@camstack/system 1.2.444 → 1.2.445

package/dist/builtins/keychain/index.js

@@ -3,9 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D1vECb_6.js");
-const require_device_ca = require("../../device-ca-DT9X2S6d.js");
-const require_constants = require("../../constants-BXiNEIeV.js");
+const require_dist = require("../../dist-DgOG8flk.js");
+const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
+const require_device_ca = require("../../device-ca-CnJ_va7i.js");
+const require_phase6_declare_gate = require("../../phase6-declare-gate-Ci1-8uUn.js");
+const require_constants = require("../../constants-Br879Axi.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -388,8 +390,11 @@ var NOT_INITIALIZED = {
 	state: "locked",
 	reason: "not-initialized"
 };
-/** The only refs `importSecret` accepts: a camera's restream tokens (D870 migration). */
-var IMPORTABLE_REF = /^secret:\/\/stream-broker\/device\/[0-9]+\/rtspTokens$/;
+/**
+* Refs `importSecret` accepts for operator migration (D870): restream tokens and
+* record-row secret refs (`recordSecretRef` — collection `records%3A<kind>`).
+*/
+var IMPORTABLE_REF = /^(?:secret:\/\/stream-broker\/device\/[0-9]+\/rtspTokens|secret:\/\/[^/]+\/row\/records%3A[^/]+\/[^/]+\/.+)$/;
 var KeychainService = class {
 	deps;
 	unlock = NOT_INITIALIZED;
@@ -785,11 +790,12 @@ var KeychainService = class {
 		return this.put(require_device_ca.SYSTEM_SECRET_OWNER, ref, value, `user:${userId}`);
 	}
 	/**
-	* An operator tool stores a carried-over value at an addon's own ref (D870).
-	* Stored under the ref's owner, audited as the operator.
+	* An operator tool stores a carried-over value at a migration ref (D870):
+	* restream tokens or a `recordSecretRef` row field. Stored under the ref's
+	* owner, audited as the operator; never overwrites an existing value.
 	*/
 	async importSecret(userId, ref, value) {
-		if (!IMPORTABLE_REF.test(ref)) throw new Error(`keychain: "${ref}" is not an importable ref (restream tokens only)`);
+		if (!IMPORTABLE_REF.test(ref)) throw new Error(`keychain: "${ref}" is not an importable ref (restream tokens or record row secrets)`);
 		if ((await this.deps.repo.getSecrets([ref])).has(ref)) throw new Error(`keychain: a value is already stored at ${ref} - import refuses to overwrite`);
 		const parts = require_dist.parseSecretRef(ref);
 		if (parts === null) throw new Error(`keychain: "${ref}" is not a secret ref`);
@@ -1068,6 +1074,7 @@ function errMsg(err) {
 require_dist.EventCategory.KeychainChanged;
 //#endregion
 //#region src/builtins/keychain/keychain-store.ts
+var import_read_all_rows = require_read_all_rows$1.require_read_all_rows();
 /**
 * @durable class=config owner=keychain
 *   write="`keychain.put` upserts one row per ref; `delete` removes it"
@@ -1373,8 +1380,16 @@ function toResetRecord(id, data) {
 var PAGE = 1e3;
 var KeychainRepository = class {
 	door;
-	constructor(door) {
+	records;
+	constructor(door, records) {
 		this.door = door;
+		this.records = records;
+	}
+	static recordStoresOf(records) {
+		return {
+			audit: records.kind(keychainRecordKinds.audit),
+			resets: records.kind(keychainRecordKinds.resets)
+		};
 	}
 	async init() {
 		await this.door.declareCollection({
@@ -1389,18 +1404,20 @@ var KeychainRepository = class {
 			collection: KEYCHAIN_KEYS_COLLECTION,
 			columns: KEY_COLUMNS
 		});
-		await this.door.declareCollection({
-			collection: KEYCHAIN_RESETS_COLLECTION,
-			columns: RESET_COLUMNS
-		});
-		await this.door.declareCollection({
-			collection: KEYCHAIN_AUDIT_COLLECTION,
-			columns: AUDIT_COLUMNS,
-			indexes: [{
-				name: "idx_keychain_audit_at",
-				columns: ["at"]
-			}]
-		});
+		if (this.records === void 0) {
+			await this.door.declareCollection({
+				collection: KEYCHAIN_RESETS_COLLECTION,
+				columns: RESET_COLUMNS
+			});
+			await this.door.declareCollection({
+				collection: KEYCHAIN_AUDIT_COLLECTION,
+				columns: AUDIT_COLUMNS,
+				indexes: [{
+					name: "idx_keychain_audit_at",
+					columns: ["at"]
+				}]
+			});
+		}
 	}
 	async getSecrets(refs) {
 		const out = /* @__PURE__ */ new Map();
@@ -1477,6 +1494,21 @@ var KeychainRepository = class {
 		});
 	}
 	async appendAudit(row) {
+		const kind = this.records?.audit;
+		if (kind !== void 0) {
+			const { id, at, action, actor, ref, detail } = row;
+			await kind.put({
+				id,
+				at,
+				data: {
+					action,
+					actor,
+					ref,
+					detail
+				}
+			});
+			return;
+		}
 		await this.door.set({
 			collection: KEYCHAIN_AUDIT_COLLECTION,
 			key: row.id,
@@ -1484,6 +1516,20 @@ var KeychainRepository = class {
 		});
 	}
 	async listAudit(limit) {
+		const kind = this.records?.audit;
+		if (kind !== void 0) {
+			const rows = await (0, import_read_all_rows.readAllRows)(kind);
+			rows.sort((a, b) => (b.at ?? 0) - (a.at ?? 0));
+			const out = [];
+			for (const row of rows.slice(0, limit)) {
+				const parsed = toAuditRow(row.id, {
+					...row.data,
+					at: row.at ?? 0
+				});
+				if (parsed !== null) out.push(parsed);
+			}
+			return out;
+		}
 		const rows = await this.door.query({
 			collection: KEYCHAIN_AUDIT_COLLECTION,
 			filter: {
@@ -1503,6 +1549,22 @@ var KeychainRepository = class {
 	}
 	/** Drop audit rows older than the retention window, then beyond the row bound. */
 	async pruneAudit(nowMs) {
+		const kind = this.records?.audit;
+		if (kind !== void 0) {
+			const ageCutoff = nowMs - AUDIT_RETENTION_MS;
+			let deleted = 0;
+			for (const row of await (0, import_read_all_rows.readAllRows)(kind)) if ((row.at ?? 0) <= ageCutoff) {
+				await kind.delete(row.id);
+				deleted += 1;
+			}
+			const remaining = await (0, import_read_all_rows.readAllRows)(kind);
+			remaining.sort((a, b) => (b.at ?? 0) - (a.at ?? 0));
+			for (const row of remaining.slice(AUDIT_MAX_ROWS)) {
+				await kind.delete(row.id);
+				deleted += 1;
+			}
+			return deleted;
+		}
 		const aged = await this.door.deleteWhere({
 			collection: KEYCHAIN_AUDIT_COLLECTION,
 			filter: { whereBetween: { at: [0, nowMs - AUDIT_RETENTION_MS] } }
@@ -1604,6 +1666,24 @@ var KeychainRepository = class {
 		return cleared;
 	}
 	async putReset(record) {
+		const kind = this.records?.resets;
+		if (kind !== void 0) {
+			const { id, at, actor, lockedReason, archived, archivedCollection, archivedKeysCollection, clearedSettingsKeys, acknowledgedAt } = record;
+			await kind.put({
+				id,
+				at,
+				data: {
+					actor,
+					lockedReason,
+					archived,
+					archivedCollection,
+					archivedKeysCollection,
+					clearedSettingsKeys: [...clearedSettingsKeys],
+					acknowledgedAt
+				}
+			});
+			return;
+		}
 		await this.door.set({
 			collection: KEYCHAIN_RESETS_COLLECTION,
 			key: record.id,
@@ -1614,6 +1694,17 @@ var KeychainRepository = class {
 		});
 	}
 	async latestReset() {
+		const kind = this.records?.resets;
+		if (kind !== void 0) {
+			const rows = await (0, import_read_all_rows.readAllRows)(kind);
+			rows.sort((a, b) => (b.at ?? 0) - (a.at ?? 0));
+			const row = rows[0];
+			if (row === void 0) return null;
+			return toResetRecord(row.id, {
+				...row.data,
+				at: row.at ?? 0
+			});
+		}
 		const row = (await this.door.query({
 			collection: KEYCHAIN_RESETS_COLLECTION,
 			filter: {
@@ -1627,6 +1718,44 @@ var KeychainRepository = class {
 		return row === void 0 ? null : toResetRecord(row.id, row.data);
 	}
 };
+var KeychainAuditBodySchema = require_dist.KeychainAuditEntrySchema.omit({
+	id: true,
+	at: true
+});
+var KeychainResetBodySchema = require_dist.KeychainResetRecordSchema.omit({
+	id: true,
+	at: true
+});
+var _keychainRecordKinds = require_dist.defineRecordKinds({
+	audit: {
+		schema: KeychainAuditBodySchema,
+		class: "audit",
+		writeTrigger: "one row per write / delete / rotation / reveal / recovery download",
+		device: "none",
+		at: "required",
+		indexes: [{
+			name: "audit_at",
+			fields: ["at"]
+		}],
+		retention: {
+			owner: "keychain",
+			reason: "90 days and at most 20_000 rows, pruned at boot and daily"
+		},
+		adoptsFrom: KEYCHAIN_AUDIT_COLLECTION
+	},
+	resets: {
+		schema: KeychainResetBodySchema,
+		class: "config",
+		writeTrigger: "one row per keychain reset (System → Secrets, or the RESET_KEYCHAIN trigger file); acknowledgeReset stamps acknowledgedAt",
+		device: "none",
+		at: "required",
+		retention: { none: "a handful of rows over a hub life; they name archive tables a reset left behind" },
+		adoptsFrom: KEYCHAIN_RESETS_COLLECTION
+	}
+});
+var keychainRecordKinds = _keychainRecordKinds;
+_keychainRecordKinds.audit;
+_keychainRecordKinds.resets;
 //#endregion
 //#region src/builtins/keychain/keychain-usage.ts
 /**
@@ -1823,8 +1952,9 @@ var KeychainAddon = class extends require_dist.BaseAddon {
 			warn: (message, meta) => ctx.logger.warn(message, meta ? { meta } : void 0),
 			error: (message, meta) => ctx.logger.error(message, meta ? { meta } : void 0)
 		};
+		const records = ctx.records;
 		const service = new KeychainService({
-			repo: new KeychainRepository(door),
+			repo: new KeychainRepository(door, records !== void 0 && await require_phase6_declare_gate.resolvePhase6UseRecordsPathForHub(ctx, "keychain", keychainRecordKinds, ["keychain:audit", "keychain:resets"]) && records !== void 0 ? KeychainRepository.recordStoresOf(records) : void 0),
 			candidates: async () => {
 				return buildKeySourceCandidates({
 					config: readKeyConfig(await ctx.settings?.getSection("keychain") ?? {}),

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,8 @@
-import { $i as EventCategory, Bi as parseSecretRef, Fr as BaseAddon, Li as normalizeSecretOwner, R as KEYCHAIN_RESET_TRIGGER_ACTOR, Ti as formatSecretScope, dn as keychainCapability, un as keychainAdminCapability } from "../../dist-DERK-gP5.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-jxjSL8Ov.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants-BKX2QnIg.mjs";
+import { B as KeychainAuditEntrySchema, Di as defineRecordKinds, Rr as BaseAddon, V as KeychainResetRecordSchema, Wi as normalizeSecretOwner, hn as keychainCapability, ji as formatSecretScope, la as EventCategory, mn as keychainAdminCapability, qi as parseSecretRef, z as KEYCHAIN_RESET_TRIGGER_ACTOR } from "../../dist-BNunRyXT.mjs";
+import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-T8osSMos.mjs";
+import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-tkKOEitw.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-BMHCxRzb.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";
@@ -382,8 +384,11 @@ var NOT_INITIALIZED = {
 	state: "locked",
 	reason: "not-initialized"
 };
-/** The only refs `importSecret` accepts: a camera's restream tokens (D870 migration). */
-var IMPORTABLE_REF = /^secret:\/\/stream-broker\/device\/[0-9]+\/rtspTokens$/;
+/**
+* Refs `importSecret` accepts for operator migration (D870): restream tokens and
+* record-row secret refs (`recordSecretRef` — collection `records%3A<kind>`).
+*/
+var IMPORTABLE_REF = /^(?:secret:\/\/stream-broker\/device\/[0-9]+\/rtspTokens|secret:\/\/[^/]+\/row\/records%3A[^/]+\/[^/]+\/.+)$/;
 var KeychainService = class {
 	deps;
 	unlock = NOT_INITIALIZED;
@@ -779,11 +784,12 @@ var KeychainService = class {
 		return this.put(SYSTEM_SECRET_OWNER, ref, value, `user:${userId}`);
 	}
 	/**
-	* An operator tool stores a carried-over value at an addon's own ref (D870).
-	* Stored under the ref's owner, audited as the operator.
+	* An operator tool stores a carried-over value at a migration ref (D870):
+	* restream tokens or a `recordSecretRef` row field. Stored under the ref's
+	* owner, audited as the operator; never overwrites an existing value.
 	*/
 	async importSecret(userId, ref, value) {
-		if (!IMPORTABLE_REF.test(ref)) throw new Error(`keychain: "${ref}" is not an importable ref (restream tokens only)`);
+		if (!IMPORTABLE_REF.test(ref)) throw new Error(`keychain: "${ref}" is not an importable ref (restream tokens or record row secrets)`);
 		if ((await this.deps.repo.getSecrets([ref])).has(ref)) throw new Error(`keychain: a value is already stored at ${ref} - import refuses to overwrite`);
 		const parts = parseSecretRef(ref);
 		if (parts === null) throw new Error(`keychain: "${ref}" is not a secret ref`);
@@ -1062,6 +1068,7 @@ function errMsg(err) {
 EventCategory.KeychainChanged;
 //#endregion
 //#region src/builtins/keychain/keychain-store.ts
+var import_read_all_rows = require_read_all_rows();
 /**
 * @durable class=config owner=keychain
 *   write="`keychain.put` upserts one row per ref; `delete` removes it"
@@ -1367,8 +1374,16 @@ function toResetRecord(id, data) {
 var PAGE = 1e3;
 var KeychainRepository = class {
 	door;
-	constructor(door) {
+	records;
+	constructor(door, records) {
 		this.door = door;
+		this.records = records;
+	}
+	static recordStoresOf(records) {
+		return {
+			audit: records.kind(keychainRecordKinds.audit),
+			resets: records.kind(keychainRecordKinds.resets)
+		};
 	}
 	async init() {
 		await this.door.declareCollection({
@@ -1383,18 +1398,20 @@ var KeychainRepository = class {
 			collection: KEYCHAIN_KEYS_COLLECTION,
 			columns: KEY_COLUMNS
 		});
-		await this.door.declareCollection({
-			collection: KEYCHAIN_RESETS_COLLECTION,
-			columns: RESET_COLUMNS
-		});
-		await this.door.declareCollection({
-			collection: KEYCHAIN_AUDIT_COLLECTION,
-			columns: AUDIT_COLUMNS,
-			indexes: [{
-				name: "idx_keychain_audit_at",
-				columns: ["at"]
-			}]
-		});
+		if (this.records === void 0) {
+			await this.door.declareCollection({
+				collection: KEYCHAIN_RESETS_COLLECTION,
+				columns: RESET_COLUMNS
+			});
+			await this.door.declareCollection({
+				collection: KEYCHAIN_AUDIT_COLLECTION,
+				columns: AUDIT_COLUMNS,
+				indexes: [{
+					name: "idx_keychain_audit_at",
+					columns: ["at"]
+				}]
+			});
+		}
 	}
 	async getSecrets(refs) {
 		const out = /* @__PURE__ */ new Map();
@@ -1471,6 +1488,21 @@ var KeychainRepository = class {
 		});
 	}
 	async appendAudit(row) {
+		const kind = this.records?.audit;
+		if (kind !== void 0) {
+			const { id, at, action, actor, ref, detail } = row;
+			await kind.put({
+				id,
+				at,
+				data: {
+					action,
+					actor,
+					ref,
+					detail
+				}
+			});
+			return;
+		}
 		await this.door.set({
 			collection: KEYCHAIN_AUDIT_COLLECTION,
 			key: row.id,
@@ -1478,6 +1510,20 @@ var KeychainRepository = class {
 		});
 	}
 	async listAudit(limit) {
+		const kind = this.records?.audit;
+		if (kind !== void 0) {
+			const rows = await (0, import_read_all_rows.readAllRows)(kind);
+			rows.sort((a, b) => (b.at ?? 0) - (a.at ?? 0));
+			const out = [];
+			for (const row of rows.slice(0, limit)) {
+				const parsed = toAuditRow(row.id, {
+					...row.data,
+					at: row.at ?? 0
+				});
+				if (parsed !== null) out.push(parsed);
+			}
+			return out;
+		}
 		const rows = await this.door.query({
 			collection: KEYCHAIN_AUDIT_COLLECTION,
 			filter: {
@@ -1497,6 +1543,22 @@ var KeychainRepository = class {
 	}
 	/** Drop audit rows older than the retention window, then beyond the row bound. */
 	async pruneAudit(nowMs) {
+		const kind = this.records?.audit;
+		if (kind !== void 0) {
+			const ageCutoff = nowMs - AUDIT_RETENTION_MS;
+			let deleted = 0;
+			for (const row of await (0, import_read_all_rows.readAllRows)(kind)) if ((row.at ?? 0) <= ageCutoff) {
+				await kind.delete(row.id);
+				deleted += 1;
+			}
+			const remaining = await (0, import_read_all_rows.readAllRows)(kind);
+			remaining.sort((a, b) => (b.at ?? 0) - (a.at ?? 0));
+			for (const row of remaining.slice(AUDIT_MAX_ROWS)) {
+				await kind.delete(row.id);
+				deleted += 1;
+			}
+			return deleted;
+		}
 		const aged = await this.door.deleteWhere({
 			collection: KEYCHAIN_AUDIT_COLLECTION,
 			filter: { whereBetween: { at: [0, nowMs - AUDIT_RETENTION_MS] } }
@@ -1598,6 +1660,24 @@ var KeychainRepository = class {
 		return cleared;
 	}
 	async putReset(record) {
+		const kind = this.records?.resets;
+		if (kind !== void 0) {
+			const { id, at, actor, lockedReason, archived, archivedCollection, archivedKeysCollection, clearedSettingsKeys, acknowledgedAt } = record;
+			await kind.put({
+				id,
+				at,
+				data: {
+					actor,
+					lockedReason,
+					archived,
+					archivedCollection,
+					archivedKeysCollection,
+					clearedSettingsKeys: [...clearedSettingsKeys],
+					acknowledgedAt
+				}
+			});
+			return;
+		}
 		await this.door.set({
 			collection: KEYCHAIN_RESETS_COLLECTION,
 			key: record.id,
@@ -1608,6 +1688,17 @@ var KeychainRepository = class {
 		});
 	}
 	async latestReset() {
+		const kind = this.records?.resets;
+		if (kind !== void 0) {
+			const rows = await (0, import_read_all_rows.readAllRows)(kind);
+			rows.sort((a, b) => (b.at ?? 0) - (a.at ?? 0));
+			const row = rows[0];
+			if (row === void 0) return null;
+			return toResetRecord(row.id, {
+				...row.data,
+				at: row.at ?? 0
+			});
+		}
 		const row = (await this.door.query({
 			collection: KEYCHAIN_RESETS_COLLECTION,
 			filter: {
@@ -1621,6 +1712,44 @@ var KeychainRepository = class {
 		return row === void 0 ? null : toResetRecord(row.id, row.data);
 	}
 };
+var KeychainAuditBodySchema = KeychainAuditEntrySchema.omit({
+	id: true,
+	at: true
+});
+var KeychainResetBodySchema = KeychainResetRecordSchema.omit({
+	id: true,
+	at: true
+});
+var _keychainRecordKinds = defineRecordKinds({
+	audit: {
+		schema: KeychainAuditBodySchema,
+		class: "audit",
+		writeTrigger: "one row per write / delete / rotation / reveal / recovery download",
+		device: "none",
+		at: "required",
+		indexes: [{
+			name: "audit_at",
+			fields: ["at"]
+		}],
+		retention: {
+			owner: "keychain",
+			reason: "90 days and at most 20_000 rows, pruned at boot and daily"
+		},
+		adoptsFrom: KEYCHAIN_AUDIT_COLLECTION
+	},
+	resets: {
+		schema: KeychainResetBodySchema,
+		class: "config",
+		writeTrigger: "one row per keychain reset (System → Secrets, or the RESET_KEYCHAIN trigger file); acknowledgeReset stamps acknowledgedAt",
+		device: "none",
+		at: "required",
+		retention: { none: "a handful of rows over a hub life; they name archive tables a reset left behind" },
+		adoptsFrom: KEYCHAIN_RESETS_COLLECTION
+	}
+});
+var keychainRecordKinds = _keychainRecordKinds;
+_keychainRecordKinds.audit;
+_keychainRecordKinds.resets;
 //#endregion
 //#region src/builtins/keychain/keychain-usage.ts
 /**
@@ -1817,8 +1946,9 @@ var KeychainAddon = class extends BaseAddon {
 			warn: (message, meta) => ctx.logger.warn(message, meta ? { meta } : void 0),
 			error: (message, meta) => ctx.logger.error(message, meta ? { meta } : void 0)
 		};
+		const records = ctx.records;
 		const service = new KeychainService({
-			repo: new KeychainRepository(door),
+			repo: new KeychainRepository(door, records !== void 0 && await resolvePhase6UseRecordsPathForHub(ctx, "keychain", keychainRecordKinds, ["keychain:audit", "keychain:resets"]) && records !== void 0 ? KeychainRepository.recordStoresOf(records) : void 0),
 			candidates: async () => {
 				return buildKeySourceCandidates({
 					config: readKeyConfig(await ctx.settings?.getSection("keychain") ?? {}),

package/dist/builtins/keychain/keychain-service.d.ts

@@ -97,8 +97,9 @@ export declare class KeychainService {
 		version: number;
 	}>;
 	/**
-	* An operator tool stores a carried-over value at an addon's own ref (D870).
-	* Stored under the ref's owner, audited as the operator.
+	* An operator tool stores a carried-over value at a migration ref (D870):
+	* restream tokens or a `recordSecretRef` row field. Stored under the ref's
+	* owner, audited as the operator; never overwrites an existing value.
 	*/
 	importSecret(userId: string, ref: string, value: string): Promise<{
 		ref: string;

package/dist/builtins/keychain/keychain-store.d.ts

@@ -7,7 +7,9 @@
 * The repository takes a narrow door port rather than the whole tRPC client so
 * the service can be exercised against an in-memory door in tests.
 */
-import type { ISettingsStoreProvider, KeychainAuditAction, KeychainResetRecord } from "@camstack/types";
+import type { ISettingsStoreProvider, KeychainAuditAction, KeychainResetRecord, RecordKindHandle, RecordsAccess } from "@camstack/types";
+import { type KeychainAuditBodySchema, type KeychainResetBodySchema } from "./record-kinds.js";
+import type { z } from "zod";
 /**
 * @durable class=config owner=keychain
 *   write="`keychain.put` upserts one row per ref; `delete` removes it"
@@ -74,9 +76,17 @@ export interface KeychainAuditRow {
 }
 /** The subset of the settings door the repository uses. */
 export type KeychainDoor = Pick<ISettingsStoreProvider, "declareCollection" | "get" | "set" | "query" | "delete" | "deleteWhere">;
+type KeychainAuditBody = z.infer<typeof KeychainAuditBodySchema>;
+type KeychainResetBody = z.infer<typeof KeychainResetBodySchema>;
+export interface KeychainRecordStores {
+	readonly audit: RecordKindHandle<KeychainAuditBody>;
+	readonly resets: RecordKindHandle<KeychainResetBody>;
+}
 export declare class KeychainRepository {
 	private readonly door;
-	constructor(door: KeychainDoor);
+	private readonly records?;
+	constructor(door: KeychainDoor, records?: KeychainRecordStores);
+	static recordStoresOf(records: Pick<RecordsAccess, "kind">): KeychainRecordStores;
 	init(): Promise<void>;
 	getSecrets(refs: readonly string[]): Promise<ReadonlyMap<string, KeychainSecretRow>>;
 	/** Every row, paged by primary key. */
@@ -112,3 +122,4 @@ export declare class KeychainRepository {
 	putReset(record: KeychainResetRecord): Promise<void>;
 	latestReset(): Promise<KeychainResetRecord | null>;
 }
+export {};

package/dist/builtins/keychain/record-kinds.d.ts

@@ -0,0 +1,16 @@
+/**
+* Record kinds owned by keychain (phase 4 — audit and resets only).
+*/
+import { KeychainAuditEntrySchema, KeychainResetRecordSchema, type DefinedRecordKind } from "@camstack/types";
+import { z } from "zod";
+export type KeychainAuditBody = Omit<z.infer<typeof KeychainAuditEntrySchema>, "id" | "at">;
+export declare const KeychainAuditBodySchema: z.ZodType<KeychainAuditBody>;
+export type KeychainResetBody = Omit<z.infer<typeof KeychainResetRecordSchema>, "id" | "at">;
+export declare const KeychainResetBodySchema: z.ZodType<KeychainResetBody>;
+export type KeychainRecordKindsMap = {
+	readonly audit: DefinedRecordKind<z.ZodType<KeychainAuditBody>>;
+	readonly resets: DefinedRecordKind<z.ZodType<KeychainResetBody>>;
+};
+export declare const keychainRecordKinds: KeychainRecordKindsMap;
+export declare const keychainAuditRecordKind: DefinedRecordKind<z.ZodType<KeychainAuditBody>>;
+export declare const keychainResetsRecordKind: DefinedRecordKind<z.ZodType<KeychainResetBody>>;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D1vECb_6.js");
+const require_dist = require("../../dist-DgOG8flk.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { $i as EventCategory, Fr as BaseAddon, G as RECORDING_SOURCE_CAMSTACK_ADDON, K as RecordingStatusSchema, Pr as errMsg, yi as createEvent } from "../../dist-DERK-gP5.mjs";
+import { Ci as createEvent, J as RECORDING_SOURCE_CAMSTACK_ADDON, Lr as errMsg, Rr as BaseAddon, Y as RecordingStatusSchema, la as EventCategory } from "../../dist-BNunRyXT.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/auth-schema.d.ts

@@ -103,4 +103,6 @@ export declare const USER_EXTERNAL_IDENTITIES_COLLECTION = "user_external_identi
 * managers. Idempotent — `declareCollection` is a no-op when the
 * collection has already been declared (same shape).
 */
-export declare function declareAuthSchema(store: SettingsStoreClient): Promise<void>;
+export declare function declareAuthSchema(store: SettingsStoreClient, options?: {
+	readonly skipCollections?: readonly string[];
+}): Promise<void>;