@camstack/system 1.2.443 → 1.2.445

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,5 @@
-import { Ar as errMsg, Br as WELL_KNOWN_TAB_MAP, Bt as deviceStatusCapability, C as DAY_NAMES, Ci as toSecretFieldView, Dr as DeviceFeature, Ei as EventCategory, En as normalizeUnit, Gn as runtimeStatePolicyFor, Ht as enumerateItemArrayFields, Kt as expandContainer, Lt as deviceExtensionCapability, N as FieldClaimModeSchema, Nt as defineExtensionSlotProvider, Or as DeviceRole, Ot as createDeviceExtensionProvider, P as FieldClaimSchema, Qt as formatMinutes, Rt as deviceManagerCapability, Ti as userError, Ut as enumerateSchemaFields, V as MINUTES_PER_DAY, Y as STREAM_PROFILE_META, Zn as siteZoneKey, _i as resolveSecretMarkers, ai as isSecretClear, c as CAMERA_SWITCH_ORDER, dn as legacyAutoLinkIds, hn as locationIconKey, ht as buildStreamParamsConfigSchema, ii as isKeychainStoredField, j as DeviceStatusSchema, jr as BaseAddon, kn as parseStreamParamsFormPatch, kr as DeviceType, ni as isDeviceConfigCap, oi as isSecretMarker, qr as collectZodSecretPaths, r as ALL_CAPABILITY_DEFINITIONS, si as isSecretMarkerLike, u as CAP_NAMES_WITH_STATUS, vt as canonicalIconKey, wi as transformSecretWrite, xi as sleep$1, yi as secretTreeFromPaths, zr as SECRET_CLEAR, zt as deviceStateCapability } from "../../dist-Bxt_S-9a.mjs";
+import { $ as STREAM_PROFILE_META, $i as resolveSecretMarkers, C as DAY_NAMES, Ct as canonicalIconKey, Di as defineRecordKinds, F as FieldClaimModeSchema, Fi as isKeychainStoredField, Fr as DeviceRole, G as MINUTES_PER_DAY, Gt as deviceStatusCapability, Ht as deviceExtensionCapability, I as FieldClaimSchema, Ii as isSecretClear, Ir as DeviceType, Jt as enumerateSchemaFields, Li as isSecretMarker, Lr as errMsg, M as DeviceStatusSchema, N as DeviceTombstoneSchema, Ni as isDeviceConfigCap, Nt as createDeviceExtensionProvider, Pn as parseStreamParamsFormPatch, Pr as DeviceFeature, Qn as runtimeStatePolicyFor, Ri as isSecretMarkerLike, Rr as BaseAddon, Rt as defineExtensionSlotProvider, Si as collectZodSecretPaths, Ut as deviceManagerCapability, Wt as deviceStateCapability, Zt as expandContainer, aa as toSecretFieldView, bn as locationIconKey, bt as buildStreamParamsConfigSchema, c as CAMERA_SWITCH_ORDER, gn as legacyAutoLinkIds, ir as siteZoneKey, jn as normalizeUnit, la as EventCategory, oa as transformSecretWrite, pi as WELL_KNOWN_TAB_MAP, qt as enumerateItemArrayFields, r as ALL_CAPABILITY_DEFINITIONS, ra as sleep$1, rn as formatMinutes, sa as userError, ta as secretTreeFromPaths, u as CAP_NAMES_WITH_STATUS, ui as SECRET_CLEAR } from "../../dist-BNunRyXT.mjs";
+import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";
 import { r as purgeRetiredSettingsRows } from "../../retired-settings-keys-Bhwe4ymb.mjs";
@@ -1095,6 +1096,10 @@ function mergeAggregates(parts) {
 function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isConfigFieldWithValue(field) {
+	if (!isRecord$2(field)) return false;
+	return typeof field.type === "string" && typeof field.key === "string" && "value" in field;
+}
 /** The declared paths that name a top-level config key. */
 function topLevelKeys(paths) {
 	return new Set(paths.filter((p) => p.length > 0 && !p.includes(".") && !p.includes("[")));
@@ -1114,8 +1119,8 @@ function viewField(field, stored, declared) {
 			fields: tab["fields"].map((f) => viewField(f, stored, declared))
 		} : tab)
 	};
-	const key = field["key"];
-	if (typeof key !== "string" || !("value" in field)) return field;
+	if (!isConfigFieldWithValue(field)) return field;
+	const key = field.key;
 	const marker = stored[key];
 	if (!isSecretMarker(marker)) return field;
 	const secretByType = isKeychainStoredField(field);
@@ -7868,6 +7873,104 @@ var DeviceMetaStore = class {
 	});
 };
 //#endregion
+//#region src/builtins/device-manager/record-kinds.ts
+var import_read_all_rows = require_read_all_rows();
+var _deviceManagerRecordKinds = defineRecordKinds({ tombstones: {
+	schema: DeviceTombstoneSchema.omit({ deviceId: true }),
+	class: "ledger",
+	writeTrigger: "`removeDevice` records one row per deleted device after the device row is gone; re-record keeps the earlier `deletedAt`",
+	device: "none",
+	at: "required",
+	indexes: [{
+		name: "deleted_at",
+		fields: ["deletedAt"]
+	}],
+	retention: {
+		owner: "device-manager",
+		reason: "90 days (`DEVICE_TOMBSTONE_RETENTION_MS`), pruned whenever a tombstone is written or the list is read"
+	},
+	adoptsFrom: DEVICE_TOMBSTONES_COLLECTION
+} });
+var deviceManagerRecordKinds = _deviceManagerRecordKinds;
+_deviceManagerRecordKinds.tombstones;
+//#endregion
+//#region src/builtins/device-manager/device-tombstone-store.ts
+/**
+* The tombstones of deleted devices (D865) — `tombstones` record kind (phase 4).
+*/
+var DEVICE_TOMBSTONES_COLLECTION = "device-manager:tombstones";
+/** More than the engine's default row cap, so a read is never silently truncated. */
+var TOMBSTONE_READ_LIMIT = 2e4;
+function rowToTombstone(id, body) {
+	const deviceId = Number(id);
+	if (!Number.isInteger(deviceId) || deviceId <= 0) return null;
+	return {
+		deviceId,
+		deletedAt: body.deletedAt,
+		providerAddonId: body.providerAddonId
+	};
+}
+var DeviceTombstoneStore = class DeviceTombstoneStore {
+	kind;
+	logger;
+	now;
+	retentionMs;
+	constructor(opts) {
+		this.kind = opts.kind;
+		this.logger = opts.logger;
+		this.now = opts.now ?? (() => Date.now());
+		this.retentionMs = opts.retentionMs ?? 7776e6;
+	}
+	static of(records, logger) {
+		return new DeviceTombstoneStore({
+			kind: records.kind(deviceManagerRecordKinds.tombstones),
+			logger
+		});
+	}
+	/** Record a deletion. Re-recording the same id keeps the EARLIER `deletedAt`. */
+	async record(tombstone) {
+		const key = String(tombstone.deviceId);
+		const existing = await this.kind.get(key);
+		if ((existing !== null ? rowToTombstone(existing.id, existing.data)?.deletedAt : void 0) === void 0) await this.kind.put({
+			id: key,
+			at: tombstone.deletedAt,
+			data: {
+				deletedAt: tombstone.deletedAt,
+				providerAddonId: tombstone.providerAddonId
+			}
+		});
+		await this.pruneExpired();
+	}
+	/** Tombstones with `deletedAt >= sinceMs`, oldest first. Expired ones are pruned first. */
+	async listSince(sinceMs) {
+		await this.pruneExpired();
+		const floor = Math.max(sinceMs, this.now() - this.retentionMs);
+		const rows = await (0, import_read_all_rows.readAllRows)(this.kind, {
+			atFrom: floor,
+			order: "at"
+		});
+		const out = [];
+		for (const row of rows) {
+			if (out.length >= TOMBSTONE_READ_LIMIT) break;
+			const decoded = rowToTombstone(row.id, row.data);
+			if (decoded !== null && decoded.deletedAt >= floor) out.push(decoded);
+		}
+		return out;
+	}
+	/** Delete tombstones older than the retention window. Best-effort: a failure is logged. */
+	async pruneExpired() {
+		try {
+			const cutoff = this.now() - this.retentionMs;
+			const rows = await (0, import_read_all_rows.readAllRows)(this.kind, { atTo: cutoff - 1 });
+			for (const row of rows) await this.kind.delete(row.id);
+			return rows.length;
+		} catch (err) {
+			this.logger.warn("device tombstone prune failed — retried on the next write", { meta: { error: errMsg(err) } });
+			return 0;
+		}
+	}
+};
+//#endregion
 //#region src/builtins/device-manager/fleet-read-census.ts
 /** How many stack frames identify a call site. One frame is a method; three are
 *  a cause — `listFleet < listAll < onDeviceRegistered` is the answer, `listAll`
@@ -8769,181 +8872,6 @@ var DeviceRowStore = class {
 	}
 };
 //#endregion
-//#region src/builtins/device-manager/device-tombstone-store.ts
-/**
-* The tombstones of deleted devices (D865).
-*
-* A device DELETE is a fact other addons must be able to learn reliably, long
-* after the `DeviceUnregistered` event (telemetry, droppable — D8/D11) is gone.
-* device-manager is the only authority on whether a device exists, so the record
-* of a deletion lives here, in its own collection, beside the device ledger.
-*
-* ## What a tombstone is NOT
-*
-* It is not "the device is unregistered / offline / its provider is restarting".
-* Those are states of a device that still exists; only {@link record}'s one
-* caller — `removeDevice`, the single door every delete converges on — writes a
-* tombstone. Anything that reconciles from tombstones therefore can never
-* destroy data of a device that merely went quiet.
-*
-* ## Expiry
-*
-* {@link DEVICE_TOMBSTONE_RETENTION_MS} (90 days). A tombstone older than that
-* is deleted the next time one is written or read. Ninety days is generous on
-* purpose: an addon that stayed disabled for a quarter still learns of the
-* deletions on its return. Data of a device deleted longer ago than that is
-* reachable only by the admin "clean data of deleted devices" action.
-*/
-/**
-* @durable class=ledger owner=device-manager
-*   write="`removeDevice` records one row per deleted device (key = device id) after the
-*     device row is gone"
-*   retention="90 days (`DEVICE_TOMBSTONE_RETENTION_MS`), pruned whenever a tombstone is
-*     written or the list is read. Bounded by the deletions an operator makes in a quarter."
-*/
-var DEVICE_TOMBSTONES_COLLECTION = "device-manager:tombstones";
-var DEVICE_TOMBSTONE_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "deviceId",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "deletedAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "providerAddonId",
-		type: "TEXT",
-		notNull: true
-	}
-];
-var DEVICE_TOMBSTONE_INDEXES = [{
-	name: "idx_dm_tombstones_deleted_at",
-	columns: ["deletedAt"]
-}];
-/** More than the engine's default row cap, so a read is never silently truncated. */
-var TOMBSTONE_READ_LIMIT = 2e4;
-function decodeTombstone(raw) {
-	const deviceId = raw["deviceId"];
-	const deletedAt = raw["deletedAt"];
-	const providerAddonId = raw["providerAddonId"];
-	if (typeof deviceId !== "number" || !Number.isInteger(deviceId) || deviceId <= 0) return null;
-	if (typeof deletedAt !== "number" || typeof providerAddonId !== "string") return null;
-	return {
-		deviceId,
-		deletedAt,
-		providerAddonId
-	};
-}
-var DeviceTombstoneStore = class {
-	backend;
-	logger;
-	now;
-	retentionMs;
-	declared = null;
-	constructor(opts) {
-		this.backend = opts.backend;
-		this.logger = opts.logger;
-		this.now = opts.now ?? (() => Date.now());
-		this.retentionMs = opts.retentionMs ?? 7776e6;
-	}
-	/**
-	* Declare the collection now. Idempotent; a rejection is not latched.
-	*
-	* Called at device-manager init (D871) so the table exists on a hub that has
-	* not deleted a device yet. It used to be declared only by the first
-	* `record` / `listSince`, i.e. by the first delete or by an implementer's
-	* reconcile — so a hub whose implementers had not been redeployed, and where
-	* nothing was deleted, never had the table, and the census read that as
-	* "D865 is not running". A DECLARATION only: nothing is read, written or
-	* purged here.
-	*/
-	declare() {
-		if (this.declared !== null) return this.declared;
-		const run = this.backend.declareCollection({
-			collection: DEVICE_TOMBSTONES_COLLECTION,
-			columns: DEVICE_TOMBSTONE_COLUMNS,
-			indexes: DEVICE_TOMBSTONE_INDEXES
-		}).catch((err) => {
-			this.declared = null;
-			throw err;
-		});
-		this.declared = run;
-		return run;
-	}
-	/** Record a deletion. Re-recording the same id keeps the EARLIER `deletedAt`. */
-	async record(tombstone) {
-		await this.declare();
-		const key = String(tombstone.deviceId);
-		const existing = await this.backend.get({
-			collection: DEVICE_TOMBSTONES_COLLECTION,
-			key
-		});
-		if ((isPlainObject(existing) ? decodeTombstone(existing) : null) === null) await this.backend.set({
-			collection: DEVICE_TOMBSTONES_COLLECTION,
-			key,
-			value: {
-				deviceId: tombstone.deviceId,
-				deletedAt: tombstone.deletedAt,
-				providerAddonId: tombstone.providerAddonId
-			}
-		});
-		await this.pruneExpired();
-	}
-	/** Tombstones with `deletedAt >= sinceMs`, oldest first. Expired ones are pruned first. */
-	async listSince(sinceMs) {
-		await this.declare();
-		await this.pruneExpired();
-		const floor = Math.max(sinceMs, this.now() - this.retentionMs);
-		const rows = await this.backend.query({
-			collection: DEVICE_TOMBSTONES_COLLECTION,
-			filter: {
-				whereBetween: { deletedAt: [floor, Number.MAX_SAFE_INTEGER] },
-				orderBy: {
-					field: "deletedAt",
-					direction: "asc"
-				},
-				limit: TOMBSTONE_READ_LIMIT
-			}
-		});
-		const out = [];
-		for (const row of rows) {
-			const decoded = decodeTombstone(row.data);
-			if (decoded !== null) out.push(decoded);
-		}
-		return out;
-	}
-	/** Delete tombstones older than the retention window. Best-effort: a failure is logged. */
-	async pruneExpired() {
-		try {
-			const cutoff = this.now() - this.retentionMs;
-			const stale = await this.backend.query({
-				collection: DEVICE_TOMBSTONES_COLLECTION,
-				filter: {
-					whereBetween: { deletedAt: [0, cutoff - 1] },
-					limit: TOMBSTONE_READ_LIMIT
-				}
-			});
-			for (const row of stale) await this.backend.delete({
-				collection: DEVICE_TOMBSTONES_COLLECTION,
-				key: row.id
-			});
-			return stale.length;
-		} catch (err) {
-			this.logger.warn("device tombstone prune failed — retried on the next write", { meta: { error: errMsg(err) } });
-			return 0;
-		}
-	}
-};
-//#endregion
 //#region src/builtins/device-manager/device-state-claims.ts
 function createDeviceStateClaimMethods(deps) {
 	const { mirror, index, settings, logger } = deps;
@@ -10859,15 +10787,10 @@ var DeviceManagerAddon = class extends BaseAddon {
 		const deviceRows = new DeviceRowStore(deviceRowBackendOf(settingsStoreApi), this.ctx.logger.child("rows"));
 		await deviceRows.declare();
 		this.deviceRows = deviceRows;
-		const tombstones = new DeviceTombstoneStore({
-			backend: deviceRowBackendOf(settingsStoreApi),
-			logger: this.ctx.logger.child("tombstones")
-		});
-		try {
-			await tombstones.declare();
-		} catch (err) {
-			this.ctx.logger.warn("device tombstones collection not declared at init — retried on first use", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		}
+		const records = this.ctx.records;
+		if (records === void 0) throw new Error("[device-manager] ctx.records is required on the hub");
+		await records.declare(deviceManagerRecordKinds);
+		const tombstones = DeviceTombstoneStore.of(records, this.ctx.logger.child("tombstones"));
 		this.staleWrapperActivations.checkOnce(() => readBindingsStore(this.bindingsDeps));
 		try {
 			await purgeRetiredSettingsRows(deviceRows.retiredRowStore(), this.ctx.logger.child("RetiredRows"));

package/dist/builtins/device-manager/device-tombstone-store.d.ts

@@ -1,64 +1,24 @@
 /**
-* The tombstones of deleted devices (D865).
-*
-* A device DELETE is a fact other addons must be able to learn reliably, long
-* after the `DeviceUnregistered` event (telemetry, droppable — D8/D11) is gone.
-* device-manager is the only authority on whether a device exists, so the record
-* of a deletion lives here, in its own collection, beside the device ledger.
-*
-* ## What a tombstone is NOT
-*
-* It is not "the device is unregistered / offline / its provider is restarting".
-* Those are states of a device that still exists; only {@link record}'s one
-* caller — `removeDevice`, the single door every delete converges on — writes a
-* tombstone. Anything that reconciles from tombstones therefore can never
-* destroy data of a device that merely went quiet.
-*
-* ## Expiry
-*
-* {@link DEVICE_TOMBSTONE_RETENTION_MS} (90 days). A tombstone older than that
-* is deleted the next time one is written or read. Ninety days is generous on
-* purpose: an addon that stayed disabled for a quarter still learns of the
-* deletions on its return. Data of a device deleted longer ago than that is
-* reachable only by the admin "clean data of deleted devices" action.
-*/
-import { type CollectionColumn, type CollectionIndex, type DeviceTombstone, type IScopedLogger } from "@camstack/types";
-import { type DeviceRowBackend } from "./device-row-store.js";
-/**
-* @durable class=ledger owner=device-manager
-*   write="`removeDevice` records one row per deleted device (key = device id) after the
-*     device row is gone"
-*   retention="90 days (`DEVICE_TOMBSTONE_RETENTION_MS`), pruned whenever a tombstone is
-*     written or the list is read. Bounded by the deletions an operator makes in a quarter."
+* The tombstones of deleted devices (D865) — `tombstones` record kind (phase 4).
 */
+import { type DeviceTombstone, type IScopedLogger, type RecordKindHandle, type RecordsAccess } from "@camstack/types";
+import { DeviceTombstoneBodySchema } from "./record-kinds.js";
+import type { z } from "zod";
 export declare const DEVICE_TOMBSTONES_COLLECTION = "device-manager:tombstones";
-export declare const DEVICE_TOMBSTONE_COLUMNS: readonly CollectionColumn[];
-export declare const DEVICE_TOMBSTONE_INDEXES: readonly CollectionIndex[];
+type TombstoneBody = z.infer<typeof DeviceTombstoneBodySchema>;
 export interface DeviceTombstoneStoreOptions {
-	readonly backend: DeviceRowBackend;
+	readonly kind: RecordKindHandle<TombstoneBody>;
 	readonly logger: IScopedLogger;
 	readonly now?: () => number;
 	readonly retentionMs?: number;
 }
 export declare class DeviceTombstoneStore {
-	private readonly backend;
+	private readonly kind;
 	private readonly logger;
 	private readonly now;
 	private readonly retentionMs;
-	private declared;
 	constructor(opts: DeviceTombstoneStoreOptions);
-	/**
-	* Declare the collection now. Idempotent; a rejection is not latched.
-	*
-	* Called at device-manager init (D871) so the table exists on a hub that has
-	* not deleted a device yet. It used to be declared only by the first
-	* `record` / `listSince`, i.e. by the first delete or by an implementer's
-	* reconcile — so a hub whose implementers had not been redeployed, and where
-	* nothing was deleted, never had the table, and the census read that as
-	* "D865 is not running". A DECLARATION only: nothing is read, written or
-	* purged here.
-	*/
-	declare(): Promise<void>;
+	static of(records: Pick<RecordsAccess, "kind">, logger: IScopedLogger): DeviceTombstoneStore;
 	/** Record a deletion. Re-recording the same id keeps the EARLIER `deletedAt`. */
 	record(tombstone: DeviceTombstone): Promise<void>;
 	/** Tombstones with `deletedAt >= sinceMs`, oldest first. Expired ones are pruned first. */
@@ -66,3 +26,4 @@ export declare class DeviceTombstoneStore {
 	/** Delete tombstones older than the retention window. Best-effort: a failure is logged. */
 	pruneExpired(): Promise<number>;
 }
+export {};

package/dist/builtins/device-manager/record-kinds.d.ts

@@ -0,0 +1,14 @@
+/**
+* Record kinds owned by device-manager (records plan phase 4).
+*/
+import { z } from "zod";
+import { DeviceTombstoneSchema, type DefinedRecordKind } from "@camstack/types";
+/** Body excludes `deviceId` — the record id is `String(deviceId)`. */
+export type DeviceTombstoneBody = Omit<z.infer<typeof DeviceTombstoneSchema>, "deviceId">;
+export declare const DeviceTombstoneBodySchema: z.ZodType<DeviceTombstoneBody>;
+export type DeviceManagerRecordKindsMap = {
+	readonly tombstones: DefinedRecordKind<z.ZodType<DeviceTombstoneBody>>;
+};
+export declare const deviceManagerRecordKinds: DeviceManagerRecordKindsMap;
+/** Narrow kind for `records.kind()`. */
+export declare const deviceTombstonesRecordKind: DefinedRecordKind<z.ZodType<DeviceTombstoneBody>>;

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D9qT3jHr.js");
+const require_dist = require("../../dist-DgOG8flk.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-Bxt_S-9a.mjs";
+import { Rr as BaseAddon, xn as logDestinationCapability } from "../../dist-BNunRyXT.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;