@camstack/addon-pipeline 1.2.373 → 1.2.374

package/dist/audio-analyzer/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-QBVFmPYQ.js");
-const require_model_catalogs = require("../model-catalogs-C42Mo0jo.js");
-const require_process_memory = require("../process-memory-Cdf2A2qg.js");
+const require_dist = require("../dist-CBEUVjTS.js");
+const require_model_catalogs = require("../model-catalogs-D5YksA5A.js");
+const require_process_memory = require("../process-memory-GFR7fxpJ.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/audio-analyzer/index.mjs

@@ -1,7 +1,7 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { $ as audioAnalyzerCapability, An as errMsg, F as PoolMemoryWatchdog, Jn as nodePin, Ln as audioChunkBytesPerSample, Lt as mapAudioLabelToMacro, Mn as BaseAddon, Q as audioAnalysisCapability, Un as hydrateSchema, Vn as expandAudioChunkToF32le, cn as resolvePoolMemoryPolicy, dr as EventCategory, h as DEFAULT_AUDIO_ANALYZER_CONFIG, r as AUDIO_BACKEND_CHOICES } from "../dist-BT3uSeR7.mjs";
-import { n as AUDIO_CLASSIFIER_MODELS } from "../model-catalogs-ChW0i2P6.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-DdeedEgU.mjs";
+import { $ as audioAnalyzerCapability, An as errMsg, F as PoolMemoryWatchdog, Ln as audioChunkBytesPerSample, Lt as mapAudioLabelToMacro, Mn as BaseAddon, Q as audioAnalysisCapability, Un as hydrateSchema, Vn as expandAudioChunkToF32le, Yn as nodePin, cn as resolvePoolMemoryPolicy, fr as EventCategory, h as DEFAULT_AUDIO_ANALYZER_CONFIG, r as AUDIO_BACKEND_CHOICES } from "../dist-CmdLCb_F.mjs";
+import { n as AUDIO_CLASSIFIER_MODELS } from "../model-catalogs-BnCdB2A3.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-X0ws1SGJ.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { ensureModel } from "@camstack/system/addon-utils";

package/dist/{custom-model-catalog-UaaDgBow.mjs → custom-model-catalog-1LDuDw8S.mjs}

@@ -1,5 +1,5 @@
-import { b as DEVICE_BACKEND_TO_FORMAT, et as audioKindId, f as COCO_80_LABELS, i as AUDIO_MACRO_LABELS, jt as inferModelProvider, k as LABEL_SUPPLY_VOCABULARIES, p as COCO_TO_MACRO, pn as stepModelRunsOnFormat } from "./dist-BT3uSeR7.mjs";
-import { a as FACE_DETECTION_MODELS, c as OBJECT_DETECTION_MODELS, d as PLATE_OCR_MODELS, f as SEGMENTATION_REFINER_MODELS, i as CLIP_EMBEDDING_MODELS, l as PACKAGE_DETECTION_MODELS, n as AUDIO_CLASSIFIER_MODELS, o as FACE_EMBEDDING_MODELS, p as VEHICLE_CLASSIFIER_MODELS, r as BIRD_CLASSIFIER_MODELS, s as INSTANCE_SEGMENTATION_MODELS, t as ANIMAL_CLASSIFIER_MODELS, u as PLATE_DETECTION_MODELS } from "./model-catalogs-ChW0i2P6.mjs";
+import { b as DEVICE_BACKEND_TO_FORMAT, et as audioKindId, f as COCO_80_LABELS, i as AUDIO_MACRO_LABELS, jt as inferModelProvider, k as LABEL_SUPPLY_VOCABULARIES, p as COCO_TO_MACRO, pn as stepModelRunsOnFormat } from "./dist-CmdLCb_F.mjs";
+import { a as FACE_DETECTION_MODELS, c as OBJECT_DETECTION_MODELS, d as PLATE_OCR_MODELS, f as SEGMENTATION_REFINER_MODELS, i as CLIP_EMBEDDING_MODELS, l as PACKAGE_DETECTION_MODELS, n as AUDIO_CLASSIFIER_MODELS, o as FACE_EMBEDDING_MODELS, p as VEHICLE_CLASSIFIER_MODELS, r as BIRD_CLASSIFIER_MODELS, s as INSTANCE_SEGMENTATION_MODELS, t as ANIMAL_CLASSIFIER_MODELS, u as PLATE_DETECTION_MODELS } from "./model-catalogs-BnCdB2A3.mjs";
 import { t as isWorkerReply } from "./worker-protocol-D_NzPcnh.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/detection-pipeline/registry/effective-confidence.ts

package/dist/{custom-model-catalog-M-ECFeNJ.js → custom-model-catalog-W0DHDhfo.js}

@@ -1,5 +1,5 @@
-const require_dist = require("./dist-QBVFmPYQ.js");
-const require_model_catalogs = require("./model-catalogs-C42Mo0jo.js");
+const require_dist = require("./dist-CBEUVjTS.js");
+const require_model_catalogs = require("./model-catalogs-D5YksA5A.js");
 const require_worker_protocol = require("./worker-protocol-C-G8qmye.js");
 let node_crypto = require("node:crypto");
 //#region src/detection-pipeline/registry/effective-confidence.ts

package/dist/detection-pipeline/index.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-QBVFmPYQ.js");
-const require_node = require("../node-B6ev-Hqa.js");
-const require_custom_model_catalog = require("../custom-model-catalog-M-ECFeNJ.js");
+const require_dist = require("../dist-CBEUVjTS.js");
+const require_node = require("../node-DMgi6pND.js");
+const require_custom_model_catalog = require("../custom-model-catalog-W0DHDhfo.js");
 const require_lazy_sharp = require("../lazy-sharp-BuwKlQLR.js");
-const require_process_memory = require("../process-memory-Cdf2A2qg.js");
+const require_process_memory = require("../process-memory-GFR7fxpJ.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/detection-pipeline/index.mjs

@@ -1,9 +1,9 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { An as errMsg$1, F as PoolMemoryWatchdog, Ft as loadContributionCapability, Gt as overlayClusterStepSettings, Hn as hfModelUrl, Jn as nodePin, Mn as BaseAddon, Nt as linkedLabelStepId, O as LABEL_SUPPLY_MACRO, Rn as createEvent, St as evaluateZoneRules, Un as hydrateSchema, Ut as modelBindingKey, X as applyModelBoundSettings, Xt as pipelineExecutorCapability, Zn as sleep, _t as detectionPipelineCapability, cn as resolvePoolMemoryPolicy, ct as containingParentIndex, d as CLUSTER_MODEL_SCOPED_STEPS, dn as rootSuppliesOf, dr as EventCategory, er as array, fn as runtimeDevices$1, ft as defaultDeviceFor$1, g as DEFAULT_CLUSTER_STEP_SETTINGS, lr as string, n as APPLE_SA_TO_MACRO, or as object, pn as stepModelRunsOnFormat, q as YAMNET_TO_MACRO, qt as pickClusterStepSettings, rn as resolveClusterStepModelId, st as collectModelBoundKeys, ur as union, vn as supportedRuntimes$1, xt as enumerateInferenceDevices } from "../dist-BT3uSeR7.mjs";
-import { s as readProcessCost } from "../node-BVRFl1hZ.mjs";
-import { C as resolveModelDefaultConfidence, S as landmarkPrecisionVerdict, _ as ALL_STEPS, b as getStepDefinition, f as localFrameRegistry, g as ALL_PIPELINE_STEPS, l as resolveDefaultDetectionModel, n as mergeCustomModels, o as deviceKeyOf, r as buildSubtreeCanRun, s as resolveDeviceEngine, t as CustomModelCatalog, u as macroGateVerdict, v as getDefaultModelForFormat, x as resolveModelForFormat, y as getStep } from "../custom-model-catalog-UaaDgBow.mjs";
+import { An as errMsg$1, F as PoolMemoryWatchdog, Ft as loadContributionCapability, Gt as overlayClusterStepSettings, Hn as hfModelUrl, Mn as BaseAddon, Nt as linkedLabelStepId, O as LABEL_SUPPLY_MACRO, Qn as sleep, Rn as createEvent, St as evaluateZoneRules, Un as hydrateSchema, Ut as modelBindingKey, X as applyModelBoundSettings, Xt as pipelineExecutorCapability, Yn as nodePin, _t as detectionPipelineCapability, cn as resolvePoolMemoryPolicy, ct as containingParentIndex, d as CLUSTER_MODEL_SCOPED_STEPS, dn as rootSuppliesOf, dr as union, fn as runtimeDevices$1, fr as EventCategory, ft as defaultDeviceFor$1, g as DEFAULT_CLUSTER_STEP_SETTINGS, n as APPLE_SA_TO_MACRO, pn as stepModelRunsOnFormat, q as YAMNET_TO_MACRO, qt as pickClusterStepSettings, rn as resolveClusterStepModelId, sr as object, st as collectModelBoundKeys, tr as array, ur as string, vn as supportedRuntimes$1, xt as enumerateInferenceDevices } from "../dist-CmdLCb_F.mjs";
+import { s as readProcessCost } from "../node-C3r8kiOo.mjs";
+import { C as resolveModelDefaultConfidence, S as landmarkPrecisionVerdict, _ as ALL_STEPS, b as getStepDefinition, f as localFrameRegistry, g as ALL_PIPELINE_STEPS, l as resolveDefaultDetectionModel, n as mergeCustomModels, o as deviceKeyOf, r as buildSubtreeCanRun, s as resolveDeviceEngine, t as CustomModelCatalog, u as macroGateVerdict, v as getDefaultModelForFormat, x as resolveModelForFormat, y as getStep } from "../custom-model-catalog-1LDuDw8S.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-DdeedEgU.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-X0ws1SGJ.mjs";
 import * as os$1 from "node:os";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/{dist-QBVFmPYQ.js → dist-CBEUVjTS.js}

@@ -5387,7 +5387,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DRqxtc0C.mjs
+//#region ../types/dist/sleep-bwsTj221.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6686,7 +6686,6 @@ function createHandle(raw, opts) {
 	const writeAddon = (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p));
 	const readAddonStoreResult = raw.readAddonStoreResult;
 	const readAddonStoreKeyResult = raw.readAddonStoreKeyResult;
-	const readDeviceStoreBatch = raw.readDeviceStoreBatch;
 	const overrides = {
 		readAddonStore: async () => resolveRead("addon", await raw.readAddonStore()),
 		...readAddonStoreResult !== void 0 ? { readAddonStoreResult: async () => {
@@ -6710,12 +6709,12 @@ function createHandle(raw, opts) {
 			};
 		} } : {},
 		readDeviceStore: async (deviceId) => resolveRead(`device:${deviceId}`, await raw.readDeviceStore(deviceId)),
-		...readDeviceStoreBatch !== void 0 ? { readDeviceStoreBatch: async (deviceIds) => {
-			const rows = await readDeviceStoreBatch.call(raw, deviceIds);
+		readDeviceStoreBatch: async (deviceIds) => {
+			const rows = await raw.readDeviceStoreBatch(deviceIds);
 			const out = /* @__PURE__ */ new Map();
 			for (const [deviceId, blob] of rows) out.set(deviceId, await resolveRead(`device:${deviceId}`, blob));
 			return out;
-		} } : {},
+		},
 		writeAddonStore: async (patch) => {
 			await writeAddon(patch);
 		},
@@ -7542,7 +7541,7 @@ var BaseAddon = class {
 		return this._addonSecretTree;
 	}
 	deviceSecretTree() {
-		this._deviceSecretTree ??= secretTreeFromSchema(this.deviceSettingsSchema());
+		this._deviceSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.deviceSettingsSchema()), this.secretStatePaths);
 		return this._deviceSecretTree;
 	}
 	/**
@@ -7618,42 +7617,135 @@ var BaseAddon = class {
 		this[timerOf] = timer;
 	}
 	/**
-	* Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
-	* transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
-	* swap, or any race where the SqliteSettingsBackend is between shutdown and
-	* re-initialize) doesn't propagate up into `initialize()` and leave the
+	* Wrap `ctx.settings.readAddonStore()` with a retry budget so a transient
+	* settings-store outage doesn't propagate up into `initialize()` and leave the
 	* addon permanently broken.
 	*
-	* Retry only the two known infra fingerprints. Anything else propagates so
-	* real bugs surface immediately. After the budget expires we fall back to
-	* `{}` (defaults) — the addon's first successful patch will rehydrate.
+	* Two kinds of outage, two budgets:
+	*  - the store's own restart fingerprints (`SqliteSettingsBackend not
+	*    initialized`, `provider not available`): a short budget, then the addon
+	*    falls back to `{}` (defaults) - its first successful patch rehydrates;
+	*  - a TRANSPORT failure (the hub is restarting while this runner boots:
+	*    `discovery deadline exceeded`, `parent could not route`, a refused or
+	*    timed-out connection). Since D870 a runner's settings read THROWS instead
+	*    of answering `{}`, so without a budget a hub restart ends in a respawn
+	*    loop. A long, bounded budget; only after it the error propagates - the
+	*    addon never runs on defaults for a store it could not ask.
+	* Anything else propagates immediately so real bugs surface.
 	*/
 	async readAddonStoreWithRetry() {
 		const settings = this.rawSettings();
 		if (!settings) return {};
-		const delaysMs = [
-			150,
-			350,
-			600,
-			900
-		];
 		let lastErr;
-		for (let attempt = 0; attempt <= delaysMs.length; attempt++) try {
+		for (let attempt = 0;; attempt++) try {
 			const stored = await settings.readAddonStore() ?? {};
 			this.settingsStoreReady = true;
 			return stored;
 		} catch (err) {
 			lastErr = err;
-			const msg = err instanceof Error ? err.message : String(err);
-			if (!(msg.includes("SqliteSettingsBackend not initialized") || msg.includes("provider not available"))) throw err;
-			if (attempt === delaysMs.length) break;
-			await new Promise((r) => setTimeout(r, delaysMs[attempt]));
+			const kind = classifyStoreError(err);
+			if (kind === "permanent") throw err;
+			const delay = (kind === "transport" ? TRANSPORT_RETRY_DELAYS_MS : RESTART_RETRY_DELAYS_MS)[attempt];
+			if (delay === void 0) {
+				if (kind === "transport") throw err;
+				break;
+			}
+			await new Promise((r) => setTimeout(r, delay));
 		}
 		this.settingsStoreReady = false;
 		this._ctx?.logger?.warn?.("readAddonStore: settings-store unavailable after retries — using defaults", { meta: { error: lastErr instanceof Error ? lastErr.message : String(lastErr) } });
 		return {};
 	}
 };
+/** The settings store's own restart fingerprints. */
+var RESTART_RETRY_DELAYS_MS = [
+	150,
+	350,
+	600,
+	900
+];
+/** A hub restarting under a booting runner: ~100 s in total. */
+var TRANSPORT_RETRY_DELAYS_MS = [
+	150,
+	350,
+	600,
+	900,
+	2e3,
+	5e3,
+	1e4,
+	2e4,
+	3e4,
+	3e4
+];
+var RESTART_FINGERPRINTS = ["SqliteSettingsBackend not initialized", "provider not available"];
+/** Node / socket error codes of a connection that did not happen or broke. */
+var TRANSPORT_CODES = new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ETIMEDOUT",
+	"EPIPE",
+	"EHOSTUNREACH",
+	"ENETUNREACH"
+]);
+/** tRPC error codes that mean "the other side is not answering now", not "your call is wrong". */
+var UNAVAILABLE_TRPC_CODES = new Set([
+	"TIMEOUT",
+	"SERVICE_UNAVAILABLE",
+	"BAD_GATEWAY",
+	"GATEWAY_TIMEOUT"
+]);
+/** The exact phrases OUR transport raises when it cannot reach the hub. */
+var TRANSPORT_PHRASES = [
+	"discovery deadline exceeded",
+	"parent could not route child unowned cap call",
+	"UDS request timed out after",
+	"channel closed"
+];
+/** Moleculer error `type`s of a call that could not be served right now. */
+var MOLECULER_TRANSIENT_TYPES = new Set([
+	"REQUEST_TIMEOUT",
+	"SERVICE_NOT_FOUND",
+	"SERVICE_NOT_AVAILABLE",
+	"REQUEST_REJECTED",
+	"BROKER_DISCONNECTED"
+]);
+function stringProp(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const found = Reflect.get(value, key);
+	return typeof found === "string" ? found : void 0;
+}
+/** The code an error carries: its own, its cause's, or a tRPC `data.code`. */
+function errorCode(err) {
+	const out = {};
+	const cause = typeof err === "object" && err !== null ? Reflect.get(err, "cause") : void 0;
+	const data = typeof err === "object" && err !== null ? Reflect.get(err, "data") : void 0;
+	const node = stringProp(err, "code") ?? stringProp(cause, "code");
+	if (node !== void 0) out.node = node;
+	const trpc = stringProp(data, "code");
+	if (trpc !== void 0) out.trpc = trpc;
+	return out;
+}
+/**
+* Is a settings read failure worth retrying, and with which budget? Only
+* EXPLICIT signals count: a socket error code, a tRPC "unavailable" code, or
+* one of the exact phrases our own transport raises. A message that merely
+* contains "timed out" or "unreachable" is not evidence of anything, and
+* `settings store not wired` is a wiring bug that retrying cannot fix.
+*/
+function classifyStoreError(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	if (RESTART_FINGERPRINTS.some((f) => message.includes(f))) return "restart";
+	const code = errorCode(err);
+	if (code.node !== void 0 && TRANSPORT_CODES.has(code.node)) return "transport";
+	if (code.trpc !== void 0 && UNAVAILABLE_TRPC_CODES.has(code.trpc)) return "transport";
+	if (typeof err === "object" && err !== null) {
+		if (Reflect.get(err, "retryable") === true) return "transport";
+		const type = stringProp(err, "type");
+		if (type !== void 0 && MOLECULER_TRANSIENT_TYPES.has(type)) return "transport";
+	}
+	if (TRANSPORT_PHRASES.some((f) => message.includes(f))) return "transport";
+	return "permanent";
+}
 /**
 * Collect the keys of every field marked `perNode: true`, recursing into
 * layout containers (`group` fields and `sub-tabs` tabs) the same way
@@ -18806,6 +18898,28 @@ id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
 });
+/** One table of the settings database. */
+var StorageTableSchema = object({
+	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
+	name: string(),
+	/** The owner prefix of a scoped name (`recorder` for `recorder:addon-settings`), else null. */
+	owner: string().nullable(),
+	rows: number().int().nonnegative(),
+	/** Bytes the table's pages occupy (`dbstat`); null when the engine cannot measure. */
+	bytes: number().int().nonnegative().nullable(),
+	/** Declared by an addon since this engine process started (a running addon claims it). */
+	declaredThisBoot: boolean()
+});
+method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: array(StorageTableSchema) }), { auth: "admin" }), method(object({
+	collection: string().min(1),
+	expectRows: number().int().nonnegative()
+}), object({
+	dropped: literal(true),
+	rows: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * `keychain` — the hub's encrypted store of secret values (D787).
 *
@@ -19347,6 +19461,16 @@ method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}),
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
+}), method(object({
+	ref: string().min(1),
+	value: string().min(1)
+}), object({
+	ref: string(),
+	version: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
 }), method(object({ refs: array(string().min(1)).max(1e3) }), object({
 	deleted: array(string()).readonly(),
 	kept: array(object({
@@ -68644,6 +68768,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychainAdmin.importSecret": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.listAudit": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -72430,6 +72560,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageAdmin.dropCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"storageAdmin.listTables": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -79539,6 +79681,12 @@ Object.defineProperty(exports, "isFirstLevelMacroClass", {
 		return isFirstLevelMacroClass;
 	}
 });
+Object.defineProperty(exports, "isSecretMarker", {
+	enumerable: true,
+	get: function() {
+		return isSecretMarker;
+	}
+});
 Object.defineProperty(exports, "isSoftwareDecode", {
 	enumerable: true,
 	get: function() {

package/dist/{dist-BT3uSeR7.mjs → dist-CmdLCb_F.mjs}

@@ -5387,7 +5387,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DRqxtc0C.mjs
+//#region ../types/dist/sleep-bwsTj221.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6686,7 +6686,6 @@ function createHandle(raw, opts) {
 	const writeAddon = (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p));
 	const readAddonStoreResult = raw.readAddonStoreResult;
 	const readAddonStoreKeyResult = raw.readAddonStoreKeyResult;
-	const readDeviceStoreBatch = raw.readDeviceStoreBatch;
 	const overrides = {
 		readAddonStore: async () => resolveRead("addon", await raw.readAddonStore()),
 		...readAddonStoreResult !== void 0 ? { readAddonStoreResult: async () => {
@@ -6710,12 +6709,12 @@ function createHandle(raw, opts) {
 			};
 		} } : {},
 		readDeviceStore: async (deviceId) => resolveRead(`device:${deviceId}`, await raw.readDeviceStore(deviceId)),
-		...readDeviceStoreBatch !== void 0 ? { readDeviceStoreBatch: async (deviceIds) => {
-			const rows = await readDeviceStoreBatch.call(raw, deviceIds);
+		readDeviceStoreBatch: async (deviceIds) => {
+			const rows = await raw.readDeviceStoreBatch(deviceIds);
 			const out = /* @__PURE__ */ new Map();
 			for (const [deviceId, blob] of rows) out.set(deviceId, await resolveRead(`device:${deviceId}`, blob));
 			return out;
-		} } : {},
+		},
 		writeAddonStore: async (patch) => {
 			await writeAddon(patch);
 		},
@@ -7542,7 +7541,7 @@ var BaseAddon = class {
 		return this._addonSecretTree;
 	}
 	deviceSecretTree() {
-		this._deviceSecretTree ??= secretTreeFromSchema(this.deviceSettingsSchema());
+		this._deviceSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.deviceSettingsSchema()), this.secretStatePaths);
 		return this._deviceSecretTree;
 	}
 	/**
@@ -7618,42 +7617,135 @@ var BaseAddon = class {
 		this[timerOf] = timer;
 	}
 	/**
-	* Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
-	* transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
-	* swap, or any race where the SqliteSettingsBackend is between shutdown and
-	* re-initialize) doesn't propagate up into `initialize()` and leave the
+	* Wrap `ctx.settings.readAddonStore()` with a retry budget so a transient
+	* settings-store outage doesn't propagate up into `initialize()` and leave the
 	* addon permanently broken.
 	*
-	* Retry only the two known infra fingerprints. Anything else propagates so
-	* real bugs surface immediately. After the budget expires we fall back to
-	* `{}` (defaults) — the addon's first successful patch will rehydrate.
+	* Two kinds of outage, two budgets:
+	*  - the store's own restart fingerprints (`SqliteSettingsBackend not
+	*    initialized`, `provider not available`): a short budget, then the addon
+	*    falls back to `{}` (defaults) - its first successful patch rehydrates;
+	*  - a TRANSPORT failure (the hub is restarting while this runner boots:
+	*    `discovery deadline exceeded`, `parent could not route`, a refused or
+	*    timed-out connection). Since D870 a runner's settings read THROWS instead
+	*    of answering `{}`, so without a budget a hub restart ends in a respawn
+	*    loop. A long, bounded budget; only after it the error propagates - the
+	*    addon never runs on defaults for a store it could not ask.
+	* Anything else propagates immediately so real bugs surface.
 	*/
 	async readAddonStoreWithRetry() {
 		const settings = this.rawSettings();
 		if (!settings) return {};
-		const delaysMs = [
-			150,
-			350,
-			600,
-			900
-		];
 		let lastErr;
-		for (let attempt = 0; attempt <= delaysMs.length; attempt++) try {
+		for (let attempt = 0;; attempt++) try {
 			const stored = await settings.readAddonStore() ?? {};
 			this.settingsStoreReady = true;
 			return stored;
 		} catch (err) {
 			lastErr = err;
-			const msg = err instanceof Error ? err.message : String(err);
-			if (!(msg.includes("SqliteSettingsBackend not initialized") || msg.includes("provider not available"))) throw err;
-			if (attempt === delaysMs.length) break;
-			await new Promise((r) => setTimeout(r, delaysMs[attempt]));
+			const kind = classifyStoreError(err);
+			if (kind === "permanent") throw err;
+			const delay = (kind === "transport" ? TRANSPORT_RETRY_DELAYS_MS : RESTART_RETRY_DELAYS_MS)[attempt];
+			if (delay === void 0) {
+				if (kind === "transport") throw err;
+				break;
+			}
+			await new Promise((r) => setTimeout(r, delay));
 		}
 		this.settingsStoreReady = false;
 		this._ctx?.logger?.warn?.("readAddonStore: settings-store unavailable after retries — using defaults", { meta: { error: lastErr instanceof Error ? lastErr.message : String(lastErr) } });
 		return {};
 	}
 };
+/** The settings store's own restart fingerprints. */
+var RESTART_RETRY_DELAYS_MS = [
+	150,
+	350,
+	600,
+	900
+];
+/** A hub restarting under a booting runner: ~100 s in total. */
+var TRANSPORT_RETRY_DELAYS_MS = [
+	150,
+	350,
+	600,
+	900,
+	2e3,
+	5e3,
+	1e4,
+	2e4,
+	3e4,
+	3e4
+];
+var RESTART_FINGERPRINTS = ["SqliteSettingsBackend not initialized", "provider not available"];
+/** Node / socket error codes of a connection that did not happen or broke. */
+var TRANSPORT_CODES = new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ETIMEDOUT",
+	"EPIPE",
+	"EHOSTUNREACH",
+	"ENETUNREACH"
+]);
+/** tRPC error codes that mean "the other side is not answering now", not "your call is wrong". */
+var UNAVAILABLE_TRPC_CODES = new Set([
+	"TIMEOUT",
+	"SERVICE_UNAVAILABLE",
+	"BAD_GATEWAY",
+	"GATEWAY_TIMEOUT"
+]);
+/** The exact phrases OUR transport raises when it cannot reach the hub. */
+var TRANSPORT_PHRASES = [
+	"discovery deadline exceeded",
+	"parent could not route child unowned cap call",
+	"UDS request timed out after",
+	"channel closed"
+];
+/** Moleculer error `type`s of a call that could not be served right now. */
+var MOLECULER_TRANSIENT_TYPES = new Set([
+	"REQUEST_TIMEOUT",
+	"SERVICE_NOT_FOUND",
+	"SERVICE_NOT_AVAILABLE",
+	"REQUEST_REJECTED",
+	"BROKER_DISCONNECTED"
+]);
+function stringProp(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const found = Reflect.get(value, key);
+	return typeof found === "string" ? found : void 0;
+}
+/** The code an error carries: its own, its cause's, or a tRPC `data.code`. */
+function errorCode(err) {
+	const out = {};
+	const cause = typeof err === "object" && err !== null ? Reflect.get(err, "cause") : void 0;
+	const data = typeof err === "object" && err !== null ? Reflect.get(err, "data") : void 0;
+	const node = stringProp(err, "code") ?? stringProp(cause, "code");
+	if (node !== void 0) out.node = node;
+	const trpc = stringProp(data, "code");
+	if (trpc !== void 0) out.trpc = trpc;
+	return out;
+}
+/**
+* Is a settings read failure worth retrying, and with which budget? Only
+* EXPLICIT signals count: a socket error code, a tRPC "unavailable" code, or
+* one of the exact phrases our own transport raises. A message that merely
+* contains "timed out" or "unreachable" is not evidence of anything, and
+* `settings store not wired` is a wiring bug that retrying cannot fix.
+*/
+function classifyStoreError(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	if (RESTART_FINGERPRINTS.some((f) => message.includes(f))) return "restart";
+	const code = errorCode(err);
+	if (code.node !== void 0 && TRANSPORT_CODES.has(code.node)) return "transport";
+	if (code.trpc !== void 0 && UNAVAILABLE_TRPC_CODES.has(code.trpc)) return "transport";
+	if (typeof err === "object" && err !== null) {
+		if (Reflect.get(err, "retryable") === true) return "transport";
+		const type = stringProp(err, "type");
+		if (type !== void 0 && MOLECULER_TRANSIENT_TYPES.has(type)) return "transport";
+	}
+	if (TRANSPORT_PHRASES.some((f) => message.includes(f))) return "transport";
+	return "permanent";
+}
 /**
 * Collect the keys of every field marked `perNode: true`, recursing into
 * layout containers (`group` fields and `sub-tabs` tabs) the same way
@@ -18806,6 +18898,28 @@ id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
 });
+/** One table of the settings database. */
+var StorageTableSchema = object({
+	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
+	name: string(),
+	/** The owner prefix of a scoped name (`recorder` for `recorder:addon-settings`), else null. */
+	owner: string().nullable(),
+	rows: number().int().nonnegative(),
+	/** Bytes the table's pages occupy (`dbstat`); null when the engine cannot measure. */
+	bytes: number().int().nonnegative().nullable(),
+	/** Declared by an addon since this engine process started (a running addon claims it). */
+	declaredThisBoot: boolean()
+});
+method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: array(StorageTableSchema) }), { auth: "admin" }), method(object({
+	collection: string().min(1),
+	expectRows: number().int().nonnegative()
+}), object({
+	dropped: literal(true),
+	rows: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * `keychain` — the hub's encrypted store of secret values (D787).
 *
@@ -19347,6 +19461,16 @@ method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}),
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
+}), method(object({
+	ref: string().min(1),
+	value: string().min(1)
+}), object({
+	ref: string(),
+	version: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
 }), method(object({ refs: array(string().min(1)).max(1e3) }), object({
 	deleted: array(string()).readonly(),
 	kept: array(object({
@@ -68644,6 +68768,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychainAdmin.importSecret": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.listAudit": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -72430,6 +72560,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageAdmin.dropCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"storageAdmin.listTables": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -78855,4 +78997,4 @@ function armRemovalReconcile(opts) {
 	return () => clearInterval(timer);
 }
 //#endregion
-export { audioAnalyzerCapability as $, _enum as $n, recordingArchiveCapability as $t, NativeLeaseAdmissionSchema as A, errMsg as An, gifFromMp4Args as At, RECORDING_SOURCE_CAMSTACK_ADDON as B, defineCustomActions as Bn, memoizePinnedFfmpeg as Bt, EVENT_PAD_MS as C, Fmp4BoxSplitter as Cn, evictionPolicyForMode as Ct, G711_SCALE_CORRECTION_DB as D, isSoftwareDecode as Dn, ffmpegRate as Dt, FailureCounters as E, invocationFromEncodeProfile as En, failureContributionCapability as Et, PoolMemoryWatchdog as F, HF_REPO as Fn, loadContributionCapability as Ft, VIDEOCLIPS_MAX_OFFER_BYTES as G, makeProfileBrokerId as Gn, overlayClusterStepSettings as Gt, RecordingConfigSchema as H, hfModelUrl as Hn, modeMayWrite as Ht, RATE_CONTROL_RELAXED as I, MODEL_FORMATS as In, logChannelsCapability as It, addonWidgetsSourceCapability as J, nodePin as Jn, pickDetailCropConvention as Jt, VISIT_MERGE_GAP_MS as K, makeSourceBrokerId as Kn, parseProcStatus as Kt, RATE_CONTROL_TIGHT as L, audioChunkBytesPerSample as Ln, mapAudioLabelToMacro as Lt, NodeBenchRunnerInputSchema as M, BaseAddon as Mn, isFirstLevelMacroClass as Mt, OpsLogEntrySchema as N, CAM_PROFILE_ORDER as Nn, linkedLabelStepId as Nt, LABEL_SUPPLY_MACRO as O, DeviceFeature as On, gbToBytes as Ot, PIPELINE_RAMP as P, CamProfileSchema as Pn, linkedStepOf as Pt, audioAnalysisCapability as Q, userError as Qn, rankStreams as Qt, RECORDING_EXPORT_MAX_READ_BYTES as R, createEvent as Rn, mayReadLocation as Rt, EVENT_OWNER_TYPES as S, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as Sn, evaluateZoneRules as St, ExportRecordSchema as T, evaluateSensorEdge as Tn, exportSubjectOf as Tt, RecordingSignalStatusSchema as U, hydrateSchema as Un, modelBindingKey as Ut, ROOT_SUPPLIABLE_STEP_IDS as V, expandAudioChunkToF32le as Vn, migrateLegacyDeviceSignalConfig as Vt, RingBuffer as W, isEvent as Wn, motionDetectionCapability as Wt, applyModelBoundSettings as X, selectAssignedProfileSlots as Xn, pipelineExecutorCapability as Xt, allowedSuppliedEffect as Y, parseProfileBrokerId as Yn, pickNativeLeaseOverride as Yt, armRemovalReconcile as Z, sleep as Zn, pipelineRunnerCapability as Zt, DEFAULT_DETAIL_CROP_CONVENTION as _, stripRetiredBandPreBufferSec as _n, detectionPipelineCapability as _t, BackgroundRunRegistry as a, resolveEgressDecodeHwAccel as an, number as ar, clipExportFailure as at, DEVICE_BACKEND_TO_FORMAT as b, webrtcSessionCapability as bn, egressTransportFromRequest as bt, CLIP_STILL_REASON_CODE_HEADER as c, resolvePoolMemoryPolicy as cn, record as cr, containingParentIndex as ct, CLUSTER_MODEL_SCOPED_STEPS as d, rootSuppliesOf as dn, EventCategory as dr, declareLogChannel as dt, recordingCapability as en, array as er, audioKindId as et, COCO_80_LABELS as f, runtimeDevices as fn, defaultDeviceFor as ft, DEFAULT_CLUSTER_STEP_SETTINGS as g, streamBrokerCapability as gn, deriveRootFaceRefineRect as gt, DEFAULT_AUDIO_ANALYZER_CONFIG as h, storageOccupancyCapability as hn, deriveRecordingMode as ht, AUDIO_MACRO_LABELS as i, resolveCreateExportSubject as in, literal as ir, cameraStreamsCapability as it, NativeLeaseSettingsSchema as j, BOOT_RECOVERY_BACKOFF_MS as jn, inferModelProvider as jt, LABEL_SUPPLY_VOCABULARIES as k, DeviceType as kn, gifDeriveSpeed as kt, CLIP_STILL_REASON_HEADER as l, resolveRecordingProfiles as ln, string as lr, createHwAccelCache as lt, CROP_SUPPLY_SOURCES as m, storageEvictableCapability as mn, deriveDetailCropRect as mt, APPLE_SA_TO_MACRO as n, recordingSignalCapability as nn, discriminatedUnion as nr, buildBenchStepTree as nt, BatteryStatusSchema as o, resolveLocationMode as on, object as or, clipExportFailureOf as ot, COCO_TO_MACRO as p, stepModelRunsOnFormat as pn, deriveBatteryPresence as pt, YAMNET_TO_MACRO as q, maskUrlCredentials as qn, pickClusterStepSettings as qt, AUDIO_BACKEND_CHOICES as r, resolveClusterStepModelId as rn, lazy as rr, cameraOwnsMotionViaSensor as rt, CLIP_BROKER_PACED_RATES as s, resolveModelBoundSetting as sn, preprocess as sr, collectModelBoundKeys as st, APPEARANCE_BLOCKS as t, recordingExportCapability as tn, boolean as tr, batteryCapability as tt, CLIP_STREAM_TRANSPORT_HEADER as u, resolveRootSupply as un, union as ur, createLogChannelsProvider as ut, DEFAULT_EVENTS_BAND_BUFFER_SEC as v, supportedRuntimes as vn, deviceRemovalHookCapability as vt, EncodeProfileSchema as w, buildFfmpegArgs as wn, evictionPolicyOfLocation as wt, DEVICE_RAMP as x, AUDIO_PRESETS as xn, enumerateInferenceDevices as xt, DEFAULT_NATIVE_LEASE_SETTINGS as y, videoclipsCapability as yn, egressTranscodeSharingKey as yt, RECORDING_SOURCE_CAMSTACK as z, customAction as zn, mayWriteToLocation as zt };
+export { audioAnalyzerCapability as $, userError as $n, recordingArchiveCapability as $t, NativeLeaseAdmissionSchema as A, errMsg as An, gifFromMp4Args as At, RECORDING_SOURCE_CAMSTACK_ADDON as B, defineCustomActions as Bn, memoizePinnedFfmpeg as Bt, EVENT_PAD_MS as C, Fmp4BoxSplitter as Cn, evictionPolicyForMode as Ct, G711_SCALE_CORRECTION_DB as D, isSoftwareDecode as Dn, ffmpegRate as Dt, FailureCounters as E, invocationFromEncodeProfile as En, failureContributionCapability as Et, PoolMemoryWatchdog as F, HF_REPO as Fn, loadContributionCapability as Ft, VIDEOCLIPS_MAX_OFFER_BYTES as G, isSecretMarker as Gn, overlayClusterStepSettings as Gt, RecordingConfigSchema as H, hfModelUrl as Hn, modeMayWrite as Ht, RATE_CONTROL_RELAXED as I, MODEL_FORMATS as In, logChannelsCapability as It, addonWidgetsSourceCapability as J, maskUrlCredentials as Jn, pickDetailCropConvention as Jt, VISIT_MERGE_GAP_MS as K, makeProfileBrokerId as Kn, parseProcStatus as Kt, RATE_CONTROL_TIGHT as L, audioChunkBytesPerSample as Ln, mapAudioLabelToMacro as Lt, NodeBenchRunnerInputSchema as M, BaseAddon as Mn, isFirstLevelMacroClass as Mt, OpsLogEntrySchema as N, CAM_PROFILE_ORDER as Nn, linkedLabelStepId as Nt, LABEL_SUPPLY_MACRO as O, DeviceFeature as On, gbToBytes as Ot, PIPELINE_RAMP as P, CamProfileSchema as Pn, linkedStepOf as Pt, audioAnalysisCapability as Q, sleep as Qn, rankStreams as Qt, RECORDING_EXPORT_MAX_READ_BYTES as R, createEvent as Rn, mayReadLocation as Rt, EVENT_OWNER_TYPES as S, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as Sn, evaluateZoneRules as St, ExportRecordSchema as T, evaluateSensorEdge as Tn, exportSubjectOf as Tt, RecordingSignalStatusSchema as U, hydrateSchema as Un, modelBindingKey as Ut, ROOT_SUPPLIABLE_STEP_IDS as V, expandAudioChunkToF32le as Vn, migrateLegacyDeviceSignalConfig as Vt, RingBuffer as W, isEvent as Wn, motionDetectionCapability as Wt, applyModelBoundSettings as X, parseProfileBrokerId as Xn, pipelineExecutorCapability as Xt, allowedSuppliedEffect as Y, nodePin as Yn, pickNativeLeaseOverride as Yt, armRemovalReconcile as Z, selectAssignedProfileSlots as Zn, pipelineRunnerCapability as Zt, DEFAULT_DETAIL_CROP_CONVENTION as _, stripRetiredBandPreBufferSec as _n, detectionPipelineCapability as _t, BackgroundRunRegistry as a, resolveEgressDecodeHwAccel as an, literal as ar, clipExportFailure as at, DEVICE_BACKEND_TO_FORMAT as b, webrtcSessionCapability as bn, egressTransportFromRequest as bt, CLIP_STILL_REASON_CODE_HEADER as c, resolvePoolMemoryPolicy as cn, preprocess as cr, containingParentIndex as ct, CLUSTER_MODEL_SCOPED_STEPS as d, rootSuppliesOf as dn, union as dr, declareLogChannel as dt, recordingCapability as en, _enum as er, audioKindId as et, COCO_80_LABELS as f, runtimeDevices as fn, EventCategory as fr, defaultDeviceFor as ft, DEFAULT_CLUSTER_STEP_SETTINGS as g, streamBrokerCapability as gn, deriveRootFaceRefineRect as gt, DEFAULT_AUDIO_ANALYZER_CONFIG as h, storageOccupancyCapability as hn, deriveRecordingMode as ht, AUDIO_MACRO_LABELS as i, resolveCreateExportSubject as in, lazy as ir, cameraStreamsCapability as it, NativeLeaseSettingsSchema as j, BOOT_RECOVERY_BACKOFF_MS as jn, inferModelProvider as jt, LABEL_SUPPLY_VOCABULARIES as k, DeviceType as kn, gifDeriveSpeed as kt, CLIP_STILL_REASON_HEADER as l, resolveRecordingProfiles as ln, record as lr, createHwAccelCache as lt, CROP_SUPPLY_SOURCES as m, storageEvictableCapability as mn, deriveDetailCropRect as mt, APPLE_SA_TO_MACRO as n, recordingSignalCapability as nn, boolean as nr, buildBenchStepTree as nt, BatteryStatusSchema as o, resolveLocationMode as on, number as or, clipExportFailureOf as ot, COCO_TO_MACRO as p, stepModelRunsOnFormat as pn, deriveBatteryPresence as pt, YAMNET_TO_MACRO as q, makeSourceBrokerId as qn, pickClusterStepSettings as qt, AUDIO_BACKEND_CHOICES as r, resolveClusterStepModelId as rn, discriminatedUnion as rr, cameraOwnsMotionViaSensor as rt, CLIP_BROKER_PACED_RATES as s, resolveModelBoundSetting as sn, object as sr, collectModelBoundKeys as st, APPEARANCE_BLOCKS as t, recordingExportCapability as tn, array as tr, batteryCapability as tt, CLIP_STREAM_TRANSPORT_HEADER as u, resolveRootSupply as un, string as ur, createLogChannelsProvider as ut, DEFAULT_EVENTS_BAND_BUFFER_SEC as v, supportedRuntimes as vn, deviceRemovalHookCapability as vt, EncodeProfileSchema as w, buildFfmpegArgs as wn, evictionPolicyOfLocation as wt, DEVICE_RAMP as x, AUDIO_PRESETS as xn, enumerateInferenceDevices as xt, DEFAULT_NATIVE_LEASE_SETTINGS as y, videoclipsCapability as yn, egressTranscodeSharingKey as yt, RECORDING_SOURCE_CAMSTACK as z, customAction as zn, mayWriteToLocation as zt };