@camstack/system 1.2.423 → 1.2.425

package/dist/{dist-DimotS8e.mjs → dist-DMWeqeTF.mjs}

@@ -10880,6 +10880,568 @@ var authProviderCapability = {
 	mount: { kind: "skip" }
 };
 /**
+* Query filter for settings-store collections.
+*/
+var QueryFilterSchema = z.object({
+	where: z.record(z.string(), z.unknown()).optional(),
+	whereIn: z.record(z.string(), z.array(z.unknown())).optional(),
+	whereBetween: z.record(z.string(), z.tuple([z.unknown(), z.unknown()])).optional(),
+	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
+	whereNot: z.record(z.string(), z.unknown()).optional(),
+	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
+	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
+	whereNotIn: z.record(z.string(), z.array(z.unknown())).optional(),
+	orderBy: z.object({
+		field: z.string(),
+		direction: z.enum(["asc", "desc"])
+	}).optional(),
+	limit: z.number().optional(),
+	offset: z.number().optional()
+});
+/**
+* The predicate half of a filter, for BULK MUTATIONS.
+*
+* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
+* meaning for a statement that rewrites a set, and accepting them would invite
+* a caller to believe `limit` bounds the damage. Every field is optional here
+* only so the shape stays composable — the implementation REJECTS a filter
+* that compiles to no predicate, because that is the whole collection.
+*/
+var MutationFilterSchema = z.object({
+	where: z.record(z.string(), z.unknown()).optional(),
+	whereIn: z.record(z.string(), z.array(z.unknown())).optional(),
+	whereBetween: z.record(z.string(), z.tuple([z.unknown(), z.unknown()])).optional(),
+	whereNot: z.record(z.string(), z.unknown()).optional(),
+	whereNotIn: z.record(z.string(), z.array(z.unknown())).optional()
+});
+/**
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
+*/
+var AggregateFieldSchema = z.object({
+	/** Result key. */
+	as: z.string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: z.string().min(1),
+	op: z.enum([
+		"sum",
+		"min",
+		"max"
+	])
+});
+/**
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+*/
+var AggregateResultSchema = z.object({
+	count: z.number().int(),
+	values: z.record(z.string(), z.number().nullable())
+});
+/** A single stored record: `{ id, data }`. */
+var SettingsRecordSchema = z.object({
+	id: z.string(),
+	data: z.record(z.string(), z.unknown())
+});
+/**
+* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
+* optional.
+*
+* A separate schema rather than loosening the shared one: every other method
+* on this cap addresses a row BY its id, and making that field optional
+* everywhere would turn a forgotten key into a silently generated one on
+* `update` and `delete` as well.
+*/
+var BulkRecordSchema = z.object({
+	id: z.string().optional(),
+	data: z.record(z.string(), z.unknown())
+});
+/**
+* The database FILES one `sqlite-settings` engine process owns (D851).
+* Closed on purpose: a file is a thing the engine opens, backs up and gives a
+* serving thread, so a new one is a code change, never a string a caller
+* invents. `settings` is `camstack.db` and the default for every collection
+* that names no file.
+*/
+var DataStoreDatabaseSchema = z.enum([
+	"settings",
+	"events",
+	"history"
+]);
+/** Every database file, in a stable order (settings first). */
+var DATA_STORE_DATABASES = DataStoreDatabaseSchema.options;
+/**
+* One write inside a {@link settingsStoreCapability.methods.transact} call.
+* The three that a "replace this set, bump that revision" write needs, plus
+* the batched upsert a rollup writer needs.
+*/
+var TransactOpSchema = z.discriminatedUnion("op", [
+	z.object({
+		op: z.literal("deleteWhere"),
+		collection: z.string(),
+		filter: MutationFilterSchema
+	}),
+	z.object({
+		op: z.literal("insertMany"),
+		collection: z.string(),
+		records: z.array(BulkRecordSchema).readonly()
+	}),
+	z.object({
+		op: z.literal("update"),
+		collection: z.string(),
+		id: z.string(),
+		data: z.record(z.string(), z.unknown())
+	}),
+	z.object({
+		op: z.literal("upsertMany"),
+		collection: z.string(),
+		conflict: z.array(z.string()).readonly(),
+		records: z.array(BulkRecordSchema).readonly()
+	})
+]);
+/**
+* The precondition of a transaction: the row `key` of `collection` must hold
+* `equals` in `column`, read INSIDE the transaction.
+*/
+var TransactGuardSchema = z.object({
+	collection: z.string(),
+	key: z.string(),
+	column: z.string(),
+	equals: z.unknown()
+});
+/**
+* Column declaration for a structured (SQL-backed) collection.
+*
+* Logical types — the backend translates each to the matching SQLite
+* storage class and handles per-type marshaling:
+*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
+*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
+*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
+*/
+var CollectionColumnSchema = z.object({
+	name: z.string(),
+	type: z.enum([
+		"TEXT",
+		"INTEGER",
+		"REAL",
+		"JSON",
+		"BOOLEAN"
+	]),
+	primaryKey: z.boolean().optional(),
+	notNull: z.boolean().optional(),
+	unique: z.boolean().optional(),
+	/**
+	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
+	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
+	* collection surface simply cannot express their existing tables — which is
+	* why they were still on the uncapped `table*` API.
+	*/
+	defaultValue: z.union([
+		z.string(),
+		z.number(),
+		z.boolean()
+	]).optional()
+});
+var CollectionIndexSchema = z.object({
+	name: z.string(),
+	columns: z.array(z.string()).readonly(),
+	unique: z.boolean().optional()
+});
+/**
+* The input of `declareCollection` — ONE schema for the door and for the
+* engine behind it, so the two surfaces cannot drift (the dispatcher forwards
+* the payload untouched).
+*
+* - `database` — the file the collection lives in (D851). Absent means
+*   `settings`. A declaration naming a file other than the one the table is
+*   already in is REFUSED by the engine, never moved.
+* - `primaryKey` — a COMPOSITE key, as column names. A single name is the same
+*   as `primaryKey: true` on that column. A composite-keyed collection has no
+*   `id`: it is written with `insertMany` / `upsertMany` / `transact` and read
+*   with `query` / `count` / `aggregate` / `deleteWhere`; the calls that
+*   address one row by id are refused.
+* - `withoutRowid` — emit `WITHOUT ROWID`. Requires a primary key.
+*/
+var DeclareCollectionInputSchema = z.object({
+	namespace: z.string().optional(),
+	collection: z.string(),
+	columns: z.array(CollectionColumnSchema).readonly(),
+	indexes: z.array(CollectionIndexSchema).readonly().optional(),
+	database: DataStoreDatabaseSchema.optional(),
+	primaryKey: z.array(z.string()).readonly().optional(),
+	withoutRowid: z.boolean().optional()
+});
+/**
+* settings-store — singleton capability for addon-scoped persistence.
+*
+* Every method operates within a `collection`. An optional `namespace`
+* field provides access to additional data spaces beyond the default
+* addon settings — useful for business data (events, tracks, faces, etc.).
+*
+* **Scoping is the CALLER's, and it is opt-in.** The table is
+* `namespace ? `${namespace}:${collection}` : collection` — nothing
+* consults the identity of the caller. An earlier version of this comment
+* claimed the implementation prefixes every collection with the calling
+* addon's ID and that "addons never see each other's data"; that was never
+* true, and this same file contradicted it under `declareCollection`. What
+* exists is `addon-context-factory`, which passes `namespace: addonId` ON
+* THE ADDON'S BEHALF for the `addon-settings` / `addon-devices` paths only.
+* Business collections use bare names, and any caller may name any
+* namespace, or none. Making the door enforce it is tracked separately —
+* it renames tables, so it needs a migration.
+*
+* **So every method is `auth: 'admin'` (D634).** Because nothing scopes a
+* call to its caller, a `protected` method here was a raw, unredacted read
+* (and write) of every addon's collections for any role holding
+* `category:system` — which is every role: a `viewer` could read every
+* notifier token in plaintext from `notifiers:notification-targets`. No
+* browser or app client calls this cap. Addons are not affected: an
+* addon's `ctx.api` cap call is resolved to the provider directly and never
+* enters the tRPC router (so the tier gates sessions and tokens, never
+* addons), and the hub itself calls it through the capability registry.
+*
+*   - `{ collection: 'addon-settings' }` → table `addon-settings`
+*   - `{ namespace: 'my-addon', collection: 'addon-settings' }` →
+*     table `my-addon:addon-settings`
+*
+* Served by the **storage-orchestrator** builtin, which dispatches to the
+* `data-store-provider` engine registered for the collection
+* (`sqlite-settings`, a SQLite WAL backend, today). One addon owns the
+* data door; engines sit behind it
+* ([D44](../../../../docs/decisions/adr-0044.md)).
+* Addons access it via `ctx.api.settingsStore.*`.
+*/
+var settingsStoreCapability = {
+	name: "settings-store",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/** Get a single value by key from a collection. */
+		get: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			key: z.string()
+		}), z.unknown(), { auth: "admin" }),
+		/** Set a value by key in a collection (upsert). */
+		set: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			key: z.string(),
+			value: z.unknown()
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Rows matching a filter.
+		*
+		* `columns` is a SQL-level projection: the engine SELECTs only those
+		* columns (plus the primary key) instead of the whole row. It is the only
+		* way to stop paying disk for a column that is discarded — a heavy JSON
+		* column dominates the row, and dropping it in JS after the read pays every
+		* byte first. Measured on the live `pipeline-analytics:tracks` table: a
+		* 501-row page is 4.6 MB whole and 0.11 MB projected, same index, same
+		* plan.
+		*
+		* The engine REFUSES a column it cannot serve rather than omitting it —
+		* see `SettingsQueryInput.columns` for why a projection may not be
+		* forgiving the way a predicate is.
+		*/
+		query: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			filter: QueryFilterSchema.optional(),
+			columns: z.array(z.string()).readonly().optional()
+		}), z.array(SettingsRecordSchema).readonly(), { auth: "admin" }),
+		/**
+		* Make a SLOT hold this row — insert it, or update whatever already
+		* occupies the slot — and answer with the id the row HAS.
+		*
+		* ## Why the store needed this
+		*
+		* {@link set} is already an upsert, but its slot is the PRIMARY KEY: the
+		* caller has to know the id to address the row. That is exactly what a
+		* collection keyed by an `INTEGER` rowid alias cannot do — SQLite assigns
+		* the id, so a writer whose uniqueness rule is "one row per
+		* `(ownerKind, ownerId, kind, slot)`" has no id to name and no way to
+		* express the rule. {@link insert} can express it (a UNIQUE index
+		* arbitrates) but only by THROWING at the loser of a race, and the loser
+		* here is a legitimate re-capture, not an error.
+		*
+		* Getting there without this method means read-then-write: query the slot,
+		* then `insert` or `update`. Two statements instead of one, a race between
+		* them, and a recovery path that has to recognise a UNIQUE violation by its
+		* MESSAGE — across a process boundary, because the store lives behind an
+		* RPC door. A string match would be the whole gate, and a store that
+		* rephrased its error would lose the row silently. One statement has no
+		* such gate (D482).
+		*
+		* ## The contract
+		*
+		* `conflict` names the DECLARED columns that identify the slot. They must
+		* be covered by a UNIQUE index on the collection — SQLite resolves an
+		* `ON CONFLICT` target against its indexes and REFUSES the statement when
+		* none matches, so a wrong list is a loud error on the first write, never a
+		* silently duplicated row. An empty list is refused rather than passed on:
+		* `ON CONFLICT()` is not valid SQL, and the intent it would most likely
+		* encode ("no slot, just insert") is {@link insert}.
+		*
+		* Row shape is {@link insert}'s: `record.id` is used when the collection
+		* needs a supplied key and IGNORED when the primary key is an `INTEGER`
+		* rowid alias — exactly as `insert` and `insertMany` already treat it.
+		*
+		* Returns the id either way: the one SQLite assigned on an insert, or the
+		* one the row it updated already had. A caller cannot tell which happened,
+		* and deliberately — every caller wants the slot's id, and one that needed
+		* to distinguish creation from replacement would have to read first anyway.
+		*/
+		upsert: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			/** Declared columns identifying the slot; must be covered by a UNIQUE
+			*  index on the collection. Never empty. */
+			conflict: z.array(z.string()).readonly(),
+			record: BulkRecordSchema
+		}), z.object({ 
+		/** The id the row HAS: assigned by SQLite on an insert, or the existing
+		*  row's own id on an update. */
+id: z.union([z.string(), z.number()]) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* {@link upsert} for a BATCH, in ONE transaction on ONE prepared statement.
+		*
+		* The write-side twin of {@link insertMany} for rows that may already
+		* exist: a rollup writer recomputes a bucket and must overwrite it, and
+		* N round trips with N COMMITs is the cost {@link insertMany} was added to
+		* avoid. `conflict` has the meaning it has on {@link upsert} (declared
+		* columns covered by a UNIQUE index or the primary key, never empty).
+		*
+		* Every record of a batch must carry the SAME set of declared columns and
+		* every `conflict` column: one batch is one statement shape, and a record
+		* that silently bound NULL over a column it did not mention would erase
+		* it. A heterogeneous batch is refused whole. **All or nothing.**
+		*/
+		upsertMany: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			conflict: z.array(z.string()).readonly(),
+			records: z.array(BulkRecordSchema).readonly()
+		}), z.object({ upserted: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Insert a new record. */
+		insert: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			record: z.object({
+				id: z.string().optional(),
+				data: z.record(z.string(), z.unknown())
+			})
+		}), z.object({ 
+		/**
+		* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
+		* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
+		* primary key — which is the only place an auto key is knowable.
+		*/
+id: z.union([z.string(), z.number()]) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Insert MANY records in ONE transaction, returning how many landed.
+		*
+		* The write-side twin of {@link deleteWhere}, and it exists for the same
+		* reason: without it, appending a batch is N round trips and N COMMITs on
+		* the single shared connection that also serves every cluster-wide
+		* configuration read. The durable load series writes one process row per
+		* process per sample — 76 rows every 10 s on the live fleet — and the
+		* operator's rule for it is *one transaction per sample, never one per
+		* row*. `insert` cannot express that; nothing else could.
+		*
+		* **All or nothing.** A batch that fails on its fifth row leaves none of
+		* the five behind. A half-written sample is worse than a missing one: the
+		* missing one reads as "nobody reported", which is true, while the half
+		* one reads as "these were the only processes running", which is not.
+		*
+		* `id` is OPTIONAL per record, and that is the difference from
+		* {@link insert}. A collection whose primary key is an `INTEGER` rowid
+		* alias has no id to supply — SQLite assigns it, for free, and inventing a
+		* `randomUUID()` for such a column would write a 36-character string into
+		* an integer key. Omitted on a TEXT key, a uuid is generated exactly as
+		* `insert` does.
+		*/
+		insertMany: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			records: z.array(BulkRecordSchema).readonly()
+		}), z.object({ inserted: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Several writes, ONE transaction, behind an optional precondition.
+		*
+		* The multi-collection twin of {@link insertMany}: a write that has to move
+		* a set of rows in one collection AND a revision in another cannot be
+		* expressed as separate calls without a window in which a reader (or a
+		* crash) sees half of it. The retrain annotation save replaces a frame's
+		* rows, its dismissed set and its revision this way.
+		*
+		* `guard`, when given, is read inside the transaction: if the row is
+		* missing or its column differs from `equals`, NOTHING is written and the
+		* answer is `{ applied: false, current }` with what was found — the
+		* compare-and-set a revisioned write needs, with no second reader able to
+		* slip between the check and the writes.
+		*
+		* **All or nothing**, like {@link insertMany}: a throw in any op rolls the
+		* whole call back. Ops run in the order given (delete before insert to
+		* replace a set). `namespace` applies to every collection named.
+		*/
+		transact: method(z.object({
+			namespace: z.string().optional(),
+			guard: TransactGuardSchema.optional(),
+			ops: z.array(TransactOpSchema).readonly()
+		}), z.object({
+			applied: z.boolean(),
+			current: z.unknown().optional()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Update an existing record by ID. */
+		update: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			id: z.string(),
+			data: z.record(z.string(), z.unknown())
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Delete a record by key/ID. */
+		delete: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			key: z.string()
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Delete every record matching `filter`, in ONE statement, returning how
+		* many rows went. This exists because its absence made every retention
+		* path in the system an N+1 drain loop: `delete` takes a key, so a sweep
+		* had to SELECT a page of full rows — every column, including the fat
+		* ones — purely to learn their ids, then issue one call per row.
+		*
+		* **The filter is required and must resolve.** A predicate naming
+		* something the collection cannot express is an ERROR here, not a
+		* widening as it is on `query`, and a filter with no predicates is an
+		* error rather than "every row". Deleting a whole collection is a
+		* legitimate intent, but it must be asked for by name — not reached by
+		* an empty object.
+		*/
+		deleteWhere: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			filter: MutationFilterSchema
+		}), z.object({ deleted: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Apply `data` to every record matching `filter`, in one statement,
+		* returning how many rows changed. Same filter contract as
+		* {@link deleteWhere} — an unresolvable predicate is an error.
+		*/
+		updateWhere: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			filter: MutationFilterSchema,
+			data: z.record(z.string(), z.unknown())
+		}), z.object({ updated: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Count entries in a collection, optionally filtered. */
+		count: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			filter: QueryFilterSchema.optional()
+		}), z.number(), { auth: "admin" }),
+		/**
+		* `COUNT(*)` and one `SUM` / `MIN` / `MAX` per requested field, in ONE
+		* statement, over the rows `filter` selects.
+		*
+		* Exists because "how much is there" was being answered by materialising
+		* "what is there". The recorder's storage-pressure sweep asked its in-RAM
+		* footage index for bytes/count/oldest/newest across a set of storage
+		* locations twice a minute, and the only way to answer that from a map is
+		* to visit every row — 7.1 M of them on the live hub, ~15 M row visits a
+		* minute on the main thread, which is also why the whole archive had to
+		* stay resident to be visited. The question is a sum; nothing needs to be
+		* materialised to answer it.
+		*
+		* **The engine REFUSES a field it cannot serve**, exactly as
+		* `query.columns` does and unlike a PREDICATE, which is skipped when
+		* unresolvable. A dropped predicate over-matches and the caller sees extra
+		* rows; a dropped aggregate returns a NUMBER that is wrong and looks
+		* exactly like a real one. That asymmetry is what this repo has already
+		* paid for once in `count`.
+		*/
+		aggregate: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			fields: z.array(AggregateFieldSchema).readonly(),
+			filter: QueryFilterSchema.optional()
+		}), AggregateResultSchema, { auth: "admin" }),
+		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
+		histogram: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			field: z.string(),
+			bucketSize: z.number().int().positive(),
+			origin: z.number().int(),
+			filter: QueryFilterSchema.optional()
+		}), z.array(z.object({
+			bucket: z.number().int(),
+			count: z.number().int()
+		})).readonly(), { auth: "admin" }),
+		/** Check if a collection is empty. */
+		isEmpty: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string()
+		}), z.boolean(), { auth: "admin" }),
+		/**
+		* Declare a typed (SQL-backed) collection with explicit columns +
+		* indexes. Idempotent: re-declaring an existing collection with the
+		* same shape is a no-op; shape changes (new columns, new indexes)
+		* are applied additively. Subsequent `insert` / `update` / `delete`
+		* / `query` calls on this collection use typed columns instead of
+		* JSON-blob storage — `record.data` fields are spread across
+		* columns, `query.filter.where` matches real columns (no
+		* `json_extract` overhead), `orderBy` uses column indexes.
+		*
+		* Addons call this in `onInitialize` before their first read/write.
+		* Collection names should be namespaced by addon (e.g.
+		* `pipeline-analytics:object-events`) to avoid cross-addon
+		* clashes — no automatic prefix is added.
+		*/
+		declareCollection: method(DeclareCollectionInputSchema, z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
 * The suffix of a verified snapshot, written next to the live database it
 * copies: `<db>.backup-snapshot`. A restore promotes it back over `<db>`
 * (`server/backend/src/sqlite-restore.ts` spells the same string — the
@@ -10906,7 +11468,11 @@ var DATABASE_SNAPSHOT_TIMEOUT_MS = 30 * 6e4;
 * database has no sidecars and is just as owned). Paths are absolute on the
 * owner's host.
 */
-var DatabaseSnapshotTargetsSchema = z.object({ databases: z.array(z.object({ livePath: z.string() })) });
+var DatabaseSnapshotTargetsSchema = z.object({ databases: z.array(z.object({
+	/** Which owned file this is — the handle `writeSnapshot` takes. */
+	databaseId: DataStoreDatabaseSchema,
+	livePath: z.string()
+})) });
 /** One b-tree table of the snapshot and the rows it holds. */
 var DatabaseSnapshotTableSchema = z.object({
 	name: z.string(),
@@ -10939,6 +11505,10 @@ var DatabaseSnapshotResultSchema = z.object({
 	/** When the pinned read transaction began (ms epoch) — the snapshot's instant. */
 	takenAt: z.number()
 });
+/** A snapshot the owner wrote, with the file it belongs to. */
+var DatabaseSnapshotWrittenSchema = DatabaseSnapshotResultSchema.extend({ databaseId: DataStoreDatabaseSchema });
+/** Which database `writeSnapshot` copies. Required: an unstated ask is not guessed. */
+var DatabaseSnapshotRequestSchema = z.object({ databaseId: DataStoreDatabaseSchema });
 /**
 * A snapshot as an ARCHIVE records it (`ArchiveManifest.sqliteSnapshots`):
 * the same facts, with both paths relative to the archive root (the node's
@@ -10948,7 +11518,9 @@ var ArchiveSqliteSnapshotSchema = DatabaseSnapshotResultSchema.extend({
 	/** Archive-relative path of the live database the archive does NOT carry. */
 	livePath: z.string(),
 	/** Archive-relative path of the verified copy it carries in its place. */
-	snapshotPath: z.string()
+	snapshotPath: z.string(),
+	/** Absent on an archive made before several files were owned: that was `settings`. */
+	databaseId: DataStoreDatabaseSchema.optional()
 });
 /**
 * database-snapshot — the OWNER of a live SQLite database writes a consistent,
@@ -10973,17 +11545,21 @@ var databaseSnapshotCapability = {
 	internal: true,
 	methods: {
 		/**
-		* Which databases this owner snapshots. Answered from memory — no file is
-		* touched — so a backup can ask it before deciding anything.
+		* EVERY database file this owner has open, with its id. Answered from
+		* memory — no file is touched — so a backup can ask it before deciding
+		* anything. A file created at runtime is listed from the moment it opens,
+		* so no backup can leave it out (D693).
 		*/
 		listDatabases: method(z.object({}), DatabaseSnapshotTargetsSchema, { auth: "admin" }),
 		/**
-		* Write `<db>.backup-snapshot` and return what it holds. Throws — and
-		* leaves no file under the final name — when the copy fails
-		* `integrity_check` or its row counts differ from the pinned source's.
-		* A second call while one is running joins it.
+		* Write `<db>.backup-snapshot` for ONE database and return what it holds.
+		* Throws — and leaves no file under the final name — when the copy fails
+		* `integrity_check` or its row counts differ from the pinned source's, or
+		* when the database is not open. A second call for the SAME database while
+		* one is running joins it; different databases run one after the other
+		* (the disk reserve check is per copy).
 		*/
-		writeSnapshot: method(z.object({}), DatabaseSnapshotResultSchema, {
+		writeSnapshot: method(DatabaseSnapshotRequestSchema, DatabaseSnapshotWrittenSchema, {
 			kind: "mutation",
 			auth: "admin",
 			timeoutMs: DATABASE_SNAPSHOT_TIMEOUT_MS
@@ -11106,7 +11682,12 @@ var BackupArchiveEntrySchema = z.object({
 	/** Top-level locations included in the archive (db, addons, tls, …). */
 	locations: z.array(z.string()).readonly(),
 	/** Present when the archive is encrypted; restore then needs that key. */
-	encryption: BackupArchiveEncryptionSchema.optional()
+	encryption: BackupArchiveEncryptionSchema.optional(),
+	/**
+	* The databases the run asked to carry (its retention class). Absent on an
+	* archive made before several files were owned: that was `['settings']`.
+	*/
+	databases: z.array(DataStoreDatabaseSchema).readonly().optional()
 });
 var BackupEntrySchema = z.object({
 	id: z.string(),
@@ -11140,7 +11721,12 @@ var ArchiveManifestSchema = z.object({
 	* Live SQLite databases this archive carries as their OWNER's verified
 	* snapshot instead of as files (D693). Absent on archives made before.
 	*/
-	sqliteSnapshots: z.array(ArchiveSqliteSnapshotSchema).optional()
+	sqliteSnapshots: z.array(ArchiveSqliteSnapshotSchema).optional(),
+	/**
+	* Owned database files the run did NOT carry (not selected): left out of the
+	* tar and the entry list alike. Absent when every owned file was carried.
+	*/
+	omittedDatabases: z.array(DataStoreDatabaseSchema).optional()
 });
 var LocationStatSchema = z.object({
 	name: z.string(),
@@ -11262,6 +11848,12 @@ var BackupScheduleSchema = z.object({
 	/** Optional subset of source locations to include; omitted = all. */
 	dataSources: z.array(z.string()).readonly().optional(),
 	/**
+	* Which database files this schedule carries. Absent = `['settings']`
+	* (an unstated ask is the minimum, D382). Events and history run weekly,
+	* settings nightly (D852).
+	*/
+	databases: z.array(DataStoreDatabaseSchema).readonly().optional(),
+	/**
 	* ms-epoch of the last tick that FIRED this schedule. Stamped before the
 	* archive runs (it is the dedupe anchor), so it says "attempted", never
 	* "succeeded" — a run refused by every destination stamps it too.
@@ -11313,7 +11905,9 @@ var backupCapability = {
 			* retention). Omitted = each destination's own policy
 			* retention (manual runs).
 			*/
-			retentionCount: z.number().int().min(1).max(1e3).optional()
+			retentionCount: z.number().int().min(1).max(1e3).optional(),
+			/** Database files to carry; omitted = `['settings']`. */
+			databases: z.array(DataStoreDatabaseSchema).optional()
 		}).optional(), BackupTriggerResultSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -11483,7 +12077,8 @@ var backupCapability = {
 			enabled: z.boolean(),
 			locationIds: z.array(z.string()).readonly(),
 			retentionCount: z.number().int().min(1).max(1e3),
-			dataSources: z.array(z.string()).readonly().optional()
+			dataSources: z.array(z.string()).readonly().optional(),
+			databases: z.array(DataStoreDatabaseSchema).readonly().optional()
 		}), BackupScheduleSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -14776,776 +15371,277 @@ var CoreBlockCompileResultSchema = z.object({
 * Compile input: legacy single-file `{ code }`, or a multi-file project.
 * When `files` is present, it wins over `code`.
 */
-var CoreBlockCompileInputSchema = z.object({
-	code: z.string().optional(),
-	files: CoreBlockFilesSchema.optional(),
-	entry: z.string().min(1).max(260).optional()
-}).superRefine((val, ctx) => {
-	if (val.files !== void 0) {
-		const entry = val.entry ?? "main.ts";
-		if (val.files[entry] === void 0) ctx.addIssue({
-			code: "custom",
-			message: `files must include the entry "${entry}"`,
-			path: ["files"]
-		});
-		return;
-	}
-	if (val.code === void 0) ctx.addIssue({
-		code: "custom",
-		message: "code or files is required",
-		path: ["code"]
-	});
-});
-var coreBlocksCapability = {
-	name: "core-blocks",
-	scope: "system",
-	mode: "singleton",
-	methods: {
-		list: method(z.object({}), z.object({ blocks: z.array(CoreBlockSchema) }), { auth: "admin" }),
-		get: method(z.object({ blockId: z.string() }), z.object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }),
-		/**
-		* Create a block. The code is COMPILED first: storing source that does not
-		* compile turns an editor error into a fork failure the operator meets
-		* minutes later in a log.
-		*/
-		create: method(z.object({ block: CoreBlockInputSchema }), z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		update: method(z.object({
-			blockId: z.string(),
-			block: CoreBlockInputFieldsSchema.partial()
-		}), z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		delete: method(z.object({ blockId: z.string() }), z.object({ success: z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		setEnabled: method(z.object({
-			blockId: z.string(),
-			enabled: z.boolean()
-		}), z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Stop this block's runner and let the supervisor bring it back.
-		*
-		* **It stores nothing.** There is no "restart requested" flag and no second
-		* lifecycle field: the supervisor already stops and respawns a runner when
-		* the code hash changes, and this exposes that same path deliberately
-		* (D62 — a switch writes the authority that already owned the function).
-		* The next reconcile pass remains the authority, so a restart that lost a
-		* race is corrected within one pass rather than leaving a stale flag behind.
-		*
-		* Refused for a DISABLED block: nothing would come back, and a button that
-		* silently does nothing is worse than one that says why.
-		*/
-		restart: method(z.object({ blockId: z.string() }), z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Type-check without saving — what the editor calls as the author types, so
-		* the compiler's verdict is the same one the server will reach.
-		* Accepts `{ code }` or `{ files, entry }` (multi-file project).
-		*/
-		compile: method(CoreBlockCompileInputSchema, CoreBlockCompileResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Hydrated settings form for one block, or null until a `settingsSchema`
-		* is known (extracted from the compiled entry's named export, or set on
-		* the block). Values live in the `core-blocks:settings` collection.
-		*/
-		getBlockSettings: method(z.object({ blockId: z.string() }), SettingsSchemaWithValuesSchema.nullable(), { auth: "admin" }),
-		/**
-		* Patch persisted preference values for one block. The schema is not
-		* rewritten here — only values. Scripts read the same blob via
-		* `ctx.settings.readAddonStore()` (mirrored into the block addon's
-		* `addon-settings` namespace on every patch).
-		*/
-		updateBlockSettings: method(z.object({
-			blockId: z.string(),
-			patch: SettingsPatchSchema
-		}), SettingsUpdateResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* The declaration files the editor type-checks against.
-		*
-		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
-		* bundling it would roughly double the admin remote. Served rather than
-		* hand-stubbed: a block runs with the same `ctx` an addon gets, so a stub
-		* would drift and the editor would confidently autocomplete methods that
-		* do not exist.
-		*/
-		getTypeDefs: method(z.object({}), z.object({ libs: z.array(z.object({
-			filePath: z.string(),
-			content: z.string()
-		})) }), { auth: "admin" }),
-		/**
-		* Create a composition block (D659). VALIDATED first against the live
-		* sources and every stored composition; a refusal names every problem by
-		* path and reason (D391) and stores nothing.
-		*/
-		createComposition: method(z.object({ block: CompositionBlockInputSchema }), z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		/**
-		* Patch a composition block. A changed `composition` is validated exactly
-		* as on create. `expectedUpdatedAt` is the `updatedAt` the caller READ: a
-		* block changed since is refused by name, never silently overwritten.
-		*/
-		updateComposition: method(z.object({
-			blockId: z.string(),
-			expectedUpdatedAt: z.number(),
-			block: CompositionBlockInputSchema.partial()
-		}), z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		/** One composition and the composer's state for it, or `not-loaded` (D315). */
-		getComposition: method(z.object({ blockId: z.string() }), CompositionGetReadSchema, { auth: "admin" }),
-		listCompositions: method(z.object({}), CompositionListReadSchema, { auth: "admin" }),
-		/**
-		* The composition that customizes an existing device (D663), found by its
-		* TARGET — never by the block's derived name. One per device at most.
-		*/
-		getCustomization: method(z.object({
-			addonId: z.string().min(1),
-			stableId: z.string().min(1)
-		}), CompositionCustomizationReadSchema, { auth: "admin" }),
-		/**
-		* The capabilities a composition may BUILD on a device of `deviceType`
-		* (a new device, or added to an existing one), with their fields — the
-		* editor's feature list and the presets' availability (G2, D676). Built
-		* from the validator's own blockers; a replace of a BOUND cap is not
-		* listed here (the device's bindings say what it has).
-		*/
-		listComposableCaps: method(z.object({ deviceType: z.enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }),
-		/**
-		* Validate without saving — the same verdict the save reaches. A mutation
-		* for its body size; it writes nothing, so its access is `view`.
-		*/
-		validateComposition: method(z.object({
-			composition: CompositionSchema,
-			blockId: z.string().optional()
-		}), CompositionValidationSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "view"
-		})
-	}
-};
-/**
-* `custom-model-registry` — collection cap exposing operator-registered
-* custom detection models. Each provider (today: `addon-model-studio`)
-* contributes a list of `CustomModelDescriptor`s; the hub auto-concatenates
-* them across providers (`concatCollection`).
-*
-* The detection-pipeline is *aware* of this cap: when at least one provider
-* exists it unions these descriptors into the per-step model picker and the
-* runtime model-resolution path, alongside the static catalog. When no
-* provider exists the consumer no-ops entirely (identical to the catalog-only
-* behaviour).
-*
-* A descriptor carries a full `ModelCatalogEntry` directly — the same shape
-* the static catalog uses — so the existing download/resolution code consumes
-* it unchanged. `stepId` is the detection step the model targets
-* (e.g. `'object-detection'`).
-*/
-var CustomModelDescriptorSchema = z.object({
-	stepId: z.string(),
-	entry: ModelCatalogEntrySchema
-});
-/** One regular file of an imported bundle, as the producer measured it. */
-var ModelBundleFileSchema = z.object({
-	/** Relative path inside the bundle tar; an mlpackage member is `<x>.mlpackage/<member>`. */
-	path: z.string().min(1),
-	bytes: z.number().int().nonnegative(),
-	sha256: z.string().regex(/^[0-9a-f]{64}$/)
-});
-var ImportModelBundleInputSchema = z.object({
-	/** The registry provider that keeps the model (Model Studio). */
-	addonId: z.string(),
-	stepId: z.string().min(1),
-	/**
-	* The catalog rows to register, complete, every format URL already
-	* `camstack-local://<modelId>/<file>` naming a file of the bundle. One
-	* bundle may carry several rows (a base and its INT8 variant).
-	*/
-	entries: z.array(ModelCatalogEntrySchema).min(1).max(4),
-	/** The bundle tar, offered by the producer over `ctx.peerBytes` (same host). */
-	bundle: z.object({
-		ticket: PeerBytesTicketSchema,
-		bytes: z.number().int().positive(),
-		sha256: z.string().regex(/^[0-9a-f]{64}$/)
-	}),
-	/** Every file the tar must hold; anything missing, extra or different is refused. */
-	files: z.array(ModelBundleFileSchema).min(1).max(64),
-	/** Convert missing engine formats and push the model to every agent afterwards. */
-	distribute: z.boolean()
-});
-var ImportModelBundleResultSchema = z.discriminatedUnion("kind", [z.object({
-	kind: z.literal("imported"),
-	modelIds: z.array(z.string()).readonly(),
-	distributed: z.array(z.object({
-		modelId: z.string(),
-		nodeId: z.string(),
-		format: z.enum(MODEL_FORMATS),
-		ok: z.boolean(),
-		error: z.string().optional()
-	})).readonly()
-}), z.object({
-	kind: z.literal("refused"),
-	reason: z.enum([
-		"transfer-failed",
-		"checksum-mismatch",
-		"bundle-mismatch",
-		"invalid-entry",
-		"id-taken"
-	]),
-	detail: z.string()
-})]);
-var customModelRegistryCapability = {
-	name: "custom-model-registry",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: {
-		/**
-		* `internal: true` did not gate the mount (see the 2026-08-26 note on
-		* `data-store-provider`) — this was reachable on the AppRouter by ANY
-		* authenticated session at the default `auth: 'protected'`. The only
-		* consumer, the detection-pipeline's model resolution
-		* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
-		* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
-		* never tRPC — so `auth: 'admin'` costs it nothing.
-		*/
-		listModels: method(z.void(), z.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }),
-		/**
-		* Register a model whose files arrive as ONE bundle tar (D806): the tar
-		* is taken over `ctx.peerBytes`, checked against `bundle.sha256` and
-		* every row of `files`, unpacked into the hub's flat modelsDir (directory
-		* formats included), each format's `.revision` record written, the rows
-		* upserted under the operator's name, the hub marked available and —
-		* when asked — engine formats converted and the model distributed. A
-		* model id already registered by another source is refused, never
-		* overwritten.
-		*/
-		importModelBundle: method(ImportModelBundleInputSchema, ImportModelBundleResultSchema, {
-			kind: "mutation",
-			auth: "admin",
-			timeoutMs: 30 * 6e4
-		})
-	}
-};
-/**
-* Query filter for settings-store collections.
-*/
-var QueryFilterSchema = z.object({
-	where: z.record(z.string(), z.unknown()).optional(),
-	whereIn: z.record(z.string(), z.array(z.unknown())).optional(),
-	whereBetween: z.record(z.string(), z.tuple([z.unknown(), z.unknown()])).optional(),
-	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
-	whereNot: z.record(z.string(), z.unknown()).optional(),
-	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
-	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
-	whereNotIn: z.record(z.string(), z.array(z.unknown())).optional(),
-	orderBy: z.object({
-		field: z.string(),
-		direction: z.enum(["asc", "desc"])
-	}).optional(),
-	limit: z.number().optional(),
-	offset: z.number().optional()
-});
-/**
-* The predicate half of a filter, for BULK MUTATIONS.
-*
-* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
-* meaning for a statement that rewrites a set, and accepting them would invite
-* a caller to believe `limit` bounds the damage. Every field is optional here
-* only so the shape stays composable — the implementation REJECTS a filter
-* that compiles to no predicate, because that is the whole collection.
-*/
-var MutationFilterSchema = z.object({
-	where: z.record(z.string(), z.unknown()).optional(),
-	whereIn: z.record(z.string(), z.array(z.unknown())).optional(),
-	whereBetween: z.record(z.string(), z.tuple([z.unknown(), z.unknown()])).optional(),
-	whereNot: z.record(z.string(), z.unknown()).optional(),
-	whereNotIn: z.record(z.string(), z.array(z.unknown())).optional()
-});
-/**
-* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
-*
-* `as` names the slot in the result, so the SAME column may be asked twice with
-* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
-* a `Record<column, op>` shape could not express.
-*/
-var AggregateFieldSchema = z.object({
-	/** Result key. */
-	as: z.string().min(1),
-	/** Column to aggregate. Must be a real column of a declared collection. */
-	field: z.string().min(1),
-	op: z.enum([
-		"sum",
-		"min",
-		"max"
-	])
-});
-/**
-* `COUNT(*)` plus one number per requested field.
-*
-* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
-* that really is 0 are different facts, and an accounting caller that renders
-* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
-*/
-var AggregateResultSchema = z.object({
-	count: z.number().int(),
-	values: z.record(z.string(), z.number().nullable())
-});
-/** A single stored record: `{ id, data }`. */
-var SettingsRecordSchema = z.object({
-	id: z.string(),
-	data: z.record(z.string(), z.unknown())
-});
-/**
-* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
-* optional.
-*
-* A separate schema rather than loosening the shared one: every other method
-* on this cap addresses a row BY its id, and making that field optional
-* everywhere would turn a forgotten key into a silently generated one on
-* `update` and `delete` as well.
-*/
-var BulkRecordSchema = z.object({
-	id: z.string().optional(),
-	data: z.record(z.string(), z.unknown())
-});
-/**
-* One write inside a {@link settingsStoreCapability.methods.transact} call.
-* Only the three that a "replace this set, bump that revision" write needs.
-*/
-var TransactOpSchema = z.discriminatedUnion("op", [
-	z.object({
-		op: z.literal("deleteWhere"),
-		collection: z.string(),
-		filter: MutationFilterSchema
-	}),
-	z.object({
-		op: z.literal("insertMany"),
-		collection: z.string(),
-		records: z.array(BulkRecordSchema).readonly()
-	}),
-	z.object({
-		op: z.literal("update"),
-		collection: z.string(),
-		id: z.string(),
-		data: z.record(z.string(), z.unknown())
-	})
-]);
-/**
-* The precondition of a transaction: the row `key` of `collection` must hold
-* `equals` in `column`, read INSIDE the transaction.
-*/
-var TransactGuardSchema = z.object({
-	collection: z.string(),
-	key: z.string(),
-	column: z.string(),
-	equals: z.unknown()
-});
-/**
-* Column declaration for a structured (SQL-backed) collection.
-*
-* Logical types — the backend translates each to the matching SQLite
-* storage class and handles per-type marshaling:
-*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
-*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
-*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
-*/
-var CollectionColumnSchema = z.object({
-	name: z.string(),
-	type: z.enum([
-		"TEXT",
-		"INTEGER",
-		"REAL",
-		"JSON",
-		"BOOLEAN"
-	]),
-	primaryKey: z.boolean().optional(),
-	notNull: z.boolean().optional(),
-	unique: z.boolean().optional(),
-	/**
-	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
-	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
-	* collection surface simply cannot express their existing tables — which is
-	* why they were still on the uncapped `table*` API.
-	*/
-	defaultValue: z.union([
-		z.string(),
-		z.number(),
-		z.boolean()
-	]).optional()
-});
-var CollectionIndexSchema = z.object({
-	name: z.string(),
-	columns: z.array(z.string()).readonly(),
-	unique: z.boolean().optional()
-});
-/**
-* settings-store — singleton capability for addon-scoped persistence.
-*
-* Every method operates within a `collection`. An optional `namespace`
-* field provides access to additional data spaces beyond the default
-* addon settings — useful for business data (events, tracks, faces, etc.).
-*
-* **Scoping is the CALLER's, and it is opt-in.** The table is
-* `namespace ? `${namespace}:${collection}` : collection` — nothing
-* consults the identity of the caller. An earlier version of this comment
-* claimed the implementation prefixes every collection with the calling
-* addon's ID and that "addons never see each other's data"; that was never
-* true, and this same file contradicted it under `declareCollection`. What
-* exists is `addon-context-factory`, which passes `namespace: addonId` ON
-* THE ADDON'S BEHALF for the `addon-settings` / `addon-devices` paths only.
-* Business collections use bare names, and any caller may name any
-* namespace, or none. Making the door enforce it is tracked separately —
-* it renames tables, so it needs a migration.
-*
-* **So every method is `auth: 'admin'` (D634).** Because nothing scopes a
-* call to its caller, a `protected` method here was a raw, unredacted read
-* (and write) of every addon's collections for any role holding
-* `category:system` — which is every role: a `viewer` could read every
-* notifier token in plaintext from `notifiers:notification-targets`. No
-* browser or app client calls this cap. Addons are not affected: an
-* addon's `ctx.api` cap call is resolved to the provider directly and never
-* enters the tRPC router (so the tier gates sessions and tokens, never
-* addons), and the hub itself calls it through the capability registry.
-*
-*   - `{ collection: 'addon-settings' }` → table `addon-settings`
-*   - `{ namespace: 'my-addon', collection: 'addon-settings' }` →
-*     table `my-addon:addon-settings`
-*
-* Served by the **storage-orchestrator** builtin, which dispatches to the
-* `data-store-provider` engine registered for the collection
-* (`sqlite-settings`, a SQLite WAL backend, today). One addon owns the
-* data door; engines sit behind it
-* ([D44](../../../../docs/decisions/adr-0044.md)).
-* Addons access it via `ctx.api.settingsStore.*`.
-*/
-var settingsStoreCapability = {
-	name: "settings-store",
+var CoreBlockCompileInputSchema = z.object({
+	code: z.string().optional(),
+	files: CoreBlockFilesSchema.optional(),
+	entry: z.string().min(1).max(260).optional()
+}).superRefine((val, ctx) => {
+	if (val.files !== void 0) {
+		const entry = val.entry ?? "main.ts";
+		if (val.files[entry] === void 0) ctx.addIssue({
+			code: "custom",
+			message: `files must include the entry "${entry}"`,
+			path: ["files"]
+		});
+		return;
+	}
+	if (val.code === void 0) ctx.addIssue({
+		code: "custom",
+		message: "code or files is required",
+		path: ["code"]
+	});
+});
+var coreBlocksCapability = {
+	name: "core-blocks",
 	scope: "system",
 	mode: "singleton",
 	methods: {
-		/** Get a single value by key from a collection. */
-		get: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			key: z.string()
-		}), z.unknown(), { auth: "admin" }),
-		/** Set a value by key in a collection (upsert). */
-		set: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			key: z.string(),
-			value: z.unknown()
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Rows matching a filter.
-		*
-		* `columns` is a SQL-level projection: the engine SELECTs only those
-		* columns (plus the primary key) instead of the whole row. It is the only
-		* way to stop paying disk for a column that is discarded — a heavy JSON
-		* column dominates the row, and dropping it in JS after the read pays every
-		* byte first. Measured on the live `pipeline-analytics:tracks` table: a
-		* 501-row page is 4.6 MB whole and 0.11 MB projected, same index, same
-		* plan.
-		*
-		* The engine REFUSES a column it cannot serve rather than omitting it —
-		* see `SettingsQueryInput.columns` for why a projection may not be
-		* forgiving the way a predicate is.
-		*/
-		query: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			filter: QueryFilterSchema.optional(),
-			columns: z.array(z.string()).readonly().optional()
-		}), z.array(SettingsRecordSchema).readonly(), { auth: "admin" }),
+		list: method(z.object({}), z.object({ blocks: z.array(CoreBlockSchema) }), { auth: "admin" }),
+		get: method(z.object({ blockId: z.string() }), z.object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }),
 		/**
-		* Make a SLOT hold this row — insert it, or update whatever already
-		* occupies the slot — and answer with the id the row HAS.
-		*
-		* ## Why the store needed this
-		*
-		* {@link set} is already an upsert, but its slot is the PRIMARY KEY: the
-		* caller has to know the id to address the row. That is exactly what a
-		* collection keyed by an `INTEGER` rowid alias cannot do — SQLite assigns
-		* the id, so a writer whose uniqueness rule is "one row per
-		* `(ownerKind, ownerId, kind, slot)`" has no id to name and no way to
-		* express the rule. {@link insert} can express it (a UNIQUE index
-		* arbitrates) but only by THROWING at the loser of a race, and the loser
-		* here is a legitimate re-capture, not an error.
-		*
-		* Getting there without this method means read-then-write: query the slot,
-		* then `insert` or `update`. Two statements instead of one, a race between
-		* them, and a recovery path that has to recognise a UNIQUE violation by its
-		* MESSAGE — across a process boundary, because the store lives behind an
-		* RPC door. A string match would be the whole gate, and a store that
-		* rephrased its error would lose the row silently. One statement has no
-		* such gate (D482).
-		*
-		* ## The contract
-		*
-		* `conflict` names the DECLARED columns that identify the slot. They must
-		* be covered by a UNIQUE index on the collection — SQLite resolves an
-		* `ON CONFLICT` target against its indexes and REFUSES the statement when
-		* none matches, so a wrong list is a loud error on the first write, never a
-		* silently duplicated row. An empty list is refused rather than passed on:
-		* `ON CONFLICT()` is not valid SQL, and the intent it would most likely
-		* encode ("no slot, just insert") is {@link insert}.
-		*
-		* Row shape is {@link insert}'s: `record.id` is used when the collection
-		* needs a supplied key and IGNORED when the primary key is an `INTEGER`
-		* rowid alias — exactly as `insert` and `insertMany` already treat it.
-		*
-		* Returns the id either way: the one SQLite assigned on an insert, or the
-		* one the row it updated already had. A caller cannot tell which happened,
-		* and deliberately — every caller wants the slot's id, and one that needed
-		* to distinguish creation from replacement would have to read first anyway.
+		* Create a block. The code is COMPILED first: storing source that does not
+		* compile turns an editor error into a fork failure the operator meets
+		* minutes later in a log.
 		*/
-		upsert: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			/** Declared columns identifying the slot; must be covered by a UNIQUE
-			*  index on the collection. Never empty. */
-			conflict: z.array(z.string()).readonly(),
-			record: BulkRecordSchema
-		}), z.object({ 
-		/** The id the row HAS: assigned by SQLite on an insert, or the existing
-		*  row's own id on an update. */
-id: z.union([z.string(), z.number()]) }), {
+		create: method(z.object({ block: CoreBlockInputSchema }), z.object({ block: CoreBlockSchema }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "admin",
+			caller: "required"
 		}),
-		/** Insert a new record. */
-		insert: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			record: z.object({
-				id: z.string().optional(),
-				data: z.record(z.string(), z.unknown())
-			})
-		}), z.object({ 
-		/**
-		* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
-		* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
-		* primary key — which is the only place an auto key is knowable.
-		*/
-id: z.union([z.string(), z.number()]) }), {
+		update: method(z.object({
+			blockId: z.string(),
+			block: CoreBlockInputFieldsSchema.partial()
+		}), z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		delete: method(z.object({ blockId: z.string() }), z.object({ success: z.literal(true) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/**
-		* Insert MANY records in ONE transaction, returning how many landed.
-		*
-		* The write-side twin of {@link deleteWhere}, and it exists for the same
-		* reason: without it, appending a batch is N round trips and N COMMITs on
-		* the single shared connection that also serves every cluster-wide
-		* configuration read. The durable load series writes one process row per
-		* process per sample — 76 rows every 10 s on the live fleet — and the
-		* operator's rule for it is *one transaction per sample, never one per
-		* row*. `insert` cannot express that; nothing else could.
-		*
-		* **All or nothing.** A batch that fails on its fifth row leaves none of
-		* the five behind. A half-written sample is worse than a missing one: the
-		* missing one reads as "nobody reported", which is true, while the half
-		* one reads as "these were the only processes running", which is not.
-		*
-		* `id` is OPTIONAL per record, and that is the difference from
-		* {@link insert}. A collection whose primary key is an `INTEGER` rowid
-		* alias has no id to supply — SQLite assigns it, for free, and inventing a
-		* `randomUUID()` for such a column would write a 36-character string into
-		* an integer key. Omitted on a TEXT key, a uuid is generated exactly as
-		* `insert` does.
-		*/
-		insertMany: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			records: z.array(BulkRecordSchema).readonly()
-		}), z.object({ inserted: z.number().int() }), {
+		setEnabled: method(z.object({
+			blockId: z.string(),
+			enabled: z.boolean()
+		}), z.object({ block: CoreBlockSchema }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
 		/**
-		* Several writes, ONE transaction, behind an optional precondition.
-		*
-		* The multi-collection twin of {@link insertMany}: a write that has to move
-		* a set of rows in one collection AND a revision in another cannot be
-		* expressed as separate calls without a window in which a reader (or a
-		* crash) sees half of it. The retrain annotation save replaces a frame's
-		* rows, its dismissed set and its revision this way.
+		* Stop this block's runner and let the supervisor bring it back.
 		*
-		* `guard`, when given, is read inside the transaction: if the row is
-		* missing or its column differs from `equals`, NOTHING is written and the
-		* answer is `{ applied: false, current }` with what was found — the
-		* compare-and-set a revisioned write needs, with no second reader able to
-		* slip between the check and the writes.
+		* **It stores nothing.** There is no "restart requested" flag and no second
+		* lifecycle field: the supervisor already stops and respawns a runner when
+		* the code hash changes, and this exposes that same path deliberately
+		* (D62 — a switch writes the authority that already owned the function).
+		* The next reconcile pass remains the authority, so a restart that lost a
+		* race is corrected within one pass rather than leaving a stale flag behind.
 		*
-		* **All or nothing**, like {@link insertMany}: a throw in any op rolls the
-		* whole call back. Ops run in the order given (delete before insert to
-		* replace a set). `namespace` applies to every collection named.
+		* Refused for a DISABLED block: nothing would come back, and a button that
+		* silently does nothing is worse than one that says why.
 		*/
-		transact: method(z.object({
-			namespace: z.string().optional(),
-			guard: TransactGuardSchema.optional(),
-			ops: z.array(TransactOpSchema).readonly()
-		}), z.object({
-			applied: z.boolean(),
-			current: z.unknown().optional()
-		}), {
+		restart: method(z.object({ blockId: z.string() }), z.object({ block: CoreBlockSchema }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Update an existing record by ID. */
-		update: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			id: z.string(),
-			data: z.record(z.string(), z.unknown())
-		}), z.void(), {
+		/**
+		* Type-check without saving — what the editor calls as the author types, so
+		* the compiler's verdict is the same one the server will reach.
+		* Accepts `{ code }` or `{ files, entry }` (multi-file project).
+		*/
+		compile: method(CoreBlockCompileInputSchema, CoreBlockCompileResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Delete a record by key/ID. */
-		delete: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			key: z.string()
-		}), z.void(), {
+		/**
+		* Hydrated settings form for one block, or null until a `settingsSchema`
+		* is known (extracted from the compiled entry's named export, or set on
+		* the block). Values live in the `core-blocks:settings` collection.
+		*/
+		getBlockSettings: method(z.object({ blockId: z.string() }), SettingsSchemaWithValuesSchema.nullable(), { auth: "admin" }),
+		/**
+		* Patch persisted preference values for one block. The schema is not
+		* rewritten here — only values. Scripts read the same blob via
+		* `ctx.settings.readAddonStore()` (mirrored into the block addon's
+		* `addon-settings` namespace on every patch).
+		*/
+		updateBlockSettings: method(z.object({
+			blockId: z.string(),
+			patch: SettingsPatchSchema
+		}), SettingsUpdateResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
 		/**
-		* Delete every record matching `filter`, in ONE statement, returning how
-		* many rows went. This exists because its absence made every retention
-		* path in the system an N+1 drain loop: `delete` takes a key, so a sweep
-		* had to SELECT a page of full rows — every column, including the fat
-		* ones — purely to learn their ids, then issue one call per row.
+		* The declaration files the editor type-checks against.
 		*
-		* **The filter is required and must resolve.** A predicate naming
-		* something the collection cannot express is an ERROR here, not a
-		* widening as it is on `query`, and a filter with no predicates is an
-		* error rather than "every row". Deleting a whole collection is a
-		* legitimate intent, but it must be asked for by name — not reached by
-		* an empty object.
+		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
+		* bundling it would roughly double the admin remote. Served rather than
+		* hand-stubbed: a block runs with the same `ctx` an addon gets, so a stub
+		* would drift and the editor would confidently autocomplete methods that
+		* do not exist.
 		*/
-		deleteWhere: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			filter: MutationFilterSchema
-		}), z.object({ deleted: z.number().int() }), {
+		getTypeDefs: method(z.object({}), z.object({ libs: z.array(z.object({
+			filePath: z.string(),
+			content: z.string()
+		})) }), { auth: "admin" }),
+		/**
+		* Create a composition block (D659). VALIDATED first against the live
+		* sources and every stored composition; a refusal names every problem by
+		* path and reason (D391) and stores nothing.
+		*/
+		createComposition: method(z.object({ block: CompositionBlockInputSchema }), z.object({ block: CoreBlockSchema }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "admin",
+			caller: "required"
 		}),
 		/**
-		* Apply `data` to every record matching `filter`, in one statement,
-		* returning how many rows changed. Same filter contract as
-		* {@link deleteWhere} — an unresolvable predicate is an error.
+		* Patch a composition block. A changed `composition` is validated exactly
+		* as on create. `expectedUpdatedAt` is the `updatedAt` the caller READ: a
+		* block changed since is refused by name, never silently overwritten.
 		*/
-		updateWhere: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			filter: MutationFilterSchema,
-			data: z.record(z.string(), z.unknown())
-		}), z.object({ updated: z.number().int() }), {
+		updateComposition: method(z.object({
+			blockId: z.string(),
+			expectedUpdatedAt: z.number(),
+			block: CompositionBlockInputSchema.partial()
+		}), z.object({ block: CoreBlockSchema }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "admin",
+			caller: "required"
 		}),
-		/** Count entries in a collection, optionally filtered. */
-		count: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			filter: QueryFilterSchema.optional()
-		}), z.number(), { auth: "admin" }),
+		/** One composition and the composer's state for it, or `not-loaded` (D315). */
+		getComposition: method(z.object({ blockId: z.string() }), CompositionGetReadSchema, { auth: "admin" }),
+		listCompositions: method(z.object({}), CompositionListReadSchema, { auth: "admin" }),
 		/**
-		* `COUNT(*)` and one `SUM` / `MIN` / `MAX` per requested field, in ONE
-		* statement, over the rows `filter` selects.
-		*
-		* Exists because "how much is there" was being answered by materialising
-		* "what is there". The recorder's storage-pressure sweep asked its in-RAM
-		* footage index for bytes/count/oldest/newest across a set of storage
-		* locations twice a minute, and the only way to answer that from a map is
-		* to visit every row — 7.1 M of them on the live hub, ~15 M row visits a
-		* minute on the main thread, which is also why the whole archive had to
-		* stay resident to be visited. The question is a sum; nothing needs to be
-		* materialised to answer it.
-		*
-		* **The engine REFUSES a field it cannot serve**, exactly as
-		* `query.columns` does and unlike a PREDICATE, which is skipped when
-		* unresolvable. A dropped predicate over-matches and the caller sees extra
-		* rows; a dropped aggregate returns a NUMBER that is wrong and looks
-		* exactly like a real one. That asymmetry is what this repo has already
-		* paid for once in `count`.
+		* The composition that customizes an existing device (D663), found by its
+		* TARGET — never by the block's derived name. One per device at most.
 		*/
-		aggregate: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			fields: z.array(AggregateFieldSchema).readonly(),
-			filter: QueryFilterSchema.optional()
-		}), AggregateResultSchema, { auth: "admin" }),
-		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
-		histogram: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			field: z.string(),
-			bucketSize: z.number().int().positive(),
-			origin: z.number().int(),
-			filter: QueryFilterSchema.optional()
-		}), z.array(z.object({
-			bucket: z.number().int(),
-			count: z.number().int()
-		})).readonly(), { auth: "admin" }),
-		/** Check if a collection is empty. */
-		isEmpty: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string()
-		}), z.boolean(), { auth: "admin" }),
+		getCustomization: method(z.object({
+			addonId: z.string().min(1),
+			stableId: z.string().min(1)
+		}), CompositionCustomizationReadSchema, { auth: "admin" }),
 		/**
-		* Declare a typed (SQL-backed) collection with explicit columns +
-		* indexes. Idempotent: re-declaring an existing collection with the
-		* same shape is a no-op; shape changes (new columns, new indexes)
-		* are applied additively. Subsequent `insert` / `update` / `delete`
-		* / `query` calls on this collection use typed columns instead of
-		* JSON-blob storage — `record.data` fields are spread across
-		* columns, `query.filter.where` matches real columns (no
-		* `json_extract` overhead), `orderBy` uses column indexes.
-		*
-		* Addons call this in `onInitialize` before their first read/write.
-		* Collection names should be namespaced by addon (e.g.
-		* `pipeline-analytics:object-events`) to avoid cross-addon
-		* clashes — no automatic prefix is added.
+		* The capabilities a composition may BUILD on a device of `deviceType`
+		* (a new device, or added to an existing one), with their fields — the
+		* editor's feature list and the presets' availability (G2, D676). Built
+		* from the validator's own blockers; a replace of a BOUND cap is not
+		* listed here (the device's bindings say what it has).
 		*/
-		declareCollection: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			columns: z.array(CollectionColumnSchema).readonly(),
-			indexes: z.array(CollectionIndexSchema).readonly().optional()
-		}), z.void(), {
+		listComposableCaps: method(z.object({ deviceType: z.enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }),
+		/**
+		* Validate without saving — the same verdict the save reaches. A mutation
+		* for its body size; it writes nothing, so its access is `view`.
+		*/
+		validateComposition: method(z.object({
+			composition: CompositionSchema,
+			blockId: z.string().optional()
+		}), CompositionValidationSchema, {
 			kind: "mutation",
-			auth: "admin"
+			auth: "admin",
+			access: "view"
+		})
+	}
+};
+/**
+* `custom-model-registry` — collection cap exposing operator-registered
+* custom detection models. Each provider (today: `addon-model-studio`)
+* contributes a list of `CustomModelDescriptor`s; the hub auto-concatenates
+* them across providers (`concatCollection`).
+*
+* The detection-pipeline is *aware* of this cap: when at least one provider
+* exists it unions these descriptors into the per-step model picker and the
+* runtime model-resolution path, alongside the static catalog. When no
+* provider exists the consumer no-ops entirely (identical to the catalog-only
+* behaviour).
+*
+* A descriptor carries a full `ModelCatalogEntry` directly — the same shape
+* the static catalog uses — so the existing download/resolution code consumes
+* it unchanged. `stepId` is the detection step the model targets
+* (e.g. `'object-detection'`).
+*/
+var CustomModelDescriptorSchema = z.object({
+	stepId: z.string(),
+	entry: ModelCatalogEntrySchema
+});
+/** One regular file of an imported bundle, as the producer measured it. */
+var ModelBundleFileSchema = z.object({
+	/** Relative path inside the bundle tar; an mlpackage member is `<x>.mlpackage/<member>`. */
+	path: z.string().min(1),
+	bytes: z.number().int().nonnegative(),
+	sha256: z.string().regex(/^[0-9a-f]{64}$/)
+});
+var ImportModelBundleInputSchema = z.object({
+	/** The registry provider that keeps the model (Model Studio). */
+	addonId: z.string(),
+	stepId: z.string().min(1),
+	/**
+	* The catalog rows to register, complete, every format URL already
+	* `camstack-local://<modelId>/<file>` naming a file of the bundle. One
+	* bundle may carry several rows (a base and its INT8 variant).
+	*/
+	entries: z.array(ModelCatalogEntrySchema).min(1).max(4),
+	/** The bundle tar, offered by the producer over `ctx.peerBytes` (same host). */
+	bundle: z.object({
+		ticket: PeerBytesTicketSchema,
+		bytes: z.number().int().positive(),
+		sha256: z.string().regex(/^[0-9a-f]{64}$/)
+	}),
+	/** Every file the tar must hold; anything missing, extra or different is refused. */
+	files: z.array(ModelBundleFileSchema).min(1).max(64),
+	/** Convert missing engine formats and push the model to every agent afterwards. */
+	distribute: z.boolean()
+});
+var ImportModelBundleResultSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("imported"),
+	modelIds: z.array(z.string()).readonly(),
+	distributed: z.array(z.object({
+		modelId: z.string(),
+		nodeId: z.string(),
+		format: z.enum(MODEL_FORMATS),
+		ok: z.boolean(),
+		error: z.string().optional()
+	})).readonly()
+}), z.object({
+	kind: z.literal("refused"),
+	reason: z.enum([
+		"transfer-failed",
+		"checksum-mismatch",
+		"bundle-mismatch",
+		"invalid-entry",
+		"id-taken"
+	]),
+	detail: z.string()
+})]);
+var customModelRegistryCapability = {
+	name: "custom-model-registry",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`. The only
+		* consumer, the detection-pipeline's model resolution
+		* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
+		* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
+		* never tRPC — so `auth: 'admin'` costs it nothing.
+		*/
+		listModels: method(z.void(), z.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }),
+		/**
+		* Register a model whose files arrive as ONE bundle tar (D806): the tar
+		* is taken over `ctx.peerBytes`, checked against `bundle.sha256` and
+		* every row of `files`, unpacked into the hub's flat modelsDir (directory
+		* formats included), each format's `.revision` record written, the rows
+		* upserted under the operator's name, the hub marked available and —
+		* when asked — engine formats converted and the model distributed. A
+		* model id already registered by another source is refused, never
+		* overwritten.
+		*/
+		importModelBundle: method(ImportModelBundleInputSchema, ImportModelBundleResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
 		})
 	}
 };
@@ -15694,6 +15790,16 @@ id: z.union([z.string(), z.number()]) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/** Upsert many records in ONE transaction; see the door's `upsertMany`. */
+		upsertMany: method(z.object({
+			namespace: z.string().optional(),
+			collection: z.string(),
+			conflict: z.array(z.string()).readonly(),
+			records: z.array(BulkRecordSchema).readonly()
+		}), z.object({ upserted: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Insert many records in ONE transaction. All or nothing. */
 		insertMany: method(z.object({
 			namespace: z.string().optional(),
@@ -15786,12 +15892,7 @@ id: z.union([z.string(), z.number()]) }), {
 			collection: z.string()
 		}), z.boolean(), { auth: "admin" }),
 		/** Declare a typed (SQL-backed) collection with columns + indexes. */
-		declareCollection: method(z.object({
-			namespace: z.string().optional(),
-			collection: z.string(),
-			columns: z.array(CollectionColumnSchema).readonly(),
-			indexes: z.array(CollectionIndexSchema).readonly().optional()
-		}), z.void(), {
+		declareCollection: method(DeclareCollectionInputSchema, z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		})
@@ -53098,6 +53199,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.upsertMany": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dayNight.getOptions": {
 		capName: "day-night",
 		capScope: "device",
@@ -57946,6 +58053,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.upsertMany": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"smoke.getStatus": {
 		capName: "smoke",
 		capScope: "device",
@@ -65448,4 +65561,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { buildStreamParamsConfigSchema as $, compositionSliceKey as $n, transformSecretWrite as $r, mayReadLocation as $t, LocationIconIdSchema as A, siteZoneKey as An, formatSecretScope as Ar, extractNestedAddonId as At, StorageLocationModeSchema as B, validateComposition as Bn, normalizeSecretOwner as Br, isObjectInput as Bt, FieldClaimModeSchema as C, resolveMethodAuth as Cn, collectZodSecretPaths as Cr, enumerateInferenceDevices as Ct, KEYCHAIN_RESET_TRIGGER_ACTOR as D, scopesAllowDeviceCap as Dn, emitDownForOwnedCaps as Dr, evictionPolicyOfLocation as Dt, HUB_MDNS_TXT_KEYS as E, scopesAllowAddon as En, defineCustomActions as Er, evaluateCompositionField as Et, RecordingStatusSchema as F, storageProviderCapability as Fn, isSecretClear as Fr, isAppLinkBase as Ft, addonSettingsCapability as G, withLocationMode as Gn, resolveCapMount as Gr, legacyAutoLinkIds as Gt, StorageMigrationJobSchema as H, vectorDimFromBase64 as Hn, parseJsonUnknown as Hr, kebabToCamel as Ht, STORAGE_ACCESS_FALLBACK as I, streamCatalogCapability as In, isSecretMarker as Ir, isArrayOutputSchema as It, authProviderCapability as J, cloneStatefulExpressionMemory as Jn, secretTreeFromPaths as Jr, localNetworkCapability as Jt, addonWidgetsCapability as K, COMPOSER_ADDON_ID as Kn, resolveSecretMarkers as Kr, legacyModeOf as Kt, STREAM_PROFILE_META as L, streamQualityLabel as Ln, isSecretMarkerLike as Lr, isCollectionArrayMethod as Lt, MINUTES_PER_DAY as M, storageCapability as Mn, isDeviceConfigCap as Mr, foldSnapshotByFunction as Mt, MOTION_CLOSE_AFTER_MS as N, storageMigrationCapability as Nn, isEvent as Nr, formatMinutes as Nt, LOG_LEVEL_RANK as O, scoreRuntimes as On, emitReadiness as Or, expandContainer as Ot, RECORDING_SOURCE_CAMSTACK_ADDON as P, storageOccupancyCapability as Pn, isKeychainStoredField as Pr, gbToBytes as Pt, buildCapabilityLookup as Q, compositionItemFieldPath as Qn, toSecretFieldView as Qr, looseSchema as Qt, ScopedTokenSchema as R, supportedRuntimes as Rn, makeSecretMarker as Rr, isDefaultAppConnectionEndpoint as Rt, FIRST_LEVEL_MACRO_CLASSES as S, resolveLocationMode as Sn, collectSecretConfigKeys as Sr, deviceStatusCapability as St, HUB_MDNS_SERVICE_TYPE as T, runtimeStatePolicyFor as Tn, customAction as Tr, enumerateSchemaFields as Tt, UserRecordSchema as U, vectorIndexDimConflictError as Un, parseSecretRef as Ur, keychainAdminCapability as Ut, StorageLocationTypeSchema as V, validateCustomAddress as Vn, parseJsonObject as Vr, isVoidInput as Vt, addonPagesCapability as W, vectorStoreCapability as Wn, readinessKey as Wr, keychainCapability as Wt, bareAddonId as X, composedDeviceStableId as Xn, sleep as Xr, logDestinationCapability as Xt, backupCapability as Y, composedDeviceRef as Yn, secretTreeFromSchema as Yr, locationIconKey as Yt, batteryCapability as Z, compositionFeatureEnabled as Zn, toNodeId as Zr, logLevelAtMost as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, resolveAppConnections as _n, WELL_KNOWN_TAB_MAP as _r, deriveBatteryPresence as _t, BatteryStatusSchema as a, normalizeCoreBlockWrite as an, DeviceRole as ar, compositionSourceRefs as at, DeclaredDevices as b, resolveCoreBlockFiles as bn, asString$1 as br, deviceManagerCapability as bt, CAP_NAMES_WITH_STATUS as c, objectInputDeclaresRequiredDeviceId as cn, BaseAddon as cr, coreBlockIdFromAddonId as ct, CORE_BLOCKS_ADDON_ID as d, planComposition as dn, DEVICE_STATUS_METHOD as dr, createDeviceExtensionProvider as dt, EventCategory as ei, mayWriteToLocation as en, compositionSourceKey as er, calendarsCapability as et, CORE_BLOCK_ADDON_PREFIX as f, platformProbeCapability as fn, REDACTED_SECRET as fr, dataStoreProviderCapability as ft, DATABASE_SNAPSHOT_SUFFIX as g, replacedFieldKeys as gn, SECRET_CLEAR as gr, defineExtensionSlotProvider as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, reducePoints as hn, ReadinessTimeoutError as hr, decodeVectorBase64 as ht, BaseDevice as i, motionCapability as in, DeviceFeature as ir, compositionFieldKey as it, METHOD_ACCESS_MAP as j, snapshotCapability as jn, hydrateSchema as jr, filesystemBrowseCapability as jt, LegacyStorageLocationDefaultSchema as k, settingsStoreCapability as kn, expandCapMethods as kr, expressionContainsBuiltinCall as kt, COMPOSED_ITEM_FIXED_FIELDS as l, parseStreamParamsFormPatch as ln, DATAPLANE_SECRET_HEADER as lr, coreBlockSourceKind as lt, CoreBlockSchema as m, ptzAutotrackCapability as mn, ReadinessRegistry as mr, declarationOwnerNodeId as mt, AlertSchema as n, metricsProviderCapability as nn, disarmRoseMemory as nr, checkRoleAddress as nt, CAMERA_SWITCH_ORDER as o, normalizeUnit as on, DeviceType as or, coreBlockAddonId as ot, CalendarPreferencesSchema as p, procedureAuthKey as pn, RUNTIME_DEFAULTS as pr, databaseSnapshotCapability as pt, alertsCapability as q, buildFfmpegArgs as qn, scopeKey as qr, lifecycleJobSchema as qt, ApiKeyRecordSchema as r, modeMayWrite as rn, toExpressionValue as rr, composerCapability as rt, CAMSTACK_APP_LINK_ORIGIN as s, objectInputDeclaresAddonId as sn, errMsg as sr, coreBlockComposition as st, ALL_CAPABILITY_DEFINITIONS as t, memoizePinnedFfmpeg as tn, createStatefulExpressionMemory as tr, cameraGridLayoutCapability as tt, COMPOSER_RUNNER_ID as u, pickAppLinkHub as un, DEVICE_SETTINGS_CONTRIBUTION_METHODS as ur, coreBlocksCapability as ut, DAY_NAMES as v, resolveBucketMs as vn, asJsonObject as vr, describeComposableCaps as vt, FieldClaimSchema as w, resolveNotificationTapAddress as wn, createEvent as wr, enumerateItemArrayFields as wt, DeviceStatusSchema as x, resolveHubAddressRoles as xn, buildSecretRef as xr, deviceStateCapability as xt, DERIVED_CAMERA_SILENCED_CAP_NAMES as y, resolveCoreBlockEntry as yn, asNumber as yr, deviceExtensionCapability as yt, StorageCleanupJobSchema as z, userManagementCapability as zn, nodePin as zr, isLocationEnabled as zt };
+export { buildCapabilityLookup as $, compositionItemFieldPath as $n, toSecretFieldView as $r, looseSchema as $t, LegacyStorageLocationDefaultSchema as A, settingsStoreCapability as An, expandCapMethods as Ar, expressionContainsBuiltinCall as At, StorageCleanupJobSchema as B, userManagementCapability as Bn, nodePin as Br, isLocationEnabled as Bt, FIRST_LEVEL_MACRO_CLASSES as C, resolveLocationMode as Cn, collectSecretConfigKeys as Cr, deviceStatusCapability as Ct, HUB_MDNS_TXT_KEYS as D, scopesAllowAddon as Dn, defineCustomActions as Dr, evaluateCompositionField as Dt, HUB_MDNS_SERVICE_TYPE as E, runtimeStatePolicyFor as En, customAction as Er, enumerateSchemaFields as Et, RECORDING_SOURCE_CAMSTACK_ADDON as F, storageOccupancyCapability as Fn, isKeychainStoredField as Fr, gbToBytes as Ft, addonPagesCapability as G, vectorStoreCapability as Gn, readinessKey as Gr, keychainCapability as Gt, StorageLocationTypeSchema as H, validateCustomAddress as Hn, parseJsonObject as Hr, isVoidInput as Ht, RecordingStatusSchema as I, storageProviderCapability as In, isSecretClear as Ir, isAppLinkBase as It, alertsCapability as J, buildFfmpegArgs as Jn, scopeKey as Jr, lifecycleJobSchema as Jt, addonSettingsCapability as K, withLocationMode as Kn, resolveCapMount as Kr, legacyAutoLinkIds as Kt, STORAGE_ACCESS_FALLBACK as L, streamCatalogCapability as Ln, isSecretMarker as Lr, isArrayOutputSchema as Lt, METHOD_ACCESS_MAP as M, snapshotCapability as Mn, hydrateSchema as Mr, filesystemBrowseCapability as Mt, MINUTES_PER_DAY as N, storageCapability as Nn, isDeviceConfigCap as Nr, foldSnapshotByFunction as Nt, KEYCHAIN_RESET_TRIGGER_ACTOR as O, scopesAllowDeviceCap as On, emitDownForOwnedCaps as Or, evictionPolicyOfLocation as Ot, MOTION_CLOSE_AFTER_MS as P, storageMigrationCapability as Pn, isEvent as Pr, formatMinutes as Pt, batteryCapability as Q, compositionFeatureEnabled as Qn, toNodeId as Qr, logLevelAtMost as Qt, STREAM_PROFILE_META as R, streamQualityLabel as Rn, isSecretMarkerLike as Rr, isCollectionArrayMethod as Rt, DeviceStatusSchema as S, resolveHubAddressRoles as Sn, buildSecretRef as Sr, deviceStateCapability as St, FieldClaimSchema as T, resolveNotificationTapAddress as Tn, createEvent as Tr, enumerateItemArrayFields as Tt, StorageMigrationJobSchema as U, vectorDimFromBase64 as Un, parseJsonUnknown as Ur, kebabToCamel as Ut, StorageLocationModeSchema as V, validateComposition as Vn, normalizeSecretOwner as Vr, isObjectInput as Vt, UserRecordSchema as W, vectorIndexDimConflictError as Wn, parseSecretRef as Wr, keychainAdminCapability as Wt, backupCapability as X, composedDeviceRef as Xn, secretTreeFromSchema as Xr, locationIconKey as Xt, authProviderCapability as Y, cloneStatefulExpressionMemory as Yn, secretTreeFromPaths as Yr, localNetworkCapability as Yt, bareAddonId as Z, composedDeviceStableId as Zn, sleep as Zr, logDestinationCapability as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, replacedFieldKeys as _n, SECRET_CLEAR as _r, defineExtensionSlotProvider as _t, BatteryStatusSchema as a, motionCapability as an, DeviceFeature as ar, compositionFieldKey as at, DERIVED_CAMERA_SILENCED_CAP_NAMES as b, resolveCoreBlockEntry as bn, asNumber as br, deviceExtensionCapability as bt, CAP_NAMES_WITH_STATUS as c, objectInputDeclaresAddonId as cn, errMsg as cr, coreBlockComposition as ct, CORE_BLOCKS_ADDON_ID as d, pickAppLinkHub as dn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as dr, coreBlocksCapability as dt, transformSecretWrite as ei, mayReadLocation as en, compositionSliceKey as er, buildStreamParamsConfigSchema as et, CORE_BLOCK_ADDON_PREFIX as f, planComposition as fn, DEVICE_STATUS_METHOD as fr, createDeviceExtensionProvider as ft, DATABASE_SNAPSHOT_SUFFIX as g, reducePoints as gn, ReadinessTimeoutError as gr, decodeVectorBase64 as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, ptzAutotrackCapability as hn, ReadinessRegistry as hr, declarationOwnerNodeId as ht, BaseDevice as i, modeMayWrite as in, toExpressionValue as ir, composerCapability as it, LocationIconIdSchema as j, siteZoneKey as jn, formatSecretScope as jr, extractNestedAddonId as jt, LOG_LEVEL_RANK as k, scoreRuntimes as kn, emitReadiness as kr, expandContainer as kt, COMPOSED_ITEM_FIXED_FIELDS as l, objectInputDeclaresRequiredDeviceId as ln, BaseAddon as lr, coreBlockIdFromAddonId as lt, CoreBlockSchema as m, procedureAuthKey as mn, RUNTIME_DEFAULTS as mr, databaseSnapshotCapability as mt, AlertSchema as n, memoizePinnedFfmpeg as nn, createStatefulExpressionMemory as nr, cameraGridLayoutCapability as nt, CAMERA_SWITCH_ORDER as o, normalizeCoreBlockWrite as on, DeviceRole as or, compositionSourceRefs as ot, CalendarPreferencesSchema as p, platformProbeCapability as pn, REDACTED_SECRET as pr, dataStoreProviderCapability as pt, addonWidgetsCapability as q, COMPOSER_ADDON_ID as qn, resolveSecretMarkers as qr, legacyModeOf as qt, ApiKeyRecordSchema as r, metricsProviderCapability as rn, disarmRoseMemory as rr, checkRoleAddress as rt, CAMSTACK_APP_LINK_ORIGIN as s, normalizeUnit as sn, DeviceType as sr, coreBlockAddonId as st, ALL_CAPABILITY_DEFINITIONS as t, EventCategory as ti, mayWriteToLocation as tn, compositionSourceKey as tr, calendarsCapability as tt, COMPOSER_RUNNER_ID as u, parseStreamParamsFormPatch as un, DATAPLANE_SECRET_HEADER as ur, coreBlockSourceKind as ut, DATA_STORE_DATABASES as v, resolveAppConnections as vn, WELL_KNOWN_TAB_MAP as vr, deriveBatteryPresence as vt, FieldClaimModeSchema as w, resolveMethodAuth as wn, collectZodSecretPaths as wr, enumerateInferenceDevices as wt, DeclaredDevices as x, resolveCoreBlockFiles as xn, asString$1 as xr, deviceManagerCapability as xt, DAY_NAMES as y, resolveBucketMs as yn, asJsonObject as yr, describeComposableCaps as yt, ScopedTokenSchema as z, supportedRuntimes as zn, makeSecretMarker as zr, isDefaultAppConnectionEndpoint as zt };