@camstack/system 1.2.90 → 1.2.92

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-C0zkl1Ae.js");
+const require_manifest_python_deps = require("./manifest-python-deps-BZO_eMn-.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, xt as resolveAddonClass } from "./manifest-python-deps-fWzdEasI.mjs";
+import { I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, xt as resolveAddonClass } from "./manifest-python-deps-D3hP9W8D.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-BH2tZ9ZN.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ut as EventCategory, _t as BaseAddon, gt as errMsg, v as addonPagesCapability } from "../../dist-DMhxx5Kr.mjs";
+import { Ut as EventCategory, _t as BaseAddon, gt as errMsg, v as addonPagesCapability } from "../../dist-DXDvrBi0.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-BH2tZ9ZN.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ut as EventCategory, _t as BaseAddon, b as addonWidgetsCapability, gt as errMsg } from "../../dist-DMhxx5Kr.mjs";
+import { Ut as EventCategory, _t as BaseAddon, b as addonWidgetsCapability, gt as errMsg } from "../../dist-DXDvrBi0.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-BH2tZ9ZN.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { At as createEvent, Ut as EventCategory, _t as BaseAddon, gt as errMsg, n as AlertSchema, x as alertsCapability } from "../../dist-DMhxx5Kr.mjs";
+import { At as createEvent, Ut as EventCategory, _t as BaseAddon, gt as errMsg, n as AlertSchema, x as alertsCapability } from "../../dist-DXDvrBi0.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-BH2tZ9ZN.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");
@@ -4204,6 +4204,18 @@ function previewNextRuns(cron, count, after) {
 }
 //#endregion
 //#region src/builtins/backup-orchestrator/destination-policy.ts
+/**
+* @durable class=config owner=backup-orchestrator
+*   write="`ensureDefault` auto-creates one row the first time a `backups` storage
+*     location is listed (enabled, retentionCount 7, cron `0 3 * * *`), and an operator
+*     edit rewrites it (`upsert` = delete + insert, carrying `last_run_at` forward so a
+*     label change does not reset the schedule baseline)"
+*   retention="none — `delete(locationId)` exists but NOTHING calls it, so a policy row
+*     outlives the `StorageLocation` it names and the table only ever grows, by one row
+*     per backups location ever seen. Losing a row is recoverable: the next
+*     `listDestinations` pass re-creates it from the defaults, which silently discards
+*     the operator's own retention count and cron."
+*/
 var BACKUP_DESTINATION_POLICIES = "backup_destination_policies";
 var BACKUP_DESTINATION_POLICIES_COLUMNS = [
 	{
@@ -4590,6 +4602,18 @@ var LocationManifestLock = class {
 };
 //#endregion
 //#region src/builtins/backup-orchestrator/schedule-store.ts
+/**
+* @durable class=config owner=backup-orchestrator
+*   write="an operator creating or editing a schedule (`upsert`, implemented as
+*     delete + insert: cron, enabled, the fan-out `location_ids`, `retention_count`,
+*     optional `data_sources`), plus a `last_run_at` stamp the orchestrator writes on
+*     every due tick BEFORE the archive runs, so an upload outliving the tick cannot
+*     fire the same schedule twice"
+*   retention="only the operator's `delete(id)` — no sweep, no expiry, and `retention_count`
+*     bounds the ARCHIVES at the destination, never these rows. Losing the table stops
+*     every scheduled backup silently: no cron remains to fire, and the fan-out sets and
+*     retention counts are gone with it."
+*/
 var BACKUP_SCHEDULES = "backup_schedules";
 var BACKUP_SCHEDULES_COLUMNS = [
 	{

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { C as backupCapability, Ut as EventCategory, _t as BaseAddon } from "../../dist-DMhxx5Kr.mjs";
+import { C as backupCapability, Ut as EventCategory, _t as BaseAddon } from "../../dist-DXDvrBi0.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";
@@ -4189,6 +4189,18 @@ function previewNextRuns(cron, count, after) {
 }
 //#endregion
 //#region src/builtins/backup-orchestrator/destination-policy.ts
+/**
+* @durable class=config owner=backup-orchestrator
+*   write="`ensureDefault` auto-creates one row the first time a `backups` storage
+*     location is listed (enabled, retentionCount 7, cron `0 3 * * *`), and an operator
+*     edit rewrites it (`upsert` = delete + insert, carrying `last_run_at` forward so a
+*     label change does not reset the schedule baseline)"
+*   retention="none — `delete(locationId)` exists but NOTHING calls it, so a policy row
+*     outlives the `StorageLocation` it names and the table only ever grows, by one row
+*     per backups location ever seen. Losing a row is recoverable: the next
+*     `listDestinations` pass re-creates it from the defaults, which silently discards
+*     the operator's own retention count and cron."
+*/
 var BACKUP_DESTINATION_POLICIES = "backup_destination_policies";
 var BACKUP_DESTINATION_POLICIES_COLUMNS = [
 	{
@@ -4575,6 +4587,18 @@ var LocationManifestLock = class {
 };
 //#endregion
 //#region src/builtins/backup-orchestrator/schedule-store.ts
+/**
+* @durable class=config owner=backup-orchestrator
+*   write="an operator creating or editing a schedule (`upsert`, implemented as
+*     delete + insert: cron, enabled, the fan-out `location_ids`, `retention_count`,
+*     optional `data_sources`), plus a `last_run_at` stamp the orchestrator writes on
+*     every due tick BEFORE the archive runs, so an upload outliving the tick cannot
+*     fire the same schedule twice"
+*   retention="only the operator's `delete(id)` — no sweep, no expiry, and `retention_count`
+*     bounds the ARCHIVES at the destination, never these rows. Losing the table stops
+*     every scheduled backup silently: no cron remains to fire, and the fan-out sets and
+*     retention counts are gone with it."
+*/
 var BACKUP_SCHEDULES = "backup_schedules";
 var BACKUP_SCHEDULES_COLUMNS = [
 	{

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-BH2tZ9ZN.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { J as logDestinationCapability, _t as BaseAddon } from "../../dist-DMhxx5Kr.mjs";
+import { J as logDestinationCapability, _t as BaseAddon } from "../../dist-DXDvrBi0.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/blocks-integration.d.ts

@@ -1,4 +1,4 @@
-import { DeclaredDevicePorts } from '@camstack/types';
+import { DeclaredDevicePorts, IScopedLogger } from '@camstack/types';
 /** Operator-visible name of the shared integration. Seeded once, at create. */
 export declare const BLOCKS_INTEGRATION_NAME = "Blocks";
 /**
@@ -22,3 +22,36 @@ export type BlocksIntegrationPorts = Omit<DeclaredDevicePorts, 'addonId'>;
  * convenience; the spec test pins both.
  */
 export declare function reconcileBlocksIntegration(ports: BlocksIntegrationPorts): Promise<string | null>;
+/** What {@link armBlocksIntegration} needs, and the seam its spec drives. */
+export interface ArmBlocksIntegrationOptions {
+    readonly logger: IScopedLogger;
+    readonly reconcile: () => Promise<string | null>;
+    readonly onLanded: (integrationId: string | null) => void;
+    readonly retryDelayMs?: number;
+    readonly maxAttempts?: number;
+}
+/** A reconcile running in the background, and a handle to await in tests. */
+export interface ArmedBlocksIntegration {
+    readonly settled: Promise<void>;
+}
+/**
+ * Arm the shared integration WITHOUT putting it on the boot path (D167).
+ *
+ * `integrations` is a hub-core namespace served by the `$core-caps` Moleculer
+ * service, and that service is registered only after `app.init()` returns —
+ * which is where the entire addon boot runs. During boot the read is therefore
+ * not slow, it is unanswerable: it burns the full 30 s discovery deadline and
+ * fast-fails, with no boot-window retry (core caps are excluded from it).
+ *
+ * Awaited inside `onInitialize()`, that 30 s sat on the hub's SERIAL in-process
+ * builtin loop and delayed `device-manager` — which every provider runner waits
+ * on before it may publish a single capability. Measured 2026-08-15: builtins
+ * stalled t0+10 s → t0+40 s, and the first camera's first keyframe landed at
+ * t0+75 s.
+ *
+ * So: arm it, let boot finish, and let the retry land it a few seconds later. A
+ * block that declares a device before it lands finds `null` and gets the
+ * integration on the next converge tick — which was already the documented
+ * behaviour when the API was unavailable.
+ */
+export declare function armBlocksIntegration(options: ArmBlocksIntegrationOptions): ArmedBlocksIntegration;

package/dist/builtins/core-blocks/core-block-store.d.ts

@@ -1,4 +1,15 @@
 import { CoreBlock, CoreBlockInput, IScopedLogger, SettingsStoreClient } from '@camstack/types';
+/**
+ * @durable class=config owner=core-blocks
+ *   write="`create` and `update` persist the operator's block after it compiles;
+ *     `setStatus` rewrites what the runner reported (status, `lastChangedAt`,
+ *     `lastError`) — so a running block is written on every state change"
+ *   retention="`delete` only, when the operator removes a block. Nothing ages out,
+ *     and a row whose JSON stops validating is left on disk rather than repaired.
+ *     The real loss path is a `declareCollection` REBUILD — a legacy (id, data)
+ *     shape, or a new PK/UNIQUE/NOT-NULL-without-default column — which drops the
+ *     table and takes the operator's source code with it."
+ */
 export declare const CORE_BLOCKS_COLLECTION = "core_blocks";
 export declare const CORE_BLOCKS_COLUMNS: readonly [{
     readonly name: "id";

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-BH2tZ9ZN.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -495,6 +495,17 @@ async function compileBlock(transpiler, code) {
 * is a fork failure the operator meets minutes later inside a log — so the
 * compile happens where they are still looking at the editor.
 */
+/**
+* @durable class=config owner=core-blocks
+*   write="`create` and `update` persist the operator's block after it compiles;
+*     `setStatus` rewrites what the runner reported (status, `lastChangedAt`,
+*     `lastError`) — so a running block is written on every state change"
+*   retention="`delete` only, when the operator removes a block. Nothing ages out,
+*     and a row whose JSON stops validating is left on disk rather than repaired.
+*     The real loss path is a `declareCollection` REBUILD — a legacy (id, data)
+*     shape, or a new PK/UNIQUE/NOT-NULL-without-default column — which drops the
+*     table and takes the operator's source code with it."
+*/
 var CORE_BLOCKS_COLLECTION = "core_blocks";
 var CORE_BLOCKS_COLUMNS = [
 	{
@@ -721,6 +732,52 @@ async function reconcileBlocksIntegration(ports) {
 		devices: []
 	})).integrationId;
 }
+/** Retry cadence for {@link armBlocksIntegration}. The gap it waits out is the
+*  rest of hub boot — `$core-caps` is registered once `app.init()` returns — so
+*  seconds, and a handful of them, is the right shape. */
+var ARM_RETRY_DELAY_MS = 5e3;
+/** Bounded, because an integration that will never reconcile must say so once
+*  rather than log forever. Roughly two minutes at the default cadence. */
+var ARM_MAX_ATTEMPTS = 24;
+/**
+* Arm the shared integration WITHOUT putting it on the boot path (D167).
+*
+* `integrations` is a hub-core namespace served by the `$core-caps` Moleculer
+* service, and that service is registered only after `app.init()` returns —
+* which is where the entire addon boot runs. During boot the read is therefore
+* not slow, it is unanswerable: it burns the full 30 s discovery deadline and
+* fast-fails, with no boot-window retry (core caps are excluded from it).
+*
+* Awaited inside `onInitialize()`, that 30 s sat on the hub's SERIAL in-process
+* builtin loop and delayed `device-manager` — which every provider runner waits
+* on before it may publish a single capability. Measured 2026-08-15: builtins
+* stalled t0+10 s → t0+40 s, and the first camera's first keyframe landed at
+* t0+75 s.
+*
+* So: arm it, let boot finish, and let the retry land it a few seconds later. A
+* block that declares a device before it lands finds `null` and gets the
+* integration on the next converge tick — which was already the documented
+* behaviour when the API was unavailable.
+*/
+function armBlocksIntegration(options) {
+	const retryDelayMs = options.retryDelayMs ?? ARM_RETRY_DELAY_MS;
+	const maxAttempts = options.maxAttempts ?? ARM_MAX_ATTEMPTS;
+	return { settled: (async () => {
+		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
+			options.onLanded(await options.reconcile());
+			return;
+		} catch (err) {
+			if (attempt === maxAttempts) {
+				options.logger.warn("core-blocks: the shared integration never reconciled — a block that declares a device has nowhere to hang it", { meta: {
+					attempts: attempt,
+					error: require_dist.errMsg(err)
+				} });
+				return;
+			}
+			await new Promise((resolve) => setTimeout(resolve, retryDelayMs));
+		}
+	})() };
+}
 //#endregion
 //#region src/builtins/core-blocks/core-blocks.addon.ts
 /**
@@ -777,7 +834,13 @@ var CoreBlocksAddon = class extends require_dist.BaseAddon {
 		});
 		await this.store.load();
 		this.transpiler = await loadTranspiler(this.ctx.logger);
-		this.blocksIntegrationId = await this.declareBlocksIntegration();
+		armBlocksIntegration({
+			logger: this.ctx.logger,
+			reconcile: () => this.declareBlocksIntegration(),
+			onLanded: (integrationId) => {
+				this.blocksIntegrationId = integrationId;
+			}
+		});
 		this.supervisor = this.buildSupervisor();
 		this.supervisor?.start(CONVERGE_INTERVAL_MS);
 		this.ctx.logger.info("core-blocks ready", { meta: {
@@ -857,26 +920,21 @@ var CoreBlocksAddon = class extends require_dist.BaseAddon {
 			this.ctx.logger.warn("core-blocks: no integrations API — a block that declares a device will have nowhere to hang it");
 			return null;
 		}
-		try {
-			return await reconcileBlocksIntegration({
-				logger: this.ctx.logger.child("integration"),
-				devices: this.ctx.kernel.devices,
-				localNodeId: this.ctx.kernel.localNodeId,
-				getIntegration: async (addonId) => api.integrations.getByAddonId.query({ addonId }),
-				createIntegration: async (input) => api.integrations.create.mutate(input),
-				updateIntegration: async ({ id, info }) => {
-					await api.integrations.update.mutate({
-						id,
-						info,
-						skipRestart: true
-					});
-				},
-				listOwnDevices: async () => api.deviceManager.listAll.query({ addonId: require_dist.CORE_BLOCKS_ADDON_ID })
-			});
-		} catch (err) {
-			this.ctx.logger.warn("core-blocks: the shared integration could not be reconciled", { meta: { error: err instanceof Error ? err.message : String(err) } });
-			return null;
-		}
+		return reconcileBlocksIntegration({
+			logger: this.ctx.logger.child("integration"),
+			devices: this.ctx.kernel.devices,
+			localNodeId: this.ctx.kernel.localNodeId,
+			getIntegration: async (addonId) => api.integrations.getByAddonId.query({ addonId }),
+			createIntegration: async (input) => api.integrations.create.mutate(input),
+			updateIntegration: async ({ id, info }) => {
+				await api.integrations.update.mutate({
+					id,
+					info,
+					skipRestart: true
+				});
+			},
+			listOwnDevices: async () => api.deviceManager.listAll.query({ addonId: require_dist.CORE_BLOCKS_ADDON_ID })
+		});
 	}
 	/**
 	* Reconcile now, after a write.

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { D as coreBlockIdFromAddonId, E as coreBlockAddonId, O as coreBlocksCapability, _t as BaseAddon, c as CoreBlockSchema, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX } from "../../dist-DMhxx5Kr.mjs";
+import { D as coreBlockIdFromAddonId, E as coreBlockAddonId, O as coreBlocksCapability, _t as BaseAddon, c as CoreBlockSchema, gt as errMsg, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX } from "../../dist-DXDvrBi0.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";
@@ -491,6 +491,17 @@ async function compileBlock(transpiler, code) {
 * is a fork failure the operator meets minutes later inside a log — so the
 * compile happens where they are still looking at the editor.
 */
+/**
+* @durable class=config owner=core-blocks
+*   write="`create` and `update` persist the operator's block after it compiles;
+*     `setStatus` rewrites what the runner reported (status, `lastChangedAt`,
+*     `lastError`) — so a running block is written on every state change"
+*   retention="`delete` only, when the operator removes a block. Nothing ages out,
+*     and a row whose JSON stops validating is left on disk rather than repaired.
+*     The real loss path is a `declareCollection` REBUILD — a legacy (id, data)
+*     shape, or a new PK/UNIQUE/NOT-NULL-without-default column — which drops the
+*     table and takes the operator's source code with it."
+*/
 var CORE_BLOCKS_COLLECTION = "core_blocks";
 var CORE_BLOCKS_COLUMNS = [
 	{
@@ -717,6 +728,52 @@ async function reconcileBlocksIntegration(ports) {
 		devices: []
 	})).integrationId;
 }
+/** Retry cadence for {@link armBlocksIntegration}. The gap it waits out is the
+*  rest of hub boot — `$core-caps` is registered once `app.init()` returns — so
+*  seconds, and a handful of them, is the right shape. */
+var ARM_RETRY_DELAY_MS = 5e3;
+/** Bounded, because an integration that will never reconcile must say so once
+*  rather than log forever. Roughly two minutes at the default cadence. */
+var ARM_MAX_ATTEMPTS = 24;
+/**
+* Arm the shared integration WITHOUT putting it on the boot path (D167).
+*
+* `integrations` is a hub-core namespace served by the `$core-caps` Moleculer
+* service, and that service is registered only after `app.init()` returns —
+* which is where the entire addon boot runs. During boot the read is therefore
+* not slow, it is unanswerable: it burns the full 30 s discovery deadline and
+* fast-fails, with no boot-window retry (core caps are excluded from it).
+*
+* Awaited inside `onInitialize()`, that 30 s sat on the hub's SERIAL in-process
+* builtin loop and delayed `device-manager` — which every provider runner waits
+* on before it may publish a single capability. Measured 2026-08-15: builtins
+* stalled t0+10 s → t0+40 s, and the first camera's first keyframe landed at
+* t0+75 s.
+*
+* So: arm it, let boot finish, and let the retry land it a few seconds later. A
+* block that declares a device before it lands finds `null` and gets the
+* integration on the next converge tick — which was already the documented
+* behaviour when the API was unavailable.
+*/
+function armBlocksIntegration(options) {
+	const retryDelayMs = options.retryDelayMs ?? ARM_RETRY_DELAY_MS;
+	const maxAttempts = options.maxAttempts ?? ARM_MAX_ATTEMPTS;
+	return { settled: (async () => {
+		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
+			options.onLanded(await options.reconcile());
+			return;
+		} catch (err) {
+			if (attempt === maxAttempts) {
+				options.logger.warn("core-blocks: the shared integration never reconciled — a block that declares a device has nowhere to hang it", { meta: {
+					attempts: attempt,
+					error: errMsg(err)
+				} });
+				return;
+			}
+			await new Promise((resolve) => setTimeout(resolve, retryDelayMs));
+		}
+	})() };
+}
 //#endregion
 //#region src/builtins/core-blocks/core-blocks.addon.ts
 /**
@@ -773,7 +830,13 @@ var CoreBlocksAddon = class extends BaseAddon {
 		});
 		await this.store.load();
 		this.transpiler = await loadTranspiler(this.ctx.logger);
-		this.blocksIntegrationId = await this.declareBlocksIntegration();
+		armBlocksIntegration({
+			logger: this.ctx.logger,
+			reconcile: () => this.declareBlocksIntegration(),
+			onLanded: (integrationId) => {
+				this.blocksIntegrationId = integrationId;
+			}
+		});
 		this.supervisor = this.buildSupervisor();
 		this.supervisor?.start(CONVERGE_INTERVAL_MS);
 		this.ctx.logger.info("core-blocks ready", { meta: {
@@ -853,26 +916,21 @@ var CoreBlocksAddon = class extends BaseAddon {
 			this.ctx.logger.warn("core-blocks: no integrations API — a block that declares a device will have nowhere to hang it");
 			return null;
 		}
-		try {
-			return await reconcileBlocksIntegration({
-				logger: this.ctx.logger.child("integration"),
-				devices: this.ctx.kernel.devices,
-				localNodeId: this.ctx.kernel.localNodeId,
-				getIntegration: async (addonId) => api.integrations.getByAddonId.query({ addonId }),
-				createIntegration: async (input) => api.integrations.create.mutate(input),
-				updateIntegration: async ({ id, info }) => {
-					await api.integrations.update.mutate({
-						id,
-						info,
-						skipRestart: true
-					});
-				},
-				listOwnDevices: async () => api.deviceManager.listAll.query({ addonId: CORE_BLOCKS_ADDON_ID })
-			});
-		} catch (err) {
-			this.ctx.logger.warn("core-blocks: the shared integration could not be reconciled", { meta: { error: err instanceof Error ? err.message : String(err) } });
-			return null;
-		}
+		return reconcileBlocksIntegration({
+			logger: this.ctx.logger.child("integration"),
+			devices: this.ctx.kernel.devices,
+			localNodeId: this.ctx.kernel.localNodeId,
+			getIntegration: async (addonId) => api.integrations.getByAddonId.query({ addonId }),
+			createIntegration: async (input) => api.integrations.create.mutate(input),
+			updateIntegration: async ({ id, info }) => {
+				await api.integrations.update.mutate({
+					id,
+					info,
+					skipRestart: true
+				});
+			},
+			listOwnDevices: async () => api.deviceManager.listAll.query({ addonId: CORE_BLOCKS_ADDON_ID })
+		});
 	}
 	/**
 	* Reconcile now, after a write.

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-BH2tZ9ZN.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { Ct as DeviceType, Et as WELL_KNOWN_TAB_MAP, Ft as isDeviceConfigCap, Ht as sleep, I as enumerateItemArrayFields, L as enumerateSchemaFields, M as deviceStateCapability, N as deviceStatusCapability, Q as normalizeUnit, St as DeviceRole, T as buildStreamParamsConfigSchema, Ut as EventCategory, _t as BaseAddon, a as CAP_NAMES_WITH_STATUS, et as parseStreamParamsFormPatch, gt as errMsg, j as deviceManagerCapability, p as STREAM_PROFILE_META, rt as runtimeStatePolicyFor, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, xt as DeviceFeature } from "../../dist-DMhxx5Kr.mjs";
+import { Ct as DeviceType, Et as WELL_KNOWN_TAB_MAP, Ft as isDeviceConfigCap, Ht as sleep, I as enumerateItemArrayFields, L as enumerateSchemaFields, M as deviceStateCapability, N as deviceStatusCapability, Q as normalizeUnit, St as DeviceRole, T as buildStreamParamsConfigSchema, Ut as EventCategory, _t as BaseAddon, a as CAP_NAMES_WITH_STATUS, et as parseStreamParamsFormPatch, gt as errMsg, j as deviceManagerCapability, p as STREAM_PROFILE_META, rt as runtimeStatePolicyFor, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, xt as DeviceFeature } from "../../dist-DXDvrBi0.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-BH2tZ9ZN.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { At as createEvent, Ct as DeviceType, P as doorbellCapability, U as isSameAddonId, Ut as EventCategory, _t as BaseAddon, gt as errMsg, w as bareAddonId } from "../../dist-DMhxx5Kr.mjs";
+import { At as createEvent, Ct as DeviceType, P as doorbellCapability, U as isSameAddonId, Ut as EventCategory, _t as BaseAddon, gt as errMsg, w as bareAddonId } from "../../dist-DXDvrBi0.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-BH2tZ9ZN.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { J as logDestinationCapability, _t as BaseAddon } from "../../dist-DMhxx5Kr.mjs";
+import { J as logDestinationCapability, _t as BaseAddon } from "../../dist-DXDvrBi0.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CYqL8oZq.js");
+const require_dist = require("../../dist-BH2tZ9ZN.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { At as createEvent, Ut as EventCategory, _t as BaseAddon, gt as errMsg } from "../../dist-DMhxx5Kr.mjs";
+import { At as createEvent, Ut as EventCategory, _t as BaseAddon, gt as errMsg } from "../../dist-DXDvrBi0.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/auth-schema.d.ts

@@ -1,7 +1,42 @@
 import { SettingsStoreClient } from '@camstack/types';
+/**
+ * @durable class=config owner=local-auth
+ *   write="an operator creates a user, or `ensureAdminExists` seeds/re-syncs the
+ *     configured admin at boot; updated on scope, isAdmin and password edits"
+ *   retention="none — a row goes only when an operator deletes the user. A
+ *     `declareCollection` that adds a PK/UNIQUE/NOT-NULL-without-default column
+ *     REBUILDS the table: every account is wiped and only the configured admin
+ *     comes back on the next boot."
+ */
 export declare const USERS_COLLECTION = "users";
+/**
+ * @durable class=config owner=local-auth
+ *   write="an operator mints an API key; `validateToken` rewrites `lastUsedAt` on
+ *     every request the key authorises"
+ *   retention="none — an explicit `revoke` is the only delete. API keys have no
+ *     expiry column and no sweep, so a key lives until someone removes it (or the
+ *     destructive `declareCollection` rebuild takes the table)."
+ */
 export declare const API_KEYS_COLLECTION = "api_keys";
+/**
+ * @durable class=config owner=local-auth
+ *   write="an operator or the CLI mints a scoped token; `validate` fires
+ *     `updateLastUsed` on every accepted call"
+ *   retention="`revoke` deletes one. The daily sweep `reapExpired` drops rows past
+ *     `expiresAt` — a NULL expiry is a deliberate never-expires token and BETWEEN
+ *     never matches it. `cleanupOrphans` drops tokens owned by the legacy 'system'
+ *     id or by a user that no longer exists."
+ */
 export declare const SCOPED_TOKENS_COLLECTION = "scoped_tokens";
+/**
+ * @durable class=ledger owner=local-auth
+ *   write="one row per redeemed OAuth code — every completed account link through
+ *     `oauthExchangeCode`; `touch` rewrites `lastUsedAt` on each refresh"
+ *   retention="ONLY revoked rows are pruned: the daily sweep deletes sessions
+ *     revoked more than OAUTH_REVOKED_RETENTION_MS (30 d) ago. An ACTIVE session
+ *     has `revokedAt` NULL, never expires and is never swept — the table grows one
+ *     row per login until an operator revokes the link."
+ */
 export declare const OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
 /**
  * TOTP enrollment table — split off from `users` to avoid the
@@ -15,6 +50,13 @@ export declare const OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
  *
  * "Enabled" means `confirmedAt != null`. A half-enrolled row (`confirmedAt
  * = null`) is INACTIVE — `verifyTotp` returns false until confirmation.
+ *
+ * @durable class=config owner=local-auth
+ *   write="`setup` inserts a fresh secret for the user (deleting any pending row
+ *     first); `confirm` flips `confirmedAt` once a valid code proves possession"
+ *   retention="`disable` deletes the row, and `setup` deletes before re-inserting.
+ *     Nothing else prunes — deleting a USER does not cascade here, so their
+ *     enrollment row outlives the account."
  */
 export declare const USER_TOTP_COLLECTION = "user_totp";
 /**