@camstack/system 1.2.444 → 1.2.445

package/dist/auth/admin-token-manager.d.ts

@@ -1,4 +1,5 @@
-import type { CollectionColumn, SettingsStoreClient } from "@camstack/types";
+import type { CollectionColumn, RecordKindHandle, SettingsStoreClient } from "@camstack/types";
+import type { AdminTokenBody } from "../builtins/local-auth/record-kinds.js";
 /**
 * @durable class=config owner=local-auth
 *   write="an admin creates a token (after re-authentication); `lastUsedAt` is
@@ -19,10 +20,15 @@ export interface AdminTokenRecord {
 	readonly lastUsedAt: number | null;
 	readonly revokedAt: number | null;
 }
+export interface AdminTokenRecordsDeps {
+	readonly adminTokensKind: RecordKindHandle<AdminTokenBody>;
+	readonly store?: SettingsStoreClient;
+}
 export declare class AdminTokenManager {
-	private readonly store;
 	private readonly now;
-	constructor(store: SettingsStoreClient, now?: () => number);
+	private readonly kind;
+	private readonly store;
+	constructor(deps: SettingsStoreClient | AdminTokenRecordsDeps, now?: () => number);
 	/** Mint a token for `createdBy`. Refuses an expiry in the past or past 90 days. */
 	create(input: {
 		readonly createdBy: string;

package/dist/auth/api-key-manager.d.ts

@@ -1,11 +1,17 @@
-import type { ApiKeyRecord, SettingsStoreClient } from "@camstack/types";
+import type { ApiKeyRecord, RecordKindHandle, SettingsStoreClient } from "@camstack/types";
+import type { ApiKeyBody } from "../builtins/local-auth/record-kinds.js";
 export type { ApiKeyRecord };
 export interface ApiKeyStorageAccess {
 	getStore(): SettingsStoreClient;
 }
+export interface ApiKeyRecordsDeps {
+	readonly apiKeysKind: RecordKindHandle<ApiKeyBody>;
+	readonly legacyStore?: SettingsStoreClient;
+}
 export declare class ApiKeyManager {
-	private readonly storageAccess;
-	constructor(storageAccess: ApiKeyStorageAccess);
+	private readonly kind;
+	private readonly legacyStore;
+	constructor(deps: ApiKeyStorageAccess | ApiKeyRecordsDeps);
 	private get store();
 	listAll(): Promise<Omit<ApiKeyRecord, "tokenHash">[]>;
 	revoke(id: string): Promise<void>;

package/dist/auth/auth-audit-log.d.ts

@@ -1,4 +1,5 @@
-import type { CollectionColumn, IScopedLogger, SettingsStoreClient } from "@camstack/types";
+import type { CollectionColumn, IScopedLogger, RecordKindHandle, SettingsStoreClient } from "@camstack/types";
+import type { AuthAuditBody } from "../builtins/local-auth/record-kinds.js";
 /**
 * @durable class=ledger owner=local-auth
 *   write="one row per audited auth event: a second factor skipped from a trusted
@@ -22,11 +23,16 @@ export interface AuthAuditRecord extends AuthAuditEvent {
 	readonly id: string;
 	readonly at: number;
 }
+export interface AuthAuditRecordsDeps {
+	readonly authAuditKind: RecordKindHandle<AuthAuditBody>;
+	readonly legacyStore?: SettingsStoreClient;
+}
 export declare class AuthAuditLog {
-	private readonly store;
 	private readonly logger;
 	private readonly now;
-	constructor(store: SettingsStoreClient, logger?: IScopedLogger | null, now?: () => number);
+	private readonly kind;
+	private readonly store;
+	constructor(deps: SettingsStoreClient | AuthAuditRecordsDeps, logger?: IScopedLogger | null, now?: () => number);
 	/** Record `event`. Never throws. */
 	record(event: AuthAuditEvent): Promise<void>;
 	/** Newest first, at most `limit` (≤ 500), optionally one user's. */

package/dist/auth/device-credential-manager.d.ts

@@ -1,4 +1,5 @@
-import type { CollectionColumn, IScopedLogger, SettingsStoreClient } from "@camstack/types";
+import type { CollectionColumn, IScopedLogger, RecordKindHandle, SettingsStoreClient } from "@camstack/types";
+import type { DeviceCredentialBody } from "../builtins/local-auth/record-kinds.js";
 import { type DeviceCredential, type DevicePlatform, type DeviceSignaturePurpose } from "@camstack/types";
 import type { DeviceCaStore } from "./device-ca-store.js";
 /**
@@ -70,6 +71,7 @@ export interface DeviceCredentialManagerDeps {
 	} | null>;
 	/** Hub-wide switch for `enrollSelf`; absent = allowed. */
 	readonly selfEnrollmentAllowed: () => Promise<boolean>;
+	readonly deviceCredentialsKind?: RecordKindHandle<DeviceCredentialBody> | null;
 	readonly now?: () => number;
 	readonly logger?: IScopedLogger;
 }
@@ -148,6 +150,8 @@ export declare class DeviceCredentialManager {
 	toSummary(record: DeviceCredentialRecord, username: string | null): DeviceCredential;
 	/** Delete rows revoked or expired more than 90 days ago. */
 	reap(): Promise<number>;
+	private persistRecord;
+	private deleteRecord;
 	private save;
 	private refuse;
 	private prune;

package/dist/auth/external-identity-manager.d.ts

@@ -1,20 +1,11 @@
 /**
 * External sign-in identities linked to local users (D782).
-*
-* An OIDC login names an identity `(provider, subject)` — the provider
-* instance's login-method id (`auth-oidc/authentik`) and the IdP's `sub`. It
-* signs in ONLY the user its owner explicitly linked it to: no
-* auto-provisioning, no email matching, no group mapping.
-*
-* The row id is the identity itself (`JSON.stringify([provider, subject])`),
-* so the collection's primary key is what makes "one identity → one user" a
-* storage invariant rather than a check that a race could slip past.
 */
-import type { SettingsStoreClient } from "@camstack/types";
+import type { RecordKindHandle, SettingsStoreClient } from "@camstack/types";
+import type { ExternalIdentityBody } from "../builtins/local-auth/record-kinds.js";
 export interface ExternalIdentityRecord {
 	readonly provider: string;
 	readonly subject: string;
-	/** Verified `iss` the identity was linked under. */
 	readonly issuer: string;
 	readonly userId: string;
 	readonly label?: string;
@@ -24,32 +15,28 @@ export interface ExternalIdentityKey {
 	readonly provider: string;
 	readonly subject: string;
 }
-/** The identity is already linked to a different user. */
 export declare class ExternalIdentityConflictError extends Error {
 	constructor();
 }
+export interface ExternalIdentityRecordsDeps {
+	readonly identitiesKind: RecordKindHandle<ExternalIdentityBody>;
+	readonly legacyStore?: SettingsStoreClient;
+}
 export declare class ExternalIdentityManager {
+	private readonly kind;
 	private readonly store;
-	constructor(store: SettingsStoreClient);
+	constructor(deps: SettingsStoreClient | ExternalIdentityRecordsDeps);
 	private find;
-	/** The link of `(provider, subject)`, or `null`. */
 	findLink(provider: string, subject: string): Promise<ExternalIdentityRecord | null>;
-	/** The user `(provider, subject)` is linked to, or `null`. */
 	findUser(provider: string, subject: string): Promise<string | null>;
 	listForUser(userId: string): Promise<readonly ExternalIdentityRecord[]>;
-	/**
-	* Link `(provider, subject)` to `userId`. Idempotent for the same user;
-	* {@link ExternalIdentityConflictError} when another user holds it.
-	*/
 	link(input: ExternalIdentityKey & {
 		userId: string;
 		issuer: string;
 		label?: string;
 	}): Promise<void>;
-	/** Remove one link of `userId`; `false` when that user did not hold it. */
 	unlink(input: ExternalIdentityKey & {
 		userId: string;
 	}): Promise<boolean>;
-	/** Delete every link of a user being deleted. Returns how many were removed. */
 	removeAllForUser(userId: string): Promise<number>;
 }

package/dist/auth/login-session-manager.d.ts

@@ -1,4 +1,5 @@
-import type { CollectionColumn, IScopedLogger, SettingsStoreClient } from "@camstack/types";
+import type { CollectionColumn, IScopedLogger, RecordKindHandle, SettingsStoreClient } from "@camstack/types";
+import type { LoginSessionBody, LoginSessionCutoffBody } from "../builtins/local-auth/record-kinds.js";
 /**
 * @durable class=ledger owner=local-auth
 *   write="one row per login (password, passkey, SSO, handoff, session exchange);
@@ -73,15 +74,22 @@ export interface LoginSessionManagerOptions {
 	readonly now?: () => number;
 	readonly logger?: IScopedLogger;
 }
+export interface LoginSessionRecordsDeps {
+	readonly sessionsKind: RecordKindHandle<LoginSessionBody>;
+	readonly cutoffsKind: RecordKindHandle<LoginSessionCutoffBody>;
+	readonly legacyStore?: SettingsStoreClient;
+}
 export declare class LoginSessionManager {
-	private readonly store;
 	private readonly sessions;
 	/** refresh hash (current or previous) → session id */
 	private readonly byRefreshHash;
 	private readonly cutoffs;
 	private readonly now;
 	private readonly logger;
-	constructor(store: SettingsStoreClient, options?: LoginSessionManagerOptions);
+	private readonly sessionsKind;
+	private readonly cutoffsKind;
+	private readonly store;
+	constructor(deps: SettingsStoreClient | LoginSessionRecordsDeps, options?: LoginSessionManagerOptions);
 	/** Load every row into the mirror. Call once at init, before serving. */
 	load(): Promise<void>;
 	create(input: CreateLoginSessionInput): Promise<{

package/dist/auth/scoped-token-manager.d.ts

@@ -1,69 +1,25 @@
-import type { ScopedToken, TokenScope, SettingsStoreClient } from "@camstack/types";
+import type { RecordKindHandle, ScopedToken, TokenScope, SettingsStoreClient } from "@camstack/types";
+import type { ScopedTokenBody } from "../builtins/local-auth/record-kinds.js";
+export interface ScopedTokenRecordsDeps {
+	readonly scopedTokensKind: RecordKindHandle<ScopedTokenBody>;
+	readonly legacyStore?: SettingsStoreClient;
+}
 /**
 * Manages scoped API tokens with restricted addon/route/capability access.
 */
 export declare class ScopedTokenManager {
+	private readonly kind;
 	private readonly store;
-	constructor(store: SettingsStoreClient);
+	constructor(deps: SettingsStoreClient | ScopedTokenRecordsDeps);
 	create(userId: string, name: string, scopes: TokenScope[], expiresAt?: number): Promise<{
 		token: string;
 		record: ScopedToken;
 	}>;
 	validate(rawToken: string): Promise<ScopedToken | null>;
-	/**
-	* Coarse scope match — checks only `addonId` / `capability` (no
-	* `route-prefix` after the caps-only migration). Used by addon-route
-	* HTTP handlers that need a quick allow/deny before the per-method
-	* `access` check kicks in via `METHOD_ACCESS_MAP` in
-	* `protectedProcedure`.
-	*/
 	matchesScope(token: ScopedToken, addonId?: string, capability?: string): boolean;
-	/**
-	* Delete the token row. `true` when a row was removed; `false` when the id
-	* was already gone (unknown or previously revoked).
-	*/
 	revoke(tokenId: string): Promise<boolean>;
 	listForUser(userId: string): Promise<ScopedToken[]>;
 	updateLastUsed(tokenId: string): Promise<void>;
-	/**
-	* Delete tokens whose expiry has passed.
-	*
-	* These were never usable — {@link validate} already rejects an expired
-	* token — so this is hygiene rather than a hole being closed, and it is
-	* worth being precise about what it actually buys:
-	*
-	*  - `listForUser` returns rows with no expiry filter, so the operator's
-	*    token list showed dead tokens as if they were live. There was no way to
-	*    tell from the UI which ones still worked.
-	*  - a database that outlives its tokens keeps their hashes indefinitely.
-	*    27 rows on the live hub had been unusable for months.
-	*
-	* A token with NO expiry (`expiresAt` null/absent) is a deliberate
-	* never-expires token and MUST survive: `BETWEEN` never matches NULL in
-	* SQL, which is the property this depends on and the spec pins against a
-	* real SQLite.
-	*
-	* The bound is `nowMs - 1` because {@link validate} treats `now ===
-	* expiresAt` as still valid; reaping at exactly the expiry instant would
-	* delete a token that the same millisecond still accepts.
-	*
-	* Returns how many rows went.
-	*/
 	reapExpired(nowMs?: number): Promise<number>;
-	/**
-	* One-shot migration: drop tokens whose owner can't be resolved.
-	*
-	* Two ways a token can end up orphan:
-	*   • Pre-fix tokens minted via the CLI were owned by the literal
-	*     string `"system"` (provider hardcode, fixed 2026-05-11).
-	*   • A user gets deleted but their tokens were not cascade-revoked.
-	*
-	* Either way the UI's `listScopedTokens({ userId: u.id })` never
-	* returns them, so the operator can't revoke through the normal flow.
-	* We sweep both classes by passing the live user-id set in.
-	*
-	* Idempotent: if no orphans exist the method is a no-op.
-	* Returns the number of tokens removed.
-	*/
 	cleanupOrphans(validUserIds: ReadonlySet<string>): Promise<number>;
 }

package/dist/auth/totp-manager.d.ts

@@ -1,4 +1,5 @@
-import { type RawSecretMigrationReport, type IScopedLogger, type SecretsAccess, type SettingsStoreClient } from "@camstack/types";
+import { type RawSecretMigrationReport, type IScopedLogger, type RecordKindHandle, type SecretsAccess, type SettingsStoreClient } from "@camstack/types";
+import type { UserTotpBody } from "../builtins/local-auth/record-kinds.js";
 /**
 * The seed cannot be used right now. The message is what a not-yet-logged-in
 * caller sees, so it is generic; `reason` (keychain detail) is for the server log only.
@@ -19,16 +20,21 @@ export interface TotpStatus {
 	readonly enabled: boolean;
 	readonly confirmedAt: number | null;
 }
+export interface TotpRecordsDeps {
+	readonly userTotpKind: RecordKindHandle<UserTotpBody>;
+	readonly legacyStore?: SettingsStoreClient;
+}
 export declare class TotpManager {
-	private readonly store;
 	/** ±N steps of clock-skew tolerance, expressed in seconds for otplib v13's
 	*  per-call `epochTolerance`. Default window 1 = ±30 s. */
 	private readonly epochTolerance;
 	private readonly secrets;
 	private readonly logger;
+	private readonly userTotpKind;
+	private readonly store;
 	/** Per-user queue: setup / confirm / disable / migration never interleave on one user. */
 	private readonly chains;
-	constructor(store: SettingsStoreClient, opts?: {
+	constructor(deps: SettingsStoreClient | TotpRecordsDeps, opts?: {
 		/** ±N 30-second windows tolerated. Default 1 = ±30 s clock skew. */
 		readonly window?: number;
 		/** Keychain handle for owner `system`; `null` = no keychain door (setup refuses). */
@@ -96,4 +102,6 @@ export declare class TotpManager {
 	private moveRow;
 	private readAll;
 	private find;
+	private writeRow;
+	private removeRow;
 }

package/dist/auth/user-manager.d.ts

@@ -1,5 +1,6 @@
-import type { SettingsStoreClient, TokenScope, UserRecord } from "@camstack/types";
+import type { RecordKindHandle, SettingsStoreClient, TokenScope, UserRecord } from "@camstack/types";
 import type { AuthManager } from "./auth-manager.js";
+import type { UserBody } from "../builtins/local-auth/record-kinds.js";
 export type { UserRecord };
 interface CreateUserInput {
 	username: string;
@@ -39,10 +40,17 @@ export type AdminSeedOutcome = {
 export interface UserStorageAccess {
 	getStore(): SettingsStoreClient;
 }
+export interface UserRecordsDeps {
+	readonly usersKind: RecordKindHandle<UserBody>;
+	/** Optional legacy store for tests that assert no declareCollection. */
+	readonly legacyStore?: SettingsStoreClient;
+}
 export declare class UserManager {
 	private readonly storageAccess;
 	private readonly auth;
-	constructor(storageAccess: UserStorageAccess, auth: AuthManager);
+	private readonly usersKind;
+	private readonly legacyStore;
+	constructor(storageAccess: UserStorageAccess | UserRecordsDeps, auth: AuthManager);
 	private get store();
 	create(input: CreateUserInput): Promise<UserRecord>;
 	findByUsername(username: string): Promise<UserRecord | null>;
@@ -55,22 +63,7 @@ export declare class UserManager {
 	/**
 	* Seed {@link FIRST_BOOT_ADMIN_USERNAME} / {@link FIRST_BOOT_ADMIN_PASSWORD}
 	* — on FIRST boot only, i.e. when no admin account exists.
-	*
-	* The seed is never an authority. Once any admin exists, this never writes a
-	* password: the operator's own change in the admin UI is the truth from then
-	* on (D728). This method once compared the stored hash with a configured
-	* password on every boot and rewrote it when they differed, so a password
-	* changed in the UI went back at the next restart.
-	*
-	* `resetPassword: true` is the one explicit exception — the operator's
-	* one-shot recovery request (`RESET_ADMIN_PASSWORD`, see
-	* `admin-account-boot.ts`): the `admin` user's password goes back to
-	* `changeme`, and the next sign-in forces a change again.
 	*/
 	ensureAdminExists(options?: EnsureAdminOptions): Promise<AdminSeedOutcome>;
-	/**
-	* Does `username` still sign in with `password`? A hash comparison — the
-	* password is never logged or stored. `false` when the user does not exist.
-	*/
 	hasPassword(username: string, password: string): Promise<boolean>;
 }

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D1vECb_6.js");
+const require_dist = require("../../dist-DgOG8flk.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { $i as EventCategory, Fr as BaseAddon, Pr as errMsg, at as addonPagesCapability } from "../../dist-DERK-gP5.mjs";
+import { Lr as errMsg, Rr as BaseAddon, la as EventCategory, lt as addonPagesCapability } from "../../dist-BNunRyXT.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D1vECb_6.js");
+const require_dist = require("../../dist-DgOG8flk.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { $i as EventCategory, Fr as BaseAddon, Pr as errMsg, st as addonWidgetsCapability } from "../../dist-DERK-gP5.mjs";
+import { Lr as errMsg, Rr as BaseAddon, dt as addonWidgetsCapability, la as EventCategory } from "../../dist-BNunRyXT.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alert-store.d.ts

@@ -0,0 +1,32 @@
+/**
+* Alert persistence over the `alerts` record kind (phase 4) or legacy collection.
+*/
+import type { Alert, RecordKindHandle, RecordsAccess, SettingsStoreClient } from "@camstack/types";
+import { type AlertBody } from "./record-kinds.js";
+export { ALERTS_COLLECTION } from "./record-kinds.js";
+export type AlertRecord = {
+	readonly id: string;
+	readonly data: Record<string, unknown>;
+};
+export declare class AlertStore {
+	private readonly kind;
+	private readonly legacyStore;
+	constructor(kind: RecordKindHandle<AlertBody> | null, legacyStore: SettingsStoreClient | null);
+	static of(records: Pick<RecordsAccess, "kind">): AlertStore;
+	static legacy(store: SettingsStoreClient): AlertStore;
+	private legacyRows;
+	list(filter?: {
+		unreadOnly?: boolean;
+		limit?: number;
+	}): Promise<readonly AlertRecord[]>;
+	countUnread(): Promise<number>;
+	countAll(): Promise<number>;
+	getData(id: string): Promise<Record<string, unknown> | null>;
+	mergeUpdate(id: string, patch: Record<string, unknown>): Promise<void>;
+	persist(alert: Alert): Promise<void>;
+	putRaw(id: string, data: Record<string, unknown>): Promise<void>;
+	delete(id: string): Promise<void>;
+	listAllByCreatedAtAsc(): Promise<readonly AlertRecord[]>;
+	listRecent(limit: number): Promise<readonly AlertRecord[]>;
+	findWhereDataField(field: string, value: unknown): Promise<readonly AlertRecord[]>;
+}

package/dist/builtins/alerts/alerts.addon.d.ts

@@ -5,10 +5,15 @@ interface AlertCenterConfig {
 	readonly retentionDays: number;
 	/** Push critical system alerts (runner failed/refused, runners degraded) straight to the notifiers (D877). */
 	readonly criticalPushEnabled: boolean;
-	/** Comma-separated notifier target ids for that push; empty = every enabled operator-level target. */
-	readonly criticalPushTargetIds: string;
+	/**
+	* Notifier target ids for that push (`notification-target-multiselect`).
+	* Empty = every enabled operator-level (shared) target. A legacy CSV string
+	* still stored in the addon store is accepted at read time.
+	*/
+	readonly criticalPushTargetIds: readonly string[];
 }
 export declare class AlertCenterAddon extends BaseAddon<AlertCenterConfig> {
+	private alertStore;
 	private unsubscribers;
 	/** How long a burst of critical findings is gathered into one digest push. */
 	private readonly pushCoalesceMs;
@@ -50,6 +55,8 @@ export declare class AlertCenterAddon extends BaseAddon<AlertCenterConfig> {
 	private readonly pushQueue;
 	private pushTimer;
 	private pushPolicy;
+	/** Rewrite a legacy CSV `criticalPushTargetIds` string into `string[]`. */
+	private migrateCriticalPushTargetIds;
 	private pushPorts;
 	/**
 	* Queue a critical finding for the next digest. A burst (every runner of a boot)