@camstack/system 1.2.390 → 1.2.392

package/dist/builtins/liveness-monitor/liveness-checks.d.ts

@@ -1,64 +1,85 @@
-import { RecordingStatus } from '@camstack/types';
+/**
+* The liveness invariants, as pure functions.
+*
+* On 2026-08-03 the hub ran for four hours with zero devices, zero published
+* streams and zero recordings, and nothing said a word. Three separate defects
+* caused it — optional chaining that no-oped, an `if` with no `else`, a JSON
+* parse that returned `{}` — and each was silent at the point of failure. All
+* three were fixed and a log line added at each. This module exists for the
+* CLASS rather than the instances: assert what must be true of a working node,
+* and report when it is not.
+*
+* **Every check here is unambiguous, on purpose.** An alert that fires on a
+* quiet night is one an operator learns to ignore, and an ignored alert is
+* worse than no alert. So "the pipeline emitted no tracks recently" is NOT a
+* check — a camera can legitimately see nothing for hours — while "a camera
+* that has been recording all day stopped producing segments" is: continuous
+* recording produces segments whether or not anything moves.
+*
+* I/O lives in the addon; everything here is a function of facts, so the
+* outage can be replayed in a test.
+*/
+import type { RecordingStatus } from "@camstack/types";
 /** The recording mode a camera is running under, as `recording.getStatus` reports it. */
-export type RecordingActiveMode = RecordingStatus['activeMode'];
+export type RecordingActiveMode = RecordingStatus["activeMode"];
 /** What the monitor learned about one camera this tick. */
 export interface CameraFootage {
-    readonly deviceId: number;
-    /**
-     * Operator-facing name. Prefer this in the finding message; the numeric id
-     * stays on `deviceId` for tags / stable finding ids.
-     */
-    readonly name?: string;
-    readonly online: boolean;
-    /**
-     * ms-epoch of the newest recorded segment within the lookback window, or
-     * `null` when the camera has produced NO footage in it.
-     *
-     * `null` means "this camera does not record" and is deliberately not a
-     * finding — it is what makes the check self-calibrating. Nothing has to be
-     * told which cameras are supposed to record: a camera that was recording and
-     * stopped is a fault, a camera that never records is a configuration.
-     */
-    readonly lastSegmentMs: number | null;
-    /**
-     * The recording mode the camera runs under, asked only when it looks silent
-     * (`null` = not asked, the footage was recent). Silence is a fault ONLY for a
-     * `continuous` recorder: an `events` recorder that has seen nothing move is
-     * doing its job, and `off` is the operator's own switch. Seven events-mode
-     * cameras alerted for a whole quiet night on 2026-09-06.
-     */
-    readonly activeMode: RecordingActiveMode | null;
+	readonly deviceId: number;
+	/**
+	* Operator-facing name. Prefer this in the finding message; the numeric id
+	* stays on `deviceId` for tags / stable finding ids.
+	*/
+	readonly name?: string;
+	readonly online: boolean;
+	/**
+	* ms-epoch of the newest recorded segment within the lookback window, or
+	* `null` when the camera has produced NO footage in it.
+	*
+	* `null` means "this camera does not record" and is deliberately not a
+	* finding — it is what makes the check self-calibrating. Nothing has to be
+	* told which cameras are supposed to record: a camera that was recording and
+	* stopped is a fault, a camera that never records is a configuration.
+	*/
+	readonly lastSegmentMs: number | null;
+	/**
+	* The recording mode the camera runs under, asked only when it looks silent
+	* (`null` = not asked, the footage was recent). Silence is a fault ONLY for a
+	* `continuous` recorder: an `events` recorder that has seen nothing move is
+	* doing its job, and `off` is the operator's own switch. Seven events-mode
+	* cameras alerted for a whole quiet night on 2026-09-06.
+	*/
+	readonly activeMode: RecordingActiveMode | null;
 }
 export interface LivenessFacts {
-    readonly nowMs: number;
-    /** Every device the node knows about, cameras and accessories alike. */
-    readonly deviceCount: number;
-    readonly cameras: readonly CameraFootage[];
-    /** How long a recording camera may stay silent before it is a fault. */
-    readonly staleAfterMs: number;
+	readonly nowMs: number;
+	/** Every device the node knows about, cameras and accessories alike. */
+	readonly deviceCount: number;
+	readonly cameras: readonly CameraFootage[];
+	/** How long a recording camera may stay silent before it is a fault. */
+	readonly staleAfterMs: number;
 }
 export interface LivenessFinding {
-    /**
-     * Stable across ticks, so an ongoing fault UPDATES one alert instead of
-     * producing a new one every minute. Same contract as the kernel's
-     * `addon-load-failed:<packageName>` ids.
-     */
-    readonly id: string;
-    readonly severity: 'error' | 'warning';
-    readonly title: string;
-    readonly message: string;
-    /** Present on per-camera findings. Always the numeric id. */
-    readonly deviceId?: number;
-    /** Operator name when known — alert surfaces prefer this over the id. */
-    readonly deviceName?: string;
+	/**
+	* Stable across ticks, so an ongoing fault UPDATES one alert instead of
+	* producing a new one every minute. Same contract as the kernel's
+	* `addon-load-failed:<packageName>` ids.
+	*/
+	readonly id: string;
+	readonly severity: "error" | "warning";
+	readonly title: string;
+	readonly message: string;
+	/** Present on per-camera findings. Always the numeric id. */
+	readonly deviceId?: number;
+	/** Operator name when known — alert surfaces prefer this over the id. */
+	readonly deviceName?: string;
 }
 /**
- * Evaluate every invariant against one tick's facts.
- *
- * Ordered most-fundamental first, and it STOPS at "no devices": when the node
- * has nothing, every camera is also silent, and reporting twelve consequences
- * of one cause is how an operator ends up reading none of them.
- */
+* Evaluate every invariant against one tick's facts.
+*
+* Ordered most-fundamental first, and it STOPS at "no devices": when the node
+* has nothing, every camera is also silent, and reporting twelve consequences
+* of one cause is how an operator ends up reading none of them.
+*/
 export declare function evaluateLiveness(facts: LivenessFacts): readonly LivenessFinding[];
 /** Every finding id this module can produce, for the recovery sweep. */
 export declare function isLivenessFindingId(id: string): boolean;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.d.ts

@@ -1,41 +1,62 @@
-import { BaseAddon, ProviderRegistration } from '@camstack/types';
-import { LivenessFinding } from './liveness-checks.js';
+/**
+* liveness-monitor — the node states, out loud, when it has stopped working.
+*
+* On 2026-08-03 the hub ran for four hours with zero devices, zero published
+* streams and zero recordings. Three separate defects caused it, each silent at
+* the point of failure, and the operator found out by opening the viewer. Every
+* one of those defects has since been fixed and given a log line — but a log
+* line per known bug does not cover the next one. This addon covers the class:
+* it asserts what must be true of a working node and reports when it is not.
+*
+* It emits `SystemLivenessFailed` / `SystemLivenessRecovered` on the event bus
+* with a STABLE finding id, exactly like the kernel's addon-health monitor, so
+* AlertCenter raises one persistent alert per fault and dismisses it on
+* recovery instead of producing a stream of them. The same lines go to the log
+* at ERROR, which is what makes them alertable in Loki.
+*
+* Deliberately hub-only and deliberately read-only: it observes through
+* `ctx.api` and changes nothing. A monitor that can act is a monitor that can
+* cause the outage it was meant to report — this repo has already stopped a
+* hub that way once (the remedial-action watcher, 2026-07-30).
+*/
+import { BaseAddon, type ProviderRegistration } from "@camstack/types";
+import { type LivenessFinding } from "./liveness-checks.js";
 interface LivenessMonitorConfig extends Record<string, unknown> {
-    readonly staleAfterMs?: number;
+	readonly staleAfterMs?: number;
 }
 export declare class LivenessMonitorAddon extends BaseAddon<LivenessMonitorConfig> {
-    private tickTimer;
-    private startedAtMs;
-    /** Finding ids currently reported, so recovery can be detected and announced. */
-    private active;
-    constructor();
-    protected onInitialize(): Promise<ProviderRegistration[]>;
-    protected onShutdown(): Promise<void>;
-    /**
-     * One evaluation. Public so a test or an operator-facing action can force it
-     * without waiting out the interval.
-     */
-    tick(): Promise<readonly LivenessFinding[]>;
-    /** Read the facts through the cap surface. Changes nothing. */
-    private gather;
-    /**
-     * Newest segment for a camera, or null when it has produced none in a day.
-     *
-     * Two steps on purpose: the healthy case asks only for the recent window,
-     * which is a handful of ranges, and only a camera that looks silent pays for
-     * the 24-hour lookback that decides whether it records at all.
-     */
-    private lastSegmentMs;
-    /**
-     * A camera nobody could read is NOT a camera with no footage.
-     *
-     * `null` here means "no claim", and `liveness-checks.ts` skips a camera with
-     * no claim — which is the safe direction. But a skip that says nothing is
-     * indistinguishable from a healthy tick, so the branch that drops the camera
-     * names it, per camera (D393, and CLAUDE.md's logging rule).
-     */
-    private unreadable;
-    /** Announce new faults and recoveries; say nothing about an unchanged fault. */
-    private report;
+	private tickTimer;
+	private startedAtMs;
+	/** Finding ids currently reported, so recovery can be detected and announced. */
+	private active;
+	constructor();
+	protected onInitialize(): Promise<ProviderRegistration[]>;
+	protected onShutdown(): Promise<void>;
+	/**
+	* One evaluation. Public so a test or an operator-facing action can force it
+	* without waiting out the interval.
+	*/
+	tick(): Promise<readonly LivenessFinding[]>;
+	/** Read the facts through the cap surface. Changes nothing. */
+	private gather;
+	/**
+	* Newest segment for a camera, or null when it has produced none in a day.
+	*
+	* Two steps on purpose: the healthy case asks only for the recent window,
+	* which is a handful of ranges, and only a camera that looks silent pays for
+	* the 24-hour lookback that decides whether it records at all.
+	*/
+	private lastSegmentMs;
+	/**
+	* A camera nobody could read is NOT a camera with no footage.
+	*
+	* `null` here means "no claim", and `liveness-checks.ts` skips a camera with
+	* no claim — which is the safe direction. But a skip that says nothing is
+	* indistinguishable from a healthy tick, so the branch that drops the camera
+	* names it, per camera (D393, and CLAUDE.md's logging rule).
+	*/
+	private unreadable;
+	/** Announce new faults and recoveries; say nothing about an unchanged fault. */
+	private report;
 }
 export {};

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-8LQ4lDEB.js");
+const require_dist = require("../../dist-XTkzsnz-.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { I as RecordingStatusSchema, P as RECORDING_SOURCE_CAMSTACK_ADDON, Tr as createEvent, lr as errMsg, ni as EventCategory, ur as BaseAddon } from "../../dist-Biqn3TEn.mjs";
+import { I as RecordingStatusSchema, P as RECORDING_SOURCE_CAMSTACK_ADDON, Tr as createEvent, lr as errMsg, ni as EventCategory, ur as BaseAddon } from "../../dist-byg8IP4Q.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/admin-account-boot.d.ts

@@ -1,27 +1,27 @@
-import { IScopedLogger } from '@camstack/types';
-import { AdminSeedOutcome, EnsureAdminOptions } from '../../auth/user-manager.js';
+import type { IScopedLogger } from "@camstack/types";
+import { type AdminSeedOutcome, type EnsureAdminOptions } from "../../auth/user-manager.js";
 /** The trigger's name, at the root of the node's data directory. */
 export declare const ADMIN_PASSWORD_RESET_TRIGGER = "RESET_ADMIN_PASSWORD";
 /** The file operations the boot step needs — injectable for tests. */
 export interface TriggerFs {
-    exists(filePath: string): boolean;
-    remove(filePath: string): void;
+	exists(filePath: string): boolean;
+	remove(filePath: string): void;
 }
 /** The slice of `UserManager` the boot step drives. */
 export interface AdminAccountManager {
-    ensureAdminExists(options?: EnsureAdminOptions): Promise<AdminSeedOutcome>;
-    hasPassword(username: string, password: string): Promise<boolean>;
+	ensureAdminExists(options?: EnsureAdminOptions): Promise<AdminSeedOutcome>;
+	hasPassword(username: string, password: string): Promise<boolean>;
 }
 export interface AdminAccountBootInput {
-    readonly users: AdminAccountManager;
-    /** `ctx.nodeDataDir` — where the operator drops the trigger. */
-    readonly dataDir: string;
-    readonly fs: TriggerFs;
-    readonly logger: IScopedLogger;
+	readonly users: AdminAccountManager;
+	/** `ctx.nodeDataDir` — where the operator drops the trigger. */
+	readonly dataDir: string;
+	readonly fs: TriggerFs;
+	readonly logger: IScopedLogger;
 }
 export interface AdminAccountBootResult {
-    readonly outcome: AdminSeedOutcome;
-    /** The admin still signs in with {@link FIRST_BOOT_ADMIN_PASSWORD}. */
-    readonly usesDefaultPassword: boolean;
+	readonly outcome: AdminSeedOutcome;
+	/** The admin still signs in with {@link FIRST_BOOT_ADMIN_PASSWORD}. */
+	readonly usesDefaultPassword: boolean;
 }
 export declare function reconcileAdminAccountAtBoot(input: AdminAccountBootInput): Promise<AdminAccountBootResult>;

package/dist/builtins/local-auth/auth-config-reader.d.ts

@@ -1,22 +1,39 @@
-import { AuthConfigReader } from '../../auth/auth-manager.js';
 /**
- * The values `local-auth` pre-resolves before constructing its AuthManager.
- *
- * No credential is among them (D797): the session signing key lives in the
- * keychain (`jwt-signing-key.ts`) and the first-boot admin is fixed
- * (`admin` / `changeme`), so `auth.jwtSecret`, `auth.adminUsername` and
- * `auth.adminPassword` are answered by nothing.
- */
+* The `AuthConfigReader` shim `local-auth` hands to its own `AuthManager`.
+*
+* WHY IT IS AN ALLOW-LIST AND STAYS ONE. `AuthConfigReader.get` is
+* SYNCHRONOUS; `ctx.settings.getSection` is a promise over the hub's settings
+* store. The addon therefore resolves the handful of paths its AuthManager
+* actually consults ONCE, in `onInitialize`, and answers only those. The
+* whitelist is not decoration: it is the list of values that were awaited, and
+* a path outside it has no resolved value to return. Widening it means
+* pre-resolving one more value here — never "let the addon read arbitrary host
+* config", which it structurally cannot do anyway.
+*
+* `auth.tokenExpiry` was the path that fell off the end. It was declared,
+* editable and mapped to the `auth` yml section, and this reader answered
+* `undefined` for it, so this AuthManager always signed with the hardcoded
+* fallback no matter what the operator set.
+*/
+import type { AuthConfigReader } from "../../auth/auth-manager.js";
+/**
+* The values `local-auth` pre-resolves before constructing its AuthManager.
+*
+* No credential is among them (D797): the session signing key lives in the
+* keychain (`jwt-signing-key.ts`) and the first-boot admin is fixed
+* (`admin` / `changeme`), so `auth.jwtSecret`, `auth.adminUsername` and
+* `auth.adminPassword` are answered by nothing.
+*/
 export interface ResolvedAuthConfig {
-    /**
-     * Operator-configured session lifetime. `undefined` when the `auth` section
-     * carries no value — the signer then applies `DEFAULT_TOKEN_EXPIRY`, which
-     * is where the default belongs (one default, one place).
-     */
-    readonly tokenExpiry: string | undefined;
+	/**
+	* Operator-configured session lifetime. `undefined` when the `auth` section
+	* carries no value — the signer then applies `DEFAULT_TOKEN_EXPIRY`, which
+	* is where the default belongs (one default, one place).
+	*/
+	readonly tokenExpiry: string | undefined;
 }
 /**
- * Every config path this reader can answer. Anything else resolves to
- * `undefined` by construction — see the module docblock.
- */
+* Every config path this reader can answer. Anything else resolves to
+* `undefined` by construction — see the module docblock.
+*/
 export declare function createAuthConfigReader(resolved: ResolvedAuthConfig): AuthConfigReader;

package/dist/builtins/local-auth/auth-schema.d.ts

@@ -1,83 +1,106 @@
-import { SettingsStoreClient } from '@camstack/types';
 /**
- * @durable class=config owner=local-auth
- *   write="an operator creates a user, or `ensureAdminExists` seeds the configured
- *     admin on first boot (or resets its password on the operator's one-shot
- *     RESET_ADMIN_PASSWORD trigger); updated on scope, isAdmin and password edits"
- *   retention="none — a row goes only when an operator deletes the user. A
- *     `declareCollection` that adds a PK/UNIQUE/NOT-NULL-without-default column
- *     REBUILDS the table: every account is wiped and only the configured admin
- *     comes back on the next boot."
- */
+* Auth-schema — typed SQL schemas for local-auth's collections.
+*
+* Mirrors the pattern used by pipeline-analytics (`event-store.ts`,
+* `track-store.ts`): each addon owns its own schema, declared once
+* in `onInitialize` via `store.declareCollection.mutate(...)`.
+*
+* Collection names (no namespace — these are global, single-tenant
+* tables backing the auth layer):
+*   - users
+*   - api_keys
+*   - scoped_tokens
+*   - oauth_sessions
+*   - login_sessions, login_session_cutoffs (`login-session-manager.ts`)
+*   - admin_tokens (`admin-token-manager.ts`), auth_audit (`auth-audit-log.ts`)
+*
+* Schema migration: when the backend receives `declareCollection` for
+* a name that already exists with a legacy `(id, data)` KV shape, the
+* `ensureTable` helper drops the old table and recreates it. Existing
+* data is wiped — `ensureAdminExists` re-seeds the admin from
+* CAMSTACK_ADMIN_USER / CAMSTACK_ADMIN_PASS on the next boot (an empty
+* table is a first boot).
+*/
+import type { SettingsStoreClient } from "@camstack/types";
+/**
+* @durable class=config owner=local-auth
+*   write="an operator creates a user, or `ensureAdminExists` seeds the configured
+*     admin on first boot (or resets its password on the operator's one-shot
+*     RESET_ADMIN_PASSWORD trigger); updated on scope, isAdmin and password edits"
+*   retention="none — a row goes only when an operator deletes the user. A
+*     `declareCollection` that adds a PK/UNIQUE/NOT-NULL-without-default column
+*     REBUILDS the table: every account is wiped and only the configured admin
+*     comes back on the next boot."
+*/
 export declare const USERS_COLLECTION = "users";
 /**
- * @durable class=config owner=local-auth
- *   write="an operator mints an API key; `validateToken` rewrites `lastUsedAt` on
- *     every request the key authorises"
- *   retention="none — an explicit `revoke` is the only delete. API keys have no
- *     expiry column and no sweep, so a key lives until someone removes it (or the
- *     destructive `declareCollection` rebuild takes the table)."
- */
+* @durable class=config owner=local-auth
+*   write="an operator mints an API key; `validateToken` rewrites `lastUsedAt` on
+*     every request the key authorises"
+*   retention="none — an explicit `revoke` is the only delete. API keys have no
+*     expiry column and no sweep, so a key lives until someone removes it (or the
+*     destructive `declareCollection` rebuild takes the table)."
+*/
 export declare const API_KEYS_COLLECTION = "api_keys";
 /**
- * @durable class=config owner=local-auth
- *   write="an operator or the CLI mints a scoped token; `validate` fires
- *     `updateLastUsed` on every accepted call"
- *   retention="`revoke` deletes one. The daily sweep `reapExpired` drops rows past
- *     `expiresAt` — a NULL expiry is a deliberate never-expires token and BETWEEN
- *     never matches it. `cleanupOrphans` drops tokens owned by the legacy 'system'
- *     id or by a user that no longer exists."
- */
+* @durable class=config owner=local-auth
+*   write="an operator or the CLI mints a scoped token; `validate` fires
+*     `updateLastUsed` on every accepted call"
+*   retention="`revoke` deletes one. The daily sweep `reapExpired` drops rows past
+*     `expiresAt` — a NULL expiry is a deliberate never-expires token and BETWEEN
+*     never matches it. `cleanupOrphans` drops tokens owned by the legacy 'system'
+*     id or by a user that no longer exists."
+*/
 export declare const SCOPED_TOKENS_COLLECTION = "scoped_tokens";
 /**
- * @durable class=ledger owner=local-auth
- *   write="one row per redeemed OAuth code — every completed account link through
- *     `oauthExchangeCode`; `touch` rewrites `lastUsedAt` on each refresh"
- *   retention="ONLY revoked rows are pruned: the daily sweep deletes sessions
- *     revoked more than OAUTH_REVOKED_RETENTION_MS (30 d) ago. An ACTIVE session
- *     has `revokedAt` NULL, never expires and is never swept — the table grows one
- *     row per login until an operator revokes the link."
- */
+* @durable class=ledger owner=local-auth
+*   write="one row per redeemed OAuth code — every completed account link through
+*     `oauthExchangeCode`; `touch` rewrites `lastUsedAt` on each refresh"
+*   retention="ONLY revoked rows are pruned: the daily sweep deletes sessions
+*     revoked more than OAUTH_REVOKED_RETENTION_MS (30 d) ago. An ACTIVE session
+*     has `revokedAt` NULL, never expires and is never swept — the table grows one
+*     row per login until an operator revokes the link."
+*/
 export declare const OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
 /**
- * TOTP enrollment table — split off from `users` to avoid the
- * destructive drop-+-recreate migration `ensureTable` performs when a
- * new column is added to a typed schema (see `sqlite-settings-backend.ts`).
- *
- * Lifecycle:
- *   - Setup: row inserted with `confirmedAt = null` and a fresh secret.
- *   - Confirm: a valid code from the secret flips `confirmedAt` to now().
- *   - Disable: the row is deleted (next setup starts fresh).
- *
- * "Enabled" means `confirmedAt != null`. A half-enrolled row (`confirmedAt
- * = null`) is INACTIVE — `verifyTotp` returns false until confirmation.
- *
- * @durable class=config owner=local-auth
- *   write="`setup` inserts a fresh secret for the user (deleting any pending row
- *     first); `confirm` flips `confirmedAt` once a valid code proves possession"
- *   retention="`disable` deletes the row, and `setup` deletes before re-inserting.
- *     Nothing else prunes — deleting a USER does not cascade here, so their
- *     enrollment row outlives the account."
- */
+* TOTP enrollment table — split off from `users` to avoid the
+* destructive drop-+-recreate migration `ensureTable` performs when a
+* new column is added to a typed schema (see `sqlite-settings-backend.ts`).
+*
+* Lifecycle:
+*   - Setup: row inserted with `confirmedAt = null` and a fresh secret.
+*   - Confirm: a valid code from the secret flips `confirmedAt` to now().
+*   - Disable: the row is deleted (next setup starts fresh).
+*
+* "Enabled" means `confirmedAt != null`. A half-enrolled row (`confirmedAt
+* = null`) is INACTIVE — `verifyTotp` returns false until confirmation.
+*
+* @durable class=config owner=local-auth
+*   write="`setup` inserts a fresh secret for the user (deleting any pending row
+*     first); `confirm` flips `confirmedAt` once a valid code proves possession"
+*   retention="`disable` deletes the row, and `setup` deletes before re-inserting.
+*     Nothing else prunes — deleting a USER does not cascade here, so their
+*     enrollment row outlives the account."
+*/
 export declare const USER_TOTP_COLLECTION = "user_totp";
 /**
- * External sign-in identities linked to local users (D782): one row per
- * `(provider, subject)` — the row id IS the identity, so one identity maps to
- * one user by primary key. Written only by the identity's owner completing a
- * "Link" flow from their profile (bound to their session).
- *
- * @durable class=config owner=local-auth
- *   write="`ExternalIdentityManager.link` when a signed-in user completes a
- *     link flow; `unlink` from the profile or the Users page"
- *   retention="`unlink` deletes one row; deleting the user deletes all of its
- *     rows (`deleteUser` → `removeAllForUser`). A row whose provider instance
- *     was renamed or removed stays, inert, until someone unlinks it."
- */
+* External sign-in identities linked to local users (D782): one row per
+* `(provider, subject)` — the row id IS the identity, so one identity maps to
+* one user by primary key. Written only by the identity's owner completing a
+* "Link" flow from their profile (bound to their session).
+*
+* @durable class=config owner=local-auth
+*   write="`ExternalIdentityManager.link` when a signed-in user completes a
+*     link flow; `unlink` from the profile or the Users page"
+*   retention="`unlink` deletes one row; deleting the user deletes all of its
+*     rows (`deleteUser` → `removeAllForUser`). A row whose provider instance
+*     was renamed or removed stays, inert, until someone unlinks it."
+*/
 export declare const USER_EXTERNAL_IDENTITIES_COLLECTION = "user_external_identities";
 /**
- * Declare every auth collection with the typed schema. Called by
- * `LocalAuthAddon.onInitialize` before constructing the per-collection
- * managers. Idempotent — `declareCollection` is a no-op when the
- * collection has already been declared (same shape).
- */
+* Declare every auth collection with the typed schema. Called by
+* `LocalAuthAddon.onInitialize` before constructing the per-collection
+* managers. Idempotent — `declareCollection` is a no-op when the
+* collection has already been declared (same shape).
+*/
 export declare function declareAuthSchema(store: SettingsStoreClient): Promise<void>;

package/dist/builtins/local-auth/index.d.ts

@@ -1 +1 @@
-export { LocalAuthAddon } from './local-auth.addon.js';
+export { LocalAuthAddon } from "./local-auth.addon.js";

package/dist/builtins/local-auth/jwt-signing-key-keeper.d.ts

@@ -1,30 +1,30 @@
-import { SecretsAccess } from '@camstack/types';
+import type { SecretsAccess } from "@camstack/types";
 /** How often a locked keychain is asked again. */
-export declare const SIGNING_KEY_RETRY_MS = 30000;
+export declare const SIGNING_KEY_RETRY_MS = 3e4;
 interface KeeperLogger {
-    info(message: string, meta?: {
-        meta?: Record<string, unknown>;
-    }): void;
-    error(message: string, meta?: {
-        meta?: Record<string, unknown>;
-    }): void;
+	info(message: string, meta?: {
+		meta?: Record<string, unknown>;
+	}): void;
+	error(message: string, meta?: {
+		meta?: Record<string, unknown>;
+	}): void;
 }
 export interface JwtSigningKeyKeeperDeps {
-    /** A keychain handle for owner `system`; `null` when this process has no keychain door. */
-    readonly secrets: SecretsAccess | null;
-    readonly logger: KeeperLogger;
-    readonly retryMs?: number;
+	/** A keychain handle for owner `system`; `null` when this process has no keychain door. */
+	readonly secrets: SecretsAccess | null;
+	readonly logger: KeeperLogger;
+	readonly retryMs?: number;
 }
 export declare class JwtSigningKeyKeeper {
-    private readonly deps;
-    private retryTimer;
-    private unsubscribe;
-    private stopped;
-    constructor(deps: JwtSigningKeyKeeperDeps);
-    start(): Promise<void>;
-    stop(): void;
-    private load;
-    private apply;
-    private scheduleRetry;
+	private readonly deps;
+	private retryTimer;
+	private unsubscribe;
+	private stopped;
+	constructor(deps: JwtSigningKeyKeeperDeps);
+	start(): Promise<void>;
+	stop(): void;
+	private load;
+	private apply;
+	private scheduleRetry;
 }
 export {};