@camstack/types 1.2.378 → 1.2.380

package/dist/{sleep-bgZLodYc.mjs → sleep-WsrozGDL.mjs}

@@ -162,7 +162,7 @@ function collectKeychainStoredKeys(schema) {
 	return keys;
 }
 function walkKeychainField(field, out) {
-	if (!isRecord$3(field)) return;
+	if (!isRecord$5(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	const isSecret = type === "password" || field["secret"] === true;
@@ -187,21 +187,21 @@ function schemaDeclaresAnyField(schema) {
 	for (const section of sectionsOf(schema)) if (fieldsOf(section).length > 0) return true;
 	return false;
 }
-function isRecord$3(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sectionsOf(schema) {
-	if (!isRecord$3(schema)) return [];
+	if (!isRecord$5(schema)) return [];
 	const sections = schema["sections"];
 	return Array.isArray(sections) ? sections : [];
 }
 function fieldsOf(node) {
-	if (!isRecord$3(node)) return [];
+	if (!isRecord$5(node)) return [];
 	const fields = node["fields"];
 	return Array.isArray(fields) ? fields : [];
 }
 function walkField(field, out) {
-	if (!isRecord$3(field)) return;
+	if (!isRecord$5(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
@@ -241,7 +241,7 @@ function walkField(field, out) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$2(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -252,19 +252,19 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$4(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 /** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
 function isSecretMarkerLike(value) {
-	return isRecord$2(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+	return isRecord$4(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
 }
 function isSecretClear(value) {
-	return isRecord$2(value) && value["$secretClear"] === true;
+	return isRecord$4(value) && value["$secretClear"] === true;
 }
 function isSecretFieldView(value) {
-	return isRecord$2(value) && value["set"] === true && isSecretMarkerLike(value);
+	return isRecord$4(value) && value["set"] === true && isSecretMarkerLike(value);
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -1018,7 +1018,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$1(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -1031,7 +1031,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$3(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -1086,7 +1086,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$3) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -1102,7 +1102,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$1(row)) {
+		if (!isRecord$3(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -1127,7 +1127,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$1(incoming)) {
+			if (!isRecord$3(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -1135,7 +1135,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$1(stored) ? stored : {};
+			const storedObj = isRecord$3(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -1258,7 +1258,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$1(v)) {
+		if (isRecord$3(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -1292,7 +1292,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -1321,7 +1321,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord(item) && isRecord(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$2(item) && isRecord$2(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -1332,7 +1332,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord(value) && isRecord(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$2(value) && isRecord$2(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -1340,7 +1340,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord(incoming) || !isRecord(stored)) return incoming;
+	if (!isRecord$2(incoming) || !isRecord$2(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -1371,7 +1371,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord(a) && isRecord(b)) {
+	if (isRecord$2(a) && isRecord$2(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -1395,7 +1395,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord(value)) return null;
+	if (!isRecord$2(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -3122,6 +3122,981 @@ async function resolveSecretViewsIn(args, secrets) {
 	return swap(args).value;
 }
 //#endregion
+//#region src/records/constants.ts
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_ID_MAX_LENGTH = 256;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_BATCH_MAX_BYTES = 4 * 1024 * 1024;
+var RECORD_QUERY_MAX = 1e3;
+/** Rows one DELETE statement removes before the serving thread yields. */
+var RECORD_DELETE_BATCH = 5e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+var RECORD_MAX_INDEXES = 8;
+var RECORD_MAX_INDEX_FIELDS = 4;
+/** The engine's TTL sweep cadence. */
+var RECORD_SWEEP_INTERVAL_MS = 10 * 6e4;
+/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
+var RECORD_SECRET_COLLECTION_PREFIX = "records:";
+//#endregion
+//#region src/records/errors.ts
+/**
+* The named failures of `ctx.records` (D881).
+*
+* A records call crosses a worker thread, a UDS channel and a tRPC router, and
+* an error class does not survive any of them - only its message does. So
+* every message STARTS with a stable code, `records/<code>: <detail>`, and
+* {@link recordsErrorFromMessage} rebuilds the typed class on the caller's side.
+* A failed read is never `[]` or `undefined`: it throws one of these.
+*/
+/** Every code a records failure carries. */
+var RECORDS_ERROR_CODES = [
+	"rev-conflict",
+	"too-large",
+	"unindexed-filter",
+	"filter-required",
+	"unknown-kind",
+	"not-found",
+	"unique-violation",
+	"plaintext-secret",
+	"foreign-marker",
+	"secret-unavailable",
+	"invalid-record",
+	"declaration-refused",
+	"adoption-pending",
+	"no-caller",
+	"batch-too-large"
+];
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+/** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
+var RevConflictError = class extends RecordsError {
+	constructor(detail) {
+		super("rev-conflict", detail);
+		this.name = "RevConflictError";
+	}
+};
+/** `data` exceeds the kind's `maxDataBytes`. Bytes are never record fields (D613). */
+var RecordTooLargeError = class extends RecordsError {
+	constructor(detail) {
+		super("too-large", detail);
+		this.name = "RecordTooLargeError";
+	}
+};
+/** A filter, order or aggregate names a field no declared index serves. */
+var UnindexedFilterError = class extends RecordsError {
+	constructor(detail) {
+		super("unindexed-filter", detail);
+		this.name = "UnindexedFilterError";
+	}
+};
+/** A bulk delete with no predicate at all. */
+var FilterRequiredError = class extends RecordsError {
+	constructor(detail) {
+		super("filter-required", detail);
+		this.name = "FilterRequiredError";
+	}
+};
+/** The caller declared no such kind (another addon's kind is indistinguishable from none). */
+var UnknownRecordKindError = class extends RecordsError {
+	constructor(detail) {
+		super("unknown-kind", detail);
+		this.name = "UnknownRecordKindError";
+	}
+};
+var RecordNotFoundError = class extends RecordsError {
+	constructor(detail) {
+		super("not-found", detail);
+		this.name = "RecordNotFoundError";
+	}
+};
+/** A unique index refused the write. */
+var RecordUniqueViolationError = class extends RecordsError {
+	constructor(detail) {
+		super("unique-violation", detail);
+		this.name = "RecordUniqueViolationError";
+	}
+};
+/** A secret field held a plain string where only a keychain marker may be stored. */
+var PlaintextSecretError = class extends RecordsError {
+	constructor(detail) {
+		super("plaintext-secret", detail);
+		this.name = "PlaintextSecretError";
+	}
+};
+/** A marker whose ref is not the row's own (the D878 rule). */
+var ForeignSecretMarkerError = class extends RecordsError {
+	constructor(detail) {
+		super("foreign-marker", detail);
+		this.name = "ForeignSecretMarkerError";
+	}
+};
+/** The keychain could not store or serve a value: explicit, never an empty string. */
+var RecordSecretUnavailableError = class extends RecordsError {
+	constructor(detail) {
+		super("secret-unavailable", detail);
+		this.name = "RecordSecretUnavailableError";
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
+/** A kind is empty while the legacy table it adopts from still holds rows. */
+var AdoptionPendingError = class extends RecordsError {
+	constructor(detail) {
+		super("adoption-pending", detail);
+		this.name = "AdoptionPendingError";
+	}
+};
+var NoCallerError = class extends RecordsError {
+	constructor(detail) {
+		super("no-caller", detail);
+		this.name = "NoCallerError";
+	}
+};
+var BatchTooLargeError = class extends RecordsError {
+	constructor(detail) {
+		super("batch-too-large", detail);
+		this.name = "BatchTooLargeError";
+	}
+};
+var FACTORIES = {
+	"rev-conflict": (d) => new RevConflictError(d),
+	"too-large": (d) => new RecordTooLargeError(d),
+	"unindexed-filter": (d) => new UnindexedFilterError(d),
+	"filter-required": (d) => new FilterRequiredError(d),
+	"unknown-kind": (d) => new UnknownRecordKindError(d),
+	"not-found": (d) => new RecordNotFoundError(d),
+	"unique-violation": (d) => new RecordUniqueViolationError(d),
+	"plaintext-secret": (d) => new PlaintextSecretError(d),
+	"foreign-marker": (d) => new ForeignSecretMarkerError(d),
+	"secret-unavailable": (d) => new RecordSecretUnavailableError(d),
+	"invalid-record": (d) => new InvalidRecordError(d),
+	"declaration-refused": (d) => new DeclarationRefusedError(d),
+	"adoption-pending": (d) => new AdoptionPendingError(d),
+	"no-caller": (d) => new NoCallerError(d),
+	"batch-too-large": (d) => new BatchTooLargeError(d)
+};
+function isCode(value) {
+	return RECORDS_ERROR_CODES.some((code) => code === value);
+}
+/**
+* Rebuild the typed error from a message that crossed a wire; `null` when the
+* message is not a records failure.
+*/
+function recordsErrorFromMessage(message) {
+	if (!message.startsWith(PREFIX)) return null;
+	const colon = message.indexOf(": ");
+	if (colon < 0) return null;
+	const code = message.slice(8, colon);
+	if (!isCode(code)) return null;
+	return FACTORIES[code](message.slice(colon + 2));
+}
+/** The records failure inside any thrown value (a wrapped tRPC error included), or the value. */
+function asRecordsError(err) {
+	if (err instanceof RecordsError) return err;
+	if (err instanceof Error) {
+		const typed = recordsErrorFromMessage(err.message);
+		if (typed !== null) return typed;
+	}
+	return err;
+}
+//#endregion
+//#region src/device/zod-secret.ts
+/**
+* Secret declaration on a Zod config schema (D783).
+*
+* A field is a secret because its schema SAYS so — `.meta({ secret: true })`,
+* spelled {@link SECRET_META} — never because its key looks like a credential.
+* It is the Zod twin of `secret: true` / `type: 'password'` on a config-UI
+* field (`isSecretConfigField`), and every consumer that treats secrets
+* specially reads it: the settings form (`zodEntriesToConfigUI`), the paths a
+* device advertises at `registerDevice` (`secretConfigPaths`, which the
+* non-admin redaction withholds at any depth), and the keychain later.
+*
+* Zod keeps `.meta()` in `z.globalRegistry`, which lives on `globalThis`, so a
+* declaration made by an addon's own copy of zod is visible here.
+*/
+/**
+* `{ secret: true }` — the one spelling of "this field holds a credential".
+*
+* Addons write the LITERAL `.meta({ secret: true })` rather than importing
+* this constant: an addon running against an older `@camstack/types` would
+* otherwise call `.meta(undefined)`, which in zod v4 is the metadata GETTER
+* and returns no schema at all.
+*/
+var SECRET_META = { secret: true };
+function defOf(schema) {
+	return schema._zod?.def ?? {};
+}
+function declaredHere(schema) {
+	return z.globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
+//#endregion
+//#region src/records/secret-paths.ts
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const key = each ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function elementId(element, idKey, declared, prefix) {
+	const id = isRecord$1(element) ? element[idKey] : void 0;
+	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
+	return id;
+}
+/**
+* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
+* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
+* result is a new body, `data` is untouched.
+*/
+var REMOVE_LEAF = Symbol("remove-leaf");
+function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
+	if (!isRecord$1(node)) return node;
+	const segment = segments[index];
+	if (segment === void 0) return node;
+	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
+	const child = node[segment.key];
+	const keys = [...walkedKeys, segment.key];
+	const last = index === segments.length - 1;
+	if (segment.each) {
+		if (!Array.isArray(child)) return node;
+		const prefix = keys.join(".");
+		const idKey = arrayKeys[prefix];
+		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
+		const mapped = child.map((element) => {
+			const id = elementId(element, idKey, declared, prefix);
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
+			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
+		});
+		return {
+			...node,
+			[segment.key]: mapped
+		};
+	}
+	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
+	if (last) {
+		const replacement = visit({
+			declared,
+			concrete,
+			value: child
+		});
+		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
+		return {
+			...node,
+			[segment.key]: replacement
+		};
+	}
+	return {
+		...node,
+		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+	};
+}
+/** Replace/remove every present secret leaf; returns a NEW body. */
+function mapSecretLeaves(data, paths, arrayKeys, visit) {
+	let current = data;
+	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
+	return current;
+}
+/** Every present secret leaf, read-only. */
+function collectSecretLeaves(data, paths, arrayKeys) {
+	const found = [];
+	mapSecretLeaves(data, paths, arrayKeys, (leaf) => {
+		found.push(leaf);
+		return leaf.value;
+	});
+	return found;
+}
+/**
+* The keychain collection name a kind's secrets live under. Prefixed so a
+* record's refs never collide with the refs a legacy collection of the same name
+* already holds during an adoption.
+*/
+function recordSecretCollection(kind) {
+	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
+}
+/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
+function recordSecretRef(owner, kind, rowId, concretePath) {
+	return buildSecretRef({
+		owner,
+		scope: {
+			kind: "row",
+			collection: recordSecretCollection(kind),
+			rowId
+		},
+		fieldPath: concretePath
+	});
+}
+/** A concrete path built from a flat array item, re-exported for adoption tooling. */
+var recordArrayItemPath = arrayItemFieldPath;
+//#endregion
+//#region src/records/record-kind.ts
+/**
+* Record kinds (D881): the declaration an addon makes of one kind of fact, the
+* Zod row schema that describes it, and the helper that turns the two into the
+* JSON the engine stores.
+*
+* A kind is declared ONCE, next to the code that owns it, and the engine's
+* reconciler creates its indexes - nothing creates DDL at runtime from a write.
+* Everything the generic machinery needs (secret fields, the entry descriptor)
+* is DERIVED from the Zod schema: `.meta({ secret: true })` marks a credential,
+* never a field name (D879).
+*/
+/** A JSON field path: `trackId`, `auth.accessToken`. Charset-restricted: it is rendered into DDL. */
+var RecordFieldPathSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}(\.[A-Za-z_][A-Za-z0-9_]{0,63}){0,3}$/);
+var RecordIndexSchema = z.object({
+	name: z.string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+	fields: z.array(RecordFieldPathSchema).min(1).max(4),
+	unique: z.boolean().optional()
+}).strict();
+var RecordRetentionSchema = z.union([
+	z.object({
+		ttlMs: z.number().int().positive(),
+		from: z.enum(["at", "write"])
+	}).strict(),
+	z.object({
+		maxRows: z.number().int().positive().optional(),
+		maxRowsPerDevice: z.number().int().positive().optional()
+	}).strict().refine((r) => r.maxRows !== void 0 || r.maxRowsPerDevice !== void 0, { message: "name maxRows, maxRowsPerDevice or both" }),
+	z.object({
+		owner: z.string().min(1),
+		reason: z.string().min(1)
+	}).strict(),
+	z.object({ none: z.string().min(1) }).strict()
+]);
+/** The descriptor a generic entries UI reads (D881 "generic entries"). */
+var EntryDescriptorSchema = z.object({
+	title: z.string().min(1),
+	/** The record body field shown as the entry's name. */
+	nameField: z.string().min(1),
+	/** JSON Schema of the entry body; `secret: true` marks a password field. */
+	fields: z.record(z.string(), z.unknown())
+}).strict();
+/** What crosses the wire and sits in the engine's catalog: JSON only, no Zod. */
+var RecordKindDeclarationSchema = z.object({
+	database: z.enum(RECORD_DATABASES).default("settings"),
+	class: z.enum(RECORD_CLASSES),
+	writeTrigger: z.string().min(1),
+	device: z.enum([
+		"required",
+		"optional",
+		"none"
+	]).default("none"),
+	at: z.enum(["required", "none"]).default("none"),
+	indexes: z.array(RecordIndexSchema).max(8).default([]),
+	retention: RecordRetentionSchema,
+	deviceRemoval: z.enum(["delete", "none"]).default("none"),
+	maxDataBytes: z.number().int().positive().max(RECORD_MAX_DATA_BYTES).default(RECORD_DEFAULT_MAX_DATA_BYTES),
+	/** Derived from the Zod schema; never written by hand. */
+	secretPaths: z.array(z.string().min(1)).default([]),
+	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
+	secretArrayKeys: z.record(z.string(), z.string()).default({}),
+	/** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+	adoptsFrom: z.string().min(1).optional(),
+	/** Kinds that must agree through `transact` sit in one file under one family name. */
+	transactFamily: z.string().min(1).optional(),
+	entry: EntryDescriptorSchema.optional()
+}).strict();
+/** The kind names: lower-case, dash separated, short enough for an index name. */
+var RecordKindNameSchema = z.string().regex(/^[a-z][a-z0-9-]{0,47}$/);
+/** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
+function assertValidDeclaration(name, decl) {
+	const refuse = (why) => {
+		throw new DeclarationRefusedError(`kind "${name}": ${why}`);
+	};
+	if (!RecordKindNameSchema.safeParse(name).success) refuse("the name must be lower-case-dashed");
+	const seen = /* @__PURE__ */ new Set();
+	for (const index of decl.indexes) {
+		if (seen.has(index.name)) refuse(`index name "${index.name}" is declared twice`);
+		seen.add(index.name);
+	}
+	const { retention } = decl;
+	const hasSecrets = decl.secretPaths.length > 0;
+	if ("ttlMs" in retention) {
+		if (retention.from === "at" && decl.at !== "required") refuse("a ttl from \"at\" needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use engine TTL (its keychain values would be orphaned)");
+	}
+	if ("maxRows" in retention || "maxRowsPerDevice" in retention) {
+		if (retention.maxRowsPerDevice !== void 0 && decl.device !== "required") refuse("maxRowsPerDevice needs device: \"required\"");
+		if (decl.at !== "required") refuse("a row bound trims the oldest \"at\": it needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use an engine row bound");
+		const bound = Math.max(retention.maxRows ?? 0, retention.maxRowsPerDevice ?? 0);
+		if (decl.database === "settings" && bound > 5e4) refuse(`a row bound above ${RECORD_SETTINGS_MAX_ROWS} belongs in database: "events" (a big delete on the settings thread stalls every configuration read)`);
+	}
+	if (decl.deviceRemoval === "delete" && decl.device === "none") refuse("deviceRemoval: \"delete\" needs a device: \"required\" or \"optional\"");
+	for (const path of decl.secretPaths) for (const prefix of secretArrayPrefixes(path)) if (decl.secretArrayKeys[prefix] === void 0) refuse(`secret path "${path}" crosses the array "${prefix}": declare its id key in secretArrayKeys`);
+}
+function bodyFieldsOf(schema) {
+	return { ...z.toJSONSchema(schema, {
+		unrepresentable: "any",
+		io: "input"
+	}) };
+}
+function isRecordLike(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Does every branch of the body schema carry `field`? (A discriminated union has several.) */
+function hasNameField(json, field) {
+	const branches = json["oneOf"] ?? json["anyOf"];
+	if (Array.isArray(branches)) return branches.length > 0 && branches.every((b) => isRecordLike(b) && hasNameField(b, field));
+	const properties = json["properties"];
+	return isRecordLike(properties) && Object.prototype.hasOwnProperty.call(properties, field);
+}
+/**
+* Declare the kinds of a package. The keys are the kind names. The result is
+* what `ctx.records.declare` sends to the engine and what `ctx.records.kind`
+* types its handle from.
+*/
+function defineRecordKinds(specs) {
+	const out = {};
+	for (const [name, spec] of Object.entries(specs)) {
+		const secretPaths = collectZodSecretPaths(spec.schema);
+		const nameField = spec.entry?.nameField ?? "name";
+		const fields = bodyFieldsOf(spec.schema);
+		if (spec.entry !== void 0 && !hasNameField(fields, nameField)) throw new DeclarationRefusedError(`kind "${name}": an entry kind's schema needs a "${nameField}" field`);
+		const parsed = RecordKindDeclarationSchema.parse({
+			database: spec.database,
+			class: spec.class,
+			writeTrigger: spec.writeTrigger,
+			device: spec.device,
+			at: spec.at,
+			indexes: spec.indexes === void 0 ? void 0 : [...spec.indexes],
+			retention: spec.retention,
+			deviceRemoval: spec.deviceRemoval,
+			maxDataBytes: spec.maxDataBytes,
+			secretPaths: [...secretPaths],
+			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
+			adoptsFrom: spec.adoptsFrom,
+			transactFamily: spec.transactFamily,
+			entry: spec.entry === void 0 ? void 0 : {
+				title: spec.entry.title,
+				nameField,
+				fields
+			}
+		});
+		assertValidDeclaration(name, parsed);
+		out[name] = {
+			name,
+			schema: spec.schema,
+			declaration: parsed
+		};
+	}
+	return out;
+}
+/** The wire form of a package's kinds: name -> declaration. */
+function declarationsOf(kinds) {
+	return Object.fromEntries(Object.entries(kinds).map(([name, kind]) => [name, kind.declaration]));
+}
+//#endregion
+//#region src/records/records-access.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Run a transport call and give a wire failure its typed class back. */
+async function call(fn) {
+	try {
+		return await fn();
+	} catch (err) {
+		throw asRecordsError(err);
+	}
+}
+function zodSummary(error) {
+	return error.issues.slice(0, 5).map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
+}
+function toRow(view, data) {
+	return {
+		id: view.id,
+		deviceId: view.deviceId,
+		at: view.at,
+		expiresAt: view.expiresAt,
+		rev: view.rev,
+		updatedAt: view.updatedAt,
+		data
+	};
+}
+var KindHandle = class {
+	def;
+	o;
+	name;
+	decl;
+	constructor(def, o) {
+		this.def = def;
+		this.o = o;
+		this.name = def.name;
+		this.decl = def.declaration;
+	}
+	get hasSecrets() {
+		return this.decl.secretPaths.length > 0;
+	}
+	requireSecrets() {
+		if (this.o.secrets === null) throw new RecordSecretUnavailableError(`kind "${this.name}" has secret fields and this process has no keychain door`);
+		return this.o.secrets;
+	}
+	/** Read the body as the schema's type. The engine already redacted the secrets. */
+	typed(view) {
+		return toRow(view, view.data);
+	}
+	/**
+	* Classify and store the secret leaves of a body about to be written. The
+	* keychain is written FIRST (a failure throws before any row is touched), and
+	* what each ref held before is remembered: when the row write is then refused
+	* (a stale `ifRev`, too large, a unique index) `rollback` puts the previous
+	* values back, so a refused write never destroys the secret that was stored.
+	*/
+	async storeSecrets(id, body, mode) {
+		if (!this.hasSecrets) return {
+			body,
+			rollback: async () => {}
+		};
+		const secrets = this.requireSecrets();
+		const writes = [];
+		const prepared = mapSecretLeaves(body, this.decl.secretPaths, this.decl.secretArrayKeys, (leaf) => {
+			const intent = classifySecretWrite(leaf.value);
+			if (intent.kind === "clear") return REMOVE_LEAF;
+			if (intent.kind === "keep") {
+				if (mode === "put") return REDACTED_SECRET;
+				if (leaf.value === null) return null;
+				return leaf.concrete.includes("[") ? REDACTED_SECRET : REMOVE_LEAF;
+			}
+			const ref = recordSecretRef(this.o.owner, this.name, id, leaf.concrete);
+			writes.push({
+				ref,
+				value: intent.value
+			});
+			return makeSecretMarker(ref);
+		});
+		const done = [];
+		const rollback = async () => {
+			for (const { ref, previous } of done) try {
+				if (previous === void 0) await secrets.delete([ref]);
+				else await secrets.put(ref, previous);
+			} catch (err) {
+				this.o.logger?.warn("records: could not restore a keychain value after a refused write", { meta: {
+					kind: this.name,
+					error: err instanceof Error ? err.message : "unknown"
+				} });
+			}
+		};
+		for (const write of writes) try {
+			const before = (await secrets.resolve([write.ref]))[write.ref];
+			const previous = before?.kind === "value" ? before.value : void 0;
+			await secrets.put(write.ref, write.value);
+			done.push({
+				ref: write.ref,
+				previous
+			});
+		} catch (err) {
+			await rollback();
+			throw new RecordSecretUnavailableError(`cannot store a secret of ${this.name}/${id}: ${err instanceof Error ? err.message : "the keychain refused"}. Unlock the keychain (System -> Secrets) and save again`);
+		}
+		return {
+			body: prepared,
+			rollback
+		};
+	}
+	async releaseRefs(refs) {
+		if (refs.length === 0 || this.o.secrets === null) return;
+		try {
+			await this.o.secrets.delete(refs);
+		} catch (err) {
+			this.o.logger?.warn("records: could not remove released keychain values", { meta: {
+				kind: this.name,
+				count: refs.length,
+				error: err instanceof Error ? err.message : "unknown"
+			} });
+		}
+	}
+	validate(data, id) {
+		const shaped = this.hasSecrets ? mapSecretLeaves(data, this.decl.secretPaths, this.decl.secretArrayKeys, (leaf) => {
+			const intent = classifySecretWrite(leaf.value);
+			if (intent.kind === "clear") return REMOVE_LEAF;
+			return intent.kind === "keep" ? REDACTED_SECRET : leaf.value;
+		}) : data;
+		const parsed = this.def.schema.safeParse(shaped);
+		if (!parsed.success) throw new InvalidRecordError(`${this.name}/${id}: ${zodSummary(parsed.error)}`);
+		if (!isRecord(parsed.data)) throw new InvalidRecordError(`${this.name}/${id}: the body must be an object`);
+		return parsed.data;
+	}
+	async get(id) {
+		const view = await call(() => this.o.transport.get({
+			kind: this.name,
+			id
+		}));
+		return view === null ? null : this.typed(view);
+	}
+	async getMany(ids) {
+		if (ids.length === 0) return [];
+		return (await call(() => this.o.transport.getMany({
+			kind: this.name,
+			ids: [...ids]
+		}))).map((v) => this.typed(v));
+	}
+	async getResolved(id) {
+		const row = await this.get(id);
+		if (row === null) return null;
+		return (await this.resolveRows([row]))[0] ?? row;
+	}
+	async resolveRows(rows) {
+		if (!this.hasSecrets || rows.length === 0) return rows;
+		const secrets = this.requireSecrets();
+		const refsById = await call(() => this.o.transport.secretRefs({
+			kind: this.name,
+			ids: rows.map((r) => r.id)
+		}));
+		const refs = Object.values(refsById).flatMap((byPath) => Object.values(byPath));
+		if (refs.length === 0) return rows;
+		const answers = await secrets.resolve(refs);
+		return rows.map((row) => {
+			const byPath = refsById[row.id] ?? {};
+			const resolved = mapSecretLeaves(row.data, this.decl.secretPaths, this.decl.secretArrayKeys, (leaf) => {
+				const ref = byPath[leaf.concrete];
+				if (ref === void 0) return leaf.value;
+				const answer = answers[ref];
+				if (answer?.kind === "value") return answer.value;
+				const why = answer?.kind === "unavailable" ? answer.reason : answer?.kind ?? "no answer";
+				throw new RecordSecretUnavailableError(`the secret "${leaf.concrete}" of ${this.name}/${row.id} cannot be served (${why})`);
+			});
+			return {
+				...row,
+				data: resolved
+			};
+		});
+	}
+	async put(input, opts = {}) {
+		const checked = this.validate(input.data, input.id);
+		const { body, rollback } = await this.storeSecrets(input.id, checked, "put");
+		const result = await call(() => this.o.transport.put({
+			kind: this.name,
+			record: {
+				...input,
+				data: toBody(body)
+			},
+			...opts.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+		})).catch(async (err) => {
+			await rollback();
+			throw err;
+		});
+		await this.releaseRefs(result.releasedRefs);
+		return { rev: result.rev };
+	}
+	async putMany(inputs) {
+		if (inputs.length === 0) return { count: 0 };
+		const prepared = [];
+		const rollbacks = [];
+		try {
+			for (const input of inputs) {
+				const checked = this.validate(input.data, input.id);
+				const { body, rollback } = await this.storeSecrets(input.id, checked, "put");
+				rollbacks.push(rollback);
+				prepared.push({
+					...input,
+					data: toBody(body)
+				});
+			}
+		} catch (err) {
+			for (const rollback of rollbacks) await rollback();
+			throw err;
+		}
+		const result = await call(() => this.o.transport.putMany({
+			kind: this.name,
+			records: prepared
+		})).catch(async (err) => {
+			for (const rollback of rollbacks) await rollback();
+			throw err;
+		});
+		await this.releaseRefs(result.releasedRefs);
+		return { count: result.count };
+	}
+	async patch(id, partial, opts = {}) {
+		const { body, rollback } = await this.storeSecrets(id, partial, "patch");
+		const result = await call(() => this.o.transport.patch({
+			kind: this.name,
+			id,
+			data: toBody(body),
+			...opts.at === void 0 ? {} : { at: opts.at },
+			...opts.expiresAt === void 0 ? {} : { expiresAt: opts.expiresAt },
+			...opts.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+		})).catch(async (err) => {
+			await rollback();
+			throw err;
+		});
+		await this.releaseRefs(result.releasedRefs);
+		return { rev: result.rev };
+	}
+	async delete(id) {
+		const result = await call(() => this.o.transport.delete({
+			kind: this.name,
+			id
+		}));
+		await this.releaseRefs(result.secretRefs);
+		return result.deleted;
+	}
+	async deleteMany(ids) {
+		if (ids.length === 0) return 0;
+		const result = await call(() => this.o.transport.deleteMany({
+			kind: this.name,
+			ids: [...ids]
+		}));
+		await this.releaseRefs(result.secretRefs);
+		return result.deleted;
+	}
+	async query(q, opts = {}) {
+		const result = await call(() => this.o.transport.query({
+			...q,
+			kind: this.name,
+			limit: q.limit ?? 100
+		}));
+		const rows = result.records.map((v) => this.typed(v));
+		return {
+			records: opts.resolveSecrets === true ? await this.resolveRows(rows) : rows,
+			nextCursor: result.nextCursor
+		};
+	}
+	async count(q) {
+		return (await call(() => this.o.transport.count({
+			...q,
+			kind: this.name
+		}))).count;
+	}
+	async histogram(q) {
+		return (await call(() => this.o.transport.histogram({
+			...q,
+			kind: this.name
+		}))).buckets;
+	}
+	async aggregate(q) {
+		return (await call(() => this.o.transport.aggregate({
+			...q,
+			kind: this.name
+		}))).rows;
+	}
+	async deleteWhere(q) {
+		const result = await call(() => this.o.transport.deleteWhere({
+			...q,
+			kind: this.name
+		}));
+		await this.releaseRefs(result.secretRefs);
+		return result.deleted;
+	}
+	async allocateId() {
+		return (await call(() => this.o.transport.allocateId({ kind: this.name }))).id;
+	}
+};
+function toBody(value) {
+	if (!isRecord(value)) throw new InvalidRecordError("the record body must be an object");
+	return value;
+}
+/** Build the owner's records handle. */
+function createRecordsAccess(options) {
+	const handles = /* @__PURE__ */ new WeakMap();
+	const delegates = /* @__PURE__ */ new Map();
+	return {
+		owner: options.owner,
+		forOwner: options.transportForOwner === void 0 ? null : (other) => {
+			const existing = delegates.get(other);
+			if (existing !== void 0) return existing;
+			const build = options.transportForOwner;
+			if (build === void 0) throw new Error("forOwner: no delegate transport");
+			const delegate = createRecordsAccess({
+				owner: other,
+				transport: build(other),
+				secrets: options.secrets?.forOwner?.(other) ?? null,
+				...options.logger === void 0 ? {} : { logger: options.logger }
+			});
+			delegates.set(other, delegate);
+			return delegate;
+		},
+		async declare(kinds) {
+			const result = await call(() => options.transport.declareKinds({ kinds: { ...declarationsOf(kinds) } }));
+			const pending = Object.entries(result.kinds).filter((entry) => entry[1].adoptionPending !== null);
+			if (pending.length > 0) throw new AdoptionPendingError(`${pending.map(([name, r]) => r.adoptionPending === null ? name : `${name} (legacy table "${r.adoptionPending.legacyTable}" holds ${r.adoptionPending.legacyRows} rows)`).join(", ")}. Stop the addon and run scripts/hub/records-adopt.ts --copy --apply before starting this build`);
+			return result.kinds;
+		},
+		kind(definition) {
+			const existing = handles.get(definition);
+			if (existing !== void 0) return existing;
+			const handle = new KindHandle(definition, options);
+			handles.set(definition, handle);
+			return handle;
+		},
+		async deleteDevice(deviceId, opts = {}) {
+			const result = await call(() => options.transport.deleteDevice({
+				deviceId,
+				...opts.kinds === void 0 ? {} : { kinds: [...opts.kinds] }
+			}));
+			if (result.secretRefs.length > 0 && options.secrets !== null) try {
+				await options.secrets.delete(result.secretRefs);
+			} catch (err) {
+				options.logger?.warn("records: could not remove released keychain values", { meta: {
+					count: result.secretRefs.length,
+					error: err instanceof Error ? err.message : "unknown"
+				} });
+			}
+			return result.deleted;
+		}
+	};
+}
+//#endregion
+//#region src/records/entry-kind.ts
+/**
+* Entry kinds (D881): every list of user-created entries (notification
+* targets, brokers, LLM profiles) is ONE record kind with an id, a name and a
+* kind-specific body, and the admin UI lists/adds/edits/deletes all of them
+* through the `record-entries` capability with password fields derived from
+* the schema (`.meta({ secret: true })`).
+*/
+/** The body of a plain entry: a name and the fields the kind adds. */
+function entryBody(shape) {
+	return z.object({
+		name: z.string().min(1),
+		...shape
+	});
+}
+/**
+* Declare one entry kind. An entry is configuration: never trimmed by the
+* engine, never aged, belonging to no device.
+*/
+function defineEntryKind(name, spec) {
+	const defined = defineRecordKinds({ [name]: {
+		schema: spec.schema,
+		class: "config",
+		writeTrigger: spec.writeTrigger ?? "an operator adds or edits an entry in the entries UI",
+		retention: { none: "an entry goes only when the operator deletes it" },
+		...spec.database === void 0 ? {} : { database: spec.database },
+		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
+		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
+		...spec.adoptsFrom === void 0 ? {} : { adoptsFrom: spec.adoptsFrom },
+		entry: {
+			title: spec.title,
+			...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
+		}
+	} })[name];
+	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
+	return defined;
+}
+//#endregion
 //#region src/capabilities/schemas/streaming-shared.ts
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = z.enum([
@@ -4537,94 +5512,6 @@ var RUNTIME_DEFAULTS = {
 	"auth.tokenExpiry": "30d"
 };
 //#endregion
-//#region src/device/zod-secret.ts
-/**
-* Secret declaration on a Zod config schema (D783).
-*
-* A field is a secret because its schema SAYS so — `.meta({ secret: true })`,
-* spelled {@link SECRET_META} — never because its key looks like a credential.
-* It is the Zod twin of `secret: true` / `type: 'password'` on a config-UI
-* field (`isSecretConfigField`), and every consumer that treats secrets
-* specially reads it: the settings form (`zodEntriesToConfigUI`), the paths a
-* device advertises at `registerDevice` (`secretConfigPaths`, which the
-* non-admin redaction withholds at any depth), and the keychain later.
-*
-* Zod keeps `.meta()` in `z.globalRegistry`, which lives on `globalThis`, so a
-* declaration made by an addon's own copy of zod is visible here.
-*/
-/**
-* `{ secret: true }` — the one spelling of "this field holds a credential".
-*
-* Addons write the LITERAL `.meta({ secret: true })` rather than importing
-* this constant: an addon running against an older `@camstack/types` would
-* otherwise call `.meta(undefined)`, which in zod v4 is the metadata GETTER
-* and returns no schema at all.
-*/
-var SECRET_META = { secret: true };
-function defOf(schema) {
-	return schema._zod?.def ?? {};
-}
-function declaredHere(schema) {
-	return z.globalRegistry.get(schema)?.secret === true;
-}
-/** Wrapper kinds whose `innerType` is the field itself. */
-var WRAPPERS = new Set([
-	"optional",
-	"nullable",
-	"default",
-	"prefault",
-	"catch",
-	"readonly",
-	"nonoptional"
-]);
-/**
-* The schema layers that make up ONE field: the schema itself and every
-* wrapper below it (optional / default / nullable / readonly / catch), plus
-* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
-* `.transform` on `in`).
-*/
-function layersOf(schema) {
-	const out = [];
-	const queue = [schema];
-	while (queue.length > 0) {
-		const s = queue.shift();
-		if (!s || out.includes(s)) continue;
-		out.push(s);
-		const def = defOf(s);
-		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
-		if (def.type === "pipe") {
-			if (def.in) queue.push(def.in);
-			if (def.out) queue.push(def.out);
-		}
-	}
-	return out;
-}
-/** True when any layer of this field declares `.meta({ secret: true })`. */
-function isZodSecret(schema) {
-	return layersOf(schema).some(declaredHere);
-}
-/**
-* Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
-* object or array is reported as one path and not descended into — everything
-* under it is secret.
-*/
-function collectZodSecretPaths(schema, prefix = "") {
-	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
-	const paths = [];
-	for (const layer of layersOf(schema)) {
-		const def = defOf(layer);
-		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
-		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
-		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
-		else if (def.type === "intersection") {
-			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
-			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
-		}
-	}
-	return [...new Set(paths)];
-}
-//#endregion
 //#region src/device/device-state-handle.ts
 var DEVICE_STATE_EVENT_CATEGORY = "device.state-changed";
 /**
@@ -6187,4 +7074,4 @@ function sleepCancellable(ms, signal) {
 	});
 }
 //#endregion
-export { resolveCapMount as $, normalizeAddonInitResult as $t, HF_BASE_URL as A, isSecretFieldView as An, makeSourceBrokerId as At, deviceCustomAction as B, schemaDeclaresAnyField as Bn, registerKnownSecret as Bt, createLazyTrpcSource as C, collectHydratedFieldEntries as Cn, ProfileSlotSchema as Ct, collectZodSecretPaths as D, SECRET_CLEAR as Dn, SubscribeAudioChunksInputSchema as Dt, SECRET_META as E, resolveHydratedFieldValue as En, StreamSourceSchema as Et, viewerUiCapability as F, REDACTED_SECRET as Fn, createSecretsAccess as Ft, HISTORY_DEFAULT_MIN_INTERVAL_MS as G, PEER_BYTES_STALL_MS as Gt, DEFAULT_RUNTIME_STATE_DURABILITY as H, audioChunkBytesPerSample as Hn, shortSecretRefHash as Ht, DEVICE_CHILDREN_BATCH_MAX as I, collectKeychainStoredKeys as In, MIN_SCRUBBED_LENGTH as It, event as J, DATAPLANE_SECRET_HEADER as Jt, HISTORY_UNIT_LABELS as K, PEER_BYTES_TICKET_TTL_MS as Kt, customAction as L, collectSecretConfigKeys as Ln, clearKnownSecrets as Lt, RUNTIME_DEFAULTS as M, isSecretMarkerLike as Mn, selectAssignedProfileSlots as Mt, RawStateResultSchema as N, makeSecretMarker as Nn, resolveSecretViewsIn as Nt, isZodSecret as O, classifySecretWrite as On, SubscribeAudioChunksResultSchema as Ot, deviceOpsCapability as P, toSecretFieldView as Pn, REVALIDATE_AFTER_MS as Pt, optionalMethod as Q, classifyStoreError as Qt, defineCustomActions as R, isKeychainStoredField as Rn, forgetKnownSecret as Rt, createEventBusSliceSource as S, WELL_KNOWN_TAB_MAP as Sn, ProfileRtspEntrySchema as St, createSliceHandle as T, hydrateSchema as Tn, StreamSourceEntrySchema$1 as Tt, DEVICE_SETTINGS_CONTRIBUTION_METHODS as U, expandAudioChunkToF32le as Un, PEER_BYTES_CHUNK_BYTES as Ut, adminUiCapability as V, AUDIO_CHUNK_FORMATS as Vn, scrubKnownSecrets as Vt, DEVICE_STATUS_METHOD as W, isAudioChunkFormat as Wn, PEER_BYTES_MAX_OUTSTANDING as Wt, isDeviceConfigCap as X, DisposerChain as Xt, expandCapMethods as Y, SHARE_VIEW_KINDS as Yt, method as Z, BaseAddon as Zt, readErrorI18n as _, createDurableState as _n, CamStreamKindSchema as _t, asJsonArray as a, collectSecretMarkerRefs as an, MODEL_FORMATS as at, isDeviceScopedCap as b, isEvent as bn, DecodedAudioChunkSchema as bt, asString as c, SECRET_REF_SCHEME as cn, emitDownForOwnedCaps as ct, parseJsonUnknown as d, formatSecretScope as dn, AudioChunkFormatSchema as dt, mergeSecretStatePaths as en, systemMethod as et, hfModelUrl as f, globalSecretScope as fn, AudioStreamPickSchema as ft, ErrorI18nPayloadSchema as g, normalizeNodeId as gn, CamProfileSchema as gt, ErrorCodeSchema as h, parseSecretRef as hn, CAM_PROFILE_ORDER as ht, asBoolean as i, KeychainWriteRefusedError as in, toNodeId as it, HF_REPO as j, isSecretMarker as jn, parseProfileBrokerId as jt, DEFAULT_TOKEN_EXPIRY as k, isSecretClear as kn, makeProfileBrokerId as kt, parseJsonArray as l, arrayItemFieldPath as ln, readinessKey as lt, CamstackError as m, normalizeSecretOwner as mn, BrokerStatusSchema as mt, sleepCancellable as n, secretTreeFromPaths as nn, nodePin as nt, asJsonObject as o, resolveSecretMarkers as on, ReadinessRegistry as ot, BOOT_RECOVERY_BACKOFF_MS as p, isSecretRef as pn, BrokerStatsSchema as pt, PROVIDER_PIN_FIELD as q, PeerBytesTicketSchema as qt, maskUrlCredentials as r, secretTreeFromSchema as rn, readNodePin as rt, asNumber as s, transformSecretWrite as sn, ReadinessTimeoutError as st, sleep as t, parseSecretStatePath as tn, CAP_NODE_PIN_CONTEXT_KEY as tt, parseJsonObject as u, buildSecretRef as un, scopeKey as ut, userError as v, createEvent as vn, CamStreamResolutionSchema as vt, createMirrorSource as w, collectHydratedFieldValues as wn, ProfileSlotStatusSchema as wt, createDeviceProxy as x, WELL_KNOWN_TABS as xn, FrameHandleSchema as xt, DEVICE_SCOPED_CAPS as y, emitReadiness as yn, CameraStreamSchema as yt, describeCustomActions as z, isSecretConfigField as zn, knownSecretCount as zt };
+export { nodePin as $, mergeSecretStatePaths as $n, AdoptionPendingError as $t, RawStateResultSchema as A, RECORD_SETTINGS_MAX_ROWS as An, isSecretFieldView as Ar, defineEntryKind as At, DEVICE_SETTINGS_CONTRIBUTION_METHODS as B, scrubKnownSecrets as Bn, schemaDeclaresAnyField as Br, declarationsOf as Bt, createLazyTrpcSource as C, RECORD_DELETE_BATCH as Cn, collectHydratedFieldEntries as Cr, StreamSourceSchema as Ct, HF_BASE_URL as D, RECORD_MAX_INDEX_FIELDS as Dn, SECRET_CLEAR as Dr, makeSourceBrokerId as Dt, DEFAULT_TOKEN_EXPIRY as E, RECORD_MAX_INDEXES as En, resolveHydratedFieldValue as Er, makeProfileBrokerId as Et, defineCustomActions as F, MIN_SCRUBBED_LENGTH as Fn, REDACTED_SECRET as Fr, RecordIndexSchema as Ft, event as G, PEER_BYTES_TICKET_TTL_MS as Gn, parseSecretPath as Gt, HISTORY_DEFAULT_MIN_INTERVAL_MS as H, PEER_BYTES_CHUNK_BYTES as Hn, audioChunkBytesPerSample as Hr, REMOVE_LEAF as Ht, describeCustomActions as I, clearKnownSecrets as In, collectKeychainStoredKeys as Ir, RecordKindDeclarationSchema as It, method as J, SHARE_VIEW_KINDS as Jn, recordSecretRef as Jt, expandCapMethods as K, PeerBytesTicketSchema as Kn, recordArrayItemPath as Kt, deviceCustomAction as L, forgetKnownSecret as Ln, collectSecretConfigKeys as Lr, RecordKindNameSchema as Lt, viewerUiCapability as M, resolveSecretViewsIn as Mn, isSecretMarkerLike as Mr, createRecordsAccess as Mt, DEVICE_CHILDREN_BATCH_MAX as N, REVALIDATE_AFTER_MS as Nn, makeSecretMarker as Nr, EntryDescriptorSchema as Nt, HF_REPO as O, RECORD_QUERY_MAX as On, classifySecretWrite as Or, parseProfileBrokerId as Ot, customAction as P, createSecretsAccess as Pn, toSecretFieldView as Pr, RecordFieldPathSchema as Pt, CAP_NODE_PIN_CONTEXT_KEY as Q, normalizeAddonInitResult as Qn, isZodSecret as Qt, adminUiCapability as R, knownSecretCount as Rn, isKeychainStoredField as Rr, RecordRetentionSchema as Rt, createEventBusSliceSource as S, RECORD_DEFAULT_MAX_DATA_BYTES as Sn, WELL_KNOWN_TAB_MAP as Sr, StreamSourceEntrySchema$1 as St, createSliceHandle as T, RECORD_MAX_DATA_BYTES as Tn, hydrateSchema as Tr, SubscribeAudioChunksResultSchema as Tt, HISTORY_UNIT_LABELS as U, PEER_BYTES_MAX_OUTSTANDING as Un, expandAudioChunkToF32le as Ur, collectSecretLeaves as Ut, DEVICE_STATUS_METHOD as V, shortSecretRefHash as Vn, AUDIO_CHUNK_FORMATS as Vr, defineRecordKinds as Vt, PROVIDER_PIN_FIELD as W, PEER_BYTES_STALL_MS as Wn, isAudioChunkFormat as Wr, mapSecretLeaves as Wt, resolveCapMount as X, BaseAddon as Xn, SECRET_META as Xt, optionalMethod as Y, DisposerChain as Yn, secretArrayPrefixes as Yt, systemMethod as Z, classifyStoreError as Zn, collectZodSecretPaths as Zt, readErrorI18n as _, recordsErrorFromMessage as _n, createDurableState as _r, DecodedAudioChunkSchema as _t, asJsonArray as a, NoCallerError as an, isSecretRefOwnedBy as ar, emitDownForOwnedCaps as at, isDeviceScopedCap as b, RECORD_CLASSES as bn, isEvent as br, ProfileSlotSchema as bt, asString as c, RecordNotFoundError as cn, SECRET_REF_SCHEME as cr, AudioChunkFormatSchema as ct, parseJsonUnknown as d, RecordUniqueViolationError as dn, formatSecretScope as dr, BrokerStatusSchema as dt, BatchTooLargeError as en, parseSecretStatePath as er, readNodePin as et, hfModelUrl as f, RecordsError as fn, globalSecretScope as fr, CAM_PROFILE_ORDER as ft, ErrorI18nPayloadSchema as g, asRecordsError as gn, normalizeNodeId as gr, CameraStreamSchema as gt, ErrorCodeSchema as h, UnknownRecordKindError as hn, parseSecretRef as hr, CamStreamResolutionSchema as ht, asBoolean as i, InvalidRecordError as in, collectSecretMarkerRefs as ir, ReadinessTimeoutError as it, deviceOpsCapability as j, RECORD_SWEEP_INTERVAL_MS as jn, isSecretMarker as jr, entryBody as jt, RUNTIME_DEFAULTS as k, RECORD_SECRET_COLLECTION_PREFIX as kn, isSecretClear as kr, selectAssignedProfileSlots as kt, parseJsonArray as l, RecordSecretUnavailableError as ln, arrayItemFieldPath as lr, AudioStreamPickSchema as lt, CamstackError as m, UnindexedFilterError as mn, normalizeSecretOwner as mr, CamStreamKindSchema as mt, sleepCancellable as n, FilterRequiredError as nn, secretTreeFromSchema as nr, MODEL_FORMATS as nt, asJsonObject as o, PlaintextSecretError as on, resolveSecretMarkers as or, readinessKey as ot, BOOT_RECOVERY_BACKOFF_MS as p, RevConflictError as pn, isSecretRef as pr, CamProfileSchema as pt, isDeviceConfigCap as q, DATAPLANE_SECRET_HEADER as qn, recordSecretCollection as qt, maskUrlCredentials as r, ForeignSecretMarkerError as rn, KeychainWriteRefusedError as rr, ReadinessRegistry as rt, asNumber as s, RECORDS_ERROR_CODES as sn, transformSecretWrite as sr, scopeKey as st, sleep as t, DeclarationRefusedError as tn, secretTreeFromPaths as tr, toNodeId as tt, parseJsonObject as u, RecordTooLargeError as un, buildSecretRef as ur, BrokerStatsSchema as ut, userError as v, RECORD_BATCH_MAX as vn, createEvent as vr, FrameHandleSchema as vt, createMirrorSource as w, RECORD_ID_MAX_LENGTH as wn, collectHydratedFieldValues as wr, SubscribeAudioChunksInputSchema as wt, createDeviceProxy as x, RECORD_DATABASES as xn, WELL_KNOWN_TABS as xr, ProfileSlotStatusSchema as xt, DEVICE_SCOPED_CAPS as y, RECORD_BATCH_MAX_BYTES as yn, emitReadiness as yr, ProfileRtspEntrySchema as yt, DEFAULT_RUNTIME_STATE_DURABILITY as z, registerKnownSecret as zn, isSecretConfigField as zr, assertValidDeclaration as zt };