@camstack/system 1.2.447 → 1.2.449

package/dist/builtins/device-history/store/series-registry.d.ts

@@ -0,0 +1,39 @@
+/**
+* The in-memory index of metrics and series, loaded once and kept in step with
+* the store. Series ids are assigned by the engine (`INTEGER PRIMARY KEY`, a
+* rowid alias, D473); creating one is single-flight per identity so two
+* concurrent first points of a series never insert it twice.
+*/
+import type { DeviceHistorySubject } from "@camstack/types";
+import { HistoryStore, type MetricRecord, type SeriesRecord } from "./history-store.js";
+export declare function subjectIdOf(subject: DeviceHistorySubject): string;
+export declare function deviceIdOf(subject: DeviceHistorySubject): number | null;
+export declare function identityOf(key: string, subjectId: string, scope: string): string;
+export declare class SeriesRegistry {
+	private readonly store;
+	private readonly metrics;
+	private readonly byIdentity;
+	private readonly byId;
+	private readonly inflight;
+	private readonly removeListeners;
+	constructor(store: HistoryStore);
+	load(): Promise<void>;
+	private index;
+	metric(key: string): MetricRecord | undefined;
+	allMetrics(): readonly MetricRecord[];
+	/** Persist and remember a metric; idempotent. */
+	declareMetric(metric: MetricRecord): Promise<void>;
+	find(key: string, subjectId: string, scope: string): SeriesRecord | undefined;
+	byIdOf(id: number): SeriesRecord | undefined;
+	all(): readonly SeriesRecord[];
+	forSubject(subjectId: string): readonly SeriesRecord[];
+	forKeyAndSubject(key: string, subjectId: string): readonly SeriesRecord[];
+	/** The series, created on first sight. `ts` stamps `first_ts`/`last_ts` of a new one. */
+	ensure(key: string, subject: DeviceHistorySubject, scope: string, ts: number): Promise<SeriesRecord>;
+	private create;
+	/** Remember a widened span (the store write is the caller's). */
+	noteSpan(id: number, firstTs: number, lastTs: number): void;
+	remove(id: number): void;
+	/** Per-series state elsewhere (last recorded value, dirty marks, rate limits) is dropped through this. */
+	onRemove(listener: (series: SeriesRecord) => void): void;
+}

package/dist/builtins/device-history/time/bucket-time.d.ts

@@ -0,0 +1,25 @@
+/**
+* Bucket arithmetic for the three rollup tiers (D850, plan §4/§5.5).
+*
+* 5m and 1h buckets are aligned to UTC; a 1d bucket starts at HUB-LOCAL
+* midnight, so a day is 23, 24 or 25 hours long across a DST change (operator
+* answer Q4). Pure: the zone is the process zone (`TZ`), nothing is read from
+* the environment here.
+*/
+export declare const FIVE_MINUTES_MS: number;
+export declare const HOUR_MS: number;
+export declare const DAY_MS: number;
+export type RollupTier = "5m" | "1h" | "1d";
+export declare function floorTo(ts: number, widthMs: number): number;
+/** Hub-local midnight at or before `ts`. */
+export declare function startOfLocalDay(ts: number): number;
+/** The local midnight following the local midnight `dayStart`. */
+export declare function nextLocalDayStart(dayStart: number): number;
+/** Start of the `tier` bucket containing `ts`. */
+export declare function bucketStartOf(tier: RollupTier, ts: number): number;
+/** Exclusive end of the `tier` bucket that starts at `start`. */
+export declare function bucketEndOf(tier: RollupTier, start: number): number;
+/** The tier a bucket of `tier` is built from. */
+export declare function childTierOf(tier: "1h" | "1d"): RollupTier;
+/** Quiet time after a bucket closes before it is rolled up (late writers). */
+export declare const ROLLUP_GRACE_MS: Readonly<Record<RollupTier, number>>;

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as STREAM_PROFILE_META, $i as resolveSecretMarkers, C as DAY_NAMES, Ct as canonicalIconKey, Di as defineRecordKinds, F as FieldClaimModeSchema, Fi as isKeychainStoredField, Fr as DeviceRole, G as MINUTES_PER_DAY, Gt as deviceStatusCapability, Ht as deviceExtensionCapability, I as FieldClaimSchema, Ii as isSecretClear, Ir as DeviceType, Jt as enumerateSchemaFields, Li as isSecretMarker, Lr as errMsg, M as DeviceStatusSchema, N as DeviceTombstoneSchema, Ni as isDeviceConfigCap, Nt as createDeviceExtensionProvider, Pn as parseStreamParamsFormPatch, Pr as DeviceFeature, Qn as runtimeStatePolicyFor, Ri as isSecretMarkerLike, Rr as BaseAddon, Rt as defineExtensionSlotProvider, Si as collectZodSecretPaths, Ut as deviceManagerCapability, Wt as deviceStateCapability, Zt as expandContainer, aa as toSecretFieldView, bn as locationIconKey, bt as buildStreamParamsConfigSchema, c as CAMERA_SWITCH_ORDER, gn as legacyAutoLinkIds, ir as siteZoneKey, jn as normalizeUnit, la as EventCategory, oa as transformSecretWrite, pi as WELL_KNOWN_TAB_MAP, qt as enumerateItemArrayFields, r as ALL_CAPABILITY_DEFINITIONS, ra as sleep$1, rn as formatMinutes, sa as userError, ta as secretTreeFromPaths, u as CAP_NAMES_WITH_STATUS, ui as SECRET_CLEAR } from "../../dist-CkZIrsAP.mjs";
+import { Bi as isKeychainStoredField, Br as DeviceType, Bt as defineExtensionSlotProvider, C as DAY_NAMES, Di as collectZodSecretPaths, F as FieldClaimModeSchema, Fn as normalizeUnit, Ft as createDeviceExtensionProvider, Hi as isSecretMarker, Hr as BaseAddon, I as FieldClaimSchema, Jt as deviceStateCapability, K as MINUTES_PER_DAY, Kt as deviceManagerCapability, M as DeviceStatusSchema, Mi as defineRecordKinds, N as DeviceTombstoneSchema, Qt as enumerateSchemaFields, Ri as isDeviceConfigCap, Rn as parseStreamParamsFormPatch, Rr as DeviceFeature, St as buildStreamParamsConfigSchema, Tt as canonicalIconKey, Ui as isSecretMarkerLike, Vi as isSecretClear, Vr as errMsg, Wt as deviceExtensionCapability, Yt as deviceStatusCapability, Zt as enumerateItemArrayFields, bn as legacyAutoLinkIds, c as CAMERA_SWITCH_ORDER, ca as sleep$1, cr as siteZoneKey, da as transformSecretWrite, et as STREAM_PROFILE_META, fa as userError, hi as SECRET_CLEAR, ia as resolveSecretMarkers, ma as EventCategory, nr as runtimeStatePolicyFor, oa as secretTreeFromPaths, r as ALL_CAPABILITY_DEFINITIONS, sn as formatMinutes, tn as expandContainer, u as CAP_NAMES_WITH_STATUS, ua as toSecretFieldView, vi as WELL_KNOWN_TAB_MAP, wn as locationIconKey, zr as DeviceRole } from "../../dist-DV2ll9Hi.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Rr as BaseAddon, xn as logDestinationCapability } from "../../dist-CkZIrsAP.mjs";
+import { Hr as BaseAddon, Tn as logDestinationCapability } from "../../dist-DV2ll9Hi.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_device_ca = require("../../device-ca-CnbrgfmW.js");
-const require_phase6_declare_gate = require("../../phase6-declare-gate-Bl7KocEs.js");
-const require_constants = require("../../constants-DA_tjzIk.js");
+const require_device_ca = require("../../device-ca-75rt3U_U.js");
+const require_phase6_declare_gate = require("../../phase6-declare-gate-C6WqagkC.js");
+const require_constants = require("../../constants-BPWA-r-Y.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/keychain/index.mjs

@@ -1,8 +1,8 @@
-import { B as KeychainAuditEntrySchema, Di as defineRecordKinds, Rr as BaseAddon, V as KeychainResetRecordSchema, Wi as normalizeSecretOwner, hn as keychainCapability, ji as formatSecretScope, la as EventCategory, mn as keychainAdminCapability, qi as parseSecretRef, z as KEYCHAIN_RESET_TRIGGER_ACTOR } from "../../dist-CkZIrsAP.mjs";
+import { B as KEYCHAIN_RESET_TRIGGER_ACTOR, H as KeychainResetRecordSchema, Hr as BaseAddon, Ii as formatSecretScope, Mi as defineRecordKinds, Qi as parseSecretRef, V as KeychainAuditEntrySchema, Yi as normalizeSecretOwner, ma as EventCategory, vn as keychainAdminCapability, yn as keychainCapability } from "../../dist-DV2ll9Hi.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-Bh_ClxMO.mjs";
-import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-BDWZuB2n.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants-6XHGmEUF.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-D05nqNXE.mjs";
+import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-BJplW6tX.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-gzGZbnwO.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Ci as createEvent, J as RECORDING_SOURCE_CAMSTACK_ADDON, Lr as errMsg, Rr as BaseAddon, Y as RecordingStatusSchema, la as EventCategory } from "../../dist-CkZIrsAP.mjs";
+import { Hr as BaseAddon, Oi as createEvent, Vr as errMsg, X as RecordingStatusSchema, Y as RECORDING_SOURCE_CAMSTACK_ADDON, ma as EventCategory } from "../../dist-DV2ll9Hi.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,12 +3,12 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-CnbrgfmW.js");
-const require_phase6_declare_gate = require("../../phase6-declare-gate-Bl7KocEs.js");
+const require_device_ca = require("../../device-ca-75rt3U_U.js");
+const require_phase6_declare_gate = require("../../phase6-declare-gate-C6WqagkC.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,10 +1,10 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Bi as makeSecretMarker, Di as defineRecordKinds, E as DEVICE_NONCE_TTL_MS, Li as isSecretMarker, Rr as BaseAddon, T as DEVICE_ENROLLMENT_TTL_MS, Vt as deviceCredentialsCapability, a as ApiKeyRecordSchema, ct as UserRecordSchema, et as ScopedTokenSchema, hr as userManagementCapability, nn as formatDeviceRevoker, nt as SsoBridgeClaimsSchema, pt as authProviderCapability, sa as userError, st as TokenScopeSchema, vt as buildDeviceEnrollmentLink, yt as buildDeviceSignatureMessage } from "../../dist-CkZIrsAP.mjs";
+import { E as DEVICE_NONCE_TTL_MS, Gi as makeSecretMarker, Hi as isSecretMarker, Hr as BaseAddon, Mi as defineRecordKinds, T as DEVICE_ENROLLMENT_TTL_MS, Ut as deviceCredentialsCapability, a as ApiKeyRecordSchema, bt as buildDeviceEnrollmentLink, ct as TokenScopeSchema, fa as userError, ht as authProviderCapability, lt as UserRecordSchema, on as formatDeviceRevoker, rt as SsoBridgeClaimsSchema, tt as ScopedTokenSchema, xt as buildDeviceSignatureMessage, yr as userManagementCapability } from "../../dist-DV2ll9Hi.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-Bh_ClxMO.mjs";
-import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-BDWZuB2n.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-D05nqNXE.mjs";
+import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-BJplW6tX.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-m5LIr4oA.js");
+const require_dist = require("../../dist-Ct88catN.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-DAU1WttG.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { Fn as pickAppLinkHub, Jn as resolveHubAddressRoles, L as HUB_MDNS_SERVICE_TYPE, R as HUB_MDNS_TXT_KEYS, Rr as BaseAddon, Wn as resolveAppConnections, Zn as resolveNotificationTapAddress, _r as validateCustomAddress, l as CAMSTACK_APP_LINK_ORIGIN, la as EventCategory, ln as isDefaultAppConnectionEndpoint, on as isAppLinkBase, q as NetworkTunnelStartedDataSchema, wt as checkRoleAddress, yn as localNetworkCapability } from "../../dist-CkZIrsAP.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-CoyIUWHC.mjs";
+import { Cn as localNetworkCapability, Et as checkRoleAddress, Hr as BaseAddon, J as NetworkTunnelStartedDataSchema, Jn as resolveAppConnections, Qn as resolveHubAddressRoles, R as HUB_MDNS_SERVICE_TYPE, l as CAMSTACK_APP_LINK_ORIGIN, ma as EventCategory, pn as isDefaultAppConnectionEndpoint, tr as resolveNotificationTapAddress, un as isAppLinkBase, xr as validateCustomAddress, z as HUB_MDNS_TXT_KEYS, zn as pickAppLinkHub } from "../../dist-DV2ll9Hi.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-BPOg2iyc.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Rr as BaseAddon, xn as logDestinationCapability } from "../../dist-CkZIrsAP.mjs";
+import { Hr as BaseAddon, Tn as logDestinationCapability } from "../../dist-DV2ll9Hi.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 let node_fs_promises = require("node:fs/promises");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Ci as createEvent, Dn as metricsProviderCapability, Gn as resolveBucketMs, Hn as reducePoints, Lr as errMsg, Rr as BaseAddon, la as EventCategory, tn as foldSnapshotByFunction } from "../../dist-CkZIrsAP.mjs";
+import { Hr as BaseAddon, Kn as reducePoints, Oi as createEvent, Vr as errMsg, Yn as resolveBucketMs, an as foldSnapshotByFunction, jn as metricsProviderCapability, ma as EventCategory } from "../../dist-DV2ll9Hi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 let node_util = require("node:util");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { Kt as enumerateInferenceDevices, Ln as platformProbeCapability, Lr as errMsg, Rr as BaseAddon, ki as emitReadiness, la as EventCategory, tr as scoreRuntimes } from "../../dist-CkZIrsAP.mjs";
+import { Hr as BaseAddon, Pi as emitReadiness, Vn as platformProbeCapability, Vr as errMsg, Xt as enumerateInferenceDevices, ar as scoreRuntimes, ma as EventCategory } from "../../dist-DV2ll9Hi.mjs";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";
 import * as fs from "node:fs";

package/dist/builtins/record-entries/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/record-entries/index.mjs

@@ -1,4 +1,4 @@
-import { Bn as recordEntriesCapability, Rr as BaseAddon, fi as UnknownRecordKindError, qr as InvalidRecordError } from "../../dist-CkZIrsAP.mjs";
+import { Hr as BaseAddon, Qr as InvalidRecordError, Wn as recordEntriesCapability, _i as UnknownRecordKindError } from "../../dist-DV2ll9Hi.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Rr as BaseAddon, la as EventCategory } from "../../dist-CkZIrsAP.mjs";
+import { Hr as BaseAddon, ma as EventCategory } from "../../dist-DV2ll9Hi.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { En as memoizePinnedFfmpeg, Hi as nodePin, Ir as DeviceType, Lr as errMsg, Pr as DeviceFeature, Rr as BaseAddon, ar as snapshotCapability, gt as batteryCapability, ht as bareAddonId, la as EventCategory, pr as streamQualityLabel, s as BatteryStatusSchema, zt as deriveBatteryPresence } from "../../dist-CkZIrsAP.mjs";
+import { An as memoizePinnedFfmpeg, Br as DeviceType, Hr as BaseAddon, Rr as DeviceFeature, Vr as errMsg, Vt as deriveBatteryPresence, _r as streamQualityLabel, _t as bareAddonId, lr as snapshotCapability, ma as EventCategory, qi as nodePin, s as BatteryStatusSchema, vt as batteryCapability } from "../../dist-DV2ll9Hi.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Rr as BaseAddon, dr as storageProviderCapability, en as filesystemBrowseCapability } from "../../dist-CkZIrsAP.mjs";
+import { Hr as BaseAddon, hr as storageProviderCapability, in as filesystemBrowseCapability } from "../../dist-DV2ll9Hi.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-CuG1DUca.js");
+const require_wal_maintenance = require("../../wal-maintenance-mwCBe3Vr.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_MMAP_FLOOR_BYTES, B as SqliteOpProfiler, F as SQLITE_ENGINE_STORM_WALL_SHARE, I as SQLITE_PROFILE_REPORT_FLOOR_MS, L as SQLITE_PROFILE_REPORT_INTERVAL_MS, M as SQLITE_PAGE_CACHE_FLOOR_KIB, N as sqliteMmapSizeFor, O as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, P as sqlitePageCacheKibFor, R as SQLITE_PROFILE_TOP_N, V as sqliteEngineStorm, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_CEILING_KIB, k as SQLITE_MMAP_CEILING_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_SLOW_CALL_MS } from "../../wal-maintenance-Bqm4zrNA.mjs";
+import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-BineOch3.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.d.ts

@@ -23,11 +23,9 @@ import type { SqliteVecVectorIndex } from "./vector-index-vec.js";
 * of its database that the nightly backup archives in place of the live files
 * (D693).
 *
-* It ALSO serves `vector-store` (singleton, internal), from the settings file's
-* open handle. That capability first shipped as its own addon and the
-* separation cost two round trips per write — caller → door → engine — plus a
-* runner process, to reach a database this addon already has open. The
-* capability is what keeps the backend swappable; the package never was.
+* It ALSO serves `vector-store` (singleton, internal), from the **events**
+* file's worker thread (sqlite-vec loaded there). The capability is what keeps
+* the backend swappable; the package never was.
 */
 export declare class SqliteSettingsAddon extends BaseAddon {
 	private settingsFile;
@@ -62,7 +60,7 @@ export declare class SqliteSettingsAddon extends BaseAddon {
 	getBackend(): SqliteSettingsBackend | null;
 	/** The placement router; null before `onInitialize`. */
 	getRouter(): PlacementRouter | null;
-	/** Exposed for tests; null before `onInitialize`. */
+	/** Exposed for tests; vectors are served from the events file (P5). */
 	getVectorIndex(): SqliteVecVectorIndex | null;
 }
 export default SqliteSettingsAddon;

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 const require_retired_settings_keys = require("../../retired-settings-keys-D_VwZiDt.js");
-const require_wal_maintenance = require("../../wal-maintenance-CuG1DUca.js");
+const require_wal_maintenance = require("../../wal-maintenance-mwCBe3Vr.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");
@@ -1812,11 +1812,9 @@ var DATABASE_FILE_NAMES = {
 * of its database that the nightly backup archives in place of the live files
 * (D693).
 *
-* It ALSO serves `vector-store` (singleton, internal), from the settings file's
-* open handle. That capability first shipped as its own addon and the
-* separation cost two round trips per write — caller → door → engine — plus a
-* runner process, to reach a database this addon already has open. The
-* capability is what keeps the backend swappable; the package never was.
+* It ALSO serves `vector-store` (singleton, internal), from the **events**
+* file's worker thread (sqlite-vec loaded there). The capability is what keeps
+* the backend swappable; the package never was.
 */
 var SqliteSettingsAddon = class extends require_dist.BaseAddon {
 	settingsFile = null;
@@ -1864,7 +1862,7 @@ var SqliteSettingsAddon = class extends require_dist.BaseAddon {
 			livePath: settingsPath,
 			thread: "main",
 			autoVacuum: "none",
-			loadVectorExtension: true
+			loadVectorExtension: false
 		}, deps);
 		if (!(settings instanceof InlineOwnedFile)) throw new Error("sqlite-settings: the settings file must be served on the main thread");
 		this.settingsFile = settings;
@@ -1877,8 +1875,7 @@ var SqliteSettingsAddon = class extends require_dist.BaseAddon {
 			logger: this.ctx.logger.child("Placement")
 		});
 		this.router = router;
-		const vectorIndex = settings.getVectorIndex();
-		if (vectorIndex === null) throw new Error("vector-store: the settings file has no vector index");
+		const vectorProvider = require_wal_maintenance.vectorProviderOfOwnedFile(() => router.recordsFileFor("events"));
 		const records = new RecordsProvider(router, this.ctx.logger.child("Records"));
 		await records.init();
 		this.startRecordsSweep(records);
@@ -1894,7 +1891,7 @@ var SqliteSettingsAddon = class extends require_dist.BaseAddon {
 			},
 			{
 				capability: require_dist.vectorStoreCapability,
-				provider: require_wal_maintenance.vectorProviderOf(vectorIndex)
+				provider: vectorProvider
 			},
 			{
 				capability: require_dist.databaseSnapshotCapability,
@@ -1963,19 +1960,19 @@ var SqliteSettingsAddon = class extends require_dist.BaseAddon {
 	getRouter() {
 		return this.router;
 	}
-	/** Exposed for tests; null before `onInitialize`. */
+	/** Exposed for tests; vectors are served from the events file (P5). */
 	getVectorIndex() {
-		return this.settingsFile?.getVectorIndex() ?? null;
+		return null;
 	}
 };
-/** How a non-settings file is opened: its own worker; `events` is the one that holds vectors later. */
+/** How a non-settings file is opened: its own worker; `events` loads sqlite-vec. */
 function workerSpec(databaseId, livePath) {
 	return {
 		databaseId,
 		livePath,
 		thread: "worker",
 		autoVacuum: "incremental",
-		loadVectorExtension: false
+		loadVectorExtension: databaseId === "events"
 	};
 }
 //#endregion

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { $r as RECORD_SWEEP_INTERVAL_MS, Ft as databaseSnapshotCapability, Ji as parseSettingsArrayAdoptsFrom, Jr as NoCallerError, Lr as errMsg, Pt as dataStoreProviderCapability, Q as STORAGE_ADMIN_SCOPED_BASES, Rr as BaseAddon, S as DATA_STORE_DATABASES, Vn as recordsCapability, Wi as normalizeSecretOwner, Wr as DeclarationRefusedError, Yi as parseSettingsBrokersAdoptsFrom, Z as STORAGE_ADMIN_MOVED_COLLECTIONS, ai as RecordKindDeclarationSchema, b as DATABASE_SNAPSHOT_SUFFIX, br as vectorStoreCapability, fi as UnknownRecordKindError, ht as bareAddonId, ni as RUNTIME_DEFAULTS, sr as storageAdminCapability, x as DATABASE_SNAPSHOT_TIMEOUT_MS, y as DATABASE_SNAPSHOT_PARTIAL_SUFFIX } from "../../dist-CkZIrsAP.mjs";
+import { $ as STORAGE_ADMIN_SCOPED_BASES, $i as parseSettingsArrayAdoptsFrom, $r as NoCallerError, Gn as recordsCapability, Hr as BaseAddon, It as dataStoreProviderCapability, Jr as DeclarationRefusedError, Lt as databaseSnapshotCapability, Q as STORAGE_ADMIN_MOVED_COLLECTIONS, S as DATA_STORE_DATABASES, Vr as errMsg, Yi as normalizeSecretOwner, _i as UnknownRecordKindError, _t as bareAddonId, b as DATABASE_SNAPSHOT_SUFFIX, dr as storageAdminCapability, ea as parseSettingsBrokersAdoptsFrom, ii as RECORD_SWEEP_INTERVAL_MS, si as RUNTIME_DEFAULTS, ui as RecordKindDeclarationSchema, wr as vectorStoreCapability, x as DATABASE_SNAPSHOT_TIMEOUT_MS, y as DATABASE_SNAPSHOT_PARTIAL_SUFFIX } from "../../dist-DV2ll9Hi.mjs";
 import { i as retiredKeyStoreOf, n as purgeRetiredSettingsKeys } from "../../retired-settings-keys-Bhwe4ymb.mjs";
-import { C as callControl, D as controlTargetOf, E as callVector, S as RecordsEngine, T as callRecords, _ as isFileHostMessage, a as WalMaintenance, c as SqliteSettingsBackend, d as DatabaseBusyError, f as DuplicatePlacementError, g as collectTransferables, l as CollectionPlacementError, o as createVectorIndex, p as rehydrateError, s as vectorProviderOf, u as CrossDatabaseTransactError, w as callData, x as trustResult } from "../../wal-maintenance-Bqm4zrNA.mjs";
+import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, S as trustResult, T as callData, _ as collectTransferables, a as WalMaintenance, c as vectorProviderOfOwnedFile, d as CrossDatabaseTransactError, f as DatabaseBusyError, l as SqliteSettingsBackend, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callControl } from "../../wal-maintenance-BineOch3.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";
@@ -1806,11 +1806,9 @@ var DATABASE_FILE_NAMES = {
 * of its database that the nightly backup archives in place of the live files
 * (D693).
 *
-* It ALSO serves `vector-store` (singleton, internal), from the settings file's
-* open handle. That capability first shipped as its own addon and the
-* separation cost two round trips per write — caller → door → engine — plus a
-* runner process, to reach a database this addon already has open. The
-* capability is what keeps the backend swappable; the package never was.
+* It ALSO serves `vector-store` (singleton, internal), from the **events**
+* file's worker thread (sqlite-vec loaded there). The capability is what keeps
+* the backend swappable; the package never was.
 */
 var SqliteSettingsAddon = class extends BaseAddon {
 	settingsFile = null;
@@ -1858,7 +1856,7 @@ var SqliteSettingsAddon = class extends BaseAddon {
 			livePath: settingsPath,
 			thread: "main",
 			autoVacuum: "none",
-			loadVectorExtension: true
+			loadVectorExtension: false
 		}, deps);
 		if (!(settings instanceof InlineOwnedFile)) throw new Error("sqlite-settings: the settings file must be served on the main thread");
 		this.settingsFile = settings;
@@ -1871,8 +1869,7 @@ var SqliteSettingsAddon = class extends BaseAddon {
 			logger: this.ctx.logger.child("Placement")
 		});
 		this.router = router;
-		const vectorIndex = settings.getVectorIndex();
-		if (vectorIndex === null) throw new Error("vector-store: the settings file has no vector index");
+		const vectorProvider = vectorProviderOfOwnedFile(() => router.recordsFileFor("events"));
 		const records = new RecordsProvider(router, this.ctx.logger.child("Records"));
 		await records.init();
 		this.startRecordsSweep(records);
@@ -1888,7 +1885,7 @@ var SqliteSettingsAddon = class extends BaseAddon {
 			},
 			{
 				capability: vectorStoreCapability,
-				provider: vectorProviderOf(vectorIndex)
+				provider: vectorProvider
 			},
 			{
 				capability: databaseSnapshotCapability,
@@ -1957,19 +1954,19 @@ var SqliteSettingsAddon = class extends BaseAddon {
 	getRouter() {
 		return this.router;
 	}
-	/** Exposed for tests; null before `onInitialize`. */
+	/** Exposed for tests; vectors are served from the events file (P5). */
 	getVectorIndex() {
-		return this.settingsFile?.getVectorIndex() ?? null;
+		return null;
 	}
 };
-/** How a non-settings file is opened: its own worker; `events` is the one that holds vectors later. */
+/** How a non-settings file is opened: its own worker; `events` loads sqlite-vec. */
 function workerSpec(databaseId, livePath) {
 	return {
 		databaseId,
 		livePath,
 		thread: "worker",
 		autoVacuum: "incremental",
-		loadVectorExtension: false
+		loadVectorExtension: databaseId === "events"
 	};
 }
 //#endregion

package/dist/builtins/sqlite-storage/vector-provider.d.ts

@@ -1,4 +1,5 @@
 import type { IScopedLogger, IVectorStoreProvider } from "@camstack/types";
+import type { OwnedSqliteFile } from "./owned-sqlite-file.js";
 import type { SqliteSettingsBackend } from "./sqlite-settings-backend.js";
 import { SqliteVecVectorIndex } from "./vector-index-vec.js";
 /**
@@ -17,6 +18,11 @@ import { SqliteVecVectorIndex } from "./vector-index-vec.js";
 */
 export declare function createVectorIndex(backend: SqliteSettingsBackend, logger: IScopedLogger): SqliteVecVectorIndex;
 /**
+* `vector-store` served from the events worker (P5): every call opens or reuses
+* `events.db` with sqlite-vec loaded there, not on the settings thread.
+*/
+export declare function vectorProviderOfOwnedFile(openEvents: () => Promise<OwnedSqliteFile>): IVectorStoreProvider;
+/**
 * The `vector-store` provider surface over one sqlite-vec index. Extracted
 * from the addon so the main thread (settings) and the file-host worker
 * (events) serve the SAME mapping.

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BkNfEJKa.js");
+const require_dist = require("../../dist-Ct88catN.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { $i as resolveSecretMarkers, Di as defineRecordKinds, Gi as parseJsonObject, Li as isSecretMarker, On as modeMayWrite, Rr as BaseAddon, Tn as mayWriteToLocation, U as LegacyStorageLocationDefaultSchema, Ui as normalizeNodeId, Xt as evictionPolicyOfLocation, Yn as resolveLocationMode, _n as legacyModeOf, at as StorageLocationTypeSchema, cr as storageCapability, ei as REDACTED_SECRET, in as gbToBytes, it as StorageLocationModeSchema, la as EventCategory, lr as storageMigrationCapability, nr as settingsStoreCapability, oa as transformSecretWrite, ot as StorageMigrationJobSchema, rt as StorageCleanupJobSchema, ta as secretTreeFromPaths, un as isLocationEnabled, wn as mayReadLocation, xr as withLocationMode, yi as collectSecretConfigKeys } from "../../dist-CkZIrsAP.mjs";
+import { $n as resolveLocationMode, Hi as isSecretMarker, Hr as BaseAddon, Ji as normalizeNodeId, Mi as defineRecordKinds, Mn as modeMayWrite, On as mayReadLocation, Tr as withLocationMode, W as LegacyStorageLocationDefaultSchema, Xi as parseJsonObject, ai as REDACTED_SECRET, at as StorageLocationModeSchema, cn as gbToBytes, da as transformSecretWrite, en as evictionPolicyOfLocation, fr as storageCapability, ia as resolveSecretMarkers, it as StorageCleanupJobSchema, kn as mayWriteToLocation, ma as EventCategory, mn as isLocationEnabled, oa as secretTreeFromPaths, or as settingsStoreCapability, ot as StorageLocationTypeSchema, pr as storageMigrationCapability, st as StorageMigrationJobSchema, wi as collectSecretConfigKeys, xn as legacyModeOf } from "../../dist-DV2ll9Hi.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";