@camstack/types 1.2.377 → 1.2.379

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-Dq0Uyeh0.js");
-const require_event_category = require("./event-category-T43rdQWR.js");
+const require_sleep = require("./sleep-DQYi915G.js");
+const require_event_category = require("./event-category-Hoe-mqbd.js");
 const require_composition = require("./composition-CUAOHZ38.js");
 const require_node_color = require("./node-color.js");
 const require_err_msg = require("./err-msg-Bb-s4Xuj.js");
@@ -13088,6 +13088,43 @@ function describeComposableCaps(defs, deviceType) {
 	}).toSorted((a, b) => a.cap.localeCompare(b.cap));
 }
 //#endregion
+//#region src/capabilities/raw-secret-migration.ts
+/**
+* The report of a one-shot "move this owner's plaintext secrets into the
+* keychain" run (D878). COUNTS only - never a value, never a ref.
+*
+* The owner runs it on its own rows, through its own write path; an operator
+* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
+* Dry run (`apply: false`) reports what WOULD move and changes nothing.
+*/
+var RawSecretMigrationInputSchema = zod.z.object({ 
+/** `false` (the default of the script) = report only. */
+apply: zod.z.boolean() });
+var RawSecretMigrationReportSchema = zod.z.object({
+	apply: zod.z.boolean(),
+	/** Rows that can carry a secret (a profile, an enrolment). */
+	rows: zod.z.number().int(),
+	/** Rows whose secret was plaintext when the run started. */
+	raw: zod.z.number().int(),
+	/** Rows that already held a keychain marker when the run started. */
+	markers: zod.z.number().int(),
+	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
+	migrated: zod.z.number().int(),
+	/** Plaintext rows left in place because the move or its read-back failed. */
+	failed: zod.z.number().int(),
+	/** After the run: rows still holding plaintext. */
+	remainingRaw: zod.z.number().int(),
+	/** After the run: markers the keychain could not resolve right now. */
+	unresolvedMarkers: zod.z.number().int(),
+	/**
+	* A second, redundant copy of the secrets' rows that the run found (and, on
+	* `apply`, deleted after verifying the first). Owners with a single copy omit it.
+	*/
+	redundantCopies: zod.z.number().int().optional(),
+	/** True when nothing is raw and every marker resolves. */
+	verified: zod.z.boolean()
+});
+//#endregion
 //#region src/capabilities/core-blocks.cap.ts
 /**
 * core-blocks — user-authored TypeScript, stored in the kernel and executed in
@@ -13453,14 +13490,16 @@ var coreBlocksCapability = {
 		/**
 		* Hydrated settings form for one block, or null until a `settingsSchema`
 		* is known (extracted from the compiled entry's named export, or set on
-		* the block). Values live in the `core-blocks:settings` collection.
+		* the block). Values live in the block addon's `addon-settings` rows (D880);
+		* a password field answers as a "set" view, never the value.
 		*/
 		getBlockSettings: require_sleep.method(zod.z.object({ blockId: zod.z.string() }), SettingsSchemaWithValuesSchema.nullable(), { auth: "admin" }),
 		/**
 		* Patch persisted preference values for one block. The schema is not
-		* rewritten here — only values. Scripts read the same blob via
-		* `ctx.settings.readAddonStore()` (mirrored into the block addon's
-		* `addon-settings` namespace on every patch).
+		* rewritten here — only values. Scripts read the same rows via
+		* `ctx.settings.readAddonStore()`. A field the schema declares `password` /
+		* `secret: true` is stored in the keychain (owner = the block's addon id)
+		* and the row holds a marker; a REDACTED or view value keeps the stored one.
 		*/
 		updateBlockSettings: require_sleep.method(zod.z.object({
 			blockId: zod.z.string(),
@@ -13470,6 +13509,16 @@ var coreBlocksCapability = {
 			auth: "admin"
 		}),
 		/**
+		* D880: move every plaintext password a block's `settingsSchema` declares
+		* into the keychain and delete the legacy `core-blocks:settings` copy. Dry
+		* run unless `apply`; idempotent; counts only. A secret is read back from
+		* the keychain before its row is rewritten.
+		*/
+		migrateRawSecrets: require_sleep.method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* The declaration files the editor type-checks against.
 		*
 		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
@@ -39512,6 +39561,16 @@ var llmCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* D878: move every profile's plaintext `apiKey` into the keychain (owner
+		* `ai`), leaving a marker in the row. Dry run unless `apply`; idempotent;
+		* counts only. The plaintext is cleared only after the keychain read-back
+		* matched.
+		*/
+		migrateRawSecrets: require_sleep.method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		deleteProfile: require_sleep.method(ProfileRefInputSchema, zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
@@ -54094,6 +54153,41 @@ var ServerRollbackInfoSchema = zod.z.object({
 	atMs: zod.z.number(),
 	reason: zod.z.string()
 });
+/**
+* The runner boot check (D877): the runners this node PLANNED (hub: one per
+* `resolveRunnerId` over its forked addons; agent: the runners its process
+* service holds, because only the hub plans) against the states the process
+* service reports. Kept in memory, recomputed by the same one-shot check after
+* every boot, served on `getServerPackageStatus`.
+*
+* `failed` is the D6 breaker's terminal state, `refused` a deterministic Init
+* refusal (an addon that said "I will not start, and here is why"), `missing` a
+* planned runner the process service has no entry for.
+*/
+var RunnerRefusalSchema = zod.z.object({
+	runnerId: zod.z.string(),
+	addonIds: zod.z.array(zod.z.string()),
+	reason: zod.z.string()
+});
+var RunnerBootCheckSchema = zod.z.object({
+	checkedAtMs: zod.z.number(),
+	/** Runners planned for this node. */
+	expected: zod.z.number(),
+	/** Planned runners whose process is `running`. */
+	running: zod.z.number(),
+	failed: zod.z.array(zod.z.string()),
+	refused: zod.z.array(RunnerRefusalSchema),
+	missing: zod.z.array(zod.z.string()),
+	/**
+	* Runners still on their way: `starting`, or `crashed` waiting on a backoff
+	* respawn. The check is FINAL only when this is empty; until then nothing is
+	* pushed and the verdict is re-evaluated on the next runner state change.
+	* Optional for version skew (absent = settled).
+	*/
+	pending: zod.z.array(zod.z.string()).optional(),
+	/** True when the plan is the hub's (`missing` is then meaningful); false on an agent. */
+	planKnown: zod.z.boolean()
+});
 var ServerPackageStatusSchema = zod.z.object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: zod.z.string(),
@@ -54156,7 +54250,14 @@ var ServerPackageStatusSchema = zod.z.object({
 	* for version skew: an older provider's payload simply omits it, and an
 	* absent wrapper is unknown — never `native`.
 	*/
-	wrapper: WrapperIdentitySchema.optional()
+	wrapper: WrapperIdentitySchema.optional(),
+	/**
+	* What this node PLANNED to run against what its process service reports
+	* (D877). Absent until the one-shot boot check has run (~60 s after boot) and
+	* on a provider that predates it. Absent is "not checked yet", never "all
+	* well": a consumer that needs the answer treats it as pending.
+	*/
+	runners: RunnerBootCheckSchema.optional()
 });
 var ServerUpdateCheckResultSchema = zod.z.object({
 	packageName: zod.z.string(),
@@ -54207,6 +54308,13 @@ var ServerUpdateOutcomeSchema = zod.z.enum([
 	"refused",
 	"failed"
 ]);
+/** One addon the pre-flight found the target version would refuse (D877). */
+var UpdateBlockerSchema = zod.z.object({
+	addonId: zod.z.string(),
+	reason: zod.z.string(),
+	/** What the operator does about it. */
+	remedy: zod.z.string()
+});
 var ServerUpdateActionResultSchema = zod.z.object({
 	accepted: zod.z.boolean(),
 	targetVersion: zod.z.string().nullable(),
@@ -54224,7 +54332,13 @@ var ServerUpdateActionResultSchema = zod.z.object({
 	* The failure itself, verbatim enough to act on (the npm output for a
 	* staging install). Non-null only for `failed`.
 	*/
-	error: zod.z.string().nullable().optional()
+	error: zod.z.string().nullable().optional(),
+	/**
+	* The addons the target version would refuse to start on this node's live
+	* store (D877), present when the pre-flight refused the update
+	* (`reason: 'addon-would-refuse'`). Optional for version skew.
+	*/
+	blockers: zod.z.array(UpdateBlockerSchema).optional()
 });
 var serverManagementCapability = {
 	name: "server-management",
@@ -54236,9 +54350,16 @@ var serverManagementCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		applyServerUpdate: require_sleep.method(zod.z.object({ 
-		/** Explicit target version; omitted = latest from the registry. */
-version: zod.z.string().optional() }), ServerUpdateActionResultSchema, {
+		applyServerUpdate: require_sleep.method(zod.z.object({
+			/** Explicit target version; omitted = latest from the registry. */
+			version: zod.z.string().optional(),
+			/**
+			* Apply even though the pre-flight (D877) found addons the target would
+			* refuse to start. Off by default: those addons stay down until the
+			* remedy is run, which is the incident this gate exists to prevent.
+			*/
+			acknowledgeRefusals: zod.z.boolean().optional()
+		}), ServerUpdateActionResultSchema, {
 			kind: "mutation",
 			auth: "admin",
 			timeoutMs: 16 * 6e4
@@ -57951,7 +58072,9 @@ var ManifestShapeSchema = zod.z.object({
 var AddonProcessSchema = zod.z.object({
 	pid: zod.z.number().optional(),
 	mode: zod.z.string(),
-	state: zod.z.string()
+	state: zod.z.string(),
+	/** Why the runner is `refused` (an addon's own words), when it is (D877). */
+	reason: zod.z.string().optional()
 });
 /**
 * Per-addon health snapshot from the kernel's AddonHealthMonitor.
@@ -71581,6 +71704,16 @@ var userManagementCapability = {
 			access: "delete"
 		}),
 		getTotpStatus: require_sleep.method(zod.z.object({ userId: zod.z.string() }), TotpStatusSchema, { auth: "admin" }),
+		/**
+		* D878: move every TOTP seed stored in plaintext into the keychain (owner
+		* `system`), leaving a marker in the row. Dry run unless `apply`;
+		* idempotent; counts only.
+		*/
+		migrateRawSecrets: require_sleep.method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
+		}),
 		verifyTotp: require_sleep.method(zod.z.object({
 			userId: zod.z.string(),
 			code: zod.z.string()
@@ -77822,6 +77955,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.migrateRawSecrets": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -79682,6 +79821,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"llm.migrateRawSecrets": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -84224,6 +84369,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.migrateRawSecrets": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.oauthExchangeCode": {
 		capName: "user-management",
 		capScope: "system",
@@ -91933,6 +92084,7 @@ function createSystemProxy(api) {
 			compile: (input) => dispatch("coreBlocks", "compile", "mutation", input),
 			getBlockSettings: (input) => dispatch("coreBlocks", "getBlockSettings", "query", input),
 			updateBlockSettings: (input) => dispatch("coreBlocks", "updateBlockSettings", "mutation", input),
+			migrateRawSecrets: (input) => dispatch("coreBlocks", "migrateRawSecrets", "mutation", input),
 			getTypeDefs: (input) => dispatch("coreBlocks", "getTypeDefs", "query", input),
 			createComposition: (input) => dispatch("coreBlocks", "createComposition", "mutation", input),
 			updateComposition: (input) => dispatch("coreBlocks", "updateComposition", "mutation", input),
@@ -92105,6 +92257,7 @@ function createSystemProxy(api) {
 			listProfileKinds: (input) => dispatch("llm", "listProfileKinds", "query", input),
 			listProfiles: (input) => dispatch("llm", "listProfiles", "query", input),
 			upsertProfile: (input) => dispatch("llm", "upsertProfile", "mutation", input),
+			migrateRawSecrets: (input) => dispatch("llm", "migrateRawSecrets", "mutation", input),
 			deleteProfile: (input) => dispatch("llm", "deleteProfile", "mutation", input),
 			testProfile: (input) => dispatch("llm", "testProfile", "mutation", input),
 			listModels: (input) => dispatch("llm", "listModels", "query", input),
@@ -92552,6 +92705,7 @@ function createSystemProxy(api) {
 			confirmTotp: (input) => dispatch("userManagement", "confirmTotp", "mutation", input),
 			disableTotp: (input) => dispatch("userManagement", "disableTotp", "mutation", input),
 			getTotpStatus: (input) => dispatch("userManagement", "getTotpStatus", "query", input),
+			migrateRawSecrets: (input) => dispatch("userManagement", "migrateRawSecrets", "mutation", input),
 			verifyTotp: (input) => dispatch("userManagement", "verifyTotp", "mutation", input),
 			oauthIssueCode: (input) => dispatch("userManagement", "oauthIssueCode", "mutation", input),
 			oauthExchangeCode: (input) => dispatch("userManagement", "oauthExchangeCode", "mutation", input),
@@ -102570,6 +102724,8 @@ exports.RUNTIME_DEFAULTS = require_sleep.RUNTIME_DEFAULTS;
 exports.RUNTIME_STATE_POLICY = RUNTIME_STATE_POLICY;
 exports.RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS = RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS;
 exports.RUNTIME_TO_FORMAT = RUNTIME_TO_FORMAT;
+exports.RawSecretMigrationInputSchema = RawSecretMigrationInputSchema;
+exports.RawSecretMigrationReportSchema = RawSecretMigrationReportSchema;
 exports.RawStateResultSchema = require_sleep.RawStateResultSchema;
 exports.ReadGopBytesResultSchema = ReadGopBytesResultSchema;
 exports.ReadSegmentBytesResultSchema = ReadSegmentBytesResultSchema;
@@ -102686,6 +102842,7 @@ exports.RingBuffer = RingBuffer;
 exports.RootStepSupplySchema = RootStepSupplySchema;
 exports.RtpSourceSchema = RtpSourceSchema;
 exports.RtspRestreamEntrySchema = RtspRestreamEntrySchema;
+exports.RunnerBootCheckSchema = RunnerBootCheckSchema;
 exports.RunnerCameraConfigSchema = RunnerCameraConfigSchema;
 exports.RunnerCameraDeviceUIFields = RunnerCameraDeviceUIFields;
 exports.RunnerFrameSourceSchema = RunnerFrameSourceSchema;
@@ -102693,6 +102850,7 @@ exports.RunnerInferenceDeviceSchema = RunnerInferenceDeviceSchema;
 exports.RunnerJumpStepProvisioningSchema = RunnerJumpStepProvisioningSchema;
 exports.RunnerLocalLoadSchema = RunnerLocalLoadSchema;
 exports.RunnerLocalMetricsSchema = RunnerLocalMetricsSchema;
+exports.RunnerRefusalSchema = RunnerRefusalSchema;
 exports.SCENE_CONDITIONS = SCENE_CONDITIONS;
 exports.SCENE_CONFIRM_DEFAULT_MAX_IMAGE_PX = SCENE_CONFIRM_DEFAULT_MAX_IMAGE_PX;
 exports.SCENE_CONFIRM_DEFAULT_TIMEOUT_MS = SCENE_CONFIRM_DEFAULT_TIMEOUT_MS;
@@ -102958,6 +103116,7 @@ exports.UninstallPackageResultSchema = UninstallPackageResultSchema;
 exports.UnitConversionError = UnitConversionError;
 exports.UnstampedEventMediaCountSchema = UnstampedEventMediaCountSchema;
 exports.UnstampedRowsSchema = UnstampedRowsSchema;
+exports.UpdateBlockerSchema = UpdateBlockerSchema;
 exports.UpdateIntegrationInputSchema = UpdateIntegrationInputSchema;
 exports.UpdateStatusSchema = UpdateStatusSchema;
 exports.UpdateUserInputSchema = UpdateUserInputSchema;
@@ -103443,6 +103602,7 @@ exports.isSecretFieldView = require_sleep.isSecretFieldView;
 exports.isSecretMarker = require_sleep.isSecretMarker;
 exports.isSecretMarkerLike = require_sleep.isSecretMarkerLike;
 exports.isSecretRef = require_sleep.isSecretRef;
+exports.isSecretRefOwnedBy = require_sleep.isSecretRefOwnedBy;
 exports.isSingleHubAddressRole = isSingleHubAddressRole;
 exports.isSoftwareDecode = require_composition.isSoftwareDecode;
 exports.isSourceCap = require_composition.isSourceCap;