@camstack/system 1.2.443 → 1.2.445

package/dist/{dist-Bxt_S-9a.mjs → dist-BNunRyXT.mjs}

@@ -736,7 +736,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-D-Q2_Mcd.mjs
+//#region ../types/dist/sleep-bZIhUvjd.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -848,21 +848,21 @@ function collectSecretConfigKeys(schema) {
 	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
 	return keys;
 }
-function isRecord$3(value) {
+function isRecord$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sectionsOf(schema) {
-	if (!isRecord$3(schema)) return [];
+	if (!isRecord$6(schema)) return [];
 	const sections = schema["sections"];
 	return Array.isArray(sections) ? sections : [];
 }
 function fieldsOf(node) {
-	if (!isRecord$3(node)) return [];
+	if (!isRecord$6(node)) return [];
 	const fields = node["fields"];
 	return Array.isArray(fields) ? fields : [];
 }
 function walkField(field, out) {
-	if (!isRecord$3(field)) return;
+	if (!isRecord$6(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
@@ -900,7 +900,7 @@ function walkField(field, out) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$2(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -911,16 +911,16 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$5(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 /** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
 function isSecretMarkerLike(value) {
-	return isRecord$2(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+	return isRecord$5(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
 }
 function isSecretClear(value) {
-	return isRecord$2(value) && value["$secretClear"] === true;
+	return isRecord$5(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -1589,7 +1589,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$1(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -1602,7 +1602,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$4(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -1657,7 +1657,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$4) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -1673,7 +1673,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$1(row)) {
+		if (!isRecord$4(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -1698,7 +1698,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$1(incoming)) {
+			if (!isRecord$4(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -1706,7 +1706,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$1(stored) ? stored : {};
+			const storedObj = isRecord$4(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -1829,7 +1829,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$1(v)) {
+		if (isRecord$4(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -1861,7 +1861,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -1890,7 +1890,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord(item) && isRecord(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$3(item) && isRecord$3(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -1901,7 +1901,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord(value) && isRecord(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$3(value) && isRecord$3(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -1909,7 +1909,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord(incoming) || !isRecord(stored)) return incoming;
+	if (!isRecord$3(incoming) || !isRecord$3(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -1940,7 +1940,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord(a) && isRecord(b)) {
+	if (isRecord$3(a) && isRecord$3(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -1964,7 +1964,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -2765,7 +2765,7 @@ var BaseAddon = class {
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
-			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
+			ctx.api.addons.restartAddon.mutate({ addonId }).then(() => {
 				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
@@ -3266,6 +3266,498 @@ var PeerBytesTicketSchema = z.object({
 	*/
 	declaredBytes: z.number().int().nonnegative().nullable()
 });
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_BATCH_MAX_BYTES = 4 * 1024 * 1024;
+var RECORD_QUERY_MAX = 1e3;
+/** Rows one DELETE statement removes before the serving thread yields. */
+var RECORD_DELETE_BATCH = 5e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+/** The engine's TTL sweep cadence. */
+var RECORD_SWEEP_INTERVAL_MS = 10 * 6e4;
+/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
+var RECORD_SECRET_COLLECTION_PREFIX = "records:";
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+/** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
+var RevConflictError = class extends RecordsError {
+	constructor(detail) {
+		super("rev-conflict", detail);
+		this.name = "RevConflictError";
+	}
+};
+/** `data` exceeds the kind's `maxDataBytes`. Bytes are never record fields (D613). */
+var RecordTooLargeError = class extends RecordsError {
+	constructor(detail) {
+		super("too-large", detail);
+		this.name = "RecordTooLargeError";
+	}
+};
+/** A filter, order or aggregate names a field no declared index serves. */
+var UnindexedFilterError = class extends RecordsError {
+	constructor(detail) {
+		super("unindexed-filter", detail);
+		this.name = "UnindexedFilterError";
+	}
+};
+/** A bulk delete with no predicate at all. */
+var FilterRequiredError = class extends RecordsError {
+	constructor(detail) {
+		super("filter-required", detail);
+		this.name = "FilterRequiredError";
+	}
+};
+/** The caller declared no such kind (another addon's kind is indistinguishable from none). */
+var UnknownRecordKindError = class extends RecordsError {
+	constructor(detail) {
+		super("unknown-kind", detail);
+		this.name = "UnknownRecordKindError";
+	}
+};
+var RecordNotFoundError = class extends RecordsError {
+	constructor(detail) {
+		super("not-found", detail);
+		this.name = "RecordNotFoundError";
+	}
+};
+/** A unique index refused the write. */
+var RecordUniqueViolationError = class extends RecordsError {
+	constructor(detail) {
+		super("unique-violation", detail);
+		this.name = "RecordUniqueViolationError";
+	}
+};
+/** A secret field held a plain string where only a keychain marker may be stored. */
+var PlaintextSecretError = class extends RecordsError {
+	constructor(detail) {
+		super("plaintext-secret", detail);
+		this.name = "PlaintextSecretError";
+	}
+};
+/** A marker whose ref is not the row's own (the D878 rule). */
+var ForeignSecretMarkerError = class extends RecordsError {
+	constructor(detail) {
+		super("foreign-marker", detail);
+		this.name = "ForeignSecretMarkerError";
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
+var NoCallerError = class extends RecordsError {
+	constructor(detail) {
+		super("no-caller", detail);
+		this.name = "NoCallerError";
+	}
+};
+var BatchTooLargeError = class extends RecordsError {
+	constructor(detail) {
+		super("batch-too-large", detail);
+		this.name = "BatchTooLargeError";
+	}
+};
+function defOf(schema) {
+	const zodBag = Reflect.get(schema, "_zod");
+	if (typeof zodBag !== "object" || zodBag === null) return {};
+	const def = Reflect.get(zodBag, "def");
+	if (typeof def !== "object" || def === null) return {};
+	return def;
+}
+function declaredHere(schema) {
+	return z.globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const key = each ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function elementId(element, idKey, declared, prefix) {
+	const id = isRecord$2(element) ? element[idKey] : void 0;
+	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
+	return id;
+}
+/**
+* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
+* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
+* result is a new body, `data` is untouched.
+*/
+var REMOVE_LEAF = Symbol("remove-leaf");
+function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
+	if (!isRecord$2(node)) return node;
+	const segment = segments[index];
+	if (segment === void 0) return node;
+	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
+	const child = node[segment.key];
+	const keys = [...walkedKeys, segment.key];
+	const last = index === segments.length - 1;
+	if (segment.each) {
+		if (!Array.isArray(child)) return node;
+		const prefix = keys.join(".");
+		const idKey = arrayKeys[prefix];
+		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
+		const mapped = child.map((element) => {
+			const id = elementId(element, idKey, declared, prefix);
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
+			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
+		});
+		return {
+			...node,
+			[segment.key]: mapped
+		};
+	}
+	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
+	if (last) {
+		const replacement = visit({
+			declared,
+			concrete,
+			value: child
+		});
+		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
+		return {
+			...node,
+			[segment.key]: replacement
+		};
+	}
+	return {
+		...node,
+		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+	};
+}
+/** Replace/remove every present secret leaf; returns a NEW body. */
+function mapSecretLeaves(data, paths, arrayKeys, visit) {
+	let current = data;
+	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
+	return current;
+}
+/** Every present secret leaf, read-only. */
+function collectSecretLeaves(data, paths, arrayKeys) {
+	const found = [];
+	mapSecretLeaves(data, paths, arrayKeys, (leaf) => {
+		found.push(leaf);
+		return leaf.value;
+	});
+	return found;
+}
+/**
+* The keychain collection name a kind's secrets live under. Prefixed so a
+* record's refs never collide with the refs a legacy collection of the same name
+* already holds during an adoption.
+*/
+function recordSecretCollection(kind) {
+	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
+}
+/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
+function recordSecretRef(owner, kind, rowId, concretePath) {
+	return buildSecretRef({
+		owner,
+		scope: {
+			kind: "row",
+			collection: recordSecretCollection(kind),
+			rowId
+		},
+		fieldPath: concretePath
+	});
+}
+/**
+* Record kinds (D881): the declaration an addon makes of one kind of fact, the
+* Zod row schema that describes it, and the helper that turns the two into the
+* JSON the engine stores.
+*
+* A kind is declared ONCE, next to the code that owns it, and the engine's
+* reconciler creates its indexes - nothing creates DDL at runtime from a write.
+* Everything the generic machinery needs (secret fields, the entry descriptor)
+* is DERIVED from the Zod schema: `.meta({ secret: true })` marks a credential,
+* never a field name (D879).
+*/
+/** A JSON field path: `trackId`, `auth.accessToken`. Charset-restricted: it is rendered into DDL. */
+var RecordFieldPathSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}(\.[A-Za-z_][A-Za-z0-9_]{0,63}){0,3}$/);
+var RecordIndexSchema = z.object({
+	name: z.string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+	fields: z.array(RecordFieldPathSchema).min(1).max(4),
+	unique: z.boolean().optional()
+}).strict();
+var RecordRetentionSchema = z.union([
+	z.object({
+		ttlMs: z.number().int().positive(),
+		from: z.enum(["at", "write"])
+	}).strict(),
+	z.object({
+		maxRows: z.number().int().positive().optional(),
+		maxRowsPerDevice: z.number().int().positive().optional()
+	}).strict().refine((r) => r.maxRows !== void 0 || r.maxRowsPerDevice !== void 0, { message: "name maxRows, maxRowsPerDevice or both" }),
+	z.object({
+		owner: z.string().min(1),
+		reason: z.string().min(1)
+	}).strict(),
+	z.object({ none: z.string().min(1) }).strict()
+]);
+/** The descriptor a generic entries UI reads (D881 "generic entries"). */
+var EntryDescriptorSchema = z.object({
+	title: z.string().min(1),
+	/** The record body field shown as the entry's name. */
+	nameField: z.string().min(1),
+	/** JSON Schema of the entry body; `secret: true` marks a password field. */
+	fields: z.record(z.string(), z.unknown())
+}).strict();
+/** What crosses the wire and sits in the engine's catalog: JSON only, no Zod. */
+var RecordKindDeclarationSchema = z.object({
+	database: z.enum(RECORD_DATABASES).default("settings"),
+	class: z.enum(RECORD_CLASSES),
+	writeTrigger: z.string().min(1),
+	device: z.enum([
+		"required",
+		"optional",
+		"none"
+	]).default("none"),
+	at: z.enum(["required", "none"]).default("none"),
+	indexes: z.array(RecordIndexSchema).max(8).default([]),
+	retention: RecordRetentionSchema,
+	deviceRemoval: z.enum(["delete", "none"]).default("none"),
+	maxDataBytes: z.number().int().positive().max(RECORD_MAX_DATA_BYTES).default(RECORD_DEFAULT_MAX_DATA_BYTES),
+	/** Derived from the Zod schema; never written by hand. */
+	secretPaths: z.array(z.string().min(1)).default([]),
+	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
+	secretArrayKeys: z.record(z.string(), z.string()).default({}),
+	/** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+	adoptsFrom: z.string().min(1).optional(),
+	/** Kinds that must agree through `transact` sit in one file under one family name. */
+	transactFamily: z.string().min(1).optional(),
+	entry: EntryDescriptorSchema.optional()
+}).strict();
+/** The kind names: lower-case, dash separated, short enough for an index name. */
+var RecordKindNameSchema = z.string().regex(/^[a-z][a-z0-9-]{0,47}$/);
+/** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
+function assertValidDeclaration(name, decl) {
+	const refuse = (why) => {
+		throw new DeclarationRefusedError(`kind "${name}": ${why}`);
+	};
+	if (!RecordKindNameSchema.safeParse(name).success) refuse("the name must be lower-case-dashed");
+	const seen = /* @__PURE__ */ new Set();
+	for (const index of decl.indexes) {
+		if (seen.has(index.name)) refuse(`index name "${index.name}" is declared twice`);
+		seen.add(index.name);
+	}
+	const { retention } = decl;
+	const hasSecrets = decl.secretPaths.length > 0;
+	if ("ttlMs" in retention) {
+		if (retention.from === "at" && decl.at !== "required") refuse("a ttl from \"at\" needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use engine TTL (its keychain values would be orphaned)");
+	}
+	if ("maxRows" in retention || "maxRowsPerDevice" in retention) {
+		if (retention.maxRowsPerDevice !== void 0 && decl.device !== "required") refuse("maxRowsPerDevice needs device: \"required\"");
+		if (decl.at !== "required") refuse("a row bound trims the oldest \"at\": it needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use an engine row bound");
+		const bound = Math.max(retention.maxRows ?? 0, retention.maxRowsPerDevice ?? 0);
+		if (decl.database === "settings" && bound > 5e4) refuse(`a row bound above ${RECORD_SETTINGS_MAX_ROWS} belongs in database: "events" (a big delete on the settings thread stalls every configuration read)`);
+	}
+	if (decl.deviceRemoval === "delete" && decl.device === "none") refuse("deviceRemoval: \"delete\" needs a device: \"required\" or \"optional\"");
+	for (const path of decl.secretPaths) for (const prefix of secretArrayPrefixes(path)) if (decl.secretArrayKeys[prefix] === void 0) refuse(`secret path "${path}" crosses the array "${prefix}": declare its id key in secretArrayKeys`);
+}
+function bodyFieldsOf(schema) {
+	return { ...z.toJSONSchema(schema, {
+		unrepresentable: "any",
+		io: "input"
+	}) };
+}
+function isRecordLike(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Does every branch of the body schema carry `field`? (A discriminated union has several.) */
+function hasNameField(json, field) {
+	const branches = json["oneOf"] ?? json["anyOf"];
+	if (Array.isArray(branches)) return branches.length > 0 && branches.every((b) => isRecordLike(b) && hasNameField(b, field));
+	const properties = json["properties"];
+	return isRecordLike(properties) && Object.prototype.hasOwnProperty.call(properties, field);
+}
+/**
+* Declare the kinds of a package. The keys are the kind names. The result is
+* what `ctx.records.declare` sends to the engine and what `ctx.records.kind`
+* types its handle from.
+*/
+function defineRecordKinds(specs) {
+	const out = {};
+	for (const [name, spec] of Object.entries(specs)) {
+		const secretPaths = collectZodSecretPaths(spec.schema);
+		const nameField = spec.entry?.nameField ?? "name";
+		const fields = bodyFieldsOf(spec.schema);
+		if (spec.entry !== void 0 && !hasNameField(fields, nameField)) throw new DeclarationRefusedError(`kind "${name}": an entry kind's schema needs a "${nameField}" field`);
+		const parsed = RecordKindDeclarationSchema.parse({
+			database: spec.database,
+			class: spec.class,
+			writeTrigger: spec.writeTrigger,
+			device: spec.device,
+			at: spec.at,
+			indexes: spec.indexes === void 0 ? void 0 : [...spec.indexes],
+			retention: spec.retention,
+			deviceRemoval: spec.deviceRemoval,
+			maxDataBytes: spec.maxDataBytes,
+			secretPaths: [...secretPaths],
+			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
+			adoptsFrom: spec.adoptsFrom,
+			transactFamily: spec.transactFamily,
+			entry: spec.entry === void 0 ? void 0 : {
+				title: spec.entry.title,
+				nameField,
+				fields
+			}
+		});
+		assertValidDeclaration(name, parsed);
+		out[name] = {
+			name,
+			schema: spec.schema,
+			declaration: parsed
+		};
+	}
+	return out;
+}
+/** The wire form of a package's kinds: name -> declaration. */
+function declarationsOf(kinds) {
+	return Object.fromEntries(Object.entries(kinds).map(([name, kind]) => [name, kind.declaration]));
+}
+/** When non-null, `from` names an addon-settings brokers blob, not a SQL table. */
+function parseSettingsBrokersAdoptsFrom(from) {
+	if (!from.startsWith("@settings-brokers/")) return null;
+	const addonId = from.slice(18);
+	return addonId.length > 0 ? addonId : null;
+}
+/** When non-null, `from` names an addon-settings array blob, not a SQL table. */
+function parseSettingsArrayAdoptsFrom(from) {
+	if (!from.startsWith("@settings-array/")) return null;
+	const rest = from.slice(16);
+	const slash = rest.indexOf("/");
+	if (slash <= 0 || slash >= rest.length - 1) return null;
+	const addonId = rest.slice(0, slash);
+	const settingsKey = rest.slice(slash + 1);
+	if (addonId.length === 0 || settingsKey.length === 0) return null;
+	return {
+		addonId,
+		settingsKey
+	};
+}
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = z.enum([
 	"high",
@@ -4275,6 +4767,28 @@ function customAction(input, output, options) {
 		...options?.caller ? { caller: "required" } : {}
 	};
 }
+/**
+* Every cap whose provider reads a `callerAddonId` in its input (the keychain's
+* owner check, device-history's `not-owner`, records' owner).
+*
+* The stamp is set ONLY by the transport (`stampCallerAddonId`, or stated by a
+* hub in-process caller). The generated HTTP/tRPC mount parses input with
+* `.loose()`, so without this a session could add the key itself and act as
+* another addon. The mount strips it for these caps.
+*/
+var CALLER_STAMPED_CAPABILITIES = [
+	"keychain",
+	"device-history",
+	"records",
+	"integrations",
+	"device-manager"
+];
+/** A copy of `input` without the caller stamp. Anything that is not a plain object passes through. */
+function withoutCallerStamp(input) {
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return input;
+	if (!Object.prototype.hasOwnProperty.call(input, "callerAddonId")) return input;
+	return Object.fromEntries(Object.entries(input).filter(([key]) => key !== "callerAddonId"));
+}
 var StaticDirOutputSchema = z.object({ staticDir: z.string() });
 var VersionOutputSchema = z.object({ version: z.string() });
 /**
@@ -4467,69 +4981,6 @@ var RUNTIME_DEFAULTS = {
 	"ffmpeg.threadCount": 0,
 	"auth.tokenExpiry": "30d"
 };
-function defOf(schema) {
-	return schema._zod?.def ?? {};
-}
-function declaredHere(schema) {
-	return z.globalRegistry.get(schema)?.secret === true;
-}
-/** Wrapper kinds whose `innerType` is the field itself. */
-var WRAPPERS = new Set([
-	"optional",
-	"nullable",
-	"default",
-	"prefault",
-	"catch",
-	"readonly",
-	"nonoptional"
-]);
-/**
-* The schema layers that make up ONE field: the schema itself and every
-* wrapper below it (optional / default / nullable / readonly / catch), plus
-* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
-* `.transform` on `in`).
-*/
-function layersOf(schema) {
-	const out = [];
-	const queue = [schema];
-	while (queue.length > 0) {
-		const s = queue.shift();
-		if (!s || out.includes(s)) continue;
-		out.push(s);
-		const def = defOf(s);
-		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
-		if (def.type === "pipe") {
-			if (def.in) queue.push(def.in);
-			if (def.out) queue.push(def.out);
-		}
-	}
-	return out;
-}
-/** True when any layer of this field declares `.meta({ secret: true })`. */
-function isZodSecret(schema) {
-	return layersOf(schema).some(declaredHere);
-}
-/**
-* Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
-* object or array is reported as one path and not descended into — everything
-* under it is secret.
-*/
-function collectZodSecretPaths(schema, prefix = "") {
-	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
-	const paths = [];
-	for (const layer of layersOf(schema)) {
-		const def = defOf(layer);
-		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
-		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
-		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
-		else if (def.type === "intersection") {
-			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
-			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
-		}
-	}
-	return [...new Set(paths)];
-}
 /**
 * A user-facing error with a STABLE code (D863).
 *
@@ -16328,6 +16779,254 @@ id: z.union([z.string(), z.number()]) }), {
 		})
 	}
 };
+/**
+* records - an addon's own facts and documents (D881): ledgers, audit rows,
+* config documents, mirrors. The third storage API next to `ctx.settings`
+* (operator intent, D870) and device-history (numbers over time, D850).
+*
+* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
+* crossed a process and stated by a hub in-process caller (`ctx.records` does
+* that with the addon id closed over). It is deliberately NOT in any input
+* schema, so a session can never supply it, and a call with no stamp is refused
+* `records/no-caller`. A kind is readable and writable only by its owner; other
+* addons go through the owner's capability.
+*
+* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
+* never `[]`. Secret fields are never on the wire: a read shows the
+* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
+* resolves itself, and a write may carry only a keychain marker bound to the
+* row's own ref.
+*
+* Internal: addons reach it through `ctx.records`, never directly.
+*/
+var RecordIdSchema = z.string().min(1).max(256);
+/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
+var RecordBodySchema = z.record(z.string(), z.unknown());
+var RecordInputSchema = z.object({
+	id: RecordIdSchema,
+	/** The device this row belongs to (D865 removal, per-device reads). */
+	deviceId: z.number().int().optional(),
+	/** The domain clock, ms: observed / created / opened. */
+	at: z.number().int().optional(),
+	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
+	expiresAt: z.number().int().optional(),
+	data: RecordBodySchema
+});
+var RecordViewSchema = z.object({
+	id: z.string(),
+	deviceId: z.number().int().nullable(),
+	at: z.number().nullable(),
+	expiresAt: z.number().nullable(),
+	rev: z.number().int(),
+	updatedAt: z.number(),
+	data: RecordBodySchema
+});
+/** One predicate on a declared index field: equality, a set, or a range. */
+var RecordWhereValueSchema = z.union([
+	z.string(),
+	z.number(),
+	z.boolean(),
+	z.object({ in: z.array(z.union([
+		z.string(),
+		z.number(),
+		z.boolean()
+	])).min(1).max(RECORD_BATCH_MAX) }),
+	z.object({
+		gt: z.union([z.string(), z.number()]).optional(),
+		gte: z.union([z.string(), z.number()]).optional(),
+		lt: z.union([z.string(), z.number()]).optional(),
+		lte: z.union([z.string(), z.number()]).optional()
+	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
+]);
+/** Declared index fields only. Anything else does not compile, by design. */
+var RecordWhereSchema = z.record(RecordFieldPathSchema, RecordWhereValueSchema);
+var KindShape = { kind: RecordKindNameSchema };
+var TimeWindowShape = {
+	deviceId: z.number().int().optional(),
+	atFrom: z.number().optional(),
+	atTo: z.number().optional()
+};
+var RecordQueryInputSchema = z.object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional(),
+	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
+	order: z.enum(["at", "id"]).optional(),
+	desc: z.boolean().optional(),
+	limit: z.number().int().min(1).max(RECORD_QUERY_MAX).default(100),
+	/** Opaque keyset cursor from a previous answer. There is no offset. */
+	cursor: z.string().min(1).optional()
+});
+var RecordQueryResultSchema = z.object({
+	records: z.array(RecordViewSchema),
+	nextCursor: z.string().nullable()
+});
+var RecordKindStateSchema = z.enum([
+	"created",
+	"unchanged",
+	"updated"
+]);
+var DeclareKindResultSchema = z.object({
+	kindId: z.number().int(),
+	state: RecordKindStateSchema,
+	createdIndexes: z.array(z.string()),
+	/** The boot guard: the kind is empty while its legacy table still holds rows. */
+	adoptionPending: z.object({
+		legacyTable: z.string(),
+		legacyRows: z.number().int()
+	}).nullable()
+});
+/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
+var SecretRefsList = z.array(z.string());
+var RecordSecretRefsSchema = z.record(z.string(), z.record(z.string(), z.string()));
+var recordsCapability = {
+	name: "records",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/** Reconcile this addon's kinds: create the catalog rows and the declared indexes. Additive only. */
+		declareKinds: method(z.object({ kinds: z.record(RecordKindNameSchema, RecordKindDeclarationSchema) }), z.object({ kinds: z.record(z.string(), DeclareKindResultSchema) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		get: method(z.object({
+			...KindShape,
+			id: RecordIdSchema
+		}), RecordViewSchema.nullable(), { auth: "admin" }),
+		getMany: method(z.object({
+			...KindShape,
+			ids: z.array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+		}), z.array(RecordViewSchema), { auth: "admin" }),
+		/** The keychain refs of the rows' secret fields, by id and concrete path. For the owner's `ctx.secrets`. */
+		secretRefs: method(z.object({
+			...KindShape,
+			ids: z.array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+		}), RecordSecretRefsSchema, { auth: "admin" }),
+		put: method(z.object({
+			...KindShape,
+			record: RecordInputSchema,
+			/** Compare-and-set. `0` means "the row must not exist". */
+			ifRev: z.number().int().min(0).optional()
+		}), z.object({
+			rev: z.number().int(),
+			releasedRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		putMany: method(z.object({
+			...KindShape,
+			records: z.array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
+		}), z.object({
+			count: z.number().int(),
+			releasedRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** One-statement RFC 7396 merge: `null` removes a field; a merge never reads. */
+		patch: method(z.object({
+			...KindShape,
+			id: RecordIdSchema,
+			data: RecordBodySchema,
+			at: z.number().int().nullable().optional(),
+			expiresAt: z.number().int().nullable().optional(),
+			ifRev: z.number().int().min(1).optional()
+		}), z.object({
+			rev: z.number().int(),
+			releasedRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		delete: method(z.object({
+			...KindShape,
+			id: RecordIdSchema
+		}), z.object({
+			deleted: z.boolean(),
+			secretRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteMany: method(z.object({
+			...KindShape,
+			ids: z.array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+		}), z.object({
+			deleted: z.number().int(),
+			secretRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		query: method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }),
+		count: method(z.object({
+			...KindShape,
+			...TimeWindowShape,
+			where: RecordWhereSchema.optional()
+		}), z.object({ count: z.number().int() }), { auth: "admin" }),
+		histogram: method(z.object({
+			...KindShape,
+			deviceId: z.number().int().optional(),
+			from: z.number(),
+			to: z.number(),
+			bucketMs: z.number().int().positive()
+		}), z.object({ buckets: z.array(z.object({
+			bucketStart: z.number(),
+			count: z.number().int()
+		})) }), { auth: "admin" }),
+		/** Index-served only: every field must belong to ONE declared index. */
+		aggregate: method(z.object({
+			...KindShape,
+			op: z.enum([
+				"sum",
+				"min",
+				"max",
+				"count"
+			]),
+			field: RecordFieldPathSchema.optional(),
+			groupBy: RecordFieldPathSchema.optional(),
+			where: RecordWhereSchema.optional()
+		}), z.object({ rows: z.array(z.object({
+			group: z.union([
+				z.string(),
+				z.number(),
+				z.null()
+			]),
+			value: z.number().nullable()
+		})) }), { auth: "admin" }),
+		/** Batched (5 000 rows per statement, yielding between). Needs a predicate: there is no "delete all". */
+		deleteWhere: method(z.object({
+			...KindShape,
+			deviceId: z.number().int().optional(),
+			atBefore: z.number().optional(),
+			where: RecordWhereSchema.optional()
+		}), z.object({
+			deleted: z.number().int(),
+			secretRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The D865 hook body: every kind of this addon declared `deviceRemoval: 'delete'`. */
+		deleteDevice: method(z.object({
+			deviceId: z.number().int(),
+			kinds: z.array(RecordKindNameSchema).optional()
+		}), z.object({
+			deleted: z.record(z.string(), z.number().int()),
+			secretRefs: SecretRefsList
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** A monotonically increasing integer per kind (replaces "resume from the highest"). */
+		allocateId: method(z.object(KindShape), z.object({ id: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 /** One table of the settings database. */
 var StorageTableSchema = z.object({
 	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
@@ -16340,6 +17039,28 @@ var StorageTableSchema = z.object({
 	/** Declared by an addon since this engine process started (a running addon claims it). */
 	declaredThisBoot: z.boolean()
 });
+/** One declared record kind (D881) as System -> Data shows it. */
+var StorageKindSchema = z.object({
+	owner: z.string(),
+	kind: z.string(),
+	database: z.enum(["settings", "events"]),
+	class: z.string(),
+	state: z.enum([
+		"declared",
+		"orphaned",
+		"dropped"
+	]),
+	/** `null` when the caller asked for no counts (`counts: false`). */
+	rows: z.number().int().nonnegative().nullable(),
+	/** Rows x the average size of a sample; null for an empty kind. */
+	bytesEstimate: z.number().int().nonnegative().nullable(),
+	writeTrigger: z.string(),
+	retention: RecordRetentionSchema,
+	/** `true` when the kind is an entry kind (the generic entries UI lists it). */
+	entry: z.boolean(),
+	/** The whole declaration, secret paths and entry descriptor included (the entries service builds its handle from it). */
+	declaration: RecordKindDeclarationSchema
+});
 /**
 * The collections retired by exact name: the D870 ones (their data became keys
 * of the camera's settings) and the three D871 leftovers (the `stats-5m` tables
@@ -16358,7 +17079,16 @@ var STORAGE_ADMIN_MOVED_COLLECTIONS = [
 	"pipeline-orchestrator:device-features",
 	"pipeline-analytics:stats-5m",
 	"pipeline-orchestrator:stats-5m",
-	"vec_object_clip"
+	"vec_object_clip",
+	"addon-devices",
+	"sections",
+	"provider-settings",
+	"device-settings",
+	"ai:budgets",
+	"pipeline-analytics:retrain-dataset-versions",
+	"training:dataset-versions",
+	"benchmark:replay-runs",
+	"viewer-settings-snapshots"
 ];
 /** The per-addon blob tables a scoped name may carry. */
 var STORAGE_ADMIN_SCOPED_BASES = [
@@ -16408,6 +17138,121 @@ var storageAdminCapability = {
 		}), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/** Every record kind of both files with rows, a size estimate, class and retention (D881). */
+		listKinds: method(z.object({
+			owner: z.string().min(1).optional(),
+			/** `false` skips the per-kind row count (a catalog read only). Default true. */
+			counts: z.boolean().optional()
+		}), z.object({ kinds: z.array(StorageKindSchema) }), { auth: "admin" }),
+		/**
+		* Read-only diagnosis of ANY owner's kind: the same indexed query as the
+		* owner's, secret fields redacted, audited in the engine log.
+		*/
+		readRecords: method(RecordQueryInputSchema.extend({
+			owner: z.string().min(1),
+			kind: RecordKindNameSchema
+		}), RecordQueryResultSchema, { auth: "admin" }),
+		/**
+		* The migration copy path (D881): write rows into a kind AS ITS DECLARED
+		* OWNER. Refused when that owner's manifest does not declare the kind.
+		* Idempotent (a put by id, so a re-run resumes). A secret field carries a
+		* keychain marker bound to the row's own ref - the operator script imports
+		* the value first - and a plain string there is refused.
+		*/
+		adoptRecords: method(z.object({
+			owner: z.string().min(1),
+			kind: RecordKindNameSchema,
+			records: z.array(RecordInputSchema).max(RECORD_BATCH_MAX),
+			/** The LAST batch: the copy is complete, the boot guard stops asking. */
+			complete: z.boolean().optional()
+		}).refine((input) => input.records.length > 0 || input.complete === true, { message: "records must be non-empty unless complete is true" }), z.object({ adopted: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Read rows from a legacy KV table by physical name, without a running
+		* `declareCollection`. Used by `records-adopt.ts` when the owner already
+		* moved to records and the collection door refuses the name.
+		*/
+		readLegacyCollection: method(z.object({
+			collection: z.string().min(1),
+			cursor: z.string().optional(),
+			limit: z.number().int().min(1).max(1e3).optional()
+		}), z.object({
+			rows: z.array(z.object({
+				id: z.string(),
+				data: z.record(z.string(), z.unknown())
+			})),
+			nextCursor: z.string().nullable()
+		}), { auth: "admin" }),
+		/** True when a declared kind lists `collection` as `adoptsFrom` and adoption finished. */
+		isAdoptedLegacyTable: method(z.object({ collection: z.string().min(1) }), z.object({ adopted: z.boolean() }), { auth: "admin" })
+	}
+};
+/**
+* record-entries - the ONE admin surface for every list of user-created entries
+* (D881): notification targets, brokers, LLM profiles, anything an addon
+* declares as an ENTRY kind (`entry: { title }` in `defineRecordKinds`).
+*
+* The UI is generic. `listEntryKinds` hands it, per kind, the JSON Schema of
+* the entry body with `secret: true` on every credential field, so a password
+* field is derived from the schema and never from a name. `putEntry` takes the
+* redaction token for an untouched secret (the stored value is kept), a string
+* for a new one, and the clear instruction to remove one. A read never carries
+* a secret value, and a locked keychain refuses the write with
+* `records/secret-unavailable` instead of storing plaintext.
+*
+* Hub-only, served in-process (it acts for each entry's owner on the keychain).
+*/
+var EntryKindInfoSchema = z.object({
+	owner: z.string(),
+	kind: RecordKindNameSchema,
+	title: z.string(),
+	nameField: z.string(),
+	/** JSON Schema of the body; `secret: true` marks a password field. */
+	fields: z.record(z.string(), z.unknown()),
+	secretPaths: z.array(z.string()),
+	rows: z.number().int().nonnegative()
+});
+var EntryViewSchema = z.object({
+	id: RecordIdSchema,
+	name: z.string(),
+	rev: z.number().int(),
+	updatedAt: z.number(),
+	/** Secret fields hold the redaction token. */
+	data: RecordBodySchema
+});
+var EntryAddress = {
+	owner: z.string().min(1),
+	kind: RecordKindNameSchema
+};
+var recordEntriesCapability = {
+	name: "record-entries",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		listEntryKinds: method(z.object({}), z.object({ kinds: z.array(EntryKindInfoSchema) }), { auth: "admin" }),
+		listEntries: method(z.object({ ...EntryAddress }), z.object({ entries: z.array(EntryViewSchema) }), { auth: "admin" }),
+		/** Create (no `id`: one is generated) or edit. `ifRev` guards an edit against a concurrent one. */
+		putEntry: method(z.object({
+			...EntryAddress,
+			id: RecordIdSchema.optional(),
+			data: RecordBodySchema,
+			ifRev: z.number().int().min(1).optional()
+		}), z.object({
+			id: z.string(),
+			rev: z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteEntry: method(z.object({
+			...EntryAddress,
+			id: RecordIdSchema
+		}), z.object({ deleted: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	}
 };
@@ -72675,13 +73520,14 @@ var BaseDevice = class {
 	get state() {
 		if (!this._stateProxyCache) {
 			const cache = {};
-			const handler = { get: (_target, key) => {
+			const handler = { get: (target, key) => {
 				const k = key;
-				if (k in cache) return cache[k];
+				const existing = Reflect.get(target, k);
+				if (existing !== void 0) return existing;
 				const cap = DEVICE_LOCAL_STATE_CAPS[k];
 				if (!cap) return void 0;
 				const proxy = this.sliceProxy(cap);
-				cache[k] = proxy;
+				Reflect.set(target, k, proxy);
 				return proxy;
 			} };
 			this._stateProxyCache = new Proxy(cache, handler);
@@ -72880,7 +73726,7 @@ var BaseDevice = class {
 	async updateSourceInfo(patch) {
 		const next = mergeSourceInfo(this.sourceInfo, patch);
 		this._sourceInfoCache = Object.freeze({ ...next });
-		const action = this.ctx.api?.deviceManager?.setMetadata;
+		const action = this.ctx.api.deviceManager?.setMetadata;
 		if (action) try {
 			await action.mutate({
 				deviceId: this.id,
@@ -72915,7 +73761,7 @@ var BaseDevice = class {
 	* device boot on a meta refresh.
 	*/
 	async refreshFeatures() {
-		const action = this.ctx.api?.deviceManager?.registerDevice;
+		const action = this.ctx.api.deviceManager?.registerDevice;
 		if (!action) return;
 		try {
 			await action.mutate({
@@ -79530,6 +80376,30 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recordEntries.deleteEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"recordEntries.listEntries": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.listEntryKinds": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.putEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.getAvailability": {
 		capName: "recording",
 		capScope: "device",
@@ -79830,6 +80700,102 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"records.aggregate": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.allocateId": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.count": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.declareKinds": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.delete": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteDevice": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteWhere": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.get": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.getMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.histogram": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.patch": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.put": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.putMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.query": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.secretRefs": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.captureReference": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -80262,18 +81228,48 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageAdmin.adoptRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"storageAdmin.dropCollection": {
 		capName: "storage-admin",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"storageAdmin.isAdoptedLegacyTable": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.listKinds": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageAdmin.listTables": {
 		capName: "storage-admin",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"storageAdmin.readLegacyCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.readRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -81910,11 +82906,13 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	ptzCapability,
 	ptzAutotrackCapability,
 	rebootCapability,
+	recordEntriesCapability,
 	recordingCapability,
 	recordingArchiveCapability,
 	recordingExportCapability,
 	recordingOnboardCapability,
 	recordingSignalCapability,
+	recordsCapability,
 	sceneMonitorCapability,
 	scriptRunnerCapability,
 	serverManagementCapability,
@@ -84133,6 +85131,37 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"records.count": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.deleteDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"records.deleteWhere": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.histogram": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.putMany": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"records.query": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"sceneMonitor.captureReference": [{
 		name: "deviceId",
 		form: "single",
@@ -84249,6 +85278,17 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"storageAdmin.adoptRecords": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"storageAdmin.readRecords": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"streamBroker.acquireEgressTranscode": [{
 		name: "deviceId",
 		form: "single",
@@ -86293,4 +87333,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { StorageCleanupJobSchema as $, splitTranslationRef as $n, expandCapMethods as $r, gbToBytes as $t, DeclaredDevices as A, pickAppLinkHub as An, errMsg as Ar, databaseSnapshotCapability as At, METHOD_ACCESS_MAP as B, resolveCoreBlockFiles as Bn, WELL_KNOWN_TAB_MAP as Br, deviceStatusCapability as Bt, DAY_NAMES as C, toSecretFieldView as Ci, modeMayWrite as Cn, compositionSourceKey as Cr, coreBlockAddonId as Ct, DEVICE_SAN_CREDENTIAL_PREFIX as D, objectInputDeclaresAddonId as Dn, DeviceFeature as Dr, coreBlocksCapability as Dt, DEVICE_NONCE_TTL_MS as E, EventCategory as Ei, normalizeUnit as En, toExpressionValue as Er, coreBlockSourceKind as Et, HUB_MDNS_SERVICE_TYPE as F, reducePoints as Fn, REDACTED_SECRET as Fr, describeComposableCaps as Ft, RecordingStatusSchema as G, runtimeStatePolicyFor as Gn, collectSecretConfigKeys as Gr, evictionPolicyOfLocation as Gt, MOTION_CLOSE_AFTER_MS as H, resolveLocationMode as Hn, asNumber as Hr, enumerateItemArrayFields as Ht, HUB_MDNS_TXT_KEYS as I, replacedFieldKeys as In, RUNTIME_DEFAULTS as Ir, deviceCredentialsCapability as It, STORAGE_ADMIN_SCOPED_BASES as J, scoreRuntimes as Jn, createEvent as Jr, extractNestedAddonId as Jt, STORAGE_ACCESS_FALLBACK as K, scopesAllowAddon as Kn, collectSecretMarkerRefs as Kr, expandContainer as Kt, KEYCHAIN_RESET_TRIGGER_ACTOR as L, resolveAppConnections as Ln, ReadinessRegistry as Lr, deviceExtensionCapability as Lt, FIRST_LEVEL_MACRO_CLASSES as M, platformProbeCapability as Mn, DATAPLANE_SECRET_HEADER as Mr, decodeVectorBase64 as Mt, FieldClaimModeSchema as N, procedureAuthKey as Nn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Nr, defineExtensionSlotProvider as Nt, DEVICE_SAN_USER_PREFIX as O, objectInputDeclaresRequiredDeviceId as On, DeviceRole as Or, createDeviceExtensionProvider as Ot, FieldClaimSchema as P, ptzAutotrackCapability as Pn, DEVICE_STATUS_METHOD as Pr, deriveBatteryPresence as Pt, SsoBridgeClaimsSchema as Q, snapshotCapability as Qn, emitReadiness as Qr, formatMinutes as Qt, LOG_LEVEL_RANK as R, resolveBucketMs as Rn, ReadinessTimeoutError as Rr, deviceManagerCapability as Rt, DATA_STORE_DATABASES as S, toNodeId as Si, metricsProviderCapability as Sn, compositionSliceKey as Sr, compositionSourceRefs as St, DEVICE_ENROLLMENT_TTL_MS as T, userError as Ti, normalizeCoreBlockWrite as Tn, disarmRoseMemory as Tr, coreBlockIdFromAddonId as Tt, NetworkTunnelStartedDataSchema as U, resolveMethodAuth as Un, asString$1 as Ur, enumerateSchemaFields as Ut, MINUTES_PER_DAY as V, resolveHubAddressRoles as Vn, asJsonObject as Vr, enumerateInferenceDevices as Vt, RECORDING_SOURCE_CAMSTACK_ADDON as W, resolveNotificationTapAddress as Wn, buildSecretRef as Wr, evaluateCompositionField as Wt, ScopedTokenSchema as X, shortHostname as Xn, defineCustomActions as Xr, foldSnapshotByFunction as Xt, STREAM_PROFILE_META as Y, settingsStoreCapability as Yn, customAction as Yr, filesystemBrowseCapability as Yt, ServerNameSchema as Z, siteZoneKey as Zn, emitDownForOwnedCaps as Zr, formatDeviceRevoker as Zt, CatalogFileSchema as _, resolveSecretMarkers as _i, logLevelAtMost as _n, cloneStatefulExpressionMemory as _r, cameraGridLayoutCapability as _t, ApiKeyRecordSchema as a, isSecretClear as ai, isLocationEnabled as an, streamCatalogCapability as ar, addonSettingsCapability as at, DATABASE_SNAPSHOT_SUFFIX as b, secretTreeFromSchema as bi, mayWriteToLocation as bn, compositionFeatureEnabled as br, composerCapability as bt, CAMERA_SWITCH_ORDER as c, isSecretRefOwnedBy as ci, kebabToCamel as cn, userManagementCapability as cr, authProviderCapability as ct, CATALOG_LANGS as d, normalizeSecretOwner as di, legacyAutoLinkIds as dn, vectorDimFromBase64 as dr, batteryCapability as dt, formatSecretScope as ei, interpolate as en, storageAdminCapability as er, StorageLocationModeSchema as et, COMPOSED_ITEM_FIXED_FIELDS as f, parseJsonObject as fi, legacyModeOf as fn, vectorIndexDimConflictError as fr, buildCapabilityLookup as ft, CalendarPreferencesSchema as g, resolveCapMount as gi, logDestinationCapability as gn, buildFfmpegArgs as gr, calendarsCapability as gt, CORE_BLOCK_ADDON_PREFIX as h, readinessKey as hi, locationIconKey as hn, COMPOSER_ADDON_ID as hr, buildStreamParamsConfigSchema as ht, AlertSchema as i, isKeychainStoredField as ii, isDefaultAppConnectionEndpoint as in, storageProviderCapability as ir, addonPagesCapability as it, DeviceStatusSchema as j, planComposition as jn, BaseAddon as jr, declarationOwnerNodeId as jt, DEVICE_TOMBSTONE_RETENTION_MS as k, parseStreamParamsFormPatch as kn, DeviceType as kr, dataStoreProviderCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, makeSecretMarker as li, keychainAdminCapability as ln, validateComposition as lr, backupCapability as lt, CORE_BLOCKS_ADDON_ID as m, parseSecretRef as mi, localNetworkCapability as mn, withLocationMode as mr, buildDeviceSignatureMessage as mt, AGENT_MDNS_TXT_KEYS as n, isDeviceConfigCap as ni, isArrayOutputSchema as nn, storageMigrationCapability as nr, StorageMigrationJobSchema as nt, BaseDevice as o, isSecretMarker as oi, isObjectInput as on, streamQualityLabel as or, addonWidgetsCapability as ot, COMPOSER_RUNNER_ID as p, parseJsonUnknown as pi, lifecycleJobSchema as pn, vectorStoreCapability as pr, buildDeviceEnrollmentLink as pt, STORAGE_ADMIN_MOVED_COLLECTIONS as q, scopesAllowDeviceCap as qn, collectZodSecretPaths as qr, expressionContainsBuiltinCall as qt, ALL_CAPABILITY_DEFINITIONS as r, isEvent as ri, isCollectionArrayMethod as rn, storageOccupancyCapability as rr, UserRecordSchema as rt, BatteryStatusSchema as s, isSecretMarkerLike as si, isVoidInput as sn, supportedRuntimes as sr, alertsCapability as st, AGENT_MDNS_SERVICE_TYPE as t, hydrateSchema as ti, isAppLinkBase as tn, storageCapability as tr, StorageLocationTypeSchema as tt, CAP_NAMES_WITH_STATUS as u, nodePin as ui, keychainCapability as un, validateCustomAddress as ur, bareAddonId as ut, CoreBlockSchema as v, scopeKey as vi, looseSchema as vn, composedDeviceRef as vr, canonicalIconKey as vt, DERIVED_CAMERA_SILENCED_CAP_NAMES as w, transformSecretWrite as wi, motionCapability as wn, createStatefulExpressionMemory as wr, coreBlockComposition as wt, DATABASE_SNAPSHOT_TIMEOUT_MS as x, sleep as xi, memoizePinnedFfmpeg as xn, compositionItemFieldPath as xr, compositionFieldKey as xt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as y, secretTreeFromPaths as yi, mayReadLocation as yn, composedDeviceStableId as yr, checkRoleAddress as yt, LegacyStorageLocationDefaultSchema as z, resolveCoreBlockEntry as zn, SECRET_CLEAR as zr, deviceStateCapability as zt };
+export { STREAM_PROFILE_META as $, resolveSecretMarkers as $i, scopesAllowAddon as $n, RECORD_SWEEP_INTERVAL_MS as $r, extractNestedAddonId as $t, DataStoreDatabaseSchema as A, expandCapMethods as Ai, normalizeCoreBlockWrite as An, compositionSourceKey as Ar, coreBlockIdFromAddonId as At, KeychainAuditEntrySchema as B, makeSecretMarker as Bi, recordEntriesCapability as Bn, CALLER_STAMPED_CAPABILITIES as Br, describeComposableCaps as Bt, DAY_NAMES as C, createEvent as Ci, looseSchema as Cn, buildFfmpegArgs as Cr, canonicalIconKey as Ct, DEVICE_SAN_CREDENTIAL_PREFIX as D, defineRecordKinds as Di, metricsProviderCapability as Dn, compositionFeatureEnabled as Dr, compositionSourceRefs as Dt, DEVICE_NONCE_TTL_MS as E, defineCustomActions as Ei, memoizePinnedFfmpeg as En, composedDeviceStableId as Er, compositionFieldKey as Et, FieldClaimModeSchema as F, isKeychainStoredField as Fi, pickAppLinkHub as Fn, DeviceRole as Fr, databaseSnapshotCapability as Ft, MINUTES_PER_DAY as G, parseJsonObject as Gi, resolveBucketMs as Gn, FilterRequiredError as Gr, deviceStatusCapability as Gt, LOG_LEVEL_RANK as H, nodePin as Hi, reducePoints as Hn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Hr, deviceExtensionCapability as Ht, FieldClaimSchema as I, isSecretClear as Ii, planComposition as In, DeviceType as Ir, declarationOwnerNodeId as It, RECORDING_SOURCE_CAMSTACK_ADDON as J, parseSettingsArrayAdoptsFrom as Ji, resolveHubAddressRoles as Jn, NoCallerError as Jr, enumerateSchemaFields as Jt, MOTION_CLOSE_AFTER_MS as K, parseJsonUnknown as Ki, resolveCoreBlockEntry as Kn, ForeignSecretMarkerError as Kr, enumerateInferenceDevices as Kt, HUB_MDNS_SERVICE_TYPE as L, isSecretMarker as Li, platformProbeCapability as Ln, errMsg as Lr, decodeVectorBase64 as Lt, DeviceStatusSchema as M, hydrateSchema as Mi, objectInputDeclaresAddonId as Mn, disarmRoseMemory as Mr, coreBlocksCapability as Mt, DeviceTombstoneSchema as N, isDeviceConfigCap as Ni, objectInputDeclaresRequiredDeviceId as Nn, toExpressionValue as Nr, createDeviceExtensionProvider as Nt, DEVICE_SAN_USER_PREFIX as O, emitDownForOwnedCaps as Oi, modeMayWrite as On, compositionItemFieldPath as Or, coreBlockAddonId as Ot, FIRST_LEVEL_MACRO_CLASSES as P, isEvent as Pi, parseStreamParamsFormPatch as Pn, DeviceFeature as Pr, dataStoreProviderCapability as Pt, STORAGE_ADMIN_SCOPED_BASES as Q, resolveCapMount as Qi, runtimeStatePolicyFor as Qn, RECORD_DELETE_BATCH as Qr, expressionContainsBuiltinCall as Qt, HUB_MDNS_TXT_KEYS as R, isSecretMarkerLike as Ri, procedureAuthKey as Rn, BaseAddon as Rr, defineExtensionSlotProvider as Rt, DATA_STORE_DATABASES as S, collectZodSecretPaths as Si, logLevelAtMost as Sn, COMPOSER_ADDON_ID as Sr, cameraGridLayoutCapability as St, DEVICE_ENROLLMENT_TTL_MS as T, declarationsOf as Ti, mayWriteToLocation as Tn, composedDeviceRef as Tr, composerCapability as Tt, LegacyStorageLocationDefaultSchema as U, normalizeNodeId as Ui, replacedFieldKeys as Un, DEVICE_STATUS_METHOD as Ur, deviceManagerCapability as Ut, KeychainResetRecordSchema as V, mapSecretLeaves as Vi, recordsCapability as Vn, DATAPLANE_SECRET_HEADER as Vr, deviceCredentialsCapability as Vt, METHOD_ACCESS_MAP as W, normalizeSecretOwner as Wi, resolveAppConnections as Wn, DeclarationRefusedError as Wr, deviceStateCapability as Wt, STORAGE_ACCESS_FALLBACK as X, readinessKey as Xi, resolveMethodAuth as Xn, RECORD_BATCH_MAX as Xr, evictionPolicyOfLocation as Xt, RecordingStatusSchema as Y, parseSettingsBrokersAdoptsFrom as Yi, resolveLocationMode as Yn, PlaintextSecretError as Yr, evaluateCompositionField as Yt, STORAGE_ADMIN_MOVED_COLLECTIONS as Z, recordSecretRef as Zi, resolveNotificationTapAddress as Zn, RECORD_BATCH_MAX_BYTES as Zr, expandContainer as Zt, CatalogFileSchema as _, assertValidDeclaration as _i, legacyModeOf as _n, validateCustomAddress as _r, buildCapabilityLookup as _t, ApiKeyRecordSchema as a, toSecretFieldView as aa, RecordKindDeclarationSchema as ai, interpolate as an, snapshotCapability as ar, StorageLocationTypeSchema as at, DATABASE_SNAPSHOT_SUFFIX as b, collectSecretLeaves as bi, locationIconKey as bn, vectorStoreCapability as br, buildStreamParamsConfigSchema as bt, CAMERA_SWITCH_ORDER as c, withoutCallerStamp as ca, RecordUniqueViolationError as ci, isCollectionArrayMethod as cn, storageCapability as cr, UserRecordSchema as ct, CATALOG_LANGS as d, UnindexedFilterError as di, isObjectInput as dn, storageProviderCapability as dr, addonWidgetsCapability as dt, scopeKey as ea, REDACTED_SECRET as ei, filesystemBrowseCapability as en, scopesAllowDeviceCap as er, ScopedTokenSchema as et, COMPOSED_ITEM_FIXED_FIELDS as f, UnknownRecordKindError as fi, isVoidInput as fn, streamCatalogCapability as fr, alertsCapability as ft, CalendarPreferencesSchema as g, asString$1 as gi, legacyAutoLinkIds as gn, validateComposition as gr, batteryCapability as gt, CORE_BLOCK_ADDON_PREFIX as h, asNumber as hi, keychainCapability as hn, userManagementCapability as hr, bareAddonId as ht, AlertSchema as i, toNodeId as ia, ReadinessTimeoutError as ii, gbToBytes as in, siteZoneKey as ir, StorageLocationModeSchema as it, DeclaredDevices as j, formatSecretScope as ji, normalizeUnit as jn, createStatefulExpressionMemory as jr, coreBlockSourceKind as jt, DEVICE_TOMBSTONE_RETENTION_MS as k, emitReadiness as ki, motionCapability as kn, compositionSliceKey as kr, coreBlockComposition as kt, CAMSTACK_APP_LINK_ORIGIN as l, EventCategory as la, RevConflictError as li, isDefaultAppConnectionEndpoint as ln, storageMigrationCapability as lr, addonPagesCapability as lt, CORE_BLOCKS_ADDON_ID as m, asJsonObject as mi, keychainAdminCapability as mn, supportedRuntimes as mr, backupCapability as mt, AGENT_MDNS_TXT_KEYS as n, secretTreeFromSchema as na, RUNTIME_DEFAULTS as ni, formatDeviceRevoker as nn, settingsStoreCapability as nr, SsoBridgeClaimsSchema as nt, BaseDevice as o, transformSecretWrite as oa, RecordNotFoundError as oi, isAppLinkBase as on, splitTranslationRef as or, StorageMigrationJobSchema as ot, COMPOSER_RUNNER_ID as p, WELL_KNOWN_TAB_MAP as pi, kebabToCamel as pn, streamQualityLabel as pr, authProviderCapability as pt, NetworkTunnelStartedDataSchema as q, parseSecretRef as qi, resolveCoreBlockFiles as qn, InvalidRecordError as qr, enumerateItemArrayFields as qt, ALL_CAPABILITY_DEFINITIONS as r, sleep as ra, ReadinessRegistry as ri, formatMinutes as rn, shortHostname as rr, StorageCleanupJobSchema as rt, BatteryStatusSchema as s, userError as sa, RecordTooLargeError as si, isArrayOutputSchema as sn, storageAdminCapability as sr, TokenScopeSchema as st, AGENT_MDNS_SERVICE_TYPE as t, secretTreeFromPaths as ta, REMOVE_LEAF as ti, foldSnapshotByFunction as tn, scoreRuntimes as tr, ServerNameSchema as tt, CAP_NAMES_WITH_STATUS as u, SECRET_CLEAR as ui, isLocationEnabled as un, storageOccupancyCapability as ur, addonSettingsCapability as ut, CoreBlockSchema as v, buildSecretRef as vi, lifecycleJobSchema as vn, vectorDimFromBase64 as vr, buildDeviceEnrollmentLink as vt, DERIVED_CAMERA_SILENCED_CAP_NAMES as w, customAction as wi, mayReadLocation as wn, cloneStatefulExpressionMemory as wr, checkRoleAddress as wt, DATABASE_SNAPSHOT_TIMEOUT_MS as x, collectSecretMarkerRefs as xi, logDestinationCapability as xn, withLocationMode as xr, calendarsCapability as xt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as y, collectSecretConfigKeys as yi, localNetworkCapability as yn, vectorIndexDimConflictError as yr, buildDeviceSignatureMessage as yt, KEYCHAIN_RESET_TRIGGER_ACTOR as z, isSecretRefOwnedBy as zi, ptzAutotrackCapability as zn, BatchTooLargeError as zr, deriveBatteryPresence as zt };