@camstack/system 1.2.29 → 1.2.30

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,62 @@
-import { Dt as parseJsonUnknown, at as errMsg, c as RUNTIME_DEFAULTS, gt as asJsonObject, ot as BaseAddon, x as dataStoreProviderCapability } from "../../dist-B7hOpr5i.mjs";
+import { Dt as parseJsonUnknown, at as errMsg, c as RUNTIME_DEFAULTS, gt as asJsonObject, ot as BaseAddon, x as dataStoreProviderCapability } from "../../dist-Dr_P0DOB.mjs";
 import { randomUUID } from "node:crypto";
 import Database from "better-sqlite3";
+//#region src/builtins/sqlite-storage/filter-compiler.ts
+/** Thrown by `mutate` mode. Distinct type so a caller can map it to a 400. */
+var UnsafeFilterError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "UnsafeFilterError";
+	}
+};
+/**
+* SQL expression for `field` on this collection, or `null` when it cannot be
+* expressed: a real column → `"field"`; a KV blob field → `json_extract`;
+* anything else on a structured table → unresolvable. Exported because
+* `histogram` needs the same resolution for its bucketed column.
+*/
+function fieldExprFor(field, shape) {
+	if (field === shape.primaryKey || shape.columns.has(field)) return `"${field}"`;
+	if (shape.kvBlobColumn !== null) return `json_extract("${shape.kvBlobColumn}", '$.${field}')`;
+	return null;
+}
+function compileFilter(filter, shape, mode, serialize) {
+	const clauses = [];
+	const params = [];
+	const resolve = (field) => {
+		const expr = fieldExprFor(field, shape);
+		if (expr === null && mode === "mutate") throw new UnsafeFilterError(`filter refers to "${field}", which this collection cannot express — refusing to run a bulk mutation with a dropped predicate`);
+		return expr;
+	};
+	for (const [field, value] of Object.entries(filter?.where ?? {})) {
+		const expr = resolve(field);
+		if (expr === null) continue;
+		clauses.push(`${expr} = ?`);
+		params.push(serialize(value));
+	}
+	for (const [field, values] of Object.entries(filter?.whereIn ?? {})) {
+		const expr = resolve(field);
+		if (expr === null) continue;
+		if (values.length === 0) {
+			if (mode === "mutate") throw new UnsafeFilterError(`filter has an empty whereIn list for "${field}" — it matches nothing, which is more likely a caller bug than an intent`);
+			continue;
+		}
+		clauses.push(`${expr} IN (${values.map(() => "?").join(", ")})`);
+		for (const v of values) params.push(serialize(v));
+	}
+	for (const [field, [low, high]] of Object.entries(filter?.whereBetween ?? {})) {
+		const expr = resolve(field);
+		if (expr === null) continue;
+		clauses.push(`${expr} BETWEEN ? AND ?`);
+		params.push(serialize(low), serialize(high));
+	}
+	if (clauses.length === 0 && mode === "mutate") throw new UnsafeFilterError("filter compiled to no predicate — that would affect every row in the collection; use the explicit clear operation if that is the intent");
+	return {
+		whereSql: clauses.length > 0 ? ` WHERE ${clauses.join(" AND ")}` : "",
+		params
+	};
+}
+//#endregion
 //#region src/builtins/sqlite-storage/sqlite-settings-backend.ts
 function parseRowData(raw) {
 	return asJsonObject(parseJsonUnknown(raw)) ?? {};
@@ -183,6 +239,41 @@ var SqliteSettingsBackend = class SqliteSettingsBackend {
 		const decl = this.requireDeclared(scoped);
 		await this.tableDelete(scoped, { [decl.primaryKey]: key });
 	}
+	/**
+	* Bulk delete. One statement, whatever the row count — this is what every
+	* retention path in the system was hand-rolling as a select-then-delete
+	* loop. The filter is compiled in `mutate` mode, so an unresolvable
+	* predicate or an empty one throws before any SQL exists.
+	*/
+	async deleteWhere({ namespace, collection, filter }) {
+		const scoped = this.scopedName(namespace, collection);
+		const decl = this.requireDeclared(scoped);
+		const { whereSql, params } = compileFilter(filter, this.shapeOf(decl), "mutate", (v) => this.serializeColumnValue(v));
+		return { deleted: this.getDb().prepare(`DELETE FROM "${scoped}"${whereSql}`).run(...params).changes };
+	}
+	/**
+	* Bulk update. Same filter contract as {@link deleteWhere}.
+	*
+	* Every key of `data` must be a REAL column. A KV-shaped collection keeps
+	* its fields inside a JSON blob, and setting one would need `json_set` with
+	* read-modify-write semantics this method does not have — so it refuses
+	* rather than writing a column that does not exist, which is what the
+	* uncapped `tableUpdate` would have done.
+	*/
+	async updateWhere({ namespace, collection, filter, data }) {
+		const scoped = this.scopedName(namespace, collection);
+		const decl = this.requireDeclared(scoped);
+		const setClauses = [];
+		const setValues = [];
+		for (const [key, value] of Object.entries(data)) {
+			if (key !== decl.primaryKey && !decl.columns.has(key)) throw new UnsafeFilterError(`updateWhere cannot set "${key}" on "${scoped}" — it is not a column of this collection`);
+			setClauses.push(`"${key}" = ?`);
+			setValues.push(this.serializeColumnValue(value));
+		}
+		if (setClauses.length === 0) throw new UnsafeFilterError("updateWhere was given no fields to set");
+		const { whereSql, params } = compileFilter(filter, this.shapeOf(decl), "mutate", (v) => this.serializeColumnValue(v));
+		return { updated: this.getDb().prepare(`UPDATE "${scoped}" SET ${setClauses.join(", ")}${whereSql}`).run(...setValues, ...params).changes };
+	}
 	async count({ namespace, collection, filter }) {
 		const scoped = this.scopedName(namespace, collection);
 		const decl = this.requireDeclared(scoped);
@@ -210,30 +301,10 @@ var SqliteSettingsBackend = class SqliteSettingsBackend {
 	async histogram({ namespace, collection, field, bucketSize, origin, filter }) {
 		const scoped = this.scopedName(namespace, collection);
 		const decl = this.requireDeclared(scoped);
-		const isKvShape = decl.columns.size === 1 && decl.columns.has("data");
-		const isColumn = (f) => f === decl.primaryKey || decl.columns.has(f);
-		const fieldExpr = (f) => {
-			if (isColumn(f)) return `"${f}"`;
-			if (isKvShape) return `json_extract("data", '$.${f}')`;
-			return "";
-		};
-		const col = fieldExpr(field);
-		if (!col) return [];
-		const params = [];
-		const clauses = [];
-		if (filter?.where) for (const [f, value] of Object.entries(filter.where)) {
-			const expr = fieldExpr(f);
-			if (!expr) continue;
-			clauses.push(`${expr} = ?`);
-			params.push(this.serializeColumnValue(value));
-		}
-		if (filter?.whereBetween) for (const [f, [lo, hi]] of Object.entries(filter.whereBetween)) {
-			const expr = fieldExpr(f);
-			if (!expr) continue;
-			clauses.push(`${expr} BETWEEN ? AND ?`);
-			params.push(this.serializeColumnValue(lo), this.serializeColumnValue(hi));
-		}
-		const where = clauses.length > 0 ? ` WHERE ${clauses.join(" AND ")}` : "";
+		const shape = this.shapeOf(decl);
+		const col = fieldExprFor(field, shape);
+		if (col === null) return [];
+		const { whereSql: where, params } = compileFilter(filter, shape, "select", (v) => this.serializeColumnValue(v));
 		const sql = `SELECT ${`CAST((${col} - ?) / ? AS INTEGER)`} AS bucket, COUNT(*) AS count FROM "${scoped}"${where} GROUP BY bucket ORDER BY bucket`;
 		return this.getDb().prepare(sql).all(origin, bucketSize, ...params).map((r) => ({
 			bucket: r.bucket,
@@ -249,43 +320,13 @@ var SqliteSettingsBackend = class SqliteSettingsBackend {
 		const isKvShape = decl.columns.size === 1 && decl.columns.has("data");
 		let sql = `SELECT ${[`"${decl.primaryKey}"`, ...[...decl.columns].map((c) => `"${c}"`)].join(", ")} FROM "${table}"`;
 		const params = [];
-		const whereClauses = [];
-		const isColumn = (f) => f === decl.primaryKey || decl.columns.has(f);
-		/**
-		* SQL expression for `field` on this table.
-		*  - real column → `"field"`
-		*  - KV blob field (e.g. `username` inside `data`) → `json_extract`
-		*  - structured table + non-column → empty string (filter dropped,
-		*    matches legacy structured-table behaviour)
-		*/
-		const fieldExpr = (f) => {
-			if (isColumn(f)) return `"${f}"`;
-			if (isKvShape) return `json_extract("data", '$.${f}')`;
-			return "";
-		};
-		if (filter?.where) for (const [field, value] of Object.entries(filter.where)) {
-			const expr = fieldExpr(field);
-			if (!expr) continue;
-			whereClauses.push(`${expr} = ?`);
-			params.push(this.serializeColumnValue(value));
-		}
-		if (filter?.whereIn) for (const [field, values] of Object.entries(filter.whereIn)) {
-			const expr = fieldExpr(field);
-			if (!expr) continue;
-			const placeholders = values.map(() => "?").join(", ");
-			whereClauses.push(`${expr} IN (${placeholders})`);
-			for (const v of values) params.push(this.serializeColumnValue(v));
-		}
-		if (filter?.whereBetween) for (const [field, [low, high]] of Object.entries(filter.whereBetween)) {
-			const expr = fieldExpr(field);
-			if (!expr) continue;
-			whereClauses.push(`${expr} BETWEEN ? AND ?`);
-			params.push(this.serializeColumnValue(low), this.serializeColumnValue(high));
-		}
-		if (whereClauses.length > 0) sql += ` WHERE ${whereClauses.join(" AND ")}`;
+		const shape = this.shapeOf(decl);
+		const compiled = compileFilter(filter, shape, "select", (v) => this.serializeColumnValue(v));
+		sql += compiled.whereSql;
+		params.push(...compiled.params);
 		if (filter?.orderBy) {
-			const expr = fieldExpr(filter.orderBy.field);
-			if (expr) {
+			const expr = fieldExprFor(filter.orderBy.field, shape);
+			if (expr !== null) {
 				const dir = filter.orderBy.direction === "desc" ? "DESC" : "ASC";
 				sql += ` ORDER BY ${expr} ${dir}`;
 			}
@@ -461,6 +502,19 @@ var SqliteSettingsBackend = class SqliteSettingsBackend {
 	scopedName(namespace, collection) {
 		return namespace ? `${namespace}:${collection}` : collection;
 	}
+	/**
+	* Project a declared collection onto what {@link compileFilter} needs. A
+	* collection whose only column is `data` is KV-shaped: its fields live
+	* inside that blob and are reached with `json_extract`.
+	*/
+	shapeOf(decl) {
+		const isKvShape = decl.columns.size === 1 && decl.columns.has("data");
+		return {
+			primaryKey: decl.primaryKey,
+			columns: decl.columns,
+			kvBlobColumn: isKvShape ? "data" : null
+		};
+	}
 	async declareCollection(input) {
 		const table = this.scopedName(input.namespace, input.collection);
 		if (this.declaredCollections.has(table)) return;

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CPmFYLqq.js");
+const require_dist = require("../../dist-VIwdvws5.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
 let node_fs_promises = require("node:fs/promises");
@@ -770,6 +770,8 @@ function createDataStoreDispatch(getEngines) {
 		insert: async (input) => (await engine()).insert(input),
 		update: async (input) => (await engine()).update(input),
 		delete: async (input) => (await engine()).delete(input),
+		deleteWhere: async (input) => (await engine()).deleteWhere(input),
+		updateWhere: async (input) => (await engine()).updateWhere(input),
 		count: async (input) => (await engine()).count(input),
 		histogram: async (input) => (await engine()).histogram(input),
 		isEmpty: async (input) => (await engine()).isEmpty(input),

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as storageCapability, Et as parseJsonObject, Z as settingsStoreCapability, d as StorageLocationTypeSchema, ot as BaseAddon } from "../../dist-B7hOpr5i.mjs";
+import { $ as storageCapability, Et as parseJsonObject, Z as settingsStoreCapability, d as StorageLocationTypeSchema, ot as BaseAddon } from "../../dist-Dr_P0DOB.mjs";
 import * as path$1 from "node:path";
 import * as fs from "node:fs/promises";
 import { buildStorageLocationRegistry } from "@camstack/system";
@@ -763,6 +763,8 @@ function createDataStoreDispatch(getEngines) {
 		insert: async (input) => (await engine()).insert(input),
 		update: async (input) => (await engine()).update(input),
 		delete: async (input) => (await engine()).delete(input),
+		deleteWhere: async (input) => (await engine()).deleteWhere(input),
+		updateWhere: async (input) => (await engine()).updateWhere(input),
 		count: async (input) => (await engine()).count(input),
 		histogram: async (input) => (await engine()).histogram(input),
 		isEmpty: async (input) => (await engine()).isEmpty(input),

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CPmFYLqq.js");
+const require_dist = require("../../dist-VIwdvws5.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Ct as hydrateSchema, at as errMsg, ot as BaseAddon } from "../../dist-B7hOpr5i.mjs";
+import { Ct as hydrateSchema, at as errMsg, ot as BaseAddon } from "../../dist-Dr_P0DOB.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CPmFYLqq.js");
+const require_dist = require("../../dist-VIwdvws5.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-B7hOpr5i.mjs";
+import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-Dr_P0DOB.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-B7hOpr5i.mjs → dist-Dr_P0DOB.mjs}

@@ -14544,6 +14544,20 @@ var QueryFilterSchema = z.object({
 	limit: z.number().optional(),
 	offset: z.number().optional()
 });
+/**
+* The predicate half of a filter, for BULK MUTATIONS.
+*
+* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
+* meaning for a statement that rewrites a set, and accepting them would invite
+* a caller to believe `limit` bounds the damage. Every field is optional here
+* only so the shape stays composable — the implementation REJECTS a filter
+* that compiles to no predicate, because that is the whole collection.
+*/
+var MutationFilterSchema = z.object({
+	where: z.record(z.string(), z.unknown()).optional(),
+	whereIn: z.record(z.string(), z.array(z.unknown())).optional(),
+	whereBetween: z.record(z.string(), z.tuple([z.unknown(), z.unknown()])).optional()
+});
 /** A single stored record: `{ id, data }`. */
 var SettingsRecordSchema = z.object({
 	id: z.string(),
@@ -14649,6 +14663,36 @@ var settingsStoreCapability = {
 			collection: z.string(),
 			key: z.string()
 		}), z.void(), { kind: "mutation" }),
+		/**
+		* Delete every record matching `filter`, in ONE statement, returning how
+		* many rows went. This exists because its absence made every retention
+		* path in the system an N+1 drain loop: `delete` takes a key, so a sweep
+		* had to SELECT a page of full rows — every column, including the fat
+		* ones — purely to learn their ids, then issue one call per row.
+		*
+		* **The filter is required and must resolve.** A predicate naming
+		* something the collection cannot express is an ERROR here, not a
+		* widening as it is on `query`, and a filter with no predicates is an
+		* error rather than "every row". Deleting a whole collection is a
+		* legitimate intent, but it must be asked for by name — not reached by
+		* an empty object.
+		*/
+		deleteWhere: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			filter: MutationFilterSchema
+		}), z.object({ deleted: z.number().int() }), { kind: "mutation" }),
+		/**
+		* Apply `data` to every record matching `filter`, in one statement,
+		* returning how many rows changed. Same filter contract as
+		* {@link deleteWhere} — an unresolvable predicate is an error.
+		*/
+		updateWhere: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			filter: MutationFilterSchema,
+			data: z.record(z.string(), z.unknown())
+		}), z.object({ updated: z.number().int() }), { kind: "mutation" }),
 		/** Count entries in a collection, optionally filtered. */
 		count: method(z.object({
 			namespace: z.string().optional(),
@@ -14784,6 +14828,19 @@ var dataStoreProviderCapability = {
 			collection: z.string(),
 			key: z.string()
 		}), z.void(), { kind: "mutation" }),
+		/** Delete every record matching `filter`, in one statement. */
+		deleteWhere: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			filter: MutationFilterSchema
+		}), z.object({ deleted: z.number().int() }), { kind: "mutation" }),
+		/** Apply `data` to every record matching `filter`, in one statement. */
+		updateWhere: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			filter: MutationFilterSchema,
+			data: z.record(z.string(), z.unknown())
+		}), z.object({ updated: z.number().int() }), { kind: "mutation" }),
 		/** Count entries in a collection, optionally filtered. */
 		count: method(z.object({
 			namespace: z.string().optional(),
@@ -24963,6 +25020,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"dataStoreProvider.deleteWhere": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"dataStoreProvider.get": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -25011,6 +25074,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.updateWhere": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dayNight.getOptions": {
 		capName: "day-night",
 		capScope: "device",
@@ -28089,6 +28158,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"settingsStore.deleteWhere": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"settingsStore.get": {
 		capName: "settings-store",
 		capScope: "system",
@@ -28131,6 +28206,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.updateWhere": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"smtpProvider.getStatus": {
 		capName: "smtp-provider",
 		capScope: "system",

package/dist/{dist-CPmFYLqq.js → dist-VIwdvws5.js}

@@ -14544,6 +14544,20 @@ var QueryFilterSchema = zod.z.object({
 	limit: zod.z.number().optional(),
 	offset: zod.z.number().optional()
 });
+/**
+* The predicate half of a filter, for BULK MUTATIONS.
+*
+* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
+* meaning for a statement that rewrites a set, and accepting them would invite
+* a caller to believe `limit` bounds the damage. Every field is optional here
+* only so the shape stays composable — the implementation REJECTS a filter
+* that compiles to no predicate, because that is the whole collection.
+*/
+var MutationFilterSchema = zod.z.object({
+	where: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	whereIn: zod.z.record(zod.z.string(), zod.z.array(zod.z.unknown())).optional(),
+	whereBetween: zod.z.record(zod.z.string(), zod.z.tuple([zod.z.unknown(), zod.z.unknown()])).optional()
+});
 /** A single stored record: `{ id, data }`. */
 var SettingsRecordSchema = zod.z.object({
 	id: zod.z.string(),
@@ -14649,6 +14663,36 @@ var settingsStoreCapability = {
 			collection: zod.z.string(),
 			key: zod.z.string()
 		}), zod.z.void(), { kind: "mutation" }),
+		/**
+		* Delete every record matching `filter`, in ONE statement, returning how
+		* many rows went. This exists because its absence made every retention
+		* path in the system an N+1 drain loop: `delete` takes a key, so a sweep
+		* had to SELECT a page of full rows — every column, including the fat
+		* ones — purely to learn their ids, then issue one call per row.
+		*
+		* **The filter is required and must resolve.** A predicate naming
+		* something the collection cannot express is an ERROR here, not a
+		* widening as it is on `query`, and a filter with no predicates is an
+		* error rather than "every row". Deleting a whole collection is a
+		* legitimate intent, but it must be asked for by name — not reached by
+		* an empty object.
+		*/
+		deleteWhere: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			filter: MutationFilterSchema
+		}), zod.z.object({ deleted: zod.z.number().int() }), { kind: "mutation" }),
+		/**
+		* Apply `data` to every record matching `filter`, in one statement,
+		* returning how many rows changed. Same filter contract as
+		* {@link deleteWhere} — an unresolvable predicate is an error.
+		*/
+		updateWhere: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			filter: MutationFilterSchema,
+			data: zod.z.record(zod.z.string(), zod.z.unknown())
+		}), zod.z.object({ updated: zod.z.number().int() }), { kind: "mutation" }),
 		/** Count entries in a collection, optionally filtered. */
 		count: method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -14784,6 +14828,19 @@ var dataStoreProviderCapability = {
 			collection: zod.z.string(),
 			key: zod.z.string()
 		}), zod.z.void(), { kind: "mutation" }),
+		/** Delete every record matching `filter`, in one statement. */
+		deleteWhere: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			filter: MutationFilterSchema
+		}), zod.z.object({ deleted: zod.z.number().int() }), { kind: "mutation" }),
+		/** Apply `data` to every record matching `filter`, in one statement. */
+		updateWhere: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			filter: MutationFilterSchema,
+			data: zod.z.record(zod.z.string(), zod.z.unknown())
+		}), zod.z.object({ updated: zod.z.number().int() }), { kind: "mutation" }),
 		/** Count entries in a collection, optionally filtered. */
 		count: method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -24963,6 +25020,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"dataStoreProvider.deleteWhere": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"dataStoreProvider.get": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -25011,6 +25074,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.updateWhere": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dayNight.getOptions": {
 		capName: "day-night",
 		capScope: "device",
@@ -28089,6 +28158,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"settingsStore.deleteWhere": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"settingsStore.get": {
 		capName: "settings-store",
 		capScope: "system",
@@ -28131,6 +28206,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.updateWhere": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"smtpProvider.getStatus": {
 		capName: "smtp-provider",
 		capScope: "system",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CPmFYLqq.js");
+const require_dist = require("./dist-VIwdvws5.js");
 const require_model_download_service = require("./model-download-service-hf0ookyy.js");
 const require_manifest_python_deps = require("./manifest-python-deps-BqE5j0-O.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
@@ -3574,6 +3574,25 @@ function readPackageJson(pkgJsonPath) {
 		camstackAddons: Array.isArray(addonsField) ? addonsField : null
 	};
 }
+/**
+* Should the bootstrap SKIP seeding `packageName` into /data/addons?
+*
+* True only for the package the closure provides, and only when it actually
+* resolves. Both halves are load-bearing:
+*
+*  - seeding a copy the closure already provides creates one that WINS over
+*    the closure and is never refreshed (bootstrap is seed-only, and
+*    `camstack deploy` of a framework package is rejected on an image hub), so
+*    the node runs first-boot builtins forever while reporting the new
+*    version;
+*  - skipping it when it does NOT resolve is how a fresh deployment was once
+*    made unbootable ("No addon provides required infrastructure capability
+*    storage-provider"). That is why the guard is resolvability rather than a
+*    blanket removal from the bootstrap list.
+*/
+function shouldSkipClosureProvidedSeed(packageName, isResolvable) {
+	return packageName === "@camstack/system" && isResolvable;
+}
 /** Minimal no-op logger for default parameter */
 var noopLogger = {
 	debug() {},
@@ -3593,6 +3612,7 @@ var AddonInstaller = class AddonInstaller {
 	workspaceDir;
 	installSource;
 	logger;
+	isPackageResolvable;
 	/**
 	* Central manifest of installed addons. Tracks version + source +
 	* timestamps + last-backup pointer per package, written atomically
@@ -3608,6 +3628,7 @@ var AddonInstaller = class AddonInstaller {
 		this.workspaceDir = config.workspacePackagesDir;
 		this.logger = logger;
 		this.manifest = new AddonManifest(config.addonsDir);
+		this.isPackageResolvable = config.isPackageResolvable;
 		if (config.installSource) this.installSource = config.installSource;
 		else this.installSource = "npm";
 	}
@@ -3636,6 +3657,25 @@ var AddonInstaller = class AddonInstaller {
 	* hardcoded lists — see design spec
 	* docs/superpowers/specs/2026-05-20-docker-install-from-npm-design.md.
 	*/
+	/**
+	* Is `packageName` reachable through normal resolution — i.e. does the
+	* running closure already provide it?
+	*
+	* Overridable via `AddonInstallerConfig.isPackageResolvable` so a spec can
+	* exercise BOTH sides. That matters more than it looks: the branch that
+	* still seeds is the one protecting a fresh deployment from an unbootable
+	* node, and it is unreachable in a test process where `@camstack/system`
+	* always resolves.
+	*/
+	isResolvableFromClosure(packageName) {
+		if (this.isPackageResolvable) return this.isPackageResolvable(packageName);
+		try {
+			require.resolve(`${packageName}/package.json`);
+			return true;
+		} catch {
+			return false;
+		}
+	}
 	static deriveBootstrapList(metaPackageName) {
 		const pkgJsonId = `${metaPackageName}/package.json`;
 		let pkgPath;
@@ -3718,6 +3758,10 @@ var AddonInstaller = class AddonInstaller {
 				this.logger.debug(`${packageName} — already installed, skipping`);
 				continue;
 			}
+			if (shouldSkipClosureProvidedSeed(packageName, this.isResolvableFromClosure(packageName))) {
+				this.logger.info(`${packageName} — provided by the server closure, not seeding a copy that would shadow it`);
+				continue;
+			}
 			try {
 				if (isLocal) {
 					const pkgDir = this.findLocalPackage(packageName);