@camstack/system 1.2.442 → 1.2.444

package/dist/{dist-CyIHDLCg.js → dist-D1vECb_6.js}

@@ -736,7 +736,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-bgZLodYc.mjs
+//#region ../types/dist/sleep-WsrozGDL.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -848,21 +848,21 @@ function collectSecretConfigKeys(schema) {
 	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
 	return keys;
 }
-function isRecord$3(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sectionsOf(schema) {
-	if (!isRecord$3(schema)) return [];
+	if (!isRecord$5(schema)) return [];
 	const sections = schema["sections"];
 	return Array.isArray(sections) ? sections : [];
 }
 function fieldsOf(node) {
-	if (!isRecord$3(node)) return [];
+	if (!isRecord$5(node)) return [];
 	const fields = node["fields"];
 	return Array.isArray(fields) ? fields : [];
 }
 function walkField(field, out) {
-	if (!isRecord$3(field)) return;
+	if (!isRecord$5(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
@@ -900,7 +900,7 @@ function walkField(field, out) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$2(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -911,16 +911,16 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$4(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 /** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
 function isSecretMarkerLike(value) {
-	return isRecord$2(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+	return isRecord$4(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
 }
 function isSecretClear(value) {
-	return isRecord$2(value) && value["$secretClear"] === true;
+	return isRecord$4(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -1589,7 +1589,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$1(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -1602,7 +1602,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$3(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -1657,7 +1657,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$3) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -1673,7 +1673,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$1(row)) {
+		if (!isRecord$3(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -1698,7 +1698,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$1(incoming)) {
+			if (!isRecord$3(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -1706,7 +1706,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$1(stored) ? stored : {};
+			const storedObj = isRecord$3(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -1829,7 +1829,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$1(v)) {
+		if (isRecord$3(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -1861,7 +1861,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -1890,7 +1890,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord(item) && isRecord(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$2(item) && isRecord$2(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -1901,7 +1901,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord(value) && isRecord(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$2(value) && isRecord$2(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -1909,7 +1909,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord(incoming) || !isRecord(stored)) return incoming;
+	if (!isRecord$2(incoming) || !isRecord$2(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -1940,7 +1940,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord(a) && isRecord(b)) {
+	if (isRecord$2(a) && isRecord$2(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -1964,7 +1964,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord(value)) return null;
+	if (!isRecord$2(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -3266,6 +3266,413 @@ var PeerBytesTicketSchema = zod.z.object({
 	*/
 	declaredBytes: zod.z.number().int().nonnegative().nullable()
 });
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_BATCH_MAX_BYTES = 4 * 1024 * 1024;
+var RECORD_QUERY_MAX = 1e3;
+/** Rows one DELETE statement removes before the serving thread yields. */
+var RECORD_DELETE_BATCH = 5e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+/** The engine's TTL sweep cadence. */
+var RECORD_SWEEP_INTERVAL_MS = 10 * 6e4;
+/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
+var RECORD_SECRET_COLLECTION_PREFIX = "records:";
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+/** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
+var RevConflictError = class extends RecordsError {
+	constructor(detail) {
+		super("rev-conflict", detail);
+		this.name = "RevConflictError";
+	}
+};
+/** `data` exceeds the kind's `maxDataBytes`. Bytes are never record fields (D613). */
+var RecordTooLargeError = class extends RecordsError {
+	constructor(detail) {
+		super("too-large", detail);
+		this.name = "RecordTooLargeError";
+	}
+};
+/** A filter, order or aggregate names a field no declared index serves. */
+var UnindexedFilterError = class extends RecordsError {
+	constructor(detail) {
+		super("unindexed-filter", detail);
+		this.name = "UnindexedFilterError";
+	}
+};
+/** A bulk delete with no predicate at all. */
+var FilterRequiredError = class extends RecordsError {
+	constructor(detail) {
+		super("filter-required", detail);
+		this.name = "FilterRequiredError";
+	}
+};
+/** The caller declared no such kind (another addon's kind is indistinguishable from none). */
+var UnknownRecordKindError = class extends RecordsError {
+	constructor(detail) {
+		super("unknown-kind", detail);
+		this.name = "UnknownRecordKindError";
+	}
+};
+var RecordNotFoundError = class extends RecordsError {
+	constructor(detail) {
+		super("not-found", detail);
+		this.name = "RecordNotFoundError";
+	}
+};
+/** A unique index refused the write. */
+var RecordUniqueViolationError = class extends RecordsError {
+	constructor(detail) {
+		super("unique-violation", detail);
+		this.name = "RecordUniqueViolationError";
+	}
+};
+/** A secret field held a plain string where only a keychain marker may be stored. */
+var PlaintextSecretError = class extends RecordsError {
+	constructor(detail) {
+		super("plaintext-secret", detail);
+		this.name = "PlaintextSecretError";
+	}
+};
+/** A marker whose ref is not the row's own (the D878 rule). */
+var ForeignSecretMarkerError = class extends RecordsError {
+	constructor(detail) {
+		super("foreign-marker", detail);
+		this.name = "ForeignSecretMarkerError";
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
+var NoCallerError = class extends RecordsError {
+	constructor(detail) {
+		super("no-caller", detail);
+		this.name = "NoCallerError";
+	}
+};
+var BatchTooLargeError = class extends RecordsError {
+	constructor(detail) {
+		super("batch-too-large", detail);
+		this.name = "BatchTooLargeError";
+	}
+};
+function defOf(schema) {
+	return schema._zod?.def ?? {};
+}
+function declaredHere(schema) {
+	return zod.z.globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const key = each ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function elementId(element, idKey, declared, prefix) {
+	const id = isRecord$1(element) ? element[idKey] : void 0;
+	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
+	return id;
+}
+/**
+* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
+* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
+* result is a new body, `data` is untouched.
+*/
+var REMOVE_LEAF = Symbol("remove-leaf");
+function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
+	if (!isRecord$1(node)) return node;
+	const segment = segments[index];
+	if (segment === void 0) return node;
+	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
+	const child = node[segment.key];
+	const keys = [...walkedKeys, segment.key];
+	const last = index === segments.length - 1;
+	if (segment.each) {
+		if (!Array.isArray(child)) return node;
+		const prefix = keys.join(".");
+		const idKey = arrayKeys[prefix];
+		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
+		const mapped = child.map((element) => {
+			const id = elementId(element, idKey, declared, prefix);
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
+			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
+		});
+		return {
+			...node,
+			[segment.key]: mapped
+		};
+	}
+	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
+	if (last) {
+		const replacement = visit({
+			declared,
+			concrete,
+			value: child
+		});
+		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
+		return {
+			...node,
+			[segment.key]: replacement
+		};
+	}
+	return {
+		...node,
+		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+	};
+}
+/** Replace/remove every present secret leaf; returns a NEW body. */
+function mapSecretLeaves(data, paths, arrayKeys, visit) {
+	let current = data;
+	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
+	return current;
+}
+/** Every present secret leaf, read-only. */
+function collectSecretLeaves(data, paths, arrayKeys) {
+	const found = [];
+	mapSecretLeaves(data, paths, arrayKeys, (leaf) => {
+		found.push(leaf);
+		return leaf.value;
+	});
+	return found;
+}
+/**
+* The keychain collection name a kind's secrets live under. Prefixed so a
+* record's refs never collide with the refs a legacy collection of the same name
+* already holds during an adoption.
+*/
+function recordSecretCollection(kind) {
+	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
+}
+/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
+function recordSecretRef(owner, kind, rowId, concretePath) {
+	return buildSecretRef({
+		owner,
+		scope: {
+			kind: "row",
+			collection: recordSecretCollection(kind),
+			rowId
+		},
+		fieldPath: concretePath
+	});
+}
+/**
+* Record kinds (D881): the declaration an addon makes of one kind of fact, the
+* Zod row schema that describes it, and the helper that turns the two into the
+* JSON the engine stores.
+*
+* A kind is declared ONCE, next to the code that owns it, and the engine's
+* reconciler creates its indexes - nothing creates DDL at runtime from a write.
+* Everything the generic machinery needs (secret fields, the entry descriptor)
+* is DERIVED from the Zod schema: `.meta({ secret: true })` marks a credential,
+* never a field name (D879).
+*/
+/** A JSON field path: `trackId`, `auth.accessToken`. Charset-restricted: it is rendered into DDL. */
+var RecordFieldPathSchema = zod.z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}(\.[A-Za-z_][A-Za-z0-9_]{0,63}){0,3}$/);
+var RecordIndexSchema = zod.z.object({
+	name: zod.z.string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+	fields: zod.z.array(RecordFieldPathSchema).min(1).max(4),
+	unique: zod.z.boolean().optional()
+}).strict();
+var RecordRetentionSchema = zod.z.union([
+	zod.z.object({
+		ttlMs: zod.z.number().int().positive(),
+		from: zod.z.enum(["at", "write"])
+	}).strict(),
+	zod.z.object({
+		maxRows: zod.z.number().int().positive().optional(),
+		maxRowsPerDevice: zod.z.number().int().positive().optional()
+	}).strict().refine((r) => r.maxRows !== void 0 || r.maxRowsPerDevice !== void 0, { message: "name maxRows, maxRowsPerDevice or both" }),
+	zod.z.object({
+		owner: zod.z.string().min(1),
+		reason: zod.z.string().min(1)
+	}).strict(),
+	zod.z.object({ none: zod.z.string().min(1) }).strict()
+]);
+/** The descriptor a generic entries UI reads (D881 "generic entries"). */
+var EntryDescriptorSchema = zod.z.object({
+	title: zod.z.string().min(1),
+	/** The record body field shown as the entry's name. */
+	nameField: zod.z.string().min(1),
+	/** JSON Schema of the entry body; `secret: true` marks a password field. */
+	fields: zod.z.record(zod.z.string(), zod.z.unknown())
+}).strict();
+/** What crosses the wire and sits in the engine's catalog: JSON only, no Zod. */
+var RecordKindDeclarationSchema = zod.z.object({
+	database: zod.z.enum(RECORD_DATABASES).default("settings"),
+	class: zod.z.enum(RECORD_CLASSES),
+	writeTrigger: zod.z.string().min(1),
+	device: zod.z.enum([
+		"required",
+		"optional",
+		"none"
+	]).default("none"),
+	at: zod.z.enum(["required", "none"]).default("none"),
+	indexes: zod.z.array(RecordIndexSchema).max(8).default([]),
+	retention: RecordRetentionSchema,
+	deviceRemoval: zod.z.enum(["delete", "none"]).default("none"),
+	maxDataBytes: zod.z.number().int().positive().max(RECORD_MAX_DATA_BYTES).default(RECORD_DEFAULT_MAX_DATA_BYTES),
+	/** Derived from the Zod schema; never written by hand. */
+	secretPaths: zod.z.array(zod.z.string().min(1)).default([]),
+	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
+	secretArrayKeys: zod.z.record(zod.z.string(), zod.z.string()).default({}),
+	/** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+	adoptsFrom: zod.z.string().min(1).optional(),
+	/** Kinds that must agree through `transact` sit in one file under one family name. */
+	transactFamily: zod.z.string().min(1).optional(),
+	entry: EntryDescriptorSchema.optional()
+}).strict();
+/** The kind names: lower-case, dash separated, short enough for an index name. */
+var RecordKindNameSchema = zod.z.string().regex(/^[a-z][a-z0-9-]{0,47}$/);
+/** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
+function assertValidDeclaration(name, decl) {
+	const refuse = (why) => {
+		throw new DeclarationRefusedError(`kind "${name}": ${why}`);
+	};
+	if (!RecordKindNameSchema.safeParse(name).success) refuse("the name must be lower-case-dashed");
+	const seen = /* @__PURE__ */ new Set();
+	for (const index of decl.indexes) {
+		if (seen.has(index.name)) refuse(`index name "${index.name}" is declared twice`);
+		seen.add(index.name);
+	}
+	const { retention } = decl;
+	const hasSecrets = decl.secretPaths.length > 0;
+	if ("ttlMs" in retention) {
+		if (retention.from === "at" && decl.at !== "required") refuse("a ttl from \"at\" needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use engine TTL (its keychain values would be orphaned)");
+	}
+	if ("maxRows" in retention || "maxRowsPerDevice" in retention) {
+		if (retention.maxRowsPerDevice !== void 0 && decl.device !== "required") refuse("maxRowsPerDevice needs device: \"required\"");
+		if (decl.at !== "required") refuse("a row bound trims the oldest \"at\": it needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use an engine row bound");
+		const bound = Math.max(retention.maxRows ?? 0, retention.maxRowsPerDevice ?? 0);
+		if (decl.database === "settings" && bound > 5e4) refuse(`a row bound above ${RECORD_SETTINGS_MAX_ROWS} belongs in database: "events" (a big delete on the settings thread stalls every configuration read)`);
+	}
+	if (decl.deviceRemoval === "delete" && decl.device === "none") refuse("deviceRemoval: \"delete\" needs a device: \"required\" or \"optional\"");
+	for (const path of decl.secretPaths) for (const prefix of secretArrayPrefixes(path)) if (decl.secretArrayKeys[prefix] === void 0) refuse(`secret path "${path}" crosses the array "${prefix}": declare its id key in secretArrayKeys`);
+}
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = zod.z.enum([
 	"high",
@@ -4467,69 +4874,6 @@ var RUNTIME_DEFAULTS = {
 	"ffmpeg.threadCount": 0,
 	"auth.tokenExpiry": "30d"
 };
-function defOf(schema) {
-	return schema._zod?.def ?? {};
-}
-function declaredHere(schema) {
-	return zod.z.globalRegistry.get(schema)?.secret === true;
-}
-/** Wrapper kinds whose `innerType` is the field itself. */
-var WRAPPERS = new Set([
-	"optional",
-	"nullable",
-	"default",
-	"prefault",
-	"catch",
-	"readonly",
-	"nonoptional"
-]);
-/**
-* The schema layers that make up ONE field: the schema itself and every
-* wrapper below it (optional / default / nullable / readonly / catch), plus
-* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
-* `.transform` on `in`).
-*/
-function layersOf(schema) {
-	const out = [];
-	const queue = [schema];
-	while (queue.length > 0) {
-		const s = queue.shift();
-		if (!s || out.includes(s)) continue;
-		out.push(s);
-		const def = defOf(s);
-		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
-		if (def.type === "pipe") {
-			if (def.in) queue.push(def.in);
-			if (def.out) queue.push(def.out);
-		}
-	}
-	return out;
-}
-/** True when any layer of this field declares `.meta({ secret: true })`. */
-function isZodSecret(schema) {
-	return layersOf(schema).some(declaredHere);
-}
-/**
-* Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
-* object or array is reported as one path and not descended into — everything
-* under it is secret.
-*/
-function collectZodSecretPaths(schema, prefix = "") {
-	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
-	const paths = [];
-	for (const layer of layersOf(schema)) {
-		const def = defOf(layer);
-		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
-		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
-		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
-		else if (def.type === "intersection") {
-			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
-			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
-		}
-	}
-	return [...new Set(paths)];
-}
 /**
 * A user-facing error with a STABLE code (D863).
 *
@@ -15476,6 +15820,41 @@ function describeComposableCaps(defs, deviceType) {
 	}).toSorted((a, b) => a.cap.localeCompare(b.cap));
 }
 /**
+* The report of a one-shot "move this owner's plaintext secrets into the
+* keychain" run (D878). COUNTS only - never a value, never a ref.
+*
+* The owner runs it on its own rows, through its own write path; an operator
+* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
+* Dry run (`apply: false`) reports what WOULD move and changes nothing.
+*/
+var RawSecretMigrationInputSchema = zod.z.object({ 
+/** `false` (the default of the script) = report only. */
+apply: zod.z.boolean() });
+var RawSecretMigrationReportSchema = zod.z.object({
+	apply: zod.z.boolean(),
+	/** Rows that can carry a secret (a profile, an enrolment). */
+	rows: zod.z.number().int(),
+	/** Rows whose secret was plaintext when the run started. */
+	raw: zod.z.number().int(),
+	/** Rows that already held a keychain marker when the run started. */
+	markers: zod.z.number().int(),
+	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
+	migrated: zod.z.number().int(),
+	/** Plaintext rows left in place because the move or its read-back failed. */
+	failed: zod.z.number().int(),
+	/** After the run: rows still holding plaintext. */
+	remainingRaw: zod.z.number().int(),
+	/** After the run: markers the keychain could not resolve right now. */
+	unresolvedMarkers: zod.z.number().int(),
+	/**
+	* A second, redundant copy of the secrets' rows that the run found (and, on
+	* `apply`, deleted after verifying the first). Owners with a single copy omit it.
+	*/
+	redundantCopies: zod.z.number().int().optional(),
+	/** True when nothing is raw and every marker resolves. */
+	verified: zod.z.boolean()
+});
+/**
 * core-blocks — user-authored TypeScript, stored in the kernel and executed in
 * its own process.
 *
@@ -15839,14 +16218,16 @@ var coreBlocksCapability = {
 		/**
 		* Hydrated settings form for one block, or null until a `settingsSchema`
 		* is known (extracted from the compiled entry's named export, or set on
-		* the block). Values live in the `core-blocks:settings` collection.
+		* the block). Values live in the block addon's `addon-settings` rows (D880);
+		* a password field answers as a "set" view, never the value.
 		*/
 		getBlockSettings: method(zod.z.object({ blockId: zod.z.string() }), SettingsSchemaWithValuesSchema.nullable(), { auth: "admin" }),
 		/**
 		* Patch persisted preference values for one block. The schema is not
-		* rewritten here — only values. Scripts read the same blob via
-		* `ctx.settings.readAddonStore()` (mirrored into the block addon's
-		* `addon-settings` namespace on every patch).
+		* rewritten here — only values. Scripts read the same rows via
+		* `ctx.settings.readAddonStore()`. A field the schema declares `password` /
+		* `secret: true` is stored in the keychain (owner = the block's addon id)
+		* and the row holds a marker; a REDACTED or view value keeps the stored one.
 		*/
 		updateBlockSettings: method(zod.z.object({
 			blockId: zod.z.string(),
@@ -15856,6 +16237,16 @@ var coreBlocksCapability = {
 			auth: "admin"
 		}),
 		/**
+		* D880: move every plaintext password a block's `settingsSchema` declares
+		* into the keychain and delete the legacy `core-blocks:settings` copy. Dry
+		* run unless `apply`; idempotent; counts only. A secret is read back from
+		* the keychain before its row is rewritten.
+		*/
+		migrateRawSecrets: method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* The declaration files the editor type-checks against.
 		*
 		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
@@ -16281,6 +16672,276 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 		})
 	}
 };
+/**
+* Every cap whose provider reads a `callerAddonId` in its input (the keychain's
+* owner check, device-history's `not-owner`, records' owner).
+*
+* The stamp is set ONLY by the transport (`stampCallerAddonId`, or stated by a
+* hub in-process caller). The generated HTTP/tRPC mount parses input with
+* `.loose()`, so without this a session could add the key itself and act as
+* another addon. The mount strips it for these caps.
+*/
+var CALLER_STAMPED_CAPABILITIES = [
+	"keychain",
+	"device-history",
+	"records",
+	"integrations",
+	"device-manager"
+];
+/** A copy of `input` without the caller stamp. Anything that is not a plain object passes through. */
+function withoutCallerStamp(input) {
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return input;
+	if (!Object.prototype.hasOwnProperty.call(input, "callerAddonId")) return input;
+	return Object.fromEntries(Object.entries(input).filter(([key]) => key !== "callerAddonId"));
+}
+/**
+* records - an addon's own facts and documents (D881): ledgers, audit rows,
+* config documents, mirrors. The third storage API next to `ctx.settings`
+* (operator intent, D870) and device-history (numbers over time, D850).
+*
+* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
+* crossed a process and stated by a hub in-process caller (`ctx.records` does
+* that with the addon id closed over). It is deliberately NOT in any input
+* schema, so a session can never supply it, and a call with no stamp is refused
+* `records/no-caller`. A kind is readable and writable only by its owner; other
+* addons go through the owner's capability.
+*
+* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
+* never `[]`. Secret fields are never on the wire: a read shows the
+* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
+* resolves itself, and a write may carry only a keychain marker bound to the
+* row's own ref.
+*
+* Internal: addons reach it through `ctx.records`, never directly.
+*/
+var RecordIdSchema = zod.z.string().min(1).max(256);
+/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
+var RecordBodySchema = zod.z.record(zod.z.string(), zod.z.unknown());
+var RecordInputSchema = zod.z.object({
+	id: RecordIdSchema,
+	/** The device this row belongs to (D865 removal, per-device reads). */
+	deviceId: zod.z.number().int().optional(),
+	/** The domain clock, ms: observed / created / opened. */
+	at: zod.z.number().int().optional(),
+	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
+	expiresAt: zod.z.number().int().optional(),
+	data: RecordBodySchema
+});
+var RecordViewSchema = zod.z.object({
+	id: zod.z.string(),
+	deviceId: zod.z.number().int().nullable(),
+	at: zod.z.number().nullable(),
+	expiresAt: zod.z.number().nullable(),
+	rev: zod.z.number().int(),
+	updatedAt: zod.z.number(),
+	data: RecordBodySchema
+});
+/** One predicate on a declared index field: equality, a set, or a range. */
+var RecordWhereValueSchema = zod.z.union([
+	zod.z.string(),
+	zod.z.number(),
+	zod.z.boolean(),
+	zod.z.object({ in: zod.z.array(zod.z.union([
+		zod.z.string(),
+		zod.z.number(),
+		zod.z.boolean()
+	])).min(1).max(RECORD_BATCH_MAX) }),
+	zod.z.object({
+		gt: zod.z.union([zod.z.string(), zod.z.number()]).optional(),
+		gte: zod.z.union([zod.z.string(), zod.z.number()]).optional(),
+		lt: zod.z.union([zod.z.string(), zod.z.number()]).optional(),
+		lte: zod.z.union([zod.z.string(), zod.z.number()]).optional()
+	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
+]);
+/** Declared index fields only. Anything else does not compile, by design. */
+var RecordWhereSchema = zod.z.record(RecordFieldPathSchema, RecordWhereValueSchema);
+var KindShape = { kind: RecordKindNameSchema };
+var TimeWindowShape = {
+	deviceId: zod.z.number().int().optional(),
+	atFrom: zod.z.number().optional(),
+	atTo: zod.z.number().optional()
+};
+var RecordQueryInputSchema = zod.z.object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional(),
+	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
+	order: zod.z.enum(["at", "id"]).optional(),
+	desc: zod.z.boolean().optional(),
+	limit: zod.z.number().int().min(1).max(RECORD_QUERY_MAX).default(100),
+	/** Opaque keyset cursor from a previous answer. There is no offset. */
+	cursor: zod.z.string().min(1).optional()
+});
+var RecordQueryResultSchema = zod.z.object({
+	records: zod.z.array(RecordViewSchema),
+	nextCursor: zod.z.string().nullable()
+});
+var RecordKindStateSchema = zod.z.enum([
+	"created",
+	"unchanged",
+	"updated"
+]);
+var DeclareKindResultSchema = zod.z.object({
+	kindId: zod.z.number().int(),
+	state: RecordKindStateSchema,
+	createdIndexes: zod.z.array(zod.z.string()),
+	/** The boot guard: the kind is empty while its legacy table still holds rows. */
+	adoptionPending: zod.z.object({
+		legacyTable: zod.z.string(),
+		legacyRows: zod.z.number().int()
+	}).nullable()
+});
+/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
+var SecretRefsList = zod.z.array(zod.z.string());
+var RecordSecretRefsSchema = zod.z.record(zod.z.string(), zod.z.record(zod.z.string(), zod.z.string()));
+var recordsCapability = {
+	name: "records",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/** Reconcile this addon's kinds: create the catalog rows and the declared indexes. Additive only. */
+		declareKinds: method(zod.z.object({ kinds: zod.z.record(RecordKindNameSchema, RecordKindDeclarationSchema) }), zod.z.object({ kinds: zod.z.record(zod.z.string(), DeclareKindResultSchema) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		get: method(zod.z.object({
+			...KindShape,
+			id: RecordIdSchema
+		}), RecordViewSchema.nullable(), { auth: "admin" }),
+		getMany: method(zod.z.object({
+			...KindShape,
+			ids: zod.z.array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+		}), zod.z.array(RecordViewSchema), { auth: "admin" }),
+		/** The keychain refs of the rows' secret fields, by id and concrete path. For the owner's `ctx.secrets`. */
+		secretRefs: method(zod.z.object({
+			...KindShape,
+			ids: zod.z.array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+		}), RecordSecretRefsSchema, { auth: "admin" }),
+		put: method(zod.z.object({
+			...KindShape,
+			record: RecordInputSchema,
+			/** Compare-and-set. `0` means "the row must not exist". */
+			ifRev: zod.z.number().int().min(0).optional()
+		}), zod.z.object({
+			rev: zod.z.number().int(),
+			releasedRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		putMany: method(zod.z.object({
+			...KindShape,
+			records: zod.z.array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
+		}), zod.z.object({
+			count: zod.z.number().int(),
+			releasedRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** One-statement RFC 7396 merge: `null` removes a field; a merge never reads. */
+		patch: method(zod.z.object({
+			...KindShape,
+			id: RecordIdSchema,
+			data: RecordBodySchema,
+			at: zod.z.number().int().nullable().optional(),
+			expiresAt: zod.z.number().int().nullable().optional(),
+			ifRev: zod.z.number().int().min(1).optional()
+		}), zod.z.object({
+			rev: zod.z.number().int(),
+			releasedRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		delete: method(zod.z.object({
+			...KindShape,
+			id: RecordIdSchema
+		}), zod.z.object({
+			deleted: zod.z.boolean(),
+			secretRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteMany: method(zod.z.object({
+			...KindShape,
+			ids: zod.z.array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+		}), zod.z.object({
+			deleted: zod.z.number().int(),
+			secretRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		query: method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }),
+		count: method(zod.z.object({
+			...KindShape,
+			...TimeWindowShape,
+			where: RecordWhereSchema.optional()
+		}), zod.z.object({ count: zod.z.number().int() }), { auth: "admin" }),
+		histogram: method(zod.z.object({
+			...KindShape,
+			deviceId: zod.z.number().int().optional(),
+			from: zod.z.number(),
+			to: zod.z.number(),
+			bucketMs: zod.z.number().int().positive()
+		}), zod.z.object({ buckets: zod.z.array(zod.z.object({
+			bucketStart: zod.z.number(),
+			count: zod.z.number().int()
+		})) }), { auth: "admin" }),
+		/** Index-served only: every field must belong to ONE declared index. */
+		aggregate: method(zod.z.object({
+			...KindShape,
+			op: zod.z.enum([
+				"sum",
+				"min",
+				"max",
+				"count"
+			]),
+			field: RecordFieldPathSchema.optional(),
+			groupBy: RecordFieldPathSchema.optional(),
+			where: RecordWhereSchema.optional()
+		}), zod.z.object({ rows: zod.z.array(zod.z.object({
+			group: zod.z.union([
+				zod.z.string(),
+				zod.z.number(),
+				zod.z.null()
+			]),
+			value: zod.z.number().nullable()
+		})) }), { auth: "admin" }),
+		/** Batched (5 000 rows per statement, yielding between). Needs a predicate: there is no "delete all". */
+		deleteWhere: method(zod.z.object({
+			...KindShape,
+			deviceId: zod.z.number().int().optional(),
+			atBefore: zod.z.number().optional(),
+			where: RecordWhereSchema.optional()
+		}), zod.z.object({
+			deleted: zod.z.number().int(),
+			secretRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The D865 hook body: every kind of this addon declared `deviceRemoval: 'delete'`. */
+		deleteDevice: method(zod.z.object({
+			deviceId: zod.z.number().int(),
+			kinds: zod.z.array(RecordKindNameSchema).optional()
+		}), zod.z.object({
+			deleted: zod.z.record(zod.z.string(), zod.z.number().int()),
+			secretRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** A monotonically increasing integer per kind (replaces "resume from the highest"). */
+		allocateId: method(zod.z.object(KindShape), zod.z.object({ id: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 /** One table of the settings database. */
 var StorageTableSchema = zod.z.object({
 	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
@@ -16293,6 +16954,28 @@ var StorageTableSchema = zod.z.object({
 	/** Declared by an addon since this engine process started (a running addon claims it). */
 	declaredThisBoot: zod.z.boolean()
 });
+/** One declared record kind (D881) as System -> Data shows it. */
+var StorageKindSchema = zod.z.object({
+	owner: zod.z.string(),
+	kind: zod.z.string(),
+	database: zod.z.enum(["settings", "events"]),
+	class: zod.z.string(),
+	state: zod.z.enum([
+		"declared",
+		"orphaned",
+		"dropped"
+	]),
+	/** `null` when the caller asked for no counts (`counts: false`). */
+	rows: zod.z.number().int().nonnegative().nullable(),
+	/** Rows x the average size of a sample; null for an empty kind. */
+	bytesEstimate: zod.z.number().int().nonnegative().nullable(),
+	writeTrigger: zod.z.string(),
+	retention: RecordRetentionSchema,
+	/** `true` when the kind is an entry kind (the generic entries UI lists it). */
+	entry: zod.z.boolean(),
+	/** The whole declaration, secret paths and entry descriptor included (the entries service builds its handle from it). */
+	declaration: RecordKindDeclarationSchema
+});
 /**
 * The collections retired by exact name: the D870 ones (their data became keys
 * of the camera's settings) and the three D871 leftovers (the `stats-5m` tables
@@ -16311,7 +16994,16 @@ var STORAGE_ADMIN_MOVED_COLLECTIONS = [
 	"pipeline-orchestrator:device-features",
 	"pipeline-analytics:stats-5m",
 	"pipeline-orchestrator:stats-5m",
-	"vec_object_clip"
+	"vec_object_clip",
+	"addon-devices",
+	"sections",
+	"provider-settings",
+	"device-settings",
+	"ai:budgets",
+	"pipeline-analytics:retrain-dataset-versions",
+	"training:dataset-versions",
+	"benchmark:replay-runs",
+	"viewer-settings-snapshots"
 ];
 /** The per-addon blob tables a scoped name may carry. */
 var STORAGE_ADMIN_SCOPED_BASES = [
@@ -16361,6 +17053,103 @@ var storageAdminCapability = {
 		}), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/** Every record kind of both files with rows, a size estimate, class and retention (D881). */
+		listKinds: method(zod.z.object({
+			owner: zod.z.string().min(1).optional(),
+			/** `false` skips the per-kind row count (a catalog read only). Default true. */
+			counts: zod.z.boolean().optional()
+		}), zod.z.object({ kinds: zod.z.array(StorageKindSchema) }), { auth: "admin" }),
+		/**
+		* Read-only diagnosis of ANY owner's kind: the same indexed query as the
+		* owner's, secret fields redacted, audited in the engine log.
+		*/
+		readRecords: method(RecordQueryInputSchema.extend({
+			owner: zod.z.string().min(1),
+			kind: RecordKindNameSchema
+		}), RecordQueryResultSchema, { auth: "admin" }),
+		/**
+		* The migration copy path (D881): write rows into a kind AS ITS DECLARED
+		* OWNER. Refused when that owner's manifest does not declare the kind.
+		* Idempotent (a put by id, so a re-run resumes). A secret field carries a
+		* keychain marker bound to the row's own ref - the operator script imports
+		* the value first - and a plain string there is refused.
+		*/
+		adoptRecords: method(zod.z.object({
+			owner: zod.z.string().min(1),
+			kind: RecordKindNameSchema,
+			records: zod.z.array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX),
+			/** The LAST batch: the copy is complete, the boot guard stops asking. */
+			complete: zod.z.boolean().optional()
+		}), zod.z.object({ adopted: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
+* record-entries - the ONE admin surface for every list of user-created entries
+* (D881): notification targets, brokers, LLM profiles, anything an addon
+* declares as an ENTRY kind (`entry: { title }` in `defineRecordKinds`).
+*
+* The UI is generic. `listEntryKinds` hands it, per kind, the JSON Schema of
+* the entry body with `secret: true` on every credential field, so a password
+* field is derived from the schema and never from a name. `putEntry` takes the
+* redaction token for an untouched secret (the stored value is kept), a string
+* for a new one, and the clear instruction to remove one. A read never carries
+* a secret value, and a locked keychain refuses the write with
+* `records/secret-unavailable` instead of storing plaintext.
+*
+* Hub-only, served in-process (it acts for each entry's owner on the keychain).
+*/
+var EntryKindInfoSchema = zod.z.object({
+	owner: zod.z.string(),
+	kind: RecordKindNameSchema,
+	title: zod.z.string(),
+	nameField: zod.z.string(),
+	/** JSON Schema of the body; `secret: true` marks a password field. */
+	fields: zod.z.record(zod.z.string(), zod.z.unknown()),
+	secretPaths: zod.z.array(zod.z.string()),
+	rows: zod.z.number().int().nonnegative()
+});
+var EntryViewSchema = zod.z.object({
+	id: RecordIdSchema,
+	name: zod.z.string(),
+	rev: zod.z.number().int(),
+	updatedAt: zod.z.number(),
+	/** Secret fields hold the redaction token. */
+	data: RecordBodySchema
+});
+var EntryAddress = {
+	owner: zod.z.string().min(1),
+	kind: RecordKindNameSchema
+};
+var recordEntriesCapability = {
+	name: "record-entries",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		listEntryKinds: method(zod.z.object({}), zod.z.object({ kinds: zod.z.array(EntryKindInfoSchema) }), { auth: "admin" }),
+		listEntries: method(zod.z.object({ ...EntryAddress }), zod.z.object({ entries: zod.z.array(EntryViewSchema) }), { auth: "admin" }),
+		/** Create (no `id`: one is generated) or edit. `ifRev` guards an edit against a concurrent one. */
+		putEntry: method(zod.z.object({
+			...EntryAddress,
+			id: RecordIdSchema.optional(),
+			data: RecordBodySchema,
+			ifRev: zod.z.number().int().min(1).optional()
+		}), zod.z.object({
+			id: zod.z.string(),
+			rev: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteEntry: method(zod.z.object({
+			...EntryAddress,
+			id: RecordIdSchema
+		}), zod.z.object({ deleted: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	}
 };
@@ -41064,36 +41853,6 @@ var llmRuntimeCapability = {
 	}
 };
 /**
-* The report of a one-shot "move this owner's plaintext secrets into the
-* keychain" run (D878). COUNTS only - never a value, never a ref.
-*
-* The owner runs it on its own rows, through its own write path; an operator
-* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
-* Dry run (`apply: false`) reports what WOULD move and changes nothing.
-*/
-var RawSecretMigrationInputSchema = zod.z.object({ 
-/** `false` (the default of the script) = report only. */
-apply: zod.z.boolean() });
-var RawSecretMigrationReportSchema = zod.z.object({
-	apply: zod.z.boolean(),
-	/** Rows that can carry a secret (a profile, an enrolment). */
-	rows: zod.z.number().int(),
-	/** Rows whose secret was plaintext when the run started. */
-	raw: zod.z.number().int(),
-	/** Rows that already held a keychain marker when the run started. */
-	markers: zod.z.number().int(),
-	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
-	migrated: zod.z.number().int(),
-	/** Plaintext rows left in place because the move or its read-back failed. */
-	failed: zod.z.number().int(),
-	/** After the run: rows still holding plaintext. */
-	remainingRaw: zod.z.number().int(),
-	/** After the run: markers the keychain could not resolve right now. */
-	unresolvedMarkers: zod.z.number().int(),
-	/** True when nothing is raw and every marker resolves. */
-	verified: zod.z.boolean()
-});
-/**
 * `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
 * methods concat-fan across providers; single-row methods route to ONE
 * provider by the `addonId` in the call input (the notification-output
@@ -74755,6 +75514,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.migrateRawSecrets": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -79507,6 +80272,30 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recordEntries.deleteEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"recordEntries.listEntries": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.listEntryKinds": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.putEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.getAvailability": {
 		capName: "recording",
 		capScope: "device",
@@ -79807,6 +80596,102 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"records.aggregate": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.allocateId": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.count": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.declareKinds": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.delete": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteDevice": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteWhere": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.get": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.getMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.histogram": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.patch": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.put": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.putMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.query": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.secretRefs": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.captureReference": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -80239,18 +81124,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageAdmin.adoptRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"storageAdmin.dropCollection": {
 		capName: "storage-admin",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"storageAdmin.listKinds": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageAdmin.listTables": {
 		capName: "storage-admin",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"storageAdmin.readRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -81887,11 +82790,13 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	ptzCapability,
 	ptzAutotrackCapability,
 	rebootCapability,
+	recordEntriesCapability,
 	recordingCapability,
 	recordingArchiveCapability,
 	recordingExportCapability,
 	recordingOnboardCapability,
 	recordingSignalCapability,
+	recordsCapability,
 	sceneMonitorCapability,
 	scriptRunnerCapability,
 	serverManagementCapability,
@@ -84110,6 +85015,37 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"records.count": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.deleteDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"records.deleteWhere": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.histogram": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.putMany": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"records.query": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"sceneMonitor.captureReference": [{
 		name: "deviceId",
 		form: "single",
@@ -84226,6 +85162,17 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"storageAdmin.adoptRecords": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"storageAdmin.readRecords": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"streamBroker.acquireEgressTranscode": [{
 		name: "deviceId",
 		form: "single",
@@ -86312,12 +87259,24 @@ Object.defineProperty(exports, "BaseDevice", {
 		return BaseDevice;
 	}
 });
+Object.defineProperty(exports, "BatchTooLargeError", {
+	enumerable: true,
+	get: function() {
+		return BatchTooLargeError;
+	}
+});
 Object.defineProperty(exports, "BatteryStatusSchema", {
 	enumerable: true,
 	get: function() {
 		return BatteryStatusSchema;
 	}
 });
+Object.defineProperty(exports, "CALLER_STAMPED_CAPABILITIES", {
+	enumerable: true,
+	get: function() {
+		return CALLER_STAMPED_CAPABILITIES;
+	}
+});
 Object.defineProperty(exports, "CAMERA_SWITCH_ORDER", {
 	enumerable: true,
 	get: function() {
@@ -86474,6 +87433,12 @@ Object.defineProperty(exports, "DEVICE_TOMBSTONE_RETENTION_MS", {
 		return DEVICE_TOMBSTONE_RETENTION_MS;
 	}
 });
+Object.defineProperty(exports, "DeclarationRefusedError", {
+	enumerable: true,
+	get: function() {
+		return DeclarationRefusedError;
+	}
+});
 Object.defineProperty(exports, "DeclaredDevices", {
 	enumerable: true,
 	get: function() {
@@ -86528,6 +87493,18 @@ Object.defineProperty(exports, "FieldClaimSchema", {
 		return FieldClaimSchema;
 	}
 });
+Object.defineProperty(exports, "FilterRequiredError", {
+	enumerable: true,
+	get: function() {
+		return FilterRequiredError;
+	}
+});
+Object.defineProperty(exports, "ForeignSecretMarkerError", {
+	enumerable: true,
+	get: function() {
+		return ForeignSecretMarkerError;
+	}
+});
 Object.defineProperty(exports, "HUB_MDNS_SERVICE_TYPE", {
 	enumerable: true,
 	get: function() {
@@ -86540,6 +87517,12 @@ Object.defineProperty(exports, "HUB_MDNS_TXT_KEYS", {
 		return HUB_MDNS_TXT_KEYS;
 	}
 });
+Object.defineProperty(exports, "InvalidRecordError", {
+	enumerable: true,
+	get: function() {
+		return InvalidRecordError;
+	}
+});
 Object.defineProperty(exports, "KEYCHAIN_RESET_TRIGGER_ACTOR", {
 	enumerable: true,
 	get: function() {
@@ -86582,18 +87565,60 @@ Object.defineProperty(exports, "NetworkTunnelStartedDataSchema", {
 		return NetworkTunnelStartedDataSchema;
 	}
 });
+Object.defineProperty(exports, "NoCallerError", {
+	enumerable: true,
+	get: function() {
+		return NoCallerError;
+	}
+});
+Object.defineProperty(exports, "PlaintextSecretError", {
+	enumerable: true,
+	get: function() {
+		return PlaintextSecretError;
+	}
+});
 Object.defineProperty(exports, "RECORDING_SOURCE_CAMSTACK_ADDON", {
 	enumerable: true,
 	get: function() {
 		return RECORDING_SOURCE_CAMSTACK_ADDON;
 	}
 });
+Object.defineProperty(exports, "RECORD_BATCH_MAX", {
+	enumerable: true,
+	get: function() {
+		return RECORD_BATCH_MAX;
+	}
+});
+Object.defineProperty(exports, "RECORD_BATCH_MAX_BYTES", {
+	enumerable: true,
+	get: function() {
+		return RECORD_BATCH_MAX_BYTES;
+	}
+});
+Object.defineProperty(exports, "RECORD_DELETE_BATCH", {
+	enumerable: true,
+	get: function() {
+		return RECORD_DELETE_BATCH;
+	}
+});
+Object.defineProperty(exports, "RECORD_SWEEP_INTERVAL_MS", {
+	enumerable: true,
+	get: function() {
+		return RECORD_SWEEP_INTERVAL_MS;
+	}
+});
 Object.defineProperty(exports, "REDACTED_SECRET", {
 	enumerable: true,
 	get: function() {
 		return REDACTED_SECRET;
 	}
 });
+Object.defineProperty(exports, "REMOVE_LEAF", {
+	enumerable: true,
+	get: function() {
+		return REMOVE_LEAF;
+	}
+});
 Object.defineProperty(exports, "RUNTIME_DEFAULTS", {
 	enumerable: true,
 	get: function() {
@@ -86612,12 +87637,42 @@ Object.defineProperty(exports, "ReadinessTimeoutError", {
 		return ReadinessTimeoutError;
 	}
 });
+Object.defineProperty(exports, "RecordKindDeclarationSchema", {
+	enumerable: true,
+	get: function() {
+		return RecordKindDeclarationSchema;
+	}
+});
+Object.defineProperty(exports, "RecordNotFoundError", {
+	enumerable: true,
+	get: function() {
+		return RecordNotFoundError;
+	}
+});
+Object.defineProperty(exports, "RecordTooLargeError", {
+	enumerable: true,
+	get: function() {
+		return RecordTooLargeError;
+	}
+});
+Object.defineProperty(exports, "RecordUniqueViolationError", {
+	enumerable: true,
+	get: function() {
+		return RecordUniqueViolationError;
+	}
+});
 Object.defineProperty(exports, "RecordingStatusSchema", {
 	enumerable: true,
 	get: function() {
 		return RecordingStatusSchema;
 	}
 });
+Object.defineProperty(exports, "RevConflictError", {
+	enumerable: true,
+	get: function() {
+		return RevConflictError;
+	}
+});
 Object.defineProperty(exports, "SECRET_CLEAR", {
 	enumerable: true,
 	get: function() {
@@ -86690,6 +87745,18 @@ Object.defineProperty(exports, "StorageMigrationJobSchema", {
 		return StorageMigrationJobSchema;
 	}
 });
+Object.defineProperty(exports, "UnindexedFilterError", {
+	enumerable: true,
+	get: function() {
+		return UnindexedFilterError;
+	}
+});
+Object.defineProperty(exports, "UnknownRecordKindError", {
+	enumerable: true,
+	get: function() {
+		return UnknownRecordKindError;
+	}
+});
 Object.defineProperty(exports, "UserRecordSchema", {
 	enumerable: true,
 	get: function() {
@@ -86744,6 +87811,12 @@ Object.defineProperty(exports, "asString", {
 		return asString$1;
 	}
 });
+Object.defineProperty(exports, "assertValidDeclaration", {
+	enumerable: true,
+	get: function() {
+		return assertValidDeclaration;
+	}
+});
 Object.defineProperty(exports, "authProviderCapability", {
 	enumerable: true,
 	get: function() {
@@ -86840,6 +87913,18 @@ Object.defineProperty(exports, "collectSecretConfigKeys", {
 		return collectSecretConfigKeys;
 	}
 });
+Object.defineProperty(exports, "collectSecretLeaves", {
+	enumerable: true,
+	get: function() {
+		return collectSecretLeaves;
+	}
+});
+Object.defineProperty(exports, "collectSecretMarkerRefs", {
+	enumerable: true,
+	get: function() {
+		return collectSecretMarkerRefs;
+	}
+});
 Object.defineProperty(exports, "collectZodSecretPaths", {
 	enumerable: true,
 	get: function() {
@@ -87230,6 +88315,12 @@ Object.defineProperty(exports, "isSecretMarkerLike", {
 		return isSecretMarkerLike;
 	}
 });
+Object.defineProperty(exports, "isSecretRefOwnedBy", {
+	enumerable: true,
+	get: function() {
+		return isSecretRefOwnedBy;
+	}
+});
 Object.defineProperty(exports, "isVoidInput", {
 	enumerable: true,
 	get: function() {
@@ -87308,6 +88399,12 @@ Object.defineProperty(exports, "makeSecretMarker", {
 		return makeSecretMarker;
 	}
 });
+Object.defineProperty(exports, "mapSecretLeaves", {
+	enumerable: true,
+	get: function() {
+		return mapSecretLeaves;
+	}
+});
 Object.defineProperty(exports, "mayReadLocation", {
 	enumerable: true,
 	get: function() {
@@ -87440,6 +88537,24 @@ Object.defineProperty(exports, "readinessKey", {
 		return readinessKey;
 	}
 });
+Object.defineProperty(exports, "recordEntriesCapability", {
+	enumerable: true,
+	get: function() {
+		return recordEntriesCapability;
+	}
+});
+Object.defineProperty(exports, "recordSecretRef", {
+	enumerable: true,
+	get: function() {
+		return recordSecretRef;
+	}
+});
+Object.defineProperty(exports, "recordsCapability", {
+	enumerable: true,
+	get: function() {
+		return recordsCapability;
+	}
+});
 Object.defineProperty(exports, "reducePoints", {
 	enumerable: true,
 	get: function() {
@@ -87548,6 +88663,12 @@ Object.defineProperty(exports, "secretTreeFromPaths", {
 		return secretTreeFromPaths;
 	}
 });
+Object.defineProperty(exports, "secretTreeFromSchema", {
+	enumerable: true,
+	get: function() {
+		return secretTreeFromSchema;
+	}
+});
 Object.defineProperty(exports, "settingsStoreCapability", {
 	enumerable: true,
 	get: function() {
@@ -87704,3 +88825,9 @@ Object.defineProperty(exports, "withLocationMode", {
 		return withLocationMode;
 	}
 });
+Object.defineProperty(exports, "withoutCallerStamp", {
+	enumerable: true,
+	get: function() {
+		return withoutCallerStamp;
+	}
+});