@camstack/system 1.2.443 → 1.2.445

package/dist/kernel/index.d.ts

@@ -49,6 +49,8 @@ export { createAddonService, validateProviderRegistrations } from "./moleculer/a
 export { createCoreCapService, CORE_CAP_SERVICE_NAME } from "./moleculer/core-cap-service.js";
 export type { CoreCapAction, CoreCapCallOrigin, CoreCapServiceOptions } from "./moleculer/core-cap-service.js";
 export { createAddonContext, createUdsAddonContext, setHubConnected, adaptBrokerToCluster, registerEventBusService, setNodeEventInterest, getMoleculerEventStats, subscribePassthrough, getBrokerEventBus, clusterEventTopic, EVENT_TOPIC_PREFIX } from "./moleculer/addon-context-factory.js";
+export { asBrokerLike } from "./moleculer/event-bus.js";
+export type { BrokerLike } from "./moleculer/event-bus.js";
 export type { MoleculerEventStats } from "./moleculer/addon-context-factory.js";
 export { HubLogForwarder } from "./moleculer/hub-log-forwarder.js";
 export type { AddonContextOptions } from "./moleculer/addon-context-factory.js";

package/dist/kernel/moleculer/event-bus.d.ts

@@ -4,7 +4,7 @@ import type { ServiceBroker } from "moleculer";
 * Narrow interface for the Moleculer ServiceBroker surface used in this file.
 * moleculer's index.d.ts chains through eventemitter2 whose package.json has
 * no `types` field; typescript-eslint's no-unsafe-* rules flag every
-* broker.X access. Cast once per function: `const bkr = broker as unknown as BrokerLike`.
+* broker.X access when eslint no-unsafe rules apply elsewhere.
 */
 export interface BrokerLike {
 	readonly nodeID: string;
@@ -19,6 +19,8 @@ export interface BrokerLike {
 		warn?: (msg: string) => void;
 	};
 }
+/** Documented boundary: CamStack brokers are always `createBroker` products. */
+export declare function asBrokerLike(broker: ServiceBroker): BrokerLike;
 /**
 * Topic prefix for clustered EventBus broadcasts. The `camstack.evt.`
 * namespace keeps our events disjoint from Moleculer internal events

package/dist/kernel/moleculer/mesh-mtls/mesh-certificate-registry.d.ts

@@ -1,4 +1,5 @@
-import type { CollectionColumn, IScopedLogger, SettingsStoreClient } from "@camstack/types";
+import type { CollectionColumn, IScopedLogger, RecordKindHandle, SettingsStoreClient } from "@camstack/types";
+import type { MeshNodeCertificateBody } from "../../../builtins/system-config/record-kinds.js";
 import type { MeshCrl } from "./mesh-crl.js";
 /**
 * @durable class=config owner=system-config
@@ -45,7 +46,9 @@ export declare class MeshCertificateRegistry {
 	constructor(store: SettingsStoreClient, deps?: {
 		readonly now?: () => number;
 		readonly logger?: IScopedLogger;
+		readonly meshKind?: RecordKindHandle<MeshNodeCertificateBody> | null;
 	});
+	private recordToBody;
 	private now;
 	load(): Promise<void>;
 	/** Write down a leaf the hub just issued. Idempotent per fingerprint. */
@@ -95,6 +98,7 @@ export declare class MeshCertificateRegistry {
 	isRevoked(serial: string): boolean;
 	reap(): Promise<number>;
 	private insert;
+	private deleteRow;
 	private persist;
 }
 export declare function setProcessMeshCertificateRegistry(registry: MeshCertificateRegistry | null): void;

package/dist/kernel/moleculer/records-api-transport.d.ts

@@ -0,0 +1,9 @@
+/**
+* The wire of `ctx.records` for an addon that runs in a forked runner or on an
+* agent (D881): every call is a cap call on `ctx.api.records`, and the parent
+* (or, on an agent, the agent and then `$hub-cap-fwd`) STAMPS who is calling
+* from the connection the call arrived on. The input carries no identity, so
+* there is nothing here an addon could change to read another addon's kind.
+*/
+import type { AddonApi, RecordsTransport } from "@camstack/types";
+export declare function recordsTransportOf(api: AddonApi): RecordsTransport;

package/dist/kernel/moleculer/remote-logger.d.ts

@@ -1,6 +1,6 @@
 import type { ServiceBroker } from "moleculer";
 import type { IScopedLogger, LogTags } from "@camstack/types";
-import type { BrokerLike } from "./event-bus.js";
+import { type BrokerLike } from "./event-bus.js";
 /**
 * Call after `broker.waitForServices('$hub')` to enable log forwarding.
 *
@@ -17,7 +17,7 @@ declare function setHubConnected(broker?: ServiceBroker): void;
 */
 declare function __resetHubConnectedForTests(): void;
 export { __resetHubConnectedForTests };
-declare function createRemoteLogger(broker: ServiceBroker, addonId: string, scope?: string, tags?: LogTags): IScopedLogger;
+declare function createRemoteLogger(broker: BrokerLike, addonId: string, scope?: string, tags?: LogTags): IScopedLogger;
 export { createRemoteLogger };
 /**
 * Build a hub-forwarding logger for a forked-process runner (process-runner

package/dist/kernel/settings-view-types.d.ts

@@ -53,13 +53,6 @@ export interface ISettingsStore {
 	/** Addon-level global settings (apply to every device unless overridden). */
 	getAllAddon(addonId: string): Record<string, unknown>;
 	setAllAddon(addonId: string, config: Record<string, unknown>): void;
-	/** Legacy per-provider settings (used by some older wiring paths). */
-	getAllProvider(providerId: string): Record<string, unknown>;
-	setProvider(providerId: string, key: string, value: unknown): void;
-	/** Legacy flat per-device settings. Kept for backward compatibility
-	*  with pre-addon wiring; new code should use the addon-device API. */
-	getAllDevice(deviceId: string): Record<string, unknown>;
-	setDevice(deviceId: string, key: string, value: unknown): void;
 	/**
 	* Per-device runtime state — the whole cap-slice map as ONE row in the
 	* `device-runtime-state` collection.

package/dist/kernel/transport/cap-route-resolver.d.ts

@@ -1,28 +1,3 @@
-/**
-* CapRouteResolver — builds a live CapRouteSnapshot from injected deps and
-* dispatches a resolved CapRoute to the appropriate transport.
-*
-* Layer boundary: this file lives in `@camstack/kernel` and MUST NOT import
-* from `server/backend`. All server-side state is injected via narrow named
-* interfaces (NodeCapAuthority, InProcessProviderLookup, BrokerHandle).
-*
-* Wire conventions (kept here as the single source of truth):
-*
-*   remote-moleculer dispatch
-*     action  : `${addonId}.${capName}.${method}`
-*     params  : methodArgs (passed through)
-*     options : { nodeID: route.nodeId, timeout: 60_000 }
-*     note    : addonId is resolved by NodeCapAuthority.getAddonId(nodeId, cap)
-*
-*   agent-child-forward dispatch
-*     service : `$agent-cap-fwd`
-*     action  : `$agent-cap-fwd.forward`
-*     params  : { capName, method, args, childId, deviceId? }
-*     options : { nodeID: route.agentNodeId, timeout: 60_000 }
-*     note    : Task 6's agent-side service MUST register the Moleculer service
-*               `$agent-cap-fwd` with action `forward` that accepts this shape
-*               and fans the call over UDS to route.childId.
-*/
 import type { ServiceDiscoveryBroker } from "../moleculer/resilient-cap-call.js";
 import type { CapRoute, CapRouteOpts, HubLocalUdsRoute, InProcessProviderRef } from "./cap-route.js";
 import type { CapCallInput } from "./child-cap-protocol.js";
@@ -186,9 +161,10 @@ export declare function extractNodeId(args: unknown): string | undefined;
 *    keychain owner-checks on this field, and until 2026-10-08 an unstamped
 *    call let a child's own `callerAddonId` through untouched.
 *
-* A hub in-process caller never reaches this function (`localProviderLink`
-* calls the provider directly), which is the one place a stated identity is
-* trusted. A non-object `args` (or `null`/array) is returned unchanged: there
+* Hub-main in-process contexts that bypass tRPC (addon-registry's stated
+* transports) never reach this function. Co-located broker/agent callers
+* stamp here inside `localProviderLink` before the zero-copy invoke.
+* A non-object `args` (or `null`/array) is returned unchanged: there
 * is nowhere to attach a key, and nowhere one could hide.
 */
 export declare function stampCallerAddonId(args: unknown, callerAddonId: string | undefined): unknown;
@@ -234,19 +210,14 @@ export declare class CapRouteResolver {
 	*   provider). Only meaningful for `agent-child-forward` — a `remote-moleculer`
 	*   route already encodes the provider in its action name
 	*   (`${addonId}.${cap}.${method}`, via `NodeCapAuthority.getAddonId`), and a
-	*   `hub-local-uds` caller that already knows the addonId (`buildCapCallFn`)
-	*   talks to `LocalChildRegistry.callCapOnChild` directly rather than through
-	*   `dispatch`.
+	*   `buildCapCallFn`'s direct UDS branch when it already knows the child.
 	* @param callerAddonId Optional out-of-band CALLER-identity hint — the
 	*   addon that ORIGINATED the call, distinct from `addonId` above (which
 	*   names the resolved PROVIDER, not the caller). Set by
-	*   `onUnownedCall` from `CapCallInput.callerAddonId`
-	*   (`LocalChildRegistry` stamped it off the registered `childId`). Only
-	*   the `hub-in-process` branch consumes it — merged into `args` so a
-	*   diagnostic tool deep in that provider (e.g. device-manager's
-	*   fleet-read census) can read it without every provider method changing
-	*   signature, the same "extra field the provider destructures or
-	*   ignores" convention `nodeId` already uses on this path.
+	*   `onUnownedCall` / `buildCapCallFn` from a stated in-process claim.
+	*   `hub-in-process` merges it into `args`; `hub-local-uds` carries it on
+	*   {@link CapCallInput.callerAddonId} so the child can stamp before invoke
+	*   (without it, `stampCallerAddonId` strips an args-only claim).
 	*/
 	dispatch(route: CapRoute, method: string, args: unknown, addonId?: string, callerAddonId?: string): Promise<unknown>;
 	/**

package/dist/phase6-declare-gate-Ci1-8uUn.js

@@ -0,0 +1,98 @@
+const require_dist = require("./dist-DgOG8flk.js");
+//#region src/builtins/records/legacy-table-row-count.ts
+/** Row count for a physical settings-db table (matches the records engine `legacyRowCount`). */
+function legacyTableRowCountFromList(tables, collection) {
+	return tables.find((t) => t.name === collection)?.rows ?? 0;
+}
+//#endregion
+//#region src/builtins/records/phase6-declare-gate.ts
+/**
+* Phase 6 auth/alert builtins: do not call `ctx.records.declare` while legacy
+* tables still hold rows unless every kind is already adopted, or the operator
+* set {@link CAMSTACK_RECORDS_DECLARE_PHASE6} for the declare pass before
+* `records-adopt.ts --apply`.
+*/
+/** Operator override: declare kinds even when adoption is still pending (legacy path until adopt completes). */
+var CAMSTACK_RECORDS_DECLARE_PHASE6 = "CAMSTACK_RECORDS_DECLARE_PHASE6";
+function isPhase6RecordsDeclareForced() {
+	const raw = process.env[CAMSTACK_RECORDS_DECLARE_PHASE6]?.trim().toLowerCase();
+	return raw === "1" || raw === "true" || raw === "yes";
+}
+async function legacyTablesHoldRows(collections, legacyRowCount) {
+	for (const collection of collections) if (await legacyRowCount(collection) > 0) return true;
+	return false;
+}
+async function catalogKindsFullyAdopted(owner, kindNames, declarations, listKindsForOwner, isAdoptedLegacyTable) {
+	const listed = await listKindsForOwner(owner);
+	const byKind = new Map(listed.map((k) => [k.kind, k]));
+	for (const name of kindNames) {
+		if (byKind.get(name) === void 0) return false;
+		const legacy = declarations[name]?.adoptsFrom;
+		if (typeof legacy !== "string") continue;
+		if (!await isAdoptedLegacyTable(legacy)) return false;
+	}
+	return true;
+}
+/**
+* @returns `true` when stores should bind record kinds; `false` for legacy collections only.
+*/
+async function resolvePhase6UseRecordsPath(deps) {
+	const declarations = require_dist.declarationsOf(deps.kinds);
+	const kindNames = Object.keys(deps.kinds);
+	if (await catalogKindsFullyAdopted(deps.owner, kindNames, declarations, deps.listKindsForOwner, deps.isAdoptedLegacyTable)) {
+		await deps.records.declare(deps.kinds);
+		return true;
+	}
+	if (!await legacyTablesHoldRows(deps.legacyCollections, deps.legacyRowCount)) {
+		await deps.records.declare(deps.kinds);
+		return true;
+	}
+	if (isPhase6RecordsDeclareForced()) {
+		try {
+			await deps.records.declare(deps.kinds);
+		} catch (err) {
+			if (!(err instanceof Error ? err.message : String(err)).startsWith("records/adoption-pending:")) throw err;
+			deps.log.info("phase 6: records kinds declared; legacy tables until adopt completes", { owner: deps.owner });
+		}
+		return false;
+	}
+	deps.log.info("phase 6: skipping records.declare — serving legacy collections until adopt completes", { owner: deps.owner });
+	return false;
+}
+/** Shared wiring for hub builtins (local-auth, keychain, alert-center). */
+async function resolvePhase6UseRecordsPathForHub(ctx, owner, kinds, legacyCollections) {
+	const records = ctx.records;
+	const store = ctx.api?.settingsStore;
+	if (records === void 0 || store === void 0) return false;
+	const admin = ctx.api?.storageAdmin;
+	return resolvePhase6UseRecordsPath({
+		owner,
+		records,
+		kinds,
+		legacyCollections,
+		legacyRowCount: async (collection) => {
+			if (admin !== void 0) {
+				const fromEngine = legacyTableRowCountFromList((await admin.listTables.query({})).tables, collection);
+				if (fromEngine > 0) return fromEngine;
+			}
+			try {
+				return await store.count.query({ collection });
+			} catch {
+				return admin === void 0 ? 0 : legacyTableRowCountFromList((await admin.listTables.query({})).tables, collection);
+			}
+		},
+		listKindsForOwner: async (o) => admin === void 0 ? [] : (await admin.listKinds.query({
+			owner: o,
+			counts: false
+		})).kinds,
+		isAdoptedLegacyTable: async (collection) => admin === void 0 ? false : (await admin.isAdoptedLegacyTable.query({ collection })).adopted,
+		log: { info: (message, meta) => ctx.logger.info(message, meta ? { meta } : void 0) }
+	});
+}
+//#endregion
+Object.defineProperty(exports, "resolvePhase6UseRecordsPathForHub", {
+	enumerable: true,
+	get: function() {
+		return resolvePhase6UseRecordsPathForHub;
+	}
+});

package/dist/phase6-declare-gate-tkKOEitw.mjs

@@ -0,0 +1,93 @@
+import { Ti as declarationsOf } from "./dist-BNunRyXT.mjs";
+//#region src/builtins/records/legacy-table-row-count.ts
+/** Row count for a physical settings-db table (matches the records engine `legacyRowCount`). */
+function legacyTableRowCountFromList(tables, collection) {
+	return tables.find((t) => t.name === collection)?.rows ?? 0;
+}
+//#endregion
+//#region src/builtins/records/phase6-declare-gate.ts
+/**
+* Phase 6 auth/alert builtins: do not call `ctx.records.declare` while legacy
+* tables still hold rows unless every kind is already adopted, or the operator
+* set {@link CAMSTACK_RECORDS_DECLARE_PHASE6} for the declare pass before
+* `records-adopt.ts --apply`.
+*/
+/** Operator override: declare kinds even when adoption is still pending (legacy path until adopt completes). */
+var CAMSTACK_RECORDS_DECLARE_PHASE6 = "CAMSTACK_RECORDS_DECLARE_PHASE6";
+function isPhase6RecordsDeclareForced() {
+	const raw = process.env[CAMSTACK_RECORDS_DECLARE_PHASE6]?.trim().toLowerCase();
+	return raw === "1" || raw === "true" || raw === "yes";
+}
+async function legacyTablesHoldRows(collections, legacyRowCount) {
+	for (const collection of collections) if (await legacyRowCount(collection) > 0) return true;
+	return false;
+}
+async function catalogKindsFullyAdopted(owner, kindNames, declarations, listKindsForOwner, isAdoptedLegacyTable) {
+	const listed = await listKindsForOwner(owner);
+	const byKind = new Map(listed.map((k) => [k.kind, k]));
+	for (const name of kindNames) {
+		if (byKind.get(name) === void 0) return false;
+		const legacy = declarations[name]?.adoptsFrom;
+		if (typeof legacy !== "string") continue;
+		if (!await isAdoptedLegacyTable(legacy)) return false;
+	}
+	return true;
+}
+/**
+* @returns `true` when stores should bind record kinds; `false` for legacy collections only.
+*/
+async function resolvePhase6UseRecordsPath(deps) {
+	const declarations = declarationsOf(deps.kinds);
+	const kindNames = Object.keys(deps.kinds);
+	if (await catalogKindsFullyAdopted(deps.owner, kindNames, declarations, deps.listKindsForOwner, deps.isAdoptedLegacyTable)) {
+		await deps.records.declare(deps.kinds);
+		return true;
+	}
+	if (!await legacyTablesHoldRows(deps.legacyCollections, deps.legacyRowCount)) {
+		await deps.records.declare(deps.kinds);
+		return true;
+	}
+	if (isPhase6RecordsDeclareForced()) {
+		try {
+			await deps.records.declare(deps.kinds);
+		} catch (err) {
+			if (!(err instanceof Error ? err.message : String(err)).startsWith("records/adoption-pending:")) throw err;
+			deps.log.info("phase 6: records kinds declared; legacy tables until adopt completes", { owner: deps.owner });
+		}
+		return false;
+	}
+	deps.log.info("phase 6: skipping records.declare — serving legacy collections until adopt completes", { owner: deps.owner });
+	return false;
+}
+/** Shared wiring for hub builtins (local-auth, keychain, alert-center). */
+async function resolvePhase6UseRecordsPathForHub(ctx, owner, kinds, legacyCollections) {
+	const records = ctx.records;
+	const store = ctx.api?.settingsStore;
+	if (records === void 0 || store === void 0) return false;
+	const admin = ctx.api?.storageAdmin;
+	return resolvePhase6UseRecordsPath({
+		owner,
+		records,
+		kinds,
+		legacyCollections,
+		legacyRowCount: async (collection) => {
+			if (admin !== void 0) {
+				const fromEngine = legacyTableRowCountFromList((await admin.listTables.query({})).tables, collection);
+				if (fromEngine > 0) return fromEngine;
+			}
+			try {
+				return await store.count.query({ collection });
+			} catch {
+				return admin === void 0 ? 0 : legacyTableRowCountFromList((await admin.listTables.query({})).tables, collection);
+			}
+		},
+		listKindsForOwner: async (o) => admin === void 0 ? [] : (await admin.listKinds.query({
+			owner: o,
+			counts: false
+		})).kinds,
+		isAdoptedLegacyTable: async (collection) => admin === void 0 ? false : (await admin.isAdoptedLegacyTable.query({ collection })).adopted,
+		log: { info: (message, meta) => ctx.logger.info(message, meta ? { meta } : void 0) }
+	});
+}
+//#endregion
+export { resolvePhase6UseRecordsPathForHub as t };

package/dist/read-all-rows-CVoO1ONM.js

@@ -0,0 +1,29 @@
+//#region src/records/read-all-rows.js
+var require_read_all_rows = /* @__PURE__ */ require("./chunk-Cek0wNdY.js").__commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.readAllRows = readAllRows;
+	var PAGE_SIZE = 1e3;
+	var MAX_PAGES = 100;
+	async function readAllRows(kind, query = {}, options = {}) {
+		const out = [];
+		let cursor;
+		for (let page = 0; page < MAX_PAGES; page += 1) {
+			const answer = await kind.query({
+				...query,
+				limit: PAGE_SIZE,
+				...cursor === void 0 ? {} : { cursor }
+			}, options);
+			out.push(...answer.records);
+			if (answer.nextCursor === null) return out;
+			cursor = answer.nextCursor;
+		}
+		throw new Error(`record kind "${kind.name}" holds more than ${MAX_PAGES * PAGE_SIZE} rows`);
+	}
+}));
+//#endregion
+Object.defineProperty(exports, "require_read_all_rows", {
+	enumerable: true,
+	get: function() {
+		return require_read_all_rows;
+	}
+});

package/dist/read-all-rows-TaPqdWNF.mjs

@@ -0,0 +1,25 @@
+import { t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
+//#region src/records/read-all-rows.js
+var require_read_all_rows = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.readAllRows = readAllRows;
+	var PAGE_SIZE = 1e3;
+	var MAX_PAGES = 100;
+	async function readAllRows(kind, query = {}, options = {}) {
+		const out = [];
+		let cursor;
+		for (let page = 0; page < MAX_PAGES; page += 1) {
+			const answer = await kind.query({
+				...query,
+				limit: PAGE_SIZE,
+				...cursor === void 0 ? {} : { cursor }
+			}, options);
+			out.push(...answer.records);
+			if (answer.nextCursor === null) return out;
+			cursor = answer.nextCursor;
+		}
+		throw new Error(`record kind "${kind.name}" holds more than ${MAX_PAGES * PAGE_SIZE} rows`);
+	}
+}));
+//#endregion
+export { require_read_all_rows as t };

package/dist/records/read-all-rows.d.ts

@@ -0,0 +1,6 @@
+/**
+* Read every row of a record kind, page by page (hub-main stores, D881).
+*/
+import type { RecordKindHandle, RecordQueryInput, RecordQueryOptions, RecordRow } from "@camstack/types";
+export type RecordPageQuery = Omit<RecordQueryInput, "kind" | "limit" | "cursor">;
+export declare function readAllRows<T>(kind: RecordKindHandle<T>, query?: RecordPageQuery, options?: RecordQueryOptions): Promise<RecordRow<T>[]>;