@camstack/system 1.2.455 → 1.2.456

package/dist/builtins/local-auth/preferences-record-kinds.d.ts

@@ -0,0 +1,27 @@
+/**
+* The per-user account preferences kind (D894), owned by `local-auth` because
+* it owns the users the rows belong to — a user's delete wipes them in the
+* same call (`endAllAccess`).
+*
+* Declared on its OWN, never folded into `localAuthRecordKinds`: that map is
+* the phase-6 adoption set, and a kind missing from the catalog there sends
+* the whole auth builtin back to its legacy tables.
+*/
+import { type DefinedRecordKind, type PreferenceValue } from "@camstack/types";
+import { z } from "zod";
+/** One `(user, namespace)` row. The record id is {@link userPreferenceRecordId}. */
+export type UserPreferenceBody = {
+	readonly userId: string;
+	readonly namespace: string;
+	readonly value: PreferenceValue;
+	readonly revision: number;
+	readonly updatedAt: number;
+	readonly updatedByDevice: string | null;
+};
+export declare const UserPreferenceBodySchema: z.ZodType<UserPreferenceBody>;
+export type LocalAuthPreferencesRecordKindsMap = {
+	readonly "user-preferences": DefinedRecordKind<z.ZodType<UserPreferenceBody>>;
+};
+export declare const localAuthPreferencesRecordKinds: LocalAuthPreferencesRecordKindsMap;
+/** Namespaces cannot hold `:`, so the id splits unambiguously. */
+export declare function userPreferenceRecordId(userId: string, namespace: string): string;

package/dist/builtins/local-auth/record-kinds.d.ts

@@ -5,7 +5,10 @@
 * use `storageAdmin.dropCollection` with `expectRows` after verify (see
 * `docs/design/records-phase-6-auth-migration.md`).
 *
-* Before hub restart: mint and test an admin token (`csa_`); snapshot every kind.
+* Before hub restart: mint and test an admin token (`auth.mintToken` with `'*'`); snapshot every kind.
+*
+* `scoped-tokens` and `admin-tokens` hold pre-D892 rows read by nothing since
+* D895; they stay declared so the layout is unchanged.
 */
 import { ApiKeyRecordSchema, type DefinedRecordKind, type RecordKindHandle, type RecordsAccess, ScopedTokenSchema, TokenScopeSchema, UserRecordSchema } from "@camstack/types";
 import { z } from "zod";
@@ -128,8 +131,6 @@ export declare const LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS: readonly string[];
 export interface LocalAuthRecordStores {
 	readonly users: RecordKindHandle<UserBody>;
 	readonly apiKeys: RecordKindHandle<ApiKeyBody>;
-	readonly scopedTokens: RecordKindHandle<ScopedTokenBody>;
-	readonly adminTokens: RecordKindHandle<AdminTokenBody>;
 	readonly loginSessions: RecordKindHandle<LoginSessionBody>;
 	readonly loginSessionCutoffs: RecordKindHandle<LoginSessionCutoffBody>;
 	readonly oauthSessions: RecordKindHandle<OauthSessionBody>;

package/dist/builtins/local-auth/user-preferences-store.d.ts

@@ -0,0 +1,56 @@
+/**
+* Per-user account preferences (D894): one row per `(userId, namespace)`.
+*
+* Every method takes the OWNER's id as its first argument and touches only
+* that user's rows; the hub router stamps it from the principal, and nothing
+* here accepts a second user id.
+*
+* The poll (`changedSince`) is answered from an in-memory mirror of each
+* user's `namespace → revision`, loaded once on first touch. This store is the
+* kind's only writer (one in-process instance in `local-auth`), so the mirror
+* cannot fall behind the rows; a poll that finds nothing changed reads no row.
+* Writes of one user are serialized, so a read-modify-write never interleaves.
+*/
+import { type PreferenceRow, type PreferencesChangedSinceOutput, type PreferencesPutInput, type PreferencesPutOutput, type RecordKindHandle } from "@camstack/types";
+import { type UserPreferenceBody } from "./preferences-record-kinds.js";
+export type PreferencesLimitReason = "value-too-large" | "too-many-namespaces";
+/** A write the limits refuse; nothing was stored. */
+export declare class PreferencesLimitError extends Error {
+	readonly reason: PreferencesLimitReason;
+	constructor(reason: PreferencesLimitReason, message: string);
+}
+/**
+* The limit refusal behind `error`, or `null`. By name and field, not
+* `instanceof`: the store and its caller may load different copies of this
+* module.
+*/
+export declare function preferencesLimitReasonOf(error: unknown): PreferencesLimitReason | null;
+export interface UserPreferencesStoreOptions {
+	readonly now?: () => number;
+}
+export declare class UserPreferencesStore {
+	private readonly kind;
+	private readonly now;
+	/** `userId → namespace → revision`; absent until the user is first touched. */
+	private readonly mirrors;
+	private readonly locks;
+	constructor(kind: RecordKindHandle<UserPreferenceBody>, options?: UserPreferencesStoreOptions);
+	/** The caller's rows; `namespaces` narrows them (unknown ones are simply absent). */
+	get(userId: string, namespaces?: readonly string[]): Promise<readonly PreferenceRow[]>;
+	put(userId: string, input: PreferencesPutInput): Promise<PreferencesPutOutput>;
+	/** `false` when the namespace did not exist. */
+	delete(userId: string, namespace: string): Promise<boolean>;
+	/**
+	* What the client is missing: every row whose revision differs from the one
+	* it holds (or that it does not list), and every listed namespace now gone.
+	*/
+	changedSince(userId: string, known: Readonly<Record<string, number>>): Promise<PreferencesChangedSinceOutput>;
+	/** Every row of `userId` goes (user delete). Returns how many. */
+	wipeUser(userId: string): Promise<number>;
+	/** Rows whose user is not in `liveUserIds` go (boot sweep). Returns how many. */
+	wipeOrphans(liveUserIds: ReadonlySet<string>): Promise<number>;
+	private mirrorOf;
+	private scanUser;
+	/** Run `task` after every earlier write of the same user has settled. */
+	private serialized;
+}

package/dist/builtins/local-network/local-network.addon.d.ts

@@ -164,6 +164,14 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
 	private reconcileMeshEndpoint;
 	private resolvedHttpPort;
 	private tlsDataDir;
+	/**
+	* The hub's name (D861) for a local root this action may CREATE (an existing root is
+	* never renamed). Hub only: on an agent the hub's name would mislabel the agent's own
+	* material, so it gets the plain name. A failed read falls back to the machine
+	* hostname (what the hub shows when unnamed) and says so: a certificate action must
+	* not fail over a label.
+	*/
+	private caHubName;
 	private snapshotTls;
 	/**
 	* Hot-swap the HTTPS listener onto the pair now on disk. A failure is not

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-Bkrvgnma.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CZlZRxxA.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");
@@ -887,7 +887,10 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			getTlsStatus: async () => this.snapshotTls(),
 			regenerateCertificate: async (_input) => {
 				const extraSans = [...require_hub_mdns_ciao.readExtraSans(this.tlsDataDir())];
-				await require_hub_mdns_ciao.regenerateCertificate(this.tlsDataDir(), { extraSans });
+				await require_hub_mdns_ciao.regenerateCertificate(this.tlsDataDir(), {
+					extraSans,
+					...await this.caHubName()
+				});
 				this.putCertificateOnListener("regenerate");
 				return this.snapshotTls();
 			},
@@ -910,7 +913,10 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			},
 			revertToGeneratedCertificate: async () => {
 				const extraSans = [...require_hub_mdns_ciao.readExtraSans(this.tlsDataDir())];
-				await require_hub_mdns_ciao.revertToGeneratedCertificate(this.tlsDataDir(), { extraSans });
+				await require_hub_mdns_ciao.revertToGeneratedCertificate(this.tlsDataDir(), {
+					extraSans,
+					...await this.caHubName()
+				});
 				this.putCertificateOnListener("revert");
 				return this.snapshotTls();
 			}
@@ -1117,6 +1123,22 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	tlsDataDir() {
 		return this.ctx.nodeDataDir ?? this.ctx.dataDir;
 	}
+	/**
+	* The hub's name (D861) for a local root this action may CREATE (an existing root is
+	* never renamed). Hub only: on an agent the hub's name would mislabel the agent's own
+	* material, so it gets the plain name. A failed read falls back to the machine
+	* hostname (what the hub shows when unnamed) and says so: a certificate action must
+	* not fail over a label.
+	*/
+	async caHubName() {
+		if ((this.ctx.kernel.localNodeId ?? "hub") !== "hub") return {};
+		try {
+			return { hubName: (await this.ctx.api.system.info.query()).serverName.name };
+		} catch (err) {
+			this.ctx.logger.warn("local-network: server name unreadable - naming the CA after the hostname", { meta: { error: require_dist.errMsg(err) } });
+			return { hubName: require_dist.shortHostname(node_os.hostname()) };
+		}
+	}
 	snapshotTls() {
 		const status = require_hub_mdns_ciao.readTlsAccessStatus(this.tlsDataDir(), require_hub_mdns_ciao.servedHttpsLeafFingerprint());
 		return {
@@ -1165,7 +1187,10 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		if (hostname !== "") {
 			require_hub_mdns_ciao.writeExtraSans(this.tlsDataDir(), [hostname]);
 			if (require_hub_mdns_ciao.readTlsMode(this.tlsDataDir()) === "generated") {
-				if ((await require_hub_mdns_ciao.ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] })).generated) this.putCertificateOnListener("hostname");
+				if ((await require_hub_mdns_ciao.ensureTlsCert(this.tlsDataDir(), {
+					extraSans: [hostname],
+					hubName: require_dist.shortHostname(node_os.hostname())
+				})).generated) this.putCertificateOnListener("hostname");
 			}
 		} else require_hub_mdns_ciao.writeExtraSans(this.tlsDataDir(), []);
 	}

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { $n as resolveAppConnections, B as HUB_MDNS_TXT_KEYS, Er as validateCustomAddress, On as localNetworkCapability, Wn as pickAppLinkHub, Y as NetworkTunnelStartedDataSchema, hn as isAppLinkBase, kt as checkRoleAddress, l as CAMSTACK_APP_LINK_ORIGIN, or as resolveNotificationTapAddress, qr as BaseAddon, rr as resolveHubAddressRoles, vn as isDefaultAppConnectionEndpoint, ya as EventCategory, z as HUB_MDNS_SERVICE_TYPE } from "../../dist-BpSENkRJ.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-DlgkFJVY.mjs";
+import { $r as BaseAddon, B as HUB_MDNS_SERVICE_TYPE, Mr as validateCustomAddress, Pn as localNetworkCapability, Pt as checkRoleAddress, Qr as errMsg, Ta as EventCategory, V as HUB_MDNS_TXT_KEYS, X as NetworkTunnelStartedDataSchema, Xn as pickAppLinkHub, ar as resolveAppConnections, bn as isAppLinkBase, fr as resolveNotificationTapAddress, l as CAMSTACK_APP_LINK_ORIGIN, lr as resolveHubAddressRoles, vr as shortHostname, wn as isDefaultAppConnectionEndpoint } from "../../dist-BSF_C8W2.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-CHaGDzyz.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";
@@ -884,7 +884,10 @@ var LocalNetworkAddon = class extends BaseAddon {
 			getTlsStatus: async () => this.snapshotTls(),
 			regenerateCertificate: async (_input) => {
 				const extraSans = [...readExtraSans(this.tlsDataDir())];
-				await regenerateCertificate(this.tlsDataDir(), { extraSans });
+				await regenerateCertificate(this.tlsDataDir(), {
+					extraSans,
+					...await this.caHubName()
+				});
 				this.putCertificateOnListener("regenerate");
 				return this.snapshotTls();
 			},
@@ -907,7 +910,10 @@ var LocalNetworkAddon = class extends BaseAddon {
 			},
 			revertToGeneratedCertificate: async () => {
 				const extraSans = [...readExtraSans(this.tlsDataDir())];
-				await revertToGeneratedCertificate(this.tlsDataDir(), { extraSans });
+				await revertToGeneratedCertificate(this.tlsDataDir(), {
+					extraSans,
+					...await this.caHubName()
+				});
 				this.putCertificateOnListener("revert");
 				return this.snapshotTls();
 			}
@@ -1114,6 +1120,22 @@ var LocalNetworkAddon = class extends BaseAddon {
 	tlsDataDir() {
 		return this.ctx.nodeDataDir ?? this.ctx.dataDir;
 	}
+	/**
+	* The hub's name (D861) for a local root this action may CREATE (an existing root is
+	* never renamed). Hub only: on an agent the hub's name would mislabel the agent's own
+	* material, so it gets the plain name. A failed read falls back to the machine
+	* hostname (what the hub shows when unnamed) and says so: a certificate action must
+	* not fail over a label.
+	*/
+	async caHubName() {
+		if ((this.ctx.kernel.localNodeId ?? "hub") !== "hub") return {};
+		try {
+			return { hubName: (await this.ctx.api.system.info.query()).serverName.name };
+		} catch (err) {
+			this.ctx.logger.warn("local-network: server name unreadable - naming the CA after the hostname", { meta: { error: errMsg(err) } });
+			return { hubName: shortHostname(os$1.hostname()) };
+		}
+	}
 	snapshotTls() {
 		const status = readTlsAccessStatus(this.tlsDataDir(), servedHttpsLeafFingerprint());
 		return {
@@ -1162,7 +1184,10 @@ var LocalNetworkAddon = class extends BaseAddon {
 		if (hostname !== "") {
 			writeExtraSans(this.tlsDataDir(), [hostname]);
 			if (readTlsMode(this.tlsDataDir()) === "generated") {
-				if ((await ensureTlsCert(this.tlsDataDir(), { extraSans: [hostname] })).generated) this.putCertificateOnListener("hostname");
+				if ((await ensureTlsCert(this.tlsDataDir(), {
+					extraSans: [hostname],
+					hubName: shortHostname(os$1.hostname())
+				})).generated) this.putCertificateOnListener("hostname");
 			}
 		} else writeExtraSans(this.tlsDataDir(), []);
 	}

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { An as logDestinationCapability, qr as BaseAddon } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, In as logDestinationCapability } from "../../dist-BSF_C8W2.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 let node_fs_promises = require("node:fs/promises");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { In as metricsProviderCapability, Kr as errMsg, Ni as createEvent, Zn as reducePoints, cn as foldSnapshotByFunction, er as resolveBucketMs, qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Hn as metricsProviderCapability, Qr as errMsg, Ta as EventCategory, or as resolveBucketMs, pn as foldSnapshotByFunction, rr as reducePoints, zi as createEvent } from "../../dist-BSF_C8W2.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 let node_util = require("node:util");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { $t as enumerateInferenceDevices, Kn as platformProbeCapability, Kr as errMsg, qr as BaseAddon, ur as scoreRuntimes, ya as EventCategory, zi as emitReadiness } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Gi as emitReadiness, Qn as platformProbeCapability, Qr as errMsg, Ta as EventCategory, gr as scoreRuntimes, in as enumerateInferenceDevices } from "../../dist-BSF_C8W2.mjs";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";
 import * as fs from "node:fs";

package/dist/builtins/record-entries/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/record-entries/index.mjs

@@ -1,4 +1,4 @@
-import { Si as UnknownRecordKindError, Yn as recordEntriesCapability, Zi as mapSecretLeaves, qr as BaseAddon, ri as InvalidRecordError, sa as recordSecretRef } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Oi as UnknownRecordKindError, li as InvalidRecordError, pa as recordSecretRef, ra as mapSecretLeaves, tr as recordEntriesCapability } from "../../dist-BSF_C8W2.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Ta as EventCategory } from "../../dist-BSF_C8W2.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Fn as memoizePinnedFfmpeg, Gr as DeviceType, Kr as errMsg, Qi as nodePin, Sr as streamQualityLabel, Ur as DeviceFeature, Wt as deriveBatteryPresence, bt as bareAddonId, mr as snapshotCapability, qr as BaseAddon, s as BatteryStatusSchema, xt as batteryCapability, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Et as batteryCapability, Or as streamQualityLabel, Qr as errMsg, Ta as EventCategory, Tt as bareAddonId, Vn as memoizePinnedFfmpeg, Yr as DeviceFeature, Yt as deriveBatteryPresence, Zr as DeviceType, br as snapshotCapability, ia as nodePin, s as BatteryStatusSchema } from "../../dist-BSF_C8W2.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { br as storageProviderCapability, qr as BaseAddon, sn as filesystemBrowseCapability } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Er as storageProviderCapability, fn as filesystemBrowseCapability } from "../../dist-BSF_C8W2.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-Bl0ZKjVR.js");
+const require_wal_maintenance = require("../../wal-maintenance-CNEs_I94.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-TyuOEVy1.mjs";
+import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-AerF4XE6.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/records/records-engine-types.d.ts

@@ -14,6 +14,7 @@ export interface RecordsEngineOps extends OwnedOps {
 	/** Every kind this file holds, with rows and a size estimate (System -> Data). */
 	listKinds(input: {
 		readonly owner?: string | undefined;
+		readonly counts?: boolean | undefined;
 	}): Promise<readonly StorageKind[]>;
 	/** Delete rows past `expires_at`, in batches. */
 	sweepExpired(input: {

package/dist/builtins/sqlite-storage/records/records-provider.d.ts

@@ -29,6 +29,19 @@ export declare class RecordsProvider implements IRecordsProvider, AdminRecords {
 	init(): Promise<void>;
 	private fileOf;
 	declareKinds(input: Parameters<IRecordsProvider["declareKinds"]>[0]): ReturnType<IRecordsProvider["declareKinds"]>;
+	/**
+	* Rows of a legacy table in EVERY open records-capable file. A legacy table lives
+	* in one file, but which one is the layout's business: the phase-3 NC ledgers moved
+	* to `events.db` with the P5 split, and a guard that asked `camstack.db` alone
+	* answered "no legacy rows" for 522 outbox rows (2026-10-20 audit).
+	*/
+	private legacyRowsAnywhere;
+	/**
+	* `transactFamily` (plan risk 8): kinds that must agree through one `transact` sit
+	* in ONE file. A family split across files is refused whole, whether the split is
+	* inside this declaration or against a kind of the same owner declared before.
+	*/
+	private assertFamiliesInOneFile;
 	/** The boot guard: empty kind + a legacy table that still has rows = adoption pending. */
 	private withAdoption;
 	get(input: Parameters<IRecordsProvider["get"]>[0]): ReturnType<IRecordsProvider["get"]>;

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_retired_settings_keys = require("../../retired-settings-keys-D_VwZiDt.js");
-const require_wal_maintenance = require("../../wal-maintenance-Bl0ZKjVR.js");
+const require_wal_maintenance = require("../../wal-maintenance-CNEs_I94.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");
@@ -1349,8 +1349,10 @@ var RecordsProvider = class {
 	async declareKinds(input) {
 		const owner = recordsCallerOf(input);
 		const byDatabase = /* @__PURE__ */ new Map();
-		for (const [kind, raw] of Object.entries(input.kinds)) {
-			const declaration = require_dist.RecordKindDeclarationSchema.parse(raw);
+		const parsed = /* @__PURE__ */ new Map();
+		for (const [kind, raw] of Object.entries(input.kinds)) parsed.set(kind, require_dist.RecordKindDeclarationSchema.parse(raw));
+		await this.assertFamiliesInOneFile(owner, parsed);
+		for (const [kind, declaration] of parsed) {
 			const known = this.placement.get(keyOf(owner, kind));
 			if (known !== void 0 && known !== declaration.database) throw new require_dist.DeclarationRefusedError(`kind "${kind}" of "${owner}" lives in "${known}", declared for "${declaration.database}" - the engine never moves data`);
 			const group = byDatabase.get(declaration.database) ?? {};
@@ -1372,6 +1374,50 @@ var RecordsProvider = class {
 		}
 		return { kinds: await this.withAdoption(owner, input.kinds, merged) };
 	}
+	/**
+	* Rows of a legacy table in EVERY open records-capable file. A legacy table lives
+	* in one file, but which one is the layout's business: the phase-3 NC ledgers moved
+	* to `events.db` with the P5 split, and a guard that asked `camstack.db` alone
+	* answered "no legacy rows" for 522 outbox rows (2026-10-20 audit).
+	*/
+	async legacyRowsAnywhere(table) {
+		let total = 0;
+		for (const file of this.router.openFiles()) {
+			if (file.databaseId === "history") continue;
+			const rows = await file.records("legacyRowCount", { table });
+			if (rows !== null) total += rows;
+		}
+		return total;
+	}
+	/**
+	* `transactFamily` (plan risk 8): kinds that must agree through one `transact` sit
+	* in ONE file. A family split across files is refused whole, whether the split is
+	* inside this declaration or against a kind of the same owner declared before.
+	*/
+	async assertFamiliesInOneFile(owner, declared) {
+		const families = /* @__PURE__ */ new Map();
+		const note = (family, kind, database) => {
+			const members = families.get(family) ?? /* @__PURE__ */ new Map();
+			members.set(kind, database);
+			families.set(family, members);
+		};
+		for (const file of this.router.openFiles()) {
+			if (file.databaseId === "history") continue;
+			for (const k of await file.records("listKinds", {
+				owner,
+				counts: false
+			})) {
+				if (k.state === "dropped" || declared.has(k.kind)) continue;
+				const family = k.declaration.transactFamily;
+				if (family !== void 0) note(family, k.kind, file.databaseId);
+			}
+		}
+		for (const [kind, declaration] of declared) if (declaration.transactFamily !== void 0) note(declaration.transactFamily, kind, declaration.database);
+		for (const [family, members] of families) {
+			if (new Set(members.values()).size <= 1) continue;
+			throw new require_dist.DeclarationRefusedError(`transactFamily "${family}" of "${owner}" is split across files (${[...members.entries()].map(([k, db]) => `${k}@${db}`).join(", ")}); a family lives in ONE file`);
+		}
+	}
 	/** The boot guard: empty kind + a legacy table that still has rows = adoption pending. */
 	async withAdoption(owner, declared, results) {
 		const out = { ...results };
@@ -1407,8 +1453,8 @@ var RecordsProvider = class {
 				};
 				continue;
 			}
-			const legacyRows = await (await this.router.recordsFileFor("settings")).records("legacyRowCount", { table: legacy });
-			if (legacyRows !== null && legacyRows > 0) out[kind] = {
+			const legacyRows = await this.legacyRowsAnywhere(legacy);
+			if (legacyRows > 0) out[kind] = {
 				...result,
 				adoptionPending: {
 					legacyTable: legacy,

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { $ as STORAGE_ADMIN_MOVED_COLLECTIONS, $r as DeclarationRefusedError, Bt as databaseSnapshotCapability, C as DATA_STORE_DATABASES, Kr as errMsg, S as DATABASE_SNAPSHOT_TIMEOUT_MS, Si as UnknownRecordKindError, Xn as recordsCapability, aa as parseSettingsBrokersAdoptsFrom, b as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, bt as bareAddonId, ea as normalizeSecretOwner, et as STORAGE_ADMIN_SCOPED_BASES, fi as RUNTIME_DEFAULTS, gr as storageAdminCapability, hi as RecordKindDeclarationSchema, ia as parseSettingsArrayAdoptsFrom, ii as NoCallerError, kr as vectorStoreCapability, li as RECORD_SWEEP_INTERVAL_MS, qr as BaseAddon, x as DATABASE_SNAPSHOT_SUFFIX, zt as dataStoreProviderCapability } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, C as DATABASE_SNAPSHOT_TIMEOUT_MS, Fr as vectorStoreCapability, Gt as databaseSnapshotCapability, Oi as UnknownRecordKindError, Qr as errMsg, S as DATABASE_SNAPSHOT_SUFFIX, Sr as storageAdminCapability, Tt as bareAddonId, Wt as dataStoreProviderCapability, ai as DeclarationRefusedError, at as STORAGE_ADMIN_SCOPED_BASES, da as parseSettingsBrokersAdoptsFrom, hi as RECORD_SWEEP_INTERVAL_MS, it as STORAGE_ADMIN_MOVED_COLLECTIONS, nr as recordsCapability, oa as normalizeSecretOwner, ua as parseSettingsArrayAdoptsFrom, ui as NoCallerError, vi as RUNTIME_DEFAULTS, w as DATA_STORE_DATABASES, x as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, xi as RecordKindDeclarationSchema } from "../../dist-BSF_C8W2.mjs";
 import { i as retiredKeyStoreOf, n as purgeRetiredSettingsKeys } from "../../retired-settings-keys-Bhwe4ymb.mjs";
-import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, S as trustResult, T as callData, _ as collectTransferables, a as WalMaintenance, c as vectorProviderOfOwnedFile, d as CrossDatabaseTransactError, f as DatabaseBusyError, l as SqliteSettingsBackend, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callControl } from "../../wal-maintenance-TyuOEVy1.mjs";
+import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, S as trustResult, T as callData, _ as collectTransferables, a as WalMaintenance, c as vectorProviderOfOwnedFile, d as CrossDatabaseTransactError, f as DatabaseBusyError, l as SqliteSettingsBackend, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callControl } from "../../wal-maintenance-AerF4XE6.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";
@@ -1343,8 +1343,10 @@ var RecordsProvider = class {
 	async declareKinds(input) {
 		const owner = recordsCallerOf(input);
 		const byDatabase = /* @__PURE__ */ new Map();
-		for (const [kind, raw] of Object.entries(input.kinds)) {
-			const declaration = RecordKindDeclarationSchema.parse(raw);
+		const parsed = /* @__PURE__ */ new Map();
+		for (const [kind, raw] of Object.entries(input.kinds)) parsed.set(kind, RecordKindDeclarationSchema.parse(raw));
+		await this.assertFamiliesInOneFile(owner, parsed);
+		for (const [kind, declaration] of parsed) {
 			const known = this.placement.get(keyOf(owner, kind));
 			if (known !== void 0 && known !== declaration.database) throw new DeclarationRefusedError(`kind "${kind}" of "${owner}" lives in "${known}", declared for "${declaration.database}" - the engine never moves data`);
 			const group = byDatabase.get(declaration.database) ?? {};
@@ -1366,6 +1368,50 @@ var RecordsProvider = class {
 		}
 		return { kinds: await this.withAdoption(owner, input.kinds, merged) };
 	}
+	/**
+	* Rows of a legacy table in EVERY open records-capable file. A legacy table lives
+	* in one file, but which one is the layout's business: the phase-3 NC ledgers moved
+	* to `events.db` with the P5 split, and a guard that asked `camstack.db` alone
+	* answered "no legacy rows" for 522 outbox rows (2026-10-20 audit).
+	*/
+	async legacyRowsAnywhere(table) {
+		let total = 0;
+		for (const file of this.router.openFiles()) {
+			if (file.databaseId === "history") continue;
+			const rows = await file.records("legacyRowCount", { table });
+			if (rows !== null) total += rows;
+		}
+		return total;
+	}
+	/**
+	* `transactFamily` (plan risk 8): kinds that must agree through one `transact` sit
+	* in ONE file. A family split across files is refused whole, whether the split is
+	* inside this declaration or against a kind of the same owner declared before.
+	*/
+	async assertFamiliesInOneFile(owner, declared) {
+		const families = /* @__PURE__ */ new Map();
+		const note = (family, kind, database) => {
+			const members = families.get(family) ?? /* @__PURE__ */ new Map();
+			members.set(kind, database);
+			families.set(family, members);
+		};
+		for (const file of this.router.openFiles()) {
+			if (file.databaseId === "history") continue;
+			for (const k of await file.records("listKinds", {
+				owner,
+				counts: false
+			})) {
+				if (k.state === "dropped" || declared.has(k.kind)) continue;
+				const family = k.declaration.transactFamily;
+				if (family !== void 0) note(family, k.kind, file.databaseId);
+			}
+		}
+		for (const [kind, declaration] of declared) if (declaration.transactFamily !== void 0) note(declaration.transactFamily, kind, declaration.database);
+		for (const [family, members] of families) {
+			if (new Set(members.values()).size <= 1) continue;
+			throw new DeclarationRefusedError(`transactFamily "${family}" of "${owner}" is split across files (${[...members.entries()].map(([k, db]) => `${k}@${db}`).join(", ")}); a family lives in ONE file`);
+		}
+	}
 	/** The boot guard: empty kind + a legacy table that still has rows = adoption pending. */
 	async withAdoption(owner, declared, results) {
 		const out = { ...results };
@@ -1401,8 +1447,8 @@ var RecordsProvider = class {
 				};
 				continue;
 			}
-			const legacyRows = await (await this.router.recordsFileFor("settings")).records("legacyRowCount", { table: legacy });
-			if (legacyRows !== null && legacyRows > 0) out[kind] = {
+			const legacyRows = await this.legacyRowsAnywhere(legacy);
+			if (legacyRows > 0) out[kind] = {
 				...result,
 				adoptionPending: {
 					legacyTable: legacy,

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");