@camstack/addon-pipeline 1.2.374 → 1.2.601

package/dist/{dist-CmdLCb_F.mjs → dist-BaHsDOWa.mjs}

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-//#region ../types/dist/event-category-C4hVnRo8.mjs
+//#region ../types/dist/event-category-BvOFi6PY.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -63,6 +63,24 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* consumes this category and maps it to the `addon-crash-loop` kind.
 	*/
 	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
+	/**
+	* A runner whose addon refused to start with a typed reason (D877) - parked
+	* in `refused`, never counted by the crash breaker, retried on operator
+	* action. One event per refusal.
+	*/
+	EventCategory["AddonRunnerRefused"] = "addon.runner-refused";
+	/**
+	* A runner settled on a state (D877): `running` (READY), `crashed`, `failed` or
+	* `refused`. In-process telemetry for the boot check (re-evaluate while any
+	* runner is still pending) and the alert centre (close a recovered runner).
+	*/
+	EventCategory["ProcessStateChanged"] = "process.state-changed";
+	/**
+	* The node's one-shot runner boot check (D877): planned runners against the
+	* process service, `degraded` when any is failed, refused or missing. The
+	* alert centre turns it into one alert and a direct critical push.
+	*/
+	EventCategory["SystemRunnerCheck"] = "system.runner-check";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -4105,6 +4123,12 @@ var numberProcessor = (schema, ctx, _json, _params) => {
 var booleanProcessor = (_schema, _ctx, json, _params) => {
 	json.type = "boolean";
 };
+var bigintProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("BigInt cannot be represented in JSON Schema");
+};
+var symbolProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Symbols cannot be represented in JSON Schema");
+};
 var nullProcessor = (_schema, ctx, json, _params) => {
 	if (ctx.target === "openapi-3.0") {
 		json.type = "string";
@@ -4112,12 +4136,17 @@ var nullProcessor = (_schema, ctx, json, _params) => {
 		json.enum = [null];
 	} else json.type = "null";
 };
+var undefinedProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Undefined cannot be represented in JSON Schema");
+};
 var voidProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Void cannot be represented in JSON Schema");
 };
 var neverProcessor = (_schema, _ctx, json, _params) => {
 	json.not = {};
 };
+var anyProcessor = (_schema, _ctx, _json, _params) => {};
+var unknownProcessor = (_schema, _ctx, _json, _params) => {};
 var dateProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Date cannot be represented in JSON Schema");
 };
@@ -4149,12 +4178,53 @@ var literalProcessor = (schema, ctx, json, _params) => {
 		json.enum = vals;
 	}
 };
+var nanProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("NaN cannot be represented in JSON Schema");
+};
+var templateLiteralProcessor = (schema, _ctx, json, _params) => {
+	const _json = json;
+	const pattern = schema._zod.pattern;
+	if (!pattern) throw new Error("Pattern not found in template literal");
+	_json.type = "string";
+	_json.pattern = pattern.source;
+};
+var fileProcessor = (schema, _ctx, json, _params) => {
+	const _json = json;
+	const file = {
+		type: "string",
+		format: "binary",
+		contentEncoding: "binary"
+	};
+	const { minimum, maximum, mime } = schema._zod.bag;
+	if (minimum !== void 0) file.minLength = minimum;
+	if (maximum !== void 0) file.maxLength = maximum;
+	if (mime) if (mime.length === 1) {
+		file.contentMediaType = mime[0];
+		Object.assign(_json, file);
+	} else {
+		Object.assign(_json, file);
+		_json.anyOf = mime.map((m) => ({ contentMediaType: m }));
+	}
+	else Object.assign(_json, file);
+};
+var successProcessor = (_schema, _ctx, json, _params) => {
+	json.type = "boolean";
+};
 var customProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Custom types cannot be represented in JSON Schema");
 };
+var functionProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Function types cannot be represented in JSON Schema");
+};
 var transformProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Transforms cannot be represented in JSON Schema");
 };
+var mapProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Map cannot be represented in JSON Schema");
+};
+var setProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Set cannot be represented in JSON Schema");
+};
 var arrayProcessor = (schema, ctx, _json, params) => {
 	const json = _json;
 	const def = schema._zod.def;
@@ -4359,6 +4429,12 @@ var readonlyProcessor = (schema, ctx, json, params) => {
 	seen.ref = def.innerType;
 	json.readOnly = true;
 };
+var promiseProcessor = (schema, ctx, _json, params) => {
+	const def = schema._zod.def;
+	process(def.innerType, ctx, params);
+	const seen = ctx.seen.get(schema);
+	seen.ref = def.innerType;
+};
 var optionalProcessor = (schema, ctx, _json, params) => {
 	const def = schema._zod.def;
 	process(def.innerType, ctx, params);
@@ -4371,6 +4447,81 @@ var lazyProcessor = (schema, ctx, _json, params) => {
 	const seen = ctx.seen.get(schema);
 	seen.ref = innerType;
 };
+var allProcessors = {
+	string: stringProcessor,
+	number: numberProcessor,
+	boolean: booleanProcessor,
+	bigint: bigintProcessor,
+	symbol: symbolProcessor,
+	null: nullProcessor,
+	undefined: undefinedProcessor,
+	void: voidProcessor,
+	never: neverProcessor,
+	any: anyProcessor,
+	unknown: unknownProcessor,
+	date: dateProcessor,
+	enum: enumProcessor,
+	literal: literalProcessor,
+	nan: nanProcessor,
+	template_literal: templateLiteralProcessor,
+	file: fileProcessor,
+	success: successProcessor,
+	custom: customProcessor,
+	function: functionProcessor,
+	transform: transformProcessor,
+	map: mapProcessor,
+	set: setProcessor,
+	array: arrayProcessor,
+	object: objectProcessor,
+	union: unionProcessor,
+	intersection: intersectionProcessor,
+	tuple: tupleProcessor,
+	record: recordProcessor,
+	nullable: nullableProcessor,
+	nonoptional: nonoptionalProcessor,
+	default: defaultProcessor,
+	prefault: prefaultProcessor,
+	catch: catchProcessor,
+	pipe: pipeProcessor,
+	readonly: readonlyProcessor,
+	promise: promiseProcessor,
+	optional: optionalProcessor,
+	lazy: lazyProcessor
+};
+function toJSONSchema(input, params) {
+	if ("_idmap" in input) {
+		const registry = input;
+		const ctx = initializeContext({
+			...params,
+			processors: allProcessors
+		});
+		const defs = {};
+		for (const entry of registry._idmap.entries()) {
+			const [_, schema] = entry;
+			process(schema, ctx);
+		}
+		const schemas = {};
+		ctx.external = {
+			registry,
+			uri: params?.uri,
+			defs
+		};
+		for (const entry of registry._idmap.entries()) {
+			const [key, schema] = entry;
+			extractDefs(ctx, schema);
+			schemas[key] = finalize(ctx, schema);
+		}
+		if (Object.keys(defs).length > 0) schemas.__shared = { [ctx.target === "draft-2020-12" ? "$defs" : "definitions"]: defs };
+		return { schemas };
+	}
+	const ctx = initializeContext({
+		...params,
+		processors: allProcessors
+	});
+	process(input, ctx);
+	extractDefs(ctx, input);
+	return finalize(ctx, input);
+}
 //#endregion
 //#region ../../node_modules/zod/v4/classic/iso.js
 var ZodISODateTime = /*@__PURE__*/ $constructor("ZodISODateTime", (inst, def) => {
@@ -5387,7 +5538,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-bwsTj221.mjs
+//#region ../types/dist/sleep-bZIhUvjd.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5536,7 +5687,7 @@ function isKeychainStoredField(field) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$2$1(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -5547,12 +5698,12 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$2$1(value)) return false;
+	if (!isRecord$5(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 function isSecretClear(value) {
-	return isRecord$2$1(value) && value["$secretClear"] === true;
+	return isRecord$5(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -6178,7 +6329,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$1(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -6191,7 +6342,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$4(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -6246,7 +6397,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$4) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -6262,7 +6413,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$1(row)) {
+		if (!isRecord$4(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -6287,7 +6438,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$1(incoming)) {
+			if (!isRecord$4(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -6295,7 +6446,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$1(stored) ? stored : {};
+			const storedObj = isRecord$4(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -6418,7 +6569,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$1(v)) {
+		if (isRecord$4(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -6450,7 +6601,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -6479,7 +6630,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord(item) && isRecord(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$3(item) && isRecord$3(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -6490,7 +6641,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord(value) && isRecord(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$3(value) && isRecord$3(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -6498,7 +6649,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord(incoming) || !isRecord(stored)) return incoming;
+	if (!isRecord$3(incoming) || !isRecord$3(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -6529,7 +6680,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord(a) && isRecord(b)) {
+	if (isRecord$3(a) && isRecord$3(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -6553,7 +6704,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -7341,7 +7492,7 @@ var BaseAddon = class {
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
-			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
+			ctx.api.addons.restartAddon.mutate({ addonId }).then(() => {
 				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
@@ -7835,6 +7986,303 @@ var PeerBytesTicketSchema = object({
 	*/
 	declaredBytes: number().int().nonnegative().nullable()
 });
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_QUERY_MAX = 1e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
+function defOf(schema) {
+	const zodBag = Reflect.get(schema, "_zod");
+	if (typeof zodBag !== "object" || zodBag === null) return {};
+	const def = Reflect.get(zodBag, "def");
+	if (typeof def !== "object" || def === null) return {};
+	return def;
+}
+function declaredHere(schema) {
+	return globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const key = each ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+/**
+* Record kinds (D881): the declaration an addon makes of one kind of fact, the
+* Zod row schema that describes it, and the helper that turns the two into the
+* JSON the engine stores.
+*
+* A kind is declared ONCE, next to the code that owns it, and the engine's
+* reconciler creates its indexes - nothing creates DDL at runtime from a write.
+* Everything the generic machinery needs (secret fields, the entry descriptor)
+* is DERIVED from the Zod schema: `.meta({ secret: true })` marks a credential,
+* never a field name (D879).
+*/
+/** A JSON field path: `trackId`, `auth.accessToken`. Charset-restricted: it is rendered into DDL. */
+var RecordFieldPathSchema = string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}(\.[A-Za-z_][A-Za-z0-9_]{0,63}){0,3}$/);
+var RecordIndexSchema = object({
+	name: string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+	fields: array(RecordFieldPathSchema).min(1).max(4),
+	unique: boolean().optional()
+}).strict();
+var RecordRetentionSchema = union([
+	object({
+		ttlMs: number().int().positive(),
+		from: _enum(["at", "write"])
+	}).strict(),
+	object({
+		maxRows: number().int().positive().optional(),
+		maxRowsPerDevice: number().int().positive().optional()
+	}).strict().refine((r) => r.maxRows !== void 0 || r.maxRowsPerDevice !== void 0, { message: "name maxRows, maxRowsPerDevice or both" }),
+	object({
+		owner: string().min(1),
+		reason: string().min(1)
+	}).strict(),
+	object({ none: string().min(1) }).strict()
+]);
+/** The descriptor a generic entries UI reads (D881 "generic entries"). */
+var EntryDescriptorSchema = object({
+	title: string().min(1),
+	/** The record body field shown as the entry's name. */
+	nameField: string().min(1),
+	/** JSON Schema of the entry body; `secret: true` marks a password field. */
+	fields: record(string(), unknown())
+}).strict();
+/** What crosses the wire and sits in the engine's catalog: JSON only, no Zod. */
+var RecordKindDeclarationSchema = object({
+	database: _enum(RECORD_DATABASES).default("settings"),
+	class: _enum(RECORD_CLASSES),
+	writeTrigger: string().min(1),
+	device: _enum([
+		"required",
+		"optional",
+		"none"
+	]).default("none"),
+	at: _enum(["required", "none"]).default("none"),
+	indexes: array(RecordIndexSchema).max(8).default([]),
+	retention: RecordRetentionSchema,
+	deviceRemoval: _enum(["delete", "none"]).default("none"),
+	maxDataBytes: number().int().positive().max(RECORD_MAX_DATA_BYTES).default(RECORD_DEFAULT_MAX_DATA_BYTES),
+	/** Derived from the Zod schema; never written by hand. */
+	secretPaths: array(string().min(1)).default([]),
+	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
+	secretArrayKeys: record(string(), string()).default({}),
+	/** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+	adoptsFrom: string().min(1).optional(),
+	/** Kinds that must agree through `transact` sit in one file under one family name. */
+	transactFamily: string().min(1).optional(),
+	entry: EntryDescriptorSchema.optional()
+}).strict();
+/** The kind names: lower-case, dash separated, short enough for an index name. */
+var RecordKindNameSchema = string().regex(/^[a-z][a-z0-9-]{0,47}$/);
+/** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
+function assertValidDeclaration(name, decl) {
+	const refuse = (why) => {
+		throw new DeclarationRefusedError(`kind "${name}": ${why}`);
+	};
+	if (!RecordKindNameSchema.safeParse(name).success) refuse("the name must be lower-case-dashed");
+	const seen = /* @__PURE__ */ new Set();
+	for (const index of decl.indexes) {
+		if (seen.has(index.name)) refuse(`index name "${index.name}" is declared twice`);
+		seen.add(index.name);
+	}
+	const { retention } = decl;
+	const hasSecrets = decl.secretPaths.length > 0;
+	if ("ttlMs" in retention) {
+		if (retention.from === "at" && decl.at !== "required") refuse("a ttl from \"at\" needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use engine TTL (its keychain values would be orphaned)");
+	}
+	if ("maxRows" in retention || "maxRowsPerDevice" in retention) {
+		if (retention.maxRowsPerDevice !== void 0 && decl.device !== "required") refuse("maxRowsPerDevice needs device: \"required\"");
+		if (decl.at !== "required") refuse("a row bound trims the oldest \"at\": it needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use an engine row bound");
+		const bound = Math.max(retention.maxRows ?? 0, retention.maxRowsPerDevice ?? 0);
+		if (decl.database === "settings" && bound > 5e4) refuse(`a row bound above ${RECORD_SETTINGS_MAX_ROWS} belongs in database: "events" (a big delete on the settings thread stalls every configuration read)`);
+	}
+	if (decl.deviceRemoval === "delete" && decl.device === "none") refuse("deviceRemoval: \"delete\" needs a device: \"required\" or \"optional\"");
+	for (const path of decl.secretPaths) for (const prefix of secretArrayPrefixes(path)) if (decl.secretArrayKeys[prefix] === void 0) refuse(`secret path "${path}" crosses the array "${prefix}": declare its id key in secretArrayKeys`);
+}
+function bodyFieldsOf(schema) {
+	return { ...toJSONSchema(schema, {
+		unrepresentable: "any",
+		io: "input"
+	}) };
+}
+function isRecordLike(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Does every branch of the body schema carry `field`? (A discriminated union has several.) */
+function hasNameField(json, field) {
+	const branches = json["oneOf"] ?? json["anyOf"];
+	if (Array.isArray(branches)) return branches.length > 0 && branches.every((b) => isRecordLike(b) && hasNameField(b, field));
+	const properties = json["properties"];
+	return isRecordLike(properties) && Object.prototype.hasOwnProperty.call(properties, field);
+}
+/**
+* Declare the kinds of a package. The keys are the kind names. The result is
+* what `ctx.records.declare` sends to the engine and what `ctx.records.kind`
+* types its handle from.
+*/
+function defineRecordKinds(specs) {
+	const out = {};
+	for (const [name, spec] of Object.entries(specs)) {
+		const secretPaths = collectZodSecretPaths(spec.schema);
+		const nameField = spec.entry?.nameField ?? "name";
+		const fields = bodyFieldsOf(spec.schema);
+		if (spec.entry !== void 0 && !hasNameField(fields, nameField)) throw new DeclarationRefusedError(`kind "${name}": an entry kind's schema needs a "${nameField}" field`);
+		const parsed = RecordKindDeclarationSchema.parse({
+			database: spec.database,
+			class: spec.class,
+			writeTrigger: spec.writeTrigger,
+			device: spec.device,
+			at: spec.at,
+			indexes: spec.indexes === void 0 ? void 0 : [...spec.indexes],
+			retention: spec.retention,
+			deviceRemoval: spec.deviceRemoval,
+			maxDataBytes: spec.maxDataBytes,
+			secretPaths: [...secretPaths],
+			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
+			adoptsFrom: spec.adoptsFrom,
+			transactFamily: spec.transactFamily,
+			entry: spec.entry === void 0 ? void 0 : {
+				title: spec.entry.title,
+				nameField,
+				fields
+			}
+		});
+		assertValidDeclaration(name, parsed);
+		out[name] = {
+			name,
+			schema: spec.schema,
+			declaration: parsed
+		};
+	}
+	return out;
+}
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = _enum([
 	"high",
@@ -8601,7 +9049,7 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/err-msg-DLerKiVO.mjs
+//#region ../types/dist/err-msg--2RrYiLO.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -8870,6 +9318,9 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
 	*  real Switch device for UI rendering / export adapters. */
 	DeviceRole["BinaryHelper"] = "binary-helper";
+	/** A smart plug: a `switch` whose source says it is an outlet (HA
+	*  `device_class: outlet`). The Alexa export shows it as a SMARTPLUG. */
+	DeviceRole["Outlet"] = "outlet";
 	/** Generic motion / occupancy / moving event source. Distinct from
 	*  the camera accessory PirSensor role: that one is a camera child;
 	*  this is a standalone HA / 3rd-party motion sensor. */
@@ -8947,7 +9398,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-EQ9Ok0Ee.mjs
+//#region ../types/dist/composition-DOwQB_Ua.mjs
 var AUDIO_ENCODER_BY_CODEC = {
 	opus: "libopus",
 	aac: "aac",
@@ -18410,6 +18861,41 @@ var ComposableCapabilitiesSchema = object({ caps: array(object({
 		keyField: string()
 	}).optional()
 })) });
+/**
+* The report of a one-shot "move this owner's plaintext secrets into the
+* keychain" run (D878). COUNTS only - never a value, never a ref.
+*
+* The owner runs it on its own rows, through its own write path; an operator
+* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
+* Dry run (`apply: false`) reports what WOULD move and changes nothing.
+*/
+var RawSecretMigrationInputSchema = object({ 
+/** `false` (the default of the script) = report only. */
+apply: boolean() });
+var RawSecretMigrationReportSchema = object({
+	apply: boolean(),
+	/** Rows that can carry a secret (a profile, an enrolment). */
+	rows: number().int(),
+	/** Rows whose secret was plaintext when the run started. */
+	raw: number().int(),
+	/** Rows that already held a keychain marker when the run started. */
+	markers: number().int(),
+	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
+	migrated: number().int(),
+	/** Plaintext rows left in place because the move or its read-back failed. */
+	failed: number().int(),
+	/** After the run: rows still holding plaintext. */
+	remainingRaw: number().int(),
+	/** After the run: markers the keychain could not resolve right now. */
+	unresolvedMarkers: number().int(),
+	/**
+	* A second, redundant copy of the secrets' rows that the run found (and, on
+	* `apply`, deleted after verifying the first). Owners with a single copy omit it.
+	*/
+	redundantCopies: number().int().optional(),
+	/** True when nothing is raw and every marker resolves. */
+	verified: boolean()
+});
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
@@ -18636,6 +19122,9 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), SettingsUpdateResultSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({}), object({ libs: array(object({
 	filePath: string(),
 	content: string()
@@ -18898,6 +19387,222 @@ id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* records - an addon's own facts and documents (D881): ledgers, audit rows,
+* config documents, mirrors. The third storage API next to `ctx.settings`
+* (operator intent, D870) and device-history (numbers over time, D850).
+*
+* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
+* crossed a process and stated by a hub in-process caller (`ctx.records` does
+* that with the addon id closed over). It is deliberately NOT in any input
+* schema, so a session can never supply it, and a call with no stamp is refused
+* `records/no-caller`. A kind is readable and writable only by its owner; other
+* addons go through the owner's capability.
+*
+* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
+* never `[]`. Secret fields are never on the wire: a read shows the
+* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
+* resolves itself, and a write may carry only a keychain marker bound to the
+* row's own ref.
+*
+* Internal: addons reach it through `ctx.records`, never directly.
+*/
+var RecordIdSchema = string().min(1).max(256);
+/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
+var RecordBodySchema = record(string(), unknown());
+var RecordInputSchema = object({
+	id: RecordIdSchema,
+	/** The device this row belongs to (D865 removal, per-device reads). */
+	deviceId: number().int().optional(),
+	/** The domain clock, ms: observed / created / opened. */
+	at: number().int().optional(),
+	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
+	expiresAt: number().int().optional(),
+	data: RecordBodySchema
+});
+var RecordViewSchema = object({
+	id: string(),
+	deviceId: number().int().nullable(),
+	at: number().nullable(),
+	expiresAt: number().nullable(),
+	rev: number().int(),
+	updatedAt: number(),
+	data: RecordBodySchema
+});
+/** Declared index fields only. Anything else does not compile, by design. */
+var RecordWhereSchema = record(RecordFieldPathSchema, union([
+	string(),
+	number(),
+	boolean(),
+	object({ in: array(union([
+		string(),
+		number(),
+		boolean()
+	])).min(1).max(RECORD_BATCH_MAX) }),
+	object({
+		gt: union([string(), number()]).optional(),
+		gte: union([string(), number()]).optional(),
+		lt: union([string(), number()]).optional(),
+		lte: union([string(), number()]).optional()
+	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
+]));
+var KindShape = { kind: RecordKindNameSchema };
+var TimeWindowShape = {
+	deviceId: number().int().optional(),
+	atFrom: number().optional(),
+	atTo: number().optional()
+};
+var RecordQueryInputSchema = object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional(),
+	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
+	order: _enum(["at", "id"]).optional(),
+	desc: boolean().optional(),
+	limit: number().int().min(1).max(RECORD_QUERY_MAX).default(100),
+	/** Opaque keyset cursor from a previous answer. There is no offset. */
+	cursor: string().min(1).optional()
+});
+var RecordQueryResultSchema = object({
+	records: array(RecordViewSchema),
+	nextCursor: string().nullable()
+});
+var RecordKindStateSchema = _enum([
+	"created",
+	"unchanged",
+	"updated"
+]);
+var DeclareKindResultSchema = object({
+	kindId: number().int(),
+	state: RecordKindStateSchema,
+	createdIndexes: array(string()),
+	/** The boot guard: the kind is empty while its legacy table still holds rows. */
+	adoptionPending: object({
+		legacyTable: string(),
+		legacyRows: number().int()
+	}).nullable()
+});
+/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
+var SecretRefsList = array(string());
+var RecordSecretRefsSchema = record(string(), record(string(), string()));
+method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string(), DeclareKindResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), array(RecordViewSchema), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	record: RecordInputSchema,
+	/** Compare-and-set. `0` means "the row must not exist". */
+	ifRev: number().int().min(0).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	count: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema,
+	data: RecordBodySchema,
+	at: number().int().nullable().optional(),
+	expiresAt: number().int().nullable().optional(),
+	ifRev: number().int().min(1).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), object({
+	deleted: boolean(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional()
+}), object({ count: number().int() }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	from: number(),
+	to: number(),
+	bucketMs: number().int().positive()
+}), object({ buckets: array(object({
+	bucketStart: number(),
+	count: number().int()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	op: _enum([
+		"sum",
+		"min",
+		"max",
+		"count"
+	]),
+	field: RecordFieldPathSchema.optional(),
+	groupBy: RecordFieldPathSchema.optional(),
+	where: RecordWhereSchema.optional()
+}), object({ rows: array(object({
+	group: union([
+		string(),
+		number(),
+		_null()
+	]),
+	value: number().nullable()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	atBefore: number().optional(),
+	where: RecordWhereSchema.optional()
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	kinds: array(RecordKindNameSchema).optional()
+}), object({
+	deleted: record(string(), number().int()),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object(KindShape), object({ id: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+});
 /** One table of the settings database. */
 var StorageTableSchema = object({
 	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
@@ -18910,6 +19615,28 @@ var StorageTableSchema = object({
 	/** Declared by an addon since this engine process started (a running addon claims it). */
 	declaredThisBoot: boolean()
 });
+/** One declared record kind (D881) as System -> Data shows it. */
+var StorageKindSchema = object({
+	owner: string(),
+	kind: string(),
+	database: _enum(["settings", "events"]),
+	class: string(),
+	state: _enum([
+		"declared",
+		"orphaned",
+		"dropped"
+	]),
+	/** `null` when the caller asked for no counts (`counts: false`). */
+	rows: number().int().nonnegative().nullable(),
+	/** Rows x the average size of a sample; null for an empty kind. */
+	bytesEstimate: number().int().nonnegative().nullable(),
+	writeTrigger: string(),
+	retention: RecordRetentionSchema,
+	/** `true` when the kind is an entry kind (the generic entries UI lists it). */
+	entry: boolean(),
+	/** The whole declaration, secret paths and entry descriptor included (the entries service builds its handle from it). */
+	declaration: RecordKindDeclarationSchema
+});
 method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: array(StorageTableSchema) }), { auth: "admin" }), method(object({
 	collection: string().min(1),
 	expectRows: number().int().nonnegative()
@@ -18919,6 +19646,87 @@ method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: arr
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	owner: string().min(1).optional(),
+	/** `false` skips the per-kind row count (a catalog read only). Default true. */
+	counts: boolean().optional()
+}), object({ kinds: array(StorageKindSchema) }), { auth: "admin" }), method(RecordQueryInputSchema.extend({
+	owner: string().min(1),
+	kind: RecordKindNameSchema
+}), RecordQueryResultSchema, { auth: "admin" }), method(object({
+	owner: string().min(1),
+	kind: RecordKindNameSchema,
+	records: array(RecordInputSchema).max(RECORD_BATCH_MAX),
+	/** The LAST batch: the copy is complete, the boot guard stops asking. */
+	complete: boolean().optional()
+}).refine((input) => input.records.length > 0 || input.complete === true, { message: "records must be non-empty unless complete is true" }), object({ adopted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	collection: string().min(1),
+	cursor: string().optional(),
+	limit: number().int().min(1).max(1e3).optional()
+}), object({
+	rows: array(object({
+		id: string(),
+		data: record(string(), unknown())
+	})),
+	nextCursor: string().nullable()
+}), { auth: "admin" }), method(object({ collection: string().min(1) }), object({ adopted: boolean() }), { auth: "admin" });
+/**
+* record-entries - the ONE admin surface for every list of user-created entries
+* (D881): notification targets, brokers, LLM profiles, anything an addon
+* declares as an ENTRY kind (`entry: { title }` in `defineRecordKinds`).
+*
+* The UI is generic. `listEntryKinds` hands it, per kind, the JSON Schema of
+* the entry body with `secret: true` on every credential field, so a password
+* field is derived from the schema and never from a name. `putEntry` takes the
+* redaction token for an untouched secret (the stored value is kept), a string
+* for a new one, and the clear instruction to remove one. A read never carries
+* a secret value, and a locked keychain refuses the write with
+* `records/secret-unavailable` instead of storing plaintext.
+*
+* Hub-only, served in-process (it acts for each entry's owner on the keychain).
+*/
+var EntryKindInfoSchema = object({
+	owner: string(),
+	kind: RecordKindNameSchema,
+	title: string(),
+	nameField: string(),
+	/** JSON Schema of the body; `secret: true` marks a password field. */
+	fields: record(string(), unknown()),
+	secretPaths: array(string()),
+	rows: number().int().nonnegative()
+});
+var EntryViewSchema = object({
+	id: RecordIdSchema,
+	name: string(),
+	rev: number().int(),
+	updatedAt: number(),
+	/** Secret fields hold the redaction token. */
+	data: RecordBodySchema
+});
+var EntryAddress = {
+	owner: string().min(1),
+	kind: RecordKindNameSchema
+};
+method(object({}), object({ kinds: array(EntryKindInfoSchema) }), { auth: "admin" }), method(object({ ...EntryAddress }), object({ entries: array(EntryViewSchema) }), { auth: "admin" }), method(object({
+	...EntryAddress,
+	id: RecordIdSchema.optional(),
+	data: RecordBodySchema,
+	ifRev: number().int().min(1).optional()
+}), object({
+	id: string(),
+	rev: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...EntryAddress,
+	id: RecordIdSchema
+}), object({ deleted: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 });
 /**
 * `keychain` — the hub's encrypted store of secret values (D787).
@@ -42007,6 +42815,9 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, {
 }), _void(), { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(ProfileRefInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -53263,6 +54074,41 @@ var ServerRollbackInfoSchema = object({
 	atMs: number(),
 	reason: string()
 });
+/**
+* The runner boot check (D877): the runners this node PLANNED (hub: one per
+* `resolveRunnerId` over its forked addons; agent: the runners its process
+* service holds, because only the hub plans) against the states the process
+* service reports. Kept in memory, recomputed by the same one-shot check after
+* every boot, served on `getServerPackageStatus`.
+*
+* `failed` is the D6 breaker's terminal state, `refused` a deterministic Init
+* refusal (an addon that said "I will not start, and here is why"), `missing` a
+* planned runner the process service has no entry for.
+*/
+var RunnerRefusalSchema = object({
+	runnerId: string(),
+	addonIds: array(string()),
+	reason: string()
+});
+var RunnerBootCheckSchema = object({
+	checkedAtMs: number(),
+	/** Runners planned for this node. */
+	expected: number(),
+	/** Planned runners whose process is `running`. */
+	running: number(),
+	failed: array(string()),
+	refused: array(RunnerRefusalSchema),
+	missing: array(string()),
+	/**
+	* Runners still on their way: `starting`, or `crashed` waiting on a backoff
+	* respawn. The check is FINAL only when this is empty; until then nothing is
+	* pushed and the verdict is re-evaluated on the next runner state change.
+	* Optional for version skew (absent = settled).
+	*/
+	pending: array(string()).optional(),
+	/** True when the plan is the hub's (`missing` is then meaningful); false on an agent. */
+	planKnown: boolean()
+});
 var ServerPackageStatusSchema = object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: string(),
@@ -53325,7 +54171,14 @@ var ServerPackageStatusSchema = object({
 	* for version skew: an older provider's payload simply omits it, and an
 	* absent wrapper is unknown — never `native`.
 	*/
-	wrapper: WrapperIdentitySchema.optional()
+	wrapper: WrapperIdentitySchema.optional(),
+	/**
+	* What this node PLANNED to run against what its process service reports
+	* (D877). Absent until the one-shot boot check has run (~60 s after boot) and
+	* on a provider that predates it. Absent is "not checked yet", never "all
+	* well": a consumer that needs the answer treats it as pending.
+	*/
+	runners: RunnerBootCheckSchema.optional()
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),
@@ -53376,6 +54229,13 @@ var ServerUpdateOutcomeSchema = _enum([
 	"refused",
 	"failed"
 ]);
+/** One addon the pre-flight found the target version would refuse (D877). */
+var UpdateBlockerSchema = object({
+	addonId: string(),
+	reason: string(),
+	/** What the operator does about it. */
+	remedy: string()
+});
 var ServerUpdateActionResultSchema = object({
 	accepted: boolean(),
 	targetVersion: string().nullable(),
@@ -53393,14 +54253,27 @@ var ServerUpdateActionResultSchema = object({
 	* The failure itself, verbatim enough to act on (the npm output for a
 	* staging install). Non-null only for `failed`.
 	*/
-	error: string().nullable().optional()
+	error: string().nullable().optional(),
+	/**
+	* The addons the target version would refuse to start on this node's live
+	* store (D877), present when the pre-flight refused the update
+	* (`reason: 'addon-would-refuse'`). Optional for version skew.
+	*/
+	blockers: array(UpdateBlockerSchema).optional()
 });
 method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), ServerUpdateCheckResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ 
-/** Explicit target version; omitted = latest from the registry. */
-version: string().optional() }), ServerUpdateActionResultSchema, {
+}), method(object({
+	/** Explicit target version; omitted = latest from the registry. */
+	version: string().optional(),
+	/**
+	* Apply even though the pre-flight (D877) found addons the target would
+	* refuse to start. Off by default: those addons stay down until the
+	* remedy is run, which is the incident this gate exists to prevent.
+	*/
+	acknowledgeRefusals: boolean().optional()
+}), ServerUpdateActionResultSchema, {
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 16 * 6e4
@@ -56227,7 +57100,9 @@ var ManifestShapeSchema = object({
 var AddonProcessSchema = object({
 	pid: number().optional(),
 	mode: string(),
-	state: string()
+	state: string(),
+	/** Why the runner is `refused` (an addon's own words), when it is (D877). */
+	reason: string().optional()
 });
 /**
 * Per-addon health snapshot from the kernel's AddonHealthMonitor.
@@ -57319,6 +58194,12 @@ object({
 	/** Horizontal louver swing on/off. Null when the device has no
 	*  horizontal swing surface (gate with `DeviceFeature.ClimateSwingHorizontal`). */
 	swingHorizontal: boolean().nullable(),
+	/** Lowest setpoint the device accepts, Celsius. Absent / null = not reported. */
+	minTemp: number().nullable().optional(),
+	/** Highest setpoint the device accepts, Celsius. Absent / null = not reported. */
+	maxTemp: number().nullable().optional(),
+	/** Setpoint granularity, Celsius (0.5, 1). Absent / null = not reported. */
+	tempStep: number().positive().nullable().optional(),
 	/** Ms epoch when the slice was last updated (push or command). */
 	lastFetchedAt: number()
 });
@@ -64863,7 +65744,11 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
-}), method(object({ userId: string() }), TotpStatusSchema, { auth: "admin" }), method(object({
+}), method(object({ userId: string() }), TotpStatusSchema, { auth: "admin" }), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
+}), method(object({
 	userId: string(),
 	code: string()
 }), object({ valid: boolean() }), {
@@ -67082,6 +67967,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.migrateRawSecrets": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -68942,6 +69833,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"llm.migrateRawSecrets": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -71828,6 +72725,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recordEntries.deleteEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"recordEntries.listEntries": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.listEntryKinds": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.putEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.getAvailability": {
 		capName: "recording",
 		capScope: "device",
@@ -72128,6 +73049,102 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"records.aggregate": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.allocateId": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.count": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.declareKinds": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.delete": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteDevice": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteWhere": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.get": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.getMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.histogram": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.patch": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.put": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.putMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.query": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.secretRefs": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.captureReference": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -72560,18 +73577,48 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageAdmin.adoptRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"storageAdmin.dropCollection": {
 		capName: "storage-admin",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"storageAdmin.isAdoptedLegacyTable": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.listKinds": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageAdmin.listTables": {
 		capName: "storage-admin",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"storageAdmin.readLegacyCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.readRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -73484,6 +74531,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.migrateRawSecrets": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.oauthExchangeCode": {
 		capName: "user-management",
 		capScope: "system",
@@ -76160,6 +77213,37 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"records.count": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.deleteDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"records.deleteWhere": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.histogram": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.putMany": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"records.query": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"sceneMonitor.captureReference": [{
 		name: "deviceId",
 		form: "single",
@@ -76276,6 +77360,17 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"storageAdmin.adoptRecords": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"storageAdmin.readRecords": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"streamBroker.acquireEgressTranscode": [{
 		name: "deviceId",
 		form: "single",
@@ -78997,4 +80092,4 @@ function armRemovalReconcile(opts) {
 	return () => clearInterval(timer);
 }
 //#endregion
-export { audioAnalyzerCapability as $, userError as $n, recordingArchiveCapability as $t, NativeLeaseAdmissionSchema as A, errMsg as An, gifFromMp4Args as At, RECORDING_SOURCE_CAMSTACK_ADDON as B, defineCustomActions as Bn, memoizePinnedFfmpeg as Bt, EVENT_PAD_MS as C, Fmp4BoxSplitter as Cn, evictionPolicyForMode as Ct, G711_SCALE_CORRECTION_DB as D, isSoftwareDecode as Dn, ffmpegRate as Dt, FailureCounters as E, invocationFromEncodeProfile as En, failureContributionCapability as Et, PoolMemoryWatchdog as F, HF_REPO as Fn, loadContributionCapability as Ft, VIDEOCLIPS_MAX_OFFER_BYTES as G, isSecretMarker as Gn, overlayClusterStepSettings as Gt, RecordingConfigSchema as H, hfModelUrl as Hn, modeMayWrite as Ht, RATE_CONTROL_RELAXED as I, MODEL_FORMATS as In, logChannelsCapability as It, addonWidgetsSourceCapability as J, maskUrlCredentials as Jn, pickDetailCropConvention as Jt, VISIT_MERGE_GAP_MS as K, makeProfileBrokerId as Kn, parseProcStatus as Kt, RATE_CONTROL_TIGHT as L, audioChunkBytesPerSample as Ln, mapAudioLabelToMacro as Lt, NodeBenchRunnerInputSchema as M, BaseAddon as Mn, isFirstLevelMacroClass as Mt, OpsLogEntrySchema as N, CAM_PROFILE_ORDER as Nn, linkedLabelStepId as Nt, LABEL_SUPPLY_MACRO as O, DeviceFeature as On, gbToBytes as Ot, PIPELINE_RAMP as P, CamProfileSchema as Pn, linkedStepOf as Pt, audioAnalysisCapability as Q, sleep as Qn, rankStreams as Qt, RECORDING_EXPORT_MAX_READ_BYTES as R, createEvent as Rn, mayReadLocation as Rt, EVENT_OWNER_TYPES as S, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as Sn, evaluateZoneRules as St, ExportRecordSchema as T, evaluateSensorEdge as Tn, exportSubjectOf as Tt, RecordingSignalStatusSchema as U, hydrateSchema as Un, modelBindingKey as Ut, ROOT_SUPPLIABLE_STEP_IDS as V, expandAudioChunkToF32le as Vn, migrateLegacyDeviceSignalConfig as Vt, RingBuffer as W, isEvent as Wn, motionDetectionCapability as Wt, applyModelBoundSettings as X, parseProfileBrokerId as Xn, pipelineExecutorCapability as Xt, allowedSuppliedEffect as Y, nodePin as Yn, pickNativeLeaseOverride as Yt, armRemovalReconcile as Z, selectAssignedProfileSlots as Zn, pipelineRunnerCapability as Zt, DEFAULT_DETAIL_CROP_CONVENTION as _, stripRetiredBandPreBufferSec as _n, detectionPipelineCapability as _t, BackgroundRunRegistry as a, resolveEgressDecodeHwAccel as an, literal as ar, clipExportFailure as at, DEVICE_BACKEND_TO_FORMAT as b, webrtcSessionCapability as bn, egressTransportFromRequest as bt, CLIP_STILL_REASON_CODE_HEADER as c, resolvePoolMemoryPolicy as cn, preprocess as cr, containingParentIndex as ct, CLUSTER_MODEL_SCOPED_STEPS as d, rootSuppliesOf as dn, union as dr, declareLogChannel as dt, recordingCapability as en, _enum as er, audioKindId as et, COCO_80_LABELS as f, runtimeDevices as fn, EventCategory as fr, defaultDeviceFor as ft, DEFAULT_CLUSTER_STEP_SETTINGS as g, streamBrokerCapability as gn, deriveRootFaceRefineRect as gt, DEFAULT_AUDIO_ANALYZER_CONFIG as h, storageOccupancyCapability as hn, deriveRecordingMode as ht, AUDIO_MACRO_LABELS as i, resolveCreateExportSubject as in, lazy as ir, cameraStreamsCapability as it, NativeLeaseSettingsSchema as j, BOOT_RECOVERY_BACKOFF_MS as jn, inferModelProvider as jt, LABEL_SUPPLY_VOCABULARIES as k, DeviceType as kn, gifDeriveSpeed as kt, CLIP_STILL_REASON_HEADER as l, resolveRecordingProfiles as ln, record as lr, createHwAccelCache as lt, CROP_SUPPLY_SOURCES as m, storageEvictableCapability as mn, deriveDetailCropRect as mt, APPLE_SA_TO_MACRO as n, recordingSignalCapability as nn, boolean as nr, buildBenchStepTree as nt, BatteryStatusSchema as o, resolveLocationMode as on, number as or, clipExportFailureOf as ot, COCO_TO_MACRO as p, stepModelRunsOnFormat as pn, deriveBatteryPresence as pt, YAMNET_TO_MACRO as q, makeSourceBrokerId as qn, pickClusterStepSettings as qt, AUDIO_BACKEND_CHOICES as r, resolveClusterStepModelId as rn, discriminatedUnion as rr, cameraOwnsMotionViaSensor as rt, CLIP_BROKER_PACED_RATES as s, resolveModelBoundSetting as sn, object as sr, collectModelBoundKeys as st, APPEARANCE_BLOCKS as t, recordingExportCapability as tn, array as tr, batteryCapability as tt, CLIP_STREAM_TRANSPORT_HEADER as u, resolveRootSupply as un, string as ur, createLogChannelsProvider as ut, DEFAULT_EVENTS_BAND_BUFFER_SEC as v, supportedRuntimes as vn, deviceRemovalHookCapability as vt, EncodeProfileSchema as w, buildFfmpegArgs as wn, evictionPolicyOfLocation as wt, DEVICE_RAMP as x, AUDIO_PRESETS as xn, enumerateInferenceDevices as xt, DEFAULT_NATIVE_LEASE_SETTINGS as y, videoclipsCapability as yn, egressTranscodeSharingKey as yt, RECORDING_SOURCE_CAMSTACK as z, customAction as zn, mayWriteToLocation as zt };
+export { audioAnalyzerCapability as $, sleep as $n, recordingArchiveCapability as $t, NativeLeaseAdmissionSchema as A, errMsg as An, gifFromMp4Args as At, RECORDING_SOURCE_CAMSTACK_ADDON as B, defineCustomActions as Bn, memoizePinnedFfmpeg as Bt, EVENT_PAD_MS as C, Fmp4BoxSplitter as Cn, evictionPolicyForMode as Ct, G711_SCALE_CORRECTION_DB as D, isSoftwareDecode as Dn, ffmpegRate as Dt, FailureCounters as E, invocationFromEncodeProfile as En, failureContributionCapability as Et, PoolMemoryWatchdog as F, HF_REPO as Fn, loadContributionCapability as Ft, VIDEOCLIPS_MAX_OFFER_BYTES as G, isEvent as Gn, overlayClusterStepSettings as Gt, RecordingConfigSchema as H, expandAudioChunkToF32le as Hn, modeMayWrite as Ht, RATE_CONTROL_RELAXED as I, MODEL_FORMATS as In, logChannelsCapability as It, addonWidgetsSourceCapability as J, makeSourceBrokerId as Jn, pickDetailCropConvention as Jt, VISIT_MERGE_GAP_MS as K, isSecretMarker as Kn, parseProcStatus as Kt, RATE_CONTROL_TIGHT as L, audioChunkBytesPerSample as Ln, mapAudioLabelToMacro as Lt, NodeBenchRunnerInputSchema as M, BaseAddon as Mn, isFirstLevelMacroClass as Mt, OpsLogEntrySchema as N, CAM_PROFILE_ORDER as Nn, linkedLabelStepId as Nt, LABEL_SUPPLY_MACRO as O, DeviceFeature as On, gbToBytes as Ot, PIPELINE_RAMP as P, CamProfileSchema as Pn, linkedStepOf as Pt, audioAnalysisCapability as Q, selectAssignedProfileSlots as Qn, rankStreams as Qt, RECORDING_EXPORT_MAX_READ_BYTES as R, createEvent as Rn, mayReadLocation as Rt, EVENT_OWNER_TYPES as S, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as Sn, evaluateZoneRules as St, ExportRecordSchema as T, evaluateSensorEdge as Tn, exportSubjectOf as Tt, RecordingSignalStatusSchema as U, hfModelUrl as Un, modelBindingKey as Ut, ROOT_SUPPLIABLE_STEP_IDS as V, defineRecordKinds as Vn, migrateLegacyDeviceSignalConfig as Vt, RingBuffer as W, hydrateSchema as Wn, motionDetectionCapability as Wt, applyModelBoundSettings as X, nodePin as Xn, pipelineExecutorCapability as Xt, allowedSuppliedEffect as Y, maskUrlCredentials as Yn, pickNativeLeaseOverride as Yt, armRemovalReconcile as Z, parseProfileBrokerId as Zn, pipelineRunnerCapability as Zt, DEFAULT_DETAIL_CROP_CONVENTION as _, stripRetiredBandPreBufferSec as _n, detectionPipelineCapability as _t, BackgroundRunRegistry as a, resolveEgressDecodeHwAccel as an, lazy as ar, clipExportFailure as at, DEVICE_BACKEND_TO_FORMAT as b, webrtcSessionCapability as bn, egressTransportFromRequest as bt, CLIP_STILL_REASON_CODE_HEADER as c, resolvePoolMemoryPolicy as cn, object as cr, containingParentIndex as ct, CLUSTER_MODEL_SCOPED_STEPS as d, rootSuppliesOf as dn, string as dr, declareLogChannel as dt, recordingCapability as en, userError as er, audioKindId as et, COCO_80_LABELS as f, runtimeDevices as fn, union as fr, defaultDeviceFor as ft, DEFAULT_CLUSTER_STEP_SETTINGS as g, streamBrokerCapability as gn, deriveRootFaceRefineRect as gt, DEFAULT_AUDIO_ANALYZER_CONFIG as h, storageOccupancyCapability as hn, deriveRecordingMode as ht, AUDIO_MACRO_LABELS as i, resolveCreateExportSubject as in, discriminatedUnion as ir, cameraStreamsCapability as it, NativeLeaseSettingsSchema as j, BOOT_RECOVERY_BACKOFF_MS as jn, inferModelProvider as jt, LABEL_SUPPLY_VOCABULARIES as k, DeviceType as kn, gifDeriveSpeed as kt, CLIP_STILL_REASON_HEADER as l, resolveRecordingProfiles as ln, preprocess as lr, createHwAccelCache as lt, CROP_SUPPLY_SOURCES as m, storageEvictableCapability as mn, deriveDetailCropRect as mt, APPLE_SA_TO_MACRO as n, recordingSignalCapability as nn, array as nr, buildBenchStepTree as nt, BatteryStatusSchema as o, resolveLocationMode as on, literal as or, clipExportFailureOf as ot, COCO_TO_MACRO as p, stepModelRunsOnFormat as pn, EventCategory as pr, deriveBatteryPresence as pt, YAMNET_TO_MACRO as q, makeProfileBrokerId as qn, pickClusterStepSettings as qt, AUDIO_BACKEND_CHOICES as r, resolveClusterStepModelId as rn, boolean as rr, cameraOwnsMotionViaSensor as rt, CLIP_BROKER_PACED_RATES as s, resolveModelBoundSetting as sn, number as sr, collectModelBoundKeys as st, APPEARANCE_BLOCKS as t, recordingExportCapability as tn, _enum as tr, batteryCapability as tt, CLIP_STREAM_TRANSPORT_HEADER as u, resolveRootSupply as un, record as ur, createLogChannelsProvider as ut, DEFAULT_EVENTS_BAND_BUFFER_SEC as v, supportedRuntimes as vn, deviceRemovalHookCapability as vt, EncodeProfileSchema as w, buildFfmpegArgs as wn, evictionPolicyOfLocation as wt, DEVICE_RAMP as x, AUDIO_PRESETS as xn, enumerateInferenceDevices as xt, DEFAULT_NATIVE_LEASE_SETTINGS as y, videoclipsCapability as yn, egressTranscodeSharingKey as yt, RECORDING_SOURCE_CAMSTACK as z, customAction as zn, mayWriteToLocation as zt };