@camstack/addon-auth 1.2.155 → 1.2.157

package/dist/{dist-BFPqfaub.mjs → dist-B8sfNbOk.mjs}

@@ -5546,7 +5546,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BSuCCFjf.mjs
+//#region ../types/dist/sleep-CSuN0thG.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8164,7 +8164,13 @@ var RecordKindDeclarationSchema = object({
 	secretPaths: array(string().min(1)).default([]),
 	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
 	secretArrayKeys: record(string(), string()).default({}),
-	/** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+	/**
+	* RETIRED (D900): the legacy table a kind adopted from during the records
+	* migration. Nothing declares it any more and nothing reads it; the schema
+	* still ACCEPTS it because the catalog rows the migration wrote carry it
+	* (an orphaned kind is never redeclared) and an addon built before the
+	* removal still sends it. Never set it.
+	*/
 	adoptsFrom: string().min(1).optional(),
 	/** Kinds that must agree through `transact` sit in one file under one family name. */
 	transactFamily: string().min(1).optional(),
@@ -8239,7 +8245,6 @@ function defineRecordKinds(specs) {
 			maxDataBytes: spec.maxDataBytes,
 			secretPaths: [...secretPaths],
 			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
-			adoptsFrom: spec.adoptsFrom,
 			transactFamily: spec.transactFamily,
 			entry: spec.entry === void 0 ? void 0 : {
 				title: spec.entry.title,
@@ -8269,7 +8274,6 @@ function defineEntryKind(name, spec) {
 		...spec.database === void 0 ? {} : { database: spec.database },
 		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
 		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
-		...spec.adoptsFrom === void 0 ? {} : { adoptsFrom: spec.adoptsFrom },
 		entry: {
 			title: spec.title,
 			...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
@@ -8278,15 +8282,6 @@ function defineEntryKind(name, spec) {
 	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
 	return defined;
 }
-/**
-* Legacy source for entry adoption (B3): a list stored under addon-settings
-* `<addonId>.<key>` until records-adopt copies rows into the entry kind.
-*/
-var SETTINGS_ARRAY_ADOPTS_PREFIX = "@settings-array/";
-/** The `adoptsFrom` value for an addon-settings array field. */
-function settingsArrayAdoptsFrom(addonId, settingsKey) {
-	return `${SETTINGS_ARRAY_ADOPTS_PREFIX}${addonId}/${settingsKey}`;
-}
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = _enum([
 	"high",
@@ -17217,11 +17212,12 @@ var DeclareKindResultSchema = object({
 	kindId: number().int(),
 	state: RecordKindStateSchema,
 	createdIndexes: array(string()),
-	/** The boot guard: the kind is empty while its legacy table still holds rows. */
-	adoptionPending: object({
-		legacyTable: string(),
-		legacyRows: number().int()
-	}).nullable()
+	/**
+	* RETIRED (D900): always `null`. It carried the records-migration boot guard;
+	* it stays on the wire, null, because an addon built before the removal reads
+	* an ABSENT field as "adoption pending" and refuses to start.
+	*/
+	adoptionPending: _null()
 });
 /** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
 var SecretRefsList = array(string());
@@ -17394,26 +17390,7 @@ method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: arr
 }), object({ kinds: array(StorageKindSchema) }), { auth: "admin" }), method(RecordQueryInputSchema.extend({
 	owner: string().min(1),
 	kind: RecordKindNameSchema
-}), RecordQueryResultSchema, { auth: "admin" }), method(object({
-	owner: string().min(1),
-	kind: RecordKindNameSchema,
-	records: array(RecordInputSchema).max(RECORD_BATCH_MAX),
-	/** The LAST batch: the copy is complete, the boot guard stops asking. */
-	complete: boolean().optional()
-}).refine((input) => input.records.length > 0 || input.complete === true, { message: "records must be non-empty unless complete is true" }), object({ adopted: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	collection: string().min(1),
-	cursor: string().optional(),
-	limit: number().int().min(1).max(1e3).optional()
-}), object({
-	rows: array(object({
-		id: string(),
-		data: record(string(), unknown())
-	})),
-	nextCursor: string().nullable()
-}), { auth: "admin" }), method(object({ collection: string().min(1) }), object({ adopted: boolean() }), { auth: "admin" });
+}), RecordQueryResultSchema, { auth: "admin" });
 /**
 * record-entries - the ONE admin surface for every list of user-created entries
 * (D881): notification targets, brokers, LLM profiles, anything an addon
@@ -64669,6 +64646,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceHistory.queryMany": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceHistory.queryNode": {
 		capName: "device-history",
 		capScope: "system",
@@ -69889,24 +69872,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"storageAdmin.adoptRecords": {
-		capName: "storage-admin",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"storageAdmin.dropCollection": {
 		capName: "storage-admin",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
-	"storageAdmin.isAdoptedLegacyTable": {
-		capName: "storage-admin",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"storageAdmin.listKinds": {
 		capName: "storage-admin",
 		capScope: "system",
@@ -69919,12 +69890,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"storageAdmin.readLegacyCollection": {
-		capName: "storage-admin",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"storageAdmin.readRecords": {
 		capName: "storage-admin",
 		capScope: "system",
@@ -73739,12 +73704,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"storageAdmin.adoptRecords": [{
-		name: "records",
-		form: "object-array",
-		optional: false,
-		itemField: "deviceId"
-	}],
 	"storageAdmin.readRecords": [{
 		name: "deviceId",
 		form: "single",
@@ -75237,4 +75196,4 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-export { settingsArrayAdoptsFrom as A, SECRET_CLEAR as C, globalSecretScope as D, defineRecordKinds as E, number as F, object as I, string as L, _enum as M, array as N, isSecretClear as O, boolean as P, RecordSecretUnavailableError as S, defineEntryKind as T, requestMountPrefix as _, addonWidgetsSourceCapability as a, errMsg as b, authProviderCapability as c, loginMethodCapability as d, normalizeOrigin as f, pickRequestOrigin as g, parseAppPageLang as h, addonRoutesCapability as i, toSecretFieldView as j, isSecretMarker as k, buildAddonRouteProvider as l, parseAppFlowRequest as m, APP_REFUSED_PATH as n, advertisedHubOrigins as o, oidcConnectionsCapability as p, SSO_STATE_COOKIE as r, appFlowLocation as s, APP_FLOW_DEFAULT_REDIRECT as t, claimedRequestOrigins as u, resolveIconKey as v, arrayItemFieldPath as w, BaseAddon as x, userPasskeysCapability as y };
+export { toSecretFieldView as A, SECRET_CLEAR as C, globalSecretScope as D, defineRecordKinds as E, object as F, string as I, array as M, boolean as N, isSecretClear as O, number as P, RecordSecretUnavailableError as S, defineEntryKind as T, requestMountPrefix as _, addonWidgetsSourceCapability as a, errMsg as b, authProviderCapability as c, loginMethodCapability as d, normalizeOrigin as f, pickRequestOrigin as g, parseAppPageLang as h, addonRoutesCapability as i, _enum as j, isSecretMarker as k, buildAddonRouteProvider as l, parseAppFlowRequest as m, APP_REFUSED_PATH as n, advertisedHubOrigins as o, oidcConnectionsCapability as p, SSO_STATE_COOKIE as r, appFlowLocation as s, APP_FLOW_DEFAULT_REDIRECT as t, claimedRequestOrigins as u, resolveIconKey as v, arrayItemFieldPath as w, BaseAddon as x, userPasskeysCapability as y };

package/dist/{dist-C22DtwR1.js → dist-a0m2kh9g.js}

@@ -5580,7 +5580,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BSuCCFjf.mjs
+//#region ../types/dist/sleep-CSuN0thG.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8198,7 +8198,13 @@ var RecordKindDeclarationSchema = object({
 	secretPaths: array(string().min(1)).default([]),
 	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
 	secretArrayKeys: record(string(), string()).default({}),
-	/** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+	/**
+	* RETIRED (D900): the legacy table a kind adopted from during the records
+	* migration. Nothing declares it any more and nothing reads it; the schema
+	* still ACCEPTS it because the catalog rows the migration wrote carry it
+	* (an orphaned kind is never redeclared) and an addon built before the
+	* removal still sends it. Never set it.
+	*/
 	adoptsFrom: string().min(1).optional(),
 	/** Kinds that must agree through `transact` sit in one file under one family name. */
 	transactFamily: string().min(1).optional(),
@@ -8273,7 +8279,6 @@ function defineRecordKinds(specs) {
 			maxDataBytes: spec.maxDataBytes,
 			secretPaths: [...secretPaths],
 			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
-			adoptsFrom: spec.adoptsFrom,
 			transactFamily: spec.transactFamily,
 			entry: spec.entry === void 0 ? void 0 : {
 				title: spec.entry.title,
@@ -8303,7 +8308,6 @@ function defineEntryKind(name, spec) {
 		...spec.database === void 0 ? {} : { database: spec.database },
 		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
 		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
-		...spec.adoptsFrom === void 0 ? {} : { adoptsFrom: spec.adoptsFrom },
 		entry: {
 			title: spec.title,
 			...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
@@ -8312,15 +8316,6 @@ function defineEntryKind(name, spec) {
 	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
 	return defined;
 }
-/**
-* Legacy source for entry adoption (B3): a list stored under addon-settings
-* `<addonId>.<key>` until records-adopt copies rows into the entry kind.
-*/
-var SETTINGS_ARRAY_ADOPTS_PREFIX = "@settings-array/";
-/** The `adoptsFrom` value for an addon-settings array field. */
-function settingsArrayAdoptsFrom(addonId, settingsKey) {
-	return `${SETTINGS_ARRAY_ADOPTS_PREFIX}${addonId}/${settingsKey}`;
-}
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = _enum([
 	"high",
@@ -17251,11 +17246,12 @@ var DeclareKindResultSchema = object({
 	kindId: number().int(),
 	state: RecordKindStateSchema,
 	createdIndexes: array(string()),
-	/** The boot guard: the kind is empty while its legacy table still holds rows. */
-	adoptionPending: object({
-		legacyTable: string(),
-		legacyRows: number().int()
-	}).nullable()
+	/**
+	* RETIRED (D900): always `null`. It carried the records-migration boot guard;
+	* it stays on the wire, null, because an addon built before the removal reads
+	* an ABSENT field as "adoption pending" and refuses to start.
+	*/
+	adoptionPending: _null()
 });
 /** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
 var SecretRefsList = array(string());
@@ -17428,26 +17424,7 @@ method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: arr
 }), object({ kinds: array(StorageKindSchema) }), { auth: "admin" }), method(RecordQueryInputSchema.extend({
 	owner: string().min(1),
 	kind: RecordKindNameSchema
-}), RecordQueryResultSchema, { auth: "admin" }), method(object({
-	owner: string().min(1),
-	kind: RecordKindNameSchema,
-	records: array(RecordInputSchema).max(RECORD_BATCH_MAX),
-	/** The LAST batch: the copy is complete, the boot guard stops asking. */
-	complete: boolean().optional()
-}).refine((input) => input.records.length > 0 || input.complete === true, { message: "records must be non-empty unless complete is true" }), object({ adopted: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	collection: string().min(1),
-	cursor: string().optional(),
-	limit: number().int().min(1).max(1e3).optional()
-}), object({
-	rows: array(object({
-		id: string(),
-		data: record(string(), unknown())
-	})),
-	nextCursor: string().nullable()
-}), { auth: "admin" }), method(object({ collection: string().min(1) }), object({ adopted: boolean() }), { auth: "admin" });
+}), RecordQueryResultSchema, { auth: "admin" });
 /**
 * record-entries - the ONE admin surface for every list of user-created entries
 * (D881): notification targets, brokers, LLM profiles, anything an addon
@@ -64703,6 +64680,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceHistory.queryMany": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceHistory.queryNode": {
 		capName: "device-history",
 		capScope: "system",
@@ -69923,24 +69906,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"storageAdmin.adoptRecords": {
-		capName: "storage-admin",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"storageAdmin.dropCollection": {
 		capName: "storage-admin",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
-	"storageAdmin.isAdoptedLegacyTable": {
-		capName: "storage-admin",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"storageAdmin.listKinds": {
 		capName: "storage-admin",
 		capScope: "system",
@@ -69953,12 +69924,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"storageAdmin.readLegacyCollection": {
-		capName: "storage-admin",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"storageAdmin.readRecords": {
 		capName: "storage-admin",
 		capScope: "system",
@@ -73773,12 +73738,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"storageAdmin.adoptRecords": [{
-		name: "records",
-		form: "object-array",
-		optional: false,
-		itemField: "deviceId"
-	}],
 	"storageAdmin.readRecords": [{
 		name: "deviceId",
 		form: "single",
@@ -75499,12 +75458,6 @@ Object.defineProperty(exports, "resolveIconKey", {
 		return resolveIconKey;
 	}
 });
-Object.defineProperty(exports, "settingsArrayAdoptsFrom", {
-	enumerable: true,
-	get: function() {
-		return settingsArrayAdoptsFrom;
-	}
-});
 Object.defineProperty(exports, "string", {
 	enumerable: true,
 	get: function() {

package/dist/oidc/auth-oidc.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-C22DtwR1.js");
+const require_dist = require("../dist-a0m2kh9g.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_dist.__toESM(node_crypto);
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -907,8 +907,7 @@ var oidcProviderEntryKind = require_dist.defineEntryKind(OIDC_PROVIDER_KIND, {
 	title: "OIDC providers",
 	nameField: "displayName",
 	schema: OidcProviderBodySchema,
-	writeTrigger: "an operator adds, edits or removes an OpenID Connect identity provider",
-	adoptsFrom: require_dist.settingsArrayAdoptsFrom("auth-oidc", "providers")
+	writeTrigger: "an operator adds, edits or removes an OpenID Connect identity provider"
 });
 //#endregion
 //#region src/oidc/oidc-provider-store.ts
@@ -1085,8 +1084,8 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			this.activeProviders = await this.loadPersistedProviders();
 		} catch (err) {
 			const msg = err instanceof Error ? err.message : String(err);
-			if (!msg.startsWith("records/foreign-marker:") && !msg.startsWith("records/adoption-pending:")) throw err;
-			this.ctx.logger.warn("OIDC: deferred config→records migrate (secret markers need adopt remap)", { meta: { error: msg } });
+			if (!msg.startsWith("records/foreign-marker:")) throw err;
+			this.ctx.logger.warn("OIDC: deferred config→records copy (a secret marker is bound to another row)", { meta: { error: msg } });
 			this.activeProviders = [...this.config.providers];
 		}
 		this.rebuildInstances();

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { A as settingsArrayAdoptsFrom, C as SECRET_CLEAR, D as globalSecretScope, I as object, L as string, M as _enum, O as isSecretClear, S as RecordSecretUnavailableError, T as defineEntryKind, _ as requestMountPrefix, b as errMsg, c as authProviderCapability, d as loginMethodCapability, f as normalizeOrigin, g as pickRequestOrigin, h as parseAppPageLang, i as addonRoutesCapability, j as toSecretFieldView, k as isSecretMarker, l as buildAddonRouteProvider, m as parseAppFlowRequest, n as APP_REFUSED_PATH, o as advertisedHubOrigins, p as oidcConnectionsCapability, r as SSO_STATE_COOKIE, s as appFlowLocation, t as APP_FLOW_DEFAULT_REDIRECT, u as claimedRequestOrigins, v as resolveIconKey, w as arrayItemFieldPath, x as BaseAddon } from "../dist-BFPqfaub.mjs";
+import { A as toSecretFieldView, C as SECRET_CLEAR, D as globalSecretScope, F as object, I as string, O as isSecretClear, S as RecordSecretUnavailableError, T as defineEntryKind, _ as requestMountPrefix, b as errMsg, c as authProviderCapability, d as loginMethodCapability, f as normalizeOrigin, g as pickRequestOrigin, h as parseAppPageLang, i as addonRoutesCapability, j as _enum, k as isSecretMarker, l as buildAddonRouteProvider, m as parseAppFlowRequest, n as APP_REFUSED_PATH, o as advertisedHubOrigins, p as oidcConnectionsCapability, r as SSO_STATE_COOKIE, s as appFlowLocation, t as APP_FLOW_DEFAULT_REDIRECT, u as claimedRequestOrigins, v as resolveIconKey, w as arrayItemFieldPath, x as BaseAddon } from "../dist-B8sfNbOk.mjs";
 import * as crypto$1 from "node:crypto";
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
@@ -902,8 +902,7 @@ var oidcProviderEntryKind = defineEntryKind(OIDC_PROVIDER_KIND, {
 	title: "OIDC providers",
 	nameField: "displayName",
 	schema: OidcProviderBodySchema,
-	writeTrigger: "an operator adds, edits or removes an OpenID Connect identity provider",
-	adoptsFrom: settingsArrayAdoptsFrom("auth-oidc", "providers")
+	writeTrigger: "an operator adds, edits or removes an OpenID Connect identity provider"
 });
 //#endregion
 //#region src/oidc/oidc-provider-store.ts
@@ -1080,8 +1079,8 @@ var AuthOidcAddon = class extends BaseAddon {
 			this.activeProviders = await this.loadPersistedProviders();
 		} catch (err) {
 			const msg = err instanceof Error ? err.message : String(err);
-			if (!msg.startsWith("records/foreign-marker:") && !msg.startsWith("records/adoption-pending:")) throw err;
-			this.ctx.logger.warn("OIDC: deferred config→records migrate (secret markers need adopt remap)", { meta: { error: msg } });
+			if (!msg.startsWith("records/foreign-marker:")) throw err;
+			this.ctx.logger.warn("OIDC: deferred config→records copy (a secret marker is bound to another row)", { meta: { error: msg } });
 			this.activeProviders = [...this.config.providers];
 		}
 		this.rebuildInstances();

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-CSECtd7j.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-BIwATeJB.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.2.139",
+		version: "1.2.142",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.389",
+		version: "1.2.392",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.306",
+		version: "1.2.309",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",

package/dist/webauthn/auth-webauthn.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-C22DtwR1.js");
+const require_dist = require("../dist-a0m2kh9g.js");
 let stream = require("stream");
 stream = require_dist.__toESM(stream, 1);
 let http = require("http");
@@ -12118,12 +12118,9 @@ async function hubBrowserOrigin(localNetwork, logger) {
 //#endregion
 //#region src/webauthn/record-kinds.ts
 /**
-* Record kinds owned by `auth-webauthn` (records plan phase 6 / §2.8).
-*
-* Legacy tables are OPERATOR-ONLY drop after verify — never the orphan job.
+* Record kinds owned by `auth-webauthn` (records plan phase 6 / §2.8). The
+* legacy `auth-webauthn:*` collections they replaced are gone (D900).
 */
-var USER_PASSKEYS_LEGACY = "auth-webauthn:user_passkeys";
-var USER_PASSKEY_PREFS_LEGACY = "auth-webauthn:user_passkey_prefs";
 var PasskeyBodySchema = require_dist.object({
 	credentialId: require_dist.string(),
 	userId: require_dist.string(),
@@ -12153,8 +12150,7 @@ var authWebauthnRecordKinds = require_dist.defineRecordKinds({
 			name: "user",
 			fields: ["userId"]
 		}],
-		retention: { none: "removePasskey only — no sweep; user delete does not cascade" },
-		adoptsFrom: USER_PASSKEYS_LEGACY
+		retention: { none: "removePasskey only — no sweep; user delete does not cascade" }
 	},
 	"passkey-prefs": {
 		schema: PasskeyPrefBodySchema,
@@ -12162,92 +12158,15 @@ var authWebauthnRecordKinds = require_dist.defineRecordKinds({
 		writeTrigger: "setSecondFactorPreference upserts one row per user",
 		device: "none",
 		at: "none",
-		retention: { none: "missing row reads as second factor OFF" },
-		adoptsFrom: USER_PASSKEY_PREFS_LEGACY
+		retention: { none: "missing row reads as second factor OFF" }
 	}
 });
 //#endregion
 //#region src/webauthn/passkey-store.ts
-var COLLECTION = "auth-webauthn:user_passkeys";
-var PREF_COLLECTION = "auth-webauthn:user_passkey_prefs";
-var PREF_COLUMNS = [
-	{
-		name: "userId",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "secondFactorEnabled",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "updatedAt",
-		type: "INTEGER",
-		notNull: true
-	}
-];
 var StoredPreferenceSchema = require_dist.object({
 	secondFactorEnabled: require_dist.boolean(),
 	updatedAt: require_dist.number()
 });
-var COLUMNS = [
-	{
-		name: "credentialId",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "userId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "publicKey",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "counter",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "transports",
-		type: "JSON"
-	},
-	{
-		name: "label",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "lastUsedAt",
-		type: "INTEGER"
-	}
-];
-async function declarePasskeySchema(store, options) {
-	const skip = new Set(options?.skipCollections ?? []);
-	if (!skip.has(COLLECTION)) await store.declareCollection.mutate({
-		collection: COLLECTION,
-		columns: COLUMNS,
-		indexes: [{
-			name: "idx_user_passkeys_user_id",
-			columns: ["userId"]
-		}]
-	});
-	if (!skip.has(PREF_COLLECTION)) await store.declareCollection.mutate({
-		collection: PREF_COLLECTION,
-		columns: PREF_COLUMNS
-	});
-}
 function parseRow(data) {
 	const credentialId = data["credentialId"];
 	const userId = data["userId"];
@@ -12293,66 +12212,34 @@ function rowToPasskey(id, body) {
 		...rest
 	});
 }
+/** The passkeys of every user, on `ctx.records` (D900: the legacy collections are gone). */
 var PasskeyStore = class {
 	passkeysKind;
 	prefsKind;
-	store;
 	constructor(deps) {
-		if ("passkeysKind" in deps) {
-			this.passkeysKind = deps.passkeysKind;
-			this.prefsKind = deps.prefsKind;
-			this.store = deps.legacyStore ?? null;
-		} else {
-			this.passkeysKind = null;
-			this.prefsKind = null;
-			this.store = deps;
-		}
+		this.passkeysKind = deps.passkeysKind;
+		this.prefsKind = deps.prefsKind;
 	}
 	async insert(pk) {
-		const kind = this.passkeysKind;
-		if (kind !== null) {
-			const parsed = authWebauthnRecordKinds.passkeys.schema.safeParse(pkToBody(pk));
-			if (!parsed.success) throw new Error(parsed.error.message);
-			await kind.put({
-				id: pk.credentialId,
-				data: parsed.data
-			});
-			return;
-		}
-		await this.store.insert.mutate({
-			collection: COLLECTION,
-			record: {
-				id: pk.credentialId,
-				data: { ...pk }
-			}
+		const parsed = authWebauthnRecordKinds.passkeys.schema.safeParse(pkToBody(pk));
+		if (!parsed.success) throw new Error(parsed.error.message);
+		await this.passkeysKind.put({
+			id: pk.credentialId,
+			data: parsed.data
 		});
 	}
 	async findByCredentialId(credentialId) {
-		const kind = this.passkeysKind;
-		if (kind !== null) {
-			const row = (await kind.query({
-				where: { credentialId },
-				limit: 1
-			})).records[0];
-			return row === void 0 ? null : rowToPasskey(row.id, row.data);
-		}
-		const results = await this.store.query.query({
-			collection: COLLECTION,
-			filter: { where: { credentialId } }
-		});
-		if (results.length === 0) return null;
-		return parseRow(results[0].data);
+		const row = (await this.passkeysKind.query({
+			where: { credentialId },
+			limit: 1
+		})).records[0];
+		return row === void 0 ? null : rowToPasskey(row.id, row.data);
 	}
 	async findByUserId(userId) {
-		const kind = this.passkeysKind;
-		if (kind !== null) return (await kind.query({
+		return (await this.passkeysKind.query({
 			where: { userId },
 			limit: 500
 		})).records.map((row) => rowToPasskey(row.id, row.data));
-		return (await this.store.query.query({
-			collection: COLLECTION,
-			filter: { where: { userId } }
-		})).map((r) => parseRow(r.data));
 	}
 	async updateCounter(credentialId, counter) {
 		const existing = await this.findByCredentialId(credentialId);
@@ -12362,45 +12249,19 @@ var PasskeyStore = class {
 			counter,
 			lastUsedAt: Date.now()
 		};
-		const kind = this.passkeysKind;
-		if (kind !== null) {
-			const parsed = authWebauthnRecordKinds.passkeys.schema.safeParse(pkToBody(next));
-			if (!parsed.success) return;
-			await kind.put({
-				id: credentialId,
-				data: parsed.data
-			});
-			return;
-		}
-		await this.store.update.mutate({
-			collection: COLLECTION,
+		const parsed = authWebauthnRecordKinds.passkeys.schema.safeParse(pkToBody(next));
+		if (!parsed.success) return;
+		await this.passkeysKind.put({
 			id: credentialId,
-			data: { ...next }
+			data: parsed.data
 		});
 	}
 	async delete(credentialId) {
-		const kind = this.passkeysKind;
-		if (kind !== null) {
-			await kind.delete(credentialId);
-			return;
-		}
-		await this.store.delete.mutate({
-			collection: COLLECTION,
-			key: credentialId
-		});
+		await this.passkeysKind.delete(credentialId);
 	}
 	async getSecondFactorPreference(userId) {
-		const prefsKind = this.prefsKind;
-		if (prefsKind !== null) {
-			const row = await prefsKind.get(userId);
-			const parsed = StoredPreferenceSchema.safeParse(row?.data);
-			return parsed.success ? parsed.data.secondFactorEnabled : false;
-		}
-		const raw = await this.store.get.query({
-			collection: PREF_COLLECTION,
-			key: userId
-		});
-		const parsed = StoredPreferenceSchema.safeParse(raw);
+		const row = await this.prefsKind.get(userId);
+		const parsed = StoredPreferenceSchema.safeParse(row?.data);
 		return parsed.success ? parsed.data.secondFactorEnabled : false;
 	}
 	async setSecondFactorPreference(userId, enabled) {
@@ -12408,20 +12269,11 @@ var PasskeyStore = class {
 			secondFactorEnabled: enabled,
 			updatedAt: Date.now()
 		};
-		const prefsKind = this.prefsKind;
-		if (prefsKind !== null) {
-			const parsed = authWebauthnRecordKinds["passkey-prefs"].schema.safeParse(value);
-			if (!parsed.success) throw new Error(parsed.error.message);
-			await prefsKind.put({
-				id: userId,
-				data: parsed.data
-			});
-			return;
-		}
-		await this.store.set.mutate({
-			collection: PREF_COLLECTION,
-			key: userId,
-			value
+		const parsed = authWebauthnRecordKinds["passkey-prefs"].schema.safeParse(value);
+		if (!parsed.success) throw new Error(parsed.error.message);
+		await this.prefsKind.put({
+			id: userId,
+			data: parsed.data
 		});
 	}
 };
@@ -12603,20 +12455,12 @@ var AuthWebauthnAddon = class extends require_dist.BaseAddon {
 		super({ ...DEFAULT_CONFIG });
 	}
 	async onInitialize() {
-		const settingsStore = this.ctx.api?.settingsStore;
 		const records = this.ctx.records;
-		if (!settingsStore || !records) throw new Error("addon-auth-webauthn: settingsStore and ctx.records required (phase 6)");
-		try {
-			await records.declare(authWebauthnRecordKinds);
-		} catch (err) {
-			if (!(err instanceof Error ? err.message : String(err)).startsWith("records/adoption-pending:")) throw err;
-			this.ctx.logger.info("phase 6: webauthn kinds declared; legacy until adopt completes");
-		}
-		await declarePasskeySchema(settingsStore, { skipCollections: [USER_PASSKEYS_LEGACY, USER_PASSKEY_PREFS_LEGACY] });
+		if (!records) throw new Error("addon-auth-webauthn: ctx.records required");
+		await records.declare(authWebauthnRecordKinds);
 		this.store = new PasskeyStore({
 			passkeysKind: records.kind(authWebauthnRecordKinds.passkeys),
-			prefsKind: records.kind(authWebauthnRecordKinds["passkey-prefs"]),
-			legacyStore: settingsStore
+			prefsKind: records.kind(authWebauthnRecordKinds["passkey-prefs"])
 		});
 		const provider = {
 			beginRegistration: async ({ userId, username }) => this.beginRegistration(userId, username),

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,4 +1,4 @@
-import { E as defineRecordKinds, F as number, I as object, L as string, N as array, P as boolean, a as addonWidgetsSourceCapability, d as loginMethodCapability, x as BaseAddon, y as userPasskeysCapability } from "../dist-BFPqfaub.mjs";
+import { E as defineRecordKinds, F as object, I as string, M as array, N as boolean, P as number, a as addonWidgetsSourceCapability, d as loginMethodCapability, x as BaseAddon, y as userPasskeysCapability } from "../dist-B8sfNbOk.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";
@@ -12145,12 +12145,9 @@ async function hubBrowserOrigin(localNetwork, logger) {
 //#endregion
 //#region src/webauthn/record-kinds.ts
 /**
-* Record kinds owned by `auth-webauthn` (records plan phase 6 / §2.8).
-*
-* Legacy tables are OPERATOR-ONLY drop after verify — never the orphan job.
+* Record kinds owned by `auth-webauthn` (records plan phase 6 / §2.8). The
+* legacy `auth-webauthn:*` collections they replaced are gone (D900).
 */
-var USER_PASSKEYS_LEGACY = "auth-webauthn:user_passkeys";
-var USER_PASSKEY_PREFS_LEGACY = "auth-webauthn:user_passkey_prefs";
 var PasskeyBodySchema = object({
 	credentialId: string(),
 	userId: string(),
@@ -12180,8 +12177,7 @@ var authWebauthnRecordKinds = defineRecordKinds({
 			name: "user",
 			fields: ["userId"]
 		}],
-		retention: { none: "removePasskey only — no sweep; user delete does not cascade" },
-		adoptsFrom: USER_PASSKEYS_LEGACY
+		retention: { none: "removePasskey only — no sweep; user delete does not cascade" }
 	},
 	"passkey-prefs": {
 		schema: PasskeyPrefBodySchema,
@@ -12189,92 +12185,15 @@ var authWebauthnRecordKinds = defineRecordKinds({
 		writeTrigger: "setSecondFactorPreference upserts one row per user",
 		device: "none",
 		at: "none",
-		retention: { none: "missing row reads as second factor OFF" },
-		adoptsFrom: USER_PASSKEY_PREFS_LEGACY
+		retention: { none: "missing row reads as second factor OFF" }
 	}
 });
 //#endregion
 //#region src/webauthn/passkey-store.ts
-var COLLECTION = "auth-webauthn:user_passkeys";
-var PREF_COLLECTION = "auth-webauthn:user_passkey_prefs";
-var PREF_COLUMNS = [
-	{
-		name: "userId",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "secondFactorEnabled",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "updatedAt",
-		type: "INTEGER",
-		notNull: true
-	}
-];
 var StoredPreferenceSchema = object({
 	secondFactorEnabled: boolean(),
 	updatedAt: number()
 });
-var COLUMNS = [
-	{
-		name: "credentialId",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "userId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "publicKey",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "counter",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "transports",
-		type: "JSON"
-	},
-	{
-		name: "label",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "lastUsedAt",
-		type: "INTEGER"
-	}
-];
-async function declarePasskeySchema(store, options) {
-	const skip = new Set(options?.skipCollections ?? []);
-	if (!skip.has(COLLECTION)) await store.declareCollection.mutate({
-		collection: COLLECTION,
-		columns: COLUMNS,
-		indexes: [{
-			name: "idx_user_passkeys_user_id",
-			columns: ["userId"]
-		}]
-	});
-	if (!skip.has(PREF_COLLECTION)) await store.declareCollection.mutate({
-		collection: PREF_COLLECTION,
-		columns: PREF_COLUMNS
-	});
-}
 function parseRow(data) {
 	const credentialId = data["credentialId"];
 	const userId = data["userId"];
@@ -12320,66 +12239,34 @@ function rowToPasskey(id, body) {
 		...rest
 	});
 }
+/** The passkeys of every user, on `ctx.records` (D900: the legacy collections are gone). */
 var PasskeyStore = class {
 	passkeysKind;
 	prefsKind;
-	store;
 	constructor(deps) {
-		if ("passkeysKind" in deps) {
-			this.passkeysKind = deps.passkeysKind;
-			this.prefsKind = deps.prefsKind;
-			this.store = deps.legacyStore ?? null;
-		} else {
-			this.passkeysKind = null;
-			this.prefsKind = null;
-			this.store = deps;
-		}
+		this.passkeysKind = deps.passkeysKind;
+		this.prefsKind = deps.prefsKind;
 	}
 	async insert(pk) {
-		const kind = this.passkeysKind;
-		if (kind !== null) {
-			const parsed = authWebauthnRecordKinds.passkeys.schema.safeParse(pkToBody(pk));
-			if (!parsed.success) throw new Error(parsed.error.message);
-			await kind.put({
-				id: pk.credentialId,
-				data: parsed.data
-			});
-			return;
-		}
-		await this.store.insert.mutate({
-			collection: COLLECTION,
-			record: {
-				id: pk.credentialId,
-				data: { ...pk }
-			}
+		const parsed = authWebauthnRecordKinds.passkeys.schema.safeParse(pkToBody(pk));
+		if (!parsed.success) throw new Error(parsed.error.message);
+		await this.passkeysKind.put({
+			id: pk.credentialId,
+			data: parsed.data
 		});
 	}
 	async findByCredentialId(credentialId) {
-		const kind = this.passkeysKind;
-		if (kind !== null) {
-			const row = (await kind.query({
-				where: { credentialId },
-				limit: 1
-			})).records[0];
-			return row === void 0 ? null : rowToPasskey(row.id, row.data);
-		}
-		const results = await this.store.query.query({
-			collection: COLLECTION,
-			filter: { where: { credentialId } }
-		});
-		if (results.length === 0) return null;
-		return parseRow(results[0].data);
+		const row = (await this.passkeysKind.query({
+			where: { credentialId },
+			limit: 1
+		})).records[0];
+		return row === void 0 ? null : rowToPasskey(row.id, row.data);
 	}
 	async findByUserId(userId) {
-		const kind = this.passkeysKind;
-		if (kind !== null) return (await kind.query({
+		return (await this.passkeysKind.query({
 			where: { userId },
 			limit: 500
 		})).records.map((row) => rowToPasskey(row.id, row.data));
-		return (await this.store.query.query({
-			collection: COLLECTION,
-			filter: { where: { userId } }
-		})).map((r) => parseRow(r.data));
 	}
 	async updateCounter(credentialId, counter) {
 		const existing = await this.findByCredentialId(credentialId);
@@ -12389,45 +12276,19 @@ var PasskeyStore = class {
 			counter,
 			lastUsedAt: Date.now()
 		};
-		const kind = this.passkeysKind;
-		if (kind !== null) {
-			const parsed = authWebauthnRecordKinds.passkeys.schema.safeParse(pkToBody(next));
-			if (!parsed.success) return;
-			await kind.put({
-				id: credentialId,
-				data: parsed.data
-			});
-			return;
-		}
-		await this.store.update.mutate({
-			collection: COLLECTION,
+		const parsed = authWebauthnRecordKinds.passkeys.schema.safeParse(pkToBody(next));
+		if (!parsed.success) return;
+		await this.passkeysKind.put({
 			id: credentialId,
-			data: { ...next }
+			data: parsed.data
 		});
 	}
 	async delete(credentialId) {
-		const kind = this.passkeysKind;
-		if (kind !== null) {
-			await kind.delete(credentialId);
-			return;
-		}
-		await this.store.delete.mutate({
-			collection: COLLECTION,
-			key: credentialId
-		});
+		await this.passkeysKind.delete(credentialId);
 	}
 	async getSecondFactorPreference(userId) {
-		const prefsKind = this.prefsKind;
-		if (prefsKind !== null) {
-			const row = await prefsKind.get(userId);
-			const parsed = StoredPreferenceSchema.safeParse(row?.data);
-			return parsed.success ? parsed.data.secondFactorEnabled : false;
-		}
-		const raw = await this.store.get.query({
-			collection: PREF_COLLECTION,
-			key: userId
-		});
-		const parsed = StoredPreferenceSchema.safeParse(raw);
+		const row = await this.prefsKind.get(userId);
+		const parsed = StoredPreferenceSchema.safeParse(row?.data);
 		return parsed.success ? parsed.data.secondFactorEnabled : false;
 	}
 	async setSecondFactorPreference(userId, enabled) {
@@ -12435,20 +12296,11 @@ var PasskeyStore = class {
 			secondFactorEnabled: enabled,
 			updatedAt: Date.now()
 		};
-		const prefsKind = this.prefsKind;
-		if (prefsKind !== null) {
-			const parsed = authWebauthnRecordKinds["passkey-prefs"].schema.safeParse(value);
-			if (!parsed.success) throw new Error(parsed.error.message);
-			await prefsKind.put({
-				id: userId,
-				data: parsed.data
-			});
-			return;
-		}
-		await this.store.set.mutate({
-			collection: PREF_COLLECTION,
-			key: userId,
-			value
+		const parsed = authWebauthnRecordKinds["passkey-prefs"].schema.safeParse(value);
+		if (!parsed.success) throw new Error(parsed.error.message);
+		await this.prefsKind.put({
+			id: userId,
+			data: parsed.data
 		});
 	}
 };
@@ -12593,20 +12445,12 @@ var AuthWebauthnAddon = class extends BaseAddon {
 		super({ ...DEFAULT_CONFIG });
 	}
 	async onInitialize() {
-		const settingsStore = this.ctx.api?.settingsStore;
 		const records = this.ctx.records;
-		if (!settingsStore || !records) throw new Error("addon-auth-webauthn: settingsStore and ctx.records required (phase 6)");
-		try {
-			await records.declare(authWebauthnRecordKinds);
-		} catch (err) {
-			if (!(err instanceof Error ? err.message : String(err)).startsWith("records/adoption-pending:")) throw err;
-			this.ctx.logger.info("phase 6: webauthn kinds declared; legacy until adopt completes");
-		}
-		await declarePasskeySchema(settingsStore, { skipCollections: [USER_PASSKEYS_LEGACY, USER_PASSKEY_PREFS_LEGACY] });
+		if (!records) throw new Error("addon-auth-webauthn: ctx.records required");
+		await records.declare(authWebauthnRecordKinds);
 		this.store = new PasskeyStore({
 			passkeysKind: records.kind(authWebauthnRecordKinds.passkeys),
-			prefsKind: records.kind(authWebauthnRecordKinds["passkey-prefs"]),
-			legacyStore: settingsStore
+			prefsKind: records.kind(authWebauthnRecordKinds["passkey-prefs"])
 		});
 		const provider = {
 			beginRegistration: async ({ userId, username }) => this.beginRegistration(userId, username),

package/dist/webauthn/{hostInit-IppC0sA4.mjs → hostInit-V-UlvjJp.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.389",
+				version: "1.2.392",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.2.139",
+				version: "1.2.142",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.306",
+				version: "1.2.309",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/webauthn/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-CSECtd7j.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-BIwATeJB.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-auth",
-  "version": "1.2.155",
+  "version": "1.2.157",
   "description": "Authentication bundle — OIDC and WebAuthn/passkey. Multi-entry npm package shipping 2 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
   "keywords": [
     "camstack",