@camstack/system 1.2.423 → 1.2.425

package/dist/{dist-VIIxVsBW.js → dist-DnALrQF-.js}

@@ -10880,6 +10880,568 @@ var authProviderCapability = {
 	mount: { kind: "skip" }
 };
 /**
+* Query filter for settings-store collections.
+*/
+var QueryFilterSchema = zod.z.object({
+	where: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	whereIn: zod.z.record(zod.z.string(), zod.z.array(zod.z.unknown())).optional(),
+	whereBetween: zod.z.record(zod.z.string(), zod.z.tuple([zod.z.unknown(), zod.z.unknown()])).optional(),
+	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
+	whereNot: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
+	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
+	whereNotIn: zod.z.record(zod.z.string(), zod.z.array(zod.z.unknown())).optional(),
+	orderBy: zod.z.object({
+		field: zod.z.string(),
+		direction: zod.z.enum(["asc", "desc"])
+	}).optional(),
+	limit: zod.z.number().optional(),
+	offset: zod.z.number().optional()
+});
+/**
+* The predicate half of a filter, for BULK MUTATIONS.
+*
+* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
+* meaning for a statement that rewrites a set, and accepting them would invite
+* a caller to believe `limit` bounds the damage. Every field is optional here
+* only so the shape stays composable — the implementation REJECTS a filter
+* that compiles to no predicate, because that is the whole collection.
+*/
+var MutationFilterSchema = zod.z.object({
+	where: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	whereIn: zod.z.record(zod.z.string(), zod.z.array(zod.z.unknown())).optional(),
+	whereBetween: zod.z.record(zod.z.string(), zod.z.tuple([zod.z.unknown(), zod.z.unknown()])).optional(),
+	whereNot: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	whereNotIn: zod.z.record(zod.z.string(), zod.z.array(zod.z.unknown())).optional()
+});
+/**
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
+*/
+var AggregateFieldSchema = zod.z.object({
+	/** Result key. */
+	as: zod.z.string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: zod.z.string().min(1),
+	op: zod.z.enum([
+		"sum",
+		"min",
+		"max"
+	])
+});
+/**
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+*/
+var AggregateResultSchema = zod.z.object({
+	count: zod.z.number().int(),
+	values: zod.z.record(zod.z.string(), zod.z.number().nullable())
+});
+/** A single stored record: `{ id, data }`. */
+var SettingsRecordSchema = zod.z.object({
+	id: zod.z.string(),
+	data: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+/**
+* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
+* optional.
+*
+* A separate schema rather than loosening the shared one: every other method
+* on this cap addresses a row BY its id, and making that field optional
+* everywhere would turn a forgotten key into a silently generated one on
+* `update` and `delete` as well.
+*/
+var BulkRecordSchema = zod.z.object({
+	id: zod.z.string().optional(),
+	data: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+/**
+* The database FILES one `sqlite-settings` engine process owns (D851).
+* Closed on purpose: a file is a thing the engine opens, backs up and gives a
+* serving thread, so a new one is a code change, never a string a caller
+* invents. `settings` is `camstack.db` and the default for every collection
+* that names no file.
+*/
+var DataStoreDatabaseSchema = zod.z.enum([
+	"settings",
+	"events",
+	"history"
+]);
+/** Every database file, in a stable order (settings first). */
+var DATA_STORE_DATABASES = DataStoreDatabaseSchema.options;
+/**
+* One write inside a {@link settingsStoreCapability.methods.transact} call.
+* The three that a "replace this set, bump that revision" write needs, plus
+* the batched upsert a rollup writer needs.
+*/
+var TransactOpSchema = zod.z.discriminatedUnion("op", [
+	zod.z.object({
+		op: zod.z.literal("deleteWhere"),
+		collection: zod.z.string(),
+		filter: MutationFilterSchema
+	}),
+	zod.z.object({
+		op: zod.z.literal("insertMany"),
+		collection: zod.z.string(),
+		records: zod.z.array(BulkRecordSchema).readonly()
+	}),
+	zod.z.object({
+		op: zod.z.literal("update"),
+		collection: zod.z.string(),
+		id: zod.z.string(),
+		data: zod.z.record(zod.z.string(), zod.z.unknown())
+	}),
+	zod.z.object({
+		op: zod.z.literal("upsertMany"),
+		collection: zod.z.string(),
+		conflict: zod.z.array(zod.z.string()).readonly(),
+		records: zod.z.array(BulkRecordSchema).readonly()
+	})
+]);
+/**
+* The precondition of a transaction: the row `key` of `collection` must hold
+* `equals` in `column`, read INSIDE the transaction.
+*/
+var TransactGuardSchema = zod.z.object({
+	collection: zod.z.string(),
+	key: zod.z.string(),
+	column: zod.z.string(),
+	equals: zod.z.unknown()
+});
+/**
+* Column declaration for a structured (SQL-backed) collection.
+*
+* Logical types — the backend translates each to the matching SQLite
+* storage class and handles per-type marshaling:
+*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
+*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
+*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
+*/
+var CollectionColumnSchema = zod.z.object({
+	name: zod.z.string(),
+	type: zod.z.enum([
+		"TEXT",
+		"INTEGER",
+		"REAL",
+		"JSON",
+		"BOOLEAN"
+	]),
+	primaryKey: zod.z.boolean().optional(),
+	notNull: zod.z.boolean().optional(),
+	unique: zod.z.boolean().optional(),
+	/**
+	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
+	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
+	* collection surface simply cannot express their existing tables — which is
+	* why they were still on the uncapped `table*` API.
+	*/
+	defaultValue: zod.z.union([
+		zod.z.string(),
+		zod.z.number(),
+		zod.z.boolean()
+	]).optional()
+});
+var CollectionIndexSchema = zod.z.object({
+	name: zod.z.string(),
+	columns: zod.z.array(zod.z.string()).readonly(),
+	unique: zod.z.boolean().optional()
+});
+/**
+* The input of `declareCollection` — ONE schema for the door and for the
+* engine behind it, so the two surfaces cannot drift (the dispatcher forwards
+* the payload untouched).
+*
+* - `database` — the file the collection lives in (D851). Absent means
+*   `settings`. A declaration naming a file other than the one the table is
+*   already in is REFUSED by the engine, never moved.
+* - `primaryKey` — a COMPOSITE key, as column names. A single name is the same
+*   as `primaryKey: true` on that column. A composite-keyed collection has no
+*   `id`: it is written with `insertMany` / `upsertMany` / `transact` and read
+*   with `query` / `count` / `aggregate` / `deleteWhere`; the calls that
+*   address one row by id are refused.
+* - `withoutRowid` — emit `WITHOUT ROWID`. Requires a primary key.
+*/
+var DeclareCollectionInputSchema = zod.z.object({
+	namespace: zod.z.string().optional(),
+	collection: zod.z.string(),
+	columns: zod.z.array(CollectionColumnSchema).readonly(),
+	indexes: zod.z.array(CollectionIndexSchema).readonly().optional(),
+	database: DataStoreDatabaseSchema.optional(),
+	primaryKey: zod.z.array(zod.z.string()).readonly().optional(),
+	withoutRowid: zod.z.boolean().optional()
+});
+/**
+* settings-store — singleton capability for addon-scoped persistence.
+*
+* Every method operates within a `collection`. An optional `namespace`
+* field provides access to additional data spaces beyond the default
+* addon settings — useful for business data (events, tracks, faces, etc.).
+*
+* **Scoping is the CALLER's, and it is opt-in.** The table is
+* `namespace ? `${namespace}:${collection}` : collection` — nothing
+* consults the identity of the caller. An earlier version of this comment
+* claimed the implementation prefixes every collection with the calling
+* addon's ID and that "addons never see each other's data"; that was never
+* true, and this same file contradicted it under `declareCollection`. What
+* exists is `addon-context-factory`, which passes `namespace: addonId` ON
+* THE ADDON'S BEHALF for the `addon-settings` / `addon-devices` paths only.
+* Business collections use bare names, and any caller may name any
+* namespace, or none. Making the door enforce it is tracked separately —
+* it renames tables, so it needs a migration.
+*
+* **So every method is `auth: 'admin'` (D634).** Because nothing scopes a
+* call to its caller, a `protected` method here was a raw, unredacted read
+* (and write) of every addon's collections for any role holding
+* `category:system` — which is every role: a `viewer` could read every
+* notifier token in plaintext from `notifiers:notification-targets`. No
+* browser or app client calls this cap. Addons are not affected: an
+* addon's `ctx.api` cap call is resolved to the provider directly and never
+* enters the tRPC router (so the tier gates sessions and tokens, never
+* addons), and the hub itself calls it through the capability registry.
+*
+*   - `{ collection: 'addon-settings' }` → table `addon-settings`
+*   - `{ namespace: 'my-addon', collection: 'addon-settings' }` →
+*     table `my-addon:addon-settings`
+*
+* Served by the **storage-orchestrator** builtin, which dispatches to the
+* `data-store-provider` engine registered for the collection
+* (`sqlite-settings`, a SQLite WAL backend, today). One addon owns the
+* data door; engines sit behind it
+* ([D44](../../../../docs/decisions/adr-0044.md)).
+* Addons access it via `ctx.api.settingsStore.*`.
+*/
+var settingsStoreCapability = {
+	name: "settings-store",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/** Get a single value by key from a collection. */
+		get: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			key: zod.z.string()
+		}), zod.z.unknown(), { auth: "admin" }),
+		/** Set a value by key in a collection (upsert). */
+		set: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			key: zod.z.string(),
+			value: zod.z.unknown()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Rows matching a filter.
+		*
+		* `columns` is a SQL-level projection: the engine SELECTs only those
+		* columns (plus the primary key) instead of the whole row. It is the only
+		* way to stop paying disk for a column that is discarded — a heavy JSON
+		* column dominates the row, and dropping it in JS after the read pays every
+		* byte first. Measured on the live `pipeline-analytics:tracks` table: a
+		* 501-row page is 4.6 MB whole and 0.11 MB projected, same index, same
+		* plan.
+		*
+		* The engine REFUSES a column it cannot serve rather than omitting it —
+		* see `SettingsQueryInput.columns` for why a projection may not be
+		* forgiving the way a predicate is.
+		*/
+		query: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			filter: QueryFilterSchema.optional(),
+			columns: zod.z.array(zod.z.string()).readonly().optional()
+		}), zod.z.array(SettingsRecordSchema).readonly(), { auth: "admin" }),
+		/**
+		* Make a SLOT hold this row — insert it, or update whatever already
+		* occupies the slot — and answer with the id the row HAS.
+		*
+		* ## Why the store needed this
+		*
+		* {@link set} is already an upsert, but its slot is the PRIMARY KEY: the
+		* caller has to know the id to address the row. That is exactly what a
+		* collection keyed by an `INTEGER` rowid alias cannot do — SQLite assigns
+		* the id, so a writer whose uniqueness rule is "one row per
+		* `(ownerKind, ownerId, kind, slot)`" has no id to name and no way to
+		* express the rule. {@link insert} can express it (a UNIQUE index
+		* arbitrates) but only by THROWING at the loser of a race, and the loser
+		* here is a legitimate re-capture, not an error.
+		*
+		* Getting there without this method means read-then-write: query the slot,
+		* then `insert` or `update`. Two statements instead of one, a race between
+		* them, and a recovery path that has to recognise a UNIQUE violation by its
+		* MESSAGE — across a process boundary, because the store lives behind an
+		* RPC door. A string match would be the whole gate, and a store that
+		* rephrased its error would lose the row silently. One statement has no
+		* such gate (D482).
+		*
+		* ## The contract
+		*
+		* `conflict` names the DECLARED columns that identify the slot. They must
+		* be covered by a UNIQUE index on the collection — SQLite resolves an
+		* `ON CONFLICT` target against its indexes and REFUSES the statement when
+		* none matches, so a wrong list is a loud error on the first write, never a
+		* silently duplicated row. An empty list is refused rather than passed on:
+		* `ON CONFLICT()` is not valid SQL, and the intent it would most likely
+		* encode ("no slot, just insert") is {@link insert}.
+		*
+		* Row shape is {@link insert}'s: `record.id` is used when the collection
+		* needs a supplied key and IGNORED when the primary key is an `INTEGER`
+		* rowid alias — exactly as `insert` and `insertMany` already treat it.
+		*
+		* Returns the id either way: the one SQLite assigned on an insert, or the
+		* one the row it updated already had. A caller cannot tell which happened,
+		* and deliberately — every caller wants the slot's id, and one that needed
+		* to distinguish creation from replacement would have to read first anyway.
+		*/
+		upsert: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			/** Declared columns identifying the slot; must be covered by a UNIQUE
+			*  index on the collection. Never empty. */
+			conflict: zod.z.array(zod.z.string()).readonly(),
+			record: BulkRecordSchema
+		}), zod.z.object({ 
+		/** The id the row HAS: assigned by SQLite on an insert, or the existing
+		*  row's own id on an update. */
+id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* {@link upsert} for a BATCH, in ONE transaction on ONE prepared statement.
+		*
+		* The write-side twin of {@link insertMany} for rows that may already
+		* exist: a rollup writer recomputes a bucket and must overwrite it, and
+		* N round trips with N COMMITs is the cost {@link insertMany} was added to
+		* avoid. `conflict` has the meaning it has on {@link upsert} (declared
+		* columns covered by a UNIQUE index or the primary key, never empty).
+		*
+		* Every record of a batch must carry the SAME set of declared columns and
+		* every `conflict` column: one batch is one statement shape, and a record
+		* that silently bound NULL over a column it did not mention would erase
+		* it. A heterogeneous batch is refused whole. **All or nothing.**
+		*/
+		upsertMany: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			conflict: zod.z.array(zod.z.string()).readonly(),
+			records: zod.z.array(BulkRecordSchema).readonly()
+		}), zod.z.object({ upserted: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Insert a new record. */
+		insert: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			record: zod.z.object({
+				id: zod.z.string().optional(),
+				data: zod.z.record(zod.z.string(), zod.z.unknown())
+			})
+		}), zod.z.object({ 
+		/**
+		* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
+		* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
+		* primary key — which is the only place an auto key is knowable.
+		*/
+id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Insert MANY records in ONE transaction, returning how many landed.
+		*
+		* The write-side twin of {@link deleteWhere}, and it exists for the same
+		* reason: without it, appending a batch is N round trips and N COMMITs on
+		* the single shared connection that also serves every cluster-wide
+		* configuration read. The durable load series writes one process row per
+		* process per sample — 76 rows every 10 s on the live fleet — and the
+		* operator's rule for it is *one transaction per sample, never one per
+		* row*. `insert` cannot express that; nothing else could.
+		*
+		* **All or nothing.** A batch that fails on its fifth row leaves none of
+		* the five behind. A half-written sample is worse than a missing one: the
+		* missing one reads as "nobody reported", which is true, while the half
+		* one reads as "these were the only processes running", which is not.
+		*
+		* `id` is OPTIONAL per record, and that is the difference from
+		* {@link insert}. A collection whose primary key is an `INTEGER` rowid
+		* alias has no id to supply — SQLite assigns it, for free, and inventing a
+		* `randomUUID()` for such a column would write a 36-character string into
+		* an integer key. Omitted on a TEXT key, a uuid is generated exactly as
+		* `insert` does.
+		*/
+		insertMany: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			records: zod.z.array(BulkRecordSchema).readonly()
+		}), zod.z.object({ inserted: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Several writes, ONE transaction, behind an optional precondition.
+		*
+		* The multi-collection twin of {@link insertMany}: a write that has to move
+		* a set of rows in one collection AND a revision in another cannot be
+		* expressed as separate calls without a window in which a reader (or a
+		* crash) sees half of it. The retrain annotation save replaces a frame's
+		* rows, its dismissed set and its revision this way.
+		*
+		* `guard`, when given, is read inside the transaction: if the row is
+		* missing or its column differs from `equals`, NOTHING is written and the
+		* answer is `{ applied: false, current }` with what was found — the
+		* compare-and-set a revisioned write needs, with no second reader able to
+		* slip between the check and the writes.
+		*
+		* **All or nothing**, like {@link insertMany}: a throw in any op rolls the
+		* whole call back. Ops run in the order given (delete before insert to
+		* replace a set). `namespace` applies to every collection named.
+		*/
+		transact: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			guard: TransactGuardSchema.optional(),
+			ops: zod.z.array(TransactOpSchema).readonly()
+		}), zod.z.object({
+			applied: zod.z.boolean(),
+			current: zod.z.unknown().optional()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Update an existing record by ID. */
+		update: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			id: zod.z.string(),
+			data: zod.z.record(zod.z.string(), zod.z.unknown())
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Delete a record by key/ID. */
+		delete: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			key: zod.z.string()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Delete every record matching `filter`, in ONE statement, returning how
+		* many rows went. This exists because its absence made every retention
+		* path in the system an N+1 drain loop: `delete` takes a key, so a sweep
+		* had to SELECT a page of full rows — every column, including the fat
+		* ones — purely to learn their ids, then issue one call per row.
+		*
+		* **The filter is required and must resolve.** A predicate naming
+		* something the collection cannot express is an ERROR here, not a
+		* widening as it is on `query`, and a filter with no predicates is an
+		* error rather than "every row". Deleting a whole collection is a
+		* legitimate intent, but it must be asked for by name — not reached by
+		* an empty object.
+		*/
+		deleteWhere: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			filter: MutationFilterSchema
+		}), zod.z.object({ deleted: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Apply `data` to every record matching `filter`, in one statement,
+		* returning how many rows changed. Same filter contract as
+		* {@link deleteWhere} — an unresolvable predicate is an error.
+		*/
+		updateWhere: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			filter: MutationFilterSchema,
+			data: zod.z.record(zod.z.string(), zod.z.unknown())
+		}), zod.z.object({ updated: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Count entries in a collection, optionally filtered. */
+		count: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			filter: QueryFilterSchema.optional()
+		}), zod.z.number(), { auth: "admin" }),
+		/**
+		* `COUNT(*)` and one `SUM` / `MIN` / `MAX` per requested field, in ONE
+		* statement, over the rows `filter` selects.
+		*
+		* Exists because "how much is there" was being answered by materialising
+		* "what is there". The recorder's storage-pressure sweep asked its in-RAM
+		* footage index for bytes/count/oldest/newest across a set of storage
+		* locations twice a minute, and the only way to answer that from a map is
+		* to visit every row — 7.1 M of them on the live hub, ~15 M row visits a
+		* minute on the main thread, which is also why the whole archive had to
+		* stay resident to be visited. The question is a sum; nothing needs to be
+		* materialised to answer it.
+		*
+		* **The engine REFUSES a field it cannot serve**, exactly as
+		* `query.columns` does and unlike a PREDICATE, which is skipped when
+		* unresolvable. A dropped predicate over-matches and the caller sees extra
+		* rows; a dropped aggregate returns a NUMBER that is wrong and looks
+		* exactly like a real one. That asymmetry is what this repo has already
+		* paid for once in `count`.
+		*/
+		aggregate: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			fields: zod.z.array(AggregateFieldSchema).readonly(),
+			filter: QueryFilterSchema.optional()
+		}), AggregateResultSchema, { auth: "admin" }),
+		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
+		histogram: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			field: zod.z.string(),
+			bucketSize: zod.z.number().int().positive(),
+			origin: zod.z.number().int(),
+			filter: QueryFilterSchema.optional()
+		}), zod.z.array(zod.z.object({
+			bucket: zod.z.number().int(),
+			count: zod.z.number().int()
+		})).readonly(), { auth: "admin" }),
+		/** Check if a collection is empty. */
+		isEmpty: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string()
+		}), zod.z.boolean(), { auth: "admin" }),
+		/**
+		* Declare a typed (SQL-backed) collection with explicit columns +
+		* indexes. Idempotent: re-declaring an existing collection with the
+		* same shape is a no-op; shape changes (new columns, new indexes)
+		* are applied additively. Subsequent `insert` / `update` / `delete`
+		* / `query` calls on this collection use typed columns instead of
+		* JSON-blob storage — `record.data` fields are spread across
+		* columns, `query.filter.where` matches real columns (no
+		* `json_extract` overhead), `orderBy` uses column indexes.
+		*
+		* Addons call this in `onInitialize` before their first read/write.
+		* Collection names should be namespaced by addon (e.g.
+		* `pipeline-analytics:object-events`) to avoid cross-addon
+		* clashes — no automatic prefix is added.
+		*/
+		declareCollection: method(DeclareCollectionInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
 * The suffix of a verified snapshot, written next to the live database it
 * copies: `<db>.backup-snapshot`. A restore promotes it back over `<db>`
 * (`server/backend/src/sqlite-restore.ts` spells the same string — the
@@ -10906,7 +11468,11 @@ var DATABASE_SNAPSHOT_TIMEOUT_MS = 30 * 6e4;
 * database has no sidecars and is just as owned). Paths are absolute on the
 * owner's host.
 */
-var DatabaseSnapshotTargetsSchema = zod.z.object({ databases: zod.z.array(zod.z.object({ livePath: zod.z.string() })) });
+var DatabaseSnapshotTargetsSchema = zod.z.object({ databases: zod.z.array(zod.z.object({
+	/** Which owned file this is — the handle `writeSnapshot` takes. */
+	databaseId: DataStoreDatabaseSchema,
+	livePath: zod.z.string()
+})) });
 /** One b-tree table of the snapshot and the rows it holds. */
 var DatabaseSnapshotTableSchema = zod.z.object({
 	name: zod.z.string(),
@@ -10939,6 +11505,10 @@ var DatabaseSnapshotResultSchema = zod.z.object({
 	/** When the pinned read transaction began (ms epoch) — the snapshot's instant. */
 	takenAt: zod.z.number()
 });
+/** A snapshot the owner wrote, with the file it belongs to. */
+var DatabaseSnapshotWrittenSchema = DatabaseSnapshotResultSchema.extend({ databaseId: DataStoreDatabaseSchema });
+/** Which database `writeSnapshot` copies. Required: an unstated ask is not guessed. */
+var DatabaseSnapshotRequestSchema = zod.z.object({ databaseId: DataStoreDatabaseSchema });
 /**
 * A snapshot as an ARCHIVE records it (`ArchiveManifest.sqliteSnapshots`):
 * the same facts, with both paths relative to the archive root (the node's
@@ -10948,7 +11518,9 @@ var ArchiveSqliteSnapshotSchema = DatabaseSnapshotResultSchema.extend({
 	/** Archive-relative path of the live database the archive does NOT carry. */
 	livePath: zod.z.string(),
 	/** Archive-relative path of the verified copy it carries in its place. */
-	snapshotPath: zod.z.string()
+	snapshotPath: zod.z.string(),
+	/** Absent on an archive made before several files were owned: that was `settings`. */
+	databaseId: DataStoreDatabaseSchema.optional()
 });
 /**
 * database-snapshot — the OWNER of a live SQLite database writes a consistent,
@@ -10973,17 +11545,21 @@ var databaseSnapshotCapability = {
 	internal: true,
 	methods: {
 		/**
-		* Which databases this owner snapshots. Answered from memory — no file is
-		* touched — so a backup can ask it before deciding anything.
+		* EVERY database file this owner has open, with its id. Answered from
+		* memory — no file is touched — so a backup can ask it before deciding
+		* anything. A file created at runtime is listed from the moment it opens,
+		* so no backup can leave it out (D693).
 		*/
 		listDatabases: method(zod.z.object({}), DatabaseSnapshotTargetsSchema, { auth: "admin" }),
 		/**
-		* Write `<db>.backup-snapshot` and return what it holds. Throws — and
-		* leaves no file under the final name — when the copy fails
-		* `integrity_check` or its row counts differ from the pinned source's.
-		* A second call while one is running joins it.
+		* Write `<db>.backup-snapshot` for ONE database and return what it holds.
+		* Throws — and leaves no file under the final name — when the copy fails
+		* `integrity_check` or its row counts differ from the pinned source's, or
+		* when the database is not open. A second call for the SAME database while
+		* one is running joins it; different databases run one after the other
+		* (the disk reserve check is per copy).
 		*/
-		writeSnapshot: method(zod.z.object({}), DatabaseSnapshotResultSchema, {
+		writeSnapshot: method(DatabaseSnapshotRequestSchema, DatabaseSnapshotWrittenSchema, {
 			kind: "mutation",
 			auth: "admin",
 			timeoutMs: DATABASE_SNAPSHOT_TIMEOUT_MS
@@ -11106,7 +11682,12 @@ var BackupArchiveEntrySchema = zod.z.object({
 	/** Top-level locations included in the archive (db, addons, tls, …). */
 	locations: zod.z.array(zod.z.string()).readonly(),
 	/** Present when the archive is encrypted; restore then needs that key. */
-	encryption: BackupArchiveEncryptionSchema.optional()
+	encryption: BackupArchiveEncryptionSchema.optional(),
+	/**
+	* The databases the run asked to carry (its retention class). Absent on an
+	* archive made before several files were owned: that was `['settings']`.
+	*/
+	databases: zod.z.array(DataStoreDatabaseSchema).readonly().optional()
 });
 var BackupEntrySchema = zod.z.object({
 	id: zod.z.string(),
@@ -11140,7 +11721,12 @@ var ArchiveManifestSchema = zod.z.object({
 	* Live SQLite databases this archive carries as their OWNER's verified
 	* snapshot instead of as files (D693). Absent on archives made before.
 	*/
-	sqliteSnapshots: zod.z.array(ArchiveSqliteSnapshotSchema).optional()
+	sqliteSnapshots: zod.z.array(ArchiveSqliteSnapshotSchema).optional(),
+	/**
+	* Owned database files the run did NOT carry (not selected): left out of the
+	* tar and the entry list alike. Absent when every owned file was carried.
+	*/
+	omittedDatabases: zod.z.array(DataStoreDatabaseSchema).optional()
 });
 var LocationStatSchema = zod.z.object({
 	name: zod.z.string(),
@@ -11262,6 +11848,12 @@ var BackupScheduleSchema = zod.z.object({
 	/** Optional subset of source locations to include; omitted = all. */
 	dataSources: zod.z.array(zod.z.string()).readonly().optional(),
 	/**
+	* Which database files this schedule carries. Absent = `['settings']`
+	* (an unstated ask is the minimum, D382). Events and history run weekly,
+	* settings nightly (D852).
+	*/
+	databases: zod.z.array(DataStoreDatabaseSchema).readonly().optional(),
+	/**
 	* ms-epoch of the last tick that FIRED this schedule. Stamped before the
 	* archive runs (it is the dedupe anchor), so it says "attempted", never
 	* "succeeded" — a run refused by every destination stamps it too.
@@ -11313,7 +11905,9 @@ var backupCapability = {
 			* retention). Omitted = each destination's own policy
 			* retention (manual runs).
 			*/
-			retentionCount: zod.z.number().int().min(1).max(1e3).optional()
+			retentionCount: zod.z.number().int().min(1).max(1e3).optional(),
+			/** Database files to carry; omitted = `['settings']`. */
+			databases: zod.z.array(DataStoreDatabaseSchema).optional()
 		}).optional(), BackupTriggerResultSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -11483,7 +12077,8 @@ var backupCapability = {
 			enabled: zod.z.boolean(),
 			locationIds: zod.z.array(zod.z.string()).readonly(),
 			retentionCount: zod.z.number().int().min(1).max(1e3),
-			dataSources: zod.z.array(zod.z.string()).readonly().optional()
+			dataSources: zod.z.array(zod.z.string()).readonly().optional(),
+			databases: zod.z.array(DataStoreDatabaseSchema).readonly().optional()
 		}), BackupScheduleSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -14778,774 +15373,275 @@ var CoreBlockCompileResultSchema = zod.z.object({
 */
 var CoreBlockCompileInputSchema = zod.z.object({
 	code: zod.z.string().optional(),
-	files: CoreBlockFilesSchema.optional(),
-	entry: zod.z.string().min(1).max(260).optional()
-}).superRefine((val, ctx) => {
-	if (val.files !== void 0) {
-		const entry = val.entry ?? "main.ts";
-		if (val.files[entry] === void 0) ctx.addIssue({
-			code: "custom",
-			message: `files must include the entry "${entry}"`,
-			path: ["files"]
-		});
-		return;
-	}
-	if (val.code === void 0) ctx.addIssue({
-		code: "custom",
-		message: "code or files is required",
-		path: ["code"]
-	});
-});
-var coreBlocksCapability = {
-	name: "core-blocks",
-	scope: "system",
-	mode: "singleton",
-	methods: {
-		list: method(zod.z.object({}), zod.z.object({ blocks: zod.z.array(CoreBlockSchema) }), { auth: "admin" }),
-		get: method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }),
-		/**
-		* Create a block. The code is COMPILED first: storing source that does not
-		* compile turns an editor error into a fork failure the operator meets
-		* minutes later in a log.
-		*/
-		create: method(zod.z.object({ block: CoreBlockInputSchema }), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		update: method(zod.z.object({
-			blockId: zod.z.string(),
-			block: CoreBlockInputFieldsSchema.partial()
-		}), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		delete: method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		setEnabled: method(zod.z.object({
-			blockId: zod.z.string(),
-			enabled: zod.z.boolean()
-		}), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Stop this block's runner and let the supervisor bring it back.
-		*
-		* **It stores nothing.** There is no "restart requested" flag and no second
-		* lifecycle field: the supervisor already stops and respawns a runner when
-		* the code hash changes, and this exposes that same path deliberately
-		* (D62 — a switch writes the authority that already owned the function).
-		* The next reconcile pass remains the authority, so a restart that lost a
-		* race is corrected within one pass rather than leaving a stale flag behind.
-		*
-		* Refused for a DISABLED block: nothing would come back, and a button that
-		* silently does nothing is worse than one that says why.
-		*/
-		restart: method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Type-check without saving — what the editor calls as the author types, so
-		* the compiler's verdict is the same one the server will reach.
-		* Accepts `{ code }` or `{ files, entry }` (multi-file project).
-		*/
-		compile: method(CoreBlockCompileInputSchema, CoreBlockCompileResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Hydrated settings form for one block, or null until a `settingsSchema`
-		* is known (extracted from the compiled entry's named export, or set on
-		* the block). Values live in the `core-blocks:settings` collection.
-		*/
-		getBlockSettings: method(zod.z.object({ blockId: zod.z.string() }), SettingsSchemaWithValuesSchema.nullable(), { auth: "admin" }),
-		/**
-		* Patch persisted preference values for one block. The schema is not
-		* rewritten here — only values. Scripts read the same blob via
-		* `ctx.settings.readAddonStore()` (mirrored into the block addon's
-		* `addon-settings` namespace on every patch).
-		*/
-		updateBlockSettings: method(zod.z.object({
-			blockId: zod.z.string(),
-			patch: SettingsPatchSchema
-		}), SettingsUpdateResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* The declaration files the editor type-checks against.
-		*
-		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
-		* bundling it would roughly double the admin remote. Served rather than
-		* hand-stubbed: a block runs with the same `ctx` an addon gets, so a stub
-		* would drift and the editor would confidently autocomplete methods that
-		* do not exist.
-		*/
-		getTypeDefs: method(zod.z.object({}), zod.z.object({ libs: zod.z.array(zod.z.object({
-			filePath: zod.z.string(),
-			content: zod.z.string()
-		})) }), { auth: "admin" }),
-		/**
-		* Create a composition block (D659). VALIDATED first against the live
-		* sources and every stored composition; a refusal names every problem by
-		* path and reason (D391) and stores nothing.
-		*/
-		createComposition: method(zod.z.object({ block: CompositionBlockInputSchema }), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		/**
-		* Patch a composition block. A changed `composition` is validated exactly
-		* as on create. `expectedUpdatedAt` is the `updatedAt` the caller READ: a
-		* block changed since is refused by name, never silently overwritten.
-		*/
-		updateComposition: method(zod.z.object({
-			blockId: zod.z.string(),
-			expectedUpdatedAt: zod.z.number(),
-			block: CompositionBlockInputSchema.partial()
-		}), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		/** One composition and the composer's state for it, or `not-loaded` (D315). */
-		getComposition: method(zod.z.object({ blockId: zod.z.string() }), CompositionGetReadSchema, { auth: "admin" }),
-		listCompositions: method(zod.z.object({}), CompositionListReadSchema, { auth: "admin" }),
-		/**
-		* The composition that customizes an existing device (D663), found by its
-		* TARGET — never by the block's derived name. One per device at most.
-		*/
-		getCustomization: method(zod.z.object({
-			addonId: zod.z.string().min(1),
-			stableId: zod.z.string().min(1)
-		}), CompositionCustomizationReadSchema, { auth: "admin" }),
-		/**
-		* The capabilities a composition may BUILD on a device of `deviceType`
-		* (a new device, or added to an existing one), with their fields — the
-		* editor's feature list and the presets' availability (G2, D676). Built
-		* from the validator's own blockers; a replace of a BOUND cap is not
-		* listed here (the device's bindings say what it has).
-		*/
-		listComposableCaps: method(zod.z.object({ deviceType: zod.z.enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }),
-		/**
-		* Validate without saving — the same verdict the save reaches. A mutation
-		* for its body size; it writes nothing, so its access is `view`.
-		*/
-		validateComposition: method(zod.z.object({
-			composition: CompositionSchema,
-			blockId: zod.z.string().optional()
-		}), CompositionValidationSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "view"
-		})
-	}
-};
-/**
-* `custom-model-registry` — collection cap exposing operator-registered
-* custom detection models. Each provider (today: `addon-model-studio`)
-* contributes a list of `CustomModelDescriptor`s; the hub auto-concatenates
-* them across providers (`concatCollection`).
-*
-* The detection-pipeline is *aware* of this cap: when at least one provider
-* exists it unions these descriptors into the per-step model picker and the
-* runtime model-resolution path, alongside the static catalog. When no
-* provider exists the consumer no-ops entirely (identical to the catalog-only
-* behaviour).
-*
-* A descriptor carries a full `ModelCatalogEntry` directly — the same shape
-* the static catalog uses — so the existing download/resolution code consumes
-* it unchanged. `stepId` is the detection step the model targets
-* (e.g. `'object-detection'`).
-*/
-var CustomModelDescriptorSchema = zod.z.object({
-	stepId: zod.z.string(),
-	entry: ModelCatalogEntrySchema
-});
-/** One regular file of an imported bundle, as the producer measured it. */
-var ModelBundleFileSchema = zod.z.object({
-	/** Relative path inside the bundle tar; an mlpackage member is `<x>.mlpackage/<member>`. */
-	path: zod.z.string().min(1),
-	bytes: zod.z.number().int().nonnegative(),
-	sha256: zod.z.string().regex(/^[0-9a-f]{64}$/)
-});
-var ImportModelBundleInputSchema = zod.z.object({
-	/** The registry provider that keeps the model (Model Studio). */
-	addonId: zod.z.string(),
-	stepId: zod.z.string().min(1),
-	/**
-	* The catalog rows to register, complete, every format URL already
-	* `camstack-local://<modelId>/<file>` naming a file of the bundle. One
-	* bundle may carry several rows (a base and its INT8 variant).
-	*/
-	entries: zod.z.array(ModelCatalogEntrySchema).min(1).max(4),
-	/** The bundle tar, offered by the producer over `ctx.peerBytes` (same host). */
-	bundle: zod.z.object({
-		ticket: PeerBytesTicketSchema,
-		bytes: zod.z.number().int().positive(),
-		sha256: zod.z.string().regex(/^[0-9a-f]{64}$/)
-	}),
-	/** Every file the tar must hold; anything missing, extra or different is refused. */
-	files: zod.z.array(ModelBundleFileSchema).min(1).max(64),
-	/** Convert missing engine formats and push the model to every agent afterwards. */
-	distribute: zod.z.boolean()
-});
-var ImportModelBundleResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
-	kind: zod.z.literal("imported"),
-	modelIds: zod.z.array(zod.z.string()).readonly(),
-	distributed: zod.z.array(zod.z.object({
-		modelId: zod.z.string(),
-		nodeId: zod.z.string(),
-		format: zod.z.enum(MODEL_FORMATS),
-		ok: zod.z.boolean(),
-		error: zod.z.string().optional()
-	})).readonly()
-}), zod.z.object({
-	kind: zod.z.literal("refused"),
-	reason: zod.z.enum([
-		"transfer-failed",
-		"checksum-mismatch",
-		"bundle-mismatch",
-		"invalid-entry",
-		"id-taken"
-	]),
-	detail: zod.z.string()
-})]);
-var customModelRegistryCapability = {
-	name: "custom-model-registry",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: {
-		/**
-		* `internal: true` did not gate the mount (see the 2026-08-26 note on
-		* `data-store-provider`) — this was reachable on the AppRouter by ANY
-		* authenticated session at the default `auth: 'protected'`. The only
-		* consumer, the detection-pipeline's model resolution
-		* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
-		* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
-		* never tRPC — so `auth: 'admin'` costs it nothing.
-		*/
-		listModels: method(zod.z.void(), zod.z.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }),
-		/**
-		* Register a model whose files arrive as ONE bundle tar (D806): the tar
-		* is taken over `ctx.peerBytes`, checked against `bundle.sha256` and
-		* every row of `files`, unpacked into the hub's flat modelsDir (directory
-		* formats included), each format's `.revision` record written, the rows
-		* upserted under the operator's name, the hub marked available and —
-		* when asked — engine formats converted and the model distributed. A
-		* model id already registered by another source is refused, never
-		* overwritten.
-		*/
-		importModelBundle: method(ImportModelBundleInputSchema, ImportModelBundleResultSchema, {
-			kind: "mutation",
-			auth: "admin",
-			timeoutMs: 30 * 6e4
-		})
-	}
-};
-/**
-* Query filter for settings-store collections.
-*/
-var QueryFilterSchema = zod.z.object({
-	where: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-	whereIn: zod.z.record(zod.z.string(), zod.z.array(zod.z.unknown())).optional(),
-	whereBetween: zod.z.record(zod.z.string(), zod.z.tuple([zod.z.unknown(), zod.z.unknown()])).optional(),
-	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
-	whereNot: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
-	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
-	whereNotIn: zod.z.record(zod.z.string(), zod.z.array(zod.z.unknown())).optional(),
-	orderBy: zod.z.object({
-		field: zod.z.string(),
-		direction: zod.z.enum(["asc", "desc"])
-	}).optional(),
-	limit: zod.z.number().optional(),
-	offset: zod.z.number().optional()
-});
-/**
-* The predicate half of a filter, for BULK MUTATIONS.
-*
-* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
-* meaning for a statement that rewrites a set, and accepting them would invite
-* a caller to believe `limit` bounds the damage. Every field is optional here
-* only so the shape stays composable — the implementation REJECTS a filter
-* that compiles to no predicate, because that is the whole collection.
-*/
-var MutationFilterSchema = zod.z.object({
-	where: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-	whereIn: zod.z.record(zod.z.string(), zod.z.array(zod.z.unknown())).optional(),
-	whereBetween: zod.z.record(zod.z.string(), zod.z.tuple([zod.z.unknown(), zod.z.unknown()])).optional(),
-	whereNot: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-	whereNotIn: zod.z.record(zod.z.string(), zod.z.array(zod.z.unknown())).optional()
-});
-/**
-* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
-*
-* `as` names the slot in the result, so the SAME column may be asked twice with
-* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
-* a `Record<column, op>` shape could not express.
-*/
-var AggregateFieldSchema = zod.z.object({
-	/** Result key. */
-	as: zod.z.string().min(1),
-	/** Column to aggregate. Must be a real column of a declared collection. */
-	field: zod.z.string().min(1),
-	op: zod.z.enum([
-		"sum",
-		"min",
-		"max"
-	])
-});
-/**
-* `COUNT(*)` plus one number per requested field.
-*
-* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
-* that really is 0 are different facts, and an accounting caller that renders
-* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
-*/
-var AggregateResultSchema = zod.z.object({
-	count: zod.z.number().int(),
-	values: zod.z.record(zod.z.string(), zod.z.number().nullable())
-});
-/** A single stored record: `{ id, data }`. */
-var SettingsRecordSchema = zod.z.object({
-	id: zod.z.string(),
-	data: zod.z.record(zod.z.string(), zod.z.unknown())
-});
-/**
-* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
-* optional.
-*
-* A separate schema rather than loosening the shared one: every other method
-* on this cap addresses a row BY its id, and making that field optional
-* everywhere would turn a forgotten key into a silently generated one on
-* `update` and `delete` as well.
-*/
-var BulkRecordSchema = zod.z.object({
-	id: zod.z.string().optional(),
-	data: zod.z.record(zod.z.string(), zod.z.unknown())
-});
-/**
-* One write inside a {@link settingsStoreCapability.methods.transact} call.
-* Only the three that a "replace this set, bump that revision" write needs.
-*/
-var TransactOpSchema = zod.z.discriminatedUnion("op", [
-	zod.z.object({
-		op: zod.z.literal("deleteWhere"),
-		collection: zod.z.string(),
-		filter: MutationFilterSchema
-	}),
-	zod.z.object({
-		op: zod.z.literal("insertMany"),
-		collection: zod.z.string(),
-		records: zod.z.array(BulkRecordSchema).readonly()
-	}),
-	zod.z.object({
-		op: zod.z.literal("update"),
-		collection: zod.z.string(),
-		id: zod.z.string(),
-		data: zod.z.record(zod.z.string(), zod.z.unknown())
-	})
-]);
-/**
-* The precondition of a transaction: the row `key` of `collection` must hold
-* `equals` in `column`, read INSIDE the transaction.
-*/
-var TransactGuardSchema = zod.z.object({
-	collection: zod.z.string(),
-	key: zod.z.string(),
-	column: zod.z.string(),
-	equals: zod.z.unknown()
-});
-/**
-* Column declaration for a structured (SQL-backed) collection.
-*
-* Logical types — the backend translates each to the matching SQLite
-* storage class and handles per-type marshaling:
-*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
-*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
-*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
-*/
-var CollectionColumnSchema = zod.z.object({
-	name: zod.z.string(),
-	type: zod.z.enum([
-		"TEXT",
-		"INTEGER",
-		"REAL",
-		"JSON",
-		"BOOLEAN"
-	]),
-	primaryKey: zod.z.boolean().optional(),
-	notNull: zod.z.boolean().optional(),
-	unique: zod.z.boolean().optional(),
-	/**
-	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
-	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
-	* collection surface simply cannot express their existing tables — which is
-	* why they were still on the uncapped `table*` API.
-	*/
-	defaultValue: zod.z.union([
-		zod.z.string(),
-		zod.z.number(),
-		zod.z.boolean()
-	]).optional()
-});
-var CollectionIndexSchema = zod.z.object({
-	name: zod.z.string(),
-	columns: zod.z.array(zod.z.string()).readonly(),
-	unique: zod.z.boolean().optional()
-});
-/**
-* settings-store — singleton capability for addon-scoped persistence.
-*
-* Every method operates within a `collection`. An optional `namespace`
-* field provides access to additional data spaces beyond the default
-* addon settings — useful for business data (events, tracks, faces, etc.).
-*
-* **Scoping is the CALLER's, and it is opt-in.** The table is
-* `namespace ? `${namespace}:${collection}` : collection` — nothing
-* consults the identity of the caller. An earlier version of this comment
-* claimed the implementation prefixes every collection with the calling
-* addon's ID and that "addons never see each other's data"; that was never
-* true, and this same file contradicted it under `declareCollection`. What
-* exists is `addon-context-factory`, which passes `namespace: addonId` ON
-* THE ADDON'S BEHALF for the `addon-settings` / `addon-devices` paths only.
-* Business collections use bare names, and any caller may name any
-* namespace, or none. Making the door enforce it is tracked separately —
-* it renames tables, so it needs a migration.
-*
-* **So every method is `auth: 'admin'` (D634).** Because nothing scopes a
-* call to its caller, a `protected` method here was a raw, unredacted read
-* (and write) of every addon's collections for any role holding
-* `category:system` — which is every role: a `viewer` could read every
-* notifier token in plaintext from `notifiers:notification-targets`. No
-* browser or app client calls this cap. Addons are not affected: an
-* addon's `ctx.api` cap call is resolved to the provider directly and never
-* enters the tRPC router (so the tier gates sessions and tokens, never
-* addons), and the hub itself calls it through the capability registry.
-*
-*   - `{ collection: 'addon-settings' }` → table `addon-settings`
-*   - `{ namespace: 'my-addon', collection: 'addon-settings' }` →
-*     table `my-addon:addon-settings`
-*
-* Served by the **storage-orchestrator** builtin, which dispatches to the
-* `data-store-provider` engine registered for the collection
-* (`sqlite-settings`, a SQLite WAL backend, today). One addon owns the
-* data door; engines sit behind it
-* ([D44](../../../../docs/decisions/adr-0044.md)).
-* Addons access it via `ctx.api.settingsStore.*`.
-*/
-var settingsStoreCapability = {
-	name: "settings-store",
+	files: CoreBlockFilesSchema.optional(),
+	entry: zod.z.string().min(1).max(260).optional()
+}).superRefine((val, ctx) => {
+	if (val.files !== void 0) {
+		const entry = val.entry ?? "main.ts";
+		if (val.files[entry] === void 0) ctx.addIssue({
+			code: "custom",
+			message: `files must include the entry "${entry}"`,
+			path: ["files"]
+		});
+		return;
+	}
+	if (val.code === void 0) ctx.addIssue({
+		code: "custom",
+		message: "code or files is required",
+		path: ["code"]
+	});
+});
+var coreBlocksCapability = {
+	name: "core-blocks",
 	scope: "system",
 	mode: "singleton",
 	methods: {
-		/** Get a single value by key from a collection. */
-		get: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			key: zod.z.string()
-		}), zod.z.unknown(), { auth: "admin" }),
-		/** Set a value by key in a collection (upsert). */
-		set: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			key: zod.z.string(),
-			value: zod.z.unknown()
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Rows matching a filter.
-		*
-		* `columns` is a SQL-level projection: the engine SELECTs only those
-		* columns (plus the primary key) instead of the whole row. It is the only
-		* way to stop paying disk for a column that is discarded — a heavy JSON
-		* column dominates the row, and dropping it in JS after the read pays every
-		* byte first. Measured on the live `pipeline-analytics:tracks` table: a
-		* 501-row page is 4.6 MB whole and 0.11 MB projected, same index, same
-		* plan.
-		*
-		* The engine REFUSES a column it cannot serve rather than omitting it —
-		* see `SettingsQueryInput.columns` for why a projection may not be
-		* forgiving the way a predicate is.
-		*/
-		query: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			filter: QueryFilterSchema.optional(),
-			columns: zod.z.array(zod.z.string()).readonly().optional()
-		}), zod.z.array(SettingsRecordSchema).readonly(), { auth: "admin" }),
+		list: method(zod.z.object({}), zod.z.object({ blocks: zod.z.array(CoreBlockSchema) }), { auth: "admin" }),
+		get: method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }),
 		/**
-		* Make a SLOT hold this row — insert it, or update whatever already
-		* occupies the slot — and answer with the id the row HAS.
-		*
-		* ## Why the store needed this
-		*
-		* {@link set} is already an upsert, but its slot is the PRIMARY KEY: the
-		* caller has to know the id to address the row. That is exactly what a
-		* collection keyed by an `INTEGER` rowid alias cannot do — SQLite assigns
-		* the id, so a writer whose uniqueness rule is "one row per
-		* `(ownerKind, ownerId, kind, slot)`" has no id to name and no way to
-		* express the rule. {@link insert} can express it (a UNIQUE index
-		* arbitrates) but only by THROWING at the loser of a race, and the loser
-		* here is a legitimate re-capture, not an error.
-		*
-		* Getting there without this method means read-then-write: query the slot,
-		* then `insert` or `update`. Two statements instead of one, a race between
-		* them, and a recovery path that has to recognise a UNIQUE violation by its
-		* MESSAGE — across a process boundary, because the store lives behind an
-		* RPC door. A string match would be the whole gate, and a store that
-		* rephrased its error would lose the row silently. One statement has no
-		* such gate (D482).
-		*
-		* ## The contract
-		*
-		* `conflict` names the DECLARED columns that identify the slot. They must
-		* be covered by a UNIQUE index on the collection — SQLite resolves an
-		* `ON CONFLICT` target against its indexes and REFUSES the statement when
-		* none matches, so a wrong list is a loud error on the first write, never a
-		* silently duplicated row. An empty list is refused rather than passed on:
-		* `ON CONFLICT()` is not valid SQL, and the intent it would most likely
-		* encode ("no slot, just insert") is {@link insert}.
-		*
-		* Row shape is {@link insert}'s: `record.id` is used when the collection
-		* needs a supplied key and IGNORED when the primary key is an `INTEGER`
-		* rowid alias — exactly as `insert` and `insertMany` already treat it.
-		*
-		* Returns the id either way: the one SQLite assigned on an insert, or the
-		* one the row it updated already had. A caller cannot tell which happened,
-		* and deliberately — every caller wants the slot's id, and one that needed
-		* to distinguish creation from replacement would have to read first anyway.
+		* Create a block. The code is COMPILED first: storing source that does not
+		* compile turns an editor error into a fork failure the operator meets
+		* minutes later in a log.
 		*/
-		upsert: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			/** Declared columns identifying the slot; must be covered by a UNIQUE
-			*  index on the collection. Never empty. */
-			conflict: zod.z.array(zod.z.string()).readonly(),
-			record: BulkRecordSchema
-		}), zod.z.object({ 
-		/** The id the row HAS: assigned by SQLite on an insert, or the existing
-		*  row's own id on an update. */
-id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
+		create: method(zod.z.object({ block: CoreBlockInputSchema }), zod.z.object({ block: CoreBlockSchema }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "admin",
+			caller: "required"
 		}),
-		/** Insert a new record. */
-		insert: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			record: zod.z.object({
-				id: zod.z.string().optional(),
-				data: zod.z.record(zod.z.string(), zod.z.unknown())
-			})
-		}), zod.z.object({ 
-		/**
-		* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
-		* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
-		* primary key — which is the only place an auto key is knowable.
-		*/
-id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
+		update: method(zod.z.object({
+			blockId: zod.z.string(),
+			block: CoreBlockInputFieldsSchema.partial()
+		}), zod.z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		delete: method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/**
-		* Insert MANY records in ONE transaction, returning how many landed.
-		*
-		* The write-side twin of {@link deleteWhere}, and it exists for the same
-		* reason: without it, appending a batch is N round trips and N COMMITs on
-		* the single shared connection that also serves every cluster-wide
-		* configuration read. The durable load series writes one process row per
-		* process per sample — 76 rows every 10 s on the live fleet — and the
-		* operator's rule for it is *one transaction per sample, never one per
-		* row*. `insert` cannot express that; nothing else could.
-		*
-		* **All or nothing.** A batch that fails on its fifth row leaves none of
-		* the five behind. A half-written sample is worse than a missing one: the
-		* missing one reads as "nobody reported", which is true, while the half
-		* one reads as "these were the only processes running", which is not.
-		*
-		* `id` is OPTIONAL per record, and that is the difference from
-		* {@link insert}. A collection whose primary key is an `INTEGER` rowid
-		* alias has no id to supply — SQLite assigns it, for free, and inventing a
-		* `randomUUID()` for such a column would write a 36-character string into
-		* an integer key. Omitted on a TEXT key, a uuid is generated exactly as
-		* `insert` does.
-		*/
-		insertMany: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			records: zod.z.array(BulkRecordSchema).readonly()
-		}), zod.z.object({ inserted: zod.z.number().int() }), {
+		setEnabled: method(zod.z.object({
+			blockId: zod.z.string(),
+			enabled: zod.z.boolean()
+		}), zod.z.object({ block: CoreBlockSchema }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
 		/**
-		* Several writes, ONE transaction, behind an optional precondition.
-		*
-		* The multi-collection twin of {@link insertMany}: a write that has to move
-		* a set of rows in one collection AND a revision in another cannot be
-		* expressed as separate calls without a window in which a reader (or a
-		* crash) sees half of it. The retrain annotation save replaces a frame's
-		* rows, its dismissed set and its revision this way.
+		* Stop this block's runner and let the supervisor bring it back.
 		*
-		* `guard`, when given, is read inside the transaction: if the row is
-		* missing or its column differs from `equals`, NOTHING is written and the
-		* answer is `{ applied: false, current }` with what was found — the
-		* compare-and-set a revisioned write needs, with no second reader able to
-		* slip between the check and the writes.
+		* **It stores nothing.** There is no "restart requested" flag and no second
+		* lifecycle field: the supervisor already stops and respawns a runner when
+		* the code hash changes, and this exposes that same path deliberately
+		* (D62 — a switch writes the authority that already owned the function).
+		* The next reconcile pass remains the authority, so a restart that lost a
+		* race is corrected within one pass rather than leaving a stale flag behind.
 		*
-		* **All or nothing**, like {@link insertMany}: a throw in any op rolls the
-		* whole call back. Ops run in the order given (delete before insert to
-		* replace a set). `namespace` applies to every collection named.
+		* Refused for a DISABLED block: nothing would come back, and a button that
+		* silently does nothing is worse than one that says why.
 		*/
-		transact: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			guard: TransactGuardSchema.optional(),
-			ops: zod.z.array(TransactOpSchema).readonly()
-		}), zod.z.object({
-			applied: zod.z.boolean(),
-			current: zod.z.unknown().optional()
-		}), {
+		restart: method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Update an existing record by ID. */
-		update: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			id: zod.z.string(),
-			data: zod.z.record(zod.z.string(), zod.z.unknown())
-		}), zod.z.void(), {
+		/**
+		* Type-check without saving — what the editor calls as the author types, so
+		* the compiler's verdict is the same one the server will reach.
+		* Accepts `{ code }` or `{ files, entry }` (multi-file project).
+		*/
+		compile: method(CoreBlockCompileInputSchema, CoreBlockCompileResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Delete a record by key/ID. */
-		delete: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			key: zod.z.string()
-		}), zod.z.void(), {
+		/**
+		* Hydrated settings form for one block, or null until a `settingsSchema`
+		* is known (extracted from the compiled entry's named export, or set on
+		* the block). Values live in the `core-blocks:settings` collection.
+		*/
+		getBlockSettings: method(zod.z.object({ blockId: zod.z.string() }), SettingsSchemaWithValuesSchema.nullable(), { auth: "admin" }),
+		/**
+		* Patch persisted preference values for one block. The schema is not
+		* rewritten here — only values. Scripts read the same blob via
+		* `ctx.settings.readAddonStore()` (mirrored into the block addon's
+		* `addon-settings` namespace on every patch).
+		*/
+		updateBlockSettings: method(zod.z.object({
+			blockId: zod.z.string(),
+			patch: SettingsPatchSchema
+		}), SettingsUpdateResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
 		/**
-		* Delete every record matching `filter`, in ONE statement, returning how
-		* many rows went. This exists because its absence made every retention
-		* path in the system an N+1 drain loop: `delete` takes a key, so a sweep
-		* had to SELECT a page of full rows — every column, including the fat
-		* ones — purely to learn their ids, then issue one call per row.
+		* The declaration files the editor type-checks against.
 		*
-		* **The filter is required and must resolve.** A predicate naming
-		* something the collection cannot express is an ERROR here, not a
-		* widening as it is on `query`, and a filter with no predicates is an
-		* error rather than "every row". Deleting a whole collection is a
-		* legitimate intent, but it must be asked for by name — not reached by
-		* an empty object.
+		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
+		* bundling it would roughly double the admin remote. Served rather than
+		* hand-stubbed: a block runs with the same `ctx` an addon gets, so a stub
+		* would drift and the editor would confidently autocomplete methods that
+		* do not exist.
 		*/
-		deleteWhere: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			filter: MutationFilterSchema
-		}), zod.z.object({ deleted: zod.z.number().int() }), {
+		getTypeDefs: method(zod.z.object({}), zod.z.object({ libs: zod.z.array(zod.z.object({
+			filePath: zod.z.string(),
+			content: zod.z.string()
+		})) }), { auth: "admin" }),
+		/**
+		* Create a composition block (D659). VALIDATED first against the live
+		* sources and every stored composition; a refusal names every problem by
+		* path and reason (D391) and stores nothing.
+		*/
+		createComposition: method(zod.z.object({ block: CompositionBlockInputSchema }), zod.z.object({ block: CoreBlockSchema }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "admin",
+			caller: "required"
 		}),
 		/**
-		* Apply `data` to every record matching `filter`, in one statement,
-		* returning how many rows changed. Same filter contract as
-		* {@link deleteWhere} — an unresolvable predicate is an error.
+		* Patch a composition block. A changed `composition` is validated exactly
+		* as on create. `expectedUpdatedAt` is the `updatedAt` the caller READ: a
+		* block changed since is refused by name, never silently overwritten.
 		*/
-		updateWhere: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			filter: MutationFilterSchema,
-			data: zod.z.record(zod.z.string(), zod.z.unknown())
-		}), zod.z.object({ updated: zod.z.number().int() }), {
+		updateComposition: method(zod.z.object({
+			blockId: zod.z.string(),
+			expectedUpdatedAt: zod.z.number(),
+			block: CompositionBlockInputSchema.partial()
+		}), zod.z.object({ block: CoreBlockSchema }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "admin",
+			caller: "required"
 		}),
-		/** Count entries in a collection, optionally filtered. */
-		count: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			filter: QueryFilterSchema.optional()
-		}), zod.z.number(), { auth: "admin" }),
+		/** One composition and the composer's state for it, or `not-loaded` (D315). */
+		getComposition: method(zod.z.object({ blockId: zod.z.string() }), CompositionGetReadSchema, { auth: "admin" }),
+		listCompositions: method(zod.z.object({}), CompositionListReadSchema, { auth: "admin" }),
 		/**
-		* `COUNT(*)` and one `SUM` / `MIN` / `MAX` per requested field, in ONE
-		* statement, over the rows `filter` selects.
-		*
-		* Exists because "how much is there" was being answered by materialising
-		* "what is there". The recorder's storage-pressure sweep asked its in-RAM
-		* footage index for bytes/count/oldest/newest across a set of storage
-		* locations twice a minute, and the only way to answer that from a map is
-		* to visit every row — 7.1 M of them on the live hub, ~15 M row visits a
-		* minute on the main thread, which is also why the whole archive had to
-		* stay resident to be visited. The question is a sum; nothing needs to be
-		* materialised to answer it.
-		*
-		* **The engine REFUSES a field it cannot serve**, exactly as
-		* `query.columns` does and unlike a PREDICATE, which is skipped when
-		* unresolvable. A dropped predicate over-matches and the caller sees extra
-		* rows; a dropped aggregate returns a NUMBER that is wrong and looks
-		* exactly like a real one. That asymmetry is what this repo has already
-		* paid for once in `count`.
+		* The composition that customizes an existing device (D663), found by its
+		* TARGET — never by the block's derived name. One per device at most.
 		*/
-		aggregate: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			fields: zod.z.array(AggregateFieldSchema).readonly(),
-			filter: QueryFilterSchema.optional()
-		}), AggregateResultSchema, { auth: "admin" }),
-		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
-		histogram: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			field: zod.z.string(),
-			bucketSize: zod.z.number().int().positive(),
-			origin: zod.z.number().int(),
-			filter: QueryFilterSchema.optional()
-		}), zod.z.array(zod.z.object({
-			bucket: zod.z.number().int(),
-			count: zod.z.number().int()
-		})).readonly(), { auth: "admin" }),
-		/** Check if a collection is empty. */
-		isEmpty: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string()
-		}), zod.z.boolean(), { auth: "admin" }),
+		getCustomization: method(zod.z.object({
+			addonId: zod.z.string().min(1),
+			stableId: zod.z.string().min(1)
+		}), CompositionCustomizationReadSchema, { auth: "admin" }),
 		/**
-		* Declare a typed (SQL-backed) collection with explicit columns +
-		* indexes. Idempotent: re-declaring an existing collection with the
-		* same shape is a no-op; shape changes (new columns, new indexes)
-		* are applied additively. Subsequent `insert` / `update` / `delete`
-		* / `query` calls on this collection use typed columns instead of
-		* JSON-blob storage — `record.data` fields are spread across
-		* columns, `query.filter.where` matches real columns (no
-		* `json_extract` overhead), `orderBy` uses column indexes.
-		*
-		* Addons call this in `onInitialize` before their first read/write.
-		* Collection names should be namespaced by addon (e.g.
-		* `pipeline-analytics:object-events`) to avoid cross-addon
-		* clashes — no automatic prefix is added.
+		* The capabilities a composition may BUILD on a device of `deviceType`
+		* (a new device, or added to an existing one), with their fields — the
+		* editor's feature list and the presets' availability (G2, D676). Built
+		* from the validator's own blockers; a replace of a BOUND cap is not
+		* listed here (the device's bindings say what it has).
 		*/
-		declareCollection: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			columns: zod.z.array(CollectionColumnSchema).readonly(),
-			indexes: zod.z.array(CollectionIndexSchema).readonly().optional()
-		}), zod.z.void(), {
+		listComposableCaps: method(zod.z.object({ deviceType: zod.z.enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }),
+		/**
+		* Validate without saving — the same verdict the save reaches. A mutation
+		* for its body size; it writes nothing, so its access is `view`.
+		*/
+		validateComposition: method(zod.z.object({
+			composition: CompositionSchema,
+			blockId: zod.z.string().optional()
+		}), CompositionValidationSchema, {
 			kind: "mutation",
-			auth: "admin"
+			auth: "admin",
+			access: "view"
+		})
+	}
+};
+/**
+* `custom-model-registry` — collection cap exposing operator-registered
+* custom detection models. Each provider (today: `addon-model-studio`)
+* contributes a list of `CustomModelDescriptor`s; the hub auto-concatenates
+* them across providers (`concatCollection`).
+*
+* The detection-pipeline is *aware* of this cap: when at least one provider
+* exists it unions these descriptors into the per-step model picker and the
+* runtime model-resolution path, alongside the static catalog. When no
+* provider exists the consumer no-ops entirely (identical to the catalog-only
+* behaviour).
+*
+* A descriptor carries a full `ModelCatalogEntry` directly — the same shape
+* the static catalog uses — so the existing download/resolution code consumes
+* it unchanged. `stepId` is the detection step the model targets
+* (e.g. `'object-detection'`).
+*/
+var CustomModelDescriptorSchema = zod.z.object({
+	stepId: zod.z.string(),
+	entry: ModelCatalogEntrySchema
+});
+/** One regular file of an imported bundle, as the producer measured it. */
+var ModelBundleFileSchema = zod.z.object({
+	/** Relative path inside the bundle tar; an mlpackage member is `<x>.mlpackage/<member>`. */
+	path: zod.z.string().min(1),
+	bytes: zod.z.number().int().nonnegative(),
+	sha256: zod.z.string().regex(/^[0-9a-f]{64}$/)
+});
+var ImportModelBundleInputSchema = zod.z.object({
+	/** The registry provider that keeps the model (Model Studio). */
+	addonId: zod.z.string(),
+	stepId: zod.z.string().min(1),
+	/**
+	* The catalog rows to register, complete, every format URL already
+	* `camstack-local://<modelId>/<file>` naming a file of the bundle. One
+	* bundle may carry several rows (a base and its INT8 variant).
+	*/
+	entries: zod.z.array(ModelCatalogEntrySchema).min(1).max(4),
+	/** The bundle tar, offered by the producer over `ctx.peerBytes` (same host). */
+	bundle: zod.z.object({
+		ticket: PeerBytesTicketSchema,
+		bytes: zod.z.number().int().positive(),
+		sha256: zod.z.string().regex(/^[0-9a-f]{64}$/)
+	}),
+	/** Every file the tar must hold; anything missing, extra or different is refused. */
+	files: zod.z.array(ModelBundleFileSchema).min(1).max(64),
+	/** Convert missing engine formats and push the model to every agent afterwards. */
+	distribute: zod.z.boolean()
+});
+var ImportModelBundleResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("imported"),
+	modelIds: zod.z.array(zod.z.string()).readonly(),
+	distributed: zod.z.array(zod.z.object({
+		modelId: zod.z.string(),
+		nodeId: zod.z.string(),
+		format: zod.z.enum(MODEL_FORMATS),
+		ok: zod.z.boolean(),
+		error: zod.z.string().optional()
+	})).readonly()
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	reason: zod.z.enum([
+		"transfer-failed",
+		"checksum-mismatch",
+		"bundle-mismatch",
+		"invalid-entry",
+		"id-taken"
+	]),
+	detail: zod.z.string()
+})]);
+var customModelRegistryCapability = {
+	name: "custom-model-registry",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`. The only
+		* consumer, the detection-pipeline's model resolution
+		* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
+		* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
+		* never tRPC — so `auth: 'admin'` costs it nothing.
+		*/
+		listModels: method(zod.z.void(), zod.z.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }),
+		/**
+		* Register a model whose files arrive as ONE bundle tar (D806): the tar
+		* is taken over `ctx.peerBytes`, checked against `bundle.sha256` and
+		* every row of `files`, unpacked into the hub's flat modelsDir (directory
+		* formats included), each format's `.revision` record written, the rows
+		* upserted under the operator's name, the hub marked available and —
+		* when asked — engine formats converted and the model distributed. A
+		* model id already registered by another source is refused, never
+		* overwritten.
+		*/
+		importModelBundle: method(ImportModelBundleInputSchema, ImportModelBundleResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
 		})
 	}
 };
@@ -15694,6 +15790,16 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/** Upsert many records in ONE transaction; see the door's `upsertMany`. */
+		upsertMany: method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			conflict: zod.z.array(zod.z.string()).readonly(),
+			records: zod.z.array(BulkRecordSchema).readonly()
+		}), zod.z.object({ upserted: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Insert many records in ONE transaction. All or nothing. */
 		insertMany: method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -15786,12 +15892,7 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 			collection: zod.z.string()
 		}), zod.z.boolean(), { auth: "admin" }),
 		/** Declare a typed (SQL-backed) collection with columns + indexes. */
-		declareCollection: method(zod.z.object({
-			namespace: zod.z.string().optional(),
-			collection: zod.z.string(),
-			columns: zod.z.array(CollectionColumnSchema).readonly(),
-			indexes: zod.z.array(CollectionIndexSchema).readonly().optional()
-		}), zod.z.void(), {
+		declareCollection: method(DeclareCollectionInputSchema, zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		})
@@ -53098,6 +53199,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.upsertMany": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dayNight.getOptions": {
 		capName: "day-night",
 		capScope: "device",
@@ -57946,6 +58053,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.upsertMany": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"smoke.getStatus": {
 		capName: "smoke",
 		capScope: "device",
@@ -65568,6 +65681,12 @@ Object.defineProperty(exports, "DATAPLANE_SECRET_HEADER", {
 		return DATAPLANE_SECRET_HEADER;
 	}
 });
+Object.defineProperty(exports, "DATA_STORE_DATABASES", {
+	enumerable: true,
+	get: function() {
+		return DATA_STORE_DATABASES;
+	}
+});
 Object.defineProperty(exports, "DAY_NAMES", {
 	enumerable: true,
 	get: function() {