@camstack/system 1.2.465 → 1.2.466

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,96 +1,15 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { $ as PreferenceDeviceIdSchema, $i as isSecretMarker, At as buildDeviceSignatureMessage, D as DEVICE_ENROLLMENT_TTL_MS, Q as PREFERENCES_MAX_VALUE_BYTES, Qt as deviceCredentialsCapability, Ui as defineRecordKinds, a as ApiKeyRecordSchema, b as CredentialTokenClaimsSchema, ei as BaseAddon, et as PreferenceNamespaceSchema, g as CREDENTIAL_TOKEN_AUDIENCE, gt as UserRecordSchema, hn as formatDeviceRevoker, jr as userManagementCapability, k as DEVICE_NONCE_TTL_MS, kt as buildDeviceEnrollmentLink, lt as SsoBridgeClaimsSchema, mt as TokenScopeSchema, na as makeSecretMarker, st as ScopedTokenSchema, tt as PreferenceValueSchema, wn as isCredentialTokenPayload, wt as authProviderCapability, xa as userError } from "../../dist-CR7idLer.mjs";
-import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
+import { $ as PreferenceNamespaceSchema, $r as BaseAddon, Ar as userManagementCapability, Ca as userError, Cn as isCredentialTokenPayload, Ct as authProviderCapability, E as DEVICE_ENROLLMENT_TTL_MS, Gi as defineRecordKinds, O as DEVICE_NONCE_TTL_MS, Ot as buildDeviceEnrollmentLink, Q as PreferenceDeviceIdSchema, Z as PREFERENCES_MAX_VALUE_BYTES, Zt as deviceCredentialsCapability, ct as SsoBridgeClaimsSchema, et as PreferenceValueSchema, h as CREDENTIAL_TOKEN_AUDIENCE, ht as UserRecordSchema, ia as makeSecretMarker, kt as buildDeviceSignatureMessage, mn as formatDeviceRevoker, ot as ScopedTokenSchema, pt as TokenScopeSchema, ta as isSecretMarker, y as CredentialTokenClaimsSchema } from "../../dist-CfjkLTZV.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-CQcB6yfj.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-B16Mr3EY.mjs";
+import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
 import * as path$1 from "node:path";
 import * as fs$1 from "node:fs";
-//#region src/auth/parse-record.ts
-function parseRecord$2(kind, schema, data) {
-	try {
-		return schema.parse(data);
-	} catch (err) {
-		const topKeys = data && typeof data === "object" && !Array.isArray(data) ? Object.keys(data).join(", ") || "(empty)" : `(non-object: ${typeof data})`;
-		const detail = err instanceof Error ? err.message : String(err);
-		const hint = data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 1 && "data" in data ? " This shape is the legacy double-wrap from a stale settings-store query path. Restart the server with the latest @camstack/system build." : "";
-		throw new Error(`Failed to parse ${kind} from settings store. Top-level keys=[${topKeys}].${hint} Underlying: ${detail}`, { cause: err });
-	}
-}
-//#endregion
-//#region src/auth/api-key-manager.ts
-/**
-* Legacy API keys — LIST and REVOKE only.
-*
-* No boundary accepts one (the tRPC context has no branch for them) and
-* nothing creates them any more: what is left is the rows a hub may still
-* hold, so an operator can see and delete them. Tokens (`auth.mintToken`) are
-* the credential for scripts and integrations.
-*/
-var import_read_all_rows = require_read_all_rows();
-var API_KEYS_COLLECTION$1 = "api_keys";
-function parseApiKey(data) {
-	return parseRecord$2("api-key", ApiKeyRecordSchema, data);
-}
-function rowToApiKey(id, body) {
-	return parseApiKey({
-		id,
-		...body
-	});
-}
-var ApiKeyManager = class {
-	kind;
-	legacyStore;
-	constructor(deps) {
-		if ("apiKeysKind" in deps) {
-			this.kind = deps.apiKeysKind;
-			this.legacyStore = deps.legacyStore ?? null;
-		} else {
-			this.kind = null;
-			this.legacyStore = deps.getStore();
-		}
-	}
-	get store() {
-		if (this.legacyStore === null) throw new Error("ApiKeyManager: legacy store unavailable on records-only path");
-		return this.legacyStore;
-	}
-	async listAll() {
-		const kind = this.kind;
-		return (kind !== null ? (await (0, import_read_all_rows.readAllRows)(kind)).map((row) => rowToApiKey(row.id, row.data)) : (await this.store.query.query({ collection: API_KEYS_COLLECTION$1 })).map((r) => parseApiKey(r.data))).map((parsed) => {
-			const { tokenHash: _th, ...rest } = parsed;
-			return rest;
-		});
-	}
-	async revoke(id) {
-		const kind = this.kind;
-		if (kind !== null) {
-			await kind.delete(id);
-			return;
-		}
-		await this.store.delete.mutate({
-			collection: API_KEYS_COLLECTION$1,
-			key: id
-		});
-	}
-	async findById(id) {
-		const kind = this.kind;
-		if (kind !== null) {
-			const row = await kind.get(id);
-			return row === null ? null : rowToApiKey(row.id, row.data);
-		}
-		const results = await this.store.query.query({
-			collection: API_KEYS_COLLECTION$1,
-			filter: { where: { id } }
-		});
-		if (results.length === 0) return null;
-		return parseApiKey(results[0].data);
-	}
-};
-//#endregion
 //#region ../../node_modules/bcryptjs/index.js
 /**
 * The random implementation to use as a fallback.
@@ -6335,6 +6254,7 @@ var AuthManager = class {
 * cannot be stored is logged loudly instead, and never blocks the action
 * (a login must not fail because the audit table is busy).
 */
+var import_read_all_rows = require_read_all_rows();
 /**
 * @durable class=ledger owner=local-auth
 *   write="one row per audited auth event: a second factor skipped from a trusted
@@ -6389,7 +6309,7 @@ var AUTH_AUDIT_ACTIONS = [
 ];
 var RETENTION_MS = 90 * 864e5;
 var MAX_LIST = 500;
-function parseRecord$1(data) {
+function parseRecord$2(data) {
 	const id = data["id"];
 	const rawAt = data["at"];
 	const at = typeof rawAt === "number" ? rawAt : typeof rawAt === "string" && rawAt.trim() !== "" && Number.isFinite(Number(rawAt)) ? Number(rawAt) : null;
@@ -6482,7 +6402,7 @@ var AuthAuditLog = class {
 			order: "at",
 			desc: true,
 			limit
-		})).records.map((row) => parseRecord$1({
+		})).records.map((row) => parseRecord$2({
 			id: row.id,
 			at: row.at,
 			action: row.data.action,
@@ -6493,7 +6413,7 @@ var AuthAuditLog = class {
 		return (await this.store.query.query({
 			collection: AUTH_AUDIT_COLLECTION,
 			...input.userId !== void 0 ? { filter: { where: { userId: input.userId } } } : {}
-		})).map((row) => parseRecord$1(row.data)).filter((r) => r !== null).toSorted((a, b) => b.at - a.at).slice(0, limit);
+		})).map((row) => parseRecord$2(row.data)).filter((r) => r !== null).toSorted((a, b) => b.at - a.at).slice(0, limit);
 	}
 	/** Delete rows older than 90 days. Returns how many. */
 	async reap() {
@@ -6709,7 +6629,7 @@ var PLATFORMS = [
 	"web",
 	"other"
 ];
-function parseRecord(data) {
+function parseRecord$1(data) {
 	const id = str$1(data, "id");
 	const userId = str$1(data, "userId");
 	const deviceName = str$1(data, "deviceName");
@@ -6774,7 +6694,7 @@ var DeviceCredentialManager = class {
 		const kind = this.deps.deviceCredentialsKind ?? null;
 		if (kind !== null) {
 			for (const row of await (0, import_read_all_rows.readAllRows)(kind)) {
-				const record = parseRecord({
+				const record = parseRecord$1({
 					id: row.id,
 					...row.data
 				});
@@ -6784,7 +6704,7 @@ var DeviceCredentialManager = class {
 		}
 		const rows = await this.store.query.query({ collection: DEVICE_CREDENTIALS_COLLECTION });
 		for (const row of rows) {
-			const record = parseRecord(row.data);
+			const record = parseRecord$1(row.data);
 			if (record !== null) this.records.set(record.id, record);
 		}
 	}
@@ -7205,7 +7125,6 @@ var USERS_COLLECTION$1 = "users";
 *     expiry column and no sweep, so a key lives until someone removes it (or the
 *     destructive `declareCollection` rebuild takes the table)."
 */
-var API_KEYS_COLLECTION = "api_keys";
 /**
 * @durable class=config owner=local-auth
 *   write="none since D895 — the pre-D892 scoped-token rows are kept on disk,
@@ -7294,52 +7213,6 @@ var USERS_COLUMNS = [
 		notNull: true
 	}
 ];
-var API_KEYS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "label",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "isAdmin",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "tokenHash",
-		type: "TEXT",
-		notNull: true,
-		unique: true
-	},
-	{
-		name: "tokenPrefix",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "allowedProviders",
-		type: "JSON"
-	},
-	{
-		name: "allowedDevices",
-		type: "JSON"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "lastUsedAt",
-		type: "INTEGER"
-	}
-];
 var USER_TOTP_COLUMNS = [
 	{
 		name: "userId",
@@ -7457,14 +7330,6 @@ async function declareAuthSchema(store, options) {
 		collection: USERS_COLLECTION$1,
 		columns: USERS_COLUMNS
 	});
-	if (!skip.has("api_keys")) await store.declareCollection.mutate({
-		collection: API_KEYS_COLLECTION,
-		columns: API_KEYS_COLUMNS,
-		indexes: [{
-			name: "idx_api_keys_token_prefix",
-			columns: ["tokenPrefix"]
-		}]
-	});
 	if (!skip.has("scoped_tokens")) await store.declareCollection.mutate({
 		collection: SCOPED_TOKENS_COLLECTION,
 		columns: SCOPED_TOKENS_COLUMNS,
@@ -7538,7 +7403,6 @@ async function declareAuthSchema(store, options) {
 */
 var DAY_MS = 864e5;
 var UserBodySchema = UserRecordSchema.omit({ id: true });
-var ApiKeyBodySchema = ApiKeyRecordSchema.omit({ id: true });
 var ScopedTokenBodySchema = ScopedTokenSchema.omit({ id: true });
 var AdminTokenBodySchema = z.object({
 	createdBy: z.string(),
@@ -7626,18 +7490,6 @@ var _localAuthRecordKinds = defineRecordKinds({
 		}],
 		retention: { none: "row goes only when an operator deletes the user; destructive declareCollection rebuild wipes all accounts" }
 	},
-	"api-keys": {
-		schema: ApiKeyBodySchema,
-		class: "config",
-		writeTrigger: "legacy list/revoke only — nothing creates new API keys",
-		device: "none",
-		at: "none",
-		indexes: [{
-			name: "prefix",
-			fields: ["tokenPrefix"]
-		}],
-		retention: { none: "explicit revoke only" }
-	},
 	"scoped-tokens": {
 		schema: ScopedTokenBodySchema,
 		class: "config",
@@ -7774,7 +7626,6 @@ var _localAuthRecordKinds = defineRecordKinds({
 });
 var localAuthRecordKinds = _localAuthRecordKinds;
 var localAuthUsersRecordKind = _localAuthRecordKinds.users;
-var localAuthApiKeysRecordKind = _localAuthRecordKinds["api-keys"];
 _localAuthRecordKinds["scoped-tokens"];
 _localAuthRecordKinds["admin-tokens"];
 var localAuthLoginSessionsRecordKind = _localAuthRecordKinds["login-sessions"];
@@ -7787,7 +7638,6 @@ var localAuthAuthAuditRecordKind = _localAuthRecordKinds["auth-audit"];
 /** Legacy collections that must not be `declareCollection` once these kinds are live. */
 var LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS = [
 	USERS_COLLECTION$1,
-	API_KEYS_COLLECTION,
 	SCOPED_TOKENS_COLLECTION,
 	ADMIN_TOKENS_COLLECTION,
 	LOGIN_SESSIONS_COLLECTION,
@@ -7800,7 +7650,6 @@ var LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS = [
 function localAuthRecordStoresOf(records) {
 	return {
 		users: records.kind(localAuthUsersRecordKind),
-		apiKeys: records.kind(localAuthApiKeysRecordKind),
 		loginSessions: records.kind(localAuthLoginSessionsRecordKind),
 		loginSessionCutoffs: records.kind(localAuthLoginSessionCutoffsRecordKind),
 		oauthSessions: records.kind(localAuthOauthSessionsRecordKind),
@@ -8720,6 +8569,18 @@ function getUserManagementInternal(provider) {
 	return internal;
 }
 //#endregion
+//#region src/auth/parse-record.ts
+function parseRecord(kind, schema, data) {
+	try {
+		return schema.parse(data);
+	} catch (err) {
+		const topKeys = data && typeof data === "object" && !Array.isArray(data) ? Object.keys(data).join(", ") || "(empty)" : `(non-object: ${typeof data})`;
+		const detail = err instanceof Error ? err.message : String(err);
+		const hint = data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 1 && "data" in data ? " This shape is the legacy double-wrap from a stale settings-store query path. Restart the server with the latest @camstack/system build." : "";
+		throw new Error(`Failed to parse ${kind} from settings store. Top-level keys=[${topKeys}].${hint} Underlying: ${detail}`, { cause: err });
+	}
+}
+//#endregion
 //#region src/auth/user-manager.ts
 var USERS_COLLECTION = "users";
 /**
@@ -8731,7 +8592,7 @@ var USERS_COLLECTION = "users";
 var FIRST_BOOT_ADMIN_USERNAME = "admin";
 var FIRST_BOOT_ADMIN_PASSWORD = "changeme";
 function parseUser(data) {
-	return parseRecord$2("user", UserRecordSchema, data);
+	return parseRecord("user", UserRecordSchema, data);
 }
 function userToBody(user) {
 	const { id: _id, ...body } = user;
@@ -12121,7 +11982,6 @@ function toAuthResult(user) {
 var LocalAuthAddon = class extends BaseAddon {
 	authManager = null;
 	userManager = null;
-	apiKeyManager = null;
 	oauthSessionManager = null;
 	reapTimer = null;
 	totpManager = null;
@@ -12157,10 +12017,6 @@ var LocalAuthAddon = class extends BaseAddon {
 				usersKind: authStores.users,
 				legacyStore: store
 			}, this.authManager);
-			this.apiKeyManager = new ApiKeyManager({
-				apiKeysKind: authStores.apiKeys,
-				legacyStore: store
-			});
 			this.oauthSessionManager = new OauthSessionManager({ oauthSessionsKind: authStores.oauthSessions });
 			this.totpManager = new TotpManager({
 				userTotpKind: authStores.userTotp,
@@ -12325,15 +12181,6 @@ var LocalAuthAddon = class extends BaseAddon {
 					totpEnabled
 				};
 			},
-			listApiKeys: async () => {
-				if (!this.apiKeyManager) return [];
-				return this.apiKeyManager.listAll();
-			},
-			revokeApiKey: async (input) => {
-				if (!this.apiKeyManager) throw new Error("API key management not available");
-				await this.apiKeyManager.revoke(input.id);
-				return { success: true };
-			},
 			oauthIssueCode: async (input) => {
 				return lazyOauthGrants().oauthIssueCode(input);
 			},
@@ -12694,7 +12541,6 @@ var LocalAuthAddon = class extends BaseAddon {
 		}
 		this.authManager = null;
 		this.userManager = null;
-		this.apiKeyManager = null;
 		this.oauthSessionManager = null;
 		this.externalIdentities = null;
 		this.loginSessions = null;
@@ -12704,4 +12550,4 @@ var LocalAuthAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { LocalAuthAddon, LocalAuthAddon as default, SettingsReadUnavailableError as _, attachUserManagementInternal as a, DeviceCaStore as c, onSessionsRevoked as d, DeviceCredentialManager as f, parseTokenExpiry as g, AuthManager as h, USER_MANAGEMENT_INTERNAL as i, LoginSessionManager as l, AuthAuditLog as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, PREVIOUS_LEAF_GRACE_MS as p, UserManager as r, preferencesLimitReasonOf as s, FIRST_BOOT_ADMIN_PASSWORD as t, REFRESH_TOKEN_PREFIX as u, isSettingsReadUnavailable as v, ApiKeyManager as y };
+export { LocalAuthAddon, LocalAuthAddon as default, SettingsReadUnavailableError as _, attachUserManagementInternal as a, DeviceCaStore as c, onSessionsRevoked as d, DeviceCredentialManager as f, parseTokenExpiry as g, AuthManager as h, USER_MANAGEMENT_INTERNAL as i, LoginSessionManager as l, AuthAuditLog as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, PREVIOUS_LEAF_GRACE_MS as p, UserManager as r, preferencesLimitReasonOf as s, FIRST_BOOT_ADMIN_PASSWORD as t, REFRESH_TOKEN_PREFIX as u, isSettingsReadUnavailable as v };

package/dist/builtins/local-auth/record-kinds.d.ts

@@ -10,12 +10,10 @@
 * `scoped-tokens` and `admin-tokens` hold pre-D892 rows read by nothing since
 * D895; they stay declared so the layout is unchanged.
 */
-import { ApiKeyRecordSchema, type DefinedRecordKind, type RecordKindHandle, type RecordsAccess, ScopedTokenSchema, TokenScopeSchema, UserRecordSchema } from "@camstack/types";
+import { type DefinedRecordKind, type RecordKindHandle, type RecordsAccess, ScopedTokenSchema, TokenScopeSchema, UserRecordSchema } from "@camstack/types";
 import { z } from "zod";
 export type UserBody = Omit<z.infer<typeof UserRecordSchema>, "id">;
 export declare const UserBodySchema: z.ZodType<UserBody>;
-export type ApiKeyBody = Omit<z.infer<typeof ApiKeyRecordSchema>, "id">;
-export declare const ApiKeyBodySchema: z.ZodType<ApiKeyBody>;
 export type ScopedTokenBody = Omit<z.infer<typeof ScopedTokenSchema>, "id">;
 export declare const ScopedTokenBodySchema: z.ZodType<ScopedTokenBody>;
 export type AdminTokenBody = {
@@ -103,7 +101,6 @@ export type AuthAuditBody = {
 export declare const AuthAuditBodySchema: z.ZodType<AuthAuditBody>;
 export type LocalAuthRecordKindsMap = {
 	readonly users: DefinedRecordKind<z.ZodType<UserBody>>;
-	readonly "api-keys": DefinedRecordKind<z.ZodType<ApiKeyBody>>;
 	readonly "scoped-tokens": DefinedRecordKind<z.ZodType<ScopedTokenBody>>;
 	readonly "admin-tokens": DefinedRecordKind<z.ZodType<AdminTokenBody>>;
 	readonly "login-sessions": DefinedRecordKind<z.ZodType<LoginSessionBody>>;
@@ -116,7 +113,6 @@ export type LocalAuthRecordKindsMap = {
 };
 export declare const localAuthRecordKinds: LocalAuthRecordKindsMap;
 export declare const localAuthUsersRecordKind: DefinedRecordKind<z.ZodType<UserBody>>;
-export declare const localAuthApiKeysRecordKind: DefinedRecordKind<z.ZodType<ApiKeyBody>>;
 export declare const localAuthScopedTokensRecordKind: DefinedRecordKind<z.ZodType<ScopedTokenBody>>;
 export declare const localAuthAdminTokensRecordKind: DefinedRecordKind<z.ZodType<AdminTokenBody>>;
 export declare const localAuthLoginSessionsRecordKind: DefinedRecordKind<z.ZodType<LoginSessionBody>>;
@@ -130,7 +126,6 @@ export declare const localAuthAuthAuditRecordKind: DefinedRecordKind<z.ZodType<A
 export declare const LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS: readonly string[];
 export interface LocalAuthRecordStores {
 	readonly users: RecordKindHandle<UserBody>;
-	readonly apiKeys: RecordKindHandle<ApiKeyBody>;
 	readonly loginSessions: RecordKindHandle<LoginSessionBody>;
 	readonly loginSessionCutoffs: RecordKindHandle<LoginSessionCutoffBody>;
 	readonly oauthSessions: RecordKindHandle<OauthSessionBody>;

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dwi4JA96.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-3qdHbtyp.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CWkX17zX.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { $r as errMsg, Ca as EventCategory, Fn as localNetworkCapability, Ft as checkRoleAddress, H as HUB_MDNS_TXT_KEYS, Nr as validateCustomAddress, Tn as isDefaultAppConnectionEndpoint, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, Zn as pickAppLinkHub, ei as BaseAddon, l as CAMSTACK_APP_LINK_ORIGIN, or as resolveAppConnections, pr as resolveNotificationTapAddress, ur as resolveHubAddressRoles, xn as isAppLinkBase, yr as shortHostname } from "../../dist-CR7idLer.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-BlLwL65g.mjs";
+import { $r as BaseAddon, B as HUB_MDNS_SERVICE_TYPE, Mr as validateCustomAddress, Pn as localNetworkCapability, Pt as checkRoleAddress, Qr as errMsg, Ta as EventCategory, V as HUB_MDNS_TXT_KEYS, X as NetworkTunnelStartedDataSchema, Xn as pickAppLinkHub, ar as resolveAppConnections, bn as isAppLinkBase, c as CAMSTACK_APP_LINK_ORIGIN, fr as resolveNotificationTapAddress, lr as resolveHubAddressRoles, vr as shortHostname, wn as isDefaultAppConnectionEndpoint } from "../../dist-CfjkLTZV.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-CtHQEnb3.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dwi4JA96.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 const require_log_read_filter = require("../../log-read-filter-Bi066jwU.js");
 let zod = require("zod");
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Ln as logDestinationCapability, ei as BaseAddon } from "../../dist-CR7idLer.mjs";
+import { $r as BaseAddon, In as logDestinationCapability } from "../../dist-CfjkLTZV.mjs";
 import { n as compileLogFilter, o as lineMatches } from "../../log-read-filter-D7Ev3zm-.mjs";
 import { z } from "zod";
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dwi4JA96.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 let node_fs_promises = require("node:fs/promises");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { $r as errMsg, Bi as createEvent, Ca as EventCategory, Un as metricsProviderCapability, ei as BaseAddon, ht as UNATTRIBUTED_BUCKET_KEY, ir as reducePoints, mn as foldSnapshotByFunction, rt as ROOT_BUCKET_KEY, sr as resolveBucketMs } from "../../dist-CR7idLer.mjs";
+import { $r as BaseAddon, Hi as createEvent, Hn as metricsProviderCapability, Qr as errMsg, Ta as EventCategory, mt as UNATTRIBUTED_BUCKET_KEY, nt as ROOT_BUCKET_KEY, or as resolveBucketMs, pn as foldSnapshotByFunction, rr as reducePoints } from "../../dist-CfjkLTZV.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dwi4JA96.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 const require_coral_accelerators = require("../../coral-accelerators-oUXmmbc2.js");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { $n as platformProbeCapability, $r as errMsg, Ca as EventCategory, Gi as emitReadiness, _r as scoreRuntimes, an as enumerateInferenceDevices, ei as BaseAddon } from "../../dist-CR7idLer.mjs";
+import { $r as BaseAddon, Qn as platformProbeCapability, Qr as errMsg, Ta as EventCategory, gr as scoreRuntimes, in as enumerateInferenceDevices, qi as emitReadiness } from "../../dist-CfjkLTZV.mjs";
 import { n as nodeCoralFs, t as classifyCoralAccelerator } from "../../coral-accelerators-Qhn5TOYZ.mjs";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";

package/dist/builtins/record-entries/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dwi4JA96.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/record-entries/index.mjs

@@ -1,4 +1,4 @@
-import { da as recordSecretRef, ei as BaseAddon, ki as UnknownRecordKindError, nr as recordEntriesCapability, ra as mapSecretLeaves, ui as InvalidRecordError } from "../../dist-CR7idLer.mjs";
+import { $r as BaseAddon, Ai as UnknownRecordKindError, aa as mapSecretLeaves, li as InvalidRecordError, pa as recordSecretRef, tr as recordEntriesCapability } from "../../dist-CfjkLTZV.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dwi4JA96.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ca as EventCategory, ei as BaseAddon } from "../../dist-CR7idLer.mjs";
+import { $r as BaseAddon, Ta as EventCategory } from "../../dist-CfjkLTZV.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dwi4JA96.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { $r as errMsg, Ca as EventCategory, Dt as batteryCapability, Et as bareAddonId, Hn as memoizePinnedFfmpeg, Qr as DeviceType, Xr as DeviceFeature, Xt as deriveBatteryPresence, ei as BaseAddon, ia as nodePin, kr as streamQualityLabel, s as BatteryStatusSchema, xr as snapshotCapability } from "../../dist-CR7idLer.mjs";
+import { $r as BaseAddon, Et as batteryCapability, Or as streamQualityLabel, Qr as errMsg, Ta as EventCategory, Tt as bareAddonId, Vn as memoizePinnedFfmpeg, Yr as DeviceFeature, Yt as deriveBatteryPresence, Zr as DeviceType, br as snapshotCapability, o as BatteryStatusSchema, oa as nodePin } from "../../dist-CfjkLTZV.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dwi4JA96.js");
+const require_dist = require("../../dist-QyW9hVO2.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Dr as storageProviderCapability, ei as BaseAddon, pn as filesystemBrowseCapability } from "../../dist-CR7idLer.mjs";
+import { $r as BaseAddon, Er as storageProviderCapability, fn as filesystemBrowseCapability } from "../../dist-CfjkLTZV.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-BQlvAduo.js");
+const require_wal_maintenance = require("../../wal-maintenance-BIpPCYDi.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-BDQT7TIi.mjs";
+import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-Bs_X-di6.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/records/records-engine.d.ts

@@ -60,8 +60,19 @@ export declare class RecordsEngine implements RecordsEngineOps {
 	put(input: OwnedInput<"put">): Promise<RecordsOutput<"put">>;
 	putMany(input: OwnedInput<"putMany">): Promise<RecordsOutput<"putMany">>;
 	patch(input: OwnedInput<"patch">): Promise<RecordsOutput<"patch">>;
+	/** One patch, inside the caller's transaction (shared with `transact`). */
+	private patchRecord;
 	private refsOfRows;
 	delete(input: OwnedInput<"delete">): Promise<RecordsOutput<"delete">>;
+	/** One delete (shared with `transact`). */
+	private deleteRecord;
+	/**
+	* Several put / patch / delete in ONE SQLite transaction. The scope rule
+	* (one file, one `transactFamily`) is checked before a row moves; each op then
+	* runs the very code of the single-row write, so secrets, indexes and size
+	* bounds behave exactly as there. Any op throwing rolls the whole call back.
+	*/
+	transact(input: OwnedInput<"transact">): Promise<RecordsOutput<"transact">>;
 	deleteMany(input: OwnedInput<"deleteMany">): Promise<RecordsOutput<"deleteMany">>;
 	/** Delete the rows `selectSql` names, in batches, yielding between them. */
 	private deleteBatched;

package/dist/builtins/sqlite-storage/records/records-provider.d.ts

@@ -10,8 +10,7 @@
 *   declaration. A kind declared for another file than the one it lives in is
 *   refused (the engine never moves data, D853).
 * - **No adoption** (D900): the records migration is closed. A declaration
-*   reads no legacy table, and a retired `adoptsFrom` an older addon still
-*   sends is dropped before the catalog stores the declaration.
+*   reads no legacy table.
 */
 import { type IRecordsProvider, type IScopedLogger, type IStorageAdminProvider, type StorageKind } from "@camstack/types";
 import type { PlacementRouter } from "../placement-router.js";
@@ -46,6 +45,12 @@ export declare class RecordsProvider implements IRecordsProvider, AdminRecords {
 	histogram(input: Parameters<IRecordsProvider["histogram"]>[0]): ReturnType<IRecordsProvider["histogram"]>;
 	aggregate(input: Parameters<IRecordsProvider["aggregate"]>[0]): ReturnType<IRecordsProvider["aggregate"]>;
 	deleteWhere(input: Parameters<IRecordsProvider["deleteWhere"]>[0]): ReturnType<IRecordsProvider["deleteWhere"]>;
+	/**
+	* All ops must resolve to ONE file (`records/transact-refused` `cross-file`
+	* otherwise); that file's engine then checks the family and runs one SQLite
+	* transaction.
+	*/
+	transact(input: Parameters<IRecordsProvider["transact"]>[0]): ReturnType<IRecordsProvider["transact"]>;
 	allocateId(input: Parameters<IRecordsProvider["allocateId"]>[0]): ReturnType<IRecordsProvider["allocateId"]>;
 	/** The D865 hook body: every file that holds kinds of this owner. */
 	deleteDevice(input: Parameters<IRecordsProvider["deleteDevice"]>[0]): ReturnType<IRecordsProvider["deleteDevice"]>;