@camstack/system 1.2.457 → 1.2.459

package/dist/builtins/alerts/alerts.addon.js

@@ -3,9 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-Bn-RNanh.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_phase6_declare_gate = require("../../phase6-declare-gate-BO-_jLh_.js");
 //#region src/builtins/alerts/alert-episode-policy.ts
 /**
 * When does an alert open a new EPISODE, and which edge of it is announced?
@@ -225,7 +224,7 @@ var import_read_all_rows = require_read_all_rows$1.require_read_all_rows();
 /**
 * Record kinds owned by alert-center (records plan phase 4).
 */
-/** Legacy collection / adoptsFrom target (canonical KV before phase 4). */
+/** The legacy collection the kind replaced (canonical KV before phase 4); read only without records. */
 var ALERTS_COLLECTION = "alerts";
 var AlertBodySchema = require_dist.AlertSchema.omit({ id: true });
 var _alertCenterRecordKinds = require_dist.defineRecordKinds({ alerts: {
@@ -251,8 +250,7 @@ var _alertCenterRecordKinds = require_dist.defineRecordKinds({ alerts: {
 	retention: {
 		owner: "alert-center",
 		reason: "maxAlerts cap and retentionDays enforced on write (enforceMaxAlerts / enforceRetention); read alerts preferred when trimming overflow"
-	},
-	adoptsFrom: ALERTS_COLLECTION
+	}
 } });
 var alertCenterRecordKinds = _alertCenterRecordKinds;
 /** Narrow kind for `records.kind()` — `IsolatedRecordKinds` string index is `| undefined`. */
@@ -644,8 +642,8 @@ var AlertCenterAddon = class extends require_dist.BaseAddon {
 	async onInitialize() {
 		const records = this.ctx.records;
 		const store = this.ctx.api?.settingsStore;
-		const useRecords = records !== void 0 && store !== void 0 && await require_phase6_declare_gate.resolvePhase6UseRecordsPathForHub(this.ctx, "alert-center", alertCenterRecordKinds, ["alerts"]);
-		this.alertStore = useRecords && records !== void 0 ? AlertStore.of(records) : store === void 0 ? null : AlertStore.legacy(store);
+		if (records !== void 0) await records.declare(alertCenterRecordKinds);
+		this.alertStore = records !== void 0 ? AlertStore.of(records) : store === void 0 ? null : AlertStore.legacy(store);
 		if (this.alertStore === null) throw new Error("alert-center needs ctx.records or settings-store on the hub");
 		const alertsProvider = {
 			emit: (alert) => this.emitAlert(alert),

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,6 +1,5 @@
-import { Ct as alertEpisodePayload, Hi as createEvent, Ki as defineRecordKinds, Oa as EventCategory, Sn as isAlertEpisodeSeverity, St as alertEpisodeId, i as AlertSchema, ni as BaseAddon, ti as errMsg, wt as alertsCapability, xn as isAlertEpisodeOpen } from "../../dist-Dhux90yB.mjs";
+import { Ct as alertEpisodePayload, Gi as defineRecordKinds, Hi as createEvent, Sn as isAlertEpisodeSeverity, St as alertEpisodeId, Ta as EventCategory, i as AlertSchema, ni as BaseAddon, ti as errMsg, wt as alertsCapability, xn as isAlertEpisodeOpen } from "../../dist-Wy8cTxg6.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-x9ZCbQJP.mjs";
 //#region src/builtins/alerts/alert-episode-policy.ts
 /**
 * When does an alert open a new EPISODE, and which edge of it is announced?
@@ -220,7 +219,7 @@ var import_read_all_rows = require_read_all_rows();
 /**
 * Record kinds owned by alert-center (records plan phase 4).
 */
-/** Legacy collection / adoptsFrom target (canonical KV before phase 4). */
+/** The legacy collection the kind replaced (canonical KV before phase 4); read only without records. */
 var ALERTS_COLLECTION = "alerts";
 var _alertCenterRecordKinds = defineRecordKinds({ alerts: {
 	schema: AlertSchema.omit({ id: true }),
@@ -245,8 +244,7 @@ var _alertCenterRecordKinds = defineRecordKinds({ alerts: {
 	retention: {
 		owner: "alert-center",
 		reason: "maxAlerts cap and retentionDays enforced on write (enforceMaxAlerts / enforceRetention); read alerts preferred when trimming overflow"
-	},
-	adoptsFrom: ALERTS_COLLECTION
+	}
 } });
 var alertCenterRecordKinds = _alertCenterRecordKinds;
 /** Narrow kind for `records.kind()` — `IsolatedRecordKinds` string index is `| undefined`. */
@@ -638,8 +636,8 @@ var AlertCenterAddon = class extends BaseAddon {
 	async onInitialize() {
 		const records = this.ctx.records;
 		const store = this.ctx.api?.settingsStore;
-		const useRecords = records !== void 0 && store !== void 0 && await resolvePhase6UseRecordsPathForHub(this.ctx, "alert-center", alertCenterRecordKinds, ["alerts"]);
-		this.alertStore = useRecords && records !== void 0 ? AlertStore.of(records) : store === void 0 ? null : AlertStore.legacy(store);
+		if (records !== void 0) await records.declare(alertCenterRecordKinds);
+		this.alertStore = records !== void 0 ? AlertStore.of(records) : store === void 0 ? null : AlertStore.legacy(store);
 		if (this.alertStore === null) throw new Error("alert-center needs ctx.records or settings-store on the hub");
 		const alertsProvider = {
 			emit: (alert) => this.emitAlert(alert),

package/dist/builtins/alerts/record-kinds.d.ts

@@ -3,7 +3,7 @@
 */
 import { type Alert, type DefinedRecordKind } from "@camstack/types";
 import { z } from "zod";
-/** Legacy collection / adoptsFrom target (canonical KV before phase 4). */
+/** The legacy collection the kind replaced (canonical KV before phase 4); read only without records. */
 export declare const ALERTS_COLLECTION = "alerts";
 export type AlertBody = Omit<Alert, "id">;
 export declare const AlertBodySchema: z.ZodType<AlertBody>;

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-Bn-RNanh.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { $i as isEvent, L as FIRST_LEVEL_MACRO_CLASSES, Oa as EventCategory, Ot as bareAddonId, ni as BaseAddon, rr as ptzAutotrackCapability, ti as errMsg } from "../../dist-Dhux90yB.mjs";
+import { L as FIRST_LEVEL_MACRO_CLASSES, Ot as bareAddonId, Qi as isEvent, Ta as EventCategory, ni as BaseAddon, rr as ptzAutotrackCapability, ti as errMsg } from "../../dist-Wy8cTxg6.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-Bn-RNanh.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_restore_archive = require("../../restore-archive-4DOUR5Gu.js");
+const require_restore_archive = require("../../restore-archive-DM1OBYq4.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -85,6 +85,81 @@ async function seedWeeklySchedule(store, markers) {
 	return seed;
 }
 //#endregion
+//#region src/builtins/backup-orchestrator/seed-marker-store.ts
+/**
+* @durable class=config owner=backup-orchestrator
+*   write="the orchestrator inserts one row per seed id the first time that
+*     seed is created (or found already created); never updated"
+*   retention="none — one tiny row per seed ever made; deleting it lets the
+*     seed be re-created once more on the next boot"
+*/
+var BACKUP_SEED_MARKERS_COLLECTION = "backup_seed_markers";
+var COLUMNS$1 = [{
+	name: "seed_id",
+	type: "TEXT",
+	primaryKey: true
+}, {
+	name: "seeded_at",
+	type: "INTEGER",
+	notNull: true
+}];
+var BackupSeedMarkerStore = class {
+	store;
+	now;
+	declared = false;
+	markersKind;
+	constructor(store, now = Date.now, markersKind = null) {
+		this.store = store;
+		this.now = now;
+		this.markersKind = markersKind;
+	}
+	async ensureDeclared() {
+		if (this.markersKind !== null) return;
+		if (this.declared) return;
+		await this.store.declareCollection({
+			collection: BACKUP_SEED_MARKERS_COLLECTION,
+			columns: COLUMNS$1
+		});
+		this.declared = true;
+	}
+	async has(seedId) {
+		await this.ensureDeclared();
+		const kind = this.markersKind;
+		if (kind !== null) return await kind.get(seedId) !== null;
+		return (await this.store.query({
+			collection: BACKUP_SEED_MARKERS_COLLECTION,
+			filter: {
+				where: { seed_id: seedId },
+				limit: 1
+			}
+		})).length > 0;
+	}
+	async mark(seedId) {
+		await this.ensureDeclared();
+		if (await this.has(seedId)) return;
+		const kind = this.markersKind;
+		if (kind !== null) {
+			const body = { seededAt: this.now() };
+			const data = require_restore_archive.backupOrchestratorRecordKinds["seed-markers"].schema.parse(body);
+			await kind.put({
+				id: seedId,
+				data
+			});
+			return;
+		}
+		await this.store.insert({
+			collection: BACKUP_SEED_MARKERS_COLLECTION,
+			record: {
+				id: seedId,
+				data: {
+					seed_id: seedId,
+					seeded_at: this.now()
+				}
+			}
+		});
+	}
+};
+//#endregion
 //#region ../../node_modules/croner/dist/croner.js
 function T(s) {
 	return Date.UTC(s.y, s.m - 1, s.d, s.h, s.i, s.s);
@@ -1209,6 +1284,169 @@ async function downloadArchiveToCache(input) {
 	}
 }
 //#endregion
+//#region src/builtins/backup-orchestrator/encryption-key-store.ts
+/**
+* @durable class=config owner=backup-orchestrator
+*   write="`setupEncryption` inserts one row per generated key and retires the
+*     previous active row; `disableEncryption` retires the active row"
+*   retention="none — one small row per key ever generated; a retired row
+*     names the key older archives need"
+*/
+var BACKUP_ENCRYPTION_KEYS_COLLECTION = "backup_encryption_keys";
+var COLUMNS = [
+	{
+		name: "key_id",
+		type: "TEXT",
+		primaryKey: true
+	},
+	{
+		name: "public_key",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "created_at",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "retired_at",
+		type: "INTEGER"
+	}
+];
+var BackupEncryptionKeyStore = class {
+	store;
+	now;
+	declared = false;
+	keysKind;
+	constructor(store, now = Date.now, keysKind = null) {
+		this.store = store;
+		this.now = now;
+		this.keysKind = keysKind;
+	}
+	async ensureDeclared() {
+		if (this.keysKind !== null) return;
+		if (this.declared) return;
+		await this.store.declareCollection({
+			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
+			columns: COLUMNS
+		});
+		this.declared = true;
+	}
+	/** Every key, newest first. */
+	async list() {
+		await this.ensureDeclared();
+		const kind = this.keysKind;
+		if (kind !== null) {
+			const rows = await (0, import_read_all_rows.readAllRows)(kind);
+			rows.sort((a, b) => b.data.createdAt - a.data.createdAt);
+			const out = [];
+			for (const row of rows) {
+				const record = bodyToRecord(row.id, row.data);
+				if (record !== null) out.push(record);
+			}
+			return out;
+		}
+		const rows = await this.store.query({
+			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
+			filter: { orderBy: {
+				field: "created_at",
+				direction: "desc"
+			} }
+		});
+		const out = [];
+		for (const row of rows) {
+			const record = toRecord(row.data);
+			if (record !== null) out.push(record);
+		}
+		return out;
+	}
+	/** The key new archives are encrypted to; `null` = encryption off. */
+	async active() {
+		return (await this.list()).find((k) => k.retiredAt === null) ?? null;
+	}
+	/** Make `publicKey` the active key; the previous one is retired, kept listed. */
+	async activate(input) {
+		const parsed = require_restore_archive.parseBackupPublicKey(input.publicKey);
+		const t = this.now();
+		await this.retireActive(t);
+		const record = {
+			keyId: parsed.keyId,
+			publicKey: input.publicKey.trim(),
+			createdAt: t,
+			retiredAt: null
+		};
+		await this.write(record);
+		return record;
+	}
+	/** Encryption off: the active key is retired. Archives already made keep needing it. */
+	async disable() {
+		await this.retireActive(this.now());
+	}
+	async retireActive(at) {
+		for (const key of await this.list()) if (key.retiredAt === null) await this.write({
+			...key,
+			retiredAt: at
+		});
+	}
+	async write(record) {
+		await this.ensureDeclared();
+		const kind = this.keysKind;
+		if (kind !== null) {
+			const body = {
+				keyId: record.keyId,
+				publicKey: record.publicKey,
+				createdAt: record.createdAt,
+				retiredAt: record.retiredAt
+			};
+			const data = require_restore_archive.backupOrchestratorRecordKinds["encryption-keys"].schema.parse(body);
+			await kind.put({
+				id: record.keyId,
+				data
+			});
+			return;
+		}
+		await this.store.deleteWhere({
+			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
+			filter: { where: { key_id: record.keyId } }
+		});
+		await this.store.insert({
+			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
+			record: {
+				id: record.keyId,
+				data: {
+					key_id: record.keyId,
+					public_key: record.publicKey,
+					created_at: record.createdAt,
+					retired_at: record.retiredAt
+				}
+			}
+		});
+	}
+};
+function bodyToRecord(keyId, body) {
+	if (!keyId) return null;
+	return {
+		keyId: body.keyId,
+		publicKey: body.publicKey,
+		createdAt: body.createdAt,
+		retiredAt: body.retiredAt
+	};
+}
+function toRecord(row) {
+	const keyId = row["key_id"];
+	const publicKey = row["public_key"];
+	const createdAt = row["created_at"];
+	if (typeof keyId !== "string" || typeof publicKey !== "string") return null;
+	const retired = row["retired_at"];
+	return {
+		keyId,
+		publicKey,
+		createdAt: typeof createdAt === "number" ? createdAt : Number(createdAt ?? 0),
+		retiredAt: typeof retired === "number" ? retired : null
+	};
+}
+//#endregion
 //#region src/builtins/backup-orchestrator/manifest-store.ts
 /** File path (relative to the location root) where the index lives. */
 var MANIFESTS_FILENAME = "manifests.json";
@@ -2194,7 +2432,7 @@ var BackupOrchestratorAddon = class extends require_dist.BaseAddon {
 		}
 		await this.seedWeekly();
 		const settingsStore = this.ctx.kernel.capabilityRegistry?.getSingleton("settings-store");
-		this.encryptionKeys = settingsStore ? new require_restore_archive.BackupEncryptionKeyStore(settingsStore, Date.now, this.backupRecords?.encryptionKeys ?? null) : null;
+		this.encryptionKeys = settingsStore ? new BackupEncryptionKeyStore(settingsStore, Date.now, this.backupRecords?.encryptionKeys ?? null) : null;
 		const provider = {
 			listDestinations: () => this.listDestinations(),
 			list: () => this.aggregatedList(),
@@ -3197,7 +3435,7 @@ var BackupOrchestratorAddon = class extends require_dist.BaseAddon {
 		try {
 			const store = this.ctx.kernel.capabilityRegistry?.getSingleton("settings-store");
 			if (!store) return;
-			const seed = await seedWeeklySchedule(this.schedules, new require_restore_archive.BackupSeedMarkerStore(store, Date.now, this.backupRecords?.seedMarkers ?? null));
+			const seed = await seedWeeklySchedule(this.schedules, new BackupSeedMarkerStore(store, Date.now, this.backupRecords?.seedMarkers ?? null));
 			if (seed === null) return;
 			this.ctx.logger.info("backup: seeded the weekly events & history schedule", { meta: {
 				scheduleId: seed.id,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,6 +1,6 @@
-import { Ca as toNodeId, Dt as backupCapability, Oa as EventCategory, Or as storageOccupancyCapability, Un as mayWriteToLocation, ni as BaseAddon, sa as nodePin } from "../../dist-Dhux90yB.mjs";
+import { Dt as backupCapability, Or as storageOccupancyCapability, Ta as EventCategory, Un as mayWriteToLocation, ba as toNodeId, ni as BaseAddon, oa as nodePin } from "../../dist-Wy8cTxg6.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { _ as parseBackupSecretKey, a as BackupSnapshotRefusedError, c as backupOrchestratorRecordKinds, d as BackupEncryptionKeyStore, g as generateBackupKeyPair, h as ENCRYPTED_BACKUP_SUFFIX, i as BackupCancelledError, l as backupRecordStoresOf, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, u as BackupSeedMarkerStore } from "../../restore-archive-DyOaPeAr.mjs";
+import { _ as backupRecordStoresOf, a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-CmP-iiG9.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";
@@ -77,6 +77,81 @@ async function seedWeeklySchedule(store, markers) {
 	return seed;
 }
 //#endregion
+//#region src/builtins/backup-orchestrator/seed-marker-store.ts
+/**
+* @durable class=config owner=backup-orchestrator
+*   write="the orchestrator inserts one row per seed id the first time that
+*     seed is created (or found already created); never updated"
+*   retention="none — one tiny row per seed ever made; deleting it lets the
+*     seed be re-created once more on the next boot"
+*/
+var BACKUP_SEED_MARKERS_COLLECTION = "backup_seed_markers";
+var COLUMNS$1 = [{
+	name: "seed_id",
+	type: "TEXT",
+	primaryKey: true
+}, {
+	name: "seeded_at",
+	type: "INTEGER",
+	notNull: true
+}];
+var BackupSeedMarkerStore = class {
+	store;
+	now;
+	declared = false;
+	markersKind;
+	constructor(store, now = Date.now, markersKind = null) {
+		this.store = store;
+		this.now = now;
+		this.markersKind = markersKind;
+	}
+	async ensureDeclared() {
+		if (this.markersKind !== null) return;
+		if (this.declared) return;
+		await this.store.declareCollection({
+			collection: BACKUP_SEED_MARKERS_COLLECTION,
+			columns: COLUMNS$1
+		});
+		this.declared = true;
+	}
+	async has(seedId) {
+		await this.ensureDeclared();
+		const kind = this.markersKind;
+		if (kind !== null) return await kind.get(seedId) !== null;
+		return (await this.store.query({
+			collection: BACKUP_SEED_MARKERS_COLLECTION,
+			filter: {
+				where: { seed_id: seedId },
+				limit: 1
+			}
+		})).length > 0;
+	}
+	async mark(seedId) {
+		await this.ensureDeclared();
+		if (await this.has(seedId)) return;
+		const kind = this.markersKind;
+		if (kind !== null) {
+			const body = { seededAt: this.now() };
+			const data = backupOrchestratorRecordKinds["seed-markers"].schema.parse(body);
+			await kind.put({
+				id: seedId,
+				data
+			});
+			return;
+		}
+		await this.store.insert({
+			collection: BACKUP_SEED_MARKERS_COLLECTION,
+			record: {
+				id: seedId,
+				data: {
+					seed_id: seedId,
+					seeded_at: this.now()
+				}
+			}
+		});
+	}
+};
+//#endregion
 //#region ../../node_modules/croner/dist/croner.js
 function T(s) {
 	return Date.UTC(s.y, s.m - 1, s.d, s.h, s.i, s.s);
@@ -1201,6 +1276,169 @@ async function downloadArchiveToCache(input) {
 	}
 }
 //#endregion
+//#region src/builtins/backup-orchestrator/encryption-key-store.ts
+/**
+* @durable class=config owner=backup-orchestrator
+*   write="`setupEncryption` inserts one row per generated key and retires the
+*     previous active row; `disableEncryption` retires the active row"
+*   retention="none — one small row per key ever generated; a retired row
+*     names the key older archives need"
+*/
+var BACKUP_ENCRYPTION_KEYS_COLLECTION = "backup_encryption_keys";
+var COLUMNS = [
+	{
+		name: "key_id",
+		type: "TEXT",
+		primaryKey: true
+	},
+	{
+		name: "public_key",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "created_at",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "retired_at",
+		type: "INTEGER"
+	}
+];
+var BackupEncryptionKeyStore = class {
+	store;
+	now;
+	declared = false;
+	keysKind;
+	constructor(store, now = Date.now, keysKind = null) {
+		this.store = store;
+		this.now = now;
+		this.keysKind = keysKind;
+	}
+	async ensureDeclared() {
+		if (this.keysKind !== null) return;
+		if (this.declared) return;
+		await this.store.declareCollection({
+			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
+			columns: COLUMNS
+		});
+		this.declared = true;
+	}
+	/** Every key, newest first. */
+	async list() {
+		await this.ensureDeclared();
+		const kind = this.keysKind;
+		if (kind !== null) {
+			const rows = await (0, import_read_all_rows.readAllRows)(kind);
+			rows.sort((a, b) => b.data.createdAt - a.data.createdAt);
+			const out = [];
+			for (const row of rows) {
+				const record = bodyToRecord(row.id, row.data);
+				if (record !== null) out.push(record);
+			}
+			return out;
+		}
+		const rows = await this.store.query({
+			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
+			filter: { orderBy: {
+				field: "created_at",
+				direction: "desc"
+			} }
+		});
+		const out = [];
+		for (const row of rows) {
+			const record = toRecord(row.data);
+			if (record !== null) out.push(record);
+		}
+		return out;
+	}
+	/** The key new archives are encrypted to; `null` = encryption off. */
+	async active() {
+		return (await this.list()).find((k) => k.retiredAt === null) ?? null;
+	}
+	/** Make `publicKey` the active key; the previous one is retired, kept listed. */
+	async activate(input) {
+		const parsed = parseBackupPublicKey(input.publicKey);
+		const t = this.now();
+		await this.retireActive(t);
+		const record = {
+			keyId: parsed.keyId,
+			publicKey: input.publicKey.trim(),
+			createdAt: t,
+			retiredAt: null
+		};
+		await this.write(record);
+		return record;
+	}
+	/** Encryption off: the active key is retired. Archives already made keep needing it. */
+	async disable() {
+		await this.retireActive(this.now());
+	}
+	async retireActive(at) {
+		for (const key of await this.list()) if (key.retiredAt === null) await this.write({
+			...key,
+			retiredAt: at
+		});
+	}
+	async write(record) {
+		await this.ensureDeclared();
+		const kind = this.keysKind;
+		if (kind !== null) {
+			const body = {
+				keyId: record.keyId,
+				publicKey: record.publicKey,
+				createdAt: record.createdAt,
+				retiredAt: record.retiredAt
+			};
+			const data = backupOrchestratorRecordKinds["encryption-keys"].schema.parse(body);
+			await kind.put({
+				id: record.keyId,
+				data
+			});
+			return;
+		}
+		await this.store.deleteWhere({
+			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
+			filter: { where: { key_id: record.keyId } }
+		});
+		await this.store.insert({
+			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
+			record: {
+				id: record.keyId,
+				data: {
+					key_id: record.keyId,
+					public_key: record.publicKey,
+					created_at: record.createdAt,
+					retired_at: record.retiredAt
+				}
+			}
+		});
+	}
+};
+function bodyToRecord(keyId, body) {
+	if (!keyId) return null;
+	return {
+		keyId: body.keyId,
+		publicKey: body.publicKey,
+		createdAt: body.createdAt,
+		retiredAt: body.retiredAt
+	};
+}
+function toRecord(row) {
+	const keyId = row["key_id"];
+	const publicKey = row["public_key"];
+	const createdAt = row["created_at"];
+	if (typeof keyId !== "string" || typeof publicKey !== "string") return null;
+	const retired = row["retired_at"];
+	return {
+		keyId,
+		publicKey,
+		createdAt: typeof createdAt === "number" ? createdAt : Number(createdAt ?? 0),
+		retiredAt: typeof retired === "number" ? retired : null
+	};
+}
+//#endregion
 //#region src/builtins/backup-orchestrator/manifest-store.ts
 /** File path (relative to the location root) where the index lives. */
 var MANIFESTS_FILENAME = "manifests.json";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-Bn-RNanh.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts
@@ -31,13 +31,6 @@ function defaultCalendarColor(calendarId) {
 	}
 	return CALENDAR_COLOR_PALETTE[Math.abs(hash) % CALENDAR_COLOR_PALETTE.length];
 }
-//#endregion
-//#region src/builtins/calendars/record-kinds.ts
-/**
-* Record kinds owned by calendars (phase 4).
-*/
-/** Legacy collection / adoptsFrom target. */
-var CALENDARS_USER_PREFS_COLLECTION = "calendars:user-prefs";
 var CalendarUserPrefsBodySchema = zod.z.object({
 	calendars: require_dist.CalendarPreferencesSchema.shape.calendars,
 	updatedAt: zod.z.number()
@@ -52,8 +45,7 @@ var _calendarsRecordKinds = require_dist.defineRecordKinds({ "user-prefs": {
 		name: "updated_at",
 		fields: ["updatedAt"]
 	}],
-	retention: { none: "a missing row reads as empty prefs (all visible, system colours)" },
-	adoptsFrom: CALENDARS_USER_PREFS_COLLECTION
+	retention: { none: "a missing row reads as empty prefs (all visible, system colours)" }
 } });
 var calendarsRecordKinds = _calendarsRecordKinds;
 _calendarsRecordKinds["user-prefs"];