@camstack/system 1.2.455 → 1.2.457

package/dist/log-file-read-worker.js

@@ -0,0 +1,64 @@
+require("./chunk-Cek0wNdY.js");
+const require_log_file_read_protocol = require("./log-file-read-protocol-D0WcLbIV.js");
+let node_worker_threads = require("node:worker_threads");
+//#region src/builtins/winston-logging/log-file-read-worker.ts
+/**
+* The rotated-file reader thread (D898) — a worker of whichever process runs
+* `winston-logging`, so scanning and indexing a day of logs never runs on that
+* process's event loop.
+*
+* A separate bundle (`dist/log-file-read-worker.js`, wired in
+* `vite.config.ts`). It imports nothing from the kernel: the index, the
+* reader and the shared line filter.
+*/
+function isWorkerData(value) {
+	return typeof value === "object" && value !== null && "logsDir" in value && typeof value.logsDir === "string" && "backgroundPassMs" in value && typeof value.backgroundPassMs === "number";
+}
+var port = node_worker_threads.parentPort;
+if (port === null || !isWorkerData(node_worker_threads.workerData)) throw new Error("log-file-read-worker: started without a parent port or worker data");
+var data = node_worker_threads.workerData;
+var store = new require_log_file_read_protocol.LogFileIndexStore(data.logsDir);
+var cancels = new require_log_file_read_protocol.CancelBook();
+var stopping = false;
+var passRunning = false;
+async function backgroundPass() {
+	if (passRunning || stopping) return;
+	passRunning = true;
+	try {
+		await store.backgroundPass(() => stopping);
+	} catch {} finally {
+		passRunning = false;
+	}
+}
+var timer = data.backgroundPassMs > 0 ? setInterval(() => void backgroundPass(), data.backgroundPassMs) : null;
+if (data.backgroundPassMs > 0) backgroundPass();
+port.on("message", (message) => {
+	if (!require_log_file_read_protocol.isToReader(message)) return;
+	if (message.type === "stop") {
+		stopping = true;
+		if (timer !== null) clearInterval(timer);
+		port.close();
+		return;
+	}
+	if (message.type === "cancel") {
+		cancels.cancel(message.requestId);
+		return;
+	}
+	const { id, query } = message;
+	require_log_file_read_protocol.serveRead(data.logsDir, store, cancels, query).then((outcome) => {
+		const reply = {
+			type: "result",
+			id,
+			result: outcome.result
+		};
+		port.postMessage(reply);
+	}, (error) => {
+		const reply = {
+			type: "error",
+			id,
+			message: error instanceof Error ? error.message : String(error)
+		};
+		port.postMessage(reply);
+	});
+});
+//#endregion

package/dist/log-file-read-worker.mjs

@@ -0,0 +1,64 @@
+import { a as LogFileIndexStore, i as serveRead, r as isToReader, t as CancelBook } from "./log-file-read-protocol-B7M3X3bT.mjs";
+import { parentPort, workerData } from "node:worker_threads";
+//#region src/builtins/winston-logging/log-file-read-worker.ts
+/**
+* The rotated-file reader thread (D898) — a worker of whichever process runs
+* `winston-logging`, so scanning and indexing a day of logs never runs on that
+* process's event loop.
+*
+* A separate bundle (`dist/log-file-read-worker.js`, wired in
+* `vite.config.ts`). It imports nothing from the kernel: the index, the
+* reader and the shared line filter.
+*/
+function isWorkerData(value) {
+	return typeof value === "object" && value !== null && "logsDir" in value && typeof value.logsDir === "string" && "backgroundPassMs" in value && typeof value.backgroundPassMs === "number";
+}
+var port = parentPort;
+if (port === null || !isWorkerData(workerData)) throw new Error("log-file-read-worker: started without a parent port or worker data");
+var data = workerData;
+var store = new LogFileIndexStore(data.logsDir);
+var cancels = new CancelBook();
+var stopping = false;
+var passRunning = false;
+async function backgroundPass() {
+	if (passRunning || stopping) return;
+	passRunning = true;
+	try {
+		await store.backgroundPass(() => stopping);
+	} catch {} finally {
+		passRunning = false;
+	}
+}
+var timer = data.backgroundPassMs > 0 ? setInterval(() => void backgroundPass(), data.backgroundPassMs) : null;
+if (data.backgroundPassMs > 0) backgroundPass();
+port.on("message", (message) => {
+	if (!isToReader(message)) return;
+	if (message.type === "stop") {
+		stopping = true;
+		if (timer !== null) clearInterval(timer);
+		port.close();
+		return;
+	}
+	if (message.type === "cancel") {
+		cancels.cancel(message.requestId);
+		return;
+	}
+	const { id, query } = message;
+	serveRead(data.logsDir, store, cancels, query).then((outcome) => {
+		const reply = {
+			type: "result",
+			id,
+			result: outcome.result
+		};
+		port.postMessage(reply);
+	}, (error) => {
+		const reply = {
+			type: "error",
+			id,
+			message: error instanceof Error ? error.message : String(error)
+		};
+		port.postMessage(reply);
+	});
+});
+//#endregion
+export {};

package/dist/log-read-filter-Bi066jwU.js

@@ -0,0 +1,134 @@
+//#region src/logging/log-read-filter.ts
+var LEVEL_RANK = {
+	debug: 0,
+	info: 1,
+	warn: 2,
+	error: 3
+};
+function levelRank(level) {
+	return level === "debug" || level === "info" || level === "warn" || level === "error" ? LEVEL_RANK[level] : LEVEL_RANK.info;
+}
+/** `provider@1.2.3` / `audio-codec::native-device-ops` → the manifest id. */
+function bareAddonOf(raw) {
+	if (typeof raw !== "string" || raw.length === 0) return null;
+	let bare = raw.split("@")[0] ?? raw;
+	const colon = bare.indexOf("::");
+	if (colon >= 0) bare = bare.slice(0, colon);
+	return bare;
+}
+/** The node a line is attributed to for the `nodeId` filter and the block index. */
+function originNodeOf(tags) {
+	const agentId = tags?.["agentId"];
+	if (typeof agentId === "string" && agentId.length > 0) return agentId;
+	const nodeId = tags?.["nodeId"];
+	if (typeof nodeId === "string" && nodeId.length > 0) {
+		const slash = nodeId.indexOf("/");
+		return slash === -1 ? nodeId : nodeId.slice(0, slash);
+	}
+	return null;
+}
+function nodeMatches(tags, want) {
+	if (tags === void 0) return false;
+	const agentId = tags["agentId"];
+	const nodeId = tags["nodeId"];
+	if (agentId === want || nodeId === want) return true;
+	return typeof nodeId === "string" && nodeId.startsWith(`${want}/`);
+}
+function stringifyValue(value) {
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	try {
+		return JSON.stringify(value) ?? "";
+	} catch {
+		return String(value);
+	}
+}
+/** Case-insensitive substring over message, scope, every tag value and every meta value. */
+function lineContainsText(line, needleLower) {
+	if (line.message.toLowerCase().includes(needleLower)) return true;
+	if (line.scope !== void 0 && line.scope.toLowerCase().includes(needleLower)) return true;
+	for (const bag of [line.tags, line.meta]) {
+		if (bag === void 0) continue;
+		for (const value of Object.values(bag)) {
+			if (value === void 0 || value === null) continue;
+			if (stringifyValue(value).toLowerCase().includes(needleLower)) return true;
+		}
+	}
+	return false;
+}
+function compileLogFilter(query) {
+	const text = query.text?.trim() ?? "";
+	return {
+		deviceId: query.deviceId ?? null,
+		addonId: query.fromAddonId !== void 0 ? bareAddonOf(query.fromAddonId) : null,
+		nodeId: query.fromNodeId ?? null,
+		tags: query.tags ?? {},
+		levelFloor: query.level !== void 0 ? LEVEL_RANK[query.level] : 0,
+		textLower: text.length > 0 ? text.toLowerCase() : null,
+		since: query.since ?? null,
+		until: query.until ?? null
+	};
+}
+/** Exact match of one line against the whole filter. */
+function lineMatches(line, filter) {
+	if (levelRank(line.level) < filter.levelFloor) return false;
+	if (filter.since !== null && line.timestamp < filter.since) return false;
+	if (filter.until !== null && line.timestamp > filter.until) return false;
+	const tags = line.tags;
+	if (filter.deviceId !== null && tags?.["deviceId"] !== filter.deviceId) return false;
+	if (filter.addonId !== null && bareAddonOf(tags?.["addonId"]) !== filter.addonId) return false;
+	if (filter.nodeId !== null && !nodeMatches(tags, filter.nodeId)) return false;
+	for (const [key, want] of Object.entries(filter.tags)) {
+		const have = tags?.[key];
+		if (have !== want && !(typeof have === "number" && String(have) === String(want))) return false;
+	}
+	if (filter.textLower !== null && !lineContainsText(line, filter.textLower)) return false;
+	return true;
+}
+/** True when the filter constrains nothing — every line matches. */
+function filterIsEmpty(filter) {
+	return filter.deviceId === null && filter.addonId === null && filter.nodeId === null && Object.keys(filter.tags).length === 0 && filter.levelFloor === 0 && filter.textLower === null && filter.since === null && filter.until === null;
+}
+//#endregion
+Object.defineProperty(exports, "bareAddonOf", {
+	enumerable: true,
+	get: function() {
+		return bareAddonOf;
+	}
+});
+Object.defineProperty(exports, "compileLogFilter", {
+	enumerable: true,
+	get: function() {
+		return compileLogFilter;
+	}
+});
+Object.defineProperty(exports, "filterIsEmpty", {
+	enumerable: true,
+	get: function() {
+		return filterIsEmpty;
+	}
+});
+Object.defineProperty(exports, "levelRank", {
+	enumerable: true,
+	get: function() {
+		return levelRank;
+	}
+});
+Object.defineProperty(exports, "lineContainsText", {
+	enumerable: true,
+	get: function() {
+		return lineContainsText;
+	}
+});
+Object.defineProperty(exports, "lineMatches", {
+	enumerable: true,
+	get: function() {
+		return lineMatches;
+	}
+});
+Object.defineProperty(exports, "originNodeOf", {
+	enumerable: true,
+	get: function() {
+		return originNodeOf;
+	}
+});

package/dist/log-read-filter-D7Ev3zm-.mjs

@@ -0,0 +1,93 @@
+//#region src/logging/log-read-filter.ts
+var LEVEL_RANK = {
+	debug: 0,
+	info: 1,
+	warn: 2,
+	error: 3
+};
+function levelRank(level) {
+	return level === "debug" || level === "info" || level === "warn" || level === "error" ? LEVEL_RANK[level] : LEVEL_RANK.info;
+}
+/** `provider@1.2.3` / `audio-codec::native-device-ops` → the manifest id. */
+function bareAddonOf(raw) {
+	if (typeof raw !== "string" || raw.length === 0) return null;
+	let bare = raw.split("@")[0] ?? raw;
+	const colon = bare.indexOf("::");
+	if (colon >= 0) bare = bare.slice(0, colon);
+	return bare;
+}
+/** The node a line is attributed to for the `nodeId` filter and the block index. */
+function originNodeOf(tags) {
+	const agentId = tags?.["agentId"];
+	if (typeof agentId === "string" && agentId.length > 0) return agentId;
+	const nodeId = tags?.["nodeId"];
+	if (typeof nodeId === "string" && nodeId.length > 0) {
+		const slash = nodeId.indexOf("/");
+		return slash === -1 ? nodeId : nodeId.slice(0, slash);
+	}
+	return null;
+}
+function nodeMatches(tags, want) {
+	if (tags === void 0) return false;
+	const agentId = tags["agentId"];
+	const nodeId = tags["nodeId"];
+	if (agentId === want || nodeId === want) return true;
+	return typeof nodeId === "string" && nodeId.startsWith(`${want}/`);
+}
+function stringifyValue(value) {
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	try {
+		return JSON.stringify(value) ?? "";
+	} catch {
+		return String(value);
+	}
+}
+/** Case-insensitive substring over message, scope, every tag value and every meta value. */
+function lineContainsText(line, needleLower) {
+	if (line.message.toLowerCase().includes(needleLower)) return true;
+	if (line.scope !== void 0 && line.scope.toLowerCase().includes(needleLower)) return true;
+	for (const bag of [line.tags, line.meta]) {
+		if (bag === void 0) continue;
+		for (const value of Object.values(bag)) {
+			if (value === void 0 || value === null) continue;
+			if (stringifyValue(value).toLowerCase().includes(needleLower)) return true;
+		}
+	}
+	return false;
+}
+function compileLogFilter(query) {
+	const text = query.text?.trim() ?? "";
+	return {
+		deviceId: query.deviceId ?? null,
+		addonId: query.fromAddonId !== void 0 ? bareAddonOf(query.fromAddonId) : null,
+		nodeId: query.fromNodeId ?? null,
+		tags: query.tags ?? {},
+		levelFloor: query.level !== void 0 ? LEVEL_RANK[query.level] : 0,
+		textLower: text.length > 0 ? text.toLowerCase() : null,
+		since: query.since ?? null,
+		until: query.until ?? null
+	};
+}
+/** Exact match of one line against the whole filter. */
+function lineMatches(line, filter) {
+	if (levelRank(line.level) < filter.levelFloor) return false;
+	if (filter.since !== null && line.timestamp < filter.since) return false;
+	if (filter.until !== null && line.timestamp > filter.until) return false;
+	const tags = line.tags;
+	if (filter.deviceId !== null && tags?.["deviceId"] !== filter.deviceId) return false;
+	if (filter.addonId !== null && bareAddonOf(tags?.["addonId"]) !== filter.addonId) return false;
+	if (filter.nodeId !== null && !nodeMatches(tags, filter.nodeId)) return false;
+	for (const [key, want] of Object.entries(filter.tags)) {
+		const have = tags?.[key];
+		if (have !== want && !(typeof have === "number" && String(have) === String(want))) return false;
+	}
+	if (filter.textLower !== null && !lineContainsText(line, filter.textLower)) return false;
+	return true;
+}
+/** True when the filter constrains nothing — every line matches. */
+function filterIsEmpty(filter) {
+	return filter.deviceId === null && filter.addonId === null && filter.nodeId === null && Object.keys(filter.tags).length === 0 && filter.levelFloor === 0 && filter.textLower === null && filter.since === null && filter.until === null;
+}
+//#endregion
+export { lineContainsText as a, levelRank as i, compileLogFilter as n, lineMatches as o, filterIsEmpty as r, originNodeOf as s, bareAddonOf as t };

package/dist/logging/log-manager.d.ts

@@ -2,12 +2,8 @@ import { type LogEntry, type LogFilter, type LogLevel } from "./log-ring-buffer.
 import type { LoggingGate } from "./logging-gate.js";
 import { type PartitionedLogBufferOptions } from "./partitioned-log-buffer.js";
 import { type IScopedLogger } from "./scoped-logger.js";
-export interface ILogDestination {
-	initialize(): Promise<void>;
-	shutdown(): Promise<void>;
-	write(entry: LogEntry): void;
-	query?(filter: LogFilter): Promise<readonly LogEntry[]>;
-}
+import type { ILogDestination } from "@camstack/types";
+export type { ILogDestination };
 /**
 * The reserved destination id of the in-memory buffer. Not an addon: the
 * buffer must exist before any addon loads (boot lines) and it backs
@@ -62,6 +58,14 @@ export declare class LogManager {
 	*/
 	private gate;
 	/**
+	* Entry identity (D898): `<bootId>.<seq>`, stamped once, here, on every line
+	* this process accepts — so the in-memory tail, the live subscription and
+	* the rotated file carry the SAME id and a page read from disk dedupes
+	* exactly against the lines pushed live.
+	*/
+	private readonly bootId;
+	private seq;
+	/**
 	* `perAddonCapacity` bounds EACH addon's bucket, not the total — a chatty addon
 	* evicts only its own lines, so quiet addons keep their sparse history.
 	*

package/dist/logging/log-read-filter.d.ts

@@ -0,0 +1,43 @@
+/**
+* The ONE definition of "does this line match a history read" (D898).
+*
+* Used by every reader — the rotated-file reader in its worker, the Loki
+* reader after LogQL has narrowed the stream, and the hub's in-memory tail —
+* so the same query cannot mean three different things on three sources.
+*
+* It is deliberately free of value imports: the file reader runs it inside a
+* bare worker thread.
+*/
+import type { LogReadQuery } from "@camstack/types";
+/** A structurally-typed line: a parsed file row, a ring entry or a Loki line. */
+export interface ReadableLine {
+	readonly timestamp: number;
+	readonly level: string;
+	readonly message: string;
+	readonly scope?: string | undefined;
+	readonly tags?: Readonly<Record<string, unknown>> | undefined;
+	readonly meta?: Readonly<Record<string, unknown>> | undefined;
+}
+export declare function levelRank(level: string): number;
+/** `provider@1.2.3` / `audio-codec::native-device-ops` → the manifest id. */
+export declare function bareAddonOf(raw: unknown): string | null;
+/** The node a line is attributed to for the `nodeId` filter and the block index. */
+export declare function originNodeOf(tags: Readonly<Record<string, unknown>> | undefined): string | null;
+/** Case-insensitive substring over message, scope, every tag value and every meta value. */
+export declare function lineContainsText(line: ReadableLine, needleLower: string): boolean;
+/** The filter half of a {@link LogReadQuery}, normalised once per read. */
+export interface CompiledLogFilter {
+	readonly deviceId: number | null;
+	readonly addonId: string | null;
+	readonly nodeId: string | null;
+	readonly tags: Readonly<Record<string, string | number>>;
+	readonly levelFloor: number;
+	readonly textLower: string | null;
+	readonly since: number | null;
+	readonly until: number | null;
+}
+export declare function compileLogFilter(query: LogReadQuery): CompiledLogFilter;
+/** Exact match of one line against the whole filter. */
+export declare function lineMatches(line: ReadableLine, filter: CompiledLogFilter): boolean;
+/** True when the filter constrains nothing — every line matches. */
+export declare function filterIsEmpty(filter: CompiledLogFilter): boolean;

package/dist/{phase6-declare-gate-DrmTtz7F.js → phase6-declare-gate-BO-_jLh_.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DjQ8C-ku.js");
+const require_dist = require("./dist-C89nqNnn.js");
 //#region src/builtins/records/legacy-table-row-count.ts
 /** Row count for a physical settings-db table (matches the records engine `legacyRowCount`). */
 function legacyTableRowCountFromList(tables, collection) {

package/dist/{phase6-declare-gate-JQUqgQgq.mjs → phase6-declare-gate-x9ZCbQJP.mjs}

@@ -1,4 +1,4 @@
-import { Fi as declarationsOf } from "./dist-BpSENkRJ.mjs";
+import { Wi as declarationsOf } from "./dist-Dhux90yB.mjs";
 //#region src/builtins/records/legacy-table-row-count.ts
 /** Row count for a physical settings-db table (matches the records engine `legacyRowCount`). */
 function legacyTableRowCountFromList(tables, collection) {

package/dist/{restore-archive-4OP0EYg6.js → restore-archive-4DOUR5Gu.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DjQ8C-ku.js");
+const require_dist = require("./dist-C89nqNnn.js");
 const require_read_all_rows$1 = require("./read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/{restore-archive-YFSJRtKy.mjs → restore-archive-DyOaPeAr.mjs}

@@ -1,4 +1,4 @@
-import { Li as defineRecordKinds, j as DataStoreDatabaseSchema, x as DATABASE_SNAPSHOT_SUFFIX } from "./dist-BpSENkRJ.mjs";
+import { Ki as defineRecordKinds, N as DataStoreDatabaseSchema, S as DATABASE_SNAPSHOT_SUFFIX } from "./dist-Dhux90yB.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";

package/dist/tls/cert-issue.d.ts

@@ -3,6 +3,19 @@ import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
 import type { CertIdentity } from "./cert-identity.js";
 /** Subject of the local root. Distinct from the leaf's CN by construction. */
 export declare const CA_COMMON_NAME = "CamStack Local CA";
+/** Between {@link CA_COMMON_NAME} and the hub's name in a new root's subject. */
+export declare const CA_HUB_NAME_SEPARATOR = " — ";
+/**
+* The subject CN of a NEW local root: `CamStack Local CA — <hub name>`, so two hubs'
+* roots installed on one phone can be told apart in its settings. The name is
+* sanitised for a CN (controls removed, whitespace collapsed) and cut so the whole
+* CN stays within 64 characters. An absent or unusable name, or one that is just
+* the product's own name, yields the plain {@link CA_COMMON_NAME}.
+*
+* Only a root being CREATED is named: an existing root is never reissued to rename
+* it, since every device that trusts it would have to install it again.
+*/
+export declare function localCaCommonName(hubName: string | undefined): string;
 /** A PEM-encoded certificate and the PKCS#8 PEM of its private key. */
 export interface CertMaterial {
 	readonly certPem: string;
@@ -23,8 +36,10 @@ export interface CaSigner {
 * It carries a CRITICAL `nameConstraints` extension (D873): private address
 * ranges and local-only DNS names, plus `hostnames` (the hub's own single-label
 * names at creation). A leaked key therefore cannot vouch for a public site.
+*
+* `commonName` is the subject CN, from {@link localCaCommonName}.
 */
-export declare function generateCa(now: Date, hostnames?: readonly string[]): Promise<CaSigner>;
+export declare function generateCa(now: Date, hostnames?: readonly string[], commonName?: string): Promise<CaSigner>;
 /** Re-open a root already on disk so a leaf can be issued under it. */
 export declare function loadCa(certPem: string, keyPem: string): Promise<CaSigner>;
 /**

package/dist/tls/cert-manager.d.ts

@@ -41,6 +41,12 @@ export interface EnsureTlsResult {
 export interface CertOptions {
 	/** Common Name for the leaf (default: 'camstack.local') */
 	readonly commonName?: string;
+	/**
+	* The hub's human name (D861). Read only when a NEW local root is created: its subject
+	* becomes `CamStack Local CA — <hubName>` ({@link localCaCommonName}). An existing root
+	* is never reissued because this changed. Absent: the plain `CamStack Local CA`.
+	*/
+	readonly hubName?: string;
 	/** Leaf validity in days. Clamped to `MAX_LEAF_VALIDITY_DAYS`. */
 	readonly validDays?: number;
 	/** Additional SANs (DNS names or IPs). Required coverage by definition. */

package/dist/tls/index.d.ts

@@ -3,7 +3,7 @@ export { type CertIdentity, type CertOptions, type HostFacts, type CertRegenerat
 export { type BootTls, type BootTlsMode, prepareBootTls } from "./boot-tls.js";
 export { clearHttpsListener, type HttpsReloadOutcome, leafFingerprintOf, registerHttpsListener, reloadHttpsListener, servedHttpsLeafFingerprint } from "./https-listener.js";
 export { applyCertificateToListener, regenerateCertificate, revertToGeneratedCertificate, storeUploadedCertificate, type UploadCertificateInput, useStoredUploadedCertificate } from "./tls-actions.js";
-export { CA_COMMON_NAME } from "./cert-issue.js";
+export { CA_COMMON_NAME, localCaCommonName } from "./cert-issue.js";
 export { checkUploadedCa, chainsToPublicRoot, validateUploadedTls, type UploadedCaCheck, type UploadedTlsErrorCode, type UploadedTlsValidation } from "./uploaded-cert.js";
 export { buildNameConstraintSet, isConstrainedCa, type NameConstraintSet, permitsIdentity, permitsName, readNameConstraints, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES } from "./cert-name-constraints.js";
 export { type StoredUploadInfo, type TlsAccessStatus, readTlsAccessStatus, splitPemCertificates, UPLOADED_CA_FILE, writeTlsMode, readTlsMode, readExtraSans, writeExtraSans } from "./tls-status.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.455",
+  "version": "1.2.457",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",

package/dist/auth/admin-token-manager.d.ts

@@ -1,51 +0,0 @@
-import type { CollectionColumn, RecordKindHandle, SettingsStoreClient } from "@camstack/types";
-import type { AdminTokenBody } from "../builtins/local-auth/record-kinds.js";
-/**
-* @durable class=config owner=local-auth
-*   write="an admin creates a token (after re-authentication); `lastUsedAt` is
-*     rewritten at most once a minute while it is used; `revoke` stamps revokedAt"
-*   retention="the daily reap deletes rows expired or revoked more than 30 days ago"
-*/
-export declare const ADMIN_TOKENS_COLLECTION = "admin_tokens";
-export declare const ADMIN_TOKENS_COLUMNS: readonly CollectionColumn[];
-export declare const ADMIN_TOKEN_PREFIX = "csa_";
-export declare const ADMIN_TOKEN_MAX_LIFETIME_MS: number;
-export interface AdminTokenRecord {
-	readonly id: string;
-	readonly createdBy: string;
-	readonly name: string;
-	readonly tokenPrefix: string;
-	readonly createdAt: number;
-	readonly expiresAt: number;
-	readonly lastUsedAt: number | null;
-	readonly revokedAt: number | null;
-}
-export interface AdminTokenRecordsDeps {
-	readonly adminTokensKind: RecordKindHandle<AdminTokenBody>;
-	readonly store?: SettingsStoreClient;
-}
-export declare class AdminTokenManager {
-	private readonly now;
-	private readonly kind;
-	private readonly store;
-	constructor(deps: SettingsStoreClient | AdminTokenRecordsDeps, now?: () => number);
-	/** Mint a token for `createdBy`. Refuses an expiry in the past or past 90 days. */
-	create(input: {
-		readonly createdBy: string;
-		readonly name: string;
-		readonly expiresAt: number;
-	}): Promise<{
-		readonly token: string;
-		readonly record: AdminTokenRecord;
-	}>;
-	/** The live record behind `token`, or `null` (unknown, revoked, expired, not a `csa_`). */
-	validate(token: string): Promise<AdminTokenRecord | null>;
-	/** Every token not yet reaped, newest first (no hashes). */
-	list(): Promise<readonly AdminTokenRecord[]>;
-	/** Revoke one token. `false` when unknown or already revoked. */
-	revoke(id: string): Promise<boolean>;
-	/** Revoke every live token `userId` created (the user was deleted). */
-	revokeAllCreatedBy(userId: string): Promise<number>;
-	/** Delete rows expired or revoked more than 30 days ago. */
-	reap(): Promise<number>;
-}

package/dist/auth/scoped-token-manager.d.ts

@@ -1,25 +0,0 @@
-import type { RecordKindHandle, ScopedToken, TokenScope, SettingsStoreClient } from "@camstack/types";
-import type { ScopedTokenBody } from "../builtins/local-auth/record-kinds.js";
-export interface ScopedTokenRecordsDeps {
-	readonly scopedTokensKind: RecordKindHandle<ScopedTokenBody>;
-	readonly legacyStore?: SettingsStoreClient;
-}
-/**
-* Manages scoped API tokens with restricted addon/route/capability access.
-*/
-export declare class ScopedTokenManager {
-	private readonly kind;
-	private readonly store;
-	constructor(deps: SettingsStoreClient | ScopedTokenRecordsDeps);
-	create(userId: string, name: string, scopes: TokenScope[], expiresAt?: number): Promise<{
-		token: string;
-		record: ScopedToken;
-	}>;
-	validate(rawToken: string): Promise<ScopedToken | null>;
-	matchesScope(token: ScopedToken, addonId?: string, capability?: string): boolean;
-	revoke(tokenId: string): Promise<boolean>;
-	listForUser(userId: string): Promise<ScopedToken[]>;
-	updateLastUsed(tokenId: string): Promise<void>;
-	reapExpired(nowMs?: number): Promise<number>;
-	cleanupOrphans(validUserIds: ReadonlySet<string>): Promise<number>;
-}