlCapability: {
             step: z.ZodOptional<z.ZodNumber>;
             precision: z.ZodOptional<z.ZodNumber>;
             format: z.ZodOptional<z.ZodEnum<{
-                date: "date";
                 datetime: "datetime";
+                date: "date";
                 time: "time";
             }>>;
         }, z.core.$strip>;
@@ -142,10 +142,10 @@ export declare const controlCapability: {
      */
     readonly runtimeState: z.ZodObject<{
         kind: z.ZodEnum<{
-            datetime: "datetime";
             text: "text";
-            numeric: "numeric";
             select: "select";
+            datetime: "datetime";
+            numeric: "numeric";
         }>;
         value: z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>;
         options: z.ZodArray<z.ZodString>;
@@ -156,8 +156,8 @@ export declare const controlCapability: {
         step: z.ZodOptional<z.ZodNumber>;
         precision: z.ZodOptional<z.ZodNumber>;
         format: z.ZodOptional<z.ZodEnum<{
-            date: "date";
             datetime: "datetime";
+            date: "date";
             time: "time";
         }>>;
     }, z.core.$strip>;