@camstack/system 1.2.328 → 1.2.329

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BUejKKBm.js");
+const require_dist = require("./dist-CSs0cFDN.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_composer_composer_addon = require("./builtins/composer/composer.addon.js");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { At as isCollectionArrayMethod, C as METHOD_ACCESS_MAP, Ft as kebabToCamel, Ht as logLevelAtMost, Jn as DATAPLANE_SECRET_HEADER$1, Kn as errMsg$1, Mt as isObjectInput, O as RUNTIME_DEFAULTS, Pt as isVoidInput, Qn as ReadinessTimeoutError, Qt as objectInputDeclaresRequiredDeviceId, Rt as lifecycleJobSchema, Ut as looseSchema, Xn as DEVICE_STATUS_METHOD, Yn as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Zn as ReadinessRegistry, Zt as objectInputDeclaresAddonId, _r as EventCategory$1, b as LOG_LEVEL_RANK, cn as resolveMethodAuth, dn as scopesAllowDeviceCap, dr as parseJsonObject, er as asJsonObject$1, fr as parseJsonUnknown, hr as scopeKey, ir as emitDownForOwnedCaps, kt as isArrayOutputSchema, mr as resolveCapMount, nn as procedureAuthKey, nr as asString$1, or as expandCapMethods, pr as readinessKey, rr as createEvent, t as ALL_CAPABILITY_DEFINITIONS, tr as asNumber, un as scopesAllowAddon, wt as extractNestedAddonId, z as addonSettingsCapability } from "./dist-DWq17vC8.mjs";
+import { $n as DEVICE_SETTINGS_CONTRIBUTION_METHODS, C as LOG_LEVEL_RANK, E as METHOD_ACCESS_MAP, H as addonSettingsCapability, Ht as lifecycleJobSchema, It as isObjectInput, Kt as logLevelAtMost, Nt as isArrayOutputSchema, Ot as extractNestedAddonId, Pt as isCollectionArrayMethod, Qn as DATAPLANE_SECRET_HEADER$1, Rt as isVoidInput, Sr as EventCategory$1, Xn as errMsg$1, _r as readinessKey, ar as asNumber, cr as emitDownForOwnedCaps, er as DEVICE_STATUS_METHOD, fn as resolveMethodAuth, gr as parseJsonUnknown, hn as scopesAllowDeviceCap, hr as parseJsonObject, ir as asJsonObject$1, j as RUNTIME_DEFAULTS, mn as scopesAllowAddon, nn as objectInputDeclaresRequiredDeviceId, nr as ReadinessTimeoutError, on as procedureAuthKey, or as asString$1, qt as looseSchema, sr as createEvent, t as ALL_CAPABILITY_DEFINITIONS, tn as objectInputDeclaresAddonId, tr as ReadinessRegistry, ur as expandCapMethods, vr as resolveCapMount, yr as scopeKey, zt as kebabToCamel } from "./dist-CV7IqaYq.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { ComposerAddon } from "./builtins/composer/composer.addon.mjs";

package/dist/{retired-settings-keys-DBPEzGop.js → retired-settings-keys-CGQnAoRx.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BUejKKBm.js");
+const require_dist = require("./dist-CSs0cFDN.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-BfHclEyd.mjs → retired-settings-keys-DSUs7U6l.mjs}

@@ -1,4 +1,4 @@
-import { er as asJsonObject } from "./dist-DWq17vC8.mjs";
+import { ir as asJsonObject } from "./dist-CV7IqaYq.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/sqlite-snapshot-protocol-2QaTouWV.mjs

@@ -0,0 +1,34 @@
+//#region src/builtins/sqlite-storage/sqlite-snapshot-protocol.ts
+/** Thrown inside the worker by a check that refuses the copy. */
+var SnapshotRefusedError = class extends Error {
+	reason;
+	detail;
+	constructor(reason, detail) {
+		super(`database snapshot refused (${reason}): ${detail}`);
+		this.reason = reason;
+		this.detail = detail;
+		this.name = "SnapshotRefusedError";
+	}
+};
+function isSnapshotWorkerData(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("kind" in value) || value.kind !== "sqlite-snapshot") return false;
+	if (!("livePath" in value) || !("copyPath" in value) || !("pagesPerStep" in value)) return false;
+	return typeof value.livePath === "string" && typeof value.copyPath === "string" && typeof value.pagesPerStep === "number";
+}
+function isTableList(value) {
+	return Array.isArray(value) && value.every((t) => typeof t === "object" && t !== null && "name" in t && "rows" in t && typeof t.name === "string" && typeof t.rows === "number");
+}
+function isVerifiedCopy(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("takenAt" in value) || !("tables" in value) || !("pageCount" in value) || !("pageSize" in value) || !("copyMs" in value) || !("verifyMs" in value)) return false;
+	return typeof value.takenAt === "number" && isTableList(value.tables) && typeof value.pageCount === "number" && typeof value.pageSize === "number" && typeof value.copyMs === "number" && typeof value.verifyMs === "number";
+}
+function isSnapshotWorkerMessage(value) {
+	if (typeof value !== "object" || value === null || !("kind" in value)) return false;
+	if (value.kind === "done") return "copy" in value && isVerifiedCopy(value.copy);
+	if (value.kind === "refused") return "reason" in value && (value.reason === "integrity" || value.reason === "row-count" || value.reason === "failed" || value.reason === "no-space") && "detail" in value && typeof value.detail === "string";
+	return false;
+}
+//#endregion
+export { isSnapshotWorkerData as n, isSnapshotWorkerMessage as r, SnapshotRefusedError as t };

package/dist/sqlite-snapshot-protocol-B9OndqZv.js

@@ -0,0 +1,51 @@
+//#region src/builtins/sqlite-storage/sqlite-snapshot-protocol.ts
+/** Thrown inside the worker by a check that refuses the copy. */
+var SnapshotRefusedError = class extends Error {
+	reason;
+	detail;
+	constructor(reason, detail) {
+		super(`database snapshot refused (${reason}): ${detail}`);
+		this.reason = reason;
+		this.detail = detail;
+		this.name = "SnapshotRefusedError";
+	}
+};
+function isSnapshotWorkerData(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("kind" in value) || value.kind !== "sqlite-snapshot") return false;
+	if (!("livePath" in value) || !("copyPath" in value) || !("pagesPerStep" in value)) return false;
+	return typeof value.livePath === "string" && typeof value.copyPath === "string" && typeof value.pagesPerStep === "number";
+}
+function isTableList(value) {
+	return Array.isArray(value) && value.every((t) => typeof t === "object" && t !== null && "name" in t && "rows" in t && typeof t.name === "string" && typeof t.rows === "number");
+}
+function isVerifiedCopy(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("takenAt" in value) || !("tables" in value) || !("pageCount" in value) || !("pageSize" in value) || !("copyMs" in value) || !("verifyMs" in value)) return false;
+	return typeof value.takenAt === "number" && isTableList(value.tables) && typeof value.pageCount === "number" && typeof value.pageSize === "number" && typeof value.copyMs === "number" && typeof value.verifyMs === "number";
+}
+function isSnapshotWorkerMessage(value) {
+	if (typeof value !== "object" || value === null || !("kind" in value)) return false;
+	if (value.kind === "done") return "copy" in value && isVerifiedCopy(value.copy);
+	if (value.kind === "refused") return "reason" in value && (value.reason === "integrity" || value.reason === "row-count" || value.reason === "failed" || value.reason === "no-space") && "detail" in value && typeof value.detail === "string";
+	return false;
+}
+//#endregion
+Object.defineProperty(exports, "SnapshotRefusedError", {
+	enumerable: true,
+	get: function() {
+		return SnapshotRefusedError;
+	}
+});
+Object.defineProperty(exports, "isSnapshotWorkerData", {
+	enumerable: true,
+	get: function() {
+		return isSnapshotWorkerData;
+	}
+});
+Object.defineProperty(exports, "isSnapshotWorkerMessage", {
+	enumerable: true,
+	get: function() {
+		return isSnapshotWorkerMessage;
+	}
+});

package/dist/sqlite-snapshot-worker.js

@@ -0,0 +1,185 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_chunk = require("./chunk-Cek0wNdY.js");
+const require_sqlite_snapshot_protocol = require("./sqlite-snapshot-protocol-B9OndqZv.js");
+let better_sqlite3 = require("better-sqlite3");
+better_sqlite3 = require_chunk.__toESM(better_sqlite3);
+let node_worker_threads = require("node:worker_threads");
+//#region src/builtins/sqlite-storage/sqlite-snapshot-worker.ts
+/**
+* The snapshot worker — a thread of the process that OWNS a live SQLite
+* database, whose one job is a consistent, verified copy of it (D693).
+*
+* - Its OWN read-only connection to the live file, in the owner's process: the
+*   same footing as the checkpoint worker (D452, D679). No other process opens
+*   the database, and no filesystem call here touches the `.db`, `-wal` or
+*   `-shm` — the copy is written by SQLite's online backup API.
+* - ONE read transaction for the whole copy. `BEGIN`, then the row count of
+*   every b-tree table, then every backup step: they all read the same pinned
+*   WAL snapshot. Writes on the settings connection go on (a WAL reader blocks
+*   no writer) and do NOT restart the copy, because the backup never opens a
+*   read transaction of its own. Without the pin, every write between two
+*   steps would restart the copy from page 1 — forever, on a hub that writes
+*   every second.
+* - The copy is checked before anyone may call it a snapshot: switched to
+*   `journal_mode = DELETE` (one self-contained file), `PRAGMA integrity_check`
+*   must answer exactly `ok`, and every table's row count must EQUAL the count
+*   read in the pinned transaction. The caller renames it into place only on
+*   `done`.
+* - It runs on a thread because both halves are long and synchronous at the
+*   scale of the hub's ~800 MB file: on the settings thread they would stall
+*   every configuration read in the cluster (the D447 failure).
+*
+* A worker entry is a separate bundle (`dist/sqlite-snapshot-worker.js`, wired
+* in `vite.config.ts` next to `wal-checkpoint-worker`). The functions are
+* exported so a spec can drive them in-process; the thread body runs only when
+* this module is loaded AS the snapshot thread.
+*/
+/** Every table with its own b-tree (a virtual table has none: `rootpage = 0`). */
+var BTREE_TABLES_SQL = "SELECT name FROM sqlite_schema WHERE type = 'table' AND rootpage > 0 ORDER BY name";
+function quoteIdent(name) {
+	return `"${name.replace(/"/g, "\"\"")}"`;
+}
+function readNames(db) {
+	const out = [];
+	for (const row of db.prepare(BTREE_TABLES_SQL).all()) if (typeof row === "object" && row !== null && "name" in row && typeof row.name === "string") out.push(row.name);
+	return out;
+}
+function countRows(db, table) {
+	const row = db.prepare(`SELECT count(*) AS n FROM ${quoteIdent(table)}`).get();
+	if (typeof row === "object" && row !== null && "n" in row && typeof row.n === "number") return row.n;
+	throw new Error(`count(*) of ${table} answered no number`);
+}
+function readTables(db) {
+	return readNames(db).map((name) => ({
+		name,
+		rows: countRows(db, name)
+	}));
+}
+/**
+* Copy `source` into `copyPath` from ONE read transaction. `onStep` observes
+* each backup step (a spec interleaves writes there).
+*/
+async function copyPinned(source, copyPath, pagesPerStep, onStep) {
+	const started = Date.now();
+	source.exec("BEGIN");
+	try {
+		const tables = readTables(source);
+		const takenAt = Date.now();
+		await source.backup(copyPath, { progress: () => {
+			onStep?.();
+			return pagesPerStep;
+		} });
+		return {
+			takenAt,
+			tables,
+			copyMs: Date.now() - started
+		};
+	} finally {
+		source.exec("COMMIT");
+	}
+}
+function integrityAnswer(db) {
+	const out = [];
+	for (const row of db.prepare("PRAGMA integrity_check").all()) if (typeof row === "object" && row !== null && "integrity_check" in row) out.push(String(row.integrity_check));
+	return out;
+}
+function describeCountMismatch(expected, actual) {
+	const got = new Map(actual.map((t) => [t.name, t.rows]));
+	const want = new Map(expected.map((t) => [t.name, t.rows]));
+	const diffs = [];
+	for (const [name, rows] of want) {
+		const copyRows = got.get(name);
+		if (copyRows === void 0) diffs.push(`${name}: missing from the copy (source ${rows})`);
+		else if (copyRows !== rows) diffs.push(`${name}: copy ${copyRows} ≠ source ${rows}`);
+	}
+	for (const name of got.keys()) if (!want.has(name)) diffs.push(`${name}: in the copy, not in the source`);
+	return diffs.length === 0 ? null : diffs.join("; ");
+}
+/**
+* The answer of `PRAGMA journal_mode = DELETE` must be `delete`. SQLite answers
+* the mode it is IN, so a switch it could not make comes back as `wal` with no
+* error — and a copy left in WAL needs sidecars that will not travel with it.
+*/
+function requireRollbackJournal(answer) {
+	if (answer !== "delete") throw new require_sqlite_snapshot_protocol.SnapshotRefusedError("failed", `the copy stayed in journal mode ${String(answer)} — it would need sidecars to be read`);
+}
+/**
+* Check a copy against what the pinned source held. Makes the copy one
+* self-contained file first. Throws {@link SnapshotRefusedError}.
+*/
+function verifyCopy(copyPath, expected) {
+	const started = Date.now();
+	const db = new better_sqlite3.default(copyPath);
+	try {
+		requireRollbackJournal(db.pragma("journal_mode = DELETE", { simple: true }));
+		const answer = integrityAnswer(db);
+		if (answer.length !== 1 || answer[0] !== "ok") throw new require_sqlite_snapshot_protocol.SnapshotRefusedError("integrity", answer.slice(0, 5).join(" | "));
+		const mismatch = describeCountMismatch(expected, readTables(db));
+		if (mismatch !== null) throw new require_sqlite_snapshot_protocol.SnapshotRefusedError("row-count", mismatch);
+		const pageCount = db.pragma("page_count", { simple: true });
+		const pageSize = db.pragma("page_size", { simple: true });
+		if (typeof pageCount !== "number" || typeof pageSize !== "number") throw new Error("page_count / page_size answered no number");
+		return {
+			pageCount,
+			pageSize,
+			verifyMs: Date.now() - started
+		};
+	} finally {
+		db.close();
+	}
+}
+/** The whole job: open the live database read-only, copy it pinned, check the copy. */
+async function takeVerifiedCopy(data) {
+	const source = new better_sqlite3.default(data.livePath, { readonly: true });
+	let pinned;
+	try {
+		source.pragma("cache_size = -2048");
+		source.pragma("mmap_size = 0");
+		source.pragma("busy_timeout = 5000");
+		pinned = await copyPinned(source, data.copyPath, data.pagesPerStep);
+	} finally {
+		source.close();
+	}
+	const check = verifyCopy(data.copyPath, pinned.tables);
+	return {
+		takenAt: pinned.takenAt,
+		tables: pinned.tables,
+		pageCount: check.pageCount,
+		pageSize: check.pageSize,
+		copyMs: pinned.copyMs,
+		verifyMs: check.verifyMs
+	};
+}
+function toRefusal(err) {
+	if (err instanceof require_sqlite_snapshot_protocol.SnapshotRefusedError) return {
+		kind: "refused",
+		reason: err.reason,
+		detail: err.detail
+	};
+	return {
+		kind: "refused",
+		reason: "failed",
+		detail: err instanceof Error ? err.message : String(err)
+	};
+}
+async function run(data) {
+	const port = node_worker_threads.parentPort;
+	if (port === null) throw new Error("sqlite-snapshot-worker: no parent port");
+	let message;
+	try {
+		message = {
+			kind: "done",
+			copy: await takeVerifiedCopy(data)
+		};
+	} catch (err) {
+		message = toRefusal(err);
+	}
+	port.postMessage(message);
+	port.close();
+}
+if (!node_worker_threads.isMainThread && require_sqlite_snapshot_protocol.isSnapshotWorkerData(node_worker_threads.workerData)) run(node_worker_threads.workerData);
+//#endregion
+exports.copyPinned = copyPinned;
+exports.requireRollbackJournal = requireRollbackJournal;
+exports.takeVerifiedCopy = takeVerifiedCopy;
+exports.verifyCopy = verifyCopy;

package/dist/sqlite-snapshot-worker.mjs

@@ -0,0 +1,179 @@
+import { n as isSnapshotWorkerData, t as SnapshotRefusedError } from "./sqlite-snapshot-protocol-2QaTouWV.mjs";
+import Database from "better-sqlite3";
+import { isMainThread, parentPort, workerData } from "node:worker_threads";
+//#region src/builtins/sqlite-storage/sqlite-snapshot-worker.ts
+/**
+* The snapshot worker — a thread of the process that OWNS a live SQLite
+* database, whose one job is a consistent, verified copy of it (D693).
+*
+* - Its OWN read-only connection to the live file, in the owner's process: the
+*   same footing as the checkpoint worker (D452, D679). No other process opens
+*   the database, and no filesystem call here touches the `.db`, `-wal` or
+*   `-shm` — the copy is written by SQLite's online backup API.
+* - ONE read transaction for the whole copy. `BEGIN`, then the row count of
+*   every b-tree table, then every backup step: they all read the same pinned
+*   WAL snapshot. Writes on the settings connection go on (a WAL reader blocks
+*   no writer) and do NOT restart the copy, because the backup never opens a
+*   read transaction of its own. Without the pin, every write between two
+*   steps would restart the copy from page 1 — forever, on a hub that writes
+*   every second.
+* - The copy is checked before anyone may call it a snapshot: switched to
+*   `journal_mode = DELETE` (one self-contained file), `PRAGMA integrity_check`
+*   must answer exactly `ok`, and every table's row count must EQUAL the count
+*   read in the pinned transaction. The caller renames it into place only on
+*   `done`.
+* - It runs on a thread because both halves are long and synchronous at the
+*   scale of the hub's ~800 MB file: on the settings thread they would stall
+*   every configuration read in the cluster (the D447 failure).
+*
+* A worker entry is a separate bundle (`dist/sqlite-snapshot-worker.js`, wired
+* in `vite.config.ts` next to `wal-checkpoint-worker`). The functions are
+* exported so a spec can drive them in-process; the thread body runs only when
+* this module is loaded AS the snapshot thread.
+*/
+/** Every table with its own b-tree (a virtual table has none: `rootpage = 0`). */
+var BTREE_TABLES_SQL = "SELECT name FROM sqlite_schema WHERE type = 'table' AND rootpage > 0 ORDER BY name";
+function quoteIdent(name) {
+	return `"${name.replace(/"/g, "\"\"")}"`;
+}
+function readNames(db) {
+	const out = [];
+	for (const row of db.prepare(BTREE_TABLES_SQL).all()) if (typeof row === "object" && row !== null && "name" in row && typeof row.name === "string") out.push(row.name);
+	return out;
+}
+function countRows(db, table) {
+	const row = db.prepare(`SELECT count(*) AS n FROM ${quoteIdent(table)}`).get();
+	if (typeof row === "object" && row !== null && "n" in row && typeof row.n === "number") return row.n;
+	throw new Error(`count(*) of ${table} answered no number`);
+}
+function readTables(db) {
+	return readNames(db).map((name) => ({
+		name,
+		rows: countRows(db, name)
+	}));
+}
+/**
+* Copy `source` into `copyPath` from ONE read transaction. `onStep` observes
+* each backup step (a spec interleaves writes there).
+*/
+async function copyPinned(source, copyPath, pagesPerStep, onStep) {
+	const started = Date.now();
+	source.exec("BEGIN");
+	try {
+		const tables = readTables(source);
+		const takenAt = Date.now();
+		await source.backup(copyPath, { progress: () => {
+			onStep?.();
+			return pagesPerStep;
+		} });
+		return {
+			takenAt,
+			tables,
+			copyMs: Date.now() - started
+		};
+	} finally {
+		source.exec("COMMIT");
+	}
+}
+function integrityAnswer(db) {
+	const out = [];
+	for (const row of db.prepare("PRAGMA integrity_check").all()) if (typeof row === "object" && row !== null && "integrity_check" in row) out.push(String(row.integrity_check));
+	return out;
+}
+function describeCountMismatch(expected, actual) {
+	const got = new Map(actual.map((t) => [t.name, t.rows]));
+	const want = new Map(expected.map((t) => [t.name, t.rows]));
+	const diffs = [];
+	for (const [name, rows] of want) {
+		const copyRows = got.get(name);
+		if (copyRows === void 0) diffs.push(`${name}: missing from the copy (source ${rows})`);
+		else if (copyRows !== rows) diffs.push(`${name}: copy ${copyRows} ≠ source ${rows}`);
+	}
+	for (const name of got.keys()) if (!want.has(name)) diffs.push(`${name}: in the copy, not in the source`);
+	return diffs.length === 0 ? null : diffs.join("; ");
+}
+/**
+* The answer of `PRAGMA journal_mode = DELETE` must be `delete`. SQLite answers
+* the mode it is IN, so a switch it could not make comes back as `wal` with no
+* error — and a copy left in WAL needs sidecars that will not travel with it.
+*/
+function requireRollbackJournal(answer) {
+	if (answer !== "delete") throw new SnapshotRefusedError("failed", `the copy stayed in journal mode ${String(answer)} — it would need sidecars to be read`);
+}
+/**
+* Check a copy against what the pinned source held. Makes the copy one
+* self-contained file first. Throws {@link SnapshotRefusedError}.
+*/
+function verifyCopy(copyPath, expected) {
+	const started = Date.now();
+	const db = new Database(copyPath);
+	try {
+		requireRollbackJournal(db.pragma("journal_mode = DELETE", { simple: true }));
+		const answer = integrityAnswer(db);
+		if (answer.length !== 1 || answer[0] !== "ok") throw new SnapshotRefusedError("integrity", answer.slice(0, 5).join(" | "));
+		const mismatch = describeCountMismatch(expected, readTables(db));
+		if (mismatch !== null) throw new SnapshotRefusedError("row-count", mismatch);
+		const pageCount = db.pragma("page_count", { simple: true });
+		const pageSize = db.pragma("page_size", { simple: true });
+		if (typeof pageCount !== "number" || typeof pageSize !== "number") throw new Error("page_count / page_size answered no number");
+		return {
+			pageCount,
+			pageSize,
+			verifyMs: Date.now() - started
+		};
+	} finally {
+		db.close();
+	}
+}
+/** The whole job: open the live database read-only, copy it pinned, check the copy. */
+async function takeVerifiedCopy(data) {
+	const source = new Database(data.livePath, { readonly: true });
+	let pinned;
+	try {
+		source.pragma("cache_size = -2048");
+		source.pragma("mmap_size = 0");
+		source.pragma("busy_timeout = 5000");
+		pinned = await copyPinned(source, data.copyPath, data.pagesPerStep);
+	} finally {
+		source.close();
+	}
+	const check = verifyCopy(data.copyPath, pinned.tables);
+	return {
+		takenAt: pinned.takenAt,
+		tables: pinned.tables,
+		pageCount: check.pageCount,
+		pageSize: check.pageSize,
+		copyMs: pinned.copyMs,
+		verifyMs: check.verifyMs
+	};
+}
+function toRefusal(err) {
+	if (err instanceof SnapshotRefusedError) return {
+		kind: "refused",
+		reason: err.reason,
+		detail: err.detail
+	};
+	return {
+		kind: "refused",
+		reason: "failed",
+		detail: err instanceof Error ? err.message : String(err)
+	};
+}
+async function run(data) {
+	const port = parentPort;
+	if (port === null) throw new Error("sqlite-snapshot-worker: no parent port");
+	let message;
+	try {
+		message = {
+			kind: "done",
+			copy: await takeVerifiedCopy(data)
+		};
+	} catch (err) {
+		message = toRefusal(err);
+	}
+	port.postMessage(message);
+	port.close();
+}
+if (!isMainThread && isSnapshotWorkerData(workerData)) run(workerData);
+//#endregion
+export { copyPinned, requireRollbackJournal, takeVerifiedCopy, verifyCopy };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.328",
+  "version": "1.2.329",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -53,7 +53,7 @@
         "category": "system",
         "name": "SQLite Settings",
         "entry": "./dist/builtins/sqlite-storage/sqlite-settings.addon.js",
-        "description": "The relational ENGINE behind the data door (SQLite WAL). Registers `data-store-provider`, an internal collection cap; the public `settings-store` door is owned by `storage-orchestrator`, which dispatches here. Callers never reach this addon directly — that is what makes the engine replaceable. It ALSO registers `vector-store` (sqlite-vec) from the same database file and the same open handle. Runs in its OWN process (`execution.isolate`) — `better-sqlite3` `Statement.run` does not belong on the event loop that serves the API ([D181]).",
+        "description": "The relational ENGINE behind the data door (SQLite WAL). Registers `data-store-provider`, an internal collection cap; the public `settings-store` door is owned by `storage-orchestrator`, which dispatches here. Callers never reach this addon directly — that is what makes the engine replaceable. It ALSO registers `vector-store` (sqlite-vec) from the same database file and the same open handle, and `database-snapshot`: the verified copy of its database that the nightly backup archives in place of the live files, written by this runner on a thread over its own connection ([D693]). Runs in its OWN process (`execution.isolate`) — `better-sqlite3` `Statement.run` does not belong on the event loop that serves the API ([D181]).",
         "execution": {
           "isolate": true,
           "heapProfile": "heavy",
@@ -65,6 +65,9 @@
           },
           {
             "name": "vector-store"
+          },
+          {
+            "name": "database-snapshot"
           }
         ]
       },