@camstack/system 1.2.443 → 1.2.444

package/dist/{dist-Bxt_S-9a.mjs → dist-DERK-gP5.mjs}

@@ -736,7 +736,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-D-Q2_Mcd.mjs
+//#region ../types/dist/sleep-WsrozGDL.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -848,21 +848,21 @@ function collectSecretConfigKeys(schema) {
 	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
 	return keys;
 }
-function isRecord$3(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sectionsOf(schema) {
-	if (!isRecord$3(schema)) return [];
+	if (!isRecord$5(schema)) return [];
 	const sections = schema["sections"];
 	return Array.isArray(sections) ? sections : [];
 }
 function fieldsOf(node) {
-	if (!isRecord$3(node)) return [];
+	if (!isRecord$5(node)) return [];
 	const fields = node["fields"];
 	return Array.isArray(fields) ? fields : [];
 }
 function walkField(field, out) {
-	if (!isRecord$3(field)) return;
+	if (!isRecord$5(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
@@ -900,7 +900,7 @@ function walkField(field, out) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$2(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -911,16 +911,16 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$4(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 /** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
 function isSecretMarkerLike(value) {
-	return isRecord$2(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+	return isRecord$4(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
 }
 function isSecretClear(value) {
-	return isRecord$2(value) && value["$secretClear"] === true;
+	return isRecord$4(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -1589,7 +1589,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$1(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -1602,7 +1602,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$3(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -1657,7 +1657,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$3) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -1673,7 +1673,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$1(row)) {
+		if (!isRecord$3(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -1698,7 +1698,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$1(incoming)) {
+			if (!isRecord$3(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -1706,7 +1706,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$1(stored) ? stored : {};
+			const storedObj = isRecord$3(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -1829,7 +1829,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$1(v)) {
+		if (isRecord$3(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -1861,7 +1861,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -1890,7 +1890,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord(item) && isRecord(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$2(item) && isRecord$2(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -1901,7 +1901,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord(value) && isRecord(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$2(value) && isRecord$2(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -1909,7 +1909,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord(incoming) || !isRecord(stored)) return incoming;
+	if (!isRecord$2(incoming) || !isRecord$2(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -1940,7 +1940,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord(a) && isRecord(b)) {
+	if (isRecord$2(a) && isRecord$2(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -1964,7 +1964,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord(value)) return null;
+	if (!isRecord$2(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -3266,6 +3266,413 @@ var PeerBytesTicketSchema = z.object({
 	*/
 	declaredBytes: z.number().int().nonnegative().nullable()
 });
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_BATCH_MAX_BYTES = 4 * 1024 * 1024;
+var RECORD_QUERY_MAX = 1e3;
+/** Rows one DELETE statement removes before the serving thread yields. */
+var RECORD_DELETE_BATCH = 5e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+/** The engine's TTL sweep cadence. */
+var RECORD_SWEEP_INTERVAL_MS = 10 * 6e4;
+/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
+var RECORD_SECRET_COLLECTION_PREFIX = "records:";
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+/** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
+var RevConflictError = class extends RecordsError {
+	constructor(detail) {
+		super("rev-conflict", detail);
+		this.name = "RevConflictError";
+	}
+};
+/** `data` exceeds the kind's `maxDataBytes`. Bytes are never record fields (D613). */
+var RecordTooLargeError = class extends RecordsError {
+	constructor(detail) {
+		super("too-large", detail);
+		this.name = "RecordTooLargeError";
+	}
+};
+/** A filter, order or aggregate names a field no declared index serves. */
+var UnindexedFilterError = class extends RecordsError {
+	constructor(detail) {
+		super("unindexed-filter", detail);
+		this.name = "UnindexedFilterError";
+	}
+};
+/** A bulk delete with no predicate at all. */
+var FilterRequiredError = class extends RecordsError {
+	constructor(detail) {
+		super("filter-required", detail);
+		this.name = "FilterRequiredError";
+	}
+};
+/** The caller declared no such kind (another addon's kind is indistinguishable from none). */
+var UnknownRecordKindError = class extends RecordsError {
+	constructor(detail) {
+		super("unknown-kind", detail);
+		this.name = "UnknownRecordKindError";
+	}
+};
+var RecordNotFoundError = class extends RecordsError {
+	constructor(detail) {
+		super("not-found", detail);
+		this.name = "RecordNotFoundError";
+	}
+};
+/** A unique index refused the write. */
+var RecordUniqueViolationError = class extends RecordsError {
+	constructor(detail) {
+		super("unique-violation", detail);
+		this.name = "RecordUniqueViolationError";
+	}
+};
+/** A secret field held a plain string where only a keychain marker may be stored. */
+var PlaintextSecretError = class extends RecordsError {
+	constructor(detail) {
+		super("plaintext-secret", detail);
+		this.name = "PlaintextSecretError";
+	}
+};
+/** A marker whose ref is not the row's own (the D878 rule). */
+var ForeignSecretMarkerError = class extends RecordsError {
+	constructor(detail) {
+		super("foreign-marker", detail);
+		this.name = "ForeignSecretMarkerError";
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
+var NoCallerError = class extends RecordsError {
+	constructor(detail) {
+		super("no-caller", detail);
+		this.name = "NoCallerError";
+	}
+};
+var BatchTooLargeError = class extends RecordsError {
+	constructor(detail) {
+		super("batch-too-large", detail);
+		this.name = "BatchTooLargeError";
+	}
+};
+function defOf(schema) {
+	return schema._zod?.def ?? {};
+}
+function declaredHere(schema) {
+	return z.globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const key = each ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function elementId(element, idKey, declared, prefix) {
+	const id = isRecord$1(element) ? element[idKey] : void 0;
+	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
+	return id;
+}
+/**
+* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
+* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
+* result is a new body, `data` is untouched.
+*/
+var REMOVE_LEAF = Symbol("remove-leaf");
+function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
+	if (!isRecord$1(node)) return node;
+	const segment = segments[index];
+	if (segment === void 0) return node;
+	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
+	const child = node[segment.key];
+	const keys = [...walkedKeys, segment.key];
+	const last = index === segments.length - 1;
+	if (segment.each) {
+		if (!Array.isArray(child)) return node;
+		const prefix = keys.join(".");
+		const idKey = arrayKeys[prefix];
+		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
+		const mapped = child.map((element) => {
+			const id = elementId(element, idKey, declared, prefix);
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
+			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
+		});
+		return {
+			...node,
+			[segment.key]: mapped
+		};
+	}
+	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
+	if (last) {
+		const replacement = visit({
+			declared,
+			concrete,
+			value: child
+		});
+		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
+		return {
+			...node,
+			[segment.key]: replacement
+		};
+	}
+	return {
+		...node,
+		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+	};
+}
+/** Replace/remove every present secret leaf; returns a NEW body. */
+function mapSecretLeaves(data, paths, arrayKeys, visit) {
+	let current = data;
+	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
+	return current;
+}
+/** Every present secret leaf, read-only. */
+function collectSecretLeaves(data, paths, arrayKeys) {
+	const found = [];
+	mapSecretLeaves(data, paths, arrayKeys, (leaf) => {
+		found.push(leaf);
+		return leaf.value;
+	});
+	return found;
+}
+/**
+* The keychain collection name a kind's secrets live under. Prefixed so a
+* record's refs never collide with the refs a legacy collection of the same name
+* already holds during an adoption.
+*/
+function recordSecretCollection(kind) {
+	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
+}
+/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
+function recordSecretRef(owner, kind, rowId, concretePath) {
+	return buildSecretRef({
+		owner,
+		scope: {
+			kind: "row",
+			collection: recordSecretCollection(kind),
+			rowId
+		},
+		fieldPath: concretePath
+	});
+}
+/**
+* Record kinds (D881): the declaration an addon makes of one kind of fact, the
+* Zod row schema that describes it, and the helper that turns the two into the
+* JSON the engine stores.
+*
+* A kind is declared ONCE, next to the code that owns it, and the engine's
+* reconciler creates its indexes - nothing creates DDL at runtime from a write.
+* Everything the generic machinery needs (secret fields, the entry descriptor)
+* is DERIVED from the Zod schema: `.meta({ secret: true })` marks a credential,
+* never a field name (D879).
+*/
+/** A JSON field path: `trackId`, `auth.accessToken`. Charset-restricted: it is rendered into DDL. */
+var RecordFieldPathSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}(\.[A-Za-z_][A-Za-z0-9_]{0,63}){0,3}$/);
+var RecordIndexSchema = z.object({
+	name: z.string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+	fields: z.array(RecordFieldPathSchema).min(1).max(4),
+	unique: z.boolean().optional()
+}).strict();
+var RecordRetentionSchema = z.union([
+	z.object({
+		ttlMs: z.number().int().positive(),
+		from: z.enum(["at", "write"])
+	}).strict(),
+	z.object({
+		maxRows: z.number().int().positive().optional(),
+		maxRowsPerDevice: z.number().int().positive().optional()
+	}).strict().refine((r) => r.maxRows !== void 0 || r.maxRowsPerDevice !== void 0, { message: "name maxRows, maxRowsPerDevice or both" }),
+	z.object({
+		owner: z.string().min(1),
+		reason: z.string().min(1)
+	}).strict(),
+	z.object({ none: z.string().min(1) }).strict()
+]);
+/** The descriptor a generic entries UI reads (D881 "generic entries"). */
+var EntryDescriptorSchema = z.object({
+	title: z.string().min(1),
+	/** The record body field shown as the entry's name. */
+	nameField: z.string().min(1),
+	/** JSON Schema of the entry body; `secret: true` marks a password field. */
+	fields: z.record(z.string(), z.unknown())
+}).strict();
+/** What crosses the wire and sits in the engine's catalog: JSON only, no Zod. */
+var RecordKindDeclarationSchema = z.object({
+	database: z.enum(RECORD_DATABASES).default("settings"),
+	class: z.enum(RECORD_CLASSES),
+	writeTrigger: z.string().min(1),
+	device: z.enum([
+		"required",
+		"optional",
+		"none"
+	]).default("none"),
+	at: z.enum(["required", "none"]).default("none"),
+	indexes: z.array(RecordIndexSchema).max(8).default([]),
+	retention: RecordRetentionSchema,
+	deviceRemoval: z.enum(["delete", "none"]).default("none"),
+	maxDataBytes: z.number().int().positive().max(RECORD_MAX_DATA_BYTES).default(RECORD_DEFAULT_MAX_DATA_BYTES),
+	/** Derived from the Zod schema; never written by hand. */
+	secretPaths: z.array(z.string().min(1)).default([]),
+	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
+	secretArrayKeys: z.record(z.string(), z.string()).default({}),
+	/** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+	adoptsFrom: z.string().min(1).optional(),
+	/** Kinds that must agree through `transact` sit in one file under one family name. */
+	transactFamily: z.string().min(1).optional(),
+	entry: EntryDescriptorSchema.optional()
+}).strict();
+/** The kind names: lower-case, dash separated, short enough for an index name. */
+var RecordKindNameSchema = z.string().regex(/^[a-z][a-z0-9-]{0,47}$/);
+/** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
+function assertValidDeclaration(name, decl) {
+	const refuse = (why) => {
+		throw new DeclarationRefusedError(`kind "${name}": ${why}`);
+	};
+	if (!RecordKindNameSchema.safeParse(name).success) refuse("the name must be lower-case-dashed");
+	const seen = /* @__PURE__ */ new Set();
+	for (const index of decl.indexes) {
+		if (seen.has(index.name)) refuse(`index name "${index.name}" is declared twice`);
+		seen.add(index.name);
+	}
+	const { retention } = decl;
+	const hasSecrets = decl.secretPaths.length > 0;
+	if ("ttlMs" in retention) {
+		if (retention.from === "at" && decl.at !== "required") refuse("a ttl from \"at\" needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use engine TTL (its keychain values would be orphaned)");
+	}
+	if ("maxRows" in retention || "maxRowsPerDevice" in retention) {
+		if (retention.maxRowsPerDevice !== void 0 && decl.device !== "required") refuse("maxRowsPerDevice needs device: \"required\"");
+		if (decl.at !== "required") refuse("a row bound trims the oldest \"at\": it needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use an engine row bound");
+		const bound = Math.max(retention.maxRows ?? 0, retention.maxRowsPerDevice ?? 0);
+		if (decl.database === "settings" && bound > 5e4) refuse(`a row bound above ${RECORD_SETTINGS_MAX_ROWS} belongs in database: "events" (a big delete on the settings thread stalls every configuration read)`);
+	}
+	if (decl.deviceRemoval === "delete" && decl.device === "none") refuse("deviceRemoval: \"delete\" needs a device: \"required\" or \"optional\"");
+	for (const path of decl.secretPaths) for (const prefix of secretArrayPrefixes(path)) if (decl.secretArrayKeys[prefix] === void 0) refuse(`secret path "${path}" crosses the array "${prefix}": declare its id key in secretArrayKeys`);
+}
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = z.enum([
 	"high",
@@ -4467,69 +4874,6 @@ var RUNTIME_DEFAULTS = {
 	"ffmpeg.threadCount": 0,
 	"auth.tokenExpiry": "30d"
 };
-function defOf(schema) {
-	return schema._zod?.def ?? {};
-}
-function declaredHere(schema) {
-	return z.globalRegistry.get(schema)?.secret === true;
-}
-/** Wrapper kinds whose `innerType` is the field itself. */
-var WRAPPERS = new Set([
-	"optional",
-	"nullable",
-	"default",
-	"prefault",
-	"catch",
-	"readonly",
-	"nonoptional"
-]);
-/**
-* The schema layers that make up ONE field: the schema itself and every
-* wrapper below it (optional / default / nullable / readonly / catch), plus
-* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
-* `.transform` on `in`).
-*/
-function layersOf(schema) {
-	const out = [];
-	const queue = [schema];
-	while (queue.length > 0) {
-		const s = queue.shift();
-		if (!s || out.includes(s)) continue;
-		out.push(s);
-		const def = defOf(s);
-		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
-		if (def.type === "pipe") {
-			if (def.in) queue.push(def.in);
-			if (def.out) queue.push(def.out);
-		}
-	}
-	return out;
-}
-/** True when any layer of this field declares `.meta({ secret: true })`. */
-function isZodSecret(schema) {
-	return layersOf(schema).some(declaredHere);
-}
-/**
-* Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
-* object or array is reported as one path and not descended into — everything
-* under it is secret.
-*/
-function collectZodSecretPaths(schema, prefix = "") {
-	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
-	const paths = [];
-	for (const layer of layersOf(schema)) {
-		const def = defOf(layer);
-		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
-		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
-		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
-		else if (def.type === "intersection") {
-			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
-			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
-		}
-	}
-	return [...new Set(paths)];
-}
 /**
 * A user-facing error with a STABLE code (D863).
 *
@@ -16328,6 +16672,276 @@ id: z.union([z.string(), z.number()]) }), {
 		})
 	}
 };
+/**
+* Every cap whose provider reads a `callerAddonId` in its input (the keychain's
+* owner check, device-history's `not-owner`, records' owner).
+*
+* The stamp is set ONLY by the transport (`stampCallerAddonId`, or stated by a
+* hub in-process caller). The generated HTTP/tRPC mount parses input with
+* `.loose()`, so without this a session could add the key itself and act as
+* another addon. The mount strips it for these caps.
+*/
+var CALLER_STAMPED_CAPABILITIES = [
+	"keychain",
+	"device-history",
+	"records",
+	"integrations",
+	"device-manager"
+];
+/** A copy of `input` without the caller stamp. Anything that is not a plain object passes through. */
+function withoutCallerStamp(input) {
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return input;
+	if (!Object.prototype.hasOwnProperty.call(input, "callerAddonId")) return input;
+	return Object.fromEntries(Object.entries(input).filter(([key]) => key !== "callerAddonId"));
+}
+/**
+* records - an addon's own facts and documents (D881): ledgers, audit rows,
+* config documents, mirrors. The third storage API next to `ctx.settings`
+* (operator intent, D870) and device-history (numbers over time, D850).
+*
+* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
+* crossed a process and stated by a hub in-process caller (`ctx.records` does
+* that with the addon id closed over). It is deliberately NOT in any input
+* schema, so a session can never supply it, and a call with no stamp is refused
+* `records/no-caller`. A kind is readable and writable only by its owner; other
+* addons go through the owner's capability.
+*
+* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
+* never `[]`. Secret fields are never on the wire: a read shows the
+* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
+* resolves itself, and a write may carry only a keychain marker bound to the
+* row's own ref.
+*
+* Internal: addons reach it through `ctx.records`, never directly.
+*/
+var RecordIdSchema = z.string().min(1).max(256);
+/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
+var RecordBodySchema = z.record(z.string(), z.unknown());
+var RecordInputSchema = z.object({
+	id: RecordIdSchema,
+	/** The device this row belongs to (D865 removal, per-device reads). */
+	deviceId: z.number().int().optional(),
+	/** The domain clock, ms: observed / created / opened. */
+	at: z.number().int().optional(),
+	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
+	expiresAt: z.number().int().optional(),
+	data: RecordBodySchema
+});
+var RecordViewSchema = z.object({
+	id: z.string(),
+	deviceId: z.number().int().nullable(),
+	at: z.number().nullable(),
+	expiresAt: z.number().nullable(),
+	rev: z.number().int(),
+	updatedAt: z.number(),
+	data: RecordBodySchema
+});
+/** One predicate on a declared index field: equality, a set, or a range. */
+var RecordWhereValueSchema = z.union([
+	z.string(),
+	z.number(),
+	z.boolean(),
+	z.object({ in: z.array(z.union([
+		z.string(),
+		z.number(),
+		z.boolean()
+	])).min(1).max(RECORD_BATCH_MAX) }),
+	z.object({
+		gt: z.union([z.string(), z.number()]).optional(),
+		gte: z.union([z.string(), z.number()]).optional(),
+		lt: z.union([z.string(), z.number()]).optional(),
+		lte: z.union([z.string(), z.number()]).optional()
+	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
+]);
+/** Declared index fields only. Anything else does not compile, by design. */
+var RecordWhereSchema = z.record(RecordFieldPathSchema, RecordWhereValueSchema);
+var KindShape = { kind: RecordKindNameSchema };
+var TimeWindowShape = {
+	deviceId: z.number().int().optional(),
+	atFrom: z.number().optional(),
+	atTo: z.number().optional()
+};
+var RecordQueryInputSchema = z.object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional(),
+	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
+	order: z.enum(["at", "id"]).optional(),
+	desc: z.boolean().optional(),
+	limit: z.number().int().min(1).max(RECORD_QUERY_MAX).default(100),
+	/** Opaque keyset cursor from a previous answer. There is no offset. */
+	cursor: z.string().min(1).optional()
+});
+var RecordQueryResultSchema = z.object({
+	records: z.array(RecordViewSchema),
+	nextCursor: z.string().nullable()
+});
+var RecordKindStateSchema = z.enum([
+	"created",
+	"unchanged",
+	"updated"
+]);
+var DeclareKindResultSchema = z.object({
+	kindId: z.number().int(),
+	state: RecordKindStateSchema,
+	createdIndexes: z.array(z.string()),
+	/** The boot guard: the kind is empty while its legacy table still holds rows. */
+	adoptionPending: z.object({
+		legacyTable: z.string(),
+		legacyRows: z.number().int()
+	}).nullable()
+});
+/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
+var SecretRefsList = z.array(z.string());
+var RecordSecretRefsSchema = z.record(z.string(), z.record(z.string(), z.string()));
+var recordsCapability = {
+	name: "records",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/** Reconcile this addon's kinds: create the catalog rows and the declared indexes. Additive only. */
+		declareKinds: method(z.object({ kinds: z.record(RecordKindNameSchema, RecordKindDeclarationSchema) }), z.object({ kinds: z.record(z.string(), DeclareKindResultSchema) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		get: method(z.object({
+			...KindShape,
+			id: RecordIdSchema
+		}), RecordViewSchema.nullable(), { auth: "admin" }),
+		getMany: method(z.object({
+			...KindShape,
+			ids: z.array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+		}), z.array(RecordViewSchema), { auth: "admin" }),
+		/** The keychain refs of the rows' secret fields, by id and concrete path. For the owner's `ctx.secrets`. */
+		secretRefs: method(z.object({
+			...KindShape,
+			ids: z.array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+		}), RecordSecretRefsSchema, { auth: "admin" }),
+		put: method(z.object({
+			...KindShape,
+			record: RecordInputSchema,
+			/** Compare-and-set. `0` means "the row must not exist". */
+			ifRev: z.number().int().min(0).optional()
+		}), z.object({
+			rev: z.number().int(),
+			releasedRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		putMany: method(z.object({
+			...KindShape,
+			records: z.array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
+		}), z.object({
+			count: z.number().int(),
+			releasedRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** One-statement RFC 7396 merge: `null` removes a field; a merge never reads. */
+		patch: method(z.object({
+			...KindShape,
+			id: RecordIdSchema,
+			data: RecordBodySchema,
+			at: z.number().int().nullable().optional(),
+			expiresAt: z.number().int().nullable().optional(),
+			ifRev: z.number().int().min(1).optional()
+		}), z.object({
+			rev: z.number().int(),
+			releasedRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		delete: method(z.object({
+			...KindShape,
+			id: RecordIdSchema
+		}), z.object({
+			deleted: z.boolean(),
+			secretRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteMany: method(z.object({
+			...KindShape,
+			ids: z.array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+		}), z.object({
+			deleted: z.number().int(),
+			secretRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		query: method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }),
+		count: method(z.object({
+			...KindShape,
+			...TimeWindowShape,
+			where: RecordWhereSchema.optional()
+		}), z.object({ count: z.number().int() }), { auth: "admin" }),
+		histogram: method(z.object({
+			...KindShape,
+			deviceId: z.number().int().optional(),
+			from: z.number(),
+			to: z.number(),
+			bucketMs: z.number().int().positive()
+		}), z.object({ buckets: z.array(z.object({
+			bucketStart: z.number(),
+			count: z.number().int()
+		})) }), { auth: "admin" }),
+		/** Index-served only: every field must belong to ONE declared index. */
+		aggregate: method(z.object({
+			...KindShape,
+			op: z.enum([
+				"sum",
+				"min",
+				"max",
+				"count"
+			]),
+			field: RecordFieldPathSchema.optional(),
+			groupBy: RecordFieldPathSchema.optional(),
+			where: RecordWhereSchema.optional()
+		}), z.object({ rows: z.array(z.object({
+			group: z.union([
+				z.string(),
+				z.number(),
+				z.null()
+			]),
+			value: z.number().nullable()
+		})) }), { auth: "admin" }),
+		/** Batched (5 000 rows per statement, yielding between). Needs a predicate: there is no "delete all". */
+		deleteWhere: method(z.object({
+			...KindShape,
+			deviceId: z.number().int().optional(),
+			atBefore: z.number().optional(),
+			where: RecordWhereSchema.optional()
+		}), z.object({
+			deleted: z.number().int(),
+			secretRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The D865 hook body: every kind of this addon declared `deviceRemoval: 'delete'`. */
+		deleteDevice: method(z.object({
+			deviceId: z.number().int(),
+			kinds: z.array(RecordKindNameSchema).optional()
+		}), z.object({
+			deleted: z.record(z.string(), z.number().int()),
+			secretRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** A monotonically increasing integer per kind (replaces "resume from the highest"). */
+		allocateId: method(z.object(KindShape), z.object({ id: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 /** One table of the settings database. */
 var StorageTableSchema = z.object({
 	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
@@ -16340,6 +16954,28 @@ var StorageTableSchema = z.object({
 	/** Declared by an addon since this engine process started (a running addon claims it). */
 	declaredThisBoot: z.boolean()
 });
+/** One declared record kind (D881) as System -> Data shows it. */
+var StorageKindSchema = z.object({
+	owner: z.string(),
+	kind: z.string(),
+	database: z.enum(["settings", "events"]),
+	class: z.string(),
+	state: z.enum([
+		"declared",
+		"orphaned",
+		"dropped"
+	]),
+	/** `null` when the caller asked for no counts (`counts: false`). */
+	rows: z.number().int().nonnegative().nullable(),
+	/** Rows x the average size of a sample; null for an empty kind. */
+	bytesEstimate: z.number().int().nonnegative().nullable(),
+	writeTrigger: z.string(),
+	retention: RecordRetentionSchema,
+	/** `true` when the kind is an entry kind (the generic entries UI lists it). */
+	entry: z.boolean(),
+	/** The whole declaration, secret paths and entry descriptor included (the entries service builds its handle from it). */
+	declaration: RecordKindDeclarationSchema
+});
 /**
 * The collections retired by exact name: the D870 ones (their data became keys
 * of the camera's settings) and the three D871 leftovers (the `stats-5m` tables
@@ -16358,7 +16994,16 @@ var STORAGE_ADMIN_MOVED_COLLECTIONS = [
 	"pipeline-orchestrator:device-features",
 	"pipeline-analytics:stats-5m",
 	"pipeline-orchestrator:stats-5m",
-	"vec_object_clip"
+	"vec_object_clip",
+	"addon-devices",
+	"sections",
+	"provider-settings",
+	"device-settings",
+	"ai:budgets",
+	"pipeline-analytics:retrain-dataset-versions",
+	"training:dataset-versions",
+	"benchmark:replay-runs",
+	"viewer-settings-snapshots"
 ];
 /** The per-addon blob tables a scoped name may carry. */
 var STORAGE_ADMIN_SCOPED_BASES = [
@@ -16408,6 +17053,103 @@ var storageAdminCapability = {
 		}), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/** Every record kind of both files with rows, a size estimate, class and retention (D881). */
+		listKinds: method(z.object({
+			owner: z.string().min(1).optional(),
+			/** `false` skips the per-kind row count (a catalog read only). Default true. */
+			counts: z.boolean().optional()
+		}), z.object({ kinds: z.array(StorageKindSchema) }), { auth: "admin" }),
+		/**
+		* Read-only diagnosis of ANY owner's kind: the same indexed query as the
+		* owner's, secret fields redacted, audited in the engine log.
+		*/
+		readRecords: method(RecordQueryInputSchema.extend({
+			owner: z.string().min(1),
+			kind: RecordKindNameSchema
+		}), RecordQueryResultSchema, { auth: "admin" }),
+		/**
+		* The migration copy path (D881): write rows into a kind AS ITS DECLARED
+		* OWNER. Refused when that owner's manifest does not declare the kind.
+		* Idempotent (a put by id, so a re-run resumes). A secret field carries a
+		* keychain marker bound to the row's own ref - the operator script imports
+		* the value first - and a plain string there is refused.
+		*/
+		adoptRecords: method(z.object({
+			owner: z.string().min(1),
+			kind: RecordKindNameSchema,
+			records: z.array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX),
+			/** The LAST batch: the copy is complete, the boot guard stops asking. */
+			complete: z.boolean().optional()
+		}), z.object({ adopted: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
+* record-entries - the ONE admin surface for every list of user-created entries
+* (D881): notification targets, brokers, LLM profiles, anything an addon
+* declares as an ENTRY kind (`entry: { title }` in `defineRecordKinds`).
+*
+* The UI is generic. `listEntryKinds` hands it, per kind, the JSON Schema of
+* the entry body with `secret: true` on every credential field, so a password
+* field is derived from the schema and never from a name. `putEntry` takes the
+* redaction token for an untouched secret (the stored value is kept), a string
+* for a new one, and the clear instruction to remove one. A read never carries
+* a secret value, and a locked keychain refuses the write with
+* `records/secret-unavailable` instead of storing plaintext.
+*
+* Hub-only, served in-process (it acts for each entry's owner on the keychain).
+*/
+var EntryKindInfoSchema = z.object({
+	owner: z.string(),
+	kind: RecordKindNameSchema,
+	title: z.string(),
+	nameField: z.string(),
+	/** JSON Schema of the body; `secret: true` marks a password field. */
+	fields: z.record(z.string(), z.unknown()),
+	secretPaths: z.array(z.string()),
+	rows: z.number().int().nonnegative()
+});
+var EntryViewSchema = z.object({
+	id: RecordIdSchema,
+	name: z.string(),
+	rev: z.number().int(),
+	updatedAt: z.number(),
+	/** Secret fields hold the redaction token. */
+	data: RecordBodySchema
+});
+var EntryAddress = {
+	owner: z.string().min(1),
+	kind: RecordKindNameSchema
+};
+var recordEntriesCapability = {
+	name: "record-entries",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		listEntryKinds: method(z.object({}), z.object({ kinds: z.array(EntryKindInfoSchema) }), { auth: "admin" }),
+		listEntries: method(z.object({ ...EntryAddress }), z.object({ entries: z.array(EntryViewSchema) }), { auth: "admin" }),
+		/** Create (no `id`: one is generated) or edit. `ifRev` guards an edit against a concurrent one. */
+		putEntry: method(z.object({
+			...EntryAddress,
+			id: RecordIdSchema.optional(),
+			data: RecordBodySchema,
+			ifRev: z.number().int().min(1).optional()
+		}), z.object({
+			id: z.string(),
+			rev: z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteEntry: method(z.object({
+			...EntryAddress,
+			id: RecordIdSchema
+		}), z.object({ deleted: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	}
 };
@@ -79530,6 +80272,30 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recordEntries.deleteEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"recordEntries.listEntries": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.listEntryKinds": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.putEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.getAvailability": {
 		capName: "recording",
 		capScope: "device",
@@ -79830,6 +80596,102 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"records.aggregate": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.allocateId": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.count": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.declareKinds": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.delete": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteDevice": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteWhere": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.get": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.getMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.histogram": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.patch": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.put": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.putMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.query": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.secretRefs": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.captureReference": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -80262,18 +81124,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageAdmin.adoptRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"storageAdmin.dropCollection": {
 		capName: "storage-admin",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"storageAdmin.listKinds": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageAdmin.listTables": {
 		capName: "storage-admin",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"storageAdmin.readRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -81910,11 +82790,13 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	ptzCapability,
 	ptzAutotrackCapability,
 	rebootCapability,
+	recordEntriesCapability,
 	recordingCapability,
 	recordingArchiveCapability,
 	recordingExportCapability,
 	recordingOnboardCapability,
 	recordingSignalCapability,
+	recordsCapability,
 	sceneMonitorCapability,
 	scriptRunnerCapability,
 	serverManagementCapability,
@@ -84133,6 +85015,37 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"records.count": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.deleteDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"records.deleteWhere": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.histogram": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.putMany": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"records.query": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"sceneMonitor.captureReference": [{
 		name: "deviceId",
 		form: "single",
@@ -84249,6 +85162,17 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"storageAdmin.adoptRecords": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"storageAdmin.readRecords": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"streamBroker.acquireEgressTranscode": [{
 		name: "deviceId",
 		form: "single",
@@ -86293,4 +87217,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { StorageCleanupJobSchema as $, splitTranslationRef as $n, expandCapMethods as $r, gbToBytes as $t, DeclaredDevices as A, pickAppLinkHub as An, errMsg as Ar, databaseSnapshotCapability as At, METHOD_ACCESS_MAP as B, resolveCoreBlockFiles as Bn, WELL_KNOWN_TAB_MAP as Br, deviceStatusCapability as Bt, DAY_NAMES as C, toSecretFieldView as Ci, modeMayWrite as Cn, compositionSourceKey as Cr, coreBlockAddonId as Ct, DEVICE_SAN_CREDENTIAL_PREFIX as D, objectInputDeclaresAddonId as Dn, DeviceFeature as Dr, coreBlocksCapability as Dt, DEVICE_NONCE_TTL_MS as E, EventCategory as Ei, normalizeUnit as En, toExpressionValue as Er, coreBlockSourceKind as Et, HUB_MDNS_SERVICE_TYPE as F, reducePoints as Fn, REDACTED_SECRET as Fr, describeComposableCaps as Ft, RecordingStatusSchema as G, runtimeStatePolicyFor as Gn, collectSecretConfigKeys as Gr, evictionPolicyOfLocation as Gt, MOTION_CLOSE_AFTER_MS as H, resolveLocationMode as Hn, asNumber as Hr, enumerateItemArrayFields as Ht, HUB_MDNS_TXT_KEYS as I, replacedFieldKeys as In, RUNTIME_DEFAULTS as Ir, deviceCredentialsCapability as It, STORAGE_ADMIN_SCOPED_BASES as J, scoreRuntimes as Jn, createEvent as Jr, extractNestedAddonId as Jt, STORAGE_ACCESS_FALLBACK as K, scopesAllowAddon as Kn, collectSecretMarkerRefs as Kr, expandContainer as Kt, KEYCHAIN_RESET_TRIGGER_ACTOR as L, resolveAppConnections as Ln, ReadinessRegistry as Lr, deviceExtensionCapability as Lt, FIRST_LEVEL_MACRO_CLASSES as M, platformProbeCapability as Mn, DATAPLANE_SECRET_HEADER as Mr, decodeVectorBase64 as Mt, FieldClaimModeSchema as N, procedureAuthKey as Nn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Nr, defineExtensionSlotProvider as Nt, DEVICE_SAN_USER_PREFIX as O, objectInputDeclaresRequiredDeviceId as On, DeviceRole as Or, createDeviceExtensionProvider as Ot, FieldClaimSchema as P, ptzAutotrackCapability as Pn, DEVICE_STATUS_METHOD as Pr, deriveBatteryPresence as Pt, SsoBridgeClaimsSchema as Q, snapshotCapability as Qn, emitReadiness as Qr, formatMinutes as Qt, LOG_LEVEL_RANK as R, resolveBucketMs as Rn, ReadinessTimeoutError as Rr, deviceManagerCapability as Rt, DATA_STORE_DATABASES as S, toNodeId as Si, metricsProviderCapability as Sn, compositionSliceKey as Sr, compositionSourceRefs as St, DEVICE_ENROLLMENT_TTL_MS as T, userError as Ti, normalizeCoreBlockWrite as Tn, disarmRoseMemory as Tr, coreBlockIdFromAddonId as Tt, NetworkTunnelStartedDataSchema as U, resolveMethodAuth as Un, asString$1 as Ur, enumerateSchemaFields as Ut, MINUTES_PER_DAY as V, resolveHubAddressRoles as Vn, asJsonObject as Vr, enumerateInferenceDevices as Vt, RECORDING_SOURCE_CAMSTACK_ADDON as W, resolveNotificationTapAddress as Wn, buildSecretRef as Wr, evaluateCompositionField as Wt, ScopedTokenSchema as X, shortHostname as Xn, defineCustomActions as Xr, foldSnapshotByFunction as Xt, STREAM_PROFILE_META as Y, settingsStoreCapability as Yn, customAction as Yr, filesystemBrowseCapability as Yt, ServerNameSchema as Z, siteZoneKey as Zn, emitDownForOwnedCaps as Zr, formatDeviceRevoker as Zt, CatalogFileSchema as _, resolveSecretMarkers as _i, logLevelAtMost as _n, cloneStatefulExpressionMemory as _r, cameraGridLayoutCapability as _t, ApiKeyRecordSchema as a, isSecretClear as ai, isLocationEnabled as an, streamCatalogCapability as ar, addonSettingsCapability as at, DATABASE_SNAPSHOT_SUFFIX as b, secretTreeFromSchema as bi, mayWriteToLocation as bn, compositionFeatureEnabled as br, composerCapability as bt, CAMERA_SWITCH_ORDER as c, isSecretRefOwnedBy as ci, kebabToCamel as cn, userManagementCapability as cr, authProviderCapability as ct, CATALOG_LANGS as d, normalizeSecretOwner as di, legacyAutoLinkIds as dn, vectorDimFromBase64 as dr, batteryCapability as dt, formatSecretScope as ei, interpolate as en, storageAdminCapability as er, StorageLocationModeSchema as et, COMPOSED_ITEM_FIXED_FIELDS as f, parseJsonObject as fi, legacyModeOf as fn, vectorIndexDimConflictError as fr, buildCapabilityLookup as ft, CalendarPreferencesSchema as g, resolveCapMount as gi, logDestinationCapability as gn, buildFfmpegArgs as gr, calendarsCapability as gt, CORE_BLOCK_ADDON_PREFIX as h, readinessKey as hi, locationIconKey as hn, COMPOSER_ADDON_ID as hr, buildStreamParamsConfigSchema as ht, AlertSchema as i, isKeychainStoredField as ii, isDefaultAppConnectionEndpoint as in, storageProviderCapability as ir, addonPagesCapability as it, DeviceStatusSchema as j, planComposition as jn, BaseAddon as jr, declarationOwnerNodeId as jt, DEVICE_TOMBSTONE_RETENTION_MS as k, parseStreamParamsFormPatch as kn, DeviceType as kr, dataStoreProviderCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, makeSecretMarker as li, keychainAdminCapability as ln, validateComposition as lr, backupCapability as lt, CORE_BLOCKS_ADDON_ID as m, parseSecretRef as mi, localNetworkCapability as mn, withLocationMode as mr, buildDeviceSignatureMessage as mt, AGENT_MDNS_TXT_KEYS as n, isDeviceConfigCap as ni, isArrayOutputSchema as nn, storageMigrationCapability as nr, StorageMigrationJobSchema as nt, BaseDevice as o, isSecretMarker as oi, isObjectInput as on, streamQualityLabel as or, addonWidgetsCapability as ot, COMPOSER_RUNNER_ID as p, parseJsonUnknown as pi, lifecycleJobSchema as pn, vectorStoreCapability as pr, buildDeviceEnrollmentLink as pt, STORAGE_ADMIN_MOVED_COLLECTIONS as q, scopesAllowDeviceCap as qn, collectZodSecretPaths as qr, expressionContainsBuiltinCall as qt, ALL_CAPABILITY_DEFINITIONS as r, isEvent as ri, isCollectionArrayMethod as rn, storageOccupancyCapability as rr, UserRecordSchema as rt, BatteryStatusSchema as s, isSecretMarkerLike as si, isVoidInput as sn, supportedRuntimes as sr, alertsCapability as st, AGENT_MDNS_SERVICE_TYPE as t, hydrateSchema as ti, isAppLinkBase as tn, storageCapability as tr, StorageLocationTypeSchema as tt, CAP_NAMES_WITH_STATUS as u, nodePin as ui, keychainCapability as un, validateCustomAddress as ur, bareAddonId as ut, CoreBlockSchema as v, scopeKey as vi, looseSchema as vn, composedDeviceRef as vr, canonicalIconKey as vt, DERIVED_CAMERA_SILENCED_CAP_NAMES as w, transformSecretWrite as wi, motionCapability as wn, createStatefulExpressionMemory as wr, coreBlockComposition as wt, DATABASE_SNAPSHOT_TIMEOUT_MS as x, sleep as xi, memoizePinnedFfmpeg as xn, compositionItemFieldPath as xr, compositionFieldKey as xt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as y, secretTreeFromPaths as yi, mayReadLocation as yn, composedDeviceStableId as yr, checkRoleAddress as yt, LegacyStorageLocationDefaultSchema as z, resolveCoreBlockEntry as zn, SECRET_CLEAR as zr, deviceStateCapability as zt };
+export { SsoBridgeClaimsSchema as $, EventCategory as $i, shortHostname as $n, ReadinessRegistry as $r, formatMinutes as $t, DEVICE_TOMBSTONE_RETENTION_MS as A, isSecretClear as Ai, parseStreamParamsFormPatch as An, toExpressionValue as Ar, dataStoreProviderCapability as At, LegacyStorageLocationDefaultSchema as B, parseSecretRef as Bi, resolveAppConnections as Bn, DeclarationRefusedError as Br, deviceStateCapability as Bt, DATA_STORE_DATABASES as C, emitReadiness as Ci, metricsProviderCapability as Cn, composedDeviceStableId as Cr, compositionSourceRefs as Ct, DEVICE_NONCE_TTL_MS as D, isDeviceConfigCap as Di, normalizeUnit as Dn, compositionSourceKey as Dr, coreBlockSourceKind as Dt, DEVICE_ENROLLMENT_TTL_MS as E, hydrateSchema as Ei, normalizeCoreBlockWrite as En, compositionSliceKey as Er, coreBlockIdFromAddonId as Et, FieldClaimSchema as F, mapSecretLeaves as Fi, ptzAutotrackCapability as Fn, BaseAddon as Fr, deriveBatteryPresence as Ft, RECORDING_SOURCE_CAMSTACK_ADDON as G, scopeKey as Gi, resolveLocationMode as Gn, PlaintextSecretError as Gr, evaluateCompositionField as Gt, MINUTES_PER_DAY as H, recordSecretRef as Hi, resolveCoreBlockEntry as Hn, ForeignSecretMarkerError as Hr, enumerateInferenceDevices as Ht, HUB_MDNS_SERVICE_TYPE as I, nodePin as Ii, recordEntriesCapability as In, BatchTooLargeError as Ir, describeComposableCaps as It, STORAGE_ADMIN_MOVED_COLLECTIONS as J, sleep as Ji, runtimeStatePolicyFor as Jn, RECORD_DELETE_BATCH as Jr, expressionContainsBuiltinCall as Jt, RecordingStatusSchema as K, secretTreeFromPaths as Ki, resolveMethodAuth as Kn, RECORD_BATCH_MAX as Kr, evictionPolicyOfLocation as Kt, HUB_MDNS_TXT_KEYS as L, normalizeSecretOwner as Li, recordsCapability as Ln, DATAPLANE_SECRET_HEADER as Lr, deviceCredentialsCapability as Lt, DeviceStatusSchema as M, isSecretMarkerLike as Mi, planComposition as Mn, DeviceRole as Mr, declarationOwnerNodeId as Mt, FIRST_LEVEL_MACRO_CLASSES as N, isSecretRefOwnedBy as Ni, platformProbeCapability as Nn, DeviceType as Nr, decodeVectorBase64 as Nt, DEVICE_SAN_CREDENTIAL_PREFIX as O, isEvent as Oi, objectInputDeclaresAddonId as On, createStatefulExpressionMemory as Or, coreBlocksCapability as Ot, FieldClaimModeSchema as P, makeSecretMarker as Pi, procedureAuthKey as Pn, errMsg as Pr, defineExtensionSlotProvider as Pt, ServerNameSchema as Q, userError as Qi, settingsStoreCapability as Qn, RUNTIME_DEFAULTS as Qr, formatDeviceRevoker as Qt, KEYCHAIN_RESET_TRIGGER_ACTOR as R, parseJsonObject as Ri, reducePoints as Rn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Rr, deviceExtensionCapability as Rt, DATABASE_SNAPSHOT_TIMEOUT_MS as S, emitDownForOwnedCaps as Si, memoizePinnedFfmpeg as Sn, composedDeviceRef as Sr, compositionFieldKey as St, DERIVED_CAMERA_SILENCED_CAP_NAMES as T, formatSecretScope as Ti, motionCapability as Tn, compositionItemFieldPath as Tr, coreBlockComposition as Tt, MOTION_CLOSE_AFTER_MS as U, resolveCapMount as Ui, resolveCoreBlockFiles as Un, InvalidRecordError as Ur, enumerateItemArrayFields as Ut, METHOD_ACCESS_MAP as V, readinessKey as Vi, resolveBucketMs as Vn, FilterRequiredError as Vr, deviceStatusCapability as Vt, NetworkTunnelStartedDataSchema as W, resolveSecretMarkers as Wi, resolveHubAddressRoles as Wn, NoCallerError as Wr, enumerateSchemaFields as Wt, STREAM_PROFILE_META as X, toSecretFieldView as Xi, scopesAllowDeviceCap as Xn, REDACTED_SECRET as Xr, filesystemBrowseCapability as Xt, STORAGE_ADMIN_SCOPED_BASES as Y, toNodeId as Yi, scopesAllowAddon as Yn, RECORD_SWEEP_INTERVAL_MS as Yr, extractNestedAddonId as Yt, ScopedTokenSchema as Z, transformSecretWrite as Zi, scoreRuntimes as Zn, REMOVE_LEAF as Zr, foldSnapshotByFunction as Zt, CalendarPreferencesSchema as _, collectSecretMarkerRefs as _i, logDestinationCapability as _n, withLocationMode as _r, calendarsCapability as _t, ApiKeyRecordSchema as a, RevConflictError as ai, isDefaultAppConnectionEndpoint as an, storageMigrationCapability as ar, addonPagesCapability as at, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as b, customAction as bi, mayReadLocation as bn, buildFfmpegArgs as br, checkRoleAddress as bt, CALLER_STAMPED_CAPABILITIES as c, UnknownRecordKindError as ci, isVoidInput as cn, streamCatalogCapability as cr, alertsCapability as ct, CAP_NAMES_WITH_STATUS as d, asNumber as di, keychainCapability as dn, userManagementCapability as dr, bareAddonId as dt, ReadinessTimeoutError as ei, gbToBytes as en, siteZoneKey as er, StorageCleanupJobSchema as et, CATALOG_LANGS as f, asString$1 as fi, legacyAutoLinkIds as fn, validateComposition as fr, batteryCapability as ft, CORE_BLOCK_ADDON_PREFIX as g, collectSecretLeaves as gi, locationIconKey as gn, vectorStoreCapability as gr, buildStreamParamsConfigSchema as gt, CORE_BLOCKS_ADDON_ID as h, collectSecretConfigKeys as hi, localNetworkCapability as hn, vectorIndexDimConflictError as hr, buildDeviceSignatureMessage as ht, AlertSchema as i, RecordUniqueViolationError as ii, isCollectionArrayMethod as in, storageCapability as ir, UserRecordSchema as it, DeclaredDevices as j, isSecretMarker as ji, pickAppLinkHub as jn, DeviceFeature as jr, databaseSnapshotCapability as jt, DEVICE_SAN_USER_PREFIX as k, isKeychainStoredField as ki, objectInputDeclaresRequiredDeviceId as kn, disarmRoseMemory as kr, createDeviceExtensionProvider as kt, CAMERA_SWITCH_ORDER as l, WELL_KNOWN_TAB_MAP as li, kebabToCamel as ln, streamQualityLabel as lr, authProviderCapability as lt, COMPOSER_RUNNER_ID as m, buildSecretRef as mi, lifecycleJobSchema as mn, vectorDimFromBase64 as mr, buildDeviceEnrollmentLink as mt, AGENT_MDNS_TXT_KEYS as n, RecordNotFoundError as ni, isAppLinkBase as nn, splitTranslationRef as nr, StorageLocationTypeSchema as nt, BaseDevice as o, SECRET_CLEAR as oi, isLocationEnabled as on, storageOccupancyCapability as or, addonSettingsCapability as ot, COMPOSED_ITEM_FIXED_FIELDS as p, assertValidDeclaration as pi, legacyModeOf as pn, validateCustomAddress as pr, buildCapabilityLookup as pt, STORAGE_ACCESS_FALLBACK as q, secretTreeFromSchema as qi, resolveNotificationTapAddress as qn, RECORD_BATCH_MAX_BYTES as qr, expandContainer as qt, ALL_CAPABILITY_DEFINITIONS as r, RecordTooLargeError as ri, isArrayOutputSchema as rn, storageAdminCapability as rr, StorageMigrationJobSchema as rt, BatteryStatusSchema as s, UnindexedFilterError as si, isObjectInput as sn, storageProviderCapability as sr, addonWidgetsCapability as st, AGENT_MDNS_SERVICE_TYPE as t, RecordKindDeclarationSchema as ti, interpolate as tn, snapshotCapability as tr, StorageLocationModeSchema as tt, CAMSTACK_APP_LINK_ORIGIN as u, asJsonObject as ui, keychainAdminCapability as un, supportedRuntimes as ur, backupCapability as ut, CatalogFileSchema as v, collectZodSecretPaths as vi, logLevelAtMost as vn, withoutCallerStamp as vr, cameraGridLayoutCapability as vt, DAY_NAMES as w, expandCapMethods as wi, modeMayWrite as wn, compositionFeatureEnabled as wr, coreBlockAddonId as wt, DATABASE_SNAPSHOT_SUFFIX as x, defineCustomActions as xi, mayWriteToLocation as xn, cloneStatefulExpressionMemory as xr, composerCapability as xt, CoreBlockSchema as y, createEvent as yi, looseSchema as yn, COMPOSER_ADDON_ID as yr, canonicalIconKey as yt, LOG_LEVEL_RANK as z, parseJsonUnknown as zi, replacedFieldKeys as zn, DEVICE_STATUS_METHOD as zr, deviceManagerCapability as zt };