@camstack/system 1.2.59 → 1.2.61

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { ft as errMsg, m as addonPagesCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
+import { ft as errMsg, m as addonPagesCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { ft as errMsg, g as addonWidgetsCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
+import { ft as errMsg, g as addonWidgetsCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Et as createEvent, _ as alertsCapability, ft as errMsg, n as AlertSchema, pt as BaseAddon, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
+import { Et as createEvent, _ as alertsCapability, ft as errMsg, n as AlertSchema, pt as BaseAddon, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_fs$1 = require_chunk.__toESM(node_fs, 1);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { b as backupCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
+import { b as backupCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import Kt from "node:fs";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { G as logDestinationCapability, pt as BaseAddon } from "../../dist-BqJJWCS8.mjs";
+import { G as logDestinationCapability, pt as BaseAddon } from "../../dist-L6QPJWsr.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { C as coreBlocksCapability, o as CoreBlockSchema, pt as BaseAddon } from "../../dist-BqJJWCS8.mjs";
+import { C as coreBlocksCapability, o as CoreBlockSchema, pt as BaseAddon } from "../../dist-L6QPJWsr.mjs";
 import { randomUUID } from "node:crypto";
 import * as path$1 from "node:path";
 import * as fs from "node:fs/promises";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { D as deviceStateCapability, E as deviceManagerCapability, I as getByPath, M as enumerateSchemaFields, N as evaluateLinkExpression, O as deviceStatusCapability, Rt as sleep, S as buildStreamParamsConfigSchema, St as WELL_KNOWN_TAB_MAP, Y as normalizeUnit, Z as parseStreamParamsFormPatch, _t as DeviceFeature, a as CAP_NAMES_WITH_STATUS, ft as errMsg, j as enumerateItemArrayFields, jt as isDeviceConfigCap, lt as validateExpressionSource, pt as BaseAddon, s as DeviceStatusSchema, st as toExpressionValue, t as ALL_CAPABILITY_DEFINITIONS, tt as setByPath, u as STREAM_PROFILE_META, v as applyTransform, vt as DeviceRole, x as bareAddonId, yt as DeviceType, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
+import { D as deviceStateCapability, E as deviceManagerCapability, I as getByPath, M as enumerateSchemaFields, N as evaluateLinkExpression, O as deviceStatusCapability, Rt as sleep, S as buildStreamParamsConfigSchema, St as WELL_KNOWN_TAB_MAP, Y as normalizeUnit, Z as parseStreamParamsFormPatch, _t as DeviceFeature, a as CAP_NAMES_WITH_STATUS, ft as errMsg, j as enumerateItemArrayFields, jt as isDeviceConfigCap, lt as validateExpressionSource, pt as BaseAddon, s as DeviceStatusSchema, st as toExpressionValue, t as ALL_CAPABILITY_DEFINITIONS, tt as setByPath, u as STREAM_PROFILE_META, v as applyTransform, vt as DeviceRole, x as bareAddonId, yt as DeviceType, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { B as isSameAddonId, Et as createEvent, ft as errMsg, k as doorbellCapability, pt as BaseAddon, x as bareAddonId, yt as DeviceType, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
+import { B as isSameAddonId, Et as createEvent, ft as errMsg, k as doorbellCapability, pt as BaseAddon, x as bareAddonId, yt as DeviceType, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { G as logDestinationCapability, pt as BaseAddon } from "../../dist-BqJJWCS8.mjs";
+import { G as logDestinationCapability, pt as BaseAddon } from "../../dist-L6QPJWsr.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Et as createEvent, ft as errMsg, pt as BaseAddon, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
+import { Et as createEvent, ft as errMsg, pt as BaseAddon, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { ct as userManagementCapability, d as ScopedTokenSchema, p as UserRecordSchema, pt as BaseAddon, r as ApiKeyRecordSchema, y as authProviderCapability } from "../../dist-BqJJWCS8.mjs";
+import { ct as userManagementCapability, d as ScopedTokenSchema, p as UserRecordSchema, pt as BaseAddon, r as ApiKeyRecordSchema, y as authProviderCapability } from "../../dist-L6QPJWsr.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomUUID } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { W as localNetworkCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
+import { W as localNetworkCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { G as logDestinationCapability, pt as BaseAddon } from "../../dist-BqJJWCS8.mjs";
+import { G as logDestinationCapability, pt as BaseAddon } from "../../dist-L6QPJWsr.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Et as createEvent, J as metricsProviderCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
+import { Et as createEvent, J as metricsProviderCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
 import * as fs from "node:fs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { A as enumerateInferenceDevices, Ot as emitReadiness, Q as platformProbeCapability, et as scoreRuntimes, ft as errMsg, pt as BaseAddon, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
+import { A as enumerateInferenceDevices, Ot as emitReadiness, Q as platformProbeCapability, et as scoreRuntimes, ft as errMsg, pt as BaseAddon, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { pt as BaseAddon, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
+import { pt as BaseAddon, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 let node_child_process = require("node:child_process");
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Mt as nodePin, _t as DeviceFeature, ft as errMsg, i as BatteryStatusSchema, ot as streamQualityLabel, pt as BaseAddon, rt as snapshotCapability, x as bareAddonId, yt as DeviceType } from "../../dist-BqJJWCS8.mjs";
+import { Mt as nodePin, _t as DeviceFeature, ft as errMsg, i as BatteryStatusSchema, ot as streamQualityLabel, pt as BaseAddon, rt as snapshotCapability, x as bareAddonId, yt as DeviceType } from "../../dist-L6QPJWsr.mjs";
 import { execFile, spawn } from "node:child_process";
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CV6XTApk.js");
+const require_dist = require("../../dist-BN681PgO.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { F as filesystemBrowseCapability, at as storageProviderCapability, pt as BaseAddon } from "../../dist-BqJJWCS8.mjs";
+import { F as filesystemBrowseCapability, at as storageProviderCapability, pt as BaseAddon } from "../../dist-L6QPJWsr.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/prefix-range.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Turn a key PREFIX into a half-open range SQLite can answer from the index.
+ *
+ * **The measurement.** The two canonical KV tables (`addon-settings`,
+ * `addon-device-settings`) are keyed `"<scope>.<key>"` and every scoped read
+ * and write selects by prefix. That was written as `WHERE id LIKE ? || '%'`,
+ * and SQLite cannot use an index for it: `LIKE` is case-insensitive for ASCII
+ * by default, so the LIKE optimisation requires an index with `COLLATE
+ * NOCASE`, which the implicit PRIMARY KEY index is not. `EXPLAIN QUERY PLAN`
+ * says so in one word:
+ *
+ *     LIKE   =>  SCAN addon-device-settings
+ *     RANGE  =>  SEARCH addon-device-settings USING INDEX … (id>? AND id<?)
+ *
+ * Every `writeDeviceRuntimeState` therefore scanned the whole table before
+ * inserting, on the main thread, synchronously — 15.6% of hub-main's CPU in
+ * the 2026-08-07 V8 profile sat in this transaction. Measured on a 2 240-row
+ * table (far smaller than the live one, and the gap widens linearly with rows):
+ *
+ *     write  (1 DELETE + 14 UPSERT, one txn)   0.253 ms → 0.143 ms   1.8x
+ *     read   (getAllScoped)                    0.207 ms → 0.011 ms  19.4x
+ *
+ * **It is also more CORRECT, which was not the goal.** `LIKE` treats `_` and
+ * `%` in the PATTERN as wildcards, and the pattern here is built from an addon
+ * id and a device id. `clearAddonDevice('a_b', …)` deleted `axb`'s rows too,
+ * and `LIKE`'s ASCII case-folding meant `Recorder:615.` matched
+ * `recorder:615.`. A byte range matches exactly the keys that start with the
+ * prefix and nothing else.
+ *
+ * **Why it can refuse.** SQLite's BINARY collation compares UTF-8 BYTES; JS
+ * compares UTF-16 code units. The two orders agree for ASCII and can disagree
+ * above it. Rather than encode a subtle equivalence nobody will re-derive, a
+ * non-ASCII prefix returns `null` and the caller keeps the existing `LIKE` —
+ * slower, but identical to what shipped. Every prefix in this codebase is an
+ * addon id, a device id and separators, so the fast path is the only one that
+ * runs in practice; the fallback exists so a future key shape cannot silently
+ * lose rows.
+ */
+/** Half-open key range `[lo, hi)` covering exactly the keys starting with a prefix. */
+export interface PrefixRange {
+    readonly lo: string;
+    /** EXCLUSIVE upper bound: the prefix with its last byte incremented. */
+    readonly hi: string;
+}
+/**
+ * @returns the range for `prefix`, or `null` when the caller must fall back to
+ *   a `LIKE` scan (empty prefix — which is the whole table and has no upper
+ *   bound — or any byte outside ASCII).
+ */
+export declare function prefixRange(prefix: string): PrefixRange | null;

package/dist/builtins/sqlite-storage/query-bounds.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Defensive row bounds for `data-store-provider.query`.
+ *
+ * **Why this file exists.** On 2026-08-07 hub-main died with
+ * `FATAL ERROR: Reached heap limit` under `Data::GetValueJS` /
+ * `Statement::JS_all`, four seconds after reporting `heapUsed=644MB
+ * heapLimit=4288MB`. The heap sampler cannot see an allocation that begins and
+ * ends between two samples, so the `[mem]` line said everything was fine right
+ * up to the kill. The same stack had already killed the hub twice on 01/08 and
+ * twice on 02/08.
+ *
+ * **It was NOT one 3.4 GB statement, and that correction matters.** The whole
+ * database measures 153 MiB (134 MB in a backup taken 14 h earlier, with
+ * `auto_vacuum=NONE` and `freelist_count=6` proving it had never been larger)
+ * — no single `.all()` on it can produce 3.4 GB. What happened was MANY reads
+ * live at once: a viewer resumed from background and requested a 12-hour
+ * window over 16 cameras, twice, 33 ms apart. The final Mark-Compact reclaimed
+ * 4 MB of 4 090 MB, i.e. every byte was still reachable. `Statement::JS_all` is
+ * where the wall was hit, not the size of that one call. The caller-side bound
+ * for that specific fan-out lives in `track-store.ts`
+ * (`RECENT_FANOUT_ROW_BUDGET`); this file is the backstop under everything
+ * else.
+ *
+ * So: a bound on the query, NOT a bigger `--max-old-space-size`. hub-main's
+ * routine p95 heap is already 2 108 MB against a 4 288 MB ceiling; a larger
+ * ceiling only moves the number the next unbounded read has to beat.
+ *
+ * **Why a cap and not a required `limit`.** 64 call sites across the repo
+ * query a collection with no `limit`, and most of them are correct — a filter
+ * narrow enough that the result set is a handful of rows (`where: { trackId }`,
+ * `where: { ownerId }`). Making `limit` mandatory would be 64 edits that each
+ * have to guess a number, and the 65th call site added next month would be
+ * unbounded again. A cap in the ENGINE holds for every caller, including the
+ * ones not written yet.
+ *
+ * **Why the cap is never silent.** A truncated read that looks like a complete
+ * one is worse than the OOM: it turns "the hub died" into "the retention sweep
+ * quietly stopped deleting". Every cap hit is logged at WARN naming the
+ * collection and the bound, and the caller is expected to page.
+ */
+/**
+ * Rows returned when the caller supplied no `limit` at all.
+ *
+ * Sized against the MEASURED hub database (2026-08-08), because a row cap is
+ * meaningless without knowing what a row weighs:
+ *
+ * | table                              | rows    | bytes  | avg row |
+ * | ---------------------------------- | ------- | ------ | ------- |
+ * | `pipeline-analytics:tracks`        |   4 668 |  54 MB | 11.5 KB |
+ * | `pipeline-analytics:media`         | 101 953 |  23 MB |   230 B |
+ * | `pipeline-analytics:motion-events` | 148 738 |  12 MB |    78 B |
+ * | `pipeline-analytics:audio-events`  |  99 608 |   8 MB |    80 B |
+ * | `pipeline-analytics:faces`         |     372 |   4 MB | 10.8 KB |
+ *
+ * `tracks` is the pacing table: its `positions` JSON alone is 47 MB of the 54,
+ * averaging **10 KB per row**, and it is parsed into JS objects on read. 2 000
+ * such rows is ~23 MB of text before parsing — an order of magnitude under
+ * hub-main's routine p95 heap (2 108 MB) rather than a multiple of it. The
+ * same 2 000 rows of `motion-events` is 160 KB, so narrow tables (auth,
+ * alerts, integrations, schedules) never notice the cap at all.
+ *
+ * An earlier draft sized this at 5 000 on the belief that `faces` was the
+ * widest table. It is 372 rows and 4 MB — `pruneCapOverflow` keeps it that
+ * way. The number was defensible; the stated evidence for it was wrong, which
+ * is worse, because the next person reasons from the evidence.
+ *
+ * It is deliberately NOT tuned to "the largest legitimate result set" — a
+ * caller that genuinely wants more says so with an explicit `limit`, which is
+ * honoured up to {@link SETTINGS_QUERY_HARD_ROW_CAP}.
+ */
+export declare const SETTINGS_QUERY_DEFAULT_ROW_CAP = 2000;
+/**
+ * Absolute ceiling, applied even to an explicit `limit`.
+ *
+ * The default cap can be opted out of; this one cannot, because the failure it
+ * prevents is an OOM and there is no result set worth taking the process down
+ * for. A caller needing more than 20 000 rows is describing a stream, not a
+ * query, and must page (`limit` + `offset`) — every bulk consumer in the repo
+ * already does. At the measured 11.5 KB/row of `tracks`, 20 000 rows is
+ * ~230 MB: ruinous to serve, but survivable, which is the right place for a
+ * ceiling whose only job is to stop the process dying.
+ */
+export declare const SETTINGS_QUERY_HARD_ROW_CAP = 20000;
+/** Where the effective row bound came from. */
+export type RowBoundSource = 
+/** The caller's own `limit`, honoured verbatim. Not a truncation. */
+'caller'
+/** No usable `limit` was given — {@link SETTINGS_QUERY_DEFAULT_ROW_CAP}. */
+ | 'default-cap'
+/** The caller asked for more than {@link SETTINGS_QUERY_HARD_ROW_CAP}. */
+ | 'hard-cap';
+export interface ResolvedRowBound {
+    /** Rows the statement is allowed to return. */
+    readonly limit: number;
+    readonly source: RowBoundSource;
+}
+/**
+ * Resolve the row bound a `query` will run under.
+ *
+ * Treats a non-finite, negative or non-integer `limit` as ABSENT rather than
+ * as an error. That is not leniency for its own sake: SQLite reads a negative
+ * `LIMIT` as "no limit at all", so `limit: -1` arriving over the wire — the
+ * cap schema is `z.number().optional()`, which accepts it — would have been
+ * the one input able to reproduce the OOM through a bound that looked applied.
+ *
+ * `limit: 0` is a real request for zero rows and is honoured.
+ */
+export declare function resolveRowBound(requested: number | undefined): ResolvedRowBound;
+/**
+ * Whether a bound being hit is something the CALLER did not ask for, and must
+ * therefore be told about.
+ *
+ * A caller that asked for 500 rows and got 500 has not been truncated — it has
+ * been served. Only a cap the engine imposed is news.
+ */
+export declare function isImposedBound(source: RowBoundSource): boolean;

package/dist/builtins/sqlite-storage/sqlite-pragmas.d.ts

@@ -81,5 +81,17 @@ export declare const SQLITE_JOURNAL_SIZE_LIMIT_BYTES = 67108864;
  * looks like verification. `__tests__/sqlite-pragmas.spec.ts` asserts the
  * effective value instead, so a dependency bump that changes the default is
  * caught rather than assumed.
+ *
+ * **When it takes effect, measured (2026-08-08).** The WAL default is applied
+ * when the WAL is actually opened — the first read/write transaction — NOT when
+ * `PRAGMA journal_mode = WAL` runs. On a brand-new file the sequence reads:
+ *
+ *     after `journal_mode = WAL`, before any write   → 2 (FULL)
+ *     after the first write                          → 1 (NORMAL)
+ *
+ * `initialize()` writes (`ensureTable`, `seedDefaults`) before anything can
+ * observe the value, so production is at NORMAL on first boot and every boot
+ * after. Recorded because reading the pragma immediately after setting the
+ * journal mode reports FULL and looks exactly like a regression in this file.
  */
 export declare const SQLITE_SYNCHRONOUS_IS_BUILD_DEFAULT = true;

package/dist/builtins/sqlite-storage/sqlite-settings-backend.d.ts

@@ -1,4 +1,4 @@
-import { CollectionColumn, CollectionIndex, DataStoreEngineInfo, HistogramBucket, ISettingsBackend, SettingsCountInput, SettingsDeleteInput, SettingsGetInput, SettingsHistogramInput, SettingsInsertInput, SettingsIsEmptyInput, SettingsQueryInput, SettingsRecord, SettingsSetInput, SettingsUpdateInput } from '@camstack/types';
+import { CollectionColumn, CollectionIndex, DataStoreEngineInfo, HistogramBucket, ISettingsBackend, SettingsCountInput, SettingsDeleteInput, SettingsGetInput, SettingsHistogramInput, SettingsInsertInput, SettingsIsEmptyInput, SettingsQueryInput, SettingsRecord, SettingsSetInput, SettingsUpdateInput, IScopedLogger } from '@camstack/types';
 import { default as Database } from 'better-sqlite3';
 import { MutationFilterInput } from './filter-compiler.js';
 /** Input for {@link SqliteSettingsBackend.deleteWhere}. */
@@ -34,6 +34,23 @@ interface SettingsUpdateWhereResult {
 export declare class SqliteSettingsBackend implements ISettingsBackend {
     private readonly dbPath;
     private db;
+    /**
+     * Table name → fingerprint of the schema this process last materialised.
+     *
+     * Keyed by FINGERPRINT, not by name, and that is the whole point. An addon
+     * declares its schema at every boot, but the backend lives in hub-main,
+     * which outlives an addon respawn: `camstack deploy` restarts the addon
+     * runner and NOT hub-main. A name-only memo therefore made the second
+     * declaration of a table a no-op FOREVER — a redeployed addon whose schema
+     * had gained a column never got the `ALTER TABLE … ADD COLUMN`, and, because
+     * `compileFilter` silently drops a predicate naming a column the collection
+     * cannot express (select mode), the missing column read as "matches
+     * everything" instead of failing. That is how `pipeline-analytics:tracks`
+     * ran for a whole release with no `retrainStatus`: the retention sweep's
+     * `whereIn: { retrainStatus: ['none','trained'] }` pin evaporated, so every
+     * operator-staged track was eligible for deletion, and `countStaging`
+     * reported the entire history as staged.
+     */
     private readonly structuredTables;
     /** Map from scoped collection name → set of column names (non-id) that
      *  the structured schema owns. Routes set/get/insert/update/query to
@@ -47,7 +64,15 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * to the previous legacy path; only the routing is unified.
      */
     private static readonly CANONICAL_KV_COLLECTIONS;
-    constructor(dbPath: string, runtimeDefaults?: Record<string, unknown>);
+    /**
+     * Optional, because the engine is constructed in places that have no addon
+     * context (migrations, one-shot tools, most specs). It is NOT optional in
+     * production: `sqlite-settings.addon.ts` passes one, and without it a row cap
+     * being hit would be silent — which is the failure mode the cap exists to
+     * avoid replacing.
+     */
+    private readonly logger;
+    constructor(dbPath: string, runtimeDefaults?: Record<string, unknown>, logger?: IScopedLogger);
     initialize(): Promise<void>;
     private requireDeclared;
     /**
@@ -122,6 +147,17 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      */
     getDatabase(): Database.Database | null;
     private getDb;
+    /**
+     * `WHERE` fragment selecting every key that starts with `prefix`, plus its
+     * bound parameters.
+     *
+     * The range form is what makes the implicit PRIMARY KEY index usable — see
+     * `prefix-range.ts` for the `EXPLAIN QUERY PLAN` output and the measured
+     * 1.8x/19.4x. The `LIKE` fallback is the SQL that shipped before, kept
+     * verbatim for the prefixes a byte range cannot express, so a key shape this
+     * function refuses degrades in speed and never in correctness.
+     */
+    private prefixWhere;
     private getAllScoped;
     private setScopedKey;
     private scopedName;