@camstack/system 1.2.439 → 1.2.441

package/dist/prefix-walk-Dv6MLZlM.js

@@ -0,0 +1,99 @@
+const require_prefix_range = require("./prefix-range-D_KueXbQ.js");
+//#region src/kernel/prefix-walk.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function unwrapStoredValue(parsed) {
+	if (!isRecord(parsed) || !("value" in parsed)) return parsed;
+	return parsed.value;
+}
+/**
+* Rows one page of a prefix read asks for.
+*
+* Below `SETTINGS_QUERY_DEFAULT_ROW_CAP` (2 000, `query-bounds.ts`) on purpose:
+* this read now names its own bound, so the engine's defensive cap is never the
+* thing that decides how much of the answer the caller gets.
+*/
+var PREFIX_PAGE_ROWS = 1e3;
+/**
+* Pages one prefix read may take before it refuses.
+*
+* 512 pages is 512 000 rows — three orders of magnitude past the largest live
+* scope (`addon-device-settings` for one addon over a ~1 019-device fleet) and
+* still a bound, because a walk with no bound is the defect this file was
+* fixing, not one to reintroduce.
+*/
+var PREFIX_PAGE_BUDGET = 512;
+/**
+* Every row under `prefix`, or a throw — never the first 2 000 of them.
+*
+* **The defect.** This issued ONE `query` with no `limit`, and
+* `queryDeclared` resolves an absent limit to `SETTINGS_QUERY_DEFAULT_ROW_CAP`
+* and cuts the result there. On the live hub that fired 138 times in two hours
+* (`settings-store query truncated by a defensive row cap`, collection
+* `addon-device-settings`, `rowCap: 2000`, `requestedLimit: null`): a
+* ~1 019-device fleet with more than two stored keys per device puts one
+* addon's `<addonId>:` range past the cap. The engine warned; the door did not
+* notice, and handed its caller a short map that is **shape-identical to a
+* complete one**. Every device whose rows sort past the cap reads as "has no
+* stored settings", which is exactly what a device with none looks like.
+*
+* **The fix is a keyset walk, not a bigger limit.** The cursor is the last id
+* of the previous page, INCLUSIVE — so the page boundary re-reads exactly one
+* row (ids are unique, so a full page always advances) and no row can fall
+* between two pages the way an `OFFSET` walk drops rows under a concurrent
+* write (D295 rule 1). Re-reading is free here: the accumulator is keyed by
+* suffix, so the duplicate overwrites itself with its own value.
+*
+* `ORDER BY id` is not decoration — the cursor is only meaningful if the
+* engine returns the range in the order the cursor advances through. It is the
+* primary key, so the ordering is the range scan's own.
+*
+* @throws when the prefix cannot be expressed as a range and the collection is
+*   larger than one page, or when the walk exceeds {@link PREFIX_PAGE_BUDGET}.
+*   A throw is the point: a caller that cannot be answered completely must not
+*   be handed something that looks like a complete answer.
+*/
+async function loadPrefixed(door, collection, prefix, decode = unwrapStoredValue) {
+	const range = require_prefix_range.prefixRange(prefix);
+	const result = {};
+	let cursor = range?.lo ?? null;
+	for (let page = 0;; page++) {
+		if (page >= PREFIX_PAGE_BUDGET) throw new Error(`settings door: reading "${prefix}" from "${collection}" exceeded ${PREFIX_PAGE_BUDGET} pages of ${PREFIX_PAGE_ROWS} rows. Refusing to return the part that was read — a partial scope read is indistinguishable from an empty one.`);
+		const rows = await door.query({
+			collection,
+			filter: {
+				...range !== null && cursor !== null ? { whereBetween: { id: [cursor, range.hi] } } : {},
+				orderBy: {
+					field: "id",
+					direction: "asc"
+				},
+				limit: PREFIX_PAGE_ROWS
+			}
+		});
+		for (const row of rows) {
+			if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
+			if (!row.id.startsWith(prefix)) continue;
+			result[row.id.slice(prefix.length)] = decode(row.data);
+		}
+		if (rows.length < PREFIX_PAGE_ROWS) return result;
+		const last = rows[rows.length - 1];
+		if (last === void 0) return result;
+		if (range === null) throw new Error(`settings door: prefix "${prefix}" on "${collection}" cannot be expressed as an id range, and the unfiltered read filled a page — the answer would be partial. Use an ASCII, non-empty prefix.`);
+		if (last.id === cursor) throw new Error(`settings door: reading "${prefix}" from "${collection}" made no progress at id "${last.id}" — ids under a prefix must be unique.`);
+		cursor = last.id;
+	}
+}
+//#endregion
+Object.defineProperty(exports, "loadPrefixed", {
+	enumerable: true,
+	get: function() {
+		return loadPrefixed;
+	}
+});
+Object.defineProperty(exports, "unwrapStoredValue", {
+	enumerable: true,
+	get: function() {
+		return unwrapStoredValue;
+	}
+});

package/dist/{restore-archive-CpdUO-uS.mjs → restore-archive-4ziluTU3.mjs}

@@ -1,4 +1,4 @@
-import { b as DATABASE_SNAPSHOT_SUFFIX } from "./dist-yI6kF6r6.mjs";
+import { b as DATABASE_SNAPSHOT_SUFFIX } from "./dist-BWvkuc31.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{restore-archive-DiGiI6Jp.js → restore-archive-CfSSjKnA.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BOWdLjoK.js");
+const require_dist = require("./dist-BiTCcaf-.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{retired-settings-keys-UsVtLOT0.mjs → retired-settings-keys-Bhwe4ymb.mjs}

@@ -1,4 +1,4 @@
-import { Rr as asJsonObject } from "./dist-yI6kF6r6.mjs";
+import { asJsonObject } from "@camstack/types/addon";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?
@@ -353,4 +353,4 @@ function errText(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
-export { purgeRetiredSettingsRows as n, retiredKeyStoreOf as r, purgeRetiredSettingsKeys as t };
+export { retiredKeyStoreOf as i, purgeRetiredSettingsKeys as n, purgeRetiredSettingsRows as r, RETIRED_SETTINGS_KEYS as t };

package/dist/{retired-settings-keys-CyQ7uvta.js → retired-settings-keys-D_VwZiDt.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BOWdLjoK.js");
+let _camstack_types_addon = require("@camstack/types/addon");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?
@@ -169,7 +169,7 @@ var RETIRED_SETTINGS_ROWS = [
 function retiredKeyStoreOf(backend) {
 	return {
 		async read(spec) {
-			return require_dist.asJsonObject(await backend.get({
+			return (0, _camstack_types_addon.asJsonObject)(await backend.get({
 				namespace: spec.namespace,
 				collection: spec.collection,
 				key: spec.row
@@ -194,7 +194,7 @@ function planNestedRetiredKeyPurge(blob, spec) {
 	if (nestedKeys.length === 0) return [];
 	const found = [];
 	for (const [mapKey, value] of Object.entries(blob)) {
-		const inner = require_dist.asJsonObject(value);
+		const inner = (0, _camstack_types_addon.asJsonObject)(value);
 		if (inner === null) continue;
 		for (const retired of nestedKeys) if (retired in inner) found.push(`${mapKey}.${retired}`);
 	}
@@ -257,7 +257,7 @@ async function purgeRetiredSettingsKeys(store, logger, specs = RETIRED_SETTINGS_
 		const next = Object.fromEntries(Object.entries(blob).filter(([key]) => !doomedSet.has(key)).map(([key, value]) => {
 			const retired = nestedByMapKey.get(key);
 			if (retired === void 0) return [key, value];
-			const inner = require_dist.asJsonObject(value);
+			const inner = (0, _camstack_types_addon.asJsonObject)(value);
 			if (inner === null) return [key, value];
 			return [key, Object.fromEntries(Object.entries(inner).filter(([k]) => !retired.has(k)))];
 		}));
@@ -353,6 +353,12 @@ function errText(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
+Object.defineProperty(exports, "RETIRED_SETTINGS_KEYS", {
+	enumerable: true,
+	get: function() {
+		return RETIRED_SETTINGS_KEYS;
+	}
+});
 Object.defineProperty(exports, "purgeRetiredSettingsKeys", {
 	enumerable: true,
 	get: function() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.439",
+  "version": "1.2.441",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -57,7 +57,7 @@
         "icon": "assets/sqlite-settings/icon.svg",
         "color": "#0d9488",
         "entry": "./dist/builtins/sqlite-storage/sqlite-settings.addon.js",
-        "description": "The relational ENGINE behind the data door (SQLite WAL). Registers `data-store-provider`, an internal collection cap; the public `settings-store` door is owned by `storage-orchestrator`, which dispatches here. Callers never reach this addon directly — that is what makes the engine replaceable. It ALSO registers `vector-store` (sqlite-vec) from the same database file and the same open handle, and `database-snapshot`: the verified copy of its database that the nightly backup archives in place of the live files, written by this runner on a thread over its own connection. Runs in its OWN process (`execution.isolate`) — `better-sqlite3` `Statement.run` does not belong on the event loop that serves the API.",
+        "description": "The relational ENGINE behind the data door (SQLite WAL). Registers `data-store-provider`, an internal collection cap; the public `settings-store` door is owned by `storage-orchestrator`, which dispatches here. Callers never reach this addon directly — that is what makes the engine replaceable. It ALSO registers `vector-store` (sqlite-vec) from the same database file and the same open handle, `storage-admin` (list tables, drop one nothing owns) and `database-snapshot`: the verified copy of its database that the nightly backup archives in place of the live files, written by this runner on a thread over its own connection. Runs in its OWN process (`execution.isolate`) — `better-sqlite3` `Statement.run` does not belong on the event loop that serves the API.",
         "execution": {
           "isolate": true,
           "heapProfile": "heavy",
@@ -72,6 +72,9 @@
           },
           {
             "name": "database-snapshot"
+          },
+          {
+            "name": "storage-admin"
           }
         ]
       },

package/dist/{custom-action-registry-Bf_YnagS.js → custom-action-registry-BKmoaqG0.js}

@@ -2,10 +2,10 @@ const require_chunk = require("./chunk-Cek0wNdY.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
+let _camstack_types_addon = require("@camstack/types/addon");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_util = require("node:util");
-let _camstack_types_addon = require("@camstack/types/addon");
 let node_http = require("node:http");
 let node_zlib = require("node:zlib");
 let node_perf_hooks = require("node:perf_hooks");

package/dist/{custom-action-registry-BQnbN0DP.mjs → custom-action-registry-CyUuhATc.mjs}

@@ -1,10 +1,10 @@
 import { createHash } from "node:crypto";
 import * as path$1 from "node:path";
 import path from "node:path";
+import { HF_REPO, MODEL_FORMATS, describeCustomActions, hfModelUrl } from "@camstack/types/addon";
 import * as fs from "node:fs";
 import { createReadStream, promises } from "node:fs";
 import { promisify } from "node:util";
-import { HF_REPO, MODEL_FORMATS, describeCustomActions, hfModelUrl } from "@camstack/types/addon";
 import { createServer } from "node:http";
 import { brotliCompress, constants as constants$1, gzip } from "node:zlib";
 import { PerformanceObserver } from "node:perf_hooks";