@camstack/addon-notifiers 1.2.135 → 1.2.601

package/dist/addon.js

@@ -29,7 +29,7 @@ let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = __toESM(node_path);
 let node_url = require("node:url");
-//#region ../types/dist/event-category-C4hVnRo8.mjs
+//#region ../types/dist/event-category-BvOFi6PY.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -93,6 +93,24 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* consumes this category and maps it to the `addon-crash-loop` kind.
 	*/
 	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
+	/**
+	* A runner whose addon refused to start with a typed reason (D877) - parked
+	* in `refused`, never counted by the crash breaker, retried on operator
+	* action. One event per refusal.
+	*/
+	EventCategory["AddonRunnerRefused"] = "addon.runner-refused";
+	/**
+	* A runner settled on a state (D877): `running` (READY), `crashed`, `failed` or
+	* `refused`. In-process telemetry for the boot check (re-evaluate while any
+	* runner is still pending) and the alert centre (close a recovered runner).
+	*/
+	EventCategory["ProcessStateChanged"] = "process.state-changed";
+	/**
+	* The node's one-shot runner boot check (D877): planned runners against the
+	* process service, `degraded` when any is failed, refused or missing. The
+	* alert centre turns it into one alert and a direct critical push.
+	*/
+	EventCategory["SystemRunnerCheck"] = "system.runner-check";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -4135,6 +4153,12 @@ var numberProcessor = (schema, ctx, _json, _params) => {
 var booleanProcessor = (_schema, _ctx, json, _params) => {
 	json.type = "boolean";
 };
+var bigintProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("BigInt cannot be represented in JSON Schema");
+};
+var symbolProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Symbols cannot be represented in JSON Schema");
+};
 var nullProcessor = (_schema, ctx, json, _params) => {
 	if (ctx.target === "openapi-3.0") {
 		json.type = "string";
@@ -4142,12 +4166,17 @@ var nullProcessor = (_schema, ctx, json, _params) => {
 		json.enum = [null];
 	} else json.type = "null";
 };
+var undefinedProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Undefined cannot be represented in JSON Schema");
+};
 var voidProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Void cannot be represented in JSON Schema");
 };
 var neverProcessor = (_schema, _ctx, json, _params) => {
 	json.not = {};
 };
+var anyProcessor = (_schema, _ctx, _json, _params) => {};
+var unknownProcessor = (_schema, _ctx, _json, _params) => {};
 var dateProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Date cannot be represented in JSON Schema");
 };
@@ -4179,12 +4208,53 @@ var literalProcessor = (schema, ctx, json, _params) => {
 		json.enum = vals;
 	}
 };
+var nanProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("NaN cannot be represented in JSON Schema");
+};
+var templateLiteralProcessor = (schema, _ctx, json, _params) => {
+	const _json = json;
+	const pattern = schema._zod.pattern;
+	if (!pattern) throw new Error("Pattern not found in template literal");
+	_json.type = "string";
+	_json.pattern = pattern.source;
+};
+var fileProcessor = (schema, _ctx, json, _params) => {
+	const _json = json;
+	const file = {
+		type: "string",
+		format: "binary",
+		contentEncoding: "binary"
+	};
+	const { minimum, maximum, mime } = schema._zod.bag;
+	if (minimum !== void 0) file.minLength = minimum;
+	if (maximum !== void 0) file.maxLength = maximum;
+	if (mime) if (mime.length === 1) {
+		file.contentMediaType = mime[0];
+		Object.assign(_json, file);
+	} else {
+		Object.assign(_json, file);
+		_json.anyOf = mime.map((m) => ({ contentMediaType: m }));
+	}
+	else Object.assign(_json, file);
+};
+var successProcessor = (_schema, _ctx, json, _params) => {
+	json.type = "boolean";
+};
 var customProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Custom types cannot be represented in JSON Schema");
 };
+var functionProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Function types cannot be represented in JSON Schema");
+};
 var transformProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Transforms cannot be represented in JSON Schema");
 };
+var mapProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Map cannot be represented in JSON Schema");
+};
+var setProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Set cannot be represented in JSON Schema");
+};
 var arrayProcessor = (schema, ctx, _json, params) => {
 	const json = _json;
 	const def = schema._zod.def;
@@ -4389,6 +4459,12 @@ var readonlyProcessor = (schema, ctx, json, params) => {
 	seen.ref = def.innerType;
 	json.readOnly = true;
 };
+var promiseProcessor = (schema, ctx, _json, params) => {
+	const def = schema._zod.def;
+	process(def.innerType, ctx, params);
+	const seen = ctx.seen.get(schema);
+	seen.ref = def.innerType;
+};
 var optionalProcessor = (schema, ctx, _json, params) => {
 	const def = schema._zod.def;
 	process(def.innerType, ctx, params);
@@ -4401,6 +4477,81 @@ var lazyProcessor = (schema, ctx, _json, params) => {
 	const seen = ctx.seen.get(schema);
 	seen.ref = innerType;
 };
+var allProcessors = {
+	string: stringProcessor,
+	number: numberProcessor,
+	boolean: booleanProcessor,
+	bigint: bigintProcessor,
+	symbol: symbolProcessor,
+	null: nullProcessor,
+	undefined: undefinedProcessor,
+	void: voidProcessor,
+	never: neverProcessor,
+	any: anyProcessor,
+	unknown: unknownProcessor,
+	date: dateProcessor,
+	enum: enumProcessor,
+	literal: literalProcessor,
+	nan: nanProcessor,
+	template_literal: templateLiteralProcessor,
+	file: fileProcessor,
+	success: successProcessor,
+	custom: customProcessor,
+	function: functionProcessor,
+	transform: transformProcessor,
+	map: mapProcessor,
+	set: setProcessor,
+	array: arrayProcessor,
+	object: objectProcessor,
+	union: unionProcessor,
+	intersection: intersectionProcessor,
+	tuple: tupleProcessor,
+	record: recordProcessor,
+	nullable: nullableProcessor,
+	nonoptional: nonoptionalProcessor,
+	default: defaultProcessor,
+	prefault: prefaultProcessor,
+	catch: catchProcessor,
+	pipe: pipeProcessor,
+	readonly: readonlyProcessor,
+	promise: promiseProcessor,
+	optional: optionalProcessor,
+	lazy: lazyProcessor
+};
+function toJSONSchema(input, params) {
+	if ("_idmap" in input) {
+		const registry = input;
+		const ctx = initializeContext({
+			...params,
+			processors: allProcessors
+		});
+		const defs = {};
+		for (const entry of registry._idmap.entries()) {
+			const [_, schema] = entry;
+			process(schema, ctx);
+		}
+		const schemas = {};
+		ctx.external = {
+			registry,
+			uri: params?.uri,
+			defs
+		};
+		for (const entry of registry._idmap.entries()) {
+			const [key, schema] = entry;
+			extractDefs(ctx, schema);
+			schemas[key] = finalize(ctx, schema);
+		}
+		if (Object.keys(defs).length > 0) schemas.__shared = { [ctx.target === "draft-2020-12" ? "$defs" : "definitions"]: defs };
+		return { schemas };
+	}
+	const ctx = initializeContext({
+		...params,
+		processors: allProcessors
+	});
+	process(input, ctx);
+	extractDefs(ctx, input);
+	return finalize(ctx, input);
+}
 //#endregion
 //#region ../../node_modules/zod/v4/classic/iso.js
 var ZodISODateTime = /*@__PURE__*/ $constructor("ZodISODateTime", (inst, def) => {
@@ -5417,7 +5568,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DRqxtc0C.mjs
+//#region ../types/dist/sleep-bZIhUvjd.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5534,7 +5685,7 @@ function isKeychainStoredField(field) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$2(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -5545,12 +5696,12 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$5(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 function isSecretClear(value) {
-	return isRecord$2(value) && value["$secretClear"] === true;
+	return isRecord$5(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -6160,7 +6311,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$1(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -6173,7 +6324,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$4(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -6228,7 +6379,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$4) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -6244,7 +6395,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$1(row)) {
+		if (!isRecord$4(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -6269,7 +6420,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$1(incoming)) {
+			if (!isRecord$4(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -6277,7 +6428,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$1(stored) ? stored : {};
+			const storedObj = isRecord$4(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -6400,7 +6551,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$1(v)) {
+		if (isRecord$4(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -6668,7 +6819,6 @@ function createHandle(raw, opts) {
 	const writeAddon = (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p));
 	const readAddonStoreResult = raw.readAddonStoreResult;
 	const readAddonStoreKeyResult = raw.readAddonStoreKeyResult;
-	const readDeviceStoreBatch = raw.readDeviceStoreBatch;
 	const overrides = {
 		readAddonStore: async () => resolveRead("addon", await raw.readAddonStore()),
 		...readAddonStoreResult !== void 0 ? { readAddonStoreResult: async () => {
@@ -6692,12 +6842,12 @@ function createHandle(raw, opts) {
 			};
 		} } : {},
 		readDeviceStore: async (deviceId) => resolveRead(`device:${deviceId}`, await raw.readDeviceStore(deviceId)),
-		...readDeviceStoreBatch !== void 0 ? { readDeviceStoreBatch: async (deviceIds) => {
-			const rows = await readDeviceStoreBatch.call(raw, deviceIds);
+		readDeviceStoreBatch: async (deviceIds) => {
+			const rows = await raw.readDeviceStoreBatch(deviceIds);
 			const out = /* @__PURE__ */ new Map();
 			for (const [deviceId, blob] of rows) out.set(deviceId, await resolveRead(`device:${deviceId}`, blob));
 			return out;
-		} } : {},
+		},
 		writeAddonStore: async (patch) => {
 			await writeAddon(patch);
 		},
@@ -7324,7 +7474,7 @@ var BaseAddon = class {
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
-			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
+			ctx.api.addons.restartAddon.mutate({ addonId }).then(() => {
 				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
@@ -7524,7 +7674,7 @@ var BaseAddon = class {
 		return this._addonSecretTree;
 	}
 	deviceSecretTree() {
-		this._deviceSecretTree ??= secretTreeFromSchema(this.deviceSettingsSchema());
+		this._deviceSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.deviceSettingsSchema()), this.secretStatePaths);
 		return this._deviceSecretTree;
 	}
 	/**
@@ -7600,42 +7750,135 @@ var BaseAddon = class {
 		this[timerOf] = timer;
 	}
 	/**
-	* Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
-	* transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
-	* swap, or any race where the SqliteSettingsBackend is between shutdown and
-	* re-initialize) doesn't propagate up into `initialize()` and leave the
+	* Wrap `ctx.settings.readAddonStore()` with a retry budget so a transient
+	* settings-store outage doesn't propagate up into `initialize()` and leave the
 	* addon permanently broken.
 	*
-	* Retry only the two known infra fingerprints. Anything else propagates so
-	* real bugs surface immediately. After the budget expires we fall back to
-	* `{}` (defaults) — the addon's first successful patch will rehydrate.
+	* Two kinds of outage, two budgets:
+	*  - the store's own restart fingerprints (`SqliteSettingsBackend not
+	*    initialized`, `provider not available`): a short budget, then the addon
+	*    falls back to `{}` (defaults) - its first successful patch rehydrates;
+	*  - a TRANSPORT failure (the hub is restarting while this runner boots:
+	*    `discovery deadline exceeded`, `parent could not route`, a refused or
+	*    timed-out connection). Since D870 a runner's settings read THROWS instead
+	*    of answering `{}`, so without a budget a hub restart ends in a respawn
+	*    loop. A long, bounded budget; only after it the error propagates - the
+	*    addon never runs on defaults for a store it could not ask.
+	* Anything else propagates immediately so real bugs surface.
 	*/
 	async readAddonStoreWithRetry() {
 		const settings = this.rawSettings();
 		if (!settings) return {};
-		const delaysMs = [
-			150,
-			350,
-			600,
-			900
-		];
 		let lastErr;
-		for (let attempt = 0; attempt <= delaysMs.length; attempt++) try {
+		for (let attempt = 0;; attempt++) try {
 			const stored = await settings.readAddonStore() ?? {};
 			this.settingsStoreReady = true;
 			return stored;
 		} catch (err) {
 			lastErr = err;
-			const msg = err instanceof Error ? err.message : String(err);
-			if (!(msg.includes("SqliteSettingsBackend not initialized") || msg.includes("provider not available"))) throw err;
-			if (attempt === delaysMs.length) break;
-			await new Promise((r) => setTimeout(r, delaysMs[attempt]));
+			const kind = classifyStoreError(err);
+			if (kind === "permanent") throw err;
+			const delay = (kind === "transport" ? TRANSPORT_RETRY_DELAYS_MS : RESTART_RETRY_DELAYS_MS)[attempt];
+			if (delay === void 0) {
+				if (kind === "transport") throw err;
+				break;
+			}
+			await new Promise((r) => setTimeout(r, delay));
 		}
 		this.settingsStoreReady = false;
 		this._ctx?.logger?.warn?.("readAddonStore: settings-store unavailable after retries — using defaults", { meta: { error: lastErr instanceof Error ? lastErr.message : String(lastErr) } });
 		return {};
 	}
 };
+/** The settings store's own restart fingerprints. */
+var RESTART_RETRY_DELAYS_MS = [
+	150,
+	350,
+	600,
+	900
+];
+/** A hub restarting under a booting runner: ~100 s in total. */
+var TRANSPORT_RETRY_DELAYS_MS = [
+	150,
+	350,
+	600,
+	900,
+	2e3,
+	5e3,
+	1e4,
+	2e4,
+	3e4,
+	3e4
+];
+var RESTART_FINGERPRINTS = ["SqliteSettingsBackend not initialized", "provider not available"];
+/** Node / socket error codes of a connection that did not happen or broke. */
+var TRANSPORT_CODES = new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ETIMEDOUT",
+	"EPIPE",
+	"EHOSTUNREACH",
+	"ENETUNREACH"
+]);
+/** tRPC error codes that mean "the other side is not answering now", not "your call is wrong". */
+var UNAVAILABLE_TRPC_CODES = new Set([
+	"TIMEOUT",
+	"SERVICE_UNAVAILABLE",
+	"BAD_GATEWAY",
+	"GATEWAY_TIMEOUT"
+]);
+/** The exact phrases OUR transport raises when it cannot reach the hub. */
+var TRANSPORT_PHRASES = [
+	"discovery deadline exceeded",
+	"parent could not route child unowned cap call",
+	"UDS request timed out after",
+	"channel closed"
+];
+/** Moleculer error `type`s of a call that could not be served right now. */
+var MOLECULER_TRANSIENT_TYPES = new Set([
+	"REQUEST_TIMEOUT",
+	"SERVICE_NOT_FOUND",
+	"SERVICE_NOT_AVAILABLE",
+	"REQUEST_REJECTED",
+	"BROKER_DISCONNECTED"
+]);
+function stringProp(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const found = Reflect.get(value, key);
+	return typeof found === "string" ? found : void 0;
+}
+/** The code an error carries: its own, its cause's, or a tRPC `data.code`. */
+function errorCode(err) {
+	const out = {};
+	const cause = typeof err === "object" && err !== null ? Reflect.get(err, "cause") : void 0;
+	const data = typeof err === "object" && err !== null ? Reflect.get(err, "data") : void 0;
+	const node = stringProp(err, "code") ?? stringProp(cause, "code");
+	if (node !== void 0) out.node = node;
+	const trpc = stringProp(data, "code");
+	if (trpc !== void 0) out.trpc = trpc;
+	return out;
+}
+/**
+* Is a settings read failure worth retrying, and with which budget? Only
+* EXPLICIT signals count: a socket error code, a tRPC "unavailable" code, or
+* one of the exact phrases our own transport raises. A message that merely
+* contains "timed out" or "unreachable" is not evidence of anything, and
+* `settings store not wired` is a wiring bug that retrying cannot fix.
+*/
+function classifyStoreError(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	if (RESTART_FINGERPRINTS.some((f) => message.includes(f))) return "restart";
+	const code = errorCode(err);
+	if (code.node !== void 0 && TRANSPORT_CODES.has(code.node)) return "transport";
+	if (code.trpc !== void 0 && UNAVAILABLE_TRPC_CODES.has(code.trpc)) return "transport";
+	if (typeof err === "object" && err !== null) {
+		if (Reflect.get(err, "retryable") === true) return "transport";
+		const type = stringProp(err, "type");
+		if (type !== void 0 && MOLECULER_TRANSIENT_TYPES.has(type)) return "transport";
+	}
+	if (TRANSPORT_PHRASES.some((f) => message.includes(f))) return "transport";
+	return "permanent";
+}
 /**
 * Collect the keys of every field marked `perNode: true`, recursing into
 * layout containers (`group` fields and `sub-tabs` tabs) the same way
@@ -7725,6 +7968,303 @@ var PeerBytesTicketSchema = object({
 	*/
 	declaredBytes: number().int().nonnegative().nullable()
 });
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_QUERY_MAX = 1e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
+function defOf(schema) {
+	const zodBag = Reflect.get(schema, "_zod");
+	if (typeof zodBag !== "object" || zodBag === null) return {};
+	const def = Reflect.get(zodBag, "def");
+	if (typeof def !== "object" || def === null) return {};
+	return def;
+}
+function declaredHere(schema) {
+	return globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const key = each ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+/**
+* Record kinds (D881): the declaration an addon makes of one kind of fact, the
+* Zod row schema that describes it, and the helper that turns the two into the
+* JSON the engine stores.
+*
+* A kind is declared ONCE, next to the code that owns it, and the engine's
+* reconciler creates its indexes - nothing creates DDL at runtime from a write.
+* Everything the generic machinery needs (secret fields, the entry descriptor)
+* is DERIVED from the Zod schema: `.meta({ secret: true })` marks a credential,
+* never a field name (D879).
+*/
+/** A JSON field path: `trackId`, `auth.accessToken`. Charset-restricted: it is rendered into DDL. */
+var RecordFieldPathSchema = string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}(\.[A-Za-z_][A-Za-z0-9_]{0,63}){0,3}$/);
+var RecordIndexSchema = object({
+	name: string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+	fields: array(RecordFieldPathSchema).min(1).max(4),
+	unique: boolean().optional()
+}).strict();
+var RecordRetentionSchema = union([
+	object({
+		ttlMs: number().int().positive(),
+		from: _enum(["at", "write"])
+	}).strict(),
+	object({
+		maxRows: number().int().positive().optional(),
+		maxRowsPerDevice: number().int().positive().optional()
+	}).strict().refine((r) => r.maxRows !== void 0 || r.maxRowsPerDevice !== void 0, { message: "name maxRows, maxRowsPerDevice or both" }),
+	object({
+		owner: string().min(1),
+		reason: string().min(1)
+	}).strict(),
+	object({ none: string().min(1) }).strict()
+]);
+/** The descriptor a generic entries UI reads (D881 "generic entries"). */
+var EntryDescriptorSchema = object({
+	title: string().min(1),
+	/** The record body field shown as the entry's name. */
+	nameField: string().min(1),
+	/** JSON Schema of the entry body; `secret: true` marks a password field. */
+	fields: record(string(), unknown())
+}).strict();
+/** What crosses the wire and sits in the engine's catalog: JSON only, no Zod. */
+var RecordKindDeclarationSchema = object({
+	database: _enum(RECORD_DATABASES).default("settings"),
+	class: _enum(RECORD_CLASSES),
+	writeTrigger: string().min(1),
+	device: _enum([
+		"required",
+		"optional",
+		"none"
+	]).default("none"),
+	at: _enum(["required", "none"]).default("none"),
+	indexes: array(RecordIndexSchema).max(8).default([]),
+	retention: RecordRetentionSchema,
+	deviceRemoval: _enum(["delete", "none"]).default("none"),
+	maxDataBytes: number().int().positive().max(RECORD_MAX_DATA_BYTES).default(RECORD_DEFAULT_MAX_DATA_BYTES),
+	/** Derived from the Zod schema; never written by hand. */
+	secretPaths: array(string().min(1)).default([]),
+	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
+	secretArrayKeys: record(string(), string()).default({}),
+	/** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+	adoptsFrom: string().min(1).optional(),
+	/** Kinds that must agree through `transact` sit in one file under one family name. */
+	transactFamily: string().min(1).optional(),
+	entry: EntryDescriptorSchema.optional()
+}).strict();
+/** The kind names: lower-case, dash separated, short enough for an index name. */
+var RecordKindNameSchema = string().regex(/^[a-z][a-z0-9-]{0,47}$/);
+/** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
+function assertValidDeclaration(name, decl) {
+	const refuse = (why) => {
+		throw new DeclarationRefusedError(`kind "${name}": ${why}`);
+	};
+	if (!RecordKindNameSchema.safeParse(name).success) refuse("the name must be lower-case-dashed");
+	const seen = /* @__PURE__ */ new Set();
+	for (const index of decl.indexes) {
+		if (seen.has(index.name)) refuse(`index name "${index.name}" is declared twice`);
+		seen.add(index.name);
+	}
+	const { retention } = decl;
+	const hasSecrets = decl.secretPaths.length > 0;
+	if ("ttlMs" in retention) {
+		if (retention.from === "at" && decl.at !== "required") refuse("a ttl from \"at\" needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use engine TTL (its keychain values would be orphaned)");
+	}
+	if ("maxRows" in retention || "maxRowsPerDevice" in retention) {
+		if (retention.maxRowsPerDevice !== void 0 && decl.device !== "required") refuse("maxRowsPerDevice needs device: \"required\"");
+		if (decl.at !== "required") refuse("a row bound trims the oldest \"at\": it needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use an engine row bound");
+		const bound = Math.max(retention.maxRows ?? 0, retention.maxRowsPerDevice ?? 0);
+		if (decl.database === "settings" && bound > 5e4) refuse(`a row bound above ${RECORD_SETTINGS_MAX_ROWS} belongs in database: "events" (a big delete on the settings thread stalls every configuration read)`);
+	}
+	if (decl.deviceRemoval === "delete" && decl.device === "none") refuse("deviceRemoval: \"delete\" needs a device: \"required\" or \"optional\"");
+	for (const path of decl.secretPaths) for (const prefix of secretArrayPrefixes(path)) if (decl.secretArrayKeys[prefix] === void 0) refuse(`secret path "${path}" crosses the array "${prefix}": declare its id key in secretArrayKeys`);
+}
+function bodyFieldsOf(schema) {
+	return { ...toJSONSchema(schema, {
+		unrepresentable: "any",
+		io: "input"
+	}) };
+}
+function isRecordLike(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Does every branch of the body schema carry `field`? (A discriminated union has several.) */
+function hasNameField(json, field) {
+	const branches = json["oneOf"] ?? json["anyOf"];
+	if (Array.isArray(branches)) return branches.length > 0 && branches.every((b) => isRecordLike(b) && hasNameField(b, field));
+	const properties = json["properties"];
+	return isRecordLike(properties) && Object.prototype.hasOwnProperty.call(properties, field);
+}
+/**
+* Declare the kinds of a package. The keys are the kind names. The result is
+* what `ctx.records.declare` sends to the engine and what `ctx.records.kind`
+* types its handle from.
+*/
+function defineRecordKinds(specs) {
+	const out = {};
+	for (const [name, spec] of Object.entries(specs)) {
+		const secretPaths = collectZodSecretPaths(spec.schema);
+		const nameField = spec.entry?.nameField ?? "name";
+		const fields = bodyFieldsOf(spec.schema);
+		if (spec.entry !== void 0 && !hasNameField(fields, nameField)) throw new DeclarationRefusedError(`kind "${name}": an entry kind's schema needs a "${nameField}" field`);
+		const parsed = RecordKindDeclarationSchema.parse({
+			database: spec.database,
+			class: spec.class,
+			writeTrigger: spec.writeTrigger,
+			device: spec.device,
+			at: spec.at,
+			indexes: spec.indexes === void 0 ? void 0 : [...spec.indexes],
+			retention: spec.retention,
+			deviceRemoval: spec.deviceRemoval,
+			maxDataBytes: spec.maxDataBytes,
+			secretPaths: [...secretPaths],
+			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
+			adoptsFrom: spec.adoptsFrom,
+			transactFamily: spec.transactFamily,
+			entry: spec.entry === void 0 ? void 0 : {
+				title: spec.entry.title,
+				nameField,
+				fields
+			}
+		});
+		assertValidDeclaration(name, parsed);
+		out[name] = {
+			name,
+			schema: spec.schema,
+			declaration: parsed
+		};
+	}
+	return out;
+}
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = _enum([
 	"high",
@@ -8226,7 +8766,7 @@ function userError(code, params, englishFallback) {
 	return new CamstackError(code, params, englishFallback);
 }
 //#endregion
-//#region ../types/dist/err-msg-DLerKiVO.mjs
+//#region ../types/dist/err-msg--2RrYiLO.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -8495,6 +9035,9 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
 	*  real Switch device for UI rendering / export adapters. */
 	DeviceRole["BinaryHelper"] = "binary-helper";
+	/** A smart plug: a `switch` whose source says it is an outlet (HA
+	*  `device_class: outlet`). The Alexa export shows it as a SMARTPLUG. */
+	DeviceRole["Outlet"] = "outlet";
 	/** Generic motion / occupancy / moving event source. Distinct from
 	*  the camera accessory PirSensor role: that one is a camera child;
 	*  this is a standalone HA / 3rd-party motion sensor. */
@@ -8562,7 +9105,7 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 	return DeviceRole;
 }({});
 //#endregion
-//#region ../types/dist/composition-EQ9Ok0Ee.mjs
+//#region ../types/dist/composition-DOwQB_Ua.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -11883,11 +12426,10 @@ var ClipModelMetaSchema = object({
 	/**
 	* The `vector-store` index this model's vectors live in. ONE feature space
 	* per index: two models share an index only when their vectors are ranked
-	* against each other, which for CLIP means never across families. MobileCLIP
-	* S1 and S2 share `object-clip` for history (separated by the row's
-	* `modelId`); any other model gets its own.
+	* against each other, which for CLIP means never across families. Every
+	* model gets its own.
 	*/
-	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	vectorIndex: string().regex(/^object-clip-[a-z0-9][a-z0-9-]*$/),
 	/**
 	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
 	* must be unique per tokenizer: every model's siblings land in ONE flat
@@ -15533,6 +16075,41 @@ var ComposableCapabilitiesSchema = object({ caps: array(object({
 		keyField: string()
 	}).optional()
 })) });
+/**
+* The report of a one-shot "move this owner's plaintext secrets into the
+* keychain" run (D878). COUNTS only - never a value, never a ref.
+*
+* The owner runs it on its own rows, through its own write path; an operator
+* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
+* Dry run (`apply: false`) reports what WOULD move and changes nothing.
+*/
+var RawSecretMigrationInputSchema = object({ 
+/** `false` (the default of the script) = report only. */
+apply: boolean() });
+var RawSecretMigrationReportSchema = object({
+	apply: boolean(),
+	/** Rows that can carry a secret (a profile, an enrolment). */
+	rows: number().int(),
+	/** Rows whose secret was plaintext when the run started. */
+	raw: number().int(),
+	/** Rows that already held a keychain marker when the run started. */
+	markers: number().int(),
+	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
+	migrated: number().int(),
+	/** Plaintext rows left in place because the move or its read-back failed. */
+	failed: number().int(),
+	/** After the run: rows still holding plaintext. */
+	remainingRaw: number().int(),
+	/** After the run: markers the keychain could not resolve right now. */
+	unresolvedMarkers: number().int(),
+	/**
+	* A second, redundant copy of the secrets' rows that the run found (and, on
+	* `apply`, deleted after verifying the first). Owners with a single copy omit it.
+	*/
+	redundantCopies: number().int().optional(),
+	/** True when nothing is raw and every marker resolves. */
+	verified: boolean()
+});
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
@@ -15759,6 +16336,9 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), SettingsUpdateResultSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({}), object({ libs: array(object({
 	filePath: string(),
 	content: string()
@@ -16022,6 +16602,347 @@ id: union([string(), number()]) }), {
 	auth: "admin"
 });
 /**
+* records - an addon's own facts and documents (D881): ledgers, audit rows,
+* config documents, mirrors. The third storage API next to `ctx.settings`
+* (operator intent, D870) and device-history (numbers over time, D850).
+*
+* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
+* crossed a process and stated by a hub in-process caller (`ctx.records` does
+* that with the addon id closed over). It is deliberately NOT in any input
+* schema, so a session can never supply it, and a call with no stamp is refused
+* `records/no-caller`. A kind is readable and writable only by its owner; other
+* addons go through the owner's capability.
+*
+* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
+* never `[]`. Secret fields are never on the wire: a read shows the
+* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
+* resolves itself, and a write may carry only a keychain marker bound to the
+* row's own ref.
+*
+* Internal: addons reach it through `ctx.records`, never directly.
+*/
+var RecordIdSchema = string().min(1).max(256);
+/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
+var RecordBodySchema = record(string(), unknown());
+var RecordInputSchema = object({
+	id: RecordIdSchema,
+	/** The device this row belongs to (D865 removal, per-device reads). */
+	deviceId: number().int().optional(),
+	/** The domain clock, ms: observed / created / opened. */
+	at: number().int().optional(),
+	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
+	expiresAt: number().int().optional(),
+	data: RecordBodySchema
+});
+var RecordViewSchema = object({
+	id: string(),
+	deviceId: number().int().nullable(),
+	at: number().nullable(),
+	expiresAt: number().nullable(),
+	rev: number().int(),
+	updatedAt: number(),
+	data: RecordBodySchema
+});
+/** Declared index fields only. Anything else does not compile, by design. */
+var RecordWhereSchema = record(RecordFieldPathSchema, union([
+	string(),
+	number(),
+	boolean(),
+	object({ in: array(union([
+		string(),
+		number(),
+		boolean()
+	])).min(1).max(RECORD_BATCH_MAX) }),
+	object({
+		gt: union([string(), number()]).optional(),
+		gte: union([string(), number()]).optional(),
+		lt: union([string(), number()]).optional(),
+		lte: union([string(), number()]).optional()
+	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
+]));
+var KindShape = { kind: RecordKindNameSchema };
+var TimeWindowShape = {
+	deviceId: number().int().optional(),
+	atFrom: number().optional(),
+	atTo: number().optional()
+};
+var RecordQueryInputSchema = object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional(),
+	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
+	order: _enum(["at", "id"]).optional(),
+	desc: boolean().optional(),
+	limit: number().int().min(1).max(RECORD_QUERY_MAX).default(100),
+	/** Opaque keyset cursor from a previous answer. There is no offset. */
+	cursor: string().min(1).optional()
+});
+var RecordQueryResultSchema = object({
+	records: array(RecordViewSchema),
+	nextCursor: string().nullable()
+});
+var RecordKindStateSchema = _enum([
+	"created",
+	"unchanged",
+	"updated"
+]);
+var DeclareKindResultSchema = object({
+	kindId: number().int(),
+	state: RecordKindStateSchema,
+	createdIndexes: array(string()),
+	/** The boot guard: the kind is empty while its legacy table still holds rows. */
+	adoptionPending: object({
+		legacyTable: string(),
+		legacyRows: number().int()
+	}).nullable()
+});
+/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
+var SecretRefsList = array(string());
+var RecordSecretRefsSchema = record(string(), record(string(), string()));
+method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string(), DeclareKindResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), array(RecordViewSchema), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	record: RecordInputSchema,
+	/** Compare-and-set. `0` means "the row must not exist". */
+	ifRev: number().int().min(0).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	count: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema,
+	data: RecordBodySchema,
+	at: number().int().nullable().optional(),
+	expiresAt: number().int().nullable().optional(),
+	ifRev: number().int().min(1).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), object({
+	deleted: boolean(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional()
+}), object({ count: number().int() }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	from: number(),
+	to: number(),
+	bucketMs: number().int().positive()
+}), object({ buckets: array(object({
+	bucketStart: number(),
+	count: number().int()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	op: _enum([
+		"sum",
+		"min",
+		"max",
+		"count"
+	]),
+	field: RecordFieldPathSchema.optional(),
+	groupBy: RecordFieldPathSchema.optional(),
+	where: RecordWhereSchema.optional()
+}), object({ rows: array(object({
+	group: union([
+		string(),
+		number(),
+		_null()
+	]),
+	value: number().nullable()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	atBefore: number().optional(),
+	where: RecordWhereSchema.optional()
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	kinds: array(RecordKindNameSchema).optional()
+}), object({
+	deleted: record(string(), number().int()),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object(KindShape), object({ id: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/** One table of the settings database. */
+var StorageTableSchema = object({
+	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
+	name: string(),
+	/** The owner prefix of a scoped name (`recorder` for `recorder:addon-settings`), else null. */
+	owner: string().nullable(),
+	rows: number().int().nonnegative(),
+	/** Bytes the table's pages occupy (`dbstat`); null when the engine cannot measure. */
+	bytes: number().int().nonnegative().nullable(),
+	/** Declared by an addon since this engine process started (a running addon claims it). */
+	declaredThisBoot: boolean()
+});
+/** One declared record kind (D881) as System -> Data shows it. */
+var StorageKindSchema = object({
+	owner: string(),
+	kind: string(),
+	database: _enum(["settings", "events"]),
+	class: string(),
+	state: _enum([
+		"declared",
+		"orphaned",
+		"dropped"
+	]),
+	/** `null` when the caller asked for no counts (`counts: false`). */
+	rows: number().int().nonnegative().nullable(),
+	/** Rows x the average size of a sample; null for an empty kind. */
+	bytesEstimate: number().int().nonnegative().nullable(),
+	writeTrigger: string(),
+	retention: RecordRetentionSchema,
+	/** `true` when the kind is an entry kind (the generic entries UI lists it). */
+	entry: boolean(),
+	/** The whole declaration, secret paths and entry descriptor included (the entries service builds its handle from it). */
+	declaration: RecordKindDeclarationSchema
+});
+method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: array(StorageTableSchema) }), { auth: "admin" }), method(object({
+	collection: string().min(1),
+	expectRows: number().int().nonnegative()
+}), object({
+	dropped: literal(true),
+	rows: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	owner: string().min(1).optional(),
+	/** `false` skips the per-kind row count (a catalog read only). Default true. */
+	counts: boolean().optional()
+}), object({ kinds: array(StorageKindSchema) }), { auth: "admin" }), method(RecordQueryInputSchema.extend({
+	owner: string().min(1),
+	kind: RecordKindNameSchema
+}), RecordQueryResultSchema, { auth: "admin" }), method(object({
+	owner: string().min(1),
+	kind: RecordKindNameSchema,
+	records: array(RecordInputSchema).max(RECORD_BATCH_MAX),
+	/** The LAST batch: the copy is complete, the boot guard stops asking. */
+	complete: boolean().optional()
+}).refine((input) => input.records.length > 0 || input.complete === true, { message: "records must be non-empty unless complete is true" }), object({ adopted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	collection: string().min(1),
+	cursor: string().optional(),
+	limit: number().int().min(1).max(1e3).optional()
+}), object({
+	rows: array(object({
+		id: string(),
+		data: record(string(), unknown())
+	})),
+	nextCursor: string().nullable()
+}), { auth: "admin" }), method(object({ collection: string().min(1) }), object({ adopted: boolean() }), { auth: "admin" });
+/**
+* record-entries - the ONE admin surface for every list of user-created entries
+* (D881): notification targets, brokers, LLM profiles, anything an addon
+* declares as an ENTRY kind (`entry: { title }` in `defineRecordKinds`).
+*
+* The UI is generic. `listEntryKinds` hands it, per kind, the JSON Schema of
+* the entry body with `secret: true` on every credential field, so a password
+* field is derived from the schema and never from a name. `putEntry` takes the
+* redaction token for an untouched secret (the stored value is kept), a string
+* for a new one, and the clear instruction to remove one. A read never carries
+* a secret value, and a locked keychain refuses the write with
+* `records/secret-unavailable` instead of storing plaintext.
+*
+* Hub-only, served in-process (it acts for each entry's owner on the keychain).
+*/
+var EntryKindInfoSchema = object({
+	owner: string(),
+	kind: RecordKindNameSchema,
+	title: string(),
+	nameField: string(),
+	/** JSON Schema of the body; `secret: true` marks a password field. */
+	fields: record(string(), unknown()),
+	secretPaths: array(string()),
+	rows: number().int().nonnegative()
+});
+var EntryViewSchema = object({
+	id: RecordIdSchema,
+	name: string(),
+	rev: number().int(),
+	updatedAt: number(),
+	/** Secret fields hold the redaction token. */
+	data: RecordBodySchema
+});
+var EntryAddress = {
+	owner: string().min(1),
+	kind: RecordKindNameSchema
+};
+method(object({}), object({ kinds: array(EntryKindInfoSchema) }), { auth: "admin" }), method(object({ ...EntryAddress }), object({ entries: array(EntryViewSchema) }), { auth: "admin" }), method(object({
+	...EntryAddress,
+	id: RecordIdSchema.optional(),
+	data: RecordBodySchema,
+	ifRev: number().int().min(1).optional()
+}), object({
+	id: string(),
+	rev: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...EntryAddress,
+	id: RecordIdSchema
+}), object({ deleted: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * `keychain` — the hub's encrypted store of secret values (D787).
 *
 * Settings blobs never hold a secret: they hold a marker
@@ -16562,6 +17483,16 @@ method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}),
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
+}), method(object({
+	ref: string().min(1),
+	value: string().min(1)
+}), object({
+	ref: string(),
+	version: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
 }), method(object({ refs: array(string().min(1)).max(1e3) }), object({
 	deleted: array(string()).readonly(),
 	kept: array(object({
@@ -39031,6 +39962,9 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, {
 }), _void(), { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(ProfileRefInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -49476,6 +50410,41 @@ var ServerRollbackInfoSchema = object({
 	atMs: number(),
 	reason: string()
 });
+/**
+* The runner boot check (D877): the runners this node PLANNED (hub: one per
+* `resolveRunnerId` over its forked addons; agent: the runners its process
+* service holds, because only the hub plans) against the states the process
+* service reports. Kept in memory, recomputed by the same one-shot check after
+* every boot, served on `getServerPackageStatus`.
+*
+* `failed` is the D6 breaker's terminal state, `refused` a deterministic Init
+* refusal (an addon that said "I will not start, and here is why"), `missing` a
+* planned runner the process service has no entry for.
+*/
+var RunnerRefusalSchema = object({
+	runnerId: string(),
+	addonIds: array(string()),
+	reason: string()
+});
+var RunnerBootCheckSchema = object({
+	checkedAtMs: number(),
+	/** Runners planned for this node. */
+	expected: number(),
+	/** Planned runners whose process is `running`. */
+	running: number(),
+	failed: array(string()),
+	refused: array(RunnerRefusalSchema),
+	missing: array(string()),
+	/**
+	* Runners still on their way: `starting`, or `crashed` waiting on a backoff
+	* respawn. The check is FINAL only when this is empty; until then nothing is
+	* pushed and the verdict is re-evaluated on the next runner state change.
+	* Optional for version skew (absent = settled).
+	*/
+	pending: array(string()).optional(),
+	/** True when the plan is the hub's (`missing` is then meaningful); false on an agent. */
+	planKnown: boolean()
+});
 var ServerPackageStatusSchema = object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: string(),
@@ -49538,7 +50507,14 @@ var ServerPackageStatusSchema = object({
 	* for version skew: an older provider's payload simply omits it, and an
 	* absent wrapper is unknown — never `native`.
 	*/
-	wrapper: WrapperIdentitySchema.optional()
+	wrapper: WrapperIdentitySchema.optional(),
+	/**
+	* What this node PLANNED to run against what its process service reports
+	* (D877). Absent until the one-shot boot check has run (~60 s after boot) and
+	* on a provider that predates it. Absent is "not checked yet", never "all
+	* well": a consumer that needs the answer treats it as pending.
+	*/
+	runners: RunnerBootCheckSchema.optional()
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),
@@ -49589,6 +50565,13 @@ var ServerUpdateOutcomeSchema = _enum([
 	"refused",
 	"failed"
 ]);
+/** One addon the pre-flight found the target version would refuse (D877). */
+var UpdateBlockerSchema = object({
+	addonId: string(),
+	reason: string(),
+	/** What the operator does about it. */
+	remedy: string()
+});
 var ServerUpdateActionResultSchema = object({
 	accepted: boolean(),
 	targetVersion: string().nullable(),
@@ -49606,14 +50589,27 @@ var ServerUpdateActionResultSchema = object({
 	* The failure itself, verbatim enough to act on (the npm output for a
 	* staging install). Non-null only for `failed`.
 	*/
-	error: string().nullable().optional()
+	error: string().nullable().optional(),
+	/**
+	* The addons the target version would refuse to start on this node's live
+	* store (D877), present when the pre-flight refused the update
+	* (`reason: 'addon-would-refuse'`). Optional for version skew.
+	*/
+	blockers: array(UpdateBlockerSchema).optional()
 });
 method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), ServerUpdateCheckResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ 
-/** Explicit target version; omitted = latest from the registry. */
-version: string().optional() }), ServerUpdateActionResultSchema, {
+}), method(object({
+	/** Explicit target version; omitted = latest from the registry. */
+	version: string().optional(),
+	/**
+	* Apply even though the pre-flight (D877) found addons the target would
+	* refuse to start. Off by default: those addons stay down until the
+	* remedy is run, which is the incident this gate exists to prevent.
+	*/
+	acknowledgeRefusals: boolean().optional()
+}), ServerUpdateActionResultSchema, {
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 16 * 6e4
@@ -52026,7 +53022,9 @@ var ManifestShapeSchema = object({
 var AddonProcessSchema = object({
 	pid: number().optional(),
 	mode: string(),
-	state: string()
+	state: string(),
+	/** Why the runner is `refused` (an addon's own words), when it is (D877). */
+	reason: string().optional()
 });
 /**
 * Per-addon health snapshot from the kernel's AddonHealthMonitor.
@@ -53029,6 +54027,12 @@ object({
 	/** Horizontal louver swing on/off. Null when the device has no
 	*  horizontal swing surface (gate with `DeviceFeature.ClimateSwingHorizontal`). */
 	swingHorizontal: boolean().nullable(),
+	/** Lowest setpoint the device accepts, Celsius. Absent / null = not reported. */
+	minTemp: number().nullable().optional(),
+	/** Highest setpoint the device accepts, Celsius. Absent / null = not reported. */
+	maxTemp: number().nullable().optional(),
+	/** Setpoint granularity, Celsius (0.5, 1). Absent / null = not reported. */
+	tempStep: number().positive().nullable().optional(),
 	/** Ms epoch when the slice was last updated (push or command). */
 	lastFetchedAt: number()
 });
@@ -54849,7 +55853,19 @@ var TlsStatusSchema = object({
 	sans: array(string()),
 	caCertPem: string().nullable(),
 	reissueError: string().nullable(),
-	restartRequired: boolean()
+	restartRequired: boolean(),
+	/** An uploaded certificate is served but no CA is kept for it and it is not publicly signed (D873). */
+	caMissing: boolean(),
+	/** Does the hub's own generated CA carry a critical name constraint? `null` while it has none. */
+	localCaConstrained: boolean().nullable(),
+	/** ISO time the generated CA was replaced by a constrained one; devices must re-download it. */
+	caReplacedAt: string().nullable(),
+	/** The uploaded certificate kept on disk, selectable again after "Revert to generated". */
+	storedUpload: object({
+		leafFingerprintSha256: string(),
+		validTo: string(),
+		hasCa: boolean()
+	}).nullable()
 });
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
@@ -54905,6 +55921,9 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 }), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(_void(), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
 });
 object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
@@ -60034,7 +61053,11 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
-}), method(object({ userId: string() }), TotpStatusSchema, { auth: "admin" }), method(object({
+}), method(object({ userId: string() }), TotpStatusSchema, { auth: "admin" }), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
+}), method(object({
 	userId: string(),
 	code: string()
 }), object({ valid: boolean() }), {
@@ -62235,6 +63258,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.migrateRawSecrets": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -63921,6 +64950,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychainAdmin.importSecret": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.listAudit": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -64089,6 +65124,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"llm.migrateRawSecrets": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -64317,6 +65358,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.useStoredUploadedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.getStatus": {
 		capName: "lock-control",
 		capScope: "device",
@@ -66969,6 +68016,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recordEntries.deleteEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"recordEntries.listEntries": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.listEntryKinds": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.putEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.getAvailability": {
 		capName: "recording",
 		capScope: "device",
@@ -67269,6 +68340,102 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"records.aggregate": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.allocateId": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.count": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.declareKinds": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.delete": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteDevice": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteWhere": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.get": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.getMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.histogram": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.patch": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.put": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.putMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.query": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.secretRefs": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.captureReference": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -67701,6 +68868,48 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageAdmin.adoptRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"storageAdmin.dropCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"storageAdmin.isAdoptedLegacyTable": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.listKinds": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.listTables": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.readLegacyCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.readRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -68613,6 +69822,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.migrateRawSecrets": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.oauthExchangeCode": {
 		capName: "user-management",
 		capScope: "system",
@@ -71289,6 +72504,37 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"records.count": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.deleteDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"records.deleteWhere": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.histogram": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.putMany": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"records.query": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"sceneMonitor.captureReference": [{
 		name: "deviceId",
 		form: "single",
@@ -71405,6 +72651,17 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"storageAdmin.adoptRecords": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"storageAdmin.readRecords": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"streamBroker.acquireEgressTranscode": [{
 		name: "deviceId",
 		form: "single",
@@ -76694,163 +77951,81 @@ function createNotificationOutputProvider(deps) {
 		}
 	};
 }
-//#endregion
-//#region src/settings-store-port.ts
-function createApiSettingsStorePort(api) {
-	return {
-		query: async (collection) => {
-			return (await api.settingsStore.query.query({ collection })).map((r) => ({
-				id: r.id,
-				data: r.data
-			}));
-		},
-		insert: async (collection, record) => {
-			await api.settingsStore.insert.mutate({
-				collection,
-				record: {
-					id: record.id,
-					data: { ...record.data }
-				}
-			});
-		},
-		update: async (collection, id, data) => {
-			await api.settingsStore.update.mutate({
-				collection,
-				id,
-				data
-			});
-		},
-		remove: async (collection, id) => {
-			await api.settingsStore.delete.mutate({
-				collection,
-				key: id
-			});
-		},
-		declareCollection: async (collection, columns) => {
-			await api.settingsStore.declareCollection.mutate({
-				collection,
-				columns: columns.map((c) => ({ ...c }))
-			});
-		}
-	};
-}
-/** In-memory port — a resilient fallback when no `api` is available. */
-function createMemorySettingsStorePort() {
-	const collections = /* @__PURE__ */ new Map();
-	const bucket = (collection) => {
-		let map = collections.get(collection);
-		if (!map) {
-			map = /* @__PURE__ */ new Map();
-			collections.set(collection, map);
-		}
-		return map;
-	};
-	return {
-		query: async (collection) => [...bucket(collection).values()],
-		insert: async (collection, record) => {
-			bucket(collection).set(record.id, {
-				id: record.id,
-				data: { ...record.data }
-			});
-		},
-		update: async (collection, id, data) => {
-			bucket(collection).set(id, {
-				id,
-				data: { ...data }
-			});
-		},
-		remove: async (collection, id) => {
-			bucket(collection).delete(id);
-		},
-		declareCollection: async (collection) => {
-			bucket(collection);
-		}
-	};
-}
+var notifiersRecordKinds = defineRecordKinds({ "notification-targets": {
+	schema: TargetSchema.omit({ id: true }),
+	class: "config",
+	writeTrigger: "an operator creates, updates, enables/disables or deletes a notification target",
+	device: "none",
+	at: "none",
+	retention: { none: "a row goes only on an explicit operator delete; bounded by the number of notification targets the operator configures" },
+	adoptsFrom: "notifiers:notification-targets",
+	entry: { title: "Notification targets" }
+} });
 //#endregion
 //#region src/target-store.ts
 /**
-* Persistence for notification targets over the `settings-store` cap.
+* Persistence for notification targets over the `notification-targets` record
+* kind (records plan phase 2, step 17).
 *
-* The store is addressed through a narrow `SettingsStorePort` (query / insert /
-* update / remove) so the class is trivially fakeable in unit tests and never
-* depends on the tRPC-shaped `AddonApi`. Rows live in the addonId-namespaced
-* `notification-targets` collection (the `settings-store` cap prefixes the
-* calling addon's id automatically — the store-isolation fix).
+* The store is addressed through a `RecordKindHandle<TargetBody>` — the
+* records facade handles all transport, boot-guard, and index concerns. No
+* `init()` or `declareCollection` call: kinds are declared at addon boot via
+* `ctx.records.declare(notifiersRecordKinds)` before this store is constructed.
 *
-* A row is `{ id, data:{ name, kind, addonId, enabled, config } }`. Secrets are
-* inside `config`; redaction/merge is the provider's concern (`secrets.ts`) —
-* the store persists whatever it is handed verbatim.
+* A row body is `{ name, kind, addonId, enabled, config }` (the record id IS
+* the target id). Secrets inside `config` are handled at the provider level by
+* `secrets.ts` (redact on read, merge on write); the records layer stores
+* the blob verbatim.
 */
-/** The default collection name (see `settings-store` addonId-prefix note). */
+/** Legacy collection name — kept for the adoption mapper and docs. */
 var TARGETS_COLLECTION = "notifiers:notification-targets";
-/** KV JSON-blob shape — a single `data` column routes the row through the
-*  settings backend's canonical key/value path (id TEXT PK, data TEXT). */
-var KV_BLOB_COLUMNS = [{
-	name: "data",
-	type: "TEXT",
-	notNull: true
-}];
-function rowToTarget(row) {
-	const candidate = {
-		id: row.id,
-		...row.data
-	};
-	const parsed = TargetSchema.safeParse(candidate);
+function rowToTarget(id, data) {
+	const parsed = TargetSchema.safeParse({
+		id,
+		...data
+	});
 	return parsed.success ? parsed.data : null;
 }
-function targetToData(target) {
-	return {
-		name: target.name,
-		kind: target.kind,
-		addonId: target.addonId,
-		enabled: target.enabled,
-		config: target.config
-	};
-}
-var TargetStore = class {
-	store;
-	collection;
-	constructor(store, collection = TARGETS_COLLECTION) {
-		this.store = store;
-		this.collection = collection;
+var TargetStore = class TargetStore {
+	kind;
+	constructor(kind) {
+		this.kind = kind;
 	}
-	/** Declare the backing collection before any read/write. The SQLite settings
-	*  backend rejects undeclared collections (fail-fast), so this MUST run before
-	*  `list`/`getById`/`upsert`/`delete` — mirrors addon-ai's ProfileStore.init. */
-	async init() {
-		await this.store.declareCollection(this.collection, KV_BLOB_COLUMNS);
+	/** Factory: build from a declared `RecordsAccess` (after `ctx.records.declare`). */
+	static of(records) {
+		return new TargetStore(records.kind(notifiersRecordKinds["notification-targets"]));
 	}
 	async list() {
-		const rows = await this.store.query(this.collection);
-		const targets = [];
-		for (const row of rows) {
-			const target = rowToTarget(row);
-			if (target) targets.push(target);
+		const page = await this.kind.query({ limit: 1e3 });
+		const out = [];
+		for (const record of page.records) {
+			const target = rowToTarget(record.id, record.data);
+			if (target !== null) out.push(target);
 		}
-		return targets;
+		return out;
 	}
 	async getById(id) {
-		const row = (await this.store.query(this.collection)).find((r) => r.id === id);
-		return row ? rowToTarget(row) : null;
+		const row = await this.kind.get(id);
+		if (row === null) return null;
+		return rowToTarget(row.id, row.data);
 	}
-	/** Upsert by id — inserts a new row or updates the existing one. */
+	/** Upsert by id — inserts a new row or replaces the existing one. */
 	async upsert(target) {
-		const exists = (await this.store.query(this.collection)).some((r) => r.id === target.id);
-		const data = targetToData(target);
-		if (exists) await this.store.update(this.collection, target.id, data);
-		else await this.store.insert(this.collection, {
-			id: target.id,
-			data
+		const { id, ...rest } = target;
+		const parsed = notifiersRecordKinds["notification-targets"].schema.safeParse(rest);
+		if (!parsed.success) throw new Error(`invalid target '${id}': ${parsed.error.message}`);
+		await this.kind.put({
+			id,
+			data: parsed.data
 		});
 	}
 	async delete(id) {
-		await this.store.remove(this.collection, id);
+		await this.kind.delete(id);
 	}
 	/** Flip `enabled` on an existing target. Returns the updated target, or null if absent. */
 	async setEnabled(id, enabled) {
 		const target = await this.getById(id);
-		if (!target) return null;
+		if (target === null) return null;
 		const next = {
 			...target,
 			enabled
@@ -76878,10 +78053,10 @@ var NotifiersAddon = class extends BaseAddon {
 	}
 	async onInitialize() {
 		const api = this.ctx.api;
-		const port = api ? createApiSettingsStorePort(api) : createMemorySettingsStorePort();
-		if (!api) this.ctx.logger.warn("notifiers: no ctx.api — targets persist in-memory only");
-		const store = new TargetStore(port);
-		await store.init();
+		const records = this.ctx.records;
+		if (records === void 0) throw new Error("notifiers (hub) needs ctx.records — check execution.placement");
+		await records.declare(notifiersRecordKinds);
+		const store = TargetStore.of(records);
 		const listProviders = async () => {
 			if (api === void 0) return [];
 			const [providers, addons] = await Promise.all([api.addons.listCapabilityProviders.query({ capName: "smtp-provider" }), api.addons.list.query()]);
@@ -76970,8 +78145,6 @@ exports.default = NotifiersAddon;
 exports.REDACTED_MARKER = REDACTED_MARKER;
 exports.TARGETS_COLLECTION = TARGETS_COLLECTION;
 exports.TargetStore = TargetStore;
-exports.createApiSettingsStorePort = createApiSettingsStorePort;
-exports.createMemorySettingsStorePort = createMemorySettingsStorePort;
 exports.createNotificationOutputProvider = createNotificationOutputProvider;
 exports.fetchAttachmentBytes = fetchAttachmentBytes;
 exports.fetchWithTimeout = fetchWithTimeout;