@camstack/types 1.2.379 → 1.2.380

package/dist/{sleep-DQYi915G.js → sleep-CIGOw58l.js}

@@ -162,7 +162,7 @@ function collectKeychainStoredKeys(schema) {
 	return keys;
 }
 function walkKeychainField(field, out) {
-	if (!isRecord$3(field)) return;
+	if (!isRecord$5(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	const isSecret = type === "password" || field["secret"] === true;
@@ -187,21 +187,21 @@ function schemaDeclaresAnyField(schema) {
 	for (const section of sectionsOf(schema)) if (fieldsOf(section).length > 0) return true;
 	return false;
 }
-function isRecord$3(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sectionsOf(schema) {
-	if (!isRecord$3(schema)) return [];
+	if (!isRecord$5(schema)) return [];
 	const sections = schema["sections"];
 	return Array.isArray(sections) ? sections : [];
 }
 function fieldsOf(node) {
-	if (!isRecord$3(node)) return [];
+	if (!isRecord$5(node)) return [];
 	const fields = node["fields"];
 	return Array.isArray(fields) ? fields : [];
 }
 function walkField(field, out) {
-	if (!isRecord$3(field)) return;
+	if (!isRecord$5(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
@@ -241,7 +241,7 @@ function walkField(field, out) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$2(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -252,19 +252,19 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$4(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 /** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
 function isSecretMarkerLike(value) {
-	return isRecord$2(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+	return isRecord$4(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
 }
 function isSecretClear(value) {
-	return isRecord$2(value) && value["$secretClear"] === true;
+	return isRecord$4(value) && value["$secretClear"] === true;
 }
 function isSecretFieldView(value) {
-	return isRecord$2(value) && value["set"] === true && isSecretMarkerLike(value);
+	return isRecord$4(value) && value["set"] === true && isSecretMarkerLike(value);
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -1018,7 +1018,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$1(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -1031,7 +1031,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$3(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -1086,7 +1086,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$3) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -1102,7 +1102,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$1(row)) {
+		if (!isRecord$3(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -1127,7 +1127,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$1(incoming)) {
+			if (!isRecord$3(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -1135,7 +1135,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$1(stored) ? stored : {};
+			const storedObj = isRecord$3(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -1258,7 +1258,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$1(v)) {
+		if (isRecord$3(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -1292,7 +1292,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -1321,7 +1321,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord(item) && isRecord(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$2(item) && isRecord$2(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -1332,7 +1332,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord(value) && isRecord(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$2(value) && isRecord$2(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -1340,7 +1340,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord(incoming) || !isRecord(stored)) return incoming;
+	if (!isRecord$2(incoming) || !isRecord$2(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -1371,7 +1371,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord(a) && isRecord(b)) {
+	if (isRecord$2(a) && isRecord$2(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -1395,7 +1395,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord(value)) return null;
+	if (!isRecord$2(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -3122,183 +3122,1158 @@ async function resolveSecretViewsIn(args, secrets) {
 	return swap(args).value;
 }
 //#endregion
-//#region src/capabilities/schemas/streaming-shared.ts
-/** Shared Zod schemas used across streaming capabilities. */
-var CamProfileSchema = zod.z.enum([
-	"high",
-	"mid",
-	"low"
-]);
-/** Canonical ordering. Hard-coded; never sorted. */
-var CAM_PROFILE_ORDER = [
-	"high",
-	"mid",
-	"low"
+//#region src/records/constants.ts
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
 ];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_ID_MAX_LENGTH = 256;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_BATCH_MAX_BYTES = 4 * 1024 * 1024;
+var RECORD_QUERY_MAX = 1e3;
+/** Rows one DELETE statement removes before the serving thread yields. */
+var RECORD_DELETE_BATCH = 5e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+var RECORD_MAX_INDEXES = 8;
+var RECORD_MAX_INDEX_FIELDS = 4;
+/** The engine's TTL sweep cadence. */
+var RECORD_SWEEP_INTERVAL_MS = 10 * 6e4;
+/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
+var RECORD_SECRET_COLLECTION_PREFIX = "records:";
+//#endregion
+//#region src/records/errors.ts
 /**
-* Which rung a per-camera consumer listens on: an explicit profile, or `auto`.
+* The named failures of `ctx.records` (D881).
 *
-* `auto` is a REAL value, not an absent one — it means "resolve it by the rule
-* that consumer owns". It lives beside `CamProfile` because a rung is the only
-* operator-facing way to name a stream: a cam-stream id is broker-internal and
-* moves when a slot is reassigned, so a stored id silently stops meaning what
-* the operator picked. Today's one user is the audio analyser, whose rule is
-* "the lowest AVAILABLE native rung" (D537).
+* A records call crosses a worker thread, a UDS channel and a tRPC router, and
+* an error class does not survive any of them - only its message does. So
+* every message STARTS with a stable code, `records/<code>: <detail>`, and
+* {@link recordsErrorFromMessage} rebuilds the typed class on the caller's side.
+* A failed read is never `[]` or `undefined`: it throws one of these.
 */
-var AudioStreamPickSchema = zod.z.union([CamProfileSchema, zod.z.literal("auto")]);
-var CamStreamKindSchema = zod.z.enum([
-	"pull-rtsp",
-	"pull-rtmp",
-	"pull-http",
-	"pull-flv",
-	"pull-rfc4571",
-	"push-annexb",
-	"derived"
-]);
-var CamStreamResolutionSchema = zod.z.object({
-	width: zod.z.number().int().positive(),
-	height: zod.z.number().int().positive()
-});
-var CameraStreamSchema = zod.z.object({
-	/** Stable, provider-assigned id unique within the (deviceId) scope. */
-	camStreamId: zod.z.string().min(1),
-	deviceId: zod.z.number().int().nonnegative(),
-	kind: CamStreamKindSchema,
-	/** Required for pull-* kinds. Ignored for push-annexb. */
-	url: zod.z.string().optional(),
-	codec: zod.z.string().optional(),
-	resolution: CamStreamResolutionSchema.optional(),
-	fps: zod.z.number().positive().optional(),
-	/** Human label surfaced in the Admin UI "Camera Stream" dropdown. */
-	label: zod.z.string().optional(),
-	/**
-	* Device-level features the publisher advertised (e.g. `battery-operated`).
-	* The broker, snapshot orchestrator, and prebuffer manager all consult
-	* this list to derive policy — relaxed stall watchdog for battery
-	* cams, prebuffer off by default, longer snapshot rate-limit, etc.
-	*
-	* Single source of truth replacing per-stream flags like the
-	* historical `allowStall`: if the publisher knows the camera is
-	* battery-powered, every downstream service derives the right policy
-	* from this list.
-	*/
-	deviceFeatures: zod.z.array(zod.z.string()).optional(),
-	/**
-	* Whether this stream participates in the broker's automatic profile
-	* assignment (`computeInitialAssignment`). Defaults to `true`. Publishers
-	* use `false` when they want a stream to be SELECTABLE in the UI but not
-	* picked by default — e.g. Reolink publishes its native Baichuan streams
-	* as `autoEligible: true` (the recommended path) and its RTSP / RTMP
-	* mirrors as `autoEligible: false` (still pickable per slot, just not
-	* the auto choice). Manual `assignProfile` calls remain valid for
-	* non-eligible streams.
-	*/
-	autoEligible: zod.z.boolean().optional(),
-	/**
-	* The profile slot the PUBLISHER says this stream is: `low` for a stream
-	* whose only sensible role is the low-bandwidth one, `high` for a main
-	* stream. Consulted by the broker's automatic ranking
-	* (`rankInitialAssignment`) BEFORE the pixel-count heuristic, and only there:
-	* an operator's manual assignment still wins, and an absent hint is the
-	* pixel-ranked default every camera had before this field existed.
-	*
-	* Why it exists: a camera with ONE stream ranked to `mid` — the slot no
-	* storage class is written for on its own (`recordings` is high|mid,
-	* `recordingsLow` is low) and the one profile scrub does not read. The robot
-	* camera's single 720p relay is a `low` in every respect except the slot the
-	* heuristic put it in.
-	*/
-	profileHint: CamProfileSchema.optional(),
-	/**
-	* Transport-specific opaque metadata. The broker passes it through to
-	* the source reader without inspecting it. Currently used by
-	* `pull-rfc4571` streams to carry the upstream SDP (so the reader can
-	* route RTP packets to the right depacketizer without an in-band
-	* DESCRIBE phase). Other kinds typically leave it undefined.
-	*/
-	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-});
-var ProfileSlotStatusSchema = zod.z.enum([
-	"unassigned",
-	"idle",
-	"connecting",
-	"streaming",
-	"error"
-]);
-var ProfileSlotSchema = zod.z.object({
-	deviceId: zod.z.number().int().nonnegative(),
-	profile: CamProfileSchema,
-	/** Broker id the rest of the system addresses: `${deviceId}/${profile}`. */
-	brokerId: zod.z.string(),
-	/** `null` when the profile is unassigned. */
-	sourceCamStreamId: zod.z.string().nullable(),
-	status: ProfileSlotStatusSchema,
-	resolution: CamStreamResolutionSchema.optional(),
-	codec: zod.z.string().optional(),
-	preBufferSec: zod.z.number().nonnegative().optional(),
-	errorMessage: zod.z.string().optional()
-});
-/** The canonical consumer-facing broker id for a device profile. */
-function makeProfileBrokerId(deviceId, profile) {
-	return `${deviceId}/${profile}`;
+/** Every code a records failure carries. */
+var RECORDS_ERROR_CODES = [
+	"rev-conflict",
+	"too-large",
+	"unindexed-filter",
+	"filter-required",
+	"unknown-kind",
+	"not-found",
+	"unique-violation",
+	"plaintext-secret",
+	"foreign-marker",
+	"secret-unavailable",
+	"invalid-record",
+	"declaration-refused",
+	"adoption-pending",
+	"no-caller",
+	"batch-too-large"
+];
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+/** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
+var RevConflictError = class extends RecordsError {
+	constructor(detail) {
+		super("rev-conflict", detail);
+		this.name = "RevConflictError";
+	}
+};
+/** `data` exceeds the kind's `maxDataBytes`. Bytes are never record fields (D613). */
+var RecordTooLargeError = class extends RecordsError {
+	constructor(detail) {
+		super("too-large", detail);
+		this.name = "RecordTooLargeError";
+	}
+};
+/** A filter, order or aggregate names a field no declared index serves. */
+var UnindexedFilterError = class extends RecordsError {
+	constructor(detail) {
+		super("unindexed-filter", detail);
+		this.name = "UnindexedFilterError";
+	}
+};
+/** A bulk delete with no predicate at all. */
+var FilterRequiredError = class extends RecordsError {
+	constructor(detail) {
+		super("filter-required", detail);
+		this.name = "FilterRequiredError";
+	}
+};
+/** The caller declared no such kind (another addon's kind is indistinguishable from none). */
+var UnknownRecordKindError = class extends RecordsError {
+	constructor(detail) {
+		super("unknown-kind", detail);
+		this.name = "UnknownRecordKindError";
+	}
+};
+var RecordNotFoundError = class extends RecordsError {
+	constructor(detail) {
+		super("not-found", detail);
+		this.name = "RecordNotFoundError";
+	}
+};
+/** A unique index refused the write. */
+var RecordUniqueViolationError = class extends RecordsError {
+	constructor(detail) {
+		super("unique-violation", detail);
+		this.name = "RecordUniqueViolationError";
+	}
+};
+/** A secret field held a plain string where only a keychain marker may be stored. */
+var PlaintextSecretError = class extends RecordsError {
+	constructor(detail) {
+		super("plaintext-secret", detail);
+		this.name = "PlaintextSecretError";
+	}
+};
+/** A marker whose ref is not the row's own (the D878 rule). */
+var ForeignSecretMarkerError = class extends RecordsError {
+	constructor(detail) {
+		super("foreign-marker", detail);
+		this.name = "ForeignSecretMarkerError";
+	}
+};
+/** The keychain could not store or serve a value: explicit, never an empty string. */
+var RecordSecretUnavailableError = class extends RecordsError {
+	constructor(detail) {
+		super("secret-unavailable", detail);
+		this.name = "RecordSecretUnavailableError";
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
+/** A kind is empty while the legacy table it adopts from still holds rows. */
+var AdoptionPendingError = class extends RecordsError {
+	constructor(detail) {
+		super("adoption-pending", detail);
+		this.name = "AdoptionPendingError";
+	}
+};
+var NoCallerError = class extends RecordsError {
+	constructor(detail) {
+		super("no-caller", detail);
+		this.name = "NoCallerError";
+	}
+};
+var BatchTooLargeError = class extends RecordsError {
+	constructor(detail) {
+		super("batch-too-large", detail);
+		this.name = "BatchTooLargeError";
+	}
+};
+var FACTORIES = {
+	"rev-conflict": (d) => new RevConflictError(d),
+	"too-large": (d) => new RecordTooLargeError(d),
+	"unindexed-filter": (d) => new UnindexedFilterError(d),
+	"filter-required": (d) => new FilterRequiredError(d),
+	"unknown-kind": (d) => new UnknownRecordKindError(d),
+	"not-found": (d) => new RecordNotFoundError(d),
+	"unique-violation": (d) => new RecordUniqueViolationError(d),
+	"plaintext-secret": (d) => new PlaintextSecretError(d),
+	"foreign-marker": (d) => new ForeignSecretMarkerError(d),
+	"secret-unavailable": (d) => new RecordSecretUnavailableError(d),
+	"invalid-record": (d) => new InvalidRecordError(d),
+	"declaration-refused": (d) => new DeclarationRefusedError(d),
+	"adoption-pending": (d) => new AdoptionPendingError(d),
+	"no-caller": (d) => new NoCallerError(d),
+	"batch-too-large": (d) => new BatchTooLargeError(d)
+};
+function isCode(value) {
+	return RECORDS_ERROR_CODES.some((code) => code === value);
 }
 /**
-* The broker id keying a physical SOURCE stream: `${deviceId}/${camStreamId}`.
-* This is the broker's internal source key (`brokerIdFor` in the manager) — a
-* `camStreamId` like `native:main` — as opposed to the public profile alias
-* {@link makeProfileBrokerId}. Used to resolve a source's restream endpoint
-* (e.g. routing a transcode's ffmpeg input through the broker so it rides the
-* single source dial instead of opening a second camera connection).
+* Rebuild the typed error from a message that crossed a wire; `null` when the
+* message is not a records failure.
 */
-function makeSourceBrokerId(deviceId, camStreamId) {
-	return `${deviceId}/${camStreamId}`;
+function recordsErrorFromMessage(message) {
+	if (!message.startsWith(PREFIX)) return null;
+	const colon = message.indexOf(": ");
+	if (colon < 0) return null;
+	const code = message.slice(8, colon);
+	if (!isCode(code)) return null;
+	return FACTORIES[code](message.slice(colon + 2));
+}
+/** The records failure inside any thrown value (a wrapped tRPC error included), or the value. */
+function asRecordsError(err) {
+	if (err instanceof RecordsError) return err;
+	if (err instanceof Error) {
+		const typed = recordsErrorFromMessage(err.message);
+		if (typed !== null) return typed;
+	}
+	return err;
 }
+//#endregion
+//#region src/device/zod-secret.ts
 /**
-* Inverse of {@link makeProfileBrokerId}. Returns `null` when the string is
-* not a canonical `${deviceId}/${profile}` id — e.g. a broker-internal
-* cam-stream id (`5/native:main`), a derived/adaptive ref, or a malformed
-* value. So a caller can safely distinguish "addresses a public profile"
-* from "addresses something broker-internal".
+* Secret declaration on a Zod config schema (D783).
+*
+* A field is a secret because its schema SAYS so — `.meta({ secret: true })`,
+* spelled {@link SECRET_META} — never because its key looks like a credential.
+* It is the Zod twin of `secret: true` / `type: 'password'` on a config-UI
+* field (`isSecretConfigField`), and every consumer that treats secrets
+* specially reads it: the settings form (`zodEntriesToConfigUI`), the paths a
+* device advertises at `registerDevice` (`secretConfigPaths`, which the
+* non-admin redaction withholds at any depth), and the keychain later.
+*
+* Zod keeps `.meta()` in `z.globalRegistry`, which lives on `globalThis`, so a
+* declaration made by an addon's own copy of zod is visible here.
 */
-function parseProfileBrokerId(brokerId) {
-	const slash = brokerId.indexOf("/");
-	if (slash <= 0) return null;
-	const idPart = brokerId.slice(0, slash);
-	const profilePart = brokerId.slice(slash + 1);
-	if (!/^\d+$/.test(idPart)) return null;
-	const parsed = CamProfileSchema.safeParse(profilePart);
-	if (!parsed.success) return null;
-	return {
-		deviceId: Number(idPart),
-		profile: parsed.data
-	};
-}
 /**
-* The profile slots worth consuming/recording: ASSIGNED only
-* (`sourceCamStreamId != null`), DEDUPED by physical source so the same
-* camera encoder is never subscribed/recorded twice, ordered high→mid→low.
-* Optionally scoped to one `deviceId`. Pure; never mutates the input.
+* `{ secret: true }` — the one spelling of "this field holds a credential".
 *
-* Recording `main` and `mid` when both point at the same `sourceCamStreamId`
-* would dial the camera's internal stream twice for no benefit — this is the
-* dedup that prevents that.
+* Addons write the LITERAL `.meta({ secret: true })` rather than importing
+* this constant: an addon running against an older `@camstack/types` would
+* otherwise call `.meta(undefined)`, which in zod v4 is the metadata GETTER
+* and returns no schema at all.
 */
-function selectAssignedProfileSlots(slots, deviceId) {
-	const ordered = [...slots].filter((s) => deviceId === void 0 || s.deviceId === deviceId).toSorted((a, b) => CAM_PROFILE_ORDER.indexOf(a.profile) - CAM_PROFILE_ORDER.indexOf(b.profile));
-	const seenSources = /* @__PURE__ */ new Set();
+var SECRET_META = { secret: true };
+function defOf(schema) {
+	return schema._zod?.def ?? {};
+}
+function declaredHere(schema) {
+	return zod.z.globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
 	const out = [];
-	for (const s of ordered) {
-		const src = s.sourceCamStreamId;
-		if (src === null) continue;
-		if (seenSources.has(src)) continue;
-		seenSources.add(src);
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
 		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
 	}
 	return out;
 }
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
 /**
-* Zod schema for StreamSourceEntry — the canonical stream descriptor
-* exposed by ICameraDevice.getStreamSources() and consumed by the broker.
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
+//#endregion
+//#region src/records/secret-paths.ts
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const key = each ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function elementId(element, idKey, declared, prefix) {
+	const id = isRecord$1(element) ? element[idKey] : void 0;
+	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
+	return id;
+}
+/**
+* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
+* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
+* result is a new body, `data` is untouched.
+*/
+var REMOVE_LEAF = Symbol("remove-leaf");
+function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
+	if (!isRecord$1(node)) return node;
+	const segment = segments[index];
+	if (segment === void 0) return node;
+	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
+	const child = node[segment.key];
+	const keys = [...walkedKeys, segment.key];
+	const last = index === segments.length - 1;
+	if (segment.each) {
+		if (!Array.isArray(child)) return node;
+		const prefix = keys.join(".");
+		const idKey = arrayKeys[prefix];
+		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
+		const mapped = child.map((element) => {
+			const id = elementId(element, idKey, declared, prefix);
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
+			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
+		});
+		return {
+			...node,
+			[segment.key]: mapped
+		};
+	}
+	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
+	if (last) {
+		const replacement = visit({
+			declared,
+			concrete,
+			value: child
+		});
+		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
+		return {
+			...node,
+			[segment.key]: replacement
+		};
+	}
+	return {
+		...node,
+		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+	};
+}
+/** Replace/remove every present secret leaf; returns a NEW body. */
+function mapSecretLeaves(data, paths, arrayKeys, visit) {
+	let current = data;
+	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
+	return current;
+}
+/** Every present secret leaf, read-only. */
+function collectSecretLeaves(data, paths, arrayKeys) {
+	const found = [];
+	mapSecretLeaves(data, paths, arrayKeys, (leaf) => {
+		found.push(leaf);
+		return leaf.value;
+	});
+	return found;
+}
+/**
+* The keychain collection name a kind's secrets live under. Prefixed so a
+* record's refs never collide with the refs a legacy collection of the same name
+* already holds during an adoption.
+*/
+function recordSecretCollection(kind) {
+	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
+}
+/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
+function recordSecretRef(owner, kind, rowId, concretePath) {
+	return buildSecretRef({
+		owner,
+		scope: {
+			kind: "row",
+			collection: recordSecretCollection(kind),
+			rowId
+		},
+		fieldPath: concretePath
+	});
+}
+/** A concrete path built from a flat array item, re-exported for adoption tooling. */
+var recordArrayItemPath = arrayItemFieldPath;
+//#endregion
+//#region src/records/record-kind.ts
+/**
+* Record kinds (D881): the declaration an addon makes of one kind of fact, the
+* Zod row schema that describes it, and the helper that turns the two into the
+* JSON the engine stores.
+*
+* A kind is declared ONCE, next to the code that owns it, and the engine's
+* reconciler creates its indexes - nothing creates DDL at runtime from a write.
+* Everything the generic machinery needs (secret fields, the entry descriptor)
+* is DERIVED from the Zod schema: `.meta({ secret: true })` marks a credential,
+* never a field name (D879).
+*/
+/** A JSON field path: `trackId`, `auth.accessToken`. Charset-restricted: it is rendered into DDL. */
+var RecordFieldPathSchema = zod.z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}(\.[A-Za-z_][A-Za-z0-9_]{0,63}){0,3}$/);
+var RecordIndexSchema = zod.z.object({
+	name: zod.z.string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+	fields: zod.z.array(RecordFieldPathSchema).min(1).max(4),
+	unique: zod.z.boolean().optional()
+}).strict();
+var RecordRetentionSchema = zod.z.union([
+	zod.z.object({
+		ttlMs: zod.z.number().int().positive(),
+		from: zod.z.enum(["at", "write"])
+	}).strict(),
+	zod.z.object({
+		maxRows: zod.z.number().int().positive().optional(),
+		maxRowsPerDevice: zod.z.number().int().positive().optional()
+	}).strict().refine((r) => r.maxRows !== void 0 || r.maxRowsPerDevice !== void 0, { message: "name maxRows, maxRowsPerDevice or both" }),
+	zod.z.object({
+		owner: zod.z.string().min(1),
+		reason: zod.z.string().min(1)
+	}).strict(),
+	zod.z.object({ none: zod.z.string().min(1) }).strict()
+]);
+/** The descriptor a generic entries UI reads (D881 "generic entries"). */
+var EntryDescriptorSchema = zod.z.object({
+	title: zod.z.string().min(1),
+	/** The record body field shown as the entry's name. */
+	nameField: zod.z.string().min(1),
+	/** JSON Schema of the entry body; `secret: true` marks a password field. */
+	fields: zod.z.record(zod.z.string(), zod.z.unknown())
+}).strict();
+/** What crosses the wire and sits in the engine's catalog: JSON only, no Zod. */
+var RecordKindDeclarationSchema = zod.z.object({
+	database: zod.z.enum(RECORD_DATABASES).default("settings"),
+	class: zod.z.enum(RECORD_CLASSES),
+	writeTrigger: zod.z.string().min(1),
+	device: zod.z.enum([
+		"required",
+		"optional",
+		"none"
+	]).default("none"),
+	at: zod.z.enum(["required", "none"]).default("none"),
+	indexes: zod.z.array(RecordIndexSchema).max(8).default([]),
+	retention: RecordRetentionSchema,
+	deviceRemoval: zod.z.enum(["delete", "none"]).default("none"),
+	maxDataBytes: zod.z.number().int().positive().max(RECORD_MAX_DATA_BYTES).default(RECORD_DEFAULT_MAX_DATA_BYTES),
+	/** Derived from the Zod schema; never written by hand. */
+	secretPaths: zod.z.array(zod.z.string().min(1)).default([]),
+	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
+	secretArrayKeys: zod.z.record(zod.z.string(), zod.z.string()).default({}),
+	/** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+	adoptsFrom: zod.z.string().min(1).optional(),
+	/** Kinds that must agree through `transact` sit in one file under one family name. */
+	transactFamily: zod.z.string().min(1).optional(),
+	entry: EntryDescriptorSchema.optional()
+}).strict();
+/** The kind names: lower-case, dash separated, short enough for an index name. */
+var RecordKindNameSchema = zod.z.string().regex(/^[a-z][a-z0-9-]{0,47}$/);
+/** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
+function assertValidDeclaration(name, decl) {
+	const refuse = (why) => {
+		throw new DeclarationRefusedError(`kind "${name}": ${why}`);
+	};
+	if (!RecordKindNameSchema.safeParse(name).success) refuse("the name must be lower-case-dashed");
+	const seen = /* @__PURE__ */ new Set();
+	for (const index of decl.indexes) {
+		if (seen.has(index.name)) refuse(`index name "${index.name}" is declared twice`);
+		seen.add(index.name);
+	}
+	const { retention } = decl;
+	const hasSecrets = decl.secretPaths.length > 0;
+	if ("ttlMs" in retention) {
+		if (retention.from === "at" && decl.at !== "required") refuse("a ttl from \"at\" needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use engine TTL (its keychain values would be orphaned)");
+	}
+	if ("maxRows" in retention || "maxRowsPerDevice" in retention) {
+		if (retention.maxRowsPerDevice !== void 0 && decl.device !== "required") refuse("maxRowsPerDevice needs device: \"required\"");
+		if (decl.at !== "required") refuse("a row bound trims the oldest \"at\": it needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use an engine row bound");
+		const bound = Math.max(retention.maxRows ?? 0, retention.maxRowsPerDevice ?? 0);
+		if (decl.database === "settings" && bound > 5e4) refuse(`a row bound above ${RECORD_SETTINGS_MAX_ROWS} belongs in database: "events" (a big delete on the settings thread stalls every configuration read)`);
+	}
+	if (decl.deviceRemoval === "delete" && decl.device === "none") refuse("deviceRemoval: \"delete\" needs a device: \"required\" or \"optional\"");
+	for (const path of decl.secretPaths) for (const prefix of secretArrayPrefixes(path)) if (decl.secretArrayKeys[prefix] === void 0) refuse(`secret path "${path}" crosses the array "${prefix}": declare its id key in secretArrayKeys`);
+}
+function bodyFieldsOf(schema) {
+	return { ...zod.z.toJSONSchema(schema, {
+		unrepresentable: "any",
+		io: "input"
+	}) };
+}
+function isRecordLike(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Does every branch of the body schema carry `field`? (A discriminated union has several.) */
+function hasNameField(json, field) {
+	const branches = json["oneOf"] ?? json["anyOf"];
+	if (Array.isArray(branches)) return branches.length > 0 && branches.every((b) => isRecordLike(b) && hasNameField(b, field));
+	const properties = json["properties"];
+	return isRecordLike(properties) && Object.prototype.hasOwnProperty.call(properties, field);
+}
+/**
+* Declare the kinds of a package. The keys are the kind names. The result is
+* what `ctx.records.declare` sends to the engine and what `ctx.records.kind`
+* types its handle from.
+*/
+function defineRecordKinds(specs) {
+	const out = {};
+	for (const [name, spec] of Object.entries(specs)) {
+		const secretPaths = collectZodSecretPaths(spec.schema);
+		const nameField = spec.entry?.nameField ?? "name";
+		const fields = bodyFieldsOf(spec.schema);
+		if (spec.entry !== void 0 && !hasNameField(fields, nameField)) throw new DeclarationRefusedError(`kind "${name}": an entry kind's schema needs a "${nameField}" field`);
+		const parsed = RecordKindDeclarationSchema.parse({
+			database: spec.database,
+			class: spec.class,
+			writeTrigger: spec.writeTrigger,
+			device: spec.device,
+			at: spec.at,
+			indexes: spec.indexes === void 0 ? void 0 : [...spec.indexes],
+			retention: spec.retention,
+			deviceRemoval: spec.deviceRemoval,
+			maxDataBytes: spec.maxDataBytes,
+			secretPaths: [...secretPaths],
+			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
+			adoptsFrom: spec.adoptsFrom,
+			transactFamily: spec.transactFamily,
+			entry: spec.entry === void 0 ? void 0 : {
+				title: spec.entry.title,
+				nameField,
+				fields
+			}
+		});
+		assertValidDeclaration(name, parsed);
+		out[name] = {
+			name,
+			schema: spec.schema,
+			declaration: parsed
+		};
+	}
+	return out;
+}
+/** The wire form of a package's kinds: name -> declaration. */
+function declarationsOf(kinds) {
+	return Object.fromEntries(Object.entries(kinds).map(([name, kind]) => [name, kind.declaration]));
+}
+//#endregion
+//#region src/records/records-access.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Run a transport call and give a wire failure its typed class back. */
+async function call(fn) {
+	try {
+		return await fn();
+	} catch (err) {
+		throw asRecordsError(err);
+	}
+}
+function zodSummary(error) {
+	return error.issues.slice(0, 5).map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
+}
+function toRow(view, data) {
+	return {
+		id: view.id,
+		deviceId: view.deviceId,
+		at: view.at,
+		expiresAt: view.expiresAt,
+		rev: view.rev,
+		updatedAt: view.updatedAt,
+		data
+	};
+}
+var KindHandle = class {
+	def;
+	o;
+	name;
+	decl;
+	constructor(def, o) {
+		this.def = def;
+		this.o = o;
+		this.name = def.name;
+		this.decl = def.declaration;
+	}
+	get hasSecrets() {
+		return this.decl.secretPaths.length > 0;
+	}
+	requireSecrets() {
+		if (this.o.secrets === null) throw new RecordSecretUnavailableError(`kind "${this.name}" has secret fields and this process has no keychain door`);
+		return this.o.secrets;
+	}
+	/** Read the body as the schema's type. The engine already redacted the secrets. */
+	typed(view) {
+		return toRow(view, view.data);
+	}
+	/**
+	* Classify and store the secret leaves of a body about to be written. The
+	* keychain is written FIRST (a failure throws before any row is touched), and
+	* what each ref held before is remembered: when the row write is then refused
+	* (a stale `ifRev`, too large, a unique index) `rollback` puts the previous
+	* values back, so a refused write never destroys the secret that was stored.
+	*/
+	async storeSecrets(id, body, mode) {
+		if (!this.hasSecrets) return {
+			body,
+			rollback: async () => {}
+		};
+		const secrets = this.requireSecrets();
+		const writes = [];
+		const prepared = mapSecretLeaves(body, this.decl.secretPaths, this.decl.secretArrayKeys, (leaf) => {
+			const intent = classifySecretWrite(leaf.value);
+			if (intent.kind === "clear") return REMOVE_LEAF;
+			if (intent.kind === "keep") {
+				if (mode === "put") return REDACTED_SECRET;
+				if (leaf.value === null) return null;
+				return leaf.concrete.includes("[") ? REDACTED_SECRET : REMOVE_LEAF;
+			}
+			const ref = recordSecretRef(this.o.owner, this.name, id, leaf.concrete);
+			writes.push({
+				ref,
+				value: intent.value
+			});
+			return makeSecretMarker(ref);
+		});
+		const done = [];
+		const rollback = async () => {
+			for (const { ref, previous } of done) try {
+				if (previous === void 0) await secrets.delete([ref]);
+				else await secrets.put(ref, previous);
+			} catch (err) {
+				this.o.logger?.warn("records: could not restore a keychain value after a refused write", { meta: {
+					kind: this.name,
+					error: err instanceof Error ? err.message : "unknown"
+				} });
+			}
+		};
+		for (const write of writes) try {
+			const before = (await secrets.resolve([write.ref]))[write.ref];
+			const previous = before?.kind === "value" ? before.value : void 0;
+			await secrets.put(write.ref, write.value);
+			done.push({
+				ref: write.ref,
+				previous
+			});
+		} catch (err) {
+			await rollback();
+			throw new RecordSecretUnavailableError(`cannot store a secret of ${this.name}/${id}: ${err instanceof Error ? err.message : "the keychain refused"}. Unlock the keychain (System -> Secrets) and save again`);
+		}
+		return {
+			body: prepared,
+			rollback
+		};
+	}
+	async releaseRefs(refs) {
+		if (refs.length === 0 || this.o.secrets === null) return;
+		try {
+			await this.o.secrets.delete(refs);
+		} catch (err) {
+			this.o.logger?.warn("records: could not remove released keychain values", { meta: {
+				kind: this.name,
+				count: refs.length,
+				error: err instanceof Error ? err.message : "unknown"
+			} });
+		}
+	}
+	validate(data, id) {
+		const shaped = this.hasSecrets ? mapSecretLeaves(data, this.decl.secretPaths, this.decl.secretArrayKeys, (leaf) => {
+			const intent = classifySecretWrite(leaf.value);
+			if (intent.kind === "clear") return REMOVE_LEAF;
+			return intent.kind === "keep" ? REDACTED_SECRET : leaf.value;
+		}) : data;
+		const parsed = this.def.schema.safeParse(shaped);
+		if (!parsed.success) throw new InvalidRecordError(`${this.name}/${id}: ${zodSummary(parsed.error)}`);
+		if (!isRecord(parsed.data)) throw new InvalidRecordError(`${this.name}/${id}: the body must be an object`);
+		return parsed.data;
+	}
+	async get(id) {
+		const view = await call(() => this.o.transport.get({
+			kind: this.name,
+			id
+		}));
+		return view === null ? null : this.typed(view);
+	}
+	async getMany(ids) {
+		if (ids.length === 0) return [];
+		return (await call(() => this.o.transport.getMany({
+			kind: this.name,
+			ids: [...ids]
+		}))).map((v) => this.typed(v));
+	}
+	async getResolved(id) {
+		const row = await this.get(id);
+		if (row === null) return null;
+		return (await this.resolveRows([row]))[0] ?? row;
+	}
+	async resolveRows(rows) {
+		if (!this.hasSecrets || rows.length === 0) return rows;
+		const secrets = this.requireSecrets();
+		const refsById = await call(() => this.o.transport.secretRefs({
+			kind: this.name,
+			ids: rows.map((r) => r.id)
+		}));
+		const refs = Object.values(refsById).flatMap((byPath) => Object.values(byPath));
+		if (refs.length === 0) return rows;
+		const answers = await secrets.resolve(refs);
+		return rows.map((row) => {
+			const byPath = refsById[row.id] ?? {};
+			const resolved = mapSecretLeaves(row.data, this.decl.secretPaths, this.decl.secretArrayKeys, (leaf) => {
+				const ref = byPath[leaf.concrete];
+				if (ref === void 0) return leaf.value;
+				const answer = answers[ref];
+				if (answer?.kind === "value") return answer.value;
+				const why = answer?.kind === "unavailable" ? answer.reason : answer?.kind ?? "no answer";
+				throw new RecordSecretUnavailableError(`the secret "${leaf.concrete}" of ${this.name}/${row.id} cannot be served (${why})`);
+			});
+			return {
+				...row,
+				data: resolved
+			};
+		});
+	}
+	async put(input, opts = {}) {
+		const checked = this.validate(input.data, input.id);
+		const { body, rollback } = await this.storeSecrets(input.id, checked, "put");
+		const result = await call(() => this.o.transport.put({
+			kind: this.name,
+			record: {
+				...input,
+				data: toBody(body)
+			},
+			...opts.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+		})).catch(async (err) => {
+			await rollback();
+			throw err;
+		});
+		await this.releaseRefs(result.releasedRefs);
+		return { rev: result.rev };
+	}
+	async putMany(inputs) {
+		if (inputs.length === 0) return { count: 0 };
+		const prepared = [];
+		const rollbacks = [];
+		try {
+			for (const input of inputs) {
+				const checked = this.validate(input.data, input.id);
+				const { body, rollback } = await this.storeSecrets(input.id, checked, "put");
+				rollbacks.push(rollback);
+				prepared.push({
+					...input,
+					data: toBody(body)
+				});
+			}
+		} catch (err) {
+			for (const rollback of rollbacks) await rollback();
+			throw err;
+		}
+		const result = await call(() => this.o.transport.putMany({
+			kind: this.name,
+			records: prepared
+		})).catch(async (err) => {
+			for (const rollback of rollbacks) await rollback();
+			throw err;
+		});
+		await this.releaseRefs(result.releasedRefs);
+		return { count: result.count };
+	}
+	async patch(id, partial, opts = {}) {
+		const { body, rollback } = await this.storeSecrets(id, partial, "patch");
+		const result = await call(() => this.o.transport.patch({
+			kind: this.name,
+			id,
+			data: toBody(body),
+			...opts.at === void 0 ? {} : { at: opts.at },
+			...opts.expiresAt === void 0 ? {} : { expiresAt: opts.expiresAt },
+			...opts.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+		})).catch(async (err) => {
+			await rollback();
+			throw err;
+		});
+		await this.releaseRefs(result.releasedRefs);
+		return { rev: result.rev };
+	}
+	async delete(id) {
+		const result = await call(() => this.o.transport.delete({
+			kind: this.name,
+			id
+		}));
+		await this.releaseRefs(result.secretRefs);
+		return result.deleted;
+	}
+	async deleteMany(ids) {
+		if (ids.length === 0) return 0;
+		const result = await call(() => this.o.transport.deleteMany({
+			kind: this.name,
+			ids: [...ids]
+		}));
+		await this.releaseRefs(result.secretRefs);
+		return result.deleted;
+	}
+	async query(q, opts = {}) {
+		const result = await call(() => this.o.transport.query({
+			...q,
+			kind: this.name,
+			limit: q.limit ?? 100
+		}));
+		const rows = result.records.map((v) => this.typed(v));
+		return {
+			records: opts.resolveSecrets === true ? await this.resolveRows(rows) : rows,
+			nextCursor: result.nextCursor
+		};
+	}
+	async count(q) {
+		return (await call(() => this.o.transport.count({
+			...q,
+			kind: this.name
+		}))).count;
+	}
+	async histogram(q) {
+		return (await call(() => this.o.transport.histogram({
+			...q,
+			kind: this.name
+		}))).buckets;
+	}
+	async aggregate(q) {
+		return (await call(() => this.o.transport.aggregate({
+			...q,
+			kind: this.name
+		}))).rows;
+	}
+	async deleteWhere(q) {
+		const result = await call(() => this.o.transport.deleteWhere({
+			...q,
+			kind: this.name
+		}));
+		await this.releaseRefs(result.secretRefs);
+		return result.deleted;
+	}
+	async allocateId() {
+		return (await call(() => this.o.transport.allocateId({ kind: this.name }))).id;
+	}
+};
+function toBody(value) {
+	if (!isRecord(value)) throw new InvalidRecordError("the record body must be an object");
+	return value;
+}
+/** Build the owner's records handle. */
+function createRecordsAccess(options) {
+	const handles = /* @__PURE__ */ new WeakMap();
+	const delegates = /* @__PURE__ */ new Map();
+	return {
+		owner: options.owner,
+		forOwner: options.transportForOwner === void 0 ? null : (other) => {
+			const existing = delegates.get(other);
+			if (existing !== void 0) return existing;
+			const build = options.transportForOwner;
+			if (build === void 0) throw new Error("forOwner: no delegate transport");
+			const delegate = createRecordsAccess({
+				owner: other,
+				transport: build(other),
+				secrets: options.secrets?.forOwner?.(other) ?? null,
+				...options.logger === void 0 ? {} : { logger: options.logger }
+			});
+			delegates.set(other, delegate);
+			return delegate;
+		},
+		async declare(kinds) {
+			const result = await call(() => options.transport.declareKinds({ kinds: { ...declarationsOf(kinds) } }));
+			const pending = Object.entries(result.kinds).filter((entry) => entry[1].adoptionPending !== null);
+			if (pending.length > 0) throw new AdoptionPendingError(`${pending.map(([name, r]) => r.adoptionPending === null ? name : `${name} (legacy table "${r.adoptionPending.legacyTable}" holds ${r.adoptionPending.legacyRows} rows)`).join(", ")}. Stop the addon and run scripts/hub/records-adopt.ts --copy --apply before starting this build`);
+			return result.kinds;
+		},
+		kind(definition) {
+			const existing = handles.get(definition);
+			if (existing !== void 0) return existing;
+			const handle = new KindHandle(definition, options);
+			handles.set(definition, handle);
+			return handle;
+		},
+		async deleteDevice(deviceId, opts = {}) {
+			const result = await call(() => options.transport.deleteDevice({
+				deviceId,
+				...opts.kinds === void 0 ? {} : { kinds: [...opts.kinds] }
+			}));
+			if (result.secretRefs.length > 0 && options.secrets !== null) try {
+				await options.secrets.delete(result.secretRefs);
+			} catch (err) {
+				options.logger?.warn("records: could not remove released keychain values", { meta: {
+					count: result.secretRefs.length,
+					error: err instanceof Error ? err.message : "unknown"
+				} });
+			}
+			return result.deleted;
+		}
+	};
+}
+//#endregion
+//#region src/records/entry-kind.ts
+/**
+* Entry kinds (D881): every list of user-created entries (notification
+* targets, brokers, LLM profiles) is ONE record kind with an id, a name and a
+* kind-specific body, and the admin UI lists/adds/edits/deletes all of them
+* through the `record-entries` capability with password fields derived from
+* the schema (`.meta({ secret: true })`).
+*/
+/** The body of a plain entry: a name and the fields the kind adds. */
+function entryBody(shape) {
+	return zod.z.object({
+		name: zod.z.string().min(1),
+		...shape
+	});
+}
+/**
+* Declare one entry kind. An entry is configuration: never trimmed by the
+* engine, never aged, belonging to no device.
+*/
+function defineEntryKind(name, spec) {
+	const defined = defineRecordKinds({ [name]: {
+		schema: spec.schema,
+		class: "config",
+		writeTrigger: spec.writeTrigger ?? "an operator adds or edits an entry in the entries UI",
+		retention: { none: "an entry goes only when the operator deletes it" },
+		...spec.database === void 0 ? {} : { database: spec.database },
+		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
+		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
+		...spec.adoptsFrom === void 0 ? {} : { adoptsFrom: spec.adoptsFrom },
+		entry: {
+			title: spec.title,
+			...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
+		}
+	} })[name];
+	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
+	return defined;
+}
+//#endregion
+//#region src/capabilities/schemas/streaming-shared.ts
+/** Shared Zod schemas used across streaming capabilities. */
+var CamProfileSchema = zod.z.enum([
+	"high",
+	"mid",
+	"low"
+]);
+/** Canonical ordering. Hard-coded; never sorted. */
+var CAM_PROFILE_ORDER = [
+	"high",
+	"mid",
+	"low"
+];
+/**
+* Which rung a per-camera consumer listens on: an explicit profile, or `auto`.
+*
+* `auto` is a REAL value, not an absent one — it means "resolve it by the rule
+* that consumer owns". It lives beside `CamProfile` because a rung is the only
+* operator-facing way to name a stream: a cam-stream id is broker-internal and
+* moves when a slot is reassigned, so a stored id silently stops meaning what
+* the operator picked. Today's one user is the audio analyser, whose rule is
+* "the lowest AVAILABLE native rung" (D537).
+*/
+var AudioStreamPickSchema = zod.z.union([CamProfileSchema, zod.z.literal("auto")]);
+var CamStreamKindSchema = zod.z.enum([
+	"pull-rtsp",
+	"pull-rtmp",
+	"pull-http",
+	"pull-flv",
+	"pull-rfc4571",
+	"push-annexb",
+	"derived"
+]);
+var CamStreamResolutionSchema = zod.z.object({
+	width: zod.z.number().int().positive(),
+	height: zod.z.number().int().positive()
+});
+var CameraStreamSchema = zod.z.object({
+	/** Stable, provider-assigned id unique within the (deviceId) scope. */
+	camStreamId: zod.z.string().min(1),
+	deviceId: zod.z.number().int().nonnegative(),
+	kind: CamStreamKindSchema,
+	/** Required for pull-* kinds. Ignored for push-annexb. */
+	url: zod.z.string().optional(),
+	codec: zod.z.string().optional(),
+	resolution: CamStreamResolutionSchema.optional(),
+	fps: zod.z.number().positive().optional(),
+	/** Human label surfaced in the Admin UI "Camera Stream" dropdown. */
+	label: zod.z.string().optional(),
+	/**
+	* Device-level features the publisher advertised (e.g. `battery-operated`).
+	* The broker, snapshot orchestrator, and prebuffer manager all consult
+	* this list to derive policy — relaxed stall watchdog for battery
+	* cams, prebuffer off by default, longer snapshot rate-limit, etc.
+	*
+	* Single source of truth replacing per-stream flags like the
+	* historical `allowStall`: if the publisher knows the camera is
+	* battery-powered, every downstream service derives the right policy
+	* from this list.
+	*/
+	deviceFeatures: zod.z.array(zod.z.string()).optional(),
+	/**
+	* Whether this stream participates in the broker's automatic profile
+	* assignment (`computeInitialAssignment`). Defaults to `true`. Publishers
+	* use `false` when they want a stream to be SELECTABLE in the UI but not
+	* picked by default — e.g. Reolink publishes its native Baichuan streams
+	* as `autoEligible: true` (the recommended path) and its RTSP / RTMP
+	* mirrors as `autoEligible: false` (still pickable per slot, just not
+	* the auto choice). Manual `assignProfile` calls remain valid for
+	* non-eligible streams.
+	*/
+	autoEligible: zod.z.boolean().optional(),
+	/**
+	* The profile slot the PUBLISHER says this stream is: `low` for a stream
+	* whose only sensible role is the low-bandwidth one, `high` for a main
+	* stream. Consulted by the broker's automatic ranking
+	* (`rankInitialAssignment`) BEFORE the pixel-count heuristic, and only there:
+	* an operator's manual assignment still wins, and an absent hint is the
+	* pixel-ranked default every camera had before this field existed.
+	*
+	* Why it exists: a camera with ONE stream ranked to `mid` — the slot no
+	* storage class is written for on its own (`recordings` is high|mid,
+	* `recordingsLow` is low) and the one profile scrub does not read. The robot
+	* camera's single 720p relay is a `low` in every respect except the slot the
+	* heuristic put it in.
+	*/
+	profileHint: CamProfileSchema.optional(),
+	/**
+	* Transport-specific opaque metadata. The broker passes it through to
+	* the source reader without inspecting it. Currently used by
+	* `pull-rfc4571` streams to carry the upstream SDP (so the reader can
+	* route RTP packets to the right depacketizer without an in-band
+	* DESCRIBE phase). Other kinds typically leave it undefined.
+	*/
+	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+});
+var ProfileSlotStatusSchema = zod.z.enum([
+	"unassigned",
+	"idle",
+	"connecting",
+	"streaming",
+	"error"
+]);
+var ProfileSlotSchema = zod.z.object({
+	deviceId: zod.z.number().int().nonnegative(),
+	profile: CamProfileSchema,
+	/** Broker id the rest of the system addresses: `${deviceId}/${profile}`. */
+	brokerId: zod.z.string(),
+	/** `null` when the profile is unassigned. */
+	sourceCamStreamId: zod.z.string().nullable(),
+	status: ProfileSlotStatusSchema,
+	resolution: CamStreamResolutionSchema.optional(),
+	codec: zod.z.string().optional(),
+	preBufferSec: zod.z.number().nonnegative().optional(),
+	errorMessage: zod.z.string().optional()
+});
+/** The canonical consumer-facing broker id for a device profile. */
+function makeProfileBrokerId(deviceId, profile) {
+	return `${deviceId}/${profile}`;
+}
+/**
+* The broker id keying a physical SOURCE stream: `${deviceId}/${camStreamId}`.
+* This is the broker's internal source key (`brokerIdFor` in the manager) — a
+* `camStreamId` like `native:main` — as opposed to the public profile alias
+* {@link makeProfileBrokerId}. Used to resolve a source's restream endpoint
+* (e.g. routing a transcode's ffmpeg input through the broker so it rides the
+* single source dial instead of opening a second camera connection).
+*/
+function makeSourceBrokerId(deviceId, camStreamId) {
+	return `${deviceId}/${camStreamId}`;
+}
+/**
+* Inverse of {@link makeProfileBrokerId}. Returns `null` when the string is
+* not a canonical `${deviceId}/${profile}` id — e.g. a broker-internal
+* cam-stream id (`5/native:main`), a derived/adaptive ref, or a malformed
+* value. So a caller can safely distinguish "addresses a public profile"
+* from "addresses something broker-internal".
+*/
+function parseProfileBrokerId(brokerId) {
+	const slash = brokerId.indexOf("/");
+	if (slash <= 0) return null;
+	const idPart = brokerId.slice(0, slash);
+	const profilePart = brokerId.slice(slash + 1);
+	if (!/^\d+$/.test(idPart)) return null;
+	const parsed = CamProfileSchema.safeParse(profilePart);
+	if (!parsed.success) return null;
+	return {
+		deviceId: Number(idPart),
+		profile: parsed.data
+	};
+}
+/**
+* The profile slots worth consuming/recording: ASSIGNED only
+* (`sourceCamStreamId != null`), DEDUPED by physical source so the same
+* camera encoder is never subscribed/recorded twice, ordered high→mid→low.
+* Optionally scoped to one `deviceId`. Pure; never mutates the input.
+*
+* Recording `main` and `mid` when both point at the same `sourceCamStreamId`
+* would dial the camera's internal stream twice for no benefit — this is the
+* dedup that prevents that.
+*/
+function selectAssignedProfileSlots(slots, deviceId) {
+	const ordered = [...slots].filter((s) => deviceId === void 0 || s.deviceId === deviceId).toSorted((a, b) => CAM_PROFILE_ORDER.indexOf(a.profile) - CAM_PROFILE_ORDER.indexOf(b.profile));
+	const seenSources = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const s of ordered) {
+		const src = s.sourceCamStreamId;
+		if (src === null) continue;
+		if (seenSources.has(src)) continue;
+		seenSources.add(src);
+		out.push(s);
+	}
+	return out;
+}
+/**
+* Zod schema for StreamSourceEntry — the canonical stream descriptor
+* exposed by ICameraDevice.getStreamSources() and consumed by the broker.
 */
 var StreamSourceEntrySchema$1 = zod.z.object({
 	id: zod.z.string(),
@@ -4507,123 +5482,35 @@ var DEFAULT_TOKEN_EXPIRY = "30d";
 * Moved from @camstack/system/config-schema to @camstack/types so that
 * @camstack/system can reference it without a cross-package kernel import.
 */
-var RUNTIME_DEFAULTS = {
-	"features.streaming": true,
-	"features.notifications": true,
-	"features.objectDetection": false,
-	"features.remoteAccess": true,
-	"features.agentCluster": false,
-	"features.smartHome": true,
-	"features.recordings": true,
-	"features.backup": true,
-	"features.repl": true,
-	"retention.detectionEventsDays": 30,
-	"retention.audioLevelsDays": 7,
-	"logging.level": "info",
-	"logging.retentionDays": 30,
-	"eventBus.ringBufferSize": 1e4,
-	"storage.provider": "sqlite-storage",
-	"storage.locations": {
-		data: "camstack-data/data",
-		media: "camstack-data/media",
-		recordings: "camstack-data/recordings",
-		cache: "/tmp/camstack-cache",
-		logs: "camstack-data/logs",
-		models: "camstack-data/models"
-	},
-	providers: [],
-	"ffmpeg.hwAccel": "auto",
-	"ffmpeg.threadCount": 0,
-	"auth.tokenExpiry": "30d"
-};
-//#endregion
-//#region src/device/zod-secret.ts
-/**
-* Secret declaration on a Zod config schema (D783).
-*
-* A field is a secret because its schema SAYS so — `.meta({ secret: true })`,
-* spelled {@link SECRET_META} — never because its key looks like a credential.
-* It is the Zod twin of `secret: true` / `type: 'password'` on a config-UI
-* field (`isSecretConfigField`), and every consumer that treats secrets
-* specially reads it: the settings form (`zodEntriesToConfigUI`), the paths a
-* device advertises at `registerDevice` (`secretConfigPaths`, which the
-* non-admin redaction withholds at any depth), and the keychain later.
-*
-* Zod keeps `.meta()` in `z.globalRegistry`, which lives on `globalThis`, so a
-* declaration made by an addon's own copy of zod is visible here.
-*/
-/**
-* `{ secret: true }` — the one spelling of "this field holds a credential".
-*
-* Addons write the LITERAL `.meta({ secret: true })` rather than importing
-* this constant: an addon running against an older `@camstack/types` would
-* otherwise call `.meta(undefined)`, which in zod v4 is the metadata GETTER
-* and returns no schema at all.
-*/
-var SECRET_META = { secret: true };
-function defOf(schema) {
-	return schema._zod?.def ?? {};
-}
-function declaredHere(schema) {
-	return zod.z.globalRegistry.get(schema)?.secret === true;
-}
-/** Wrapper kinds whose `innerType` is the field itself. */
-var WRAPPERS = new Set([
-	"optional",
-	"nullable",
-	"default",
-	"prefault",
-	"catch",
-	"readonly",
-	"nonoptional"
-]);
-/**
-* The schema layers that make up ONE field: the schema itself and every
-* wrapper below it (optional / default / nullable / readonly / catch), plus
-* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
-* `.transform` on `in`).
-*/
-function layersOf(schema) {
-	const out = [];
-	const queue = [schema];
-	while (queue.length > 0) {
-		const s = queue.shift();
-		if (!s || out.includes(s)) continue;
-		out.push(s);
-		const def = defOf(s);
-		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
-		if (def.type === "pipe") {
-			if (def.in) queue.push(def.in);
-			if (def.out) queue.push(def.out);
-		}
-	}
-	return out;
-}
-/** True when any layer of this field declares `.meta({ secret: true })`. */
-function isZodSecret(schema) {
-	return layersOf(schema).some(declaredHere);
-}
-/**
-* Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
-* object or array is reported as one path and not descended into — everything
-* under it is secret.
-*/
-function collectZodSecretPaths(schema, prefix = "") {
-	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
-	const paths = [];
-	for (const layer of layersOf(schema)) {
-		const def = defOf(layer);
-		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
-		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
-		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
-		else if (def.type === "intersection") {
-			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
-			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
-		}
-	}
-	return [...new Set(paths)];
-}
+var RUNTIME_DEFAULTS = {
+	"features.streaming": true,
+	"features.notifications": true,
+	"features.objectDetection": false,
+	"features.remoteAccess": true,
+	"features.agentCluster": false,
+	"features.smartHome": true,
+	"features.recordings": true,
+	"features.backup": true,
+	"features.repl": true,
+	"retention.detectionEventsDays": 30,
+	"retention.audioLevelsDays": 7,
+	"logging.level": "info",
+	"logging.retentionDays": 30,
+	"eventBus.ringBufferSize": 1e4,
+	"storage.provider": "sqlite-storage",
+	"storage.locations": {
+		data: "camstack-data/data",
+		media: "camstack-data/media",
+		recordings: "camstack-data/recordings",
+		cache: "/tmp/camstack-cache",
+		logs: "camstack-data/logs",
+		models: "camstack-data/models"
+	},
+	providers: [],
+	"ffmpeg.hwAccel": "auto",
+	"ffmpeg.threadCount": 0,
+	"auth.tokenExpiry": "30d"
+};
 //#endregion
 //#region src/device/device-state-handle.ts
 var DEVICE_STATE_EVENT_CATEGORY = "device.state-changed";
@@ -6193,6 +7080,12 @@ Object.defineProperty(exports, "AUDIO_CHUNK_FORMATS", {
 		return AUDIO_CHUNK_FORMATS;
 	}
 });
+Object.defineProperty(exports, "AdoptionPendingError", {
+	enumerable: true,
+	get: function() {
+		return AdoptionPendingError;
+	}
+});
 Object.defineProperty(exports, "AudioChunkFormatSchema", {
 	enumerable: true,
 	get: function() {
@@ -6217,6 +7110,12 @@ Object.defineProperty(exports, "BaseAddon", {
 		return BaseAddon;
 	}
 });
+Object.defineProperty(exports, "BatchTooLargeError", {
+	enumerable: true,
+	get: function() {
+		return BatchTooLargeError;
+	}
+});
 Object.defineProperty(exports, "BrokerStatsSchema", {
 	enumerable: true,
 	get: function() {
@@ -6313,6 +7212,12 @@ Object.defineProperty(exports, "DEVICE_STATUS_METHOD", {
 		return DEVICE_STATUS_METHOD;
 	}
 });
+Object.defineProperty(exports, "DeclarationRefusedError", {
+	enumerable: true,
+	get: function() {
+		return DeclarationRefusedError;
+	}
+});
 Object.defineProperty(exports, "DecodedAudioChunkSchema", {
 	enumerable: true,
 	get: function() {
@@ -6325,6 +7230,12 @@ Object.defineProperty(exports, "DisposerChain", {
 		return DisposerChain;
 	}
 });
+Object.defineProperty(exports, "EntryDescriptorSchema", {
+	enumerable: true,
+	get: function() {
+		return EntryDescriptorSchema;
+	}
+});
 Object.defineProperty(exports, "ErrorCodeSchema", {
 	enumerable: true,
 	get: function() {
@@ -6337,6 +7248,18 @@ Object.defineProperty(exports, "ErrorI18nPayloadSchema", {
 		return ErrorI18nPayloadSchema;
 	}
 });
+Object.defineProperty(exports, "FilterRequiredError", {
+	enumerable: true,
+	get: function() {
+		return FilterRequiredError;
+	}
+});
+Object.defineProperty(exports, "ForeignSecretMarkerError", {
+	enumerable: true,
+	get: function() {
+		return ForeignSecretMarkerError;
+	}
+});
 Object.defineProperty(exports, "FrameHandleSchema", {
 	enumerable: true,
 	get: function() {
@@ -6367,6 +7290,12 @@ Object.defineProperty(exports, "HISTORY_UNIT_LABELS", {
 		return HISTORY_UNIT_LABELS;
 	}
 });
+Object.defineProperty(exports, "InvalidRecordError", {
+	enumerable: true,
+	get: function() {
+		return InvalidRecordError;
+	}
+});
 Object.defineProperty(exports, "KeychainWriteRefusedError", {
 	enumerable: true,
 	get: function() {
@@ -6385,6 +7314,12 @@ Object.defineProperty(exports, "MODEL_FORMATS", {
 		return MODEL_FORMATS;
 	}
 });
+Object.defineProperty(exports, "NoCallerError", {
+	enumerable: true,
+	get: function() {
+		return NoCallerError;
+	}
+});
 Object.defineProperty(exports, "PEER_BYTES_CHUNK_BYTES", {
 	enumerable: true,
 	get: function() {
@@ -6421,6 +7356,12 @@ Object.defineProperty(exports, "PeerBytesTicketSchema", {
 		return PeerBytesTicketSchema;
 	}
 });
+Object.defineProperty(exports, "PlaintextSecretError", {
+	enumerable: true,
+	get: function() {
+		return PlaintextSecretError;
+	}
+});
 Object.defineProperty(exports, "ProfileRtspEntrySchema", {
 	enumerable: true,
 	get: function() {
@@ -6439,12 +7380,108 @@ Object.defineProperty(exports, "ProfileSlotStatusSchema", {
 		return ProfileSlotStatusSchema;
 	}
 });
+Object.defineProperty(exports, "RECORDS_ERROR_CODES", {
+	enumerable: true,
+	get: function() {
+		return RECORDS_ERROR_CODES;
+	}
+});
+Object.defineProperty(exports, "RECORD_BATCH_MAX", {
+	enumerable: true,
+	get: function() {
+		return RECORD_BATCH_MAX;
+	}
+});
+Object.defineProperty(exports, "RECORD_BATCH_MAX_BYTES", {
+	enumerable: true,
+	get: function() {
+		return RECORD_BATCH_MAX_BYTES;
+	}
+});
+Object.defineProperty(exports, "RECORD_CLASSES", {
+	enumerable: true,
+	get: function() {
+		return RECORD_CLASSES;
+	}
+});
+Object.defineProperty(exports, "RECORD_DATABASES", {
+	enumerable: true,
+	get: function() {
+		return RECORD_DATABASES;
+	}
+});
+Object.defineProperty(exports, "RECORD_DEFAULT_MAX_DATA_BYTES", {
+	enumerable: true,
+	get: function() {
+		return RECORD_DEFAULT_MAX_DATA_BYTES;
+	}
+});
+Object.defineProperty(exports, "RECORD_DELETE_BATCH", {
+	enumerable: true,
+	get: function() {
+		return RECORD_DELETE_BATCH;
+	}
+});
+Object.defineProperty(exports, "RECORD_ID_MAX_LENGTH", {
+	enumerable: true,
+	get: function() {
+		return RECORD_ID_MAX_LENGTH;
+	}
+});
+Object.defineProperty(exports, "RECORD_MAX_DATA_BYTES", {
+	enumerable: true,
+	get: function() {
+		return RECORD_MAX_DATA_BYTES;
+	}
+});
+Object.defineProperty(exports, "RECORD_MAX_INDEXES", {
+	enumerable: true,
+	get: function() {
+		return RECORD_MAX_INDEXES;
+	}
+});
+Object.defineProperty(exports, "RECORD_MAX_INDEX_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return RECORD_MAX_INDEX_FIELDS;
+	}
+});
+Object.defineProperty(exports, "RECORD_QUERY_MAX", {
+	enumerable: true,
+	get: function() {
+		return RECORD_QUERY_MAX;
+	}
+});
+Object.defineProperty(exports, "RECORD_SECRET_COLLECTION_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return RECORD_SECRET_COLLECTION_PREFIX;
+	}
+});
+Object.defineProperty(exports, "RECORD_SETTINGS_MAX_ROWS", {
+	enumerable: true,
+	get: function() {
+		return RECORD_SETTINGS_MAX_ROWS;
+	}
+});
+Object.defineProperty(exports, "RECORD_SWEEP_INTERVAL_MS", {
+	enumerable: true,
+	get: function() {
+		return RECORD_SWEEP_INTERVAL_MS;
+	}
+});
 Object.defineProperty(exports, "REDACTED_SECRET", {
 	enumerable: true,
 	get: function() {
 		return REDACTED_SECRET;
 	}
 });
+Object.defineProperty(exports, "REMOVE_LEAF", {
+	enumerable: true,
+	get: function() {
+		return REMOVE_LEAF;
+	}
+});
 Object.defineProperty(exports, "REVALIDATE_AFTER_MS", {
 	enumerable: true,
 	get: function() {
@@ -6475,6 +7512,72 @@ Object.defineProperty(exports, "ReadinessTimeoutError", {
 		return ReadinessTimeoutError;
 	}
 });
+Object.defineProperty(exports, "RecordFieldPathSchema", {
+	enumerable: true,
+	get: function() {
+		return RecordFieldPathSchema;
+	}
+});
+Object.defineProperty(exports, "RecordIndexSchema", {
+	enumerable: true,
+	get: function() {
+		return RecordIndexSchema;
+	}
+});
+Object.defineProperty(exports, "RecordKindDeclarationSchema", {
+	enumerable: true,
+	get: function() {
+		return RecordKindDeclarationSchema;
+	}
+});
+Object.defineProperty(exports, "RecordKindNameSchema", {
+	enumerable: true,
+	get: function() {
+		return RecordKindNameSchema;
+	}
+});
+Object.defineProperty(exports, "RecordNotFoundError", {
+	enumerable: true,
+	get: function() {
+		return RecordNotFoundError;
+	}
+});
+Object.defineProperty(exports, "RecordRetentionSchema", {
+	enumerable: true,
+	get: function() {
+		return RecordRetentionSchema;
+	}
+});
+Object.defineProperty(exports, "RecordSecretUnavailableError", {
+	enumerable: true,
+	get: function() {
+		return RecordSecretUnavailableError;
+	}
+});
+Object.defineProperty(exports, "RecordTooLargeError", {
+	enumerable: true,
+	get: function() {
+		return RecordTooLargeError;
+	}
+});
+Object.defineProperty(exports, "RecordUniqueViolationError", {
+	enumerable: true,
+	get: function() {
+		return RecordUniqueViolationError;
+	}
+});
+Object.defineProperty(exports, "RecordsError", {
+	enumerable: true,
+	get: function() {
+		return RecordsError;
+	}
+});
+Object.defineProperty(exports, "RevConflictError", {
+	enumerable: true,
+	get: function() {
+		return RevConflictError;
+	}
+});
 Object.defineProperty(exports, "SECRET_CLEAR", {
 	enumerable: true,
 	get: function() {
@@ -6523,6 +7626,18 @@ Object.defineProperty(exports, "SubscribeAudioChunksResultSchema", {
 		return SubscribeAudioChunksResultSchema;
 	}
 });
+Object.defineProperty(exports, "UnindexedFilterError", {
+	enumerable: true,
+	get: function() {
+		return UnindexedFilterError;
+	}
+});
+Object.defineProperty(exports, "UnknownRecordKindError", {
+	enumerable: true,
+	get: function() {
+		return UnknownRecordKindError;
+	}
+});
 Object.defineProperty(exports, "WELL_KNOWN_TABS", {
 	enumerable: true,
 	get: function() {
@@ -6571,12 +7686,24 @@ Object.defineProperty(exports, "asNumber", {
 		return asNumber;
 	}
 });
+Object.defineProperty(exports, "asRecordsError", {
+	enumerable: true,
+	get: function() {
+		return asRecordsError;
+	}
+});
 Object.defineProperty(exports, "asString", {
 	enumerable: true,
 	get: function() {
 		return asString;
 	}
 });
+Object.defineProperty(exports, "assertValidDeclaration", {
+	enumerable: true,
+	get: function() {
+		return assertValidDeclaration;
+	}
+});
 Object.defineProperty(exports, "audioChunkBytesPerSample", {
 	enumerable: true,
 	get: function() {
@@ -6631,6 +7758,12 @@ Object.defineProperty(exports, "collectSecretConfigKeys", {
 		return collectSecretConfigKeys;
 	}
 });
+Object.defineProperty(exports, "collectSecretLeaves", {
+	enumerable: true,
+	get: function() {
+		return collectSecretLeaves;
+	}
+});
 Object.defineProperty(exports, "collectSecretMarkerRefs", {
 	enumerable: true,
 	get: function() {
@@ -6679,6 +7812,12 @@ Object.defineProperty(exports, "createMirrorSource", {
 		return createMirrorSource;
 	}
 });
+Object.defineProperty(exports, "createRecordsAccess", {
+	enumerable: true,
+	get: function() {
+		return createRecordsAccess;
+	}
+});
 Object.defineProperty(exports, "createSecretsAccess", {
 	enumerable: true,
 	get: function() {
@@ -6697,12 +7836,30 @@ Object.defineProperty(exports, "customAction", {
 		return customAction;
 	}
 });
+Object.defineProperty(exports, "declarationsOf", {
+	enumerable: true,
+	get: function() {
+		return declarationsOf;
+	}
+});
 Object.defineProperty(exports, "defineCustomActions", {
 	enumerable: true,
 	get: function() {
 		return defineCustomActions;
 	}
 });
+Object.defineProperty(exports, "defineEntryKind", {
+	enumerable: true,
+	get: function() {
+		return defineEntryKind;
+	}
+});
+Object.defineProperty(exports, "defineRecordKinds", {
+	enumerable: true,
+	get: function() {
+		return defineRecordKinds;
+	}
+});
 Object.defineProperty(exports, "describeCustomActions", {
 	enumerable: true,
 	get: function() {
@@ -6733,6 +7890,12 @@ Object.defineProperty(exports, "emitReadiness", {
 		return emitReadiness;
 	}
 });
+Object.defineProperty(exports, "entryBody", {
+	enumerable: true,
+	get: function() {
+		return entryBody;
+	}
+});
 Object.defineProperty(exports, "event", {
 	enumerable: true,
 	get: function() {
@@ -6883,6 +8046,12 @@ Object.defineProperty(exports, "makeSourceBrokerId", {
 		return makeSourceBrokerId;
 	}
 });
+Object.defineProperty(exports, "mapSecretLeaves", {
+	enumerable: true,
+	get: function() {
+		return mapSecretLeaves;
+	}
+});
 Object.defineProperty(exports, "maskUrlCredentials", {
 	enumerable: true,
 	get: function() {
@@ -6955,6 +8124,12 @@ Object.defineProperty(exports, "parseProfileBrokerId", {
 		return parseProfileBrokerId;
 	}
 });
+Object.defineProperty(exports, "parseSecretPath", {
+	enumerable: true,
+	get: function() {
+		return parseSecretPath;
+	}
+});
 Object.defineProperty(exports, "parseSecretRef", {
 	enumerable: true,
 	get: function() {
@@ -6985,6 +8160,30 @@ Object.defineProperty(exports, "readinessKey", {
 		return readinessKey;
 	}
 });
+Object.defineProperty(exports, "recordArrayItemPath", {
+	enumerable: true,
+	get: function() {
+		return recordArrayItemPath;
+	}
+});
+Object.defineProperty(exports, "recordSecretCollection", {
+	enumerable: true,
+	get: function() {
+		return recordSecretCollection;
+	}
+});
+Object.defineProperty(exports, "recordSecretRef", {
+	enumerable: true,
+	get: function() {
+		return recordSecretRef;
+	}
+});
+Object.defineProperty(exports, "recordsErrorFromMessage", {
+	enumerable: true,
+	get: function() {
+		return recordsErrorFromMessage;
+	}
+});
 Object.defineProperty(exports, "registerKnownSecret", {
 	enumerable: true,
 	get: function() {
@@ -7033,6 +8232,12 @@ Object.defineProperty(exports, "scrubKnownSecrets", {
 		return scrubKnownSecrets;
 	}
 });
+Object.defineProperty(exports, "secretArrayPrefixes", {
+	enumerable: true,
+	get: function() {
+		return secretArrayPrefixes;
+	}
+});
 Object.defineProperty(exports, "secretTreeFromPaths", {
 	enumerable: true,
 	get: function() {