@camstack/types 1.2.377 → 1.2.378

package/dist/addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-Dq0Uyeh0.js");
-const require_event_category = require("./event-category-T43rdQWR.js");
+const require_sleep = require("./sleep-gxUz0C9M.js");
+const require_event_category = require("./event-category-Hoe-mqbd.js");
 const require_err_msg = require("./err-msg-Bb-s4Xuj.js");
 //#region src/generated/cap-input-defaults.ts
 /**

package/dist/addon.mjs

@@ -1,5 +1,5 @@
-import { $t as normalizeAddonInitResult, An as isSecretFieldView, Bt as registerKnownSecret, D as collectZodSecretPaths, Dn as SECRET_CLEAR, F as viewerUiCapability, Ft as createSecretsAccess, Gt as PEER_BYTES_STALL_MS, Ht as shortSecretRefHash, I as DEVICE_CHILDREN_BATCH_MAX, It as MIN_SCRUBBED_LENGTH, Jt as DATAPLANE_SECRET_HEADER, Kt as PEER_BYTES_TICKET_TTL_MS, Lt as clearKnownSecrets, Mn as isSecretMarkerLike, Nn as makeSecretMarker, Nt as resolveSecretViewsIn, O as isZodSecret, On as classifySecretWrite, P as deviceOpsCapability, Pn as toSecretFieldView, Pt as REVALIDATE_AFTER_MS, Rt as forgetKnownSecret, S as createEventBusSliceSource, Ut as PEER_BYTES_CHUNK_BYTES, V as adminUiCapability, Vt as scrubKnownSecrets, Wt as PEER_BYTES_MAX_OUTSTANDING, Xt as DisposerChain, Y as expandCapMethods, Zt as BaseAddon, _ as readErrorI18n, at as MODEL_FORMATS, b as isDeviceScopedCap, c as asString, cn as SECRET_REF_SCHEME, d as parseJsonUnknown, dn as formatSecretScope, f as hfModelUrl, fn as globalSecretScope, g as ErrorI18nPayloadSchema, hn as parseSecretRef, j as HF_REPO, jn as isSecretMarker, kn as isSecretClear, ln as arrayItemFieldPath, mn as normalizeSecretOwner, nt as nodePin, o as asJsonObject, ot as ReadinessRegistry, p as BOOT_RECOVERY_BACKOFF_MS, pn as isSecretRef, r as maskUrlCredentials, rt as readNodePin, st as ReadinessTimeoutError, t as sleep, un as buildSecretRef, ut as scopeKey, vn as createEvent, x as createDeviceProxy, y as DEVICE_SCOPED_CAPS, yn as emitReadiness, z as describeCustomActions, zt as knownSecretCount } from "./sleep-bwsTj221.mjs";
-import { t as EventCategory } from "./event-category-C4hVnRo8.mjs";
+import { $t as normalizeAddonInitResult, An as isSecretFieldView, Bt as registerKnownSecret, D as collectZodSecretPaths, Dn as SECRET_CLEAR, F as viewerUiCapability, Ft as createSecretsAccess, Gt as PEER_BYTES_STALL_MS, Ht as shortSecretRefHash, I as DEVICE_CHILDREN_BATCH_MAX, It as MIN_SCRUBBED_LENGTH, Jt as DATAPLANE_SECRET_HEADER, Kt as PEER_BYTES_TICKET_TTL_MS, Lt as clearKnownSecrets, Mn as isSecretMarkerLike, Nn as makeSecretMarker, Nt as resolveSecretViewsIn, O as isZodSecret, On as classifySecretWrite, P as deviceOpsCapability, Pn as toSecretFieldView, Pt as REVALIDATE_AFTER_MS, Rt as forgetKnownSecret, S as createEventBusSliceSource, Ut as PEER_BYTES_CHUNK_BYTES, V as adminUiCapability, Vt as scrubKnownSecrets, Wt as PEER_BYTES_MAX_OUTSTANDING, Xt as DisposerChain, Y as expandCapMethods, Zt as BaseAddon, _ as readErrorI18n, at as MODEL_FORMATS, b as isDeviceScopedCap, c as asString, cn as SECRET_REF_SCHEME, d as parseJsonUnknown, dn as formatSecretScope, f as hfModelUrl, fn as globalSecretScope, g as ErrorI18nPayloadSchema, hn as parseSecretRef, j as HF_REPO, jn as isSecretMarker, kn as isSecretClear, ln as arrayItemFieldPath, mn as normalizeSecretOwner, nt as nodePin, o as asJsonObject, ot as ReadinessRegistry, p as BOOT_RECOVERY_BACKOFF_MS, pn as isSecretRef, r as maskUrlCredentials, rt as readNodePin, st as ReadinessTimeoutError, t as sleep, un as buildSecretRef, ut as scopeKey, vn as createEvent, x as createDeviceProxy, y as DEVICE_SCOPED_CAPS, yn as emitReadiness, z as describeCustomActions, zt as knownSecretCount } from "./sleep-bgZLodYc.mjs";
+import { t as EventCategory } from "./event-category-BvOFi6PY.mjs";
 import { a as DeviceType, t as errMsg } from "./err-msg--2RrYiLO.mjs";
 //#region src/generated/cap-input-defaults.ts
 /**

package/dist/capabilities/addons.cap.d.ts

@@ -59,6 +59,7 @@ declare const AddonListItemSchema: z.ZodObject<{
         pid: z.ZodOptional<z.ZodNumber>;
         mode: z.ZodString;
         state: z.ZodString;
+        reason: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     hasBackup: z.ZodOptional<z.ZodBoolean>;
     health: z.ZodOptional<z.ZodNullable<z.ZodObject<{
@@ -371,6 +372,7 @@ export declare const addonsCapability: {
                 pid: z.ZodOptional<z.ZodNumber>;
                 mode: z.ZodString;
                 state: z.ZodString;
+                reason: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>>;
             hasBackup: z.ZodOptional<z.ZodBoolean>;
             health: z.ZodOptional<z.ZodNullable<z.ZodObject<{

package/dist/capabilities/index.d.ts

@@ -75,6 +75,7 @@ export { filesystemBrowseCapability, type IFilesystemBrowseProvider, } from './f
 export { AUTOMATIC_HUB_ADDRESS_FLAGS, checkRoleAddress, HUB_ADDRESS_ROLES, type HubAddressCheck, type HubAddressFlags, type HubAddressRole, type HubAddressRoleResolution, type HubAddressRoles, type HubAddressSource, type HubAppConnectionsResolution, HUB_MDNS_QUERY_NAME, HUB_MDNS_ROLE, HUB_MDNS_SERVICE_TYPE, HUB_MDNS_TXT_KEYS, AGENT_MDNS_QUERY_NAME, AGENT_MDNS_SERVICE_TYPE, AGENT_MDNS_TXT_KEYS, hubAddressHostname, isDefaultAppConnectionEndpoint, isSingleHubAddressRole, PUBLIC_ENDPOINT_HTTP_REASON, resolveAppConnections, resolveHubAddressRoles, resolveInternalAddress, resolveNotificationTapAddress, resolvePublicEndpoint, SINGLE_HUB_ADDRESS_ROLES, type SingleHubAddressRole, selectAppConnectionEndpoints, validateCustomAddress, } from './hub-address.js';
 export { addonCatalogHref } from './addon-catalog-href.js';
 export { type HfModelResolution, HfModelResolutionSchema, type ILlmProvider, type LlmDefault, LlmDefaultSchema, type LlmDefaultSelector, LlmDefaultSelectorSchema, type LlmProfile, type LlmProfileKind, type LlmProfileKindDescriptor, LlmProfileKindDescriptorSchema, LlmProfileKindSchema, LlmProfileSchema, type LlmRuntimeNode, LlmRuntimeNodeSchema, type LlmUsageRollup, LlmUsageRollupSchema, llmCapability, type ManagedModelCatalogEntry, ManagedModelCatalogEntrySchema, } from './llm.cap.js';
+export { type RawSecretMigrationInput, RawSecretMigrationInputSchema, type RawSecretMigrationReport, RawSecretMigrationReportSchema, } from './raw-secret-migration.js';
 export { type AppleFmAvailability, AppleFmAvailabilitySchema, type AppleFmUnavailableReason, AppleFmUnavailableReasonSchema, type ILlmRuntimeProvider, type LlmDownloadProgress, LlmDownloadProgressSchema, type LlmNodeModel, LlmNodeModelSchema, type LlmRuntimeAppleCompleteInput, LlmRuntimeAppleCompleteInputSchema, type LlmRuntimeCancelInput, LlmRuntimeCancelInputSchema, type LlmRuntimeCompleteInput, LlmRuntimeCompleteInputSchema, type LlmRuntimeDiskUsage, LlmRuntimeDiskUsageSchema, type LlmRuntimeStatus, LlmRuntimeStatusSchema, llmRuntimeCapability, type ManagedModelExtraFile, ManagedModelExtraFileSchema, type ManagedModelRef, ManagedModelRefSchema, type ManagedRuntimeConfig, ManagedRuntimeConfigSchema, } from './llm-runtime.cap.js';
 export { type LlmErrorCode, LlmErrorCodeSchema, type LlmGenerateBaseInput, LlmGenerateBaseInputSchema, type LlmGenerateErr, LlmGenerateErrSchema, type LlmGenerateOk, LlmGenerateOkSchema, type LlmGenerateResult, LlmGenerateResultSchema, type LlmImage, LlmImageSchema, type LlmRefusalSource, LlmRefusalSourceSchema, type LlmRetryPolicy, LlmRetryPolicySchema, LlmTimeoutDefaults, type LlmUsage, LlmUsageSchema, } from './llm-shared.js';
 export type { ILoadContributionProvider, LoadContribution, LoadContributionAttribution, LoadContributionRole, } from './load-contribution.cap.js';
@@ -112,7 +113,7 @@ export { CameraMetricsSchema, CameraMetricsWithDeviceIdSchema, OrchestratorMetri
 export type { AudioStreamPick, CameraStream, CamProfile, CamStreamKind, DecodedAudioChunkWire, ProfileRtspEntry, ProfileSlot, ProfileSlotStatus, SubscribeAudioChunksInput, SubscribeAudioChunksResult, } from './schemas/streaming-shared.js';
 export { AudioChunkFormatSchema, AudioStreamPickSchema, BrokerStatsSchema, BrokerStatusSchema, CAM_PROFILE_ORDER, CameraStreamSchema, CamProfileSchema, CamStreamKindSchema, CamStreamResolutionSchema, DecodedAudioChunkSchema, FrameHandleSchema, makeProfileBrokerId, makeSourceBrokerId, ProfileRtspEntrySchema, ProfileSlotSchema, ProfileSlotStatusSchema, parseProfileBrokerId, StreamSourceEntrySchema, StreamSourceSchema, SubscribeAudioChunksInputSchema, SubscribeAudioChunksResultSchema, selectAssignedProfileSlots, } from './schemas/streaming-shared.js';
 export { buildEventKindDescriptor, EVENT_KIND_BY_CAP, EVENTFUL_CAP_NAMES, type SensorEventKindDescriptor, } from './sensor-event-kinds.js';
-export { type ImageContract, ImageContractSchema, type ImageContractState, ImageContractStateSchema, type IServerManagementProvider, type ServerBootMode, ServerBootModeSchema, type ServerPackageStatus, ServerPackageStatusSchema, type ServerRollbackInfo, ServerRollbackInfoSchema, type ServerUpdateActionResult, ServerUpdateActionResultSchema, type ServerUpdateCheckResult, ServerUpdateCheckResultSchema, type ServerUpdateOutcome, ServerUpdateOutcomeSchema, type ServerUpdateState, ServerUpdateStateSchema, serverManagementCapability, type WrapperEvidence, WrapperEvidenceSchema, type WrapperIdentity, WrapperIdentitySchema, type WrapperKind, WrapperKindSchema, } from './server-management.cap.js';
+export { type ImageContract, ImageContractSchema, type ImageContractState, ImageContractStateSchema, type IServerManagementProvider, type RunnerBootCheck, RunnerBootCheckSchema, type RunnerRefusal, RunnerRefusalSchema, type ServerBootMode, ServerBootModeSchema, type ServerPackageStatus, ServerPackageStatusSchema, type ServerRollbackInfo, ServerRollbackInfoSchema, type ServerUpdateActionResult, ServerUpdateActionResultSchema, type ServerUpdateCheckResult, ServerUpdateCheckResultSchema, type ServerUpdateOutcome, ServerUpdateOutcomeSchema, type ServerUpdateState, ServerUpdateStateSchema, serverManagementCapability, type UpdateBlocker, UpdateBlockerSchema, type WrapperEvidence, WrapperEvidenceSchema, type WrapperIdentity, WrapperIdentitySchema, type WrapperKind, WrapperKindSchema, } from './server-management.cap.js';
 export { type BulkRecord, BulkRecordSchema, type CollectionColumn, CollectionColumnSchema, type CollectionIndex, CollectionIndexSchema, DATA_STORE_DATABASES, type DataStoreDatabase, DataStoreDatabaseSchema, type DeclareCollectionInput, DeclareCollectionInputSchema, type ISettingsStoreProvider, type MutationFilter, MutationFilterSchema, QueryFilterSchema, SettingsRecordSchema, type SettingsStoreClient, settingsStoreCapability, } from './settings-store.cap.js';
 export type { ISmtpProvider } from './smtp-provider.cap.js';
 export { SendEmailInputSchema, SendEmailResultSchema, SmtpStatusSchema, smtpProviderCapability, } from './smtp-provider.cap.js';

package/dist/capabilities/llm.cap.d.ts

@@ -706,6 +706,25 @@ export declare const llmCapability: {
                 nodeId: z.ZodString;
             }, z.core.$strip>>;
         }, z.core.$strip>, "mutation">;
+        /**
+         * D878: move every profile's plaintext `apiKey` into the keychain (owner
+         * `ai`), leaving a marker in the row. Dry run unless `apply`; idempotent;
+         * counts only. The plaintext is cleared only after the keychain read-back
+         * matched.
+         */
+        readonly migrateRawSecrets: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            apply: z.ZodBoolean;
+        }, z.core.$strip>, z.ZodObject<{
+            apply: z.ZodBoolean;
+            rows: z.ZodNumber;
+            raw: z.ZodNumber;
+            markers: z.ZodNumber;
+            migrated: z.ZodNumber;
+            failed: z.ZodNumber;
+            remainingRaw: z.ZodNumber;
+            unresolvedMarkers: z.ZodNumber;
+            verified: z.ZodBoolean;
+        }, z.core.$strip>, "mutation">;
         readonly deleteProfile: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             addonId: z.ZodString;
             profileId: z.ZodString;

package/dist/capabilities/raw-secret-migration.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The report of a one-shot "move this owner's plaintext secrets into the
+ * keychain" run (D878). COUNTS only - never a value, never a ref.
+ *
+ * The owner runs it on its own rows, through its own write path; an operator
+ * script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
+ * Dry run (`apply: false`) reports what WOULD move and changes nothing.
+ */
+import { z } from 'zod';
+export declare const RawSecretMigrationInputSchema: z.ZodObject<{
+    apply: z.ZodBoolean;
+}, z.core.$strip>;
+export type RawSecretMigrationInput = z.infer<typeof RawSecretMigrationInputSchema>;
+export declare const RawSecretMigrationReportSchema: z.ZodObject<{
+    apply: z.ZodBoolean;
+    rows: z.ZodNumber;
+    raw: z.ZodNumber;
+    markers: z.ZodNumber;
+    migrated: z.ZodNumber;
+    failed: z.ZodNumber;
+    remainingRaw: z.ZodNumber;
+    unresolvedMarkers: z.ZodNumber;
+    verified: z.ZodBoolean;
+}, z.core.$strip>;
+export type RawSecretMigrationReport = z.infer<typeof RawSecretMigrationReportSchema>;

package/dist/capabilities/server-management.cap.d.ts

@@ -203,6 +203,36 @@ declare const ServerRollbackInfoSchema: z.ZodObject<{
     atMs: z.ZodNumber;
     reason: z.ZodString;
 }, z.core.$strip>;
+/**
+ * The runner boot check (D877): the runners this node PLANNED (hub: one per
+ * `resolveRunnerId` over its forked addons; agent: the runners its process
+ * service holds, because only the hub plans) against the states the process
+ * service reports. Kept in memory, recomputed by the same one-shot check after
+ * every boot, served on `getServerPackageStatus`.
+ *
+ * `failed` is the D6 breaker's terminal state, `refused` a deterministic Init
+ * refusal (an addon that said "I will not start, and here is why"), `missing` a
+ * planned runner the process service has no entry for.
+ */
+declare const RunnerRefusalSchema: z.ZodObject<{
+    runnerId: z.ZodString;
+    addonIds: z.ZodArray<z.ZodString>;
+    reason: z.ZodString;
+}, z.core.$strip>;
+declare const RunnerBootCheckSchema: z.ZodObject<{
+    checkedAtMs: z.ZodNumber;
+    expected: z.ZodNumber;
+    running: z.ZodNumber;
+    failed: z.ZodArray<z.ZodString>;
+    refused: z.ZodArray<z.ZodObject<{
+        runnerId: z.ZodString;
+        addonIds: z.ZodArray<z.ZodString>;
+        reason: z.ZodString;
+    }, z.core.$strip>>;
+    missing: z.ZodArray<z.ZodString>;
+    pending: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    planKnown: z.ZodBoolean;
+}, z.core.$strip>;
 declare const ServerPackageStatusSchema: z.ZodObject<{
     packageName: z.ZodString;
     runningVersion: z.ZodNullable<z.ZodString>;
@@ -275,6 +305,20 @@ declare const ServerPackageStatusSchema: z.ZodObject<{
         }, z.core.$strip>>;
         currentVersion: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
+    runners: z.ZodOptional<z.ZodObject<{
+        checkedAtMs: z.ZodNumber;
+        expected: z.ZodNumber;
+        running: z.ZodNumber;
+        failed: z.ZodArray<z.ZodString>;
+        refused: z.ZodArray<z.ZodObject<{
+            runnerId: z.ZodString;
+            addonIds: z.ZodArray<z.ZodString>;
+            reason: z.ZodString;
+        }, z.core.$strip>>;
+        missing: z.ZodArray<z.ZodString>;
+        pending: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        planKnown: z.ZodBoolean;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 declare const ServerUpdateCheckResultSchema: z.ZodObject<{
     packageName: z.ZodString;
@@ -309,6 +353,12 @@ declare const ServerUpdateOutcomeSchema: z.ZodEnum<{
     "restart-scheduled": "restart-scheduled";
     staged: "staged";
 }>;
+/** One addon the pre-flight found the target version would refuse (D877). */
+declare const UpdateBlockerSchema: z.ZodObject<{
+    addonId: z.ZodString;
+    reason: z.ZodString;
+    remedy: z.ZodString;
+}, z.core.$strip>;
 declare const ServerUpdateActionResultSchema: z.ZodObject<{
     accepted: z.ZodBoolean;
     targetVersion: z.ZodNullable<z.ZodString>;
@@ -323,6 +373,11 @@ declare const ServerUpdateActionResultSchema: z.ZodObject<{
     }>>;
     reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    blockers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        addonId: z.ZodString;
+        reason: z.ZodString;
+        remedy: z.ZodString;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
 export declare const serverManagementCapability: {
     readonly name: 'server-management';
@@ -401,6 +456,20 @@ export declare const serverManagementCapability: {
                 }, z.core.$strip>>;
                 currentVersion: z.ZodNullable<z.ZodString>;
             }, z.core.$strip>>;
+            runners: z.ZodOptional<z.ZodObject<{
+                checkedAtMs: z.ZodNumber;
+                expected: z.ZodNumber;
+                running: z.ZodNumber;
+                failed: z.ZodArray<z.ZodString>;
+                refused: z.ZodArray<z.ZodObject<{
+                    runnerId: z.ZodString;
+                    addonIds: z.ZodArray<z.ZodString>;
+                    reason: z.ZodString;
+                }, z.core.$strip>>;
+                missing: z.ZodArray<z.ZodString>;
+                pending: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                planKnown: z.ZodBoolean;
+            }, z.core.$strip>>;
         }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
         readonly checkServerUpdate: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
             packageName: z.ZodString;
@@ -414,6 +483,7 @@ export declare const serverManagementCapability: {
         }, z.core.$strip>, "mutation">;
         readonly applyServerUpdate: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
+            acknowledgeRefusals: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>, z.ZodObject<{
             accepted: z.ZodBoolean;
             targetVersion: z.ZodNullable<z.ZodString>;
@@ -428,6 +498,11 @@ export declare const serverManagementCapability: {
             }>>;
             reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            blockers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                addonId: z.ZodString;
+                reason: z.ZodString;
+                remedy: z.ZodString;
+            }, z.core.$strip>>>;
         }, z.core.$strip>, "mutation">;
         readonly rollbackServerUpdate: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
             accepted: z.ZodBoolean;
@@ -443,6 +518,11 @@ export declare const serverManagementCapability: {
             }>>;
             reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            blockers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                addonId: z.ZodString;
+                reason: z.ZodString;
+                remedy: z.ZodString;
+            }, z.core.$strip>>>;
         }, z.core.$strip>, "mutation">;
         /**
          * Plain process restart of the node's root process — no version change.
@@ -465,6 +545,11 @@ export declare const serverManagementCapability: {
             }>>;
             reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            blockers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                addonId: z.ZodString;
+                reason: z.ZodString;
+                remedy: z.ZodString;
+            }, z.core.$strip>>>;
         }, z.core.$strip>, "mutation">;
     };
     /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
@@ -485,4 +570,7 @@ export type ServerPackageStatus = z.infer<typeof ServerPackageStatusSchema>;
 export type ServerUpdateCheckResult = z.infer<typeof ServerUpdateCheckResultSchema>;
 export type ServerUpdateOutcome = z.infer<typeof ServerUpdateOutcomeSchema>;
 export type ServerUpdateActionResult = z.infer<typeof ServerUpdateActionResultSchema>;
-export { ServerBootModeSchema, ServerUpdateStateSchema, ImageContractStateSchema, ImageContractSchema, WrapperKindSchema, WrapperEvidenceSchema, WrapperIdentitySchema, ServerRollbackInfoSchema, ServerPackageStatusSchema, ServerUpdateCheckResultSchema, ServerUpdateOutcomeSchema, ServerUpdateActionResultSchema, };
+export type RunnerBootCheck = z.infer<typeof RunnerBootCheckSchema>;
+export type RunnerRefusal = z.infer<typeof RunnerRefusalSchema>;
+export type UpdateBlocker = z.infer<typeof UpdateBlockerSchema>;
+export { RunnerBootCheckSchema, RunnerRefusalSchema, UpdateBlockerSchema, ServerBootModeSchema, ServerUpdateStateSchema, ImageContractStateSchema, ImageContractSchema, WrapperKindSchema, WrapperEvidenceSchema, WrapperIdentitySchema, ServerRollbackInfoSchema, ServerPackageStatusSchema, ServerUpdateCheckResultSchema, ServerUpdateOutcomeSchema, ServerUpdateActionResultSchema, };

package/dist/capabilities/user-management.cap.d.ts

@@ -1056,6 +1056,24 @@ export declare const userManagementCapability: {
             enabled: z.ZodBoolean;
             confirmedAt: z.ZodNullable<z.ZodNumber>;
         }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
+        /**
+         * D878: move every TOTP seed stored in plaintext into the keychain (owner
+         * `system`), leaving a marker in the row. Dry run unless `apply`;
+         * idempotent; counts only.
+         */
+        readonly migrateRawSecrets: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            apply: z.ZodBoolean;
+        }, z.core.$strip>, z.ZodObject<{
+            apply: z.ZodBoolean;
+            rows: z.ZodNumber;
+            raw: z.ZodNumber;
+            markers: z.ZodNumber;
+            migrated: z.ZodNumber;
+            failed: z.ZodNumber;
+            remainingRaw: z.ZodNumber;
+            unresolvedMarkers: z.ZodNumber;
+            verified: z.ZodBoolean;
+        }, z.core.$strip>, "mutation">;
         readonly verifyTotp: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             userId: z.ZodString;
             code: z.ZodString;

package/dist/client.js

@@ -27812,6 +27812,7 @@ function createSystemProxy(api) {
 			listProfileKinds: (input) => dispatch("llm", "listProfileKinds", "query", input),
 			listProfiles: (input) => dispatch("llm", "listProfiles", "query", input),
 			upsertProfile: (input) => dispatch("llm", "upsertProfile", "mutation", input),
+			migrateRawSecrets: (input) => dispatch("llm", "migrateRawSecrets", "mutation", input),
 			deleteProfile: (input) => dispatch("llm", "deleteProfile", "mutation", input),
 			testProfile: (input) => dispatch("llm", "testProfile", "mutation", input),
 			listModels: (input) => dispatch("llm", "listModels", "query", input),
@@ -28259,6 +28260,7 @@ function createSystemProxy(api) {
 			confirmTotp: (input) => dispatch("userManagement", "confirmTotp", "mutation", input),
 			disableTotp: (input) => dispatch("userManagement", "disableTotp", "mutation", input),
 			getTotpStatus: (input) => dispatch("userManagement", "getTotpStatus", "query", input),
+			migrateRawSecrets: (input) => dispatch("userManagement", "migrateRawSecrets", "mutation", input),
 			verifyTotp: (input) => dispatch("userManagement", "verifyTotp", "mutation", input),
 			oauthIssueCode: (input) => dispatch("userManagement", "oauthIssueCode", "mutation", input),
 			oauthExchangeCode: (input) => dispatch("userManagement", "oauthExchangeCode", "mutation", input),

package/dist/client.mjs

@@ -27811,6 +27811,7 @@ function createSystemProxy(api) {
 			listProfileKinds: (input) => dispatch("llm", "listProfileKinds", "query", input),
 			listProfiles: (input) => dispatch("llm", "listProfiles", "query", input),
 			upsertProfile: (input) => dispatch("llm", "upsertProfile", "mutation", input),
+			migrateRawSecrets: (input) => dispatch("llm", "migrateRawSecrets", "mutation", input),
 			deleteProfile: (input) => dispatch("llm", "deleteProfile", "mutation", input),
 			testProfile: (input) => dispatch("llm", "testProfile", "mutation", input),
 			listModels: (input) => dispatch("llm", "listModels", "query", input),
@@ -28258,6 +28259,7 @@ function createSystemProxy(api) {
 			confirmTotp: (input) => dispatch("userManagement", "confirmTotp", "mutation", input),
 			disableTotp: (input) => dispatch("userManagement", "disableTotp", "mutation", input),
 			getTotpStatus: (input) => dispatch("userManagement", "getTotpStatus", "query", input),
+			migrateRawSecrets: (input) => dispatch("userManagement", "migrateRawSecrets", "mutation", input),
 			verifyTotp: (input) => dispatch("userManagement", "verifyTotp", "mutation", input),
 			oauthIssueCode: (input) => dispatch("userManagement", "oauthIssueCode", "mutation", input),
 			oauthExchangeCode: (input) => dispatch("userManagement", "oauthExchangeCode", "mutation", input),

package/dist/enums/event-category.d.ts

@@ -61,6 +61,24 @@ export declare enum EventCategory {
      * consumes this category and maps it to the `addon-crash-loop` kind.
      */
     AddonRunnerFailed = "addon.runner-failed",
+    /**
+     * A runner whose addon refused to start with a typed reason (D877) - parked
+     * in `refused`, never counted by the crash breaker, retried on operator
+     * action. One event per refusal.
+     */
+    AddonRunnerRefused = "addon.runner-refused",
+    /**
+     * A runner settled on a state (D877): `running` (READY), `crashed`, `failed` or
+     * `refused`. In-process telemetry for the boot check (re-evaluate while any
+     * runner is still pending) and the alert centre (close a recovered runner).
+     */
+    ProcessStateChanged = "process.state-changed",
+    /**
+     * The node's one-shot runner boot check (D877): planned runners against the
+     * process service, `degraded` when any is failed, refused or missing. The
+     * alert centre turns it into one alert and a direct critical push.
+     */
+    SystemRunnerCheck = "system.runner-check",
     AddonError = "addon.error",
     AddonPageReady = "addon.page-ready",
     AddonWidgetReady = "addon.widget-ready",

package/dist/enums.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_event_category = require("./event-category-T43rdQWR.js");
+const require_event_category = require("./event-category-Hoe-mqbd.js");
 //#region src/enums/event-source-type.ts
 var EventSourceType = /* @__PURE__ */ function(EventSourceType) {
 	EventSourceType["Addon"] = "addon";

package/dist/enums.mjs

@@ -1,4 +1,4 @@
-import { t as EventCategory } from "./event-category-C4hVnRo8.mjs";
+import { t as EventCategory } from "./event-category-BvOFi6PY.mjs";
 //#region src/enums/event-source-type.ts
 var EventSourceType = /* @__PURE__ */ function(EventSourceType) {
 	EventSourceType["Addon"] = "addon";

package/dist/{event-category-C4hVnRo8.mjs → event-category-BvOFi6PY.mjs}

@@ -62,6 +62,24 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* consumes this category and maps it to the `addon-crash-loop` kind.
 	*/
 	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
+	/**
+	* A runner whose addon refused to start with a typed reason (D877) - parked
+	* in `refused`, never counted by the crash breaker, retried on operator
+	* action. One event per refusal.
+	*/
+	EventCategory["AddonRunnerRefused"] = "addon.runner-refused";
+	/**
+	* A runner settled on a state (D877): `running` (READY), `crashed`, `failed` or
+	* `refused`. In-process telemetry for the boot check (re-evaluate while any
+	* runner is still pending) and the alert centre (close a recovered runner).
+	*/
+	EventCategory["ProcessStateChanged"] = "process.state-changed";
+	/**
+	* The node's one-shot runner boot check (D877): planned runners against the
+	* process service, `degraded` when any is failed, refused or missing. The
+	* alert centre turns it into one alert and a direct critical push.
+	*/
+	EventCategory["SystemRunnerCheck"] = "system.runner-check";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";

package/dist/{event-category-T43rdQWR.js → event-category-Hoe-mqbd.js}

@@ -62,6 +62,24 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* consumes this category and maps it to the `addon-crash-loop` kind.
 	*/
 	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
+	/**
+	* A runner whose addon refused to start with a typed reason (D877) - parked
+	* in `refused`, never counted by the crash breaker, retried on operator
+	* action. One event per refusal.
+	*/
+	EventCategory["AddonRunnerRefused"] = "addon.runner-refused";
+	/**
+	* A runner settled on a state (D877): `running` (READY), `crashed`, `failed` or
+	* `refused`. In-process telemetry for the boot check (re-evaluate while any
+	* runner is still pending) and the alert centre (close a recovered runner).
+	*/
+	EventCategory["ProcessStateChanged"] = "process.state-changed";
+	/**
+	* The node's one-shot runner boot check (D877): planned runners against the
+	* process service, `degraded` when any is failed, refused or missing. The
+	* alert centre turns it into one alert and a direct critical push.
+	*/
+	EventCategory["SystemRunnerCheck"] = "system.runner-check";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";

package/dist/generated/addon-api.d.ts

@@ -4127,6 +4127,13 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof llmCapability.methods.upsertProfile.output>;
             meta: object;
         }>;
+        migrateRawSecrets: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof llmCapability.methods.migrateRawSecrets.input>;
+            output: z.infer<typeof llmCapability.methods.migrateRawSecrets.output>;
+            meta: object;
+        }>;
         deleteProfile: TRPCMutationProcedure<{
             input: {
                 [x: string]: unknown;
@@ -10068,6 +10075,13 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof userManagementCapability.methods.getTotpStatus.output>;
             meta: object;
         }>;
+        migrateRawSecrets: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof userManagementCapability.methods.migrateRawSecrets.input>;
+            output: z.infer<typeof userManagementCapability.methods.migrateRawSecrets.output>;
+            meta: object;
+        }>;
         verifyTotp: TRPCMutationProcedure<{
             input: {
                 [x: string]: unknown;

package/dist/generated/method-access-map.d.ts

@@ -6,7 +6,7 @@
  * scope+access check inside `protectedProcedure` (see
  * `server/backend/src/api/trpc/trpc.middleware.ts`).
  *
- * Coverage: 1341 method paths across 175 capabilities.
+ * Coverage: 1343 method paths across 175 capabilities.
  */
 import type { CapabilityMethodAccess } from '../capabilities/capability-definition.js';
 export interface MethodAccessRecord {

package/dist/generated/system-proxy.d.ts

@@ -84,7 +84,7 @@ export interface SystemProxy {
     readonly faceGallery: Pick<InferProvider<typeof faceGalleryCapability>, 'listIdentities' | 'createIdentity' | 'renameIdentity' | 'deleteIdentity' | 'listIdentitySamples' | 'auditIdentitySamples' | 'removeSample' | 'getFaceMedia' | 'assignFace' | 'unassignFace' | 'deleteFace' | 'assignFaces' | 'unassignFaces' | 'suggestFaceClusters'>;
     readonly integrations: Pick<InferProvider<typeof integrationsCapability>, 'list' | 'get' | 'getByAddonId' | 'create' | 'update' | 'delete' | 'getSettings' | 'setSettings' | 'getAvailableTypes' | 'testConnection'>;
     readonly keychainAdmin: Pick<InferProvider<typeof keychainAdminCapability>, 'status' | 'listSecrets' | 'listAudit' | 'reveal' | 'setSystemSecret' | 'importSecret' | 'deleteOrphans' | 'rotateMasterKey' | 'purgeRetiredKeys' | 'downloadRecoveryKey' | 'resetKeychain' | 'resetReport' | 'acknowledgeReset'>;
-    readonly llm: Pick<InferProvider<typeof llmCapability>, 'generate' | 'generateVision' | 'cancel' | 'listProfileKinds' | 'listProfiles' | 'upsertProfile' | 'deleteProfile' | 'testProfile' | 'listModels' | 'getDefaults' | 'setDefault' | 'getUsage' | 'listModelCatalog' | 'listRuntimeNodes' | 'listNodeModels' | 'resolveModelRef' | 'installModel' | 'deleteModel' | 'getRuntimeStatus' | 'startRuntime' | 'stopRuntime'>;
+    readonly llm: Pick<InferProvider<typeof llmCapability>, 'generate' | 'generateVision' | 'cancel' | 'listProfileKinds' | 'listProfiles' | 'upsertProfile' | 'migrateRawSecrets' | 'deleteProfile' | 'testProfile' | 'listModels' | 'getDefaults' | 'setDefault' | 'getUsage' | 'listModelCatalog' | 'listRuntimeNodes' | 'listNodeModels' | 'resolveModelRef' | 'installModel' | 'deleteModel' | 'getRuntimeStatus' | 'startRuntime' | 'stopRuntime'>;
     readonly localNetwork: Pick<InferProvider<typeof localNetworkCapability>, 'list' | 'getPreferred' | 'getConnectionEndpoints' | 'getNotificationEndpoint' | 'setNotificationEndpoint' | 'getViewerEndpoints' | 'setViewerEndpoints' | 'getAddresses' | 'addCustomAddress' | 'removeCustomAddress' | 'setAddressRole' | 'getHubAddresses' | 'getAllowedAddresses' | 'setAllowedAddresses' | 'resetAllowlistToBestMatch' | 'getTlsStatus' | 'regenerateCertificate' | 'uploadCertificate' | 'downloadCa' | 'useStoredUploadedCertificate' | 'revertToGeneratedCertificate'>;
     readonly meshNetwork: Pick<InferProvider<typeof meshNetworkCapability>, 'getStatus' | 'join' | 'startLogin' | 'leave' | 'logout' | 'listPeers' | 'testConnection'>;
     readonly metricsProvider: Pick<InferProvider<typeof metricsProviderCapability>, 'collectSnapshot' | 'getCached' | 'getCurrent' | 'getDiskSpace' | 'getGpuInfo' | 'getCpuTemperature' | 'getProcessStats' | 'listAddonInstances' | 'getAddonStats' | 'listNodeProcesses' | 'getLoadSeries'>;
@@ -112,7 +112,7 @@ export interface SystemProxy {
     readonly toast: Pick<InferProvider<typeof toastCapability>, 'onToast'>;
     readonly training: Pick<InferProvider<typeof trainingCapability>, 'listBaseModels' | 'planJob' | 'startJob' | 'startJobBatch' | 'listJobs' | 'getJob' | 'cancelJob' | 'getJobResult' | 'registerResult' | 'canaryResult' | 'rollbackCanary' | 'discardResult'>;
     readonly turnProvider: Pick<InferProvider<typeof turnProviderCapability>, 'getTurnServers'>;
-    readonly userManagement: Pick<InferProvider<typeof userManagementCapability>, 'listUsers' | 'createUser' | 'updateUser' | 'deleteUser' | 'resetPassword' | 'setUserScopes' | 'validateCredentials' | 'listApiKeys' | 'revokeApiKey' | 'createScopedToken' | 'revokeScopedToken' | 'validateScopedToken' | 'listScopedTokens' | 'setupTotp' | 'confirmTotp' | 'disableTotp' | 'getTotpStatus' | 'verifyTotp' | 'oauthIssueCode' | 'oauthExchangeCode' | 'oauthRefresh' | 'oauthVerifyAccessToken' | 'listExternalIdentities' | 'findUserByExternalIdentity' | 'unlinkExternalIdentity' | 'listOauthSessions' | 'revokeOauthSession'>;
+    readonly userManagement: Pick<InferProvider<typeof userManagementCapability>, 'listUsers' | 'createUser' | 'updateUser' | 'deleteUser' | 'resetPassword' | 'setUserScopes' | 'validateCredentials' | 'listApiKeys' | 'revokeApiKey' | 'createScopedToken' | 'revokeScopedToken' | 'validateScopedToken' | 'listScopedTokens' | 'setupTotp' | 'confirmTotp' | 'disableTotp' | 'getTotpStatus' | 'migrateRawSecrets' | 'verifyTotp' | 'oauthIssueCode' | 'oauthExchangeCode' | 'oauthRefresh' | 'oauthVerifyAccessToken' | 'listExternalIdentities' | 'findUserByExternalIdentity' | 'unlinkExternalIdentity' | 'listOauthSessions' | 'revokeOauthSession'>;
 }
 /**
  * Build a `SystemProxy` that dispatches every namespace method through