@camstack/system 1.2.457 → 1.2.459

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-Bn-RNanh.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { ni as BaseAddon, zn as logDestinationCapability } from "../../dist-Dhux90yB.mjs";
+import { ni as BaseAddon, zn as logDestinationCapability } from "../../dist-Wy8cTxg6.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,11 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-Bn-RNanh.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_device_ca = require("../../device-ca-CVK3YcR_.js");
-const require_phase6_declare_gate = require("../../phase6-declare-gate-BO-_jLh_.js");
-const require_constants = require("../../constants-B_X9cWEK.js");
+const require_device_ca = require("../../device-ca-CPTDs--d.js");
+const require_constants = require("../../constants-6OeJiZgi.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -1072,6 +1071,42 @@ function errMsg(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 require_dist.EventCategory.KeychainChanged;
+var KeychainAuditBodySchema = require_dist.KeychainAuditEntrySchema.omit({
+	id: true,
+	at: true
+});
+var KeychainResetBodySchema = require_dist.KeychainResetRecordSchema.omit({
+	id: true,
+	at: true
+});
+var _keychainRecordKinds = require_dist.defineRecordKinds({
+	audit: {
+		schema: KeychainAuditBodySchema,
+		class: "audit",
+		writeTrigger: "one row per write / delete / rotation / reveal / recovery download",
+		device: "none",
+		at: "required",
+		indexes: [{
+			name: "audit_at",
+			fields: ["at"]
+		}],
+		retention: {
+			owner: "keychain",
+			reason: "90 days and at most 20_000 rows, pruned at boot and daily"
+		}
+	},
+	resets: {
+		schema: KeychainResetBodySchema,
+		class: "config",
+		writeTrigger: "one row per keychain reset (System → Secrets, or the RESET_KEYCHAIN trigger file); acknowledgeReset stamps acknowledgedAt",
+		device: "none",
+		at: "required",
+		retention: { none: "a handful of rows over a hub life; they name archive tables a reset left behind" }
+	}
+});
+var keychainRecordKinds = _keychainRecordKinds;
+_keychainRecordKinds.audit;
+_keychainRecordKinds.resets;
 //#endregion
 //#region src/builtins/keychain/keychain-store.ts
 var import_read_all_rows = require_read_all_rows$1.require_read_all_rows();
@@ -1718,44 +1753,6 @@ var KeychainRepository = class {
 		return row === void 0 ? null : toResetRecord(row.id, row.data);
 	}
 };
-var KeychainAuditBodySchema = require_dist.KeychainAuditEntrySchema.omit({
-	id: true,
-	at: true
-});
-var KeychainResetBodySchema = require_dist.KeychainResetRecordSchema.omit({
-	id: true,
-	at: true
-});
-var _keychainRecordKinds = require_dist.defineRecordKinds({
-	audit: {
-		schema: KeychainAuditBodySchema,
-		class: "audit",
-		writeTrigger: "one row per write / delete / rotation / reveal / recovery download",
-		device: "none",
-		at: "required",
-		indexes: [{
-			name: "audit_at",
-			fields: ["at"]
-		}],
-		retention: {
-			owner: "keychain",
-			reason: "90 days and at most 20_000 rows, pruned at boot and daily"
-		},
-		adoptsFrom: KEYCHAIN_AUDIT_COLLECTION
-	},
-	resets: {
-		schema: KeychainResetBodySchema,
-		class: "config",
-		writeTrigger: "one row per keychain reset (System → Secrets, or the RESET_KEYCHAIN trigger file); acknowledgeReset stamps acknowledgedAt",
-		device: "none",
-		at: "required",
-		retention: { none: "a handful of rows over a hub life; they name archive tables a reset left behind" },
-		adoptsFrom: KEYCHAIN_RESETS_COLLECTION
-	}
-});
-var keychainRecordKinds = _keychainRecordKinds;
-_keychainRecordKinds.audit;
-_keychainRecordKinds.resets;
 //#endregion
 //#region src/builtins/keychain/keychain-usage.ts
 /**
@@ -1953,8 +1950,9 @@ var KeychainAddon = class extends require_dist.BaseAddon {
 			error: (message, meta) => ctx.logger.error(message, meta ? { meta } : void 0)
 		};
 		const records = ctx.records;
+		if (records !== void 0) await records.declare(keychainRecordKinds);
 		const service = new KeychainService({
-			repo: new KeychainRepository(door, records !== void 0 && await require_phase6_declare_gate.resolvePhase6UseRecordsPathForHub(ctx, "keychain", keychainRecordKinds, ["keychain:audit", "keychain:resets"]) && records !== void 0 ? KeychainRepository.recordStoresOf(records) : void 0),
+			repo: new KeychainRepository(door, records !== void 0 ? KeychainRepository.recordStoresOf(records) : void 0),
 			candidates: async () => {
 				return buildKeySourceCandidates({
 					config: readKeyConfig(await ctx.settings?.getSection("keychain") ?? {}),

package/dist/builtins/keychain/index.mjs

@@ -1,8 +1,7 @@
-import { G as KeychainResetRecordSchema, Ki as defineRecordKinds, Mn as keychainAdminCapability, Nn as keychainCapability, Oa as EventCategory, U as KEYCHAIN_RESET_TRIGGER_ACTOR, W as KeychainAuditEntrySchema, Xi as formatSecretScope, fa as parseSecretRef, la as normalizeSecretOwner, ni as BaseAddon } from "../../dist-Dhux90yB.mjs";
+import { G as KeychainResetRecordSchema, Gi as defineRecordKinds, Mn as keychainAdminCapability, Nn as keychainCapability, Ta as EventCategory, U as KEYCHAIN_RESET_TRIGGER_ACTOR, W as KeychainAuditEntrySchema, Yi as formatSecretScope, ca as normalizeSecretOwner, da as parseSecretRef, ni as BaseAddon } from "../../dist-Wy8cTxg6.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-BB6nHAL5.mjs";
-import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-x9ZCbQJP.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants-cxKcZRMi.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-Bnkw8GyU.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-BnkOdj9Q.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";
@@ -1066,6 +1065,42 @@ function errMsg(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 EventCategory.KeychainChanged;
+var KeychainAuditBodySchema = KeychainAuditEntrySchema.omit({
+	id: true,
+	at: true
+});
+var KeychainResetBodySchema = KeychainResetRecordSchema.omit({
+	id: true,
+	at: true
+});
+var _keychainRecordKinds = defineRecordKinds({
+	audit: {
+		schema: KeychainAuditBodySchema,
+		class: "audit",
+		writeTrigger: "one row per write / delete / rotation / reveal / recovery download",
+		device: "none",
+		at: "required",
+		indexes: [{
+			name: "audit_at",
+			fields: ["at"]
+		}],
+		retention: {
+			owner: "keychain",
+			reason: "90 days and at most 20_000 rows, pruned at boot and daily"
+		}
+	},
+	resets: {
+		schema: KeychainResetBodySchema,
+		class: "config",
+		writeTrigger: "one row per keychain reset (System → Secrets, or the RESET_KEYCHAIN trigger file); acknowledgeReset stamps acknowledgedAt",
+		device: "none",
+		at: "required",
+		retention: { none: "a handful of rows over a hub life; they name archive tables a reset left behind" }
+	}
+});
+var keychainRecordKinds = _keychainRecordKinds;
+_keychainRecordKinds.audit;
+_keychainRecordKinds.resets;
 //#endregion
 //#region src/builtins/keychain/keychain-store.ts
 var import_read_all_rows = require_read_all_rows();
@@ -1712,44 +1747,6 @@ var KeychainRepository = class {
 		return row === void 0 ? null : toResetRecord(row.id, row.data);
 	}
 };
-var KeychainAuditBodySchema = KeychainAuditEntrySchema.omit({
-	id: true,
-	at: true
-});
-var KeychainResetBodySchema = KeychainResetRecordSchema.omit({
-	id: true,
-	at: true
-});
-var _keychainRecordKinds = defineRecordKinds({
-	audit: {
-		schema: KeychainAuditBodySchema,
-		class: "audit",
-		writeTrigger: "one row per write / delete / rotation / reveal / recovery download",
-		device: "none",
-		at: "required",
-		indexes: [{
-			name: "audit_at",
-			fields: ["at"]
-		}],
-		retention: {
-			owner: "keychain",
-			reason: "90 days and at most 20_000 rows, pruned at boot and daily"
-		},
-		adoptsFrom: KEYCHAIN_AUDIT_COLLECTION
-	},
-	resets: {
-		schema: KeychainResetBodySchema,
-		class: "config",
-		writeTrigger: "one row per keychain reset (System → Secrets, or the RESET_KEYCHAIN trigger file); acknowledgeReset stamps acknowledgedAt",
-		device: "none",
-		at: "required",
-		retention: { none: "a handful of rows over a hub life; they name archive tables a reset left behind" },
-		adoptsFrom: KEYCHAIN_RESETS_COLLECTION
-	}
-});
-var keychainRecordKinds = _keychainRecordKinds;
-_keychainRecordKinds.audit;
-_keychainRecordKinds.resets;
 //#endregion
 //#region src/builtins/keychain/keychain-usage.ts
 /**
@@ -1947,8 +1944,9 @@ var KeychainAddon = class extends BaseAddon {
 			error: (message, meta) => ctx.logger.error(message, meta ? { meta } : void 0)
 		};
 		const records = ctx.records;
+		if (records !== void 0) await records.declare(keychainRecordKinds);
 		const service = new KeychainService({
-			repo: new KeychainRepository(door, records !== void 0 && await resolvePhase6UseRecordsPathForHub(ctx, "keychain", keychainRecordKinds, ["keychain:audit", "keychain:resets"]) && records !== void 0 ? KeychainRepository.recordStoresOf(records) : void 0),
+			repo: new KeychainRepository(door, records !== void 0 ? KeychainRepository.recordStoresOf(records) : void 0),
 			candidates: async () => {
 				return buildKeySourceCandidates({
 					config: readKeyConfig(await ctx.settings?.getSection("keychain") ?? {}),

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-Bn-RNanh.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Hi as createEvent, Oa as EventCategory, it as RecordingStatusSchema, ni as BaseAddon, nt as RECORDING_SOURCE_CAMSTACK_ADDON, ti as errMsg } from "../../dist-Dhux90yB.mjs";
+import { Hi as createEvent, Ta as EventCategory, it as RecordingStatusSchema, ni as BaseAddon, nt as RECORDING_SOURCE_CAMSTACK_ADDON, ti as errMsg } from "../../dist-Wy8cTxg6.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,12 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
+const require_dist = require("../../dist-Bn-RNanh.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-CVK3YcR_.js");
-const require_phase6_declare_gate = require("../../phase6-declare-gate-BO-_jLh_.js");
+const require_device_ca = require("../../device-ca-CPTDs--d.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -7694,8 +7693,7 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 			fields: ["username"],
 			unique: true
 		}],
-		retention: { none: "row goes only when an operator deletes the user; destructive declareCollection rebuild wipes all accounts" },
-		adoptsFrom: USERS_COLLECTION$1
+		retention: { none: "row goes only when an operator deletes the user; destructive declareCollection rebuild wipes all accounts" }
 	},
 	"api-keys": {
 		schema: ApiKeyBodySchema,
@@ -7707,8 +7705,7 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 			name: "prefix",
 			fields: ["tokenPrefix"]
 		}],
-		retention: { none: "explicit revoke only" },
-		adoptsFrom: API_KEYS_COLLECTION
+		retention: { none: "explicit revoke only" }
 	},
 	"scoped-tokens": {
 		schema: ScopedTokenBodySchema,
@@ -7724,8 +7721,7 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 			name: "user",
 			fields: ["userId"]
 		}],
-		retention: { none: "the operator drops the legacy rows by hand (D895)" },
-		adoptsFrom: SCOPED_TOKENS_COLLECTION
+		retention: { none: "the operator drops the legacy rows by hand (D895)" }
 	},
 	"admin-tokens": {
 		schema: AdminTokenBodySchema,
@@ -7741,8 +7737,7 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 			name: "created_by",
 			fields: ["createdBy"]
 		}],
-		retention: { none: "the operator drops the legacy rows by hand (D895)" },
-		adoptsFrom: ADMIN_TOKENS_COLLECTION
+		retention: { none: "the operator drops the legacy rows by hand (D895)" }
 	},
 	"login-sessions": {
 		schema: LoginSessionBodySchema,
@@ -7760,8 +7755,7 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 		retention: {
 			owner: "local-auth",
 			reason: "daily reap: expired >7d and revoked >30d"
-		},
-		adoptsFrom: LOGIN_SESSIONS_COLLECTION
+		}
 	},
 	"login-session-cutoffs": {
 		schema: LoginSessionCutoffBodySchema,
@@ -7769,8 +7763,7 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 		writeTrigger: "revoke-all-sessions for a user (password change, delete, logout everywhere)",
 		device: "none",
 		at: "none",
-		retention: { none: "one row per user who ever had all sessions revoked" },
-		adoptsFrom: LOGIN_SESSION_CUTOFFS_COLLECTION
+		retention: { none: "one row per user who ever had all sessions revoked" }
 	},
 	"oauth-sessions": {
 		schema: OauthSessionBodySchema,
@@ -7785,8 +7778,7 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 		retention: {
 			owner: "local-auth",
 			reason: "daily reap deletes revoked sessions older than 30 days; active rows never expire"
-		},
-		adoptsFrom: OAUTH_SESSIONS_COLLECTION
+		}
 	},
 	"user-totp": {
 		schema: UserTotpBodySchema,
@@ -7794,8 +7786,7 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 		writeTrigger: "setup inserts seed (keychain); confirm sets confirmedAt; disable deletes row",
 		device: "none",
 		at: "none",
-		retention: { none: "disable or replace on re-setup; user delete does not cascade" },
-		adoptsFrom: USER_TOTP_COLLECTION
+		retention: { none: "disable or replace on re-setup; user delete does not cascade" }
 	},
 	"user-external-identities": {
 		schema: ExternalIdentityBodySchema,
@@ -7811,8 +7802,7 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 			fields: ["provider", "subject"],
 			unique: true
 		}],
-		retention: { none: "unlink or deleteUser removes rows" },
-		adoptsFrom: USER_EXTERNAL_IDENTITIES_COLLECTION
+		retention: { none: "unlink or deleteUser removes rows" }
 	},
 	"device-credentials": {
 		schema: DeviceCredentialBodySchema,
@@ -7830,8 +7820,7 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 		retention: {
 			owner: "local-auth",
 			reason: "daily reap removes revoked/expired rows older than 90 days"
-		},
-		adoptsFrom: DEVICE_CREDENTIALS_COLLECTION
+		}
 	},
 	"auth-audit": {
 		schema: AuthAuditBodySchema,
@@ -7846,8 +7835,7 @@ var _localAuthRecordKinds = require_dist.defineRecordKinds({
 		retention: {
 			ttlMs: 90 * DAY_MS,
 			from: "at"
-		},
-		adoptsFrom: AUTH_AUDIT_COLLECTION
+		}
 	}
 });
 var localAuthRecordKinds = _localAuthRecordKinds;
@@ -12307,45 +12295,41 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 		const store = this.ctx.api?.settingsStore;
 		const records = this.ctx.records;
 		if (store && records) {
-			const useRecords = await require_phase6_declare_gate.resolvePhase6UseRecordsPathForHub(this.ctx, "local-auth", localAuthRecordKinds, LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS);
-			const authStores = useRecords ? localAuthRecordStoresOf(records) : null;
+			await records.declare(localAuthRecordKinds);
+			const authStores = localAuthRecordStoresOf(records);
 			await records.declare(localAuthPreferencesRecordKinds);
 			this.preferences = new UserPreferencesStore(records.kind(localAuthPreferencesRecordKinds["user-preferences"]));
-			const legacyStoreAccess = { getStore: () => store };
-			await declareAuthSchema(store, { ...useRecords ? { skipCollections: LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS } : {} });
-			this.userManager = authStores === null ? new UserManager(legacyStoreAccess, this.authManager) : new UserManager({
+			await declareAuthSchema(store, { skipCollections: LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS });
+			this.userManager = new UserManager({
 				usersKind: authStores.users,
 				legacyStore: store
 			}, this.authManager);
-			this.apiKeyManager = authStores === null ? new ApiKeyManager(legacyStoreAccess) : new ApiKeyManager({
+			this.apiKeyManager = new ApiKeyManager({
 				apiKeysKind: authStores.apiKeys,
 				legacyStore: store
 			});
-			this.oauthSessionManager = authStores === null ? new OauthSessionManager(store) : new OauthSessionManager({
+			this.oauthSessionManager = new OauthSessionManager({
 				oauthSessionsKind: authStores.oauthSessions,
 				legacyStore: store
 			});
-			this.totpManager = authStores === null ? new TotpManager(store, {
-				secrets: forOwner === null ? null : forOwner("system"),
-				logger: this.ctx.logger
-			}) : new TotpManager({
+			this.totpManager = new TotpManager({
 				userTotpKind: authStores.userTotp,
 				legacyStore: store
 			}, {
 				secrets: forOwner === null ? null : forOwner("system"),
 				logger: this.ctx.logger
 			});
-			this.externalIdentities = authStores === null ? new ExternalIdentityManager(store) : new ExternalIdentityManager({
+			this.externalIdentities = new ExternalIdentityManager({
 				identitiesKind: authStores.userExternalIdentities,
 				legacyStore: store
 			});
-			this.loginSessions = authStores === null ? new LoginSessionManager(store, { logger: this.ctx.logger }) : new LoginSessionManager({
+			this.loginSessions = new LoginSessionManager({
 				sessionsKind: authStores.loginSessions,
 				cutoffsKind: authStores.loginSessionCutoffs,
 				legacyStore: store
 			}, { logger: this.ctx.logger });
 			await this.loginSessions.load();
-			this.auditLog = authStores === null ? new AuthAuditLog(store, this.ctx.logger) : new AuthAuditLog({
+			this.auditLog = new AuthAuditLog({
 				authAuditKind: authStores.authAudit,
 				legacyStore: store
 			}, this.ctx.logger);
@@ -12365,7 +12349,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 					return user === null ? null : { username: user.username };
 				},
 				selfEnrollmentAllowed: async () => (await this.readDeviceCertificateSettings()).selfEnrollment === "allowed",
-				deviceCredentialsKind: authStores?.deviceCredentials ?? null,
+				deviceCredentialsKind: authStores.deviceCredentials,
 				logger: this.ctx.logger
 			});
 			await this.deviceCredentials.load();

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,10 +1,9 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { $ as PreferenceDeviceIdSchema, D as DEVICE_ENROLLMENT_TTL_MS, Ea as userError, En as isCredentialTokenPayload, Et as authProviderCapability, Ki as defineRecordKinds, Mt as buildDeviceSignatureMessage, Nr as userManagementCapability, Q as PREFERENCES_MAX_VALUE_BYTES, _n as formatDeviceRevoker, a as ApiKeyRecordSchema, aa as makeSecretMarker, b as CredentialTokenClaimsSchema, dt as SsoBridgeClaimsSchema, en as deviceCredentialsCapability, et as PreferenceNamespaceSchema, g as CREDENTIAL_TOKEN_AUDIENCE, gt as TokenScopeSchema, jt as buildDeviceEnrollmentLink, k as DEVICE_NONCE_TTL_MS, lt as ScopedTokenSchema, na as isSecretMarker, ni as BaseAddon, tt as PreferenceValueSchema, vt as UserRecordSchema } from "../../dist-Dhux90yB.mjs";
+import { $ as PreferenceDeviceIdSchema, Ca as userError, D as DEVICE_ENROLLMENT_TTL_MS, En as isCredentialTokenPayload, Et as authProviderCapability, Gi as defineRecordKinds, Mt as buildDeviceSignatureMessage, Nr as userManagementCapability, Q as PREFERENCES_MAX_VALUE_BYTES, _n as formatDeviceRevoker, a as ApiKeyRecordSchema, b as CredentialTokenClaimsSchema, dt as SsoBridgeClaimsSchema, en as deviceCredentialsCapability, et as PreferenceNamespaceSchema, g as CREDENTIAL_TOKEN_AUDIENCE, gt as TokenScopeSchema, ia as makeSecretMarker, jt as buildDeviceEnrollmentLink, k as DEVICE_NONCE_TTL_MS, lt as ScopedTokenSchema, ni as BaseAddon, ta as isSecretMarker, tt as PreferenceValueSchema, vt as UserRecordSchema } from "../../dist-Wy8cTxg6.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-BB6nHAL5.mjs";
-import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-x9ZCbQJP.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-Bnkw8GyU.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
@@ -7684,8 +7683,7 @@ var _localAuthRecordKinds = defineRecordKinds({
 			fields: ["username"],
 			unique: true
 		}],
-		retention: { none: "row goes only when an operator deletes the user; destructive declareCollection rebuild wipes all accounts" },
-		adoptsFrom: USERS_COLLECTION$1
+		retention: { none: "row goes only when an operator deletes the user; destructive declareCollection rebuild wipes all accounts" }
 	},
 	"api-keys": {
 		schema: ApiKeyBodySchema,
@@ -7697,8 +7695,7 @@ var _localAuthRecordKinds = defineRecordKinds({
 			name: "prefix",
 			fields: ["tokenPrefix"]
 		}],
-		retention: { none: "explicit revoke only" },
-		adoptsFrom: API_KEYS_COLLECTION
+		retention: { none: "explicit revoke only" }
 	},
 	"scoped-tokens": {
 		schema: ScopedTokenBodySchema,
@@ -7714,8 +7711,7 @@ var _localAuthRecordKinds = defineRecordKinds({
 			name: "user",
 			fields: ["userId"]
 		}],
-		retention: { none: "the operator drops the legacy rows by hand (D895)" },
-		adoptsFrom: SCOPED_TOKENS_COLLECTION
+		retention: { none: "the operator drops the legacy rows by hand (D895)" }
 	},
 	"admin-tokens": {
 		schema: AdminTokenBodySchema,
@@ -7731,8 +7727,7 @@ var _localAuthRecordKinds = defineRecordKinds({
 			name: "created_by",
 			fields: ["createdBy"]
 		}],
-		retention: { none: "the operator drops the legacy rows by hand (D895)" },
-		adoptsFrom: ADMIN_TOKENS_COLLECTION
+		retention: { none: "the operator drops the legacy rows by hand (D895)" }
 	},
 	"login-sessions": {
 		schema: LoginSessionBodySchema,
@@ -7750,8 +7745,7 @@ var _localAuthRecordKinds = defineRecordKinds({
 		retention: {
 			owner: "local-auth",
 			reason: "daily reap: expired >7d and revoked >30d"
-		},
-		adoptsFrom: LOGIN_SESSIONS_COLLECTION
+		}
 	},
 	"login-session-cutoffs": {
 		schema: LoginSessionCutoffBodySchema,
@@ -7759,8 +7753,7 @@ var _localAuthRecordKinds = defineRecordKinds({
 		writeTrigger: "revoke-all-sessions for a user (password change, delete, logout everywhere)",
 		device: "none",
 		at: "none",
-		retention: { none: "one row per user who ever had all sessions revoked" },
-		adoptsFrom: LOGIN_SESSION_CUTOFFS_COLLECTION
+		retention: { none: "one row per user who ever had all sessions revoked" }
 	},
 	"oauth-sessions": {
 		schema: OauthSessionBodySchema,
@@ -7775,8 +7768,7 @@ var _localAuthRecordKinds = defineRecordKinds({
 		retention: {
 			owner: "local-auth",
 			reason: "daily reap deletes revoked sessions older than 30 days; active rows never expire"
-		},
-		adoptsFrom: OAUTH_SESSIONS_COLLECTION
+		}
 	},
 	"user-totp": {
 		schema: UserTotpBodySchema,
@@ -7784,8 +7776,7 @@ var _localAuthRecordKinds = defineRecordKinds({
 		writeTrigger: "setup inserts seed (keychain); confirm sets confirmedAt; disable deletes row",
 		device: "none",
 		at: "none",
-		retention: { none: "disable or replace on re-setup; user delete does not cascade" },
-		adoptsFrom: USER_TOTP_COLLECTION
+		retention: { none: "disable or replace on re-setup; user delete does not cascade" }
 	},
 	"user-external-identities": {
 		schema: ExternalIdentityBodySchema,
@@ -7801,8 +7792,7 @@ var _localAuthRecordKinds = defineRecordKinds({
 			fields: ["provider", "subject"],
 			unique: true
 		}],
-		retention: { none: "unlink or deleteUser removes rows" },
-		adoptsFrom: USER_EXTERNAL_IDENTITIES_COLLECTION
+		retention: { none: "unlink or deleteUser removes rows" }
 	},
 	"device-credentials": {
 		schema: DeviceCredentialBodySchema,
@@ -7820,8 +7810,7 @@ var _localAuthRecordKinds = defineRecordKinds({
 		retention: {
 			owner: "local-auth",
 			reason: "daily reap removes revoked/expired rows older than 90 days"
-		},
-		adoptsFrom: DEVICE_CREDENTIALS_COLLECTION
+		}
 	},
 	"auth-audit": {
 		schema: AuthAuditBodySchema,
@@ -7836,8 +7825,7 @@ var _localAuthRecordKinds = defineRecordKinds({
 		retention: {
 			ttlMs: 90 * DAY_MS,
 			from: "at"
-		},
-		adoptsFrom: AUTH_AUDIT_COLLECTION
+		}
 	}
 });
 var localAuthRecordKinds = _localAuthRecordKinds;
@@ -12296,45 +12284,41 @@ var LocalAuthAddon = class extends BaseAddon {
 		const store = this.ctx.api?.settingsStore;
 		const records = this.ctx.records;
 		if (store && records) {
-			const useRecords = await resolvePhase6UseRecordsPathForHub(this.ctx, "local-auth", localAuthRecordKinds, LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS);
-			const authStores = useRecords ? localAuthRecordStoresOf(records) : null;
+			await records.declare(localAuthRecordKinds);
+			const authStores = localAuthRecordStoresOf(records);
 			await records.declare(localAuthPreferencesRecordKinds);
 			this.preferences = new UserPreferencesStore(records.kind(localAuthPreferencesRecordKinds["user-preferences"]));
-			const legacyStoreAccess = { getStore: () => store };
-			await declareAuthSchema(store, { ...useRecords ? { skipCollections: LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS } : {} });
-			this.userManager = authStores === null ? new UserManager(legacyStoreAccess, this.authManager) : new UserManager({
+			await declareAuthSchema(store, { skipCollections: LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS });
+			this.userManager = new UserManager({
 				usersKind: authStores.users,
 				legacyStore: store
 			}, this.authManager);
-			this.apiKeyManager = authStores === null ? new ApiKeyManager(legacyStoreAccess) : new ApiKeyManager({
+			this.apiKeyManager = new ApiKeyManager({
 				apiKeysKind: authStores.apiKeys,
 				legacyStore: store
 			});
-			this.oauthSessionManager = authStores === null ? new OauthSessionManager(store) : new OauthSessionManager({
+			this.oauthSessionManager = new OauthSessionManager({
 				oauthSessionsKind: authStores.oauthSessions,
 				legacyStore: store
 			});
-			this.totpManager = authStores === null ? new TotpManager(store, {
-				secrets: forOwner === null ? null : forOwner("system"),
-				logger: this.ctx.logger
-			}) : new TotpManager({
+			this.totpManager = new TotpManager({
 				userTotpKind: authStores.userTotp,
 				legacyStore: store
 			}, {
 				secrets: forOwner === null ? null : forOwner("system"),
 				logger: this.ctx.logger
 			});
-			this.externalIdentities = authStores === null ? new ExternalIdentityManager(store) : new ExternalIdentityManager({
+			this.externalIdentities = new ExternalIdentityManager({
 				identitiesKind: authStores.userExternalIdentities,
 				legacyStore: store
 			});
-			this.loginSessions = authStores === null ? new LoginSessionManager(store, { logger: this.ctx.logger }) : new LoginSessionManager({
+			this.loginSessions = new LoginSessionManager({
 				sessionsKind: authStores.loginSessions,
 				cutoffsKind: authStores.loginSessionCutoffs,
 				legacyStore: store
 			}, { logger: this.ctx.logger });
 			await this.loginSessions.load();
-			this.auditLog = authStores === null ? new AuthAuditLog(store, this.ctx.logger) : new AuthAuditLog({
+			this.auditLog = new AuthAuditLog({
 				authAuditKind: authStores.authAudit,
 				legacyStore: store
 			}, this.ctx.logger);
@@ -12354,7 +12338,7 @@ var LocalAuthAddon = class extends BaseAddon {
 					return user === null ? null : { username: user.username };
 				},
 				selfEnrollmentAllowed: async () => (await this.readDeviceCertificateSettings()).selfEnrollment === "allowed",
-				deviceCredentialsKind: authStores?.deviceCredentials ?? null,
+				deviceCredentialsKind: authStores.deviceCredentials,
 				logger: this.ctx.logger
 			});
 			await this.deviceCredentials.load();

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C89nqNnn.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-DB1Y9agt.js");
+const require_dist = require("../../dist-Bn-RNanh.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CTBTlia4.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { $n as pickAppLinkHub, Cn as isAppLinkBase, Dn as isDefaultAppConnectionEndpoint, Fr as validateCustomAddress, H as HUB_MDNS_TXT_KEYS, Ln as localNetworkCapability, Lt as checkRoleAddress, Oa as EventCategory, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, cr as resolveAppConnections, fr as resolveHubAddressRoles, hr as resolveNotificationTapAddress, l as CAMSTACK_APP_LINK_ORIGIN, ni as BaseAddon, ti as errMsg, xr as shortHostname } from "../../dist-Dhux90yB.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-B8olZqqd.mjs";
+import { $n as pickAppLinkHub, Cn as isAppLinkBase, Dn as isDefaultAppConnectionEndpoint, Fr as validateCustomAddress, H as HUB_MDNS_TXT_KEYS, Ln as localNetworkCapability, Lt as checkRoleAddress, Ta as EventCategory, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, cr as resolveAppConnections, fr as resolveHubAddressRoles, hr as resolveNotificationTapAddress, l as CAMSTACK_APP_LINK_ORIGIN, ni as BaseAddon, ti as errMsg, xr as shortHostname } from "../../dist-Wy8cTxg6.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-CJu0nhla.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";