@camstack/system 1.2.461 → 1.2.463

package/dist/kernel/moleculer/runner-device-settings.d.ts

@@ -22,7 +22,7 @@ export interface RunnerSettingsClient {
 	};
 }
 /** The door slice the per-device store needs, over a tRPC client. */
-export declare function doorOverClient(client: RunnerSettingsClient, before?: () => Promise<void>): DeviceSettingsDoor;
+export declare function doorOverClient(client: RunnerSettingsClient): DeviceSettingsDoor;
 /** The per-device methods of a runner's `ctx.settings`. */
 export interface RunnerDeviceSettingsView {
 	readDeviceStore(deviceId: number): Promise<Record<string, unknown>>;
@@ -36,4 +36,4 @@ export interface RunnerDeviceSettingsView {
 *   runner has none — every call then THROWS: a store that could not be asked
 *   is not an empty one.
 */
-export declare function createRunnerDeviceSettings(client: RunnerSettingsClient | undefined, addonId: string, before?: () => Promise<void>): RunnerDeviceSettingsView;
+export declare function createRunnerDeviceSettings(client: RunnerSettingsClient | undefined, addonId: string): RunnerDeviceSettingsView;

package/dist/{restore-archive-DM1OBYq4.js → restore-archive-6zkRREHO.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Bn-RNanh.js");
+const require_dist = require("./dist-D9aw_d0G.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");

package/dist/{restore-archive-CM23Pq9B.mjs → restore-archive-CSOR_tyN.mjs}

@@ -1,4 +1,4 @@
-import { Gi as defineRecordKinds, N as DataStoreDatabaseSchema, S as DATABASE_SNAPSHOT_SUFFIX } from "./dist-Wy8cTxg6.mjs";
+import { N as DataStoreDatabaseSchema, S as DATABASE_SNAPSHOT_SUFFIX, Ui as defineRecordKinds } from "./dist-C2OBCa-A.mjs";
 import { z } from "zod";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";

package/dist/{retired-settings-keys-D_VwZiDt.js → retired-settings-keys-CGUqX-Oz.js}

@@ -353,12 +353,6 @@ function errText(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
-Object.defineProperty(exports, "RETIRED_SETTINGS_KEYS", {
-	enumerable: true,
-	get: function() {
-		return RETIRED_SETTINGS_KEYS;
-	}
-});
 Object.defineProperty(exports, "purgeRetiredSettingsKeys", {
 	enumerable: true,
 	get: function() {

package/dist/{retired-settings-keys-Bhwe4ymb.mjs → retired-settings-keys-C_Kjp-Bj.mjs}

@@ -353,4 +353,4 @@ function errText(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
-export { retiredKeyStoreOf as i, purgeRetiredSettingsKeys as n, purgeRetiredSettingsRows as r, RETIRED_SETTINGS_KEYS as t };
+export { purgeRetiredSettingsRows as n, retiredKeyStoreOf as r, purgeRetiredSettingsKeys as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.461",
+  "version": "1.2.463",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",

package/dist/builtins/sqlite-storage/retired-collections.d.ts

@@ -1,146 +0,0 @@
-/**
-* Retired COLLECTIONS — the boot-time drop of dead tables.
-*
-* ## Why this is not the retired-key purge
-*
-* `retired-settings-keys.ts` handles two shapes of dead configuration: keys
-* inside a live row, and whole rows inside a live collection. Neither can
-* express the third shape — a whole TABLE whose owning code is gone. Deleting
-* its rows would leave the table, and the table is what makes a reader believe
-* the feature still exists: `devices` and `device_settings_kv` sat in the
-* schema of every hub, described by their own `@durable` records, next to a
-* fleet of 974 cameras none of which had ever been written there.
-*
-* ## Where it runs: EVERY node, unlike the key purge
-*
-* The retired keys live in the hub-central settings store, so cleaning them
-* anywhere else is work that can never find anything — hence
-* `settingsStoreIsAuthoritativeHere`. A retired table is the opposite: it was
-* materialised by a `declareCollection` that ran inside whatever engine the
-* declaring code booted next to, so every node that ever ran that code has its
-* own copy. This purge is therefore NOT role-gated — and it takes no `env`
-* parameter at all, where its sibling does, so that the gate cannot be added
-* back by copying a signature.
-*
-* ## Contract
-*
-* - **Idempotent.** An absent table plans nothing, drops nothing, logs nothing.
-* - **Loud exactly once per drop**, and the line carries the row count. An
-*   empty drop is `info`; a drop that destroyed rows is `warn`, because
-*   "nothing read this" is a claim about the code and the number is the only
-*   evidence of what it cost on this machine.
-* - **A fault never blocks boot.** A drop that throws is warned about and the
-*   next spec still runs; the next boot retries.
-*
-* ## Adding a collection
-*
-* Only add a table whose declaring code you have DELETED in the same change.
-* A table listed here while something still declares it is dropped at every
-* boot and recreated moments later — a churn no test would catch. Worse than
-* churn, in fact: the purge is not role-gated, so a live table added here is
-* dropped **on the hub too**, at every boot, and the rows are reported only
-* after they are gone. `scripts/check-retired-collections-are-dead.ts` now
-* refuses any entry that still appears in `docs/reference/storage.md`.
-*
-* ## What this list can NOT retire: a whole node's store
-*
-* On 2026-09-01 agents stopped booting a `data-store-provider` of their own
-* (`server/backend/src/agent/agent-infra-capabilities.ts`). It looks like a
-* deletion that should retire its tables. It is not, for two independent
-* reasons, and both are worth writing down because the next session will reach
-* for this file first:
-*
-*  1. **Every table an agent held is a table the hub still declares.**
-*     `addon-settings`, `storage_locations`, `system-settings`, `sections`,
-*     `provider-settings`, the `device-*` family, `alerts`, `vec_indexes` and
-*     each `<addonId>:addon-settings` variant are all live on the hub. Listing
-*     any of them here drops the HUB's copy — see the guard.
-*  2. **The purge runs inside the engine's boot, and the agent no longer boots
-*     one.** Nothing on that node would execute the drop even if a name were
-*     safe to add. This is not hypothetical: the `macmini` node's leftover
-*     store still carries `devices` and `device_settings_kv` — the two tables
-*     D183 retired — because its engine has not booted since 2026-05-09.
-*
-* The agent's leftover `camstack.db` is therefore inert, not resurrectable: no
-* engine opens it and no code reads it. Its disposal is an operator decision,
-* not a boot-time one, and it is recorded in the ADR rather than automated
-* here — this module drops TABLES, and deleting somebody's database file is a
-* different kind of act.
-*/
-import type { OwnedSqliteFile } from "./owned-sqlite-file.js";
-import type { RetiredKeyLogger } from "./retired-settings-keys.js";
-import type { DroppedTable, SqliteSettingsBackend } from "./sqlite-settings-backend.js";
-/** One retired-table declaration. */
-export interface RetiredCollectionSpec {
-	/**
-	* The table name as it exists on disk. These tables are NOT namespaced —
-	* the retired code declared them bare — so this is the literal name, not a
-	* `<namespace>:<collection>` pair to be resolved.
-	*/
-	readonly collection: string;
-	/** The code that used to own it — reported, never used to address it. */
-	readonly owner: string;
-	/** Why it is dead. Cited in the log line, not re-derived at the call site. */
-	readonly reason: string;
-}
-/** What one drop destroyed. */
-export interface RetiredCollectionDrop {
-	readonly collection: string;
-	readonly owner: string;
-	/** Rows the table held. Zero is the expected case and is still reported. */
-	readonly rows: number;
-}
-/** The engine access the purge needs. Narrow on purpose — trivially fakeable. */
-export interface RetiredCollectionStore {
-	/** Drop `collection`, or answer `null` when it is not there. Throws on fault. */
-	drop(collection: string): Promise<DroppedTable | null>;
-}
-/**
-* The dead tables.
-*
-* `devices` / `device_settings_kv` — the device half of the
-* integration-registry ([D183](../../../../../docs/decisions/adr-0183.md)).
-* The registry's INTEGRATION half is live (`integrations`,
-* `integration_settings`); its device half never had a production caller and
-* never had a row. The fleet lives in `device-manager:devices`, under numeric
-* ids, while these tables key on `dev_NNNN` — the two id-spaces could not be
-* reconciled even if something had wanted to.
-*
-* `pipeline-analytics:track-groups` / `:track-group-members` — the co-moving
-* GROUP entity. It shipped on 2026-08-24 and was kill-switched the same day
-* (duplicate sealed rows made Library → Gruppi unusable); the operator decided
-* on 2026-09-01 to delete it rather than re-open it. The clusterer, the live
-* buffer, the sealer, the query, the two cap methods and the two custom
-* actions are gone, so nothing declares these tables any more. The group-owned
-* MEDIA rows are NOT here — they live in the shared `pipeline-analytics:media`
-* and are collected by the orphan audit through `RETIRED_OWNER_KINDS`.
-*
-* `pipeline-analytics:summaries` / `:summary-members` — the session SUMMARY,
-* the entity that grouped tracks by proximity at birth (D489) and split them
-* when they walked apart (D490). Its production path was switched off on
-* 2026-09-16 and the operator decided on 2026-09-29 to delete it (D680): the
-* sealer, the store, the group shot, the three cap methods and the digest's
-* `groups` reading are gone, so nothing declares these tables. The group
-* shots were `summary`-owned rows in `pipeline-analytics:media` and go the
-* same way as the group entity's — through `RETIRED_OWNER_KINDS`.
-*/
-export declare const RETIRED_COLLECTIONS: readonly RetiredCollectionSpec[];
-/**
-* Adapt the SQLite engine to {@link RetiredCollectionStore}.
-*
-* The DDL itself is the engine's — it owns the handle and the memos a drop has
-* to evict. This module owns only the list and the reporting.
-*/
-export declare function retiredCollectionStoreOf(backend: SqliteSettingsBackend): RetiredCollectionStore;
-/**
-* The same adapter over an {@link OwnedSqliteFile} — the purge runs against
-* EVERY open database file (D851), and a file served by a worker answers the
-* drop through its thread.
-*/
-export declare function retiredCollectionStoreOfFile(file: OwnedSqliteFile): RetiredCollectionStore;
-/**
-* Drop every retired table that is still present. Returns one entry per table
-* actually dropped — empty when the schema is already clean, which is the
-* steady state after the first boot that ran it.
-*/
-export declare function purgeRetiredCollections(store: RetiredCollectionStore, logger: RetiredKeyLogger, specs?: readonly RetiredCollectionSpec[]): Promise<readonly RetiredCollectionDrop[]>;

package/dist/kernel/legacy-blob-guard.d.ts

@@ -1,63 +0,0 @@
-/**
-* The boot guard of the D870 cut-over: an addon never starts on `absent`.
-*
-* Until `scripts/hub/migrate-device-store.ts --copy` has run, a forked addon's
-* settings still sit in its per-addon blobs (`<addonId>:addon-devices`,
-* `<addonId>:addon-settings` / `root`) while the standard rows are empty. New
-* code reads only the standard rows, so it would run on "no settings" - every
-* camera unconfigured, recording off, with nothing in a log. Instead the addon
-* REFUSES to start, and says why.
-*
-* Reads of an unwritten scoped table answer absent and create nothing, so the
-* guard costs two counts and a `get` on a hub that never had blobs, and it goes
-* quiet by itself once `--drop` removed the old tables.
-*/
-import type { IScopedLogger } from "@camstack/types";
-import { AddonRefusedError } from "./addon-refused-error.js";
-/** Is `key` of `addonId` a root key that was retired (and must not be migrated)? */
-export declare function isRetiredRootKey(addonId: string, key: string): boolean;
-/** The client calls the guard uses. */
-export interface LegacyGuardClient {
-	readonly query: {
-		query(input: {
-			namespace?: string;
-			collection: string;
-			filter?: {
-				whereBetween: Record<string, [string, string]>;
-				orderBy: {
-					field: string;
-					direction: "asc" | "desc";
-				};
-				limit: number;
-			};
-		}): Promise<unknown>;
-	};
-	readonly get: {
-		query(input: {
-			namespace: string;
-			collection: string;
-			key: string;
-		}): Promise<unknown>;
-	};
-	readonly count: {
-		query(input: {
-			namespace?: string;
-			collection: string;
-			filter?: {
-				whereBetween: Record<string, [string, string]>;
-			};
-		}): Promise<unknown>;
-	};
-}
-/** Stable `code` of the D870 refusal. */
-export declare const UNMIGRATED_SETTINGS_CODE = "unmigrated-settings";
-/** The remedy the refusal (and the update pre-flight) names. */
-export declare const UNMIGRATED_SETTINGS_REMEDY = "Run scripts/hub/migrate-device-store.ts --copy --apply (D870), then restart the addon.";
-export declare class UnmigratedSettingsError extends AddonRefusedError {
-	constructor(addonId: string, what: string);
-}
-/**
-* THROWS when the addon has blob settings and the standard store has none of
-* its own. A store that cannot be asked also throws: it is not "no blobs".
-*/
-export declare function assertLegacyBlobsMigrated(client: LegacyGuardClient, addonId: string, logger: IScopedLogger): Promise<void>;