@camstack/addon-training 0.1.54 → 0.1.56

package/dist/{dist-91Rnxphf.mjs → dist-DnFIVL4Y.js}

@@ -1,4 +1,37 @@
-import "node:crypto";
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+require("node:crypto");
 //#region ../types/dist/event-category-BvOFi6PY.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -4123,6 +4156,12 @@ var numberProcessor = (schema, ctx, _json, _params) => {
 var booleanProcessor = (_schema, _ctx, json, _params) => {
 	json.type = "boolean";
 };
+var bigintProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("BigInt cannot be represented in JSON Schema");
+};
+var symbolProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Symbols cannot be represented in JSON Schema");
+};
 var nullProcessor = (_schema, ctx, json, _params) => {
 	if (ctx.target === "openapi-3.0") {
 		json.type = "string";
@@ -4130,12 +4169,17 @@ var nullProcessor = (_schema, ctx, json, _params) => {
 		json.enum = [null];
 	} else json.type = "null";
 };
+var undefinedProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Undefined cannot be represented in JSON Schema");
+};
 var voidProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Void cannot be represented in JSON Schema");
 };
 var neverProcessor = (_schema, _ctx, json, _params) => {
 	json.not = {};
 };
+var anyProcessor = (_schema, _ctx, _json, _params) => {};
+var unknownProcessor = (_schema, _ctx, _json, _params) => {};
 var dateProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Date cannot be represented in JSON Schema");
 };
@@ -4167,12 +4211,53 @@ var literalProcessor = (schema, ctx, json, _params) => {
 		json.enum = vals;
 	}
 };
+var nanProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("NaN cannot be represented in JSON Schema");
+};
+var templateLiteralProcessor = (schema, _ctx, json, _params) => {
+	const _json = json;
+	const pattern = schema._zod.pattern;
+	if (!pattern) throw new Error("Pattern not found in template literal");
+	_json.type = "string";
+	_json.pattern = pattern.source;
+};
+var fileProcessor = (schema, _ctx, json, _params) => {
+	const _json = json;
+	const file = {
+		type: "string",
+		format: "binary",
+		contentEncoding: "binary"
+	};
+	const { minimum, maximum, mime } = schema._zod.bag;
+	if (minimum !== void 0) file.minLength = minimum;
+	if (maximum !== void 0) file.maxLength = maximum;
+	if (mime) if (mime.length === 1) {
+		file.contentMediaType = mime[0];
+		Object.assign(_json, file);
+	} else {
+		Object.assign(_json, file);
+		_json.anyOf = mime.map((m) => ({ contentMediaType: m }));
+	}
+	else Object.assign(_json, file);
+};
+var successProcessor = (_schema, _ctx, json, _params) => {
+	json.type = "boolean";
+};
 var customProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Custom types cannot be represented in JSON Schema");
 };
+var functionProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Function types cannot be represented in JSON Schema");
+};
 var transformProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Transforms cannot be represented in JSON Schema");
 };
+var mapProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Map cannot be represented in JSON Schema");
+};
+var setProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Set cannot be represented in JSON Schema");
+};
 var arrayProcessor = (schema, ctx, _json, params) => {
 	const json = _json;
 	const def = schema._zod.def;
@@ -4377,6 +4462,12 @@ var readonlyProcessor = (schema, ctx, json, params) => {
 	seen.ref = def.innerType;
 	json.readOnly = true;
 };
+var promiseProcessor = (schema, ctx, _json, params) => {
+	const def = schema._zod.def;
+	process(def.innerType, ctx, params);
+	const seen = ctx.seen.get(schema);
+	seen.ref = def.innerType;
+};
 var optionalProcessor = (schema, ctx, _json, params) => {
 	const def = schema._zod.def;
 	process(def.innerType, ctx, params);
@@ -4389,6 +4480,81 @@ var lazyProcessor = (schema, ctx, _json, params) => {
 	const seen = ctx.seen.get(schema);
 	seen.ref = innerType;
 };
+var allProcessors = {
+	string: stringProcessor,
+	number: numberProcessor,
+	boolean: booleanProcessor,
+	bigint: bigintProcessor,
+	symbol: symbolProcessor,
+	null: nullProcessor,
+	undefined: undefinedProcessor,
+	void: voidProcessor,
+	never: neverProcessor,
+	any: anyProcessor,
+	unknown: unknownProcessor,
+	date: dateProcessor,
+	enum: enumProcessor,
+	literal: literalProcessor,
+	nan: nanProcessor,
+	template_literal: templateLiteralProcessor,
+	file: fileProcessor,
+	success: successProcessor,
+	custom: customProcessor,
+	function: functionProcessor,
+	transform: transformProcessor,
+	map: mapProcessor,
+	set: setProcessor,
+	array: arrayProcessor,
+	object: objectProcessor,
+	union: unionProcessor,
+	intersection: intersectionProcessor,
+	tuple: tupleProcessor,
+	record: recordProcessor,
+	nullable: nullableProcessor,
+	nonoptional: nonoptionalProcessor,
+	default: defaultProcessor,
+	prefault: prefaultProcessor,
+	catch: catchProcessor,
+	pipe: pipeProcessor,
+	readonly: readonlyProcessor,
+	promise: promiseProcessor,
+	optional: optionalProcessor,
+	lazy: lazyProcessor
+};
+function toJSONSchema(input, params) {
+	if ("_idmap" in input) {
+		const registry = input;
+		const ctx = initializeContext({
+			...params,
+			processors: allProcessors
+		});
+		const defs = {};
+		for (const entry of registry._idmap.entries()) {
+			const [_, schema] = entry;
+			process(schema, ctx);
+		}
+		const schemas = {};
+		ctx.external = {
+			registry,
+			uri: params?.uri,
+			defs
+		};
+		for (const entry of registry._idmap.entries()) {
+			const [key, schema] = entry;
+			extractDefs(ctx, schema);
+			schemas[key] = finalize(ctx, schema);
+		}
+		if (Object.keys(defs).length > 0) schemas.__shared = { [ctx.target === "draft-2020-12" ? "$defs" : "definitions"]: defs };
+		return { schemas };
+	}
+	const ctx = initializeContext({
+		...params,
+		processors: allProcessors
+	});
+	process(input, ctx);
+	extractDefs(ctx, input);
+	return finalize(ctx, input);
+}
 //#endregion
 //#region ../../node_modules/zod/v4/classic/iso.js
 var ZodISODateTime = /*@__PURE__*/ $constructor("ZodISODateTime", (inst, def) => {
@@ -5405,7 +5571,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-WsrozGDL.mjs
+//#region ../types/dist/sleep-bZIhUvjd.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5522,7 +5688,7 @@ function isKeychainStoredField(field) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$4(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -5533,12 +5699,12 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$4(value)) return false;
+	if (!isRecord$5(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 function isSecretClear(value) {
-	return isRecord$4(value) && value["$secretClear"] === true;
+	return isRecord$5(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -6148,7 +6314,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$3(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -6161,7 +6327,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$3(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$4(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -6216,7 +6382,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$3) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$4) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -6232,7 +6398,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$3(row)) {
+		if (!isRecord$4(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -6257,7 +6423,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$3(incoming)) {
+			if (!isRecord$4(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -6265,7 +6431,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$3(stored) ? stored : {};
+			const storedObj = isRecord$4(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -6388,7 +6554,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$3(v)) {
+		if (isRecord$4(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -6420,7 +6586,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -6449,7 +6615,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord$2(item) && isRecord$2(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$3(item) && isRecord$3(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -6460,7 +6626,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord$2(value) && isRecord$2(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$3(value) && isRecord$3(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -6468,7 +6634,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord$2(incoming) || !isRecord$2(stored)) return incoming;
+	if (!isRecord$3(incoming) || !isRecord$3(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -6499,7 +6665,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord$2(a) && isRecord$2(b)) {
+	if (isRecord$3(a) && isRecord$3(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -6523,7 +6689,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord$2(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -7311,7 +7477,7 @@ var BaseAddon = class {
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
-			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
+			ctx.api.addons.restartAddon.mutate({ addonId }).then(() => {
 				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
@@ -7820,6 +7986,136 @@ var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
 var RECORD_MAX_DATA_BYTES = 1024 * 1024;
 var RECORD_BATCH_MAX = 1e3;
 var RECORD_QUERY_MAX = 1e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
+function defOf(schema) {
+	const zodBag = Reflect.get(schema, "_zod");
+	if (typeof zodBag !== "object" || zodBag === null) return {};
+	const def = Reflect.get(zodBag, "def");
+	if (typeof def !== "object" || def === null) return {};
+	return def;
+}
+function declaredHere(schema) {
+	return globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const key = each ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
 /**
 * Record kinds (D881): the declaration an addon makes of one kind of fact, the
 * Zod row schema that describes it, and the helper that turns the two into the
@@ -7888,6 +8184,135 @@ var RecordKindDeclarationSchema = object({
 }).strict();
 /** The kind names: lower-case, dash separated, short enough for an index name. */
 var RecordKindNameSchema = string().regex(/^[a-z][a-z0-9-]{0,47}$/);
+/** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
+function assertValidDeclaration(name, decl) {
+	const refuse = (why) => {
+		throw new DeclarationRefusedError(`kind "${name}": ${why}`);
+	};
+	if (!RecordKindNameSchema.safeParse(name).success) refuse("the name must be lower-case-dashed");
+	const seen = /* @__PURE__ */ new Set();
+	for (const index of decl.indexes) {
+		if (seen.has(index.name)) refuse(`index name "${index.name}" is declared twice`);
+		seen.add(index.name);
+	}
+	const { retention } = decl;
+	const hasSecrets = decl.secretPaths.length > 0;
+	if ("ttlMs" in retention) {
+		if (retention.from === "at" && decl.at !== "required") refuse("a ttl from \"at\" needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use engine TTL (its keychain values would be orphaned)");
+	}
+	if ("maxRows" in retention || "maxRowsPerDevice" in retention) {
+		if (retention.maxRowsPerDevice !== void 0 && decl.device !== "required") refuse("maxRowsPerDevice needs device: \"required\"");
+		if (decl.at !== "required") refuse("a row bound trims the oldest \"at\": it needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use an engine row bound");
+		const bound = Math.max(retention.maxRows ?? 0, retention.maxRowsPerDevice ?? 0);
+		if (decl.database === "settings" && bound > 5e4) refuse(`a row bound above ${RECORD_SETTINGS_MAX_ROWS} belongs in database: "events" (a big delete on the settings thread stalls every configuration read)`);
+	}
+	if (decl.deviceRemoval === "delete" && decl.device === "none") refuse("deviceRemoval: \"delete\" needs a device: \"required\" or \"optional\"");
+	for (const path of decl.secretPaths) for (const prefix of secretArrayPrefixes(path)) if (decl.secretArrayKeys[prefix] === void 0) refuse(`secret path "${path}" crosses the array "${prefix}": declare its id key in secretArrayKeys`);
+}
+function bodyFieldsOf(schema) {
+	return { ...toJSONSchema(schema, {
+		unrepresentable: "any",
+		io: "input"
+	}) };
+}
+function isRecordLike(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Does every branch of the body schema carry `field`? (A discriminated union has several.) */
+function hasNameField(json, field) {
+	const branches = json["oneOf"] ?? json["anyOf"];
+	if (Array.isArray(branches)) return branches.length > 0 && branches.every((b) => isRecordLike(b) && hasNameField(b, field));
+	const properties = json["properties"];
+	return isRecordLike(properties) && Object.prototype.hasOwnProperty.call(properties, field);
+}
+/**
+* Declare the kinds of a package. The keys are the kind names. The result is
+* what `ctx.records.declare` sends to the engine and what `ctx.records.kind`
+* types its handle from.
+*/
+function defineRecordKinds(specs) {
+	const out = {};
+	for (const [name, spec] of Object.entries(specs)) {
+		const secretPaths = collectZodSecretPaths(spec.schema);
+		const nameField = spec.entry?.nameField ?? "name";
+		const fields = bodyFieldsOf(spec.schema);
+		if (spec.entry !== void 0 && !hasNameField(fields, nameField)) throw new DeclarationRefusedError(`kind "${name}": an entry kind's schema needs a "${nameField}" field`);
+		const parsed = RecordKindDeclarationSchema.parse({
+			database: spec.database,
+			class: spec.class,
+			writeTrigger: spec.writeTrigger,
+			device: spec.device,
+			at: spec.at,
+			indexes: spec.indexes === void 0 ? void 0 : [...spec.indexes],
+			retention: spec.retention,
+			deviceRemoval: spec.deviceRemoval,
+			maxDataBytes: spec.maxDataBytes,
+			secretPaths: [...secretPaths],
+			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
+			adoptsFrom: spec.adoptsFrom,
+			transactFamily: spec.transactFamily,
+			entry: spec.entry === void 0 ? void 0 : {
+				title: spec.entry.title,
+				nameField,
+				fields
+			}
+		});
+		assertValidDeclaration(name, parsed);
+		out[name] = {
+			name,
+			schema: spec.schema,
+			declaration: parsed
+		};
+	}
+	return out;
+}
+/**
+* Entry kinds (D881): every list of user-created entries (notification
+* targets, brokers, LLM profiles) is ONE record kind with an id, a name and a
+* kind-specific body, and the admin UI lists/adds/edits/deletes all of them
+* through the `record-entries` capability with password fields derived from
+* the schema (`.meta({ secret: true })`).
+*/
+/** The body of a plain entry: a name and the fields the kind adds. */
+function entryBody(shape) {
+	return object({
+		name: string().min(1),
+		...shape
+	});
+}
+/**
+* Declare one entry kind. An entry is configuration: never trimmed by the
+* engine, never aged, belonging to no device.
+*/
+function defineEntryKind(name, spec) {
+	const defined = defineRecordKinds({ [name]: {
+		schema: spec.schema,
+		class: "config",
+		writeTrigger: spec.writeTrigger ?? "an operator adds or edits an entry in the entries UI",
+		retention: { none: "an entry goes only when the operator deletes it" },
+		...spec.database === void 0 ? {} : { database: spec.database },
+		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
+		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
+		...spec.adoptsFrom === void 0 ? {} : { adoptsFrom: spec.adoptsFrom },
+		entry: {
+			title: spec.title,
+			...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
+		}
+	} })[name];
+	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
+	return defined;
+}
+/**
+* Legacy source for entry adoption (B3): a list stored under addon-settings
+* `<addonId>.<key>` until records-adopt copies rows into the entry kind.
+*/
+var SETTINGS_ARRAY_ADOPTS_PREFIX = "@settings-array/";
+/** The `adoptsFrom` value for an addon-settings array field. */
+function settingsArrayAdoptsFrom(addonId, settingsKey) {
+	return `${SETTINGS_ARRAY_ADOPTS_PREFIX}${addonId}/${settingsKey}`;
+}
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = _enum([
 	"high",
@@ -16356,13 +16781,23 @@ method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: arr
 }), RecordQueryResultSchema, { auth: "admin" }), method(object({
 	owner: string().min(1),
 	kind: RecordKindNameSchema,
-	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX),
+	records: array(RecordInputSchema).max(RECORD_BATCH_MAX),
 	/** The LAST batch: the copy is complete, the boot guard stops asking. */
 	complete: boolean().optional()
-}), object({ adopted: number().int() }), {
+}).refine((input) => input.records.length > 0 || input.complete === true, { message: "records must be non-empty unless complete is true" }), object({ adopted: number().int() }), {
 	kind: "mutation",
 	auth: "admin"
-});
+}), method(object({
+	collection: string().min(1),
+	cursor: string().optional(),
+	limit: number().int().min(1).max(1e3).optional()
+}), object({
+	rows: array(object({
+		id: string(),
+		data: record(string(), unknown())
+	})),
+	nextCursor: string().nullable()
+}), { auth: "admin" }), method(object({ collection: string().min(1) }), object({ adopted: boolean() }), { auth: "admin" });
 /**
 * record-entries - the ONE admin surface for every list of user-created entries
 * (D881): notification targets, brokers, LLM profiles, anything an addon
@@ -68434,6 +68869,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"storageAdmin.isAdoptedLegacyTable": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageAdmin.listKinds": {
 		capName: "storage-admin",
 		capScope: "system",
@@ -68446,6 +68887,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"storageAdmin.readLegacyCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageAdmin.readRecords": {
 		capName: "storage-admin",
 		capScope: "system",
@@ -73654,4 +74101,183 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-export { number as _, addonPagesSourceCapability as a, string as b, trainingProviderCapability as c, arrayItemFieldPath as d, globalSecretScope as f, boolean as g, toSecretFieldView as h, TrainingResultSchema as i, BaseAddon as l, isSecretMarker as m, TrainingJobSchema as n, parseTrainingEventLine as o, isSecretClear as p, TrainingJobSpecSchema as r, trainingCapability as s, TRAINING_JOB_SCHEMA as t, SECRET_CLEAR as u, object as v, record as y };
+Object.defineProperty(exports, "BaseAddon", {
+	enumerable: true,
+	get: function() {
+		return BaseAddon;
+	}
+});
+Object.defineProperty(exports, "RECORD_MAX_DATA_BYTES", {
+	enumerable: true,
+	get: function() {
+		return RECORD_MAX_DATA_BYTES;
+	}
+});
+Object.defineProperty(exports, "SECRET_CLEAR", {
+	enumerable: true,
+	get: function() {
+		return SECRET_CLEAR;
+	}
+});
+Object.defineProperty(exports, "TRAINING_JOB_SCHEMA", {
+	enumerable: true,
+	get: function() {
+		return TRAINING_JOB_SCHEMA;
+	}
+});
+Object.defineProperty(exports, "TrainingJobSchema", {
+	enumerable: true,
+	get: function() {
+		return TrainingJobSchema;
+	}
+});
+Object.defineProperty(exports, "TrainingJobSpecSchema", {
+	enumerable: true,
+	get: function() {
+		return TrainingJobSpecSchema;
+	}
+});
+Object.defineProperty(exports, "TrainingResultSchema", {
+	enumerable: true,
+	get: function() {
+		return TrainingResultSchema;
+	}
+});
+Object.defineProperty(exports, "__commonJSMin", {
+	enumerable: true,
+	get: function() {
+		return __commonJSMin;
+	}
+});
+Object.defineProperty(exports, "__esmMin", {
+	enumerable: true,
+	get: function() {
+		return __esmMin;
+	}
+});
+Object.defineProperty(exports, "__exportAll", {
+	enumerable: true,
+	get: function() {
+		return __exportAll;
+	}
+});
+Object.defineProperty(exports, "__toCommonJS", {
+	enumerable: true,
+	get: function() {
+		return __toCommonJS;
+	}
+});
+Object.defineProperty(exports, "__toESM", {
+	enumerable: true,
+	get: function() {
+		return __toESM;
+	}
+});
+Object.defineProperty(exports, "addonPagesSourceCapability", {
+	enumerable: true,
+	get: function() {
+		return addonPagesSourceCapability;
+	}
+});
+Object.defineProperty(exports, "arrayItemFieldPath", {
+	enumerable: true,
+	get: function() {
+		return arrayItemFieldPath;
+	}
+});
+Object.defineProperty(exports, "boolean", {
+	enumerable: true,
+	get: function() {
+		return boolean;
+	}
+});
+Object.defineProperty(exports, "defineEntryKind", {
+	enumerable: true,
+	get: function() {
+		return defineEntryKind;
+	}
+});
+Object.defineProperty(exports, "defineRecordKinds", {
+	enumerable: true,
+	get: function() {
+		return defineRecordKinds;
+	}
+});
+Object.defineProperty(exports, "entryBody", {
+	enumerable: true,
+	get: function() {
+		return entryBody;
+	}
+});
+Object.defineProperty(exports, "globalSecretScope", {
+	enumerable: true,
+	get: function() {
+		return globalSecretScope;
+	}
+});
+Object.defineProperty(exports, "isSecretClear", {
+	enumerable: true,
+	get: function() {
+		return isSecretClear;
+	}
+});
+Object.defineProperty(exports, "isSecretMarker", {
+	enumerable: true,
+	get: function() {
+		return isSecretMarker;
+	}
+});
+Object.defineProperty(exports, "number", {
+	enumerable: true,
+	get: function() {
+		return number;
+	}
+});
+Object.defineProperty(exports, "object", {
+	enumerable: true,
+	get: function() {
+		return object;
+	}
+});
+Object.defineProperty(exports, "parseTrainingEventLine", {
+	enumerable: true,
+	get: function() {
+		return parseTrainingEventLine;
+	}
+});
+Object.defineProperty(exports, "record", {
+	enumerable: true,
+	get: function() {
+		return record;
+	}
+});
+Object.defineProperty(exports, "settingsArrayAdoptsFrom", {
+	enumerable: true,
+	get: function() {
+		return settingsArrayAdoptsFrom;
+	}
+});
+Object.defineProperty(exports, "string", {
+	enumerable: true,
+	get: function() {
+		return string;
+	}
+});
+Object.defineProperty(exports, "toSecretFieldView", {
+	enumerable: true,
+	get: function() {
+		return toSecretFieldView;
+	}
+});
+Object.defineProperty(exports, "trainingCapability", {
+	enumerable: true,
+	get: function() {
+		return trainingCapability;
+	}
+});
+Object.defineProperty(exports, "trainingProviderCapability", {
+	enumerable: true,
+	get: function() {
+		return trainingProviderCapability;
+	}
+});