@camstack/types 1.2.375 → 1.2.376

package/dist/addon/base-addon.d.ts

@@ -457,18 +457,32 @@ export declare abstract class BaseAddon<TConfig extends object = Record<string,
     /** Re-resolve the config (a keychain-only change, or a retry) and apply it. */
     private scheduleSecretReresolve;
     /**
-     * Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
-     * transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
-     * swap, or any race where the SqliteSettingsBackend is between shutdown and
-     * re-initialize) doesn't propagate up into `initialize()` and leave the
+     * Wrap `ctx.settings.readAddonStore()` with a retry budget so a transient
+     * settings-store outage doesn't propagate up into `initialize()` and leave the
      * addon permanently broken.
      *
-     * Retry only the two known infra fingerprints. Anything else propagates so
-     * real bugs surface immediately. After the budget expires we fall back to
-     * `{}` (defaults) — the addon's first successful patch will rehydrate.
+     * Two kinds of outage, two budgets:
+     *  - the store's own restart fingerprints (`SqliteSettingsBackend not
+     *    initialized`, `provider not available`): a short budget, then the addon
+     *    falls back to `{}` (defaults) - its first successful patch rehydrates;
+     *  - a TRANSPORT failure (the hub is restarting while this runner boots:
+     *    `discovery deadline exceeded`, `parent could not route`, a refused or
+     *    timed-out connection). Since D870 a runner's settings read THROWS instead
+     *    of answering `{}`, so without a budget a hub restart ends in a respawn
+     *    loop. A long, bounded budget; only after it the error propagates - the
+     *    addon never runs on defaults for a store it could not ask.
+     * Anything else propagates immediately so real bugs surface.
      */
     private readAddonStoreWithRetry;
 }
+/**
+ * Is a settings read failure worth retrying, and with which budget? Only
+ * EXPLICIT signals count: a socket error code, a tRPC "unavailable" code, or
+ * one of the exact phrases our own transport raises. A message that merely
+ * contains "timed out" or "unreachable" is not evidence of anything, and
+ * `settings store not wired` is a wiring bug that retrying cannot fix.
+ */
+export declare function classifyStoreError(err: unknown): 'restart' | 'transport' | 'permanent';
 /**
  * Normalize an `ICamstackAddon.initialize()` return value into the
  * `AddonInitResult` envelope. Arrays are wrapped into `{ providers }`;

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-rqlHXgwb.js");
+const require_sleep = require("./sleep-Dq0Uyeh0.js");
 const require_event_category = require("./event-category-T43rdQWR.js");
 const require_err_msg = require("./err-msg-Ls8Q6dHO.js");
 //#region src/generated/cap-input-defaults.ts

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { An as isSecretMarker, Bt as registerKnownSecret, D as collectZodSecretPaths, Dn as classifySecretWrite, En as SECRET_CLEAR, F as viewerUiCapability, Ft as createSecretsAccess, Gt as PEER_BYTES_STALL_MS, Ht as shortSecretRefHash, I as DEVICE_CHILDREN_BATCH_MAX, It as MIN_SCRUBBED_LENGTH, Jt as DATAPLANE_SECRET_HEADER, Kt as PEER_BYTES_TICKET_TTL_MS, Lt as clearKnownSecrets, Mn as makeSecretMarker, Nn as toSecretFieldView, Nt as resolveSecretViewsIn, O as isZodSecret, On as isSecretClear, P as deviceOpsCapability, Pt as REVALIDATE_AFTER_MS, Qt as normalizeAddonInitResult, Rt as forgetKnownSecret, S as createEventBusSliceSource, Ut as PEER_BYTES_CHUNK_BYTES, V as adminUiCapability, Vt as scrubKnownSecrets, Wt as PEER_BYTES_MAX_OUTSTANDING, Xt as DisposerChain, Y as expandCapMethods, Zt as BaseAddon, _ as readErrorI18n, _n as createEvent, at as MODEL_FORMATS, b as isDeviceScopedCap, c as asString, cn as arrayItemFieldPath, d as parseJsonUnknown, dn as globalSecretScope, f as hfModelUrl, fn as isSecretRef, g as ErrorI18nPayloadSchema, j as HF_REPO, jn as isSecretMarkerLike, kn as isSecretFieldView, ln as buildSecretRef, mn as parseSecretRef, nt as nodePin, o as asJsonObject, ot as ReadinessRegistry, p as BOOT_RECOVERY_BACKOFF_MS, pn as normalizeSecretOwner, r as maskUrlCredentials, rt as readNodePin, sn as SECRET_REF_SCHEME, st as ReadinessTimeoutError, t as sleep, un as formatSecretScope, ut as scopeKey, vn as emitReadiness, x as createDeviceProxy, y as DEVICE_SCOPED_CAPS, z as describeCustomActions, zt as knownSecretCount } from "./sleep-DRqxtc0C.mjs";
+import { $t as normalizeAddonInitResult, An as isSecretFieldView, Bt as registerKnownSecret, D as collectZodSecretPaths, Dn as SECRET_CLEAR, F as viewerUiCapability, Ft as createSecretsAccess, Gt as PEER_BYTES_STALL_MS, Ht as shortSecretRefHash, I as DEVICE_CHILDREN_BATCH_MAX, It as MIN_SCRUBBED_LENGTH, Jt as DATAPLANE_SECRET_HEADER, Kt as PEER_BYTES_TICKET_TTL_MS, Lt as clearKnownSecrets, Mn as isSecretMarkerLike, Nn as makeSecretMarker, Nt as resolveSecretViewsIn, O as isZodSecret, On as classifySecretWrite, P as deviceOpsCapability, Pn as toSecretFieldView, Pt as REVALIDATE_AFTER_MS, Rt as forgetKnownSecret, S as createEventBusSliceSource, Ut as PEER_BYTES_CHUNK_BYTES, V as adminUiCapability, Vt as scrubKnownSecrets, Wt as PEER_BYTES_MAX_OUTSTANDING, Xt as DisposerChain, Y as expandCapMethods, Zt as BaseAddon, _ as readErrorI18n, at as MODEL_FORMATS, b as isDeviceScopedCap, c as asString, cn as SECRET_REF_SCHEME, d as parseJsonUnknown, dn as formatSecretScope, f as hfModelUrl, fn as globalSecretScope, g as ErrorI18nPayloadSchema, hn as parseSecretRef, j as HF_REPO, jn as isSecretMarker, kn as isSecretClear, ln as arrayItemFieldPath, mn as normalizeSecretOwner, nt as nodePin, o as asJsonObject, ot as ReadinessRegistry, p as BOOT_RECOVERY_BACKOFF_MS, pn as isSecretRef, r as maskUrlCredentials, rt as readNodePin, st as ReadinessTimeoutError, t as sleep, un as buildSecretRef, ut as scopeKey, vn as createEvent, x as createDeviceProxy, y as DEVICE_SCOPED_CAPS, yn as emitReadiness, z as describeCustomActions, zt as knownSecretCount } from "./sleep-bwsTj221.mjs";
 import { t as EventCategory } from "./event-category-C4hVnRo8.mjs";
 import { a as DeviceType, t as errMsg } from "./err-msg-DLerKiVO.mjs";
 //#region src/generated/cap-input-defaults.ts

package/dist/capabilities/index.d.ts

@@ -45,6 +45,7 @@ export type { CustomModelDescriptor, ICustomModelRegistryProvider, ImportModelBu
 export { CustomModelDescriptorSchema, customModelRegistryCapability, ImportModelBundleInputSchema, ImportModelBundleResultSchema, ModelBundleFileSchema, } from './custom-model-registry.cap.js';
 export { type DataStoreEngineInfo, dataStoreProviderCapability, EngineInfoSchema as DataStoreEngineInfoSchema, type IDataStoreProvider, } from './data-store-provider.cap.js';
 export { type ArchiveSqliteSnapshot, ArchiveSqliteSnapshotSchema, DATABASE_SNAPSHOT_PARTIAL_SUFFIX, DATABASE_SNAPSHOT_SUFFIX, DATABASE_SNAPSHOT_TIMEOUT_MS, type DatabaseSnapshotRequest, DatabaseSnapshotRequestSchema, type DatabaseSnapshotResult, DatabaseSnapshotResultSchema, type DatabaseSnapshotTable, DatabaseSnapshotTableSchema, type DatabaseSnapshotTargets, DatabaseSnapshotTargetsSchema, type DatabaseSnapshotWritten, DatabaseSnapshotWrittenSchema, databaseSnapshotCapability, type IDatabaseSnapshotProvider, } from './database-snapshot.cap.js';
+export { type IStorageAdminProvider, STORAGE_ADMIN_MOVED_COLLECTIONS, STORAGE_ADMIN_SCOPED_BASES, type StorageTable, StorageTableSchema, storageAdminCapability, } from './storage-admin.cap.js';
 export { type IKeychainProvider, KEYCHAIN_MAX_REFS_PER_CALL, type KeychainResolveEntry, KeychainResolveEntrySchema, type KeychainResolveResult, KeychainResolveResultSchema, type KeychainSecretMeta, KeychainSecretMetaSchema, type KeychainState, KeychainStateSchema, type KeychainUnavailableReason, KeychainUnavailableReasonSchema, keychainCapability, } from './keychain.cap.js';
 export { type DeviceHistoryStatus, DeviceHistoryStatusSchema, type DeviceHistoryIngestResult, type DeviceHistoryKind, DeviceHistoryKindSchema, type DeviceHistoryQueryPoint, type DeviceHistoryRefusalReason, DeviceHistoryRefusalReasonSchema, type DeviceHistoryResolution, DeviceHistoryResolutionSchema, type DeviceHistorySeriesInfo, type DeviceHistorySubject, DeviceHistorySubjectSchema, type IDeviceHistoryProvider, deviceHistoryCapability, } from './device-history.cap.js';
 export { type DeviceCaStatus, DeviceCaStatusSchema, type DeviceCertificateSettings, DeviceCertificateSettingsSchema, deviceCredentialsCapability, type IDeviceCredentialsProvider, } from './device-credentials.cap.js';
@@ -290,6 +291,7 @@ import type { coverCapability } from './cover.cap.js';
 import type { customModelRegistryCapability } from './custom-model-registry.cap.js';
 import type { dataStoreProviderCapability } from './data-store-provider.cap.js';
 import type { databaseSnapshotCapability } from './database-snapshot.cap.js';
+import type { storageAdminCapability } from './storage-admin.cap.js';
 import type { deviceHistoryCapability } from './device-history.cap.js';
 import type { keychainCapability } from './keychain.cap.js';
 import type { keychainAdminCapability } from './keychain-admin.cap.js';
@@ -419,6 +421,6 @@ import type { trainingProviderCapability } from './training-provider.cap.js';
 import type { zoneAnalyticsCapability } from './zone-analytics.cap.js';
 import type { zoneRulesCapability } from './zone-rules.cap.js';
 import type { zonesCapability } from './zones.cap.js';
-type AnyCapability = typeof streamSignalsCapability | typeof addonSettingsCapability | typeof alertsCapability | typeof storageCapability | typeof storageMigrationCapability | typeof storageProviderCapability | typeof storageEvictableCapability | typeof storageOccupancyCapability | typeof filesystemBrowseCapability | typeof backupCapability | typeof terminalSessionCapability | typeof settingsStoreCapability | typeof dataStoreProviderCapability | typeof databaseSnapshotCapability | typeof deviceHistoryCapability | typeof keychainCapability | typeof keychainAdminCapability | typeof deviceCredentialsCapability | typeof nodeCertificatesCapability | typeof logChannelsCapability | typeof logDestinationCapability | typeof loadContributionCapability | typeof failureContributionCapability | typeof deviceRemovalHookCapability | typeof adminUiCapability | typeof viewerUiCapability | typeof ssoBridgeCapability | typeof userPasskeysCapability | typeof smtpProviderCapability | typeof mqttBrokerCapability | typeof brokerCapability | typeof deviceAdoptionCapability | typeof deviceAdminLinkCapability | typeof deviceExportCapability | typeof addonPagesCapability | typeof addonPagesSourceCapability | typeof addonWidgetsCapability | typeof addonWidgetsSourceCapability | typeof customModelRegistryCapability | typeof modelDistributorCapability | typeof modelConvertCapability | typeof addonRoutesCapability | typeof streamBrokerCapability | typeof decoderCapability | typeof webrtcSessionCapability | typeof cameraStreamsCapability | typeof calendarSourceCapability | typeof calendarsCapability | typeof motionDetectionCapability | typeof pipelineExecutorCapability | typeof detectionPipelineCapability | typeof cameraPipelineConfigCapability | typeof pipelineRunnerCapability | typeof pipelineOrchestratorCapability | typeof audioAnalyzerCapability | typeof audioAnalysisCapability | typeof audioCodecCapability | typeof embeddingEncoderCapability | typeof vectorStoreCapability | typeof deviceProviderCapability | typeof deviceManagerCapability | typeof deviceStateCapability | typeof authProviderCapability | typeof loginMethodCapability | typeof networkAccessCapability | typeof turnProviderCapability | typeof snapshotCapability | typeof llmCapability | typeof llmRuntimeCapability | typeof notificationOutputCapability | typeof composerCapability | typeof coreBlocksCapability | typeof notificationRulesCapability | typeof pipelineAnalyticsCapability | typeof metricsProviderCapability | typeof ptzCapability | typeof ptzAutotrackCapability | typeof navigationCapability | typeof consumablesCapability | typeof connectionTestCapability | typeof rebootCapability | typeof deviceDiscoveryCapability | typeof brightnessCapability | typeof colorCapability | typeof climateControlCapability | typeof coverCapability | typeof valveCapability | typeof humidifierCapability | typeof waterHeaterCapability | typeof weatherCapability | typeof imageCapability | typeof lockControlCapability | typeof vacuumControlCapability | typeof petFeederCapability | typeof lawnMowerControlCapability | typeof fanControlCapability | typeof controlCapability | typeof notifierCapability | typeof mediaPlayerCapability | typeof alarmPanelCapability | typeof presenceCapability | typeof scriptRunnerCapability | typeof automationControlCapability | typeof motionTriggerCapability | typeof zonesCapability | typeof zoneRulesCapability | typeof trainingCapability | typeof trainingProviderCapability | typeof zoneAnalyticsCapability | typeof audioMetricsCapability | typeof motionCapability | typeof contactCapability | typeof floodCapability | typeof smokeCapability | typeof carbonMonoxideCapability | typeof gasCapability | typeof tamperCapability | typeof vibrationCapability | typeof connectivityCapability | typeof binaryCapability | typeof temperatureSensorCapability | typeof humiditySensorCapability | typeof ambientLightSensorCapability | typeof pressureSensorCapability | typeof powerMeterCapability | typeof airQualitySensorCapability | typeof numericSensorCapability | typeof enumSensorCapability | typeof recordingCapability | typeof recordingArchiveCapability | typeof recordingExportCapability | typeof recordingSignalCapability | typeof deviceOpsCapability | typeof platformProbeCapability | typeof localNetworkCapability | typeof meshNetworkCapability | typeof userManagementCapability | typeof systemCapability | typeof networkQualityCapability | typeof toastCapability | typeof nodesCapability | typeof serverManagementCapability | typeof integrationsCapability | typeof addonsCapability | typeof oauthIntegrationCapability | typeof oidcConnectionsCapability | typeof streamParamsCapability | typeof streamCatalogCapability | typeof motionZonesCapability | typeof cameraGridLayoutCapability | typeof sceneMonitorCapability | typeof privacyMaskCapability | typeof dayNightCapability | typeof recordingOnboardCapability | typeof imageSettingsCapability | typeof osdCapability | typeof osdManagerCapability | typeof accessoriesCapability | typeof batteryCapability | typeof networkLinkCapability | typeof buttonCapability | typeof cameraCredentialsCapability | typeof deviceStatusCapability | typeof doorbellCapability | typeof eventEmitterCapability | typeof faceGalleryCapability | typeof featureProbeCapability | typeof intercomCapability | typeof nativeObjectDetectionCapability | typeof plateGalleryCapability | typeof switchCapability | typeof updateCapability | typeof videoclipsCapability | typeof deviceExtensionCapability;
+type AnyCapability = typeof streamSignalsCapability | typeof addonSettingsCapability | typeof alertsCapability | typeof storageCapability | typeof storageMigrationCapability | typeof storageProviderCapability | typeof storageEvictableCapability | typeof storageOccupancyCapability | typeof filesystemBrowseCapability | typeof backupCapability | typeof terminalSessionCapability | typeof settingsStoreCapability | typeof dataStoreProviderCapability | typeof databaseSnapshotCapability | typeof storageAdminCapability | typeof deviceHistoryCapability | typeof keychainCapability | typeof keychainAdminCapability | typeof deviceCredentialsCapability | typeof nodeCertificatesCapability | typeof logChannelsCapability | typeof logDestinationCapability | typeof loadContributionCapability | typeof failureContributionCapability | typeof deviceRemovalHookCapability | typeof adminUiCapability | typeof viewerUiCapability | typeof ssoBridgeCapability | typeof userPasskeysCapability | typeof smtpProviderCapability | typeof mqttBrokerCapability | typeof brokerCapability | typeof deviceAdoptionCapability | typeof deviceAdminLinkCapability | typeof deviceExportCapability | typeof addonPagesCapability | typeof addonPagesSourceCapability | typeof addonWidgetsCapability | typeof addonWidgetsSourceCapability | typeof customModelRegistryCapability | typeof modelDistributorCapability | typeof modelConvertCapability | typeof addonRoutesCapability | typeof streamBrokerCapability | typeof decoderCapability | typeof webrtcSessionCapability | typeof cameraStreamsCapability | typeof calendarSourceCapability | typeof calendarsCapability | typeof motionDetectionCapability | typeof pipelineExecutorCapability | typeof detectionPipelineCapability | typeof cameraPipelineConfigCapability | typeof pipelineRunnerCapability | typeof pipelineOrchestratorCapability | typeof audioAnalyzerCapability | typeof audioAnalysisCapability | typeof audioCodecCapability | typeof embeddingEncoderCapability | typeof vectorStoreCapability | typeof deviceProviderCapability | typeof deviceManagerCapability | typeof deviceStateCapability | typeof authProviderCapability | typeof loginMethodCapability | typeof networkAccessCapability | typeof turnProviderCapability | typeof snapshotCapability | typeof llmCapability | typeof llmRuntimeCapability | typeof notificationOutputCapability | typeof composerCapability | typeof coreBlocksCapability | typeof notificationRulesCapability | typeof pipelineAnalyticsCapability | typeof metricsProviderCapability | typeof ptzCapability | typeof ptzAutotrackCapability | typeof navigationCapability | typeof consumablesCapability | typeof connectionTestCapability | typeof rebootCapability | typeof deviceDiscoveryCapability | typeof brightnessCapability | typeof colorCapability | typeof climateControlCapability | typeof coverCapability | typeof valveCapability | typeof humidifierCapability | typeof waterHeaterCapability | typeof weatherCapability | typeof imageCapability | typeof lockControlCapability | typeof vacuumControlCapability | typeof petFeederCapability | typeof lawnMowerControlCapability | typeof fanControlCapability | typeof controlCapability | typeof notifierCapability | typeof mediaPlayerCapability | typeof alarmPanelCapability | typeof presenceCapability | typeof scriptRunnerCapability | typeof automationControlCapability | typeof motionTriggerCapability | typeof zonesCapability | typeof zoneRulesCapability | typeof trainingCapability | typeof trainingProviderCapability | typeof zoneAnalyticsCapability | typeof audioMetricsCapability | typeof motionCapability | typeof contactCapability | typeof floodCapability | typeof smokeCapability | typeof carbonMonoxideCapability | typeof gasCapability | typeof tamperCapability | typeof vibrationCapability | typeof connectivityCapability | typeof binaryCapability | typeof temperatureSensorCapability | typeof humiditySensorCapability | typeof ambientLightSensorCapability | typeof pressureSensorCapability | typeof powerMeterCapability | typeof airQualitySensorCapability | typeof numericSensorCapability | typeof enumSensorCapability | typeof recordingCapability | typeof recordingArchiveCapability | typeof recordingExportCapability | typeof recordingSignalCapability | typeof deviceOpsCapability | typeof platformProbeCapability | typeof localNetworkCapability | typeof meshNetworkCapability | typeof userManagementCapability | typeof systemCapability | typeof networkQualityCapability | typeof toastCapability | typeof nodesCapability | typeof serverManagementCapability | typeof integrationsCapability | typeof addonsCapability | typeof oauthIntegrationCapability | typeof oidcConnectionsCapability | typeof streamParamsCapability | typeof streamCatalogCapability | typeof motionZonesCapability | typeof cameraGridLayoutCapability | typeof sceneMonitorCapability | typeof privacyMaskCapability | typeof dayNightCapability | typeof recordingOnboardCapability | typeof imageSettingsCapability | typeof osdCapability | typeof osdManagerCapability | typeof accessoriesCapability | typeof batteryCapability | typeof networkLinkCapability | typeof buttonCapability | typeof cameraCredentialsCapability | typeof deviceStatusCapability | typeof doorbellCapability | typeof eventEmitterCapability | typeof faceGalleryCapability | typeof featureProbeCapability | typeof intercomCapability | typeof nativeObjectDetectionCapability | typeof plateGalleryCapability | typeof switchCapability | typeof updateCapability | typeof videoclipsCapability | typeof deviceExtensionCapability;
 export type CapabilityName = AnyCapability['name'];
 export type ITypedReadinessRegistry = IReadinessRegistry<CapabilityName>;

package/dist/capabilities/keychain-admin.cap.d.ts

@@ -305,6 +305,22 @@ export declare const keychainAdminCapability: {
         }, z.core.$strip>, "mutation"> & {
             readonly caller: 'required';
         };
+        /**
+         * Store a value an operator tool carries over from a retired store at an
+         * addon's own ref (`secret://<owner>/<scope>/<path>`) and answer the ref -
+         * the D870 migration moves a camera's restream tokens this way, so they
+         * never sit in a settings row as plaintext. Audited as the operator; the
+         * caller then writes the MARKER of the ref where the value used to be.
+         */
+        readonly importSecret: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            ref: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            ref: z.ZodString;
+            version: z.ZodNumber;
+        }, z.core.$strip>, "mutation"> & {
+            readonly caller: 'required';
+        };
         /** Delete refs no owner points at any more. Re-checked here; `unknown` is kept. */
         readonly deleteOrphans: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             refs: z.ZodArray<z.ZodString>;

package/dist/capabilities/storage-admin.cap.d.ts

@@ -0,0 +1,76 @@
+import { z } from 'zod';
+import { type InferProvider } from './capability-definition.js';
+/** One table of the settings database. */
+export declare const StorageTableSchema: z.ZodObject<{
+    name: z.ZodString;
+    owner: z.ZodNullable<z.ZodString>;
+    rows: z.ZodNumber;
+    bytes: z.ZodNullable<z.ZodNumber>;
+    declaredThisBoot: z.ZodBoolean;
+}, z.core.$strip>;
+export type StorageTable = z.infer<typeof StorageTableSchema>;
+/**
+ * The collections retired by exact name: the D870 ones (their data became keys
+ * of the camera's settings) and the three D871 leftovers (the `stats-5m` tables
+ * superseded by `stats-5m-v2`, and the unread `vec_object_clip`). No addon
+ * declares any of them any more; the engine still refuses one a running addon
+ * declared this boot. `dropCollection` may remove these, the
+ * per-addon scoped `addon-settings` / `addon-devices` / `sections` tables, and
+ * the tables of owners that are no longer installed - nothing else.
+ */
+export declare const STORAGE_ADMIN_MOVED_COLLECTIONS: readonly string[];
+/** The per-addon blob tables a scoped name may carry. */
+export declare const STORAGE_ADMIN_SCOPED_BASES: readonly string[];
+/**
+ * storage-admin - the operator's maintenance reach into the settings database:
+ * list its tables, drop one that nothing owns any more (D870).
+ *
+ * Hub-only, internal and `auth: 'admin'` explicitly (`internal` does not gate
+ * the mount, see `data-store-provider`). Both methods are LOGGED by the engine
+ * with the table and the counts. `dropCollection` is a ONE-SHOT of the D870
+ * migration and is marked for removal once the last hub has run it.
+ *
+ * `listTables` is READ-ONLY: it never creates a table, which `count` and `get`
+ * on an undeclared scoped name used to do.
+ */
+export declare const storageAdminCapability: {
+    readonly name: 'storage-admin';
+    readonly scope: 'system';
+    readonly mode: 'singleton';
+    readonly internal: true;
+    readonly methods: {
+        /**
+         * Every table of the settings database with its row count and size,
+         * optionally only those owned by `ownerPrefix`. Reads only.
+         */
+        readonly listTables: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            ownerPrefix: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>, z.ZodObject<{
+            tables: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                owner: z.ZodNullable<z.ZodString>;
+                rows: z.ZodNumber;
+                bytes: z.ZodNullable<z.ZodNumber>;
+                declaredThisBoot: z.ZodBoolean;
+            }, z.core.$strip>>;
+        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
+        /**
+         * Drop one table. REFUSES when an addon declared it since the engine
+         * started (a running addon still owns it), when it is an engine or
+         * canonical table, when it does not exist, or when its row count is not
+         * `expectRows` - the caller states what it believes it is deleting. The
+         * engine also refuses anything but `<owner>:(addon-settings|addon-devices|
+         * sections)`, the retired collections by name, and tables of owners that
+         * are not installed (and refuses when it cannot read the installed list).
+         * Removed with the D870 migration script once the last hub ran it.
+         */
+        readonly dropCollection: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            collection: z.ZodString;
+            expectRows: z.ZodNumber;
+        }, z.core.$strip>, z.ZodObject<{
+            dropped: z.ZodLiteral<true>;
+            rows: z.ZodNumber;
+        }, z.core.$strip>, "mutation">;
+    };
+};
+export type IStorageAdminProvider = InferProvider<typeof storageAdminCapability>;

package/dist/client.js

@@ -27796,6 +27796,7 @@ function createSystemProxy(api) {
 			listAudit: (input) => dispatch("keychainAdmin", "listAudit", "query", input),
 			reveal: (input) => dispatch("keychainAdmin", "reveal", "mutation", input),
 			setSystemSecret: (input) => dispatch("keychainAdmin", "setSystemSecret", "mutation", input),
+			importSecret: (input) => dispatch("keychainAdmin", "importSecret", "mutation", input),
 			deleteOrphans: (input) => dispatch("keychainAdmin", "deleteOrphans", "mutation", input),
 			rotateMasterKey: (input) => dispatch("keychainAdmin", "rotateMasterKey", "mutation", input),
 			purgeRetiredKeys: (input) => dispatch("keychainAdmin", "purgeRetiredKeys", "mutation", input),

package/dist/client.mjs

@@ -27795,6 +27795,7 @@ function createSystemProxy(api) {
 			listAudit: (input) => dispatch("keychainAdmin", "listAudit", "query", input),
 			reveal: (input) => dispatch("keychainAdmin", "reveal", "mutation", input),
 			setSystemSecret: (input) => dispatch("keychainAdmin", "setSystemSecret", "mutation", input),
+			importSecret: (input) => dispatch("keychainAdmin", "importSecret", "mutation", input),
 			deleteOrphans: (input) => dispatch("keychainAdmin", "deleteOrphans", "mutation", input),
 			rotateMasterKey: (input) => dispatch("keychainAdmin", "rotateMasterKey", "mutation", input),
 			purgeRetiredKeys: (input) => dispatch("keychainAdmin", "purgeRetiredKeys", "mutation", input),

package/dist/generated/addon-api.d.ts

@@ -117,6 +117,7 @@ import type { settingsStoreCapability } from '../capabilities/settings-store.cap
 import type { smtpProviderCapability } from '../capabilities/smtp-provider.cap.js';
 import type { snapshotCapability } from '../capabilities/snapshot.cap.js';
 import type { ssoBridgeCapability } from '../capabilities/sso-bridge.cap.js';
+import type { storageAdminCapability } from '../capabilities/storage-admin.cap.js';
 import type { storageEvictableCapability } from '../capabilities/storage-evictable.cap.js';
 import type { storageMigrationCapability } from '../capabilities/storage-migration.cap.js';
 import type { storageOccupancyCapability } from '../capabilities/storage-occupancy.cap.js';
@@ -3986,6 +3987,13 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof keychainAdminCapability.methods.setSystemSecret.output>;
             meta: object;
         }>;
+        importSecret: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof keychainAdminCapability.methods.importSecret.input>;
+            output: z.infer<typeof keychainAdminCapability.methods.importSecret.output>;
+            meta: object;
+        }>;
         deleteOrphans: TRPCMutationProcedure<{
             input: {
                 [x: string]: unknown;
@@ -8812,6 +8820,27 @@ export type AppRouter = TrpcCoreRouter<{
             meta: object;
         }>;
     }>>;
+    storageAdmin: TRPCBuiltRouter<{
+        ctx: TrpcContext;
+        meta: object;
+        errorShape: AugmentedErrorShape;
+        transformer: true;
+    }, TRPCDecorateCreateRouterOptions<{
+        listTables: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof storageAdminCapability.methods.listTables.input>;
+            output: z.infer<typeof storageAdminCapability.methods.listTables.output>;
+            meta: object;
+        }>;
+        dropCollection: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof storageAdminCapability.methods.dropCollection.input>;
+            output: z.infer<typeof storageAdminCapability.methods.dropCollection.output>;
+            meta: object;
+        }>;
+    }>>;
     storageEvictable: TRPCBuiltRouter<{
         ctx: TrpcContext;
         meta: object;

package/dist/generated/capability-router-map.d.ts

@@ -140,6 +140,7 @@ export { smtpProviderCapability } from '../capabilities/smtp-provider.cap.js';
 export { snapshotCapability } from '../capabilities/snapshot.cap.js';
 export { ssoBridgeCapability } from '../capabilities/sso-bridge.cap.js';
 export { storageCapability } from '../capabilities/storage.cap.js';
+export { storageAdminCapability } from '../capabilities/storage-admin.cap.js';
 export { storageEvictableCapability } from '../capabilities/storage-evictable.cap.js';
 export { storageMigrationCapability } from '../capabilities/storage-migration.cap.js';
 export { storageOccupancyCapability } from '../capabilities/storage-occupancy.cap.js';
@@ -315,6 +316,7 @@ export declare const CAPABILITY_NAMES: {
     readonly snapshot: 'snapshot';
     readonly ssoBridge: 'sso-bridge';
     readonly storage: 'storage';
+    readonly storageAdmin: 'storage-admin';
     readonly storageEvictable: 'storage-evictable';
     readonly storageMigration: 'storage-migration';
     readonly storageOccupancy: 'storage-occupancy';
@@ -503,6 +505,7 @@ export interface CapabilityRouterMap<TRouter = unknown> {
     readonly snapshot: TRouter;
     readonly ssoBridge: TRouter;
     readonly storage: TRouter;
+    readonly storageAdmin: TRouter;
     readonly storageEvictable: TRouter;
     readonly storageMigration: TRouter;
     readonly storageOccupancy: TRouter;
@@ -536,8 +539,8 @@ export interface CapabilityRouterMap<TRouter = unknown> {
     readonly zoneRules: TRouter;
     readonly zones: TRouter;
 }
-/** Capability names whose mode is `singleton` (140 caps). */
-export declare const SINGLETON_CAPABILITY_NAMES: readonly ['accessories', 'addon-pages', 'addon-settings', 'addon-widgets', 'addons', 'admin-ui', 'air-quality-sensor', 'alarm-panel', 'alerts', 'ambient-light-sensor', 'audio-analysis', 'audio-analyzer', 'audio-codec', 'audio-metrics', 'automation-control', 'backup', 'battery', 'binary', 'brightness', 'button', 'calendars', 'camera-credentials', 'camera-grid-layout', 'camera-pipeline-config', 'camera-streams', 'carbon-monoxide', 'climate-control', 'color', 'composer', 'connectivity', 'consumables', 'contact', 'control', 'core-blocks', 'cover', 'database-snapshot', 'day-night', 'decoder', 'detection-pipeline', 'device-admin-link', 'device-adoption', 'device-credentials', 'device-discovery', 'device-history', 'device-manager', 'device-ops', 'device-state', 'device-status', 'doorbell', 'enum-sensor', 'event-emitter', 'face-gallery', 'fan-control', 'feature-probe', 'filesystem-browse', 'flood', 'gas', 'humidifier', 'humidity-sensor', 'image', 'image-settings', 'integrations', 'intercom', 'keychain', 'keychain-admin', 'lawn-mower-control', 'llm-runtime', 'local-network', 'lock-control', 'media-player', 'metrics-provider', 'model-convert', 'model-distributor', 'motion', 'motion-detection', 'motion-trigger', 'motion-zones', 'native-object-detection', 'navigation', 'network-link', 'network-quality', 'node-certificates', 'nodes', 'notification-rules', 'notifier', 'numeric-sensor', 'oidc-connections', 'osd', 'osd-manager', 'pet-feeder', 'pipeline-analytics', 'pipeline-executor', 'pipeline-orchestrator', 'pipeline-runner', 'plate-gallery', 'platform-probe', 'power-meter', 'presence', 'pressure-sensor', 'privacy-mask', 'ptz', 'ptz-autotrack', 'reboot', 'recording-archive', 'recording-export', 'recording-onboard', 'recording-signal', 'scene-monitor', 'script-runner', 'server-management', 'settings-store', 'smoke', 'snapshot', 'sso-bridge', 'storage', 'storage-migration', 'stream-broker', 'stream-catalog', 'stream-params', 'stream-signals', 'switch', 'system', 'tamper', 'temperature-sensor', 'terminal-session', 'toast', 'training', 'update', 'user-management', 'vacuum-control', 'valve', 'vector-store', 'vibration', 'viewer-ui', 'water-heater', 'weather', 'webrtc-session', 'zone-analytics', 'zone-rules', 'zones'];
+/** Capability names whose mode is `singleton` (141 caps). */
+export declare const SINGLETON_CAPABILITY_NAMES: readonly ['accessories', 'addon-pages', 'addon-settings', 'addon-widgets', 'addons', 'admin-ui', 'air-quality-sensor', 'alarm-panel', 'alerts', 'ambient-light-sensor', 'audio-analysis', 'audio-analyzer', 'audio-codec', 'audio-metrics', 'automation-control', 'backup', 'battery', 'binary', 'brightness', 'button', 'calendars', 'camera-credentials', 'camera-grid-layout', 'camera-pipeline-config', 'camera-streams', 'carbon-monoxide', 'climate-control', 'color', 'composer', 'connectivity', 'consumables', 'contact', 'control', 'core-blocks', 'cover', 'database-snapshot', 'day-night', 'decoder', 'detection-pipeline', 'device-admin-link', 'device-adoption', 'device-credentials', 'device-discovery', 'device-history', 'device-manager', 'device-ops', 'device-state', 'device-status', 'doorbell', 'enum-sensor', 'event-emitter', 'face-gallery', 'fan-control', 'feature-probe', 'filesystem-browse', 'flood', 'gas', 'humidifier', 'humidity-sensor', 'image', 'image-settings', 'integrations', 'intercom', 'keychain', 'keychain-admin', 'lawn-mower-control', 'llm-runtime', 'local-network', 'lock-control', 'media-player', 'metrics-provider', 'model-convert', 'model-distributor', 'motion', 'motion-detection', 'motion-trigger', 'motion-zones', 'native-object-detection', 'navigation', 'network-link', 'network-quality', 'node-certificates', 'nodes', 'notification-rules', 'notifier', 'numeric-sensor', 'oidc-connections', 'osd', 'osd-manager', 'pet-feeder', 'pipeline-analytics', 'pipeline-executor', 'pipeline-orchestrator', 'pipeline-runner', 'plate-gallery', 'platform-probe', 'power-meter', 'presence', 'pressure-sensor', 'privacy-mask', 'ptz', 'ptz-autotrack', 'reboot', 'recording-archive', 'recording-export', 'recording-onboard', 'recording-signal', 'scene-monitor', 'script-runner', 'server-management', 'settings-store', 'smoke', 'snapshot', 'sso-bridge', 'storage', 'storage-admin', 'storage-migration', 'stream-broker', 'stream-catalog', 'stream-params', 'stream-signals', 'switch', 'system', 'tamper', 'temperature-sensor', 'terminal-session', 'toast', 'training', 'update', 'user-management', 'vacuum-control', 'valve', 'vector-store', 'vibration', 'viewer-ui', 'water-heater', 'weather', 'webrtc-session', 'zone-analytics', 'zone-rules', 'zones'];
 /** Union of singleton capability names (literal string union). */
 export type SingletonCapabilityName = typeof SINGLETON_CAPABILITY_NAMES[number];
 /** Capability names whose mode is `collection` (34 caps). */

package/dist/generated/method-access-map.d.ts

@@ -6,7 +6,7 @@
  * scope+access check inside `protectedProcedure` (see
  * `server/backend/src/api/trpc/trpc.middleware.ts`).
  *
- * Coverage: 1338 method paths across 174 capabilities.
+ * Coverage: 1341 method paths across 175 capabilities.
  */
 import type { CapabilityMethodAccess } from '../capabilities/capability-definition.js';
 export interface MethodAccessRecord {

package/dist/generated/system-proxy.d.ts

@@ -83,7 +83,7 @@ export interface SystemProxy {
     readonly deviceState: Pick<InferProvider<typeof deviceStateCapability>, 'getAllSnapshots' | 'listClaims'>;
     readonly faceGallery: Pick<InferProvider<typeof faceGalleryCapability>, 'listIdentities' | 'createIdentity' | 'renameIdentity' | 'deleteIdentity' | 'listIdentitySamples' | 'auditIdentitySamples' | 'removeSample' | 'getFaceMedia' | 'assignFace' | 'unassignFace' | 'deleteFace' | 'assignFaces' | 'unassignFaces' | 'suggestFaceClusters'>;
     readonly integrations: Pick<InferProvider<typeof integrationsCapability>, 'list' | 'get' | 'getByAddonId' | 'create' | 'update' | 'delete' | 'getSettings' | 'setSettings' | 'getAvailableTypes' | 'testConnection'>;
-    readonly keychainAdmin: Pick<InferProvider<typeof keychainAdminCapability>, 'status' | 'listSecrets' | 'listAudit' | 'reveal' | 'setSystemSecret' | 'deleteOrphans' | 'rotateMasterKey' | 'purgeRetiredKeys' | 'downloadRecoveryKey' | 'resetKeychain' | 'resetReport' | 'acknowledgeReset'>;
+    readonly keychainAdmin: Pick<InferProvider<typeof keychainAdminCapability>, 'status' | 'listSecrets' | 'listAudit' | 'reveal' | 'setSystemSecret' | 'importSecret' | 'deleteOrphans' | 'rotateMasterKey' | 'purgeRetiredKeys' | 'downloadRecoveryKey' | 'resetKeychain' | 'resetReport' | 'acknowledgeReset'>;
     readonly llm: Pick<InferProvider<typeof llmCapability>, 'generate' | 'generateVision' | 'cancel' | 'listProfileKinds' | 'listProfiles' | 'upsertProfile' | 'deleteProfile' | 'testProfile' | 'listModels' | 'getDefaults' | 'setDefault' | 'getUsage' | 'listModelCatalog' | 'listRuntimeNodes' | 'listNodeModels' | 'resolveModelRef' | 'installModel' | 'deleteModel' | 'getRuntimeStatus' | 'startRuntime' | 'stopRuntime'>;
     readonly localNetwork: Pick<InferProvider<typeof localNetworkCapability>, 'list' | 'getPreferred' | 'getConnectionEndpoints' | 'getNotificationEndpoint' | 'setNotificationEndpoint' | 'getViewerEndpoints' | 'setViewerEndpoints' | 'getAddresses' | 'addCustomAddress' | 'removeCustomAddress' | 'setAddressRole' | 'getHubAddresses' | 'getAllowedAddresses' | 'setAllowedAddresses' | 'resetAllowlistToBestMatch' | 'getTlsStatus' | 'regenerateCertificate' | 'uploadCertificate' | 'downloadCa' | 'useStoredUploadedCertificate' | 'revertToGeneratedCertificate'>;
     readonly meshNetwork: Pick<InferProvider<typeof meshNetworkCapability>, 'getStatus' | 'join' | 'startLogin' | 'leave' | 'logout' | 'listPeers' | 'testConnection'>;

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export * from './audio/audio-chunk-format.js';
 export type { EventOwnerType, MediaOwnerKey, MediaOwnerKeyInput, MediaOwnerType, MediaPresenceOwnerKind, } from './media/media-owner-key.js';
 export { EVENT_OWNER_TYPES, EventOwnerTypeSchema, MEDIA_OWNER_TYPES, MEDIA_PRESENCE_OWNER_KINDS, MediaPresenceOwnerKindSchema, formatMediaOwnerKey, isEventOwnerType, isMediaOwnerType, parseMediaOwnerKey, } from './media/media-owner-key.js';
 export type { CapabilitiesAccess } from './addon/base-addon.js';
-export { BaseAddon, normalizeAddonInitResult } from './addon/base-addon.js';
+export { BaseAddon, classifyStoreError, normalizeAddonInitResult } from './addon/base-addon.js';
 export { normalizeNodeId } from './addon/per-node-store.js';
 export type { AddonRouteInvokeRequest, AddonRouteReplyEnvelope, } from './addon/build-addon-route-provider.js';
 export { buildAddonRouteProvider } from './addon/build-addon-route-provider.js';

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-rqlHXgwb.js");
+const require_sleep = require("./sleep-Dq0Uyeh0.js");
 const require_event_category = require("./event-category-T43rdQWR.js");
 const require_composition = require("./composition-DIp0uE_b.js");
 const require_node_color = require("./node-color.js");
@@ -13900,6 +13900,91 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 	}
 };
 //#endregion
+//#region src/capabilities/storage-admin.cap.ts
+/** One table of the settings database. */
+var StorageTableSchema = zod.z.object({
+	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
+	name: zod.z.string(),
+	/** The owner prefix of a scoped name (`recorder` for `recorder:addon-settings`), else null. */
+	owner: zod.z.string().nullable(),
+	rows: zod.z.number().int().nonnegative(),
+	/** Bytes the table's pages occupy (`dbstat`); null when the engine cannot measure. */
+	bytes: zod.z.number().int().nonnegative().nullable(),
+	/** Declared by an addon since this engine process started (a running addon claims it). */
+	declaredThisBoot: zod.z.boolean()
+});
+/**
+* The collections retired by exact name: the D870 ones (their data became keys
+* of the camera's settings) and the three D871 leftovers (the `stats-5m` tables
+* superseded by `stats-5m-v2`, and the unread `vec_object_clip`). No addon
+* declares any of them any more; the engine still refuses one a running addon
+* declared this boot. `dropCollection` may remove these, the
+* per-addon scoped `addon-settings` / `addon-devices` / `sections` tables, and
+* the tables of owners that are no longer installed - nothing else.
+*/
+var STORAGE_ADMIN_MOVED_COLLECTIONS = [
+	"stream-broker:probe-snapshots",
+	"stream-broker:profile-map",
+	"stream-broker:rtsp-tokens",
+	"notification-center:device-mutes",
+	"recorder:recording-configs",
+	"pipeline-orchestrator:device-features",
+	"pipeline-analytics:stats-5m",
+	"pipeline-orchestrator:stats-5m",
+	"vec_object_clip"
+];
+/** The per-addon blob tables a scoped name may carry. */
+var STORAGE_ADMIN_SCOPED_BASES = [
+	"addon-settings",
+	"addon-devices",
+	"sections"
+];
+/**
+* storage-admin - the operator's maintenance reach into the settings database:
+* list its tables, drop one that nothing owns any more (D870).
+*
+* Hub-only, internal and `auth: 'admin'` explicitly (`internal` does not gate
+* the mount, see `data-store-provider`). Both methods are LOGGED by the engine
+* with the table and the counts. `dropCollection` is a ONE-SHOT of the D870
+* migration and is marked for removal once the last hub has run it.
+*
+* `listTables` is READ-ONLY: it never creates a table, which `count` and `get`
+* on an undeclared scoped name used to do.
+*/
+var storageAdminCapability = {
+	name: "storage-admin",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/**
+		* Every table of the settings database with its row count and size,
+		* optionally only those owned by `ownerPrefix`. Reads only.
+		*/
+		listTables: require_sleep.method(zod.z.object({ ownerPrefix: zod.z.string().min(1).optional() }), zod.z.object({ tables: zod.z.array(StorageTableSchema) }), { auth: "admin" }),
+		/**
+		* Drop one table. REFUSES when an addon declared it since the engine
+		* started (a running addon still owns it), when it is an engine or
+		* canonical table, when it does not exist, or when its row count is not
+		* `expectRows` - the caller states what it believes it is deleting. The
+		* engine also refuses anything but `<owner>:(addon-settings|addon-devices|
+		* sections)`, the retired collections by name, and tables of owners that
+		* are not installed (and refuses when it cannot read the installed list).
+		* Removed with the D870 migration script once the last hub ran it.
+		*/
+		dropCollection: require_sleep.method(zod.z.object({
+			collection: zod.z.string().min(1),
+			expectRows: zod.z.number().int().nonnegative()
+		}), zod.z.object({
+			dropped: zod.z.literal(true),
+			rows: zod.z.number().int().nonnegative()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+//#endregion
 //#region src/capabilities/keychain.cap.ts
 /**
 * `keychain` — the hub's encrypted store of secret values (D787).
@@ -14647,6 +14732,24 @@ var keychainAdminCapability = {
 			auth: "admin",
 			caller: "required"
 		}),
+		/**
+		* Store a value an operator tool carries over from a retired store at an
+		* addon's own ref (`secret://<owner>/<scope>/<path>`) and answer the ref -
+		* the D870 migration moves a camera's restream tokens this way, so they
+		* never sit in a settings row as plaintext. Audited as the operator; the
+		* caller then writes the MARKER of the ref where the value used to be.
+		*/
+		importSecret: require_sleep.method(zod.z.object({
+			ref: zod.z.string().min(1),
+			value: zod.z.string().min(1)
+		}), zod.z.object({
+			ref: zod.z.string(),
+			version: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
 		/** Delete refs no owner points at any more. Re-checked here; `unknown` is kept. */
 		deleteOrphans: require_sleep.method(zod.z.object({ refs: zod.z.array(zod.z.string().min(1)).max(1e3) }), zod.z.object({
 			deleted: zod.z.array(zod.z.string()).readonly(),
@@ -79399,6 +79502,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychainAdmin.importSecret": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.listAudit": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -83185,6 +83294,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageAdmin.dropCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"storageAdmin.listTables": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -84740,6 +84861,7 @@ var KNOWN_CAP_NAMES = [
 	"snapshot",
 	"sso-bridge",
 	"storage",
+	"storage-admin",
 	"storage-evictable",
 	"storage-migration",
 	"storage-occupancy",
@@ -84937,6 +85059,7 @@ var SYSTEM_CAP_NAMES = [
 	"smtp-provider",
 	"sso-bridge",
 	"storage",
+	"storage-admin",
 	"storage-evictable",
 	"storage-migration",
 	"storage-occupancy",
@@ -87012,6 +87135,7 @@ var CAPABILITY_NAMES = {
 	snapshot: "snapshot",
 	ssoBridge: "sso-bridge",
 	storage: "storage",
+	storageAdmin: "storage-admin",
 	storageEvictable: "storage-evictable",
 	storageMigration: "storage-migration",
 	storageOccupancy: "storage-occupancy",
@@ -87615,6 +87739,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "storage",
 		name: "storage"
 	},
+	{
+		key: "storageAdmin",
+		name: "storage-admin"
+	},
 	{
 		key: "storageEvictable",
 		name: "storage-evictable"
@@ -87896,6 +88024,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	snapshotCapability,
 	ssoBridgeCapability,
 	storageCapability,
+	storageAdminCapability,
 	storageEvictableCapability,
 	storageMigrationCapability,
 	storageOccupancyCapability,
@@ -91954,6 +92083,7 @@ function createSystemProxy(api) {
 			listAudit: (input) => dispatch("keychainAdmin", "listAudit", "query", input),
 			reveal: (input) => dispatch("keychainAdmin", "reveal", "mutation", input),
 			setSystemSecret: (input) => dispatch("keychainAdmin", "setSystemSecret", "mutation", input),
+			importSecret: (input) => dispatch("keychainAdmin", "importSecret", "mutation", input),
 			deleteOrphans: (input) => dispatch("keychainAdmin", "deleteOrphans", "mutation", input),
 			rotateMasterKey: (input) => dispatch("keychainAdmin", "rotateMasterKey", "mutation", input),
 			purgeRetiredKeys: (input) => dispatch("keychainAdmin", "purgeRetiredKeys", "mutation", input),
@@ -102590,6 +102720,8 @@ exports.STATE_LABELS = STATE_LABELS;
 exports.STATE_LABEL_KEYS = STATE_LABEL_KEYS;
 exports.STATIONARY_OVERLAY_STYLE = STATIONARY_OVERLAY_STYLE;
 exports.STORAGE_ACCESS_FALLBACK = STORAGE_ACCESS_FALLBACK;
+exports.STORAGE_ADMIN_MOVED_COLLECTIONS = STORAGE_ADMIN_MOVED_COLLECTIONS;
+exports.STORAGE_ADMIN_SCOPED_BASES = STORAGE_ADMIN_SCOPED_BASES;
 exports.STORAGE_BYTES_PER_GB = STORAGE_BYTES_PER_GB;
 exports.STORAGE_LOCATION_MODES = STORAGE_LOCATION_MODES;
 exports.STREAM_PROFILE_META = STREAM_PROFILE_META;
@@ -102697,6 +102829,7 @@ exports.StorageMigrationSourcesSchema = StorageMigrationSourcesSchema;
 exports.StorageOccupancyReportSchema = StorageOccupancyReportSchema;
 exports.StorageProviderInfoSchema = ProviderInfoSchema;
 exports.StorageReadChunkInputSchema = ReadChunkInputSchema;
+exports.StorageTableSchema = StorageTableSchema;
 exports.StorageTestLocationResultSchema = TestLocationResultSchema;
 exports.StorageWriteChunkInputSchema = WriteChunkInputSchema;
 exports.StreamCodecSchema = StreamCodecSchema;
@@ -102999,6 +103132,7 @@ exports.classifyCamerasForBenchmark = classifyCamerasForBenchmark;
 exports.classifyInferenceHardware = classifyInferenceHardware;
 exports.classifyRetrainReview = classifyRetrainReview;
 exports.classifySecretWrite = require_sleep.classifySecretWrite;
+exports.classifyStoreError = require_sleep.classifyStoreError;
 exports.classifyStream = classifyStream;
 exports.classifyStreams = classifyStreams;
 exports.clearKnownSecrets = require_sleep.clearKnownSecrets;
@@ -103624,6 +103758,7 @@ exports.stateLabel = stateLabel;
 exports.stateVocabularyFor = stateVocabularyFor;
 exports.stepModelRunsOnFormat = stepModelRunsOnFormat;
 exports.stepSettingSource = stepSettingSource;
+exports.storageAdminCapability = storageAdminCapability;
 exports.storageCapability = storageCapability;
 exports.storageEvictableCapability = storageEvictableCapability;
 exports.storageMigrationCapability = storageMigrationCapability;