@camstack/system 1.2.443 → 1.2.445

package/dist/builtins/local-auth/oauth-session-manager.d.ts

@@ -1,4 +1,5 @@
-import type { SettingsStoreClient, TokenScope } from "@camstack/types";
+import type { RecordKindHandle, SettingsStoreClient, TokenScope } from "@camstack/types";
+import type { OauthSessionBody } from "./record-kinds.js";
 export interface OauthSession {
 	readonly id: string;
 	readonly userId: string;
@@ -15,61 +16,20 @@ interface CreateInput {
 	readonly integrationId: string;
 	readonly scopes: TokenScope[];
 }
+export interface OauthSessionRecordsDeps {
+	readonly oauthSessionsKind: RecordKindHandle<OauthSessionBody>;
+	readonly legacyStore?: SettingsStoreClient;
+}
 export declare class OauthSessionManager {
+	private readonly kind;
 	private readonly store;
-	constructor(store: SettingsStoreClient);
-	/**
-	* Create a new OAuth session record. Generates a UUID as the session id,
-	* sets `createdAt` and `lastUsedAt` to now, `revokedAt` to null.
-	*/
+	constructor(deps: SettingsStoreClient | OauthSessionRecordsDeps);
 	create(input: CreateInput): Promise<OauthSession>;
-	/**
-	* Return all sessions — both active and revoked. Callers decide
-	* whether to filter by `revokedAt`.
-	*/
 	list(): Promise<OauthSession[]>;
-	/**
-	* Look up a session by its id. Returns null when not found.
-	*/
 	getById(id: string): Promise<OauthSession | null>;
-	/**
-	* Mark a session as revoked by setting `revokedAt = now`.
-	*
-	* - Returns `true` on success (including idempotent re-revoke — the
-	*   existing `revokedAt` timestamp is preserved; it is NOT updated).
-	* - Returns `false` when the session id is not found.
-	*/
 	markRevoked(id: string): Promise<boolean>;
-	/**
-	* Delete one session row. Used by hub bulk revoke when the link is already
-	* revoked ("Remove revoked"): absence fails closed the same way as a
-	* revoked row, so dropping it only clears the list.
-	*/
 	remove(id: string): Promise<boolean>;
-	/**
-	* Delete sessions revoked longer ago than `horizonMs`.
-	*
-	* Safe because an ABSENT session already fails closed exactly like a revoked
-	* one: every consumer in `oauth-grants.ts` reads
-	* `if (!session || session.revokedAt != null) return null`. Deleting the row
-	* therefore cannot re-enable a link that was cut — it removes a record whose
-	* only remaining job was to say "no", which the absence says too.
-	*
-	* A retention window rather than an immediate delete: a revoked account link
-	* is the kind of thing an operator looks up AFTER the fact ("when did I
-	* unlink that?"), and the row is tiny. Active sessions are never touched —
-	* the filter matches only rows with a `revokedAt` timestamp in range, and
-	* `revokedAt` is NULL on every live session, which SQL's `BETWEEN` never
-	* matches.
-	*
-	* Returns how many rows went.
-	*/
 	reapRevoked(horizonMs: number): Promise<number>;
-	/**
-	* Update `lastUsedAt` to now. No-op (does not throw) when the session
-	* id is not found — the caller (token-use hot path) should not fail
-	* for a missing session that may have been concurrently revoked.
-	*/
 	touch(id: string): Promise<void>;
 }
 export {};

package/dist/builtins/local-auth/record-kinds.d.ts

@@ -0,0 +1,141 @@
+/**
+* Record kinds owned by `local-auth` (records plan phase 6 / §2.8).
+*
+* Operator-only legacy drop: auth tables are NEVER removed by the orphan job —
+* use `storageAdmin.dropCollection` with `expectRows` after verify (see
+* `docs/design/records-phase-6-auth-migration.md`).
+*
+* Before hub restart: mint and test an admin token (`csa_`); snapshot every kind.
+*/
+import { ApiKeyRecordSchema, type DefinedRecordKind, type RecordKindHandle, type RecordsAccess, ScopedTokenSchema, TokenScopeSchema, UserRecordSchema } from "@camstack/types";
+import { z } from "zod";
+export type UserBody = Omit<z.infer<typeof UserRecordSchema>, "id">;
+export declare const UserBodySchema: z.ZodType<UserBody>;
+export type ApiKeyBody = Omit<z.infer<typeof ApiKeyRecordSchema>, "id">;
+export declare const ApiKeyBodySchema: z.ZodType<ApiKeyBody>;
+export type ScopedTokenBody = Omit<z.infer<typeof ScopedTokenSchema>, "id">;
+export declare const ScopedTokenBodySchema: z.ZodType<ScopedTokenBody>;
+export type AdminTokenBody = {
+	readonly createdBy: string;
+	readonly name: string;
+	readonly tokenHash: string;
+	readonly tokenPrefix: string;
+	readonly createdAt: number;
+	readonly expiresAt: number;
+	readonly lastUsedAt?: number | null;
+	readonly revokedAt?: number | null;
+};
+export declare const AdminTokenBodySchema: z.ZodType<AdminTokenBody>;
+export type LoginSessionBody = {
+	readonly userId: string;
+	readonly method: string;
+	readonly refreshable: boolean;
+	readonly createdAt: number;
+	readonly lastUsedAt: number;
+	readonly expiresAt: number;
+	readonly revokedAt?: number | null;
+	readonly revokedReason?: string | null;
+	readonly refreshHash?: string | null;
+	readonly previousRefreshHash?: string | null;
+	readonly rotatedAt?: number | null;
+	readonly client?: string | null;
+	readonly ip?: string | null;
+	readonly credentialId?: string | null;
+};
+export declare const LoginSessionBodySchema: z.ZodType<LoginSessionBody>;
+export type LoginSessionCutoffBody = {
+	readonly notBefore: number;
+};
+export declare const LoginSessionCutoffBodySchema: z.ZodType<LoginSessionCutoffBody>;
+export type OauthSessionBody = {
+	readonly userId: string;
+	readonly username: string;
+	readonly integrationId: string;
+	readonly scopes: z.infer<typeof TokenScopeSchema>[];
+	readonly createdAt: number;
+	readonly lastUsedAt: number;
+	readonly revokedAt?: number | null;
+};
+export declare const OauthSessionBodySchema: z.ZodType<OauthSessionBody>;
+/** TOTP seed is a keychain-backed secret (D878); the row holds only a marker. */
+export type UserTotpBody = {
+	readonly confirmedAt?: number | null;
+	readonly createdAt: number;
+	readonly secret: string;
+};
+export declare const UserTotpBodySchema: z.ZodType<UserTotpBody>;
+export type ExternalIdentityBody = {
+	readonly provider: string;
+	readonly subject: string;
+	readonly issuer: string;
+	readonly userId: string;
+	readonly label?: string | null;
+	readonly linkedAt: number;
+};
+export declare const ExternalIdentityBodySchema: z.ZodType<ExternalIdentityBody>;
+export type DeviceCredentialBody = {
+	readonly userId: string;
+	readonly deviceName: string;
+	readonly platform: string;
+	readonly enrolledVia: string;
+	readonly fingerprint: string;
+	readonly serial: string;
+	readonly previousFingerprint?: string | null;
+	readonly renewedAt?: number | null;
+	readonly publicKey: string;
+	readonly issuedAt: number;
+	readonly expiresAt: number;
+	readonly lastUsedAt?: number | null;
+	readonly lastUsedFrom?: string | null;
+	readonly revokedAt?: number | null;
+	readonly revokedBy?: string | null;
+};
+export declare const DeviceCredentialBodySchema: z.ZodType<DeviceCredentialBody>;
+export type AuthAuditBody = {
+	readonly action: string;
+	readonly userId?: string | null;
+	readonly ip?: string | null;
+	readonly detail?: string | null;
+};
+export declare const AuthAuditBodySchema: z.ZodType<AuthAuditBody>;
+export type LocalAuthRecordKindsMap = {
+	readonly users: DefinedRecordKind<z.ZodType<UserBody>>;
+	readonly "api-keys": DefinedRecordKind<z.ZodType<ApiKeyBody>>;
+	readonly "scoped-tokens": DefinedRecordKind<z.ZodType<ScopedTokenBody>>;
+	readonly "admin-tokens": DefinedRecordKind<z.ZodType<AdminTokenBody>>;
+	readonly "login-sessions": DefinedRecordKind<z.ZodType<LoginSessionBody>>;
+	readonly "login-session-cutoffs": DefinedRecordKind<z.ZodType<LoginSessionCutoffBody>>;
+	readonly "oauth-sessions": DefinedRecordKind<z.ZodType<OauthSessionBody>>;
+	readonly "user-totp": DefinedRecordKind<z.ZodType<UserTotpBody>>;
+	readonly "user-external-identities": DefinedRecordKind<z.ZodType<ExternalIdentityBody>>;
+	readonly "device-credentials": DefinedRecordKind<z.ZodType<DeviceCredentialBody>>;
+	readonly "auth-audit": DefinedRecordKind<z.ZodType<AuthAuditBody>>;
+};
+export declare const localAuthRecordKinds: LocalAuthRecordKindsMap;
+export declare const localAuthUsersRecordKind: DefinedRecordKind<z.ZodType<UserBody>>;
+export declare const localAuthApiKeysRecordKind: DefinedRecordKind<z.ZodType<ApiKeyBody>>;
+export declare const localAuthScopedTokensRecordKind: DefinedRecordKind<z.ZodType<ScopedTokenBody>>;
+export declare const localAuthAdminTokensRecordKind: DefinedRecordKind<z.ZodType<AdminTokenBody>>;
+export declare const localAuthLoginSessionsRecordKind: DefinedRecordKind<z.ZodType<LoginSessionBody>>;
+export declare const localAuthLoginSessionCutoffsRecordKind: DefinedRecordKind<z.ZodType<LoginSessionCutoffBody>>;
+export declare const localAuthOauthSessionsRecordKind: DefinedRecordKind<z.ZodType<OauthSessionBody>>;
+export declare const localAuthUserTotpRecordKind: DefinedRecordKind<z.ZodType<UserTotpBody>>;
+export declare const localAuthUserExternalIdentitiesRecordKind: DefinedRecordKind<z.ZodType<ExternalIdentityBody>>;
+export declare const localAuthDeviceCredentialsRecordKind: DefinedRecordKind<z.ZodType<DeviceCredentialBody>>;
+export declare const localAuthAuthAuditRecordKind: DefinedRecordKind<z.ZodType<AuthAuditBody>>;
+/** Legacy collections that must not be `declareCollection` once these kinds are live. */
+export declare const LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS: readonly string[];
+export interface LocalAuthRecordStores {
+	readonly users: RecordKindHandle<UserBody>;
+	readonly apiKeys: RecordKindHandle<ApiKeyBody>;
+	readonly scopedTokens: RecordKindHandle<ScopedTokenBody>;
+	readonly adminTokens: RecordKindHandle<AdminTokenBody>;
+	readonly loginSessions: RecordKindHandle<LoginSessionBody>;
+	readonly loginSessionCutoffs: RecordKindHandle<LoginSessionCutoffBody>;
+	readonly oauthSessions: RecordKindHandle<OauthSessionBody>;
+	readonly userTotp: RecordKindHandle<UserTotpBody>;
+	readonly userExternalIdentities: RecordKindHandle<ExternalIdentityBody>;
+	readonly deviceCredentials: RecordKindHandle<DeviceCredentialBody>;
+	readonly authAudit: RecordKindHandle<AuthAuditBody>;
+}
+export declare function localAuthRecordStoresOf(records: Pick<RecordsAccess, "kind">): LocalAuthRecordStores;

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D9qT3jHr.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-B-wk9nzx.js");
+const require_dist = require("../../dist-DgOG8flk.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-BIkTHq-n.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { An as pickAppLinkHub, Ei as EventCategory, F as HUB_MDNS_SERVICE_TYPE, I as HUB_MDNS_TXT_KEYS, Ln as resolveAppConnections, U as NetworkTunnelStartedDataSchema, Vn as resolveHubAddressRoles, Wn as resolveNotificationTapAddress, in as isDefaultAppConnectionEndpoint, jr as BaseAddon, l as CAMSTACK_APP_LINK_ORIGIN, mn as localNetworkCapability, tn as isAppLinkBase, ur as validateCustomAddress, yt as checkRoleAddress } from "../../dist-Bxt_S-9a.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-DpPcQDg-.mjs";
+import { Fn as pickAppLinkHub, Jn as resolveHubAddressRoles, L as HUB_MDNS_SERVICE_TYPE, R as HUB_MDNS_TXT_KEYS, Rr as BaseAddon, Wn as resolveAppConnections, Zn as resolveNotificationTapAddress, _r as validateCustomAddress, l as CAMSTACK_APP_LINK_ORIGIN, la as EventCategory, ln as isDefaultAppConnectionEndpoint, on as isAppLinkBase, q as NetworkTunnelStartedDataSchema, wt as checkRoleAddress, yn as localNetworkCapability } from "../../dist-BNunRyXT.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-D16oRQ9K.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D9qT3jHr.js");
+const require_dist = require("../../dist-DgOG8flk.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-Bxt_S-9a.mjs";
+import { Rr as BaseAddon, xn as logDestinationCapability } from "../../dist-BNunRyXT.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D9qT3jHr.js");
+const require_dist = require("../../dist-DgOG8flk.js");
 let node_fs_promises = require("node:fs/promises");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Ar as errMsg, Ei as EventCategory, Fn as reducePoints, Jr as createEvent, Rn as resolveBucketMs, Sn as metricsProviderCapability, Xt as foldSnapshotByFunction, jr as BaseAddon } from "../../dist-Bxt_S-9a.mjs";
+import { Ci as createEvent, Dn as metricsProviderCapability, Gn as resolveBucketMs, Hn as reducePoints, Lr as errMsg, Rr as BaseAddon, la as EventCategory, tn as foldSnapshotByFunction } from "../../dist-BNunRyXT.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D9qT3jHr.js");
+const require_dist = require("../../dist-DgOG8flk.js");
 let node_util = require("node:util");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { Ar as errMsg, Ei as EventCategory, Jn as scoreRuntimes, Mn as platformProbeCapability, Qr as emitReadiness, Vt as enumerateInferenceDevices, jr as BaseAddon } from "../../dist-Bxt_S-9a.mjs";
+import { Kt as enumerateInferenceDevices, Ln as platformProbeCapability, Lr as errMsg, Rr as BaseAddon, ki as emitReadiness, la as EventCategory, tr as scoreRuntimes } from "../../dist-BNunRyXT.mjs";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";
 import * as fs from "node:fs";

package/dist/builtins/record-entries/entries-service.d.ts

@@ -0,0 +1,42 @@
+import { type EntryKindInfo, type EntryView, type RecordsAccess, type StorageKind } from "@camstack/types";
+/** Entries one list answers: an entries list is a settings page, not a table. */
+export declare const ENTRIES_LIST_MAX = 2e3;
+export interface EntriesServiceDeps {
+	/** Every record kind of the engine; `counts: false` is a catalog read with no row counting. */
+	listKinds(counts: boolean): Promise<readonly StorageKind[]>;
+	/** The records door of `owner` (hub in-process builtins only). */
+	recordsFor(owner: string): RecordsAccess;
+	newId?: () => string;
+}
+export declare class EntriesService {
+	private readonly deps;
+	constructor(deps: EntriesServiceDeps);
+	private entryKind;
+	private definitionOf;
+	listEntryKinds(): Promise<{
+		kinds: EntryKindInfo[];
+	}>;
+	listEntries(input: {
+		owner: string;
+		kind: string;
+	}): Promise<{
+		entries: EntryView[];
+	}>;
+	putEntry(input: {
+		owner: string;
+		kind: string;
+		id?: string | undefined;
+		data: Record<string, unknown>;
+		ifRev?: number | undefined;
+	}): Promise<{
+		id: string;
+		rev: number;
+	}>;
+	deleteEntry(input: {
+		owner: string;
+		kind: string;
+		id: string;
+	}): Promise<{
+		deleted: boolean;
+	}>;
+}

package/dist/builtins/record-entries/index.d.ts

@@ -0,0 +1 @@
+export { RecordEntriesAddon, default } from "./record-entries.addon.js";

package/dist/builtins/record-entries/index.js

@@ -0,0 +1,142 @@
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+require("../../chunk-Cek0wNdY.js");
+const require_dist = require("../../dist-DgOG8flk.js");
+let zod = require("zod");
+let node_crypto = require("node:crypto");
+//#region src/builtins/record-entries/entries-service.ts
+/**
+* The entries service (D881): one list/add/edit/delete surface for every entry
+* kind an addon declares (`defineEntryKind`). It holds no data and no schema of
+* its own - the engine's catalog is the source (`storageAdmin.listKinds`), and
+* each call acts for the entry's OWNER through `ctx.records.forOwner`, so the
+* owner's keychain refs and the owner-only rule of records both hold.
+*
+* The body is validated against the kind's JSON Schema descriptor
+* (`z.fromJSONSchema`), so a form can only save what the owner's own schema
+* describes. A password field is whatever the schema marks `secret: true`.
+*/
+/** Entries one list answers: an entries list is a settings page, not a table. */
+var ENTRIES_LIST_MAX = 2e3;
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var EntriesService = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async entryKind(owner, kind) {
+		const found = (await this.deps.listKinds(false)).find((k) => k.owner === owner && k.kind === kind && k.declaration.entry !== void 0);
+		if (found === void 0) throw new require_dist.UnknownRecordKindError(`"${owner}" declared no entry kind "${kind}"`);
+		return found;
+	}
+	definitionOf(info) {
+		const entry = info.declaration.entry;
+		if (entry === void 0) throw new require_dist.UnknownRecordKindError(`"${info.kind}" is not an entry kind`);
+		const body = zod.z.fromJSONSchema(entry.fields);
+		const schema = zod.z.custom((value) => isRecord(value) && body.safeParse(value).success, { message: "the entry does not match the kind's schema" });
+		return {
+			name: info.kind,
+			schema,
+			declaration: info.declaration
+		};
+	}
+	async listEntryKinds() {
+		return { kinds: (await this.deps.listKinds(true)).filter((k) => k.declaration.entry !== void 0 && k.state === "declared").map((k) => {
+			const entry = k.declaration.entry;
+			return {
+				owner: k.owner,
+				kind: k.kind,
+				title: entry?.title ?? k.kind,
+				nameField: entry?.nameField ?? "name",
+				fields: entry?.fields ?? {},
+				secretPaths: k.declaration.secretPaths,
+				rows: k.rows ?? 0
+			};
+		}) };
+	}
+	async listEntries(input) {
+		const info = await this.entryKind(input.owner, input.kind);
+		const nameField = info.declaration.entry?.nameField ?? "name";
+		const handle = this.deps.recordsFor(input.owner).kind(this.definitionOf(info));
+		const entries = [];
+		let cursor;
+		do {
+			const page = await handle.query({
+				limit: 500,
+				...cursor === void 0 ? {} : { cursor },
+				order: "id"
+			});
+			for (const row of page.records) {
+				const name = row.data[nameField];
+				entries.push({
+					id: row.id,
+					name: typeof name === "string" ? name : row.id,
+					rev: row.rev,
+					updatedAt: row.updatedAt,
+					data: row.data
+				});
+			}
+			cursor = page.nextCursor ?? void 0;
+			if (entries.length > 2e3) throw new require_dist.InvalidRecordError(`${input.kind}: more than ${ENTRIES_LIST_MAX} entries`);
+		} while (cursor !== void 0);
+		return { entries };
+	}
+	async putEntry(input) {
+		const info = await this.entryKind(input.owner, input.kind);
+		const handle = this.deps.recordsFor(input.owner).kind(this.definitionOf(info));
+		const id = input.id ?? (this.deps.newId ?? node_crypto.randomUUID)();
+		const ifRev = input.id === void 0 ? 0 : input.ifRev;
+		const { rev } = await handle.put({
+			id,
+			data: input.data
+		}, ifRev === void 0 ? {} : { ifRev });
+		return {
+			id,
+			rev
+		};
+	}
+	async deleteEntry(input) {
+		const info = await this.entryKind(input.owner, input.kind);
+		return { deleted: await this.deps.recordsFor(input.owner).kind(this.definitionOf(info)).delete(input.id) };
+	}
+};
+//#endregion
+//#region src/builtins/record-entries/record-entries.addon.ts
+/**
+* `record-entries` - the generic entries surface (D881). Hub-only and
+* in-process: it acts for each entry's owner on the keychain and on the
+* records door, which only a hub in-process system builtin may do
+* (`ctx.records.forOwner`, `ctx.secrets.forOwner`).
+*/
+var RecordEntriesAddon = class extends require_dist.BaseAddon {
+	id = "record-entries";
+	constructor() {
+		super({});
+	}
+	async onInitialize() {
+		const ctx = this.ctx;
+		const records = ctx.records;
+		const forOwner = records?.forOwner ?? null;
+		if (records === void 0 || forOwner === null) throw new Error("record-entries: this process cannot act for another owner (hub in-process only)");
+		const service = new EntriesService({
+			listKinds: async (counts) => (await ctx.api.storageAdmin.listKinds.query({ counts })).kinds,
+			recordsFor: (owner) => forOwner(owner)
+		});
+		return [{
+			capability: require_dist.recordEntriesCapability,
+			provider: {
+				listEntryKinds: () => service.listEntryKinds(),
+				listEntries: (input) => service.listEntries(input),
+				putEntry: (input) => service.putEntry(input),
+				deleteEntry: (input) => service.deleteEntry(input)
+			}
+		}];
+	}
+};
+//#endregion
+exports.RecordEntriesAddon = RecordEntriesAddon;
+exports.default = RecordEntriesAddon;

package/dist/builtins/record-entries/index.mjs

@@ -0,0 +1,136 @@
+import { Bn as recordEntriesCapability, Rr as BaseAddon, fi as UnknownRecordKindError, qr as InvalidRecordError } from "../../dist-BNunRyXT.mjs";
+import { z } from "zod";
+import { randomUUID } from "node:crypto";
+//#region src/builtins/record-entries/entries-service.ts
+/**
+* The entries service (D881): one list/add/edit/delete surface for every entry
+* kind an addon declares (`defineEntryKind`). It holds no data and no schema of
+* its own - the engine's catalog is the source (`storageAdmin.listKinds`), and
+* each call acts for the entry's OWNER through `ctx.records.forOwner`, so the
+* owner's keychain refs and the owner-only rule of records both hold.
+*
+* The body is validated against the kind's JSON Schema descriptor
+* (`z.fromJSONSchema`), so a form can only save what the owner's own schema
+* describes. A password field is whatever the schema marks `secret: true`.
+*/
+/** Entries one list answers: an entries list is a settings page, not a table. */
+var ENTRIES_LIST_MAX = 2e3;
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var EntriesService = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async entryKind(owner, kind) {
+		const found = (await this.deps.listKinds(false)).find((k) => k.owner === owner && k.kind === kind && k.declaration.entry !== void 0);
+		if (found === void 0) throw new UnknownRecordKindError(`"${owner}" declared no entry kind "${kind}"`);
+		return found;
+	}
+	definitionOf(info) {
+		const entry = info.declaration.entry;
+		if (entry === void 0) throw new UnknownRecordKindError(`"${info.kind}" is not an entry kind`);
+		const body = z.fromJSONSchema(entry.fields);
+		const schema = z.custom((value) => isRecord(value) && body.safeParse(value).success, { message: "the entry does not match the kind's schema" });
+		return {
+			name: info.kind,
+			schema,
+			declaration: info.declaration
+		};
+	}
+	async listEntryKinds() {
+		return { kinds: (await this.deps.listKinds(true)).filter((k) => k.declaration.entry !== void 0 && k.state === "declared").map((k) => {
+			const entry = k.declaration.entry;
+			return {
+				owner: k.owner,
+				kind: k.kind,
+				title: entry?.title ?? k.kind,
+				nameField: entry?.nameField ?? "name",
+				fields: entry?.fields ?? {},
+				secretPaths: k.declaration.secretPaths,
+				rows: k.rows ?? 0
+			};
+		}) };
+	}
+	async listEntries(input) {
+		const info = await this.entryKind(input.owner, input.kind);
+		const nameField = info.declaration.entry?.nameField ?? "name";
+		const handle = this.deps.recordsFor(input.owner).kind(this.definitionOf(info));
+		const entries = [];
+		let cursor;
+		do {
+			const page = await handle.query({
+				limit: 500,
+				...cursor === void 0 ? {} : { cursor },
+				order: "id"
+			});
+			for (const row of page.records) {
+				const name = row.data[nameField];
+				entries.push({
+					id: row.id,
+					name: typeof name === "string" ? name : row.id,
+					rev: row.rev,
+					updatedAt: row.updatedAt,
+					data: row.data
+				});
+			}
+			cursor = page.nextCursor ?? void 0;
+			if (entries.length > 2e3) throw new InvalidRecordError(`${input.kind}: more than ${ENTRIES_LIST_MAX} entries`);
+		} while (cursor !== void 0);
+		return { entries };
+	}
+	async putEntry(input) {
+		const info = await this.entryKind(input.owner, input.kind);
+		const handle = this.deps.recordsFor(input.owner).kind(this.definitionOf(info));
+		const id = input.id ?? (this.deps.newId ?? randomUUID)();
+		const ifRev = input.id === void 0 ? 0 : input.ifRev;
+		const { rev } = await handle.put({
+			id,
+			data: input.data
+		}, ifRev === void 0 ? {} : { ifRev });
+		return {
+			id,
+			rev
+		};
+	}
+	async deleteEntry(input) {
+		const info = await this.entryKind(input.owner, input.kind);
+		return { deleted: await this.deps.recordsFor(input.owner).kind(this.definitionOf(info)).delete(input.id) };
+	}
+};
+//#endregion
+//#region src/builtins/record-entries/record-entries.addon.ts
+/**
+* `record-entries` - the generic entries surface (D881). Hub-only and
+* in-process: it acts for each entry's owner on the keychain and on the
+* records door, which only a hub in-process system builtin may do
+* (`ctx.records.forOwner`, `ctx.secrets.forOwner`).
+*/
+var RecordEntriesAddon = class extends BaseAddon {
+	id = "record-entries";
+	constructor() {
+		super({});
+	}
+	async onInitialize() {
+		const ctx = this.ctx;
+		const records = ctx.records;
+		const forOwner = records?.forOwner ?? null;
+		if (records === void 0 || forOwner === null) throw new Error("record-entries: this process cannot act for another owner (hub in-process only)");
+		const service = new EntriesService({
+			listKinds: async (counts) => (await ctx.api.storageAdmin.listKinds.query({ counts })).kinds,
+			recordsFor: (owner) => forOwner(owner)
+		});
+		return [{
+			capability: recordEntriesCapability,
+			provider: {
+				listEntryKinds: () => service.listEntryKinds(),
+				listEntries: (input) => service.listEntries(input),
+				putEntry: (input) => service.putEntry(input),
+				deleteEntry: (input) => service.deleteEntry(input)
+			}
+		}];
+	}
+};
+//#endregion
+export { RecordEntriesAddon, RecordEntriesAddon as default };

package/dist/builtins/record-entries/record-entries.addon.d.ts

@@ -0,0 +1,13 @@
+/**
+* `record-entries` - the generic entries surface (D881). Hub-only and
+* in-process: it acts for each entry's owner on the keychain and on the
+* records door, which only a hub in-process system builtin may do
+* (`ctx.records.forOwner`, `ctx.secrets.forOwner`).
+*/
+import { BaseAddon, type ProviderRegistration } from "@camstack/types";
+export declare class RecordEntriesAddon extends BaseAddon {
+	readonly id = "record-entries";
+	constructor();
+	protected onInitialize(): Promise<ProviderRegistration[]>;
+}
+export default RecordEntriesAddon;

package/dist/builtins/records/legacy-table-row-count.d.ts

@@ -0,0 +1,5 @@
+/** Row count for a physical settings-db table (matches the records engine `legacyRowCount`). */
+export declare function legacyTableRowCountFromList(tables: readonly {
+	readonly name: string;
+	readonly rows: number;
+}[], collection: string): number;

package/dist/builtins/records/phase6-declare-gate.d.ts

@@ -0,0 +1,28 @@
+/**
+* Phase 6 auth/alert builtins: do not call `ctx.records.declare` while legacy
+* tables still hold rows unless every kind is already adopted, or the operator
+* set {@link CAMSTACK_RECORDS_DECLARE_PHASE6} for the declare pass before
+* `records-adopt.ts --apply`.
+*/
+import { type AddonContext, type DefinedRecordKind, type RecordsAccess, type StorageKind } from "@camstack/types";
+/** Operator override: declare kinds even when adoption is still pending (legacy path until adopt completes). */
+export declare const CAMSTACK_RECORDS_DECLARE_PHASE6 = "CAMSTACK_RECORDS_DECLARE_PHASE6";
+export declare function isPhase6RecordsDeclareForced(): boolean;
+export interface Phase6DeclareGateDeps {
+	readonly owner: string;
+	readonly records: RecordsAccess;
+	readonly kinds: Readonly<Record<string, DefinedRecordKind>>;
+	readonly legacyCollections: readonly string[];
+	readonly legacyRowCount: (collection: string) => Promise<number>;
+	readonly listKindsForOwner: (owner: string) => Promise<readonly StorageKind[]>;
+	readonly isAdoptedLegacyTable: (collection: string) => Promise<boolean>;
+	readonly log: {
+		info(message: string, meta?: Record<string, unknown>): void;
+	};
+}
+/**
+* @returns `true` when stores should bind record kinds; `false` for legacy collections only.
+*/
+export declare function resolvePhase6UseRecordsPath(deps: Phase6DeclareGateDeps): Promise<boolean>;
+/** Shared wiring for hub builtins (local-auth, keychain, alert-center). */
+export declare function resolvePhase6UseRecordsPathForHub(ctx: Pick<AddonContext, "api" | "logger" | "records">, owner: string, kinds: Readonly<Record<string, DefinedRecordKind>>, legacyCollections: readonly string[]): Promise<boolean>;