@camstack/addon-provider-homeassistant 1.2.173 → 1.2.601

package/dist/{dist-DTt9hwTQ.js → dist-BXMUyWXo.js}

@@ -1,5 +1,5 @@
 require("node:crypto");
-//#region ../types/dist/event-category-C4hVnRo8.mjs
+//#region ../types/dist/event-category-BvOFi6PY.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -63,6 +63,24 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* consumes this category and maps it to the `addon-crash-loop` kind.
 	*/
 	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
+	/**
+	* A runner whose addon refused to start with a typed reason (D877) - parked
+	* in `refused`, never counted by the crash breaker, retried on operator
+	* action. One event per refusal.
+	*/
+	EventCategory["AddonRunnerRefused"] = "addon.runner-refused";
+	/**
+	* A runner settled on a state (D877): `running` (READY), `crashed`, `failed` or
+	* `refused`. In-process telemetry for the boot check (re-evaluate while any
+	* runner is still pending) and the alert centre (close a recovered runner).
+	*/
+	EventCategory["ProcessStateChanged"] = "process.state-changed";
+	/**
+	* The node's one-shot runner boot check (D877): planned runners against the
+	* process service, `degraded` when any is failed, refused or missing. The
+	* alert centre turns it into one alert and a direct critical push.
+	*/
+	EventCategory["SystemRunnerCheck"] = "system.runner-check";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -4105,6 +4123,12 @@ var numberProcessor = (schema, ctx, _json, _params) => {
 var booleanProcessor = (_schema, _ctx, json, _params) => {
 	json.type = "boolean";
 };
+var bigintProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("BigInt cannot be represented in JSON Schema");
+};
+var symbolProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Symbols cannot be represented in JSON Schema");
+};
 var nullProcessor = (_schema, ctx, json, _params) => {
 	if (ctx.target === "openapi-3.0") {
 		json.type = "string";
@@ -4112,12 +4136,17 @@ var nullProcessor = (_schema, ctx, json, _params) => {
 		json.enum = [null];
 	} else json.type = "null";
 };
+var undefinedProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Undefined cannot be represented in JSON Schema");
+};
 var voidProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Void cannot be represented in JSON Schema");
 };
 var neverProcessor = (_schema, _ctx, json, _params) => {
 	json.not = {};
 };
+var anyProcessor = (_schema, _ctx, _json, _params) => {};
+var unknownProcessor = (_schema, _ctx, _json, _params) => {};
 var dateProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Date cannot be represented in JSON Schema");
 };
@@ -4149,12 +4178,53 @@ var literalProcessor = (schema, ctx, json, _params) => {
 		json.enum = vals;
 	}
 };
+var nanProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("NaN cannot be represented in JSON Schema");
+};
+var templateLiteralProcessor = (schema, _ctx, json, _params) => {
+	const _json = json;
+	const pattern = schema._zod.pattern;
+	if (!pattern) throw new Error("Pattern not found in template literal");
+	_json.type = "string";
+	_json.pattern = pattern.source;
+};
+var fileProcessor = (schema, _ctx, json, _params) => {
+	const _json = json;
+	const file = {
+		type: "string",
+		format: "binary",
+		contentEncoding: "binary"
+	};
+	const { minimum, maximum, mime } = schema._zod.bag;
+	if (minimum !== void 0) file.minLength = minimum;
+	if (maximum !== void 0) file.maxLength = maximum;
+	if (mime) if (mime.length === 1) {
+		file.contentMediaType = mime[0];
+		Object.assign(_json, file);
+	} else {
+		Object.assign(_json, file);
+		_json.anyOf = mime.map((m) => ({ contentMediaType: m }));
+	}
+	else Object.assign(_json, file);
+};
+var successProcessor = (_schema, _ctx, json, _params) => {
+	json.type = "boolean";
+};
 var customProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Custom types cannot be represented in JSON Schema");
 };
+var functionProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Function types cannot be represented in JSON Schema");
+};
 var transformProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Transforms cannot be represented in JSON Schema");
 };
+var mapProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Map cannot be represented in JSON Schema");
+};
+var setProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Set cannot be represented in JSON Schema");
+};
 var arrayProcessor = (schema, ctx, _json, params) => {
 	const json = _json;
 	const def = schema._zod.def;
@@ -4359,6 +4429,12 @@ var readonlyProcessor = (schema, ctx, json, params) => {
 	seen.ref = def.innerType;
 	json.readOnly = true;
 };
+var promiseProcessor = (schema, ctx, _json, params) => {
+	const def = schema._zod.def;
+	process(def.innerType, ctx, params);
+	const seen = ctx.seen.get(schema);
+	seen.ref = def.innerType;
+};
 var optionalProcessor = (schema, ctx, _json, params) => {
 	const def = schema._zod.def;
 	process(def.innerType, ctx, params);
@@ -4371,6 +4447,81 @@ var lazyProcessor = (schema, ctx, _json, params) => {
 	const seen = ctx.seen.get(schema);
 	seen.ref = innerType;
 };
+var allProcessors = {
+	string: stringProcessor,
+	number: numberProcessor,
+	boolean: booleanProcessor,
+	bigint: bigintProcessor,
+	symbol: symbolProcessor,
+	null: nullProcessor,
+	undefined: undefinedProcessor,
+	void: voidProcessor,
+	never: neverProcessor,
+	any: anyProcessor,
+	unknown: unknownProcessor,
+	date: dateProcessor,
+	enum: enumProcessor,
+	literal: literalProcessor,
+	nan: nanProcessor,
+	template_literal: templateLiteralProcessor,
+	file: fileProcessor,
+	success: successProcessor,
+	custom: customProcessor,
+	function: functionProcessor,
+	transform: transformProcessor,
+	map: mapProcessor,
+	set: setProcessor,
+	array: arrayProcessor,
+	object: objectProcessor,
+	union: unionProcessor,
+	intersection: intersectionProcessor,
+	tuple: tupleProcessor,
+	record: recordProcessor,
+	nullable: nullableProcessor,
+	nonoptional: nonoptionalProcessor,
+	default: defaultProcessor,
+	prefault: prefaultProcessor,
+	catch: catchProcessor,
+	pipe: pipeProcessor,
+	readonly: readonlyProcessor,
+	promise: promiseProcessor,
+	optional: optionalProcessor,
+	lazy: lazyProcessor
+};
+function toJSONSchema(input, params) {
+	if ("_idmap" in input) {
+		const registry = input;
+		const ctx = initializeContext({
+			...params,
+			processors: allProcessors
+		});
+		const defs = {};
+		for (const entry of registry._idmap.entries()) {
+			const [_, schema] = entry;
+			process(schema, ctx);
+		}
+		const schemas = {};
+		ctx.external = {
+			registry,
+			uri: params?.uri,
+			defs
+		};
+		for (const entry of registry._idmap.entries()) {
+			const [key, schema] = entry;
+			extractDefs(ctx, schema);
+			schemas[key] = finalize(ctx, schema);
+		}
+		if (Object.keys(defs).length > 0) schemas.__shared = { [ctx.target === "draft-2020-12" ? "$defs" : "definitions"]: defs };
+		return { schemas };
+	}
+	const ctx = initializeContext({
+		...params,
+		processors: allProcessors
+	});
+	process(input, ctx);
+	extractDefs(ctx, input);
+	return finalize(ctx, input);
+}
 //#endregion
 //#region ../../node_modules/zod/v4/classic/iso.js
 var ZodISODateTime = /*@__PURE__*/ $constructor("ZodISODateTime", (inst, def) => {
@@ -5387,7 +5538,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-bwsTj221.mjs
+//#region ../types/dist/sleep-bZIhUvjd.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5504,7 +5655,7 @@ function isKeychainStoredField(field) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$2(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -5515,12 +5666,12 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$5(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 function isSecretClear(value) {
-	return isRecord$2(value) && value["$secretClear"] === true;
+	return isRecord$5(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -6130,7 +6281,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$1(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -6143,7 +6294,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$4(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -6198,7 +6349,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$4) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -6214,7 +6365,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$1(row)) {
+		if (!isRecord$4(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -6239,7 +6390,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$1(incoming)) {
+			if (!isRecord$4(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -6247,7 +6398,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$1(stored) ? stored : {};
+			const storedObj = isRecord$4(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -6370,7 +6521,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$1(v)) {
+		if (isRecord$4(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -6402,7 +6553,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -6431,7 +6582,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord(item) && isRecord(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$3(item) && isRecord$3(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -6442,7 +6593,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord(value) && isRecord(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$3(value) && isRecord$3(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -6450,7 +6601,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord(incoming) || !isRecord(stored)) return incoming;
+	if (!isRecord$3(incoming) || !isRecord$3(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -6481,7 +6632,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord(a) && isRecord(b)) {
+	if (isRecord$3(a) && isRecord$3(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -6505,7 +6656,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -7293,7 +7444,7 @@ var BaseAddon = class {
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
-			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
+			ctx.api.addons.restartAddon.mutate({ addonId }).then(() => {
 				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
@@ -7787,6 +7938,356 @@ var PeerBytesTicketSchema = object({
 	*/
 	declaredBytes: number().int().nonnegative().nullable()
 });
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_QUERY_MAX = 1e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+/** The keychain could not store or serve a value: explicit, never an empty string. */
+var RecordSecretUnavailableError = class extends RecordsError {
+	constructor(detail) {
+		super("secret-unavailable", detail);
+		this.name = "RecordSecretUnavailableError";
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
+function defOf(schema) {
+	const zodBag = Reflect.get(schema, "_zod");
+	if (typeof zodBag !== "object" || zodBag === null) return {};
+	const def = Reflect.get(zodBag, "def");
+	if (typeof def !== "object" || def === null) return {};
+	return def;
+}
+function declaredHere(schema) {
+	return globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const key = each ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+/**
+* Record kinds (D881): the declaration an addon makes of one kind of fact, the
+* Zod row schema that describes it, and the helper that turns the two into the
+* JSON the engine stores.
+*
+* A kind is declared ONCE, next to the code that owns it, and the engine's
+* reconciler creates its indexes - nothing creates DDL at runtime from a write.
+* Everything the generic machinery needs (secret fields, the entry descriptor)
+* is DERIVED from the Zod schema: `.meta({ secret: true })` marks a credential,
+* never a field name (D879).
+*/
+/** A JSON field path: `trackId`, `auth.accessToken`. Charset-restricted: it is rendered into DDL. */
+var RecordFieldPathSchema = string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}(\.[A-Za-z_][A-Za-z0-9_]{0,63}){0,3}$/);
+var RecordIndexSchema = object({
+	name: string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+	fields: array(RecordFieldPathSchema).min(1).max(4),
+	unique: boolean().optional()
+}).strict();
+var RecordRetentionSchema = union([
+	object({
+		ttlMs: number().int().positive(),
+		from: _enum(["at", "write"])
+	}).strict(),
+	object({
+		maxRows: number().int().positive().optional(),
+		maxRowsPerDevice: number().int().positive().optional()
+	}).strict().refine((r) => r.maxRows !== void 0 || r.maxRowsPerDevice !== void 0, { message: "name maxRows, maxRowsPerDevice or both" }),
+	object({
+		owner: string().min(1),
+		reason: string().min(1)
+	}).strict(),
+	object({ none: string().min(1) }).strict()
+]);
+/** The descriptor a generic entries UI reads (D881 "generic entries"). */
+var EntryDescriptorSchema = object({
+	title: string().min(1),
+	/** The record body field shown as the entry's name. */
+	nameField: string().min(1),
+	/** JSON Schema of the entry body; `secret: true` marks a password field. */
+	fields: record(string(), unknown())
+}).strict();
+/** What crosses the wire and sits in the engine's catalog: JSON only, no Zod. */
+var RecordKindDeclarationSchema = object({
+	database: _enum(RECORD_DATABASES).default("settings"),
+	class: _enum(RECORD_CLASSES),
+	writeTrigger: string().min(1),
+	device: _enum([
+		"required",
+		"optional",
+		"none"
+	]).default("none"),
+	at: _enum(["required", "none"]).default("none"),
+	indexes: array(RecordIndexSchema).max(8).default([]),
+	retention: RecordRetentionSchema,
+	deviceRemoval: _enum(["delete", "none"]).default("none"),
+	maxDataBytes: number().int().positive().max(RECORD_MAX_DATA_BYTES).default(RECORD_DEFAULT_MAX_DATA_BYTES),
+	/** Derived from the Zod schema; never written by hand. */
+	secretPaths: array(string().min(1)).default([]),
+	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
+	secretArrayKeys: record(string(), string()).default({}),
+	/** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+	adoptsFrom: string().min(1).optional(),
+	/** Kinds that must agree through `transact` sit in one file under one family name. */
+	transactFamily: string().min(1).optional(),
+	entry: EntryDescriptorSchema.optional()
+}).strict();
+/** The kind names: lower-case, dash separated, short enough for an index name. */
+var RecordKindNameSchema = string().regex(/^[a-z][a-z0-9-]{0,47}$/);
+/** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
+function assertValidDeclaration(name, decl) {
+	const refuse = (why) => {
+		throw new DeclarationRefusedError(`kind "${name}": ${why}`);
+	};
+	if (!RecordKindNameSchema.safeParse(name).success) refuse("the name must be lower-case-dashed");
+	const seen = /* @__PURE__ */ new Set();
+	for (const index of decl.indexes) {
+		if (seen.has(index.name)) refuse(`index name "${index.name}" is declared twice`);
+		seen.add(index.name);
+	}
+	const { retention } = decl;
+	const hasSecrets = decl.secretPaths.length > 0;
+	if ("ttlMs" in retention) {
+		if (retention.from === "at" && decl.at !== "required") refuse("a ttl from \"at\" needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use engine TTL (its keychain values would be orphaned)");
+	}
+	if ("maxRows" in retention || "maxRowsPerDevice" in retention) {
+		if (retention.maxRowsPerDevice !== void 0 && decl.device !== "required") refuse("maxRowsPerDevice needs device: \"required\"");
+		if (decl.at !== "required") refuse("a row bound trims the oldest \"at\": it needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use an engine row bound");
+		const bound = Math.max(retention.maxRows ?? 0, retention.maxRowsPerDevice ?? 0);
+		if (decl.database === "settings" && bound > 5e4) refuse(`a row bound above ${RECORD_SETTINGS_MAX_ROWS} belongs in database: "events" (a big delete on the settings thread stalls every configuration read)`);
+	}
+	if (decl.deviceRemoval === "delete" && decl.device === "none") refuse("deviceRemoval: \"delete\" needs a device: \"required\" or \"optional\"");
+	for (const path of decl.secretPaths) for (const prefix of secretArrayPrefixes(path)) if (decl.secretArrayKeys[prefix] === void 0) refuse(`secret path "${path}" crosses the array "${prefix}": declare its id key in secretArrayKeys`);
+}
+function bodyFieldsOf(schema) {
+	return { ...toJSONSchema(schema, {
+		unrepresentable: "any",
+		io: "input"
+	}) };
+}
+function isRecordLike(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Does every branch of the body schema carry `field`? (A discriminated union has several.) */
+function hasNameField(json, field) {
+	const branches = json["oneOf"] ?? json["anyOf"];
+	if (Array.isArray(branches)) return branches.length > 0 && branches.every((b) => isRecordLike(b) && hasNameField(b, field));
+	const properties = json["properties"];
+	return isRecordLike(properties) && Object.prototype.hasOwnProperty.call(properties, field);
+}
+/**
+* Declare the kinds of a package. The keys are the kind names. The result is
+* what `ctx.records.declare` sends to the engine and what `ctx.records.kind`
+* types its handle from.
+*/
+function defineRecordKinds(specs) {
+	const out = {};
+	for (const [name, spec] of Object.entries(specs)) {
+		const secretPaths = collectZodSecretPaths(spec.schema);
+		const nameField = spec.entry?.nameField ?? "name";
+		const fields = bodyFieldsOf(spec.schema);
+		if (spec.entry !== void 0 && !hasNameField(fields, nameField)) throw new DeclarationRefusedError(`kind "${name}": an entry kind's schema needs a "${nameField}" field`);
+		const parsed = RecordKindDeclarationSchema.parse({
+			database: spec.database,
+			class: spec.class,
+			writeTrigger: spec.writeTrigger,
+			device: spec.device,
+			at: spec.at,
+			indexes: spec.indexes === void 0 ? void 0 : [...spec.indexes],
+			retention: spec.retention,
+			deviceRemoval: spec.deviceRemoval,
+			maxDataBytes: spec.maxDataBytes,
+			secretPaths: [...secretPaths],
+			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
+			adoptsFrom: spec.adoptsFrom,
+			transactFamily: spec.transactFamily,
+			entry: spec.entry === void 0 ? void 0 : {
+				title: spec.entry.title,
+				nameField,
+				fields
+			}
+		});
+		assertValidDeclaration(name, parsed);
+		out[name] = {
+			name,
+			schema: spec.schema,
+			declaration: parsed
+		};
+	}
+	return out;
+}
+/**
+* Entry kinds (D881): every list of user-created entries (notification
+* targets, brokers, LLM profiles) is ONE record kind with an id, a name and a
+* kind-specific body, and the admin UI lists/adds/edits/deletes all of them
+* through the `record-entries` capability with password fields derived from
+* the schema (`.meta({ secret: true })`).
+*/
+/** The body of a plain entry: a name and the fields the kind adds. */
+function entryBody(shape) {
+	return object({
+		name: string().min(1),
+		...shape
+	});
+}
+/**
+* Declare one entry kind. An entry is configuration: never trimmed by the
+* engine, never aged, belonging to no device.
+*/
+function defineEntryKind(name, spec) {
+	const defined = defineRecordKinds({ [name]: {
+		schema: spec.schema,
+		class: "config",
+		writeTrigger: spec.writeTrigger ?? "an operator adds or edits an entry in the entries UI",
+		retention: { none: "an entry goes only when the operator deletes it" },
+		...spec.database === void 0 ? {} : { database: spec.database },
+		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
+		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
+		...spec.adoptsFrom === void 0 ? {} : { adoptsFrom: spec.adoptsFrom },
+		entry: {
+			title: spec.title,
+			...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
+		}
+	} })[name];
+	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
+	return defined;
+}
+/**
+* Legacy source for broker entry adoption (B2): brokers live in addon-settings
+* as one row `<addonId>.brokers` whose value is an array until records-adopt
+* copies them into the entry kind.
+*/
+var SETTINGS_BROKERS_ADOPTS_PREFIX = "@settings-brokers/";
+/** The `adoptsFrom` value for an addon's broker entry kind. */
+function settingsBrokersAdoptsFrom(addonId) {
+	return `${SETTINGS_BROKERS_ADOPTS_PREFIX}${addonId}`;
+}
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = _enum([
 	"high",
@@ -8310,69 +8811,6 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
-function defOf(schema) {
-	return schema._zod?.def ?? {};
-}
-function declaredHere(schema) {
-	return globalRegistry.get(schema)?.secret === true;
-}
-/** Wrapper kinds whose `innerType` is the field itself. */
-var WRAPPERS = new Set([
-	"optional",
-	"nullable",
-	"default",
-	"prefault",
-	"catch",
-	"readonly",
-	"nonoptional"
-]);
-/**
-* The schema layers that make up ONE field: the schema itself and every
-* wrapper below it (optional / default / nullable / readonly / catch), plus
-* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
-* `.transform` on `in`).
-*/
-function layersOf(schema) {
-	const out = [];
-	const queue = [schema];
-	while (queue.length > 0) {
-		const s = queue.shift();
-		if (!s || out.includes(s)) continue;
-		out.push(s);
-		const def = defOf(s);
-		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
-		if (def.type === "pipe") {
-			if (def.in) queue.push(def.in);
-			if (def.out) queue.push(def.out);
-		}
-	}
-	return out;
-}
-/** True when any layer of this field declares `.meta({ secret: true })`. */
-function isZodSecret(schema) {
-	return layersOf(schema).some(declaredHere);
-}
-/**
-* Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
-* object or array is reported as one path and not descended into — everything
-* under it is secret.
-*/
-function collectZodSecretPaths(schema, prefix = "") {
-	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
-	const paths = [];
-	for (const layer of layersOf(schema)) {
-		const def = defOf(layer);
-		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
-		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
-		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
-		else if (def.type === "intersection") {
-			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
-			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
-		}
-	}
-	return [...new Set(paths)];
-}
 object({
 	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
 	params: record(string(), union([string(), number()])).optional()
@@ -15879,6 +16317,41 @@ var ComposableCapabilitiesSchema = object({ caps: array(object({
 		keyField: string()
 	}).optional()
 })) });
+/**
+* The report of a one-shot "move this owner's plaintext secrets into the
+* keychain" run (D878). COUNTS only - never a value, never a ref.
+*
+* The owner runs it on its own rows, through its own write path; an operator
+* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
+* Dry run (`apply: false`) reports what WOULD move and changes nothing.
+*/
+var RawSecretMigrationInputSchema = object({ 
+/** `false` (the default of the script) = report only. */
+apply: boolean() });
+var RawSecretMigrationReportSchema = object({
+	apply: boolean(),
+	/** Rows that can carry a secret (a profile, an enrolment). */
+	rows: number().int(),
+	/** Rows whose secret was plaintext when the run started. */
+	raw: number().int(),
+	/** Rows that already held a keychain marker when the run started. */
+	markers: number().int(),
+	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
+	migrated: number().int(),
+	/** Plaintext rows left in place because the move or its read-back failed. */
+	failed: number().int(),
+	/** After the run: rows still holding plaintext. */
+	remainingRaw: number().int(),
+	/** After the run: markers the keychain could not resolve right now. */
+	unresolvedMarkers: number().int(),
+	/**
+	* A second, redundant copy of the secrets' rows that the run found (and, on
+	* `apply`, deleted after verifying the first). Owners with a single copy omit it.
+	*/
+	redundantCopies: number().int().optional(),
+	/** True when nothing is raw and every marker resolves. */
+	verified: boolean()
+});
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
@@ -16105,6 +16578,9 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), SettingsUpdateResultSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({}), object({ libs: array(object({
 	filePath: string(),
 	content: string()
@@ -16367,6 +16843,222 @@ id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* records - an addon's own facts and documents (D881): ledgers, audit rows,
+* config documents, mirrors. The third storage API next to `ctx.settings`
+* (operator intent, D870) and device-history (numbers over time, D850).
+*
+* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
+* crossed a process and stated by a hub in-process caller (`ctx.records` does
+* that with the addon id closed over). It is deliberately NOT in any input
+* schema, so a session can never supply it, and a call with no stamp is refused
+* `records/no-caller`. A kind is readable and writable only by its owner; other
+* addons go through the owner's capability.
+*
+* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
+* never `[]`. Secret fields are never on the wire: a read shows the
+* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
+* resolves itself, and a write may carry only a keychain marker bound to the
+* row's own ref.
+*
+* Internal: addons reach it through `ctx.records`, never directly.
+*/
+var RecordIdSchema = string().min(1).max(256);
+/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
+var RecordBodySchema = record(string(), unknown());
+var RecordInputSchema = object({
+	id: RecordIdSchema,
+	/** The device this row belongs to (D865 removal, per-device reads). */
+	deviceId: number().int().optional(),
+	/** The domain clock, ms: observed / created / opened. */
+	at: number().int().optional(),
+	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
+	expiresAt: number().int().optional(),
+	data: RecordBodySchema
+});
+var RecordViewSchema = object({
+	id: string(),
+	deviceId: number().int().nullable(),
+	at: number().nullable(),
+	expiresAt: number().nullable(),
+	rev: number().int(),
+	updatedAt: number(),
+	data: RecordBodySchema
+});
+/** Declared index fields only. Anything else does not compile, by design. */
+var RecordWhereSchema = record(RecordFieldPathSchema, union([
+	string(),
+	number(),
+	boolean(),
+	object({ in: array(union([
+		string(),
+		number(),
+		boolean()
+	])).min(1).max(RECORD_BATCH_MAX) }),
+	object({
+		gt: union([string(), number()]).optional(),
+		gte: union([string(), number()]).optional(),
+		lt: union([string(), number()]).optional(),
+		lte: union([string(), number()]).optional()
+	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
+]));
+var KindShape = { kind: RecordKindNameSchema };
+var TimeWindowShape = {
+	deviceId: number().int().optional(),
+	atFrom: number().optional(),
+	atTo: number().optional()
+};
+var RecordQueryInputSchema = object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional(),
+	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
+	order: _enum(["at", "id"]).optional(),
+	desc: boolean().optional(),
+	limit: number().int().min(1).max(RECORD_QUERY_MAX).default(100),
+	/** Opaque keyset cursor from a previous answer. There is no offset. */
+	cursor: string().min(1).optional()
+});
+var RecordQueryResultSchema = object({
+	records: array(RecordViewSchema),
+	nextCursor: string().nullable()
+});
+var RecordKindStateSchema = _enum([
+	"created",
+	"unchanged",
+	"updated"
+]);
+var DeclareKindResultSchema = object({
+	kindId: number().int(),
+	state: RecordKindStateSchema,
+	createdIndexes: array(string()),
+	/** The boot guard: the kind is empty while its legacy table still holds rows. */
+	adoptionPending: object({
+		legacyTable: string(),
+		legacyRows: number().int()
+	}).nullable()
+});
+/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
+var SecretRefsList = array(string());
+var RecordSecretRefsSchema = record(string(), record(string(), string()));
+method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string(), DeclareKindResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), array(RecordViewSchema), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	record: RecordInputSchema,
+	/** Compare-and-set. `0` means "the row must not exist". */
+	ifRev: number().int().min(0).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	count: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema,
+	data: RecordBodySchema,
+	at: number().int().nullable().optional(),
+	expiresAt: number().int().nullable().optional(),
+	ifRev: number().int().min(1).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), object({
+	deleted: boolean(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional()
+}), object({ count: number().int() }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	from: number(),
+	to: number(),
+	bucketMs: number().int().positive()
+}), object({ buckets: array(object({
+	bucketStart: number(),
+	count: number().int()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	op: _enum([
+		"sum",
+		"min",
+		"max",
+		"count"
+	]),
+	field: RecordFieldPathSchema.optional(),
+	groupBy: RecordFieldPathSchema.optional(),
+	where: RecordWhereSchema.optional()
+}), object({ rows: array(object({
+	group: union([
+		string(),
+		number(),
+		_null()
+	]),
+	value: number().nullable()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	atBefore: number().optional(),
+	where: RecordWhereSchema.optional()
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	kinds: array(RecordKindNameSchema).optional()
+}), object({
+	deleted: record(string(), number().int()),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object(KindShape), object({ id: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+});
 /** One table of the settings database. */
 var StorageTableSchema = object({
 	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
@@ -16379,6 +17071,28 @@ var StorageTableSchema = object({
 	/** Declared by an addon since this engine process started (a running addon claims it). */
 	declaredThisBoot: boolean()
 });
+/** One declared record kind (D881) as System -> Data shows it. */
+var StorageKindSchema = object({
+	owner: string(),
+	kind: string(),
+	database: _enum(["settings", "events"]),
+	class: string(),
+	state: _enum([
+		"declared",
+		"orphaned",
+		"dropped"
+	]),
+	/** `null` when the caller asked for no counts (`counts: false`). */
+	rows: number().int().nonnegative().nullable(),
+	/** Rows x the average size of a sample; null for an empty kind. */
+	bytesEstimate: number().int().nonnegative().nullable(),
+	writeTrigger: string(),
+	retention: RecordRetentionSchema,
+	/** `true` when the kind is an entry kind (the generic entries UI lists it). */
+	entry: boolean(),
+	/** The whole declaration, secret paths and entry descriptor included (the entries service builds its handle from it). */
+	declaration: RecordKindDeclarationSchema
+});
 method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: array(StorageTableSchema) }), { auth: "admin" }), method(object({
 	collection: string().min(1),
 	expectRows: number().int().nonnegative()
@@ -16388,6 +17102,87 @@ method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: arr
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	owner: string().min(1).optional(),
+	/** `false` skips the per-kind row count (a catalog read only). Default true. */
+	counts: boolean().optional()
+}), object({ kinds: array(StorageKindSchema) }), { auth: "admin" }), method(RecordQueryInputSchema.extend({
+	owner: string().min(1),
+	kind: RecordKindNameSchema
+}), RecordQueryResultSchema, { auth: "admin" }), method(object({
+	owner: string().min(1),
+	kind: RecordKindNameSchema,
+	records: array(RecordInputSchema).max(RECORD_BATCH_MAX),
+	/** The LAST batch: the copy is complete, the boot guard stops asking. */
+	complete: boolean().optional()
+}).refine((input) => input.records.length > 0 || input.complete === true, { message: "records must be non-empty unless complete is true" }), object({ adopted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	collection: string().min(1),
+	cursor: string().optional(),
+	limit: number().int().min(1).max(1e3).optional()
+}), object({
+	rows: array(object({
+		id: string(),
+		data: record(string(), unknown())
+	})),
+	nextCursor: string().nullable()
+}), { auth: "admin" }), method(object({ collection: string().min(1) }), object({ adopted: boolean() }), { auth: "admin" });
+/**
+* record-entries - the ONE admin surface for every list of user-created entries
+* (D881): notification targets, brokers, LLM profiles, anything an addon
+* declares as an ENTRY kind (`entry: { title }` in `defineRecordKinds`).
+*
+* The UI is generic. `listEntryKinds` hands it, per kind, the JSON Schema of
+* the entry body with `secret: true` on every credential field, so a password
+* field is derived from the schema and never from a name. `putEntry` takes the
+* redaction token for an untouched secret (the stored value is kept), a string
+* for a new one, and the clear instruction to remove one. A read never carries
+* a secret value, and a locked keychain refuses the write with
+* `records/secret-unavailable` instead of storing plaintext.
+*
+* Hub-only, served in-process (it acts for each entry's owner on the keychain).
+*/
+var EntryKindInfoSchema = object({
+	owner: string(),
+	kind: RecordKindNameSchema,
+	title: string(),
+	nameField: string(),
+	/** JSON Schema of the body; `secret: true` marks a password field. */
+	fields: record(string(), unknown()),
+	secretPaths: array(string()),
+	rows: number().int().nonnegative()
+});
+var EntryViewSchema = object({
+	id: RecordIdSchema,
+	name: string(),
+	rev: number().int(),
+	updatedAt: number(),
+	/** Secret fields hold the redaction token. */
+	data: RecordBodySchema
+});
+var EntryAddress = {
+	owner: string().min(1),
+	kind: RecordKindNameSchema
+};
+method(object({}), object({ kinds: array(EntryKindInfoSchema) }), { auth: "admin" }), method(object({ ...EntryAddress }), object({ entries: array(EntryViewSchema) }), { auth: "admin" }), method(object({
+	...EntryAddress,
+	id: RecordIdSchema.optional(),
+	data: RecordBodySchema,
+	ifRev: number().int().min(1).optional()
+}), object({
+	id: string(),
+	rev: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...EntryAddress,
+	id: RecordIdSchema
+}), object({ deleted: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 });
 /**
 * `keychain` — the hub's encrypted store of secret values (D787).
@@ -39835,6 +40630,9 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, {
 }), _void(), { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(ProfileRefInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -50382,6 +51180,41 @@ var ServerRollbackInfoSchema = object({
 	atMs: number(),
 	reason: string()
 });
+/**
+* The runner boot check (D877): the runners this node PLANNED (hub: one per
+* `resolveRunnerId` over its forked addons; agent: the runners its process
+* service holds, because only the hub plans) against the states the process
+* service reports. Kept in memory, recomputed by the same one-shot check after
+* every boot, served on `getServerPackageStatus`.
+*
+* `failed` is the D6 breaker's terminal state, `refused` a deterministic Init
+* refusal (an addon that said "I will not start, and here is why"), `missing` a
+* planned runner the process service has no entry for.
+*/
+var RunnerRefusalSchema = object({
+	runnerId: string(),
+	addonIds: array(string()),
+	reason: string()
+});
+var RunnerBootCheckSchema = object({
+	checkedAtMs: number(),
+	/** Runners planned for this node. */
+	expected: number(),
+	/** Planned runners whose process is `running`. */
+	running: number(),
+	failed: array(string()),
+	refused: array(RunnerRefusalSchema),
+	missing: array(string()),
+	/**
+	* Runners still on their way: `starting`, or `crashed` waiting on a backoff
+	* respawn. The check is FINAL only when this is empty; until then nothing is
+	* pushed and the verdict is re-evaluated on the next runner state change.
+	* Optional for version skew (absent = settled).
+	*/
+	pending: array(string()).optional(),
+	/** True when the plan is the hub's (`missing` is then meaningful); false on an agent. */
+	planKnown: boolean()
+});
 var ServerPackageStatusSchema = object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: string(),
@@ -50444,7 +51277,14 @@ var ServerPackageStatusSchema = object({
 	* for version skew: an older provider's payload simply omits it, and an
 	* absent wrapper is unknown — never `native`.
 	*/
-	wrapper: WrapperIdentitySchema.optional()
+	wrapper: WrapperIdentitySchema.optional(),
+	/**
+	* What this node PLANNED to run against what its process service reports
+	* (D877). Absent until the one-shot boot check has run (~60 s after boot) and
+	* on a provider that predates it. Absent is "not checked yet", never "all
+	* well": a consumer that needs the answer treats it as pending.
+	*/
+	runners: RunnerBootCheckSchema.optional()
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),
@@ -50495,6 +51335,13 @@ var ServerUpdateOutcomeSchema = _enum([
 	"refused",
 	"failed"
 ]);
+/** One addon the pre-flight found the target version would refuse (D877). */
+var UpdateBlockerSchema = object({
+	addonId: string(),
+	reason: string(),
+	/** What the operator does about it. */
+	remedy: string()
+});
 var ServerUpdateActionResultSchema = object({
 	accepted: boolean(),
 	targetVersion: string().nullable(),
@@ -50512,14 +51359,27 @@ var ServerUpdateActionResultSchema = object({
 	* The failure itself, verbatim enough to act on (the npm output for a
 	* staging install). Non-null only for `failed`.
 	*/
-	error: string().nullable().optional()
+	error: string().nullable().optional(),
+	/**
+	* The addons the target version would refuse to start on this node's live
+	* store (D877), present when the pre-flight refused the update
+	* (`reason: 'addon-would-refuse'`). Optional for version skew.
+	*/
+	blockers: array(UpdateBlockerSchema).optional()
 });
 method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), ServerUpdateCheckResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ 
-/** Explicit target version; omitted = latest from the registry. */
-version: string().optional() }), ServerUpdateActionResultSchema, {
+}), method(object({
+	/** Explicit target version; omitted = latest from the registry. */
+	version: string().optional(),
+	/**
+	* Apply even though the pre-flight (D877) found addons the target would
+	* refuse to start. Off by default: those addons stay down until the
+	* remedy is run, which is the incident this gate exists to prevent.
+	*/
+	acknowledgeRefusals: boolean().optional()
+}), ServerUpdateActionResultSchema, {
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 16 * 6e4
@@ -53037,7 +53897,9 @@ var ManifestShapeSchema = object({
 var AddonProcessSchema = object({
 	pid: number().optional(),
 	mode: string(),
-	state: string()
+	state: string(),
+	/** Why the runner is `refused` (an addon's own words), when it is (D877). */
+	reason: string().optional()
 });
 /**
 * Per-addon health snapshot from the kernel's AddonHealthMonitor.
@@ -63803,7 +64665,11 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
-}), method(object({ userId: string() }), TotpStatusSchema, { auth: "admin" }), method(object({
+}), method(object({ userId: string() }), TotpStatusSchema, { auth: "admin" }), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
+}), method(object({
 	userId: string(),
 	code: string()
 }), object({ valid: boolean() }), {
@@ -65615,13 +66481,14 @@ var BaseDevice = class {
 	get state() {
 		if (!this._stateProxyCache) {
 			const cache = {};
-			const handler = { get: (_target, key) => {
+			const handler = { get: (target, key) => {
 				const k = key;
-				if (k in cache) return cache[k];
+				const existing = Reflect.get(target, k);
+				if (existing !== void 0) return existing;
 				const cap = DEVICE_LOCAL_STATE_CAPS[k];
 				if (!cap) return void 0;
 				const proxy = this.sliceProxy(cap);
-				cache[k] = proxy;
+				Reflect.set(target, k, proxy);
 				return proxy;
 			} };
 			this._stateProxyCache = new Proxy(cache, handler);
@@ -65820,7 +66687,7 @@ var BaseDevice = class {
 	async updateSourceInfo(patch) {
 		const next = mergeSourceInfo(this.sourceInfo, patch);
 		this._sourceInfoCache = Object.freeze({ ...next });
-		const action = this.ctx.api?.deviceManager?.setMetadata;
+		const action = this.ctx.api.deviceManager?.setMetadata;
 		if (action) try {
 			await action.mutate({
 				deviceId: this.id,
@@ -65855,7 +66722,7 @@ var BaseDevice = class {
 	* device boot on a meta refresh.
 	*/
 	async refreshFeatures() {
-		const action = this.ctx.api?.deviceManager?.registerDevice;
+		const action = this.ctx.api.deviceManager?.registerDevice;
 		if (!action) return;
 		try {
 			await action.mutate({
@@ -67929,6 +68796,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.migrateRawSecrets": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -69789,6 +70662,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"llm.migrateRawSecrets": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -72675,6 +73554,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recordEntries.deleteEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"recordEntries.listEntries": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.listEntryKinds": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.putEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.getAvailability": {
 		capName: "recording",
 		capScope: "device",
@@ -72975,6 +73878,102 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"records.aggregate": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.allocateId": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.count": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.declareKinds": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.delete": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteDevice": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteWhere": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.get": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.getMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.histogram": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.patch": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.put": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.putMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.query": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.secretRefs": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.captureReference": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -73407,18 +74406,48 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageAdmin.adoptRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"storageAdmin.dropCollection": {
 		capName: "storage-admin",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"storageAdmin.isAdoptedLegacyTable": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.listKinds": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageAdmin.listTables": {
 		capName: "storage-admin",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"storageAdmin.readLegacyCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.readRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -74331,6 +75360,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.migrateRawSecrets": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.oauthExchangeCode": {
 		capName: "user-management",
 		capScope: "system",
@@ -77007,6 +78042,37 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"records.count": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.deleteDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"records.deleteWhere": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.histogram": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.putMany": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"records.query": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"sceneMonitor.captureReference": [{
 		name: "deviceId",
 		form: "single",
@@ -77123,6 +78189,17 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"storageAdmin.adoptRecords": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"storageAdmin.readRecords": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"streamBroker.acquireEgressTranscode": [{
 		name: "deviceId",
 		form: "single",
@@ -78922,6 +79999,12 @@ Object.defineProperty(exports, "MediaPlayerRepeatSchema", {
 		return MediaPlayerRepeatSchema;
 	}
 });
+Object.defineProperty(exports, "RecordSecretUnavailableError", {
+	enumerable: true,
+	get: function() {
+		return RecordSecretUnavailableError;
+	}
+});
 Object.defineProperty(exports, "TargetSchema", {
 	enumerable: true,
 	get: function() {
@@ -79084,6 +80167,18 @@ Object.defineProperty(exports, "createEvent", {
 		return createEvent;
 	}
 });
+Object.defineProperty(exports, "defineEntryKind", {
+	enumerable: true,
+	get: function() {
+		return defineEntryKind;
+	}
+});
+Object.defineProperty(exports, "defineRecordKinds", {
+	enumerable: true,
+	get: function() {
+		return defineRecordKinds;
+	}
+});
 Object.defineProperty(exports, "deviceAdminLinkCapability", {
 	enumerable: true,
 	get: function() {
@@ -79108,6 +80203,12 @@ Object.defineProperty(exports, "discriminatedUnion", {
 		return discriminatedUnion;
 	}
 });
+Object.defineProperty(exports, "entryBody", {
+	enumerable: true,
+	get: function() {
+		return entryBody;
+	}
+});
 Object.defineProperty(exports, "enumSensorCapability", {
 	enumerable: true,
 	get: function() {
@@ -79282,6 +80383,12 @@ Object.defineProperty(exports, "scriptRunnerCapability", {
 		return scriptRunnerCapability;
 	}
 });
+Object.defineProperty(exports, "settingsBrokersAdoptsFrom", {
+	enumerable: true,
+	get: function() {
+		return settingsBrokersAdoptsFrom;
+	}
+});
 Object.defineProperty(exports, "smokeCapability", {
 	enumerable: true,
 	get: function() {