@camstack/system 1.2.89 → 1.2.91

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ut as EventCategory, _t as BaseAddon, gt as errMsg, v as addonPagesCapability } from "../../dist-Bij6agsS.mjs";
+import { Ut as EventCategory, _t as BaseAddon, gt as errMsg, v as addonPagesCapability } from "../../dist-DhrTd8LL.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ut as EventCategory, _t as BaseAddon, b as addonWidgetsCapability, gt as errMsg } from "../../dist-Bij6agsS.mjs";
+import { Ut as EventCategory, _t as BaseAddon, b as addonWidgetsCapability, gt as errMsg } from "../../dist-DhrTd8LL.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { At as createEvent, Ut as EventCategory, _t as BaseAddon, gt as errMsg, n as AlertSchema, x as alertsCapability } from "../../dist-Bij6agsS.mjs";
+import { At as createEvent, Ut as EventCategory, _t as BaseAddon, gt as errMsg, n as AlertSchema, x as alertsCapability } from "../../dist-DhrTd8LL.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");
@@ -4204,6 +4204,18 @@ function previewNextRuns(cron, count, after) {
 }
 //#endregion
 //#region src/builtins/backup-orchestrator/destination-policy.ts
+/**
+* @durable class=config owner=backup-orchestrator
+*   write="`ensureDefault` auto-creates one row the first time a `backups` storage
+*     location is listed (enabled, retentionCount 7, cron `0 3 * * *`), and an operator
+*     edit rewrites it (`upsert` = delete + insert, carrying `last_run_at` forward so a
+*     label change does not reset the schedule baseline)"
+*   retention="none — `delete(locationId)` exists but NOTHING calls it, so a policy row
+*     outlives the `StorageLocation` it names and the table only ever grows, by one row
+*     per backups location ever seen. Losing a row is recoverable: the next
+*     `listDestinations` pass re-creates it from the defaults, which silently discards
+*     the operator's own retention count and cron."
+*/
 var BACKUP_DESTINATION_POLICIES = "backup_destination_policies";
 var BACKUP_DESTINATION_POLICIES_COLUMNS = [
 	{
@@ -4590,6 +4602,18 @@ var LocationManifestLock = class {
 };
 //#endregion
 //#region src/builtins/backup-orchestrator/schedule-store.ts
+/**
+* @durable class=config owner=backup-orchestrator
+*   write="an operator creating or editing a schedule (`upsert`, implemented as
+*     delete + insert: cron, enabled, the fan-out `location_ids`, `retention_count`,
+*     optional `data_sources`), plus a `last_run_at` stamp the orchestrator writes on
+*     every due tick BEFORE the archive runs, so an upload outliving the tick cannot
+*     fire the same schedule twice"
+*   retention="only the operator's `delete(id)` — no sweep, no expiry, and `retention_count`
+*     bounds the ARCHIVES at the destination, never these rows. Losing the table stops
+*     every scheduled backup silently: no cron remains to fire, and the fan-out sets and
+*     retention counts are gone with it."
+*/
 var BACKUP_SCHEDULES = "backup_schedules";
 var BACKUP_SCHEDULES_COLUMNS = [
 	{

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { C as backupCapability, Ut as EventCategory, _t as BaseAddon } from "../../dist-Bij6agsS.mjs";
+import { C as backupCapability, Ut as EventCategory, _t as BaseAddon } from "../../dist-DhrTd8LL.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";
@@ -4189,6 +4189,18 @@ function previewNextRuns(cron, count, after) {
 }
 //#endregion
 //#region src/builtins/backup-orchestrator/destination-policy.ts
+/**
+* @durable class=config owner=backup-orchestrator
+*   write="`ensureDefault` auto-creates one row the first time a `backups` storage
+*     location is listed (enabled, retentionCount 7, cron `0 3 * * *`), and an operator
+*     edit rewrites it (`upsert` = delete + insert, carrying `last_run_at` forward so a
+*     label change does not reset the schedule baseline)"
+*   retention="none — `delete(locationId)` exists but NOTHING calls it, so a policy row
+*     outlives the `StorageLocation` it names and the table only ever grows, by one row
+*     per backups location ever seen. Losing a row is recoverable: the next
+*     `listDestinations` pass re-creates it from the defaults, which silently discards
+*     the operator's own retention count and cron."
+*/
 var BACKUP_DESTINATION_POLICIES = "backup_destination_policies";
 var BACKUP_DESTINATION_POLICIES_COLUMNS = [
 	{
@@ -4575,6 +4587,18 @@ var LocationManifestLock = class {
 };
 //#endregion
 //#region src/builtins/backup-orchestrator/schedule-store.ts
+/**
+* @durable class=config owner=backup-orchestrator
+*   write="an operator creating or editing a schedule (`upsert`, implemented as
+*     delete + insert: cron, enabled, the fan-out `location_ids`, `retention_count`,
+*     optional `data_sources`), plus a `last_run_at` stamp the orchestrator writes on
+*     every due tick BEFORE the archive runs, so an upload outliving the tick cannot
+*     fire the same schedule twice"
+*   retention="only the operator's `delete(id)` — no sweep, no expiry, and `retention_count`
+*     bounds the ARCHIVES at the destination, never these rows. Losing the table stops
+*     every scheduled backup silently: no cron remains to fire, and the fan-out sets and
+*     retention counts are gone with it."
+*/
 var BACKUP_SCHEDULES = "backup_schedules";
 var BACKUP_SCHEDULES_COLUMNS = [
 	{

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { J as logDestinationCapability, _t as BaseAddon } from "../../dist-Bij6agsS.mjs";
+import { J as logDestinationCapability, _t as BaseAddon } from "../../dist-DhrTd8LL.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-block-store.d.ts

@@ -1,4 +1,15 @@
 import { CoreBlock, CoreBlockInput, IScopedLogger, SettingsStoreClient } from '@camstack/types';
+/**
+ * @durable class=config owner=core-blocks
+ *   write="`create` and `update` persist the operator's block after it compiles;
+ *     `setStatus` rewrites what the runner reported (status, `lastChangedAt`,
+ *     `lastError`) — so a running block is written on every state change"
+ *   retention="`delete` only, when the operator removes a block. Nothing ages out,
+ *     and a row whose JSON stops validating is left on disk rather than repaired.
+ *     The real loss path is a `declareCollection` REBUILD — a legacy (id, data)
+ *     shape, or a new PK/UNIQUE/NOT-NULL-without-default column — which drops the
+ *     table and takes the operator's source code with it."
+ */
 export declare const CORE_BLOCKS_COLLECTION = "core_blocks";
 export declare const CORE_BLOCKS_COLUMNS: readonly [{
     readonly name: "id";

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -495,6 +495,17 @@ async function compileBlock(transpiler, code) {
 * is a fork failure the operator meets minutes later inside a log — so the
 * compile happens where they are still looking at the editor.
 */
+/**
+* @durable class=config owner=core-blocks
+*   write="`create` and `update` persist the operator's block after it compiles;
+*     `setStatus` rewrites what the runner reported (status, `lastChangedAt`,
+*     `lastError`) — so a running block is written on every state change"
+*   retention="`delete` only, when the operator removes a block. Nothing ages out,
+*     and a row whose JSON stops validating is left on disk rather than repaired.
+*     The real loss path is a `declareCollection` REBUILD — a legacy (id, data)
+*     shape, or a new PK/UNIQUE/NOT-NULL-without-default column — which drops the
+*     table and takes the operator's source code with it."
+*/
 var CORE_BLOCKS_COLLECTION = "core_blocks";
 var CORE_BLOCKS_COLUMNS = [
 	{

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { D as coreBlockIdFromAddonId, E as coreBlockAddonId, O as coreBlocksCapability, _t as BaseAddon, c as CoreBlockSchema, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX } from "../../dist-Bij6agsS.mjs";
+import { D as coreBlockIdFromAddonId, E as coreBlockAddonId, O as coreBlocksCapability, _t as BaseAddon, c as CoreBlockSchema, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX } from "../../dist-DhrTd8LL.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";
@@ -491,6 +491,17 @@ async function compileBlock(transpiler, code) {
 * is a fork failure the operator meets minutes later inside a log — so the
 * compile happens where they are still looking at the editor.
 */
+/**
+* @durable class=config owner=core-blocks
+*   write="`create` and `update` persist the operator's block after it compiles;
+*     `setStatus` rewrites what the runner reported (status, `lastChangedAt`,
+*     `lastError`) — so a running block is written on every state change"
+*   retention="`delete` only, when the operator removes a block. Nothing ages out,
+*     and a row whose JSON stops validating is left on disk rather than repaired.
+*     The real loss path is a `declareCollection` REBUILD — a legacy (id, data)
+*     shape, or a new PK/UNIQUE/NOT-NULL-without-default column — which drops the
+*     table and takes the operator's source code with it."
+*/
 var CORE_BLOCKS_COLLECTION = "core_blocks";
 var CORE_BLOCKS_COLUMNS = [
 	{

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { Ct as DeviceType, Et as WELL_KNOWN_TAB_MAP, Ft as isDeviceConfigCap, Ht as sleep, I as enumerateItemArrayFields, L as enumerateSchemaFields, M as deviceStateCapability, N as deviceStatusCapability, Q as normalizeUnit, St as DeviceRole, T as buildStreamParamsConfigSchema, Ut as EventCategory, _t as BaseAddon, a as CAP_NAMES_WITH_STATUS, et as parseStreamParamsFormPatch, gt as errMsg, j as deviceManagerCapability, p as STREAM_PROFILE_META, rt as runtimeStatePolicyFor, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, xt as DeviceFeature } from "../../dist-Bij6agsS.mjs";
+import { Ct as DeviceType, Et as WELL_KNOWN_TAB_MAP, Ft as isDeviceConfigCap, Ht as sleep, I as enumerateItemArrayFields, L as enumerateSchemaFields, M as deviceStateCapability, N as deviceStatusCapability, Q as normalizeUnit, St as DeviceRole, T as buildStreamParamsConfigSchema, Ut as EventCategory, _t as BaseAddon, a as CAP_NAMES_WITH_STATUS, et as parseStreamParamsFormPatch, gt as errMsg, j as deviceManagerCapability, p as STREAM_PROFILE_META, rt as runtimeStatePolicyFor, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, xt as DeviceFeature } from "../../dist-DhrTd8LL.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { At as createEvent, Ct as DeviceType, P as doorbellCapability, U as isSameAddonId, Ut as EventCategory, _t as BaseAddon, gt as errMsg, w as bareAddonId } from "../../dist-Bij6agsS.mjs";
+import { At as createEvent, Ct as DeviceType, P as doorbellCapability, U as isSameAddonId, Ut as EventCategory, _t as BaseAddon, gt as errMsg, w as bareAddonId } from "../../dist-DhrTd8LL.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { J as logDestinationCapability, _t as BaseAddon } from "../../dist-Bij6agsS.mjs";
+import { J as logDestinationCapability, _t as BaseAddon } from "../../dist-DhrTd8LL.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { At as createEvent, Ut as EventCategory, _t as BaseAddon, gt as errMsg } from "../../dist-Bij6agsS.mjs";
+import { At as createEvent, Ut as EventCategory, _t as BaseAddon, gt as errMsg } from "../../dist-DhrTd8LL.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/auth-schema.d.ts

@@ -1,7 +1,42 @@
 import { SettingsStoreClient } from '@camstack/types';
+/**
+ * @durable class=config owner=local-auth
+ *   write="an operator creates a user, or `ensureAdminExists` seeds/re-syncs the
+ *     configured admin at boot; updated on scope, isAdmin and password edits"
+ *   retention="none — a row goes only when an operator deletes the user. A
+ *     `declareCollection` that adds a PK/UNIQUE/NOT-NULL-without-default column
+ *     REBUILDS the table: every account is wiped and only the configured admin
+ *     comes back on the next boot."
+ */
 export declare const USERS_COLLECTION = "users";
+/**
+ * @durable class=config owner=local-auth
+ *   write="an operator mints an API key; `validateToken` rewrites `lastUsedAt` on
+ *     every request the key authorises"
+ *   retention="none — an explicit `revoke` is the only delete. API keys have no
+ *     expiry column and no sweep, so a key lives until someone removes it (or the
+ *     destructive `declareCollection` rebuild takes the table)."
+ */
 export declare const API_KEYS_COLLECTION = "api_keys";
+/**
+ * @durable class=config owner=local-auth
+ *   write="an operator or the CLI mints a scoped token; `validate` fires
+ *     `updateLastUsed` on every accepted call"
+ *   retention="`revoke` deletes one. The daily sweep `reapExpired` drops rows past
+ *     `expiresAt` — a NULL expiry is a deliberate never-expires token and BETWEEN
+ *     never matches it. `cleanupOrphans` drops tokens owned by the legacy 'system'
+ *     id or by a user that no longer exists."
+ */
 export declare const SCOPED_TOKENS_COLLECTION = "scoped_tokens";
+/**
+ * @durable class=ledger owner=local-auth
+ *   write="one row per redeemed OAuth code — every completed account link through
+ *     `oauthExchangeCode`; `touch` rewrites `lastUsedAt` on each refresh"
+ *   retention="ONLY revoked rows are pruned: the daily sweep deletes sessions
+ *     revoked more than OAUTH_REVOKED_RETENTION_MS (30 d) ago. An ACTIVE session
+ *     has `revokedAt` NULL, never expires and is never swept — the table grows one
+ *     row per login until an operator revokes the link."
+ */
 export declare const OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
 /**
  * TOTP enrollment table — split off from `users` to avoid the
@@ -15,6 +50,13 @@ export declare const OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
  *
  * "Enabled" means `confirmedAt != null`. A half-enrolled row (`confirmedAt
  * = null`) is INACTIVE — `verifyTotp` returns false until confirmation.
+ *
+ * @durable class=config owner=local-auth
+ *   write="`setup` inserts a fresh secret for the user (deleting any pending row
+ *     first); `confirm` flips `confirmedAt` once a valid code proves possession"
+ *   retention="`disable` deletes the row, and `setup` deletes before re-inserting.
+ *     Nothing else prunes — deleting a USER does not cascade here, so their
+ *     enrollment row outlives the account."
  */
 export declare const USER_TOTP_COLLECTION = "user_totp";
 /**

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -8823,9 +8823,44 @@ var TotpManager = class {
 };
 //#endregion
 //#region src/builtins/local-auth/auth-schema.ts
+/**
+* @durable class=config owner=local-auth
+*   write="an operator creates a user, or `ensureAdminExists` seeds/re-syncs the
+*     configured admin at boot; updated on scope, isAdmin and password edits"
+*   retention="none — a row goes only when an operator deletes the user. A
+*     `declareCollection` that adds a PK/UNIQUE/NOT-NULL-without-default column
+*     REBUILDS the table: every account is wiped and only the configured admin
+*     comes back on the next boot."
+*/
 var USERS_COLLECTION = "users";
+/**
+* @durable class=config owner=local-auth
+*   write="an operator mints an API key; `validateToken` rewrites `lastUsedAt` on
+*     every request the key authorises"
+*   retention="none — an explicit `revoke` is the only delete. API keys have no
+*     expiry column and no sweep, so a key lives until someone removes it (or the
+*     destructive `declareCollection` rebuild takes the table)."
+*/
 var API_KEYS_COLLECTION = "api_keys";
+/**
+* @durable class=config owner=local-auth
+*   write="an operator or the CLI mints a scoped token; `validate` fires
+*     `updateLastUsed` on every accepted call"
+*   retention="`revoke` deletes one. The daily sweep `reapExpired` drops rows past
+*     `expiresAt` — a NULL expiry is a deliberate never-expires token and BETWEEN
+*     never matches it. `cleanupOrphans` drops tokens owned by the legacy 'system'
+*     id or by a user that no longer exists."
+*/
 var SCOPED_TOKENS_COLLECTION = "scoped_tokens";
+/**
+* @durable class=ledger owner=local-auth
+*   write="one row per redeemed OAuth code — every completed account link through
+*     `oauthExchangeCode`; `touch` rewrites `lastUsedAt` on each refresh"
+*   retention="ONLY revoked rows are pruned: the daily sweep deletes sessions
+*     revoked more than OAUTH_REVOKED_RETENTION_MS (30 d) ago. An ACTIVE session
+*     has `revokedAt` NULL, never expires and is never swept — the table grows one
+*     row per login until an operator revokes the link."
+*/
 var OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
 /**
 * TOTP enrollment table — split off from `users` to avoid the
@@ -8839,6 +8874,13 @@ var OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
 *
 * "Enabled" means `confirmedAt != null`. A half-enrolled row (`confirmedAt
 * = null`) is INACTIVE — `verifyTotp` returns false until confirmation.
+*
+* @durable class=config owner=local-auth
+*   write="`setup` inserts a fresh secret for the user (deleting any pending row
+*     first); `confirm` flips `confirmedAt` once a valid code proves possession"
+*   retention="`disable` deletes the row, and `setup` deletes before re-inserting.
+*     Nothing else prunes — deleting a USER does not cascade here, so their
+*     enrollment row outlives the account."
 */
 var USER_TOTP_COLLECTION = "user_totp";
 var USERS_COLUMNS = [

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { S as authProviderCapability, _ as UserRecordSchema, _t as BaseAddon, m as ScopedTokenSchema, pt as userManagementCapability, r as ApiKeyRecordSchema } from "../../dist-Bij6agsS.mjs";
+import { S as authProviderCapability, _ as UserRecordSchema, _t as BaseAddon, m as ScopedTokenSchema, pt as userManagementCapability, r as ApiKeyRecordSchema } from "../../dist-DhrTd8LL.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -8815,9 +8815,44 @@ var TotpManager = class {
 };
 //#endregion
 //#region src/builtins/local-auth/auth-schema.ts
+/**
+* @durable class=config owner=local-auth
+*   write="an operator creates a user, or `ensureAdminExists` seeds/re-syncs the
+*     configured admin at boot; updated on scope, isAdmin and password edits"
+*   retention="none — a row goes only when an operator deletes the user. A
+*     `declareCollection` that adds a PK/UNIQUE/NOT-NULL-without-default column
+*     REBUILDS the table: every account is wiped and only the configured admin
+*     comes back on the next boot."
+*/
 var USERS_COLLECTION = "users";
+/**
+* @durable class=config owner=local-auth
+*   write="an operator mints an API key; `validateToken` rewrites `lastUsedAt` on
+*     every request the key authorises"
+*   retention="none — an explicit `revoke` is the only delete. API keys have no
+*     expiry column and no sweep, so a key lives until someone removes it (or the
+*     destructive `declareCollection` rebuild takes the table)."
+*/
 var API_KEYS_COLLECTION = "api_keys";
+/**
+* @durable class=config owner=local-auth
+*   write="an operator or the CLI mints a scoped token; `validate` fires
+*     `updateLastUsed` on every accepted call"
+*   retention="`revoke` deletes one. The daily sweep `reapExpired` drops rows past
+*     `expiresAt` — a NULL expiry is a deliberate never-expires token and BETWEEN
+*     never matches it. `cleanupOrphans` drops tokens owned by the legacy 'system'
+*     id or by a user that no longer exists."
+*/
 var SCOPED_TOKENS_COLLECTION = "scoped_tokens";
+/**
+* @durable class=ledger owner=local-auth
+*   write="one row per redeemed OAuth code — every completed account link through
+*     `oauthExchangeCode`; `touch` rewrites `lastUsedAt` on each refresh"
+*   retention="ONLY revoked rows are pruned: the daily sweep deletes sessions
+*     revoked more than OAUTH_REVOKED_RETENTION_MS (30 d) ago. An ACTIVE session
+*     has `revokedAt` NULL, never expires and is never swept — the table grows one
+*     row per login until an operator revokes the link."
+*/
 var OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
 /**
 * TOTP enrollment table — split off from `users` to avoid the
@@ -8831,6 +8866,13 @@ var OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
 *
 * "Enabled" means `confirmedAt != null`. A half-enrolled row (`confirmedAt
 * = null`) is INACTIVE — `verifyTotp` returns false until confirmation.
+*
+* @durable class=config owner=local-auth
+*   write="`setup` inserts a fresh secret for the user (deleting any pending row
+*     first); `confirm` flips `confirmedAt` once a valid code proves possession"
+*   retention="`disable` deletes the row, and `setup` deletes before re-inserting.
+*     Nothing else prunes — deleting a USER does not cascade here, so their
+*     enrollment row outlives the account."
 */
 var USER_TOTP_COLLECTION = "user_totp";
 var USERS_COLUMNS = [

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Ut as EventCategory, _t as BaseAddon, q as localNetworkCapability } from "../../dist-Bij6agsS.mjs";
+import { Ut as EventCategory, _t as BaseAddon, q as localNetworkCapability } from "../../dist-DhrTd8LL.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { J as logDestinationCapability, _t as BaseAddon } from "../../dist-Bij6agsS.mjs";
+import { J as logDestinationCapability, _t as BaseAddon } from "../../dist-DhrTd8LL.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { At as createEvent, Ut as EventCategory, Z as metricsProviderCapability, _t as BaseAddon } from "../../dist-Bij6agsS.mjs";
+import { At as createEvent, Ut as EventCategory, Z as metricsProviderCapability, _t as BaseAddon } from "../../dist-DhrTd8LL.mjs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { F as enumerateInferenceDevices, Mt as emitReadiness, Ut as EventCategory, _t as BaseAddon, gt as errMsg, ot as scoreRuntimes, tt as platformProbeCapability } from "../../dist-Bij6agsS.mjs";
+import { F as enumerateInferenceDevices, Mt as emitReadiness, Ut as EventCategory, _t as BaseAddon, gt as errMsg, ot as scoreRuntimes, tt as platformProbeCapability } from "../../dist-DhrTd8LL.mjs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ut as EventCategory, _t as BaseAddon } from "../../dist-Bij6agsS.mjs";
+import { Ut as EventCategory, _t as BaseAddon } from "../../dist-DhrTd8LL.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Ct as DeviceType, It as nodePin, Ut as EventCategory, _t as BaseAddon, ct as snapshotCapability, ft as streamQualityLabel, gt as errMsg, i as BatteryStatusSchema, w as bareAddonId, xt as DeviceFeature } from "../../dist-Bij6agsS.mjs";
+import { Ct as DeviceType, It as nodePin, Ut as EventCategory, _t as BaseAddon, ct as snapshotCapability, ft as streamQualityLabel, gt as errMsg, i as BatteryStatusSchema, w as bareAddonId, xt as DeviceFeature } from "../../dist-DhrTd8LL.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dq0ebOuS.js");
+const require_dist = require("../../dist-9Gfk4KOk.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { _t as BaseAddon, dt as storageProviderCapability, z as filesystemBrowseCapability } from "../../dist-Bij6agsS.mjs";
+import { _t as BaseAddon, dt as storageProviderCapability, z as filesystemBrowseCapability } from "../../dist-DhrTd8LL.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";