@camstack/system 1.2.161 → 1.2.163

package/dist/{dist-D4xNBlJM.mjs → dist-DxFjna2a.mjs}

@@ -4192,6 +4192,20 @@ var RelocateJobSchema = z.object({
 	* in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
 	*/
 	rowsReconciled: z.number().int().nonnegative().optional(),
+	/**
+	* Rows this run FORGOT because the file they name is not on disk.
+	*
+	* The mover derived the path from the row's own fields and `stat`ed it; an
+	* ENOENT there is a per-path confirmation that the segment is gone (D296),
+	* and the durable row is dropped through the same channel eviction uses. It
+	* is reported for the same reason `rowsReconciled` is: this is a durable
+	* mutation nobody asked for, and a migration that quietly erases hour rows is
+	* the same failure as one that quietly skips them (D295).
+	*
+	* The production drain of 2026-08-30 would have reported 11 074 here — the
+	* ledger claimed 5.65 GB of footage that no longer existed.
+	*/
+	rowsForgotten: z.number().int().nonnegative().optional(),
 	startedAt: z.number(),
 	finishedAt: z.number().nullable(),
 	error: z.string().nullable()
@@ -4587,6 +4601,91 @@ var RelocateResidueSchema = z.object({
 	segments: z.number().int().nonnegative(),
 	bytes: z.number().int().nonnegative()
 }).nullable();
+/**
+* Ask one location whether its durable hour rows describe the disk — the walk
+* (D319).
+*
+* `apply` DEFAULTS TO FALSE and that default is the product: the operator's
+* missing tool is the question, and the dry run is how they sanity-check the
+* destructive run before authorising it.
+*/
+var LedgerWalkInputSchema = z.object({
+	locationId: z.string().min(1),
+	/** Forget the confirmed-absent rows, rather than only counting them. */
+	apply: z.boolean().optional(),
+	/** Narrow to one camera. */
+	deviceId: z.number().int().positive().optional(),
+	/** Narrow to these recording profiles; empty/absent = every profile. */
+	profiles: z.array(z.string().min(1)).optional()
+});
+/** Why a whole walk did nothing. Every one leaves the ledger untouched. */
+var LedgerWalkRefusalSchema = z.enum([
+	"location-unknown",
+	"source-writable",
+	"no-ledger",
+	"archive-unreadable",
+	"anchor-absent",
+	"anchor-unreadable",
+	"anchor-moved"
+]);
+z.enum([
+	"live-tail",
+	"listing-error",
+	"path-mismatch",
+	"durable-refused"
+]);
+/** Every skip reason, always present, always a number — so a reason that never
+*  fired reports as zero rather than absent and the report shape is constant
+*  between passes. Spelled out rather than `z.record` for exactly that. */
+var LedgerWalkSkipCountsSchema = z.object({
+	"live-tail": z.number().int().nonnegative(),
+	"listing-error": z.number().int().nonnegative(),
+	"path-mismatch": z.number().int().nonnegative(),
+	"durable-refused": z.number().int().nonnegative()
+});
+/** One camera's share of a walk, so a report names cameras and not rows. */
+var LedgerWalkDeviceReportSchema = z.object({
+	deviceId: z.number().int(),
+	hoursWalked: z.number().int().nonnegative(),
+	hoursMissing: z.number().int().nonnegative(),
+	ghostSegments: z.number().int().nonnegative(),
+	ghostBytes: z.number().int().nonnegative(),
+	forgottenSegments: z.number().int().nonnegative(),
+	orphanFiles: z.number().int().nonnegative()
+});
+/**
+* What one walk claimed, listed, found and (only when armed) forgot.
+*
+* `archiveSegments` is the **M** and `segmentsClaimed` the **N** (D295), so a
+* walk that saw a fraction of the location is visible in its own report rather
+* than in the absence of one.
+*/
+var LedgerWalkReportSchema = z.object({
+	locationId: z.string(),
+	applied: z.boolean(),
+	refused: LedgerWalkRefusalSchema.nullable(),
+	archiveSegments: z.number().int().nonnegative().nullable(),
+	archiveBytes: z.number().int().nonnegative().nullable(),
+	hoursClaimed: z.number().int().nonnegative(),
+	hoursWalked: z.number().int().nonnegative(),
+	hoursMissing: z.number().int().nonnegative(),
+	/** `readdir` calls issued — the cost, stated in the unit that is paid. */
+	listings: z.number().int().nonnegative(),
+	segmentsClaimed: z.number().int().nonnegative(),
+	ghostSegments: z.number().int().nonnegative(),
+	ghostBytes: z.number().int().nonnegative(),
+	ghostHoursWhole: z.number().int().nonnegative(),
+	forgottenSegments: z.number().int().nonnegative(),
+	forgottenBytes: z.number().int().nonnegative(),
+	/** Files under a claimed hour that no durable row names. Never deleted. */
+	orphanFiles: z.number().int().nonnegative(),
+	orphanSample: z.array(z.string()).readonly(),
+	hoursSkipped: z.number().int().nonnegative(),
+	skippedByReason: LedgerWalkSkipCountsSchema,
+	/** The walk stopped at its per-pass hour bound with claims unwalked. */
+	bounded: z.boolean(),
+	byDevice: z.array(LedgerWalkDeviceReportSchema).readonly()
+});
 /** How many rows a media pass would still act on against a given target — the
 *  media lane's denominator AND its residue, from ONE derivation so the two can
 *  never disagree. `null` = the count could not be taken. */
@@ -17777,13 +17876,15 @@ var ListGroupsPageSchema = z.object({
 	groups: z.array(AnalyticsGroupRecordSchema).readonly(),
 	nextCursor: z.string().nullable()
 });
+var KEY_EVENTS_DEFAULT_LIMIT = 50;
+var KEY_EVENTS_MAX_LIMIT = 200;
 var KeyEventQueryInput = z.object({
 	deviceId: z.number(),
 	/** Window lower bound (track firstSeen ≥ since). */
 	since: z.number(),
 	/** Window upper bound (track firstSeen ≤ until). */
 	until: z.number(),
-	limit: z.number().int().min(1).max(200).default(50),
+	limit: z.number().int().min(1).max(KEY_EVENTS_MAX_LIMIT).default(KEY_EVENTS_DEFAULT_LIMIT),
 	/** Drop tracks scoring below this importance. */
 	minImportance: z.number().min(0).max(1).optional(),
 	/** Restrict to a single class (e.g. 'person'). */
@@ -17805,6 +17906,32 @@ var KeyEventSchema = z.object({
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
+/** `getKeyEvents`' window and filters, asked of a SET of cameras at once. */
+var KeyEventBatchQueryInput = z.object({
+	deviceIds: z.array(z.number()).min(1).max(200),
+	since: z.number(),
+	until: z.number(),
+	/** Applied PER CAMERA, exactly as `getKeyEvents.limit` is — never a total
+	*  across the set, which would let a busy camera starve a quiet one of its
+	*  rows and change what the merged feed contains. */
+	limit: z.number().int().min(1).max(KEY_EVENTS_MAX_LIMIT).default(KEY_EVENTS_DEFAULT_LIMIT),
+	minImportance: z.number().min(0).max(1).optional(),
+	classFilter: z.string().optional()
+});
+/**
+* One camera's key events in a batch answer.
+*
+* The row exists for every requested id. `getKeyEvents` degrades to `[]` on
+* error rather than throwing, so a camera whose store read failed and one with
+* no events in the window were ALREADY indistinguishable per camera — the
+* batch does not make that worse, and the row keeps the deviceId the single
+* method's output never carried (the caller used to stamp it from the fan-out
+* key, which only worked because there was one query per camera).
+*/
+var KeyEventsForDeviceSchema = z.object({
+	deviceId: z.number(),
+	events: z.array(KeyEventSchema).readonly()
+});
 z.object({
 	trackId: z.string(),
 	className: z.string(),
@@ -17876,6 +18003,50 @@ var EventStoreFootprintSchema = z.object({
 	totalBytes: z.number().int(),
 	devices: z.array(EventStoreDeviceFootprintSchema).readonly()
 });
+/** Event-media footprint for one {@link MediaFileKind}. */
+var EventMediaKindFootprintSchema = z.object({
+	kind: MediaFileKindEnum,
+	/** Media rows of this kind. */
+	rows: z.number().int(),
+	/** Bytes on disk held by those rows. */
+	bytes: z.number().int()
+});
+/**
+* The media footprint broken down by KIND — the axis a deletion decision
+* actually turns on.
+*
+* A byte total says how much there is; it cannot say what is safe to remove.
+* The deletable set (the periodic `snapshot` filmstrip, the surplus per-edge
+* motion stills) and the keep set (`firstFrame`, rolling `lastFrame`,
+* `thumbnail`/`thumbnailSmall`, `keyFrame`/`keyFrameSmall`, the face/plate
+* buffers, gallery media, the CLIP `crop`) are distinguished by `kind` and by
+* nothing else, so sizing a deletion means summing per kind.
+*
+* ## Why `unaccounted*` exists
+*
+* `kinds` is enumerated from {@link MediaFileKindEnum} — the closed set the
+* writers use — and summed one kind at a time. `totalRows` / `totalBytes` come
+* from a SEPARATE unfiltered aggregate over the same rows, never from adding
+* `kinds` up. A row whose stored `kind` is not in the enum (written by a
+* retired code path, or by a version that knew a kind this one does not) would
+* otherwise vanish from the total silently, and an operator would delete
+* against a denominator smaller than the disk.
+*
+* `unaccountedRows` / `unaccountedBytes` are the difference. They are normally
+* zero; a non-zero value is a real finding and must be shown, not rounded away.
+*/
+var EventMediaKindBreakdownSchema = z.object({
+	/** Every media row in scope, from one unfiltered aggregate. */
+	totalRows: z.number().int(),
+	/** Every media byte in scope, from that same aggregate. */
+	totalBytes: z.number().int(),
+	/** Per-kind footprint, ordered by bytes descending. */
+	kinds: z.array(EventMediaKindFootprintSchema).readonly(),
+	/** `totalRows` minus the summed `kinds` rows — see the schema note. */
+	unaccountedRows: z.number().int(),
+	/** `totalBytes` minus the summed `kinds` bytes — see the schema note. */
+	unaccountedBytes: z.number().int()
+});
 /** Per-kind counts returned by the event-prune / device-delete mutations. */
 var EventPruneCountsSchema = z.object({
 	motion: z.number().int(),
@@ -18110,6 +18281,21 @@ var pipelineAnalyticsCapability = {
 		* scored on-read (no write). Degrades to `[]` on error.
 		*/
 		getKeyEvents: method(KeyEventQueryInput, z.array(KeyEventSchema).readonly()),
+		/**
+		* The same ranking, for a SET of cameras, in one round trip.
+		*
+		* The Detection Intelligence events feed asks this of every selected
+		* camera and re-asks on a 30s timer. Fanned out client-side that is N
+		* round trips — browser → hub → post-analysis — for N independent,
+		* already-indexed store queries. Batched, the queries are unchanged and
+		* run concurrently INSIDE the owner; only the transport collapses.
+		*
+		* Deliberately per-device rather than pre-merged: `limit` stays per
+		* camera (a total would let a busy camera starve a quiet one), and a
+		* caller that renders one camera's lane needs to know which camera a row
+		* came from. `getKeyEvents` stays for single-device callers.
+		*/
+		getKeyEventsBatch: method(KeyEventBatchQueryInput, z.array(KeyEventsForDeviceSchema).readonly()),
 		/** Server-side bucketed event counts for the 24-hour timeline.
 		*  Returns one entry per non-empty bucket; empty buckets are omitted. */
 		getEventDensity: method(z.object({
@@ -18258,6 +18444,22 @@ var pipelineAnalyticsCapability = {
 			auth: "admin"
 		}),
 		/**
+		* The same media footprint, broken down by {@link MediaFileKind} instead of
+		* by camera — fleet-wide, or for one camera with `deviceId`.
+		*
+		* Separate from {@link getEventStoreFootprint} rather than a field on it:
+		* the two answer different questions on different axes, the per-camera one
+		* is what the management table renders on every open, and nothing should
+		* pay for a per-kind pass to draw it. See
+		* {@link EventMediaKindBreakdownSchema} for why `unaccounted*` exists —
+		* `kinds` is enumerated, `totalBytes` is not, and the gap must be visible
+		* to anyone sizing a deletion against it.
+		*/
+		getEventMediaFootprintByKind: method(z.object({ deviceId: z.number().int().optional() }), EventMediaKindBreakdownSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
 		* Cluster-wide prune of events older than `olderThanMs` (exclusive) across
 		* every camera, deleting each event's media in lockstep. Logged to the
 		* events ops-log with `reason` (default `'retention'`). Returns the summed
@@ -21255,6 +21457,20 @@ var storageCapability = {
 		listProviders: method(z.void(), z.array(ProviderListEntrySchema).readonly()),
 		testConfig: method(z.object({
 			providerId: z.string(),
+			/**
+			* The location this config is an UNSAVED edit of, when there is one.
+			*
+			* `listLocations` replaces every declared secret with the redaction
+			* sentinel, so the edit modal's form state holds the sentinel for any
+			* credential the operator did not retype — and posting that here
+			* without a way to resolve it makes the provider try to authenticate
+			* as `__camstack_redacted__` and report the operator's own working
+			* password as wrong. Given this id, the orchestrator restores each
+			* sentinel from the stored config (same rule as `upsertLocation`)
+			* before dispatching. Omitted by the "Add location" wizard, where
+			* every value was typed just now and nothing is stored yet.
+			*/
+			locationId: z.string().optional(),
 			config: z.record(z.string(), z.unknown())
 		}), z.object({
 			ok: z.boolean(),
@@ -29949,6 +30165,23 @@ var recordingCapability = {
 			kind: "query",
 			auth: "admin"
 		}),
+		/**
+		* Does this location's LEDGER tell the truth about its disk? (D319)
+		*
+		* One `readdir` per claimed hour, diffed both ways: durable rows whose file
+		* is not there, and files no durable row names. `apply` defaults to FALSE —
+		* the report is the product, and the dry run is how an operator
+		* sanity-checks the destructive run before authorising it.
+		*
+		* REFUSES a source that is still a write target: a listing of a live
+		* location is a lower bound, which is not the strong evidence that lets
+		* this pass forget without a budget. A live location is reconciled by the
+		* mover, under D318's bound.
+		*/
+		reconcileLedgerAgainstDisk: method(LedgerWalkInputSchema, LedgerWalkReportSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Cancel a running or queued relocate job. A queued job never runs. */
 		cancelRelocateJob: method(z.object({ jobId: z.string() }), z.object({ cancelled: z.boolean() }), {
 			kind: "mutation",
@@ -30383,6 +30616,25 @@ var SceneMonitorStatusSchema = z.object({
 	monitors: z.array(SceneMonitorSchema),
 	lastFetchedAt: z.number()
 });
+/**
+* One camera's row in a `listScenesBatch` answer.
+*
+* `status` is NULLABLE and the nullability is the whole point. `scene-monitor`
+* is a `defaultActive` wrapper, so every camera is asked; a camera whose
+* provider is absent (pipeline-analytics not deployed, the post-processing node
+* down) cannot answer, and that is not the same fact as a camera with no scenes
+* configured. Fanned out per camera the difference was visible — one query
+* errored while the others resolved — and a batch that returned only the rows
+* it managed would have destroyed it, silently, by making an unreachable camera
+* indistinguishable from one that answered `monitors: []`.
+*
+* So: EVERY requested deviceId gets a row. `status: null` means "this camera
+* could not be read"; `status.monitors: []` means "read, and it has none".
+*/
+var SceneMonitorStatusForDeviceSchema = z.object({
+	deviceId: z.number(),
+	status: SceneMonitorStatusSchema.nullable()
+});
 var sceneMonitorCapability = {
 	name: "scene-monitor",
 	scope: "device",
@@ -30392,6 +30644,22 @@ var sceneMonitorCapability = {
 	deviceTypes: [DeviceType.Camera],
 	methods: {
 		listScenes: method(z.object({ deviceId: z.number() }), SceneMonitorStatusSchema),
+		/**
+		* The same answer, for a SET of cameras, in one round trip.
+		*
+		* `/scenes` renders every camera and re-reads them on a 30s safety-net
+		* poll behind the push slice. Fanned out client-side that was one query
+		* per camera — 29 round trips through the browser, the hub and the
+		* post-analysis runner every 30 seconds to read an in-memory map the
+		* owner had already merged. The work is unchanged (`statusFor` per
+		* device, all in-process at the owner); what collapses is the transport.
+		*
+		* A camera that cannot answer still gets a row, with `status: null` —
+		* see {@link SceneMonitorStatusForDeviceSchema}. Never fewer rows than
+		* ids: a caller that asked for twenty-nine and got twenty-seven cannot
+		* tell which two are missing, or that any are.
+		*/
+		listScenesBatch: method(z.object({ deviceIds: z.array(z.number()).min(1).max(200) }), z.array(SceneMonitorStatusForDeviceSchema).readonly()),
 		createScene: method(z.object({
 			deviceId: z.number(),
 			label: z.string(),
@@ -32662,6 +32930,27 @@ var CameraOccupancySnapshotSchema = z.object({
 	stationaryObjects: z.array(StationaryObjectSchema).readonly().optional()
 });
 /**
+* One camera's row in a `getCurrentSnapshotBatch` answer.
+*
+* THREE outcomes, and the single-camera method could only express two of them
+* because `snapshot: null` was already spoken for:
+*
+*  - `read: 'read'`, `snapshot` present — the live occupancy reading.
+*  - `read: 'read'`, `snapshot: null`   — read, and this camera has no reading
+*    yet: no frame since boot, and no parked-object registry to hydrate from.
+*  - `read: 'unreadable'`               — the owner could not answer for this
+*    camera. `snapshot` is null, and it does NOT mean "nothing parked here".
+*
+* Collapsing the last two is the failure this field exists to prevent: a
+* hydration that threw would otherwise render as an empty Stationary section,
+* which is a definite claim about a camera nobody could read.
+*/
+var CameraOccupancySnapshotForDeviceSchema = z.object({
+	deviceId: z.number(),
+	read: z.enum(["read", "unreadable"]),
+	snapshot: CameraOccupancySnapshotSchema.nullable()
+});
+/**
 * Time-series resolution. The history methods return one bucket per
 * step over the requested range. Smaller resolutions cost more
 * memory + bandwidth; bound to discrete steps so caller cannot ask
@@ -32718,6 +33007,20 @@ var zoneAnalyticsCapability = {
 		*  (no inference result emitted since boot or since binding was
 		*  activated). */
 		getCurrentSnapshot: method(z.object({ deviceId: z.number() }), CameraOccupancySnapshotSchema.nullable()),
+		/**
+		* The same snapshot, for a SET of cameras, in one round trip.
+		*
+		* The Events page's Stationary section polls this every 15s for every
+		* selected camera. Fanned out client-side that is one query per camera to
+		* read a `Map.get` at the owner — the answer costs nothing, the round trip
+		* costs everything. Batched, N transports become one and the per-device
+		* work is unchanged.
+		*
+		* Every requested deviceId gets a row, tagged `read` — see
+		* {@link CameraOccupancySnapshotForDeviceSchema}. A camera the owner could
+		* not answer for is `'unreadable'`, never an empty reading.
+		*/
+		getCurrentSnapshotBatch: method(z.object({ deviceIds: z.array(z.number()).min(1).max(200) }), z.array(CameraOccupancySnapshotForDeviceSchema).readonly()),
 		/** Time-series object count inside one zone. `className` optional —
 		*  omit to count every class in the zone. */
 		getZoneHistory: method(z.object({
@@ -36827,6 +37130,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getEventMediaFootprintByKind": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getEventStoreFootprint": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -36845,6 +37154,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getKeyEventsBatch": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getMotionEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -38021,6 +38336,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.reconcileLedgerAgainstDisk": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.refreshStorageLocationsForMigration": {
 		capName: "recording",
 		capScope: "system",
@@ -38147,6 +38468,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"sceneMonitor.listScenesBatch": {
+		capName: "scene-monitor",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.recheckNow": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -39503,6 +39830,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"zoneAnalytics.getCurrentSnapshotBatch": {
+		capName: "zone-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"zoneAnalytics.getUnzonedHistory": {
 		capName: "zone-analytics",
 		capScope: "device",
@@ -40492,6 +40825,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.getEventMediaFootprintByKind": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"pipelineAnalytics.getGroup": [{
 		name: "deviceId",
 		form: "single",
@@ -40502,6 +40840,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.getKeyEventsBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"pipelineAnalytics.getMotionEvents": [{
 		name: "deviceId",
 		form: "single",
@@ -40942,6 +41285,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"recording.reconcileLedgerAgainstDisk": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"recording.relocateFootage": [{
 		name: "deviceId",
 		form: "single",
@@ -41007,6 +41355,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"sceneMonitor.listScenesBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"sceneMonitor.recheckNow": [{
 		name: "deviceId",
 		form: "single",
@@ -41268,6 +41621,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"zoneAnalytics.getCurrentSnapshotBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"zoneAnalytics.getUnzonedHistory": [{
 		name: "deviceId",
 		form: "single",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Keu5TDO7.js");
+const require_dist = require("./dist-B29Skpzo.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -26,7 +26,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
 const require_tls$1 = require("./tls-BxQlomxd.js");
-const require_manifest_system_deps = require("./manifest-system-deps-DYv4ZPo2.js");
+const require_manifest_system_deps = require("./manifest-system-deps-DBje540e.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -6847,19 +6847,82 @@ function unwrapValue(parsed) {
 	if (!isRecord$1(parsed) || !("value" in parsed)) return parsed;
 	return parsed.value;
 }
+/**
+* Rows one page of a prefix read asks for.
+*
+* Below `SETTINGS_QUERY_DEFAULT_ROW_CAP` (2 000, `query-bounds.ts`) on purpose:
+* this read now names its own bound, so the engine's defensive cap is never the
+* thing that decides how much of the answer the caller gets.
+*/
+var PREFIX_PAGE_ROWS = 1e3;
+/**
+* Pages one prefix read may take before it refuses.
+*
+* 512 pages is 512 000 rows — three orders of magnitude past the largest live
+* scope (`addon-device-settings` for one addon over a ~1 019-device fleet) and
+* still a bound, because a walk with no bound is the defect this file was
+* fixing, not one to reintroduce.
+*/
+var PREFIX_PAGE_BUDGET = 512;
+/**
+* Every row under `prefix`, or a throw — never the first 2 000 of them.
+*
+* **The defect.** This issued ONE `query` with no `limit`, and
+* `queryDeclared` resolves an absent limit to `SETTINGS_QUERY_DEFAULT_ROW_CAP`
+* and cuts the result there. On the live hub that fired 138 times in two hours
+* (`settings-store query truncated by a defensive row cap`, collection
+* `addon-device-settings`, `rowCap: 2000`, `requestedLimit: null`): a
+* ~1 019-device fleet with more than two stored keys per device puts one
+* addon's `<addonId>:` range past the cap. The engine warned; the door did not
+* notice, and handed its caller a short map that is **shape-identical to a
+* complete one**. Every device whose rows sort past the cap reads as "has no
+* stored settings", which is exactly what a device with none looks like.
+*
+* **The fix is a keyset walk, not a bigger limit.** The cursor is the last id
+* of the previous page, INCLUSIVE — so the page boundary re-reads exactly one
+* row (ids are unique, so a full page always advances) and no row can fall
+* between two pages the way an `OFFSET` walk drops rows under a concurrent
+* write (D295 rule 1). Re-reading is free here: the accumulator is keyed by
+* suffix, so the duplicate overwrites itself with its own value.
+*
+* `ORDER BY id` is not decoration — the cursor is only meaningful if the
+* engine returns the range in the order the cursor advances through. It is the
+* primary key, so the ordering is the range scan's own.
+*
+* @throws when the prefix cannot be expressed as a range and the collection is
+*   larger than one page, or when the walk exceeds {@link PREFIX_PAGE_BUDGET}.
+*   A throw is the point: a caller that cannot be answered completely must not
+*   be handed something that looks like a complete answer.
+*/
 async function loadPrefixed(door, collection, prefix) {
 	const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(prefix);
-	const rows = await door.query({
-		collection,
-		...range !== null ? { filter: { whereBetween: { id: [range.lo, range.hi] } } } : {}
-	});
 	const result = {};
-	for (const row of rows) {
-		if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
-		if (!row.id.startsWith(prefix)) continue;
-		result[row.id.slice(prefix.length)] = unwrapValue(row.data);
+	let cursor = range?.lo ?? null;
+	for (let page = 0;; page++) {
+		if (page >= PREFIX_PAGE_BUDGET) throw new Error(`settings door: reading "${prefix}" from "${collection}" exceeded ${PREFIX_PAGE_BUDGET} pages of ${PREFIX_PAGE_ROWS} rows. Refusing to return the part that was read — a partial scope read is indistinguishable from an empty one.`);
+		const rows = await door.query({
+			collection,
+			filter: {
+				...range !== null && cursor !== null ? { whereBetween: { id: [cursor, range.hi] } } : {},
+				orderBy: {
+					field: "id",
+					direction: "asc"
+				},
+				limit: PREFIX_PAGE_ROWS
+			}
+		});
+		for (const row of rows) {
+			if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
+			if (!row.id.startsWith(prefix)) continue;
+			result[row.id.slice(prefix.length)] = unwrapValue(row.data);
+		}
+		if (rows.length < PREFIX_PAGE_ROWS) return result;
+		const last = rows[rows.length - 1];
+		if (last === void 0) return result;
+		if (range === null) throw new Error(`settings door: prefix "${prefix}" on "${collection}" cannot be expressed as an id range, and the unfiltered read filled a page — the answer would be partial. Use an ASCII, non-empty prefix.`);
+		if (last.id === cursor) throw new Error(`settings door: reading "${prefix}" from "${collection}" made no progress at id "${last.id}" — ids under a prefix must be unique.`);
+		cursor = last.id;
 	}
-	return result;
 }
 async function replacePrefixed(door, collection, prefix, values, wrap) {
 	const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(prefix);