@camstack/types 1.2.379 → 1.2.381

package/dist/{sleep-D-Q2_Mcd.mjs → sleep-bZIhUvjd.mjs}

@@ -162,7 +162,7 @@ function collectKeychainStoredKeys(schema) {
 	return keys;
 }
 function walkKeychainField(field, out) {
-	if (!isRecord$3(field)) return;
+	if (!isRecord$6(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	const isSecret = type === "password" || field["secret"] === true;
@@ -187,21 +187,21 @@ function schemaDeclaresAnyField(schema) {
 	for (const section of sectionsOf(schema)) if (fieldsOf(section).length > 0) return true;
 	return false;
 }
-function isRecord$3(value) {
+function isRecord$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sectionsOf(schema) {
-	if (!isRecord$3(schema)) return [];
+	if (!isRecord$6(schema)) return [];
 	const sections = schema["sections"];
 	return Array.isArray(sections) ? sections : [];
 }
 function fieldsOf(node) {
-	if (!isRecord$3(node)) return [];
+	if (!isRecord$6(node)) return [];
 	const fields = node["fields"];
 	return Array.isArray(fields) ? fields : [];
 }
 function walkField(field, out) {
-	if (!isRecord$3(field)) return;
+	if (!isRecord$6(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
@@ -241,7 +241,7 @@ function walkField(field, out) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$2(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -252,19 +252,19 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$5(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 /** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
 function isSecretMarkerLike(value) {
-	return isRecord$2(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+	return isRecord$5(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
 }
 function isSecretClear(value) {
-	return isRecord$2(value) && value["$secretClear"] === true;
+	return isRecord$5(value) && value["$secretClear"] === true;
 }
 function isSecretFieldView(value) {
-	return isRecord$2(value) && value["set"] === true && isSecretMarkerLike(value);
+	return isRecord$5(value) && value["set"] === true && isSecretMarkerLike(value);
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -677,6 +677,33 @@ function typeOf(field) {
 		default: return "other";
 	}
 }
+/** Strip inline `value` from a hydrated field for schema-only round-trips. */
+function dehydrateConfigField(field) {
+	if (field.type === "group") return {
+		...field,
+		fields: field.fields.map(dehydrateConfigField)
+	};
+	if (field.type === "sub-tabs") return {
+		...field,
+		tabs: field.tabs.map((tab) => ({
+			...tab,
+			fields: tab.fields.map(dehydrateConfigField)
+		}))
+	};
+	if (isValuelessField(field)) return field;
+	const { value: _drop, ...rest } = field;
+	return rest;
+}
+/** Inverse of {@link hydrateSchema} — drops resolved values from every leaf field. */
+function dehydrateSchema(schema) {
+	return {
+		...schema.tabs ? { tabs: [...schema.tabs] } : {},
+		sections: schema.sections.map((section) => ({
+			...section,
+			fields: section.fields.map(dehydrateConfigField)
+		}))
+	};
+}
 //#endregion
 //#region src/interfaces/event-bus.ts
 /**
@@ -1018,7 +1045,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$1(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -1031,7 +1058,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$4(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -1086,7 +1113,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$4) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -1102,7 +1129,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$1(row)) {
+		if (!isRecord$4(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -1127,7 +1154,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$1(incoming)) {
+			if (!isRecord$4(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -1135,7 +1162,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$1(stored) ? stored : {};
+			const storedObj = isRecord$4(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -1258,7 +1285,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$1(v)) {
+		if (isRecord$4(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -1292,7 +1319,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -1321,7 +1348,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord(item) && isRecord(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$3(item) && isRecord$3(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -1332,7 +1359,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord(value) && isRecord(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$3(value) && isRecord$3(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -1340,7 +1367,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord(incoming) || !isRecord(stored)) return incoming;
+	if (!isRecord$3(incoming) || !isRecord$3(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -1371,7 +1398,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord(a) && isRecord(b)) {
+	if (isRecord$3(a) && isRecord$3(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -1395,7 +1422,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -2202,7 +2229,7 @@ var BaseAddon = class {
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
-			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
+			ctx.api.addons.restartAddon.mutate({ addonId }).then(() => {
 				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
@@ -3122,6 +3149,1297 @@ async function resolveSecretViewsIn(args, secrets) {
 	return swap(args).value;
 }
 //#endregion
+//#region src/records/constants.ts
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_ID_MAX_LENGTH = 256;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_BATCH_MAX_BYTES = 4 * 1024 * 1024;
+var RECORD_QUERY_MAX = 1e3;
+/** Rows one DELETE statement removes before the serving thread yields. */
+var RECORD_DELETE_BATCH = 5e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+var RECORD_MAX_INDEXES = 8;
+var RECORD_MAX_INDEX_FIELDS = 4;
+/** The engine's TTL sweep cadence. */
+var RECORD_SWEEP_INTERVAL_MS = 10 * 6e4;
+/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
+var RECORD_SECRET_COLLECTION_PREFIX = "records:";
+//#endregion
+//#region src/records/errors.ts
+/**
+* The named failures of `ctx.records` (D881).
+*
+* A records call crosses a worker thread, a UDS channel and a tRPC router, and
+* an error class does not survive any of them - only its message does. So
+* every message STARTS with a stable code, `records/<code>: <detail>`, and
+* {@link recordsErrorFromMessage} rebuilds the typed class on the caller's side.
+* A failed read is never `[]` or `undefined`: it throws one of these.
+*/
+/** Every code a records failure carries. */
+var RECORDS_ERROR_CODES = [
+	"rev-conflict",
+	"too-large",
+	"unindexed-filter",
+	"filter-required",
+	"unknown-kind",
+	"not-found",
+	"unique-violation",
+	"plaintext-secret",
+	"foreign-marker",
+	"secret-unavailable",
+	"invalid-record",
+	"declaration-refused",
+	"adoption-pending",
+	"no-caller",
+	"batch-too-large"
+];
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+/** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
+var RevConflictError = class extends RecordsError {
+	constructor(detail) {
+		super("rev-conflict", detail);
+		this.name = "RevConflictError";
+	}
+};
+/** `data` exceeds the kind's `maxDataBytes`. Bytes are never record fields (D613). */
+var RecordTooLargeError = class extends RecordsError {
+	constructor(detail) {
+		super("too-large", detail);
+		this.name = "RecordTooLargeError";
+	}
+};
+/** A filter, order or aggregate names a field no declared index serves. */
+var UnindexedFilterError = class extends RecordsError {
+	constructor(detail) {
+		super("unindexed-filter", detail);
+		this.name = "UnindexedFilterError";
+	}
+};
+/** A bulk delete with no predicate at all. */
+var FilterRequiredError = class extends RecordsError {
+	constructor(detail) {
+		super("filter-required", detail);
+		this.name = "FilterRequiredError";
+	}
+};
+/** The caller declared no such kind (another addon's kind is indistinguishable from none). */
+var UnknownRecordKindError = class extends RecordsError {
+	constructor(detail) {
+		super("unknown-kind", detail);
+		this.name = "UnknownRecordKindError";
+	}
+};
+var RecordNotFoundError = class extends RecordsError {
+	constructor(detail) {
+		super("not-found", detail);
+		this.name = "RecordNotFoundError";
+	}
+};
+/** A unique index refused the write. */
+var RecordUniqueViolationError = class extends RecordsError {
+	constructor(detail) {
+		super("unique-violation", detail);
+		this.name = "RecordUniqueViolationError";
+	}
+};
+/** A secret field held a plain string where only a keychain marker may be stored. */
+var PlaintextSecretError = class extends RecordsError {
+	constructor(detail) {
+		super("plaintext-secret", detail);
+		this.name = "PlaintextSecretError";
+	}
+};
+/** A marker whose ref is not the row's own (the D878 rule). */
+var ForeignSecretMarkerError = class extends RecordsError {
+	constructor(detail) {
+		super("foreign-marker", detail);
+		this.name = "ForeignSecretMarkerError";
+	}
+};
+/** The keychain could not store or serve a value: explicit, never an empty string. */
+var RecordSecretUnavailableError = class extends RecordsError {
+	constructor(detail) {
+		super("secret-unavailable", detail);
+		this.name = "RecordSecretUnavailableError";
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
+/** A kind is empty while the legacy table it adopts from still holds rows. */
+var AdoptionPendingError = class extends RecordsError {
+	constructor(detail) {
+		super("adoption-pending", detail);
+		this.name = "AdoptionPendingError";
+	}
+};
+var NoCallerError = class extends RecordsError {
+	constructor(detail) {
+		super("no-caller", detail);
+		this.name = "NoCallerError";
+	}
+};
+var BatchTooLargeError = class extends RecordsError {
+	constructor(detail) {
+		super("batch-too-large", detail);
+		this.name = "BatchTooLargeError";
+	}
+};
+var FACTORIES = {
+	"rev-conflict": (d) => new RevConflictError(d),
+	"too-large": (d) => new RecordTooLargeError(d),
+	"unindexed-filter": (d) => new UnindexedFilterError(d),
+	"filter-required": (d) => new FilterRequiredError(d),
+	"unknown-kind": (d) => new UnknownRecordKindError(d),
+	"not-found": (d) => new RecordNotFoundError(d),
+	"unique-violation": (d) => new RecordUniqueViolationError(d),
+	"plaintext-secret": (d) => new PlaintextSecretError(d),
+	"foreign-marker": (d) => new ForeignSecretMarkerError(d),
+	"secret-unavailable": (d) => new RecordSecretUnavailableError(d),
+	"invalid-record": (d) => new InvalidRecordError(d),
+	"declaration-refused": (d) => new DeclarationRefusedError(d),
+	"adoption-pending": (d) => new AdoptionPendingError(d),
+	"no-caller": (d) => new NoCallerError(d),
+	"batch-too-large": (d) => new BatchTooLargeError(d)
+};
+function isCode(value) {
+	return RECORDS_ERROR_CODES.some((code) => code === value);
+}
+/**
+* Rebuild the typed error from a message that crossed a wire; `null` when the
+* message is not a records failure.
+*/
+function recordsErrorFromMessage(message) {
+	if (!message.startsWith(PREFIX)) return null;
+	const colon = message.indexOf(": ");
+	if (colon < 0) return null;
+	const code = message.slice(8, colon);
+	if (!isCode(code)) return null;
+	return FACTORIES[code](message.slice(colon + 2));
+}
+/** The records failure inside any thrown value (a wrapped tRPC error included), or the value. */
+function asRecordsError(err) {
+	if (err instanceof RecordsError) return err;
+	if (err instanceof Error) {
+		const typed = recordsErrorFromMessage(err.message);
+		if (typed !== null) return typed;
+	}
+	return err;
+}
+//#endregion
+//#region src/device/zod-secret.ts
+/**
+* Secret declaration on a Zod config schema (D783).
+*
+* A field is a secret because its schema SAYS so — `.meta({ secret: true })`,
+* spelled {@link SECRET_META} — never because its key looks like a credential.
+* It is the Zod twin of `secret: true` / `type: 'password'` on a config-UI
+* field (`isSecretConfigField`), and every consumer that treats secrets
+* specially reads it: the settings form (`zodEntriesToConfigUI`), the paths a
+* device advertises at `registerDevice` (`secretConfigPaths`, which the
+* non-admin redaction withholds at any depth), and the keychain later.
+*
+* Zod keeps `.meta()` in `z.globalRegistry`, which lives on `globalThis`, so a
+* declaration made by an addon's own copy of zod is visible here.
+*/
+/**
+* `{ secret: true }` — the one spelling of "this field holds a credential".
+*
+* Addons write the LITERAL `.meta({ secret: true })` rather than importing
+* this constant: an addon running against an older `@camstack/types` would
+* otherwise call `.meta(undefined)`, which in zod v4 is the metadata GETTER
+* and returns no schema at all.
+*/
+var SECRET_META = { secret: true };
+function defOf(schema) {
+	const zodBag = Reflect.get(schema, "_zod");
+	if (typeof zodBag !== "object" || zodBag === null) return {};
+	const def = Reflect.get(zodBag, "def");
+	if (typeof def !== "object" || def === null) return {};
+	return def;
+}
+function declaredHere(schema) {
+	return z.globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
+//#endregion
+//#region src/records/secret-paths.ts
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const key = each ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function elementId(element, idKey, declared, prefix) {
+	const id = isRecord$2(element) ? element[idKey] : void 0;
+	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
+	return id;
+}
+/**
+* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
+* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
+* result is a new body, `data` is untouched.
+*/
+var REMOVE_LEAF = Symbol("remove-leaf");
+function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
+	if (!isRecord$2(node)) return node;
+	const segment = segments[index];
+	if (segment === void 0) return node;
+	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
+	const child = node[segment.key];
+	const keys = [...walkedKeys, segment.key];
+	const last = index === segments.length - 1;
+	if (segment.each) {
+		if (!Array.isArray(child)) return node;
+		const prefix = keys.join(".");
+		const idKey = arrayKeys[prefix];
+		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
+		const mapped = child.map((element) => {
+			const id = elementId(element, idKey, declared, prefix);
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
+			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
+		});
+		return {
+			...node,
+			[segment.key]: mapped
+		};
+	}
+	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
+	if (last) {
+		const replacement = visit({
+			declared,
+			concrete,
+			value: child
+		});
+		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
+		return {
+			...node,
+			[segment.key]: replacement
+		};
+	}
+	return {
+		...node,
+		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+	};
+}
+/** Replace/remove every present secret leaf; returns a NEW body. */
+function mapSecretLeaves(data, paths, arrayKeys, visit) {
+	let current = data;
+	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
+	return current;
+}
+/** Every present secret leaf, read-only. */
+function collectSecretLeaves(data, paths, arrayKeys) {
+	const found = [];
+	mapSecretLeaves(data, paths, arrayKeys, (leaf) => {
+		found.push(leaf);
+		return leaf.value;
+	});
+	return found;
+}
+/**
+* The keychain collection name a kind's secrets live under. Prefixed so a
+* record's refs never collide with the refs a legacy collection of the same name
+* already holds during an adoption.
+*/
+function recordSecretCollection(kind) {
+	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
+}
+/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
+function recordSecretRef(owner, kind, rowId, concretePath) {
+	return buildSecretRef({
+		owner,
+		scope: {
+			kind: "row",
+			collection: recordSecretCollection(kind),
+			rowId
+		},
+		fieldPath: concretePath
+	});
+}
+/** A concrete path built from a flat array item, re-exported for adoption tooling. */
+var recordArrayItemPath = arrayItemFieldPath;
+//#endregion
+//#region src/records/record-kind.ts
+/**
+* Record kinds (D881): the declaration an addon makes of one kind of fact, the
+* Zod row schema that describes it, and the helper that turns the two into the
+* JSON the engine stores.
+*
+* A kind is declared ONCE, next to the code that owns it, and the engine's
+* reconciler creates its indexes - nothing creates DDL at runtime from a write.
+* Everything the generic machinery needs (secret fields, the entry descriptor)
+* is DERIVED from the Zod schema: `.meta({ secret: true })` marks a credential,
+* never a field name (D879).
+*/
+/** A JSON field path: `trackId`, `auth.accessToken`. Charset-restricted: it is rendered into DDL. */
+var RecordFieldPathSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}(\.[A-Za-z_][A-Za-z0-9_]{0,63}){0,3}$/);
+var RecordIndexSchema = z.object({
+	name: z.string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+	fields: z.array(RecordFieldPathSchema).min(1).max(4),
+	unique: z.boolean().optional()
+}).strict();
+var RecordRetentionSchema = z.union([
+	z.object({
+		ttlMs: z.number().int().positive(),
+		from: z.enum(["at", "write"])
+	}).strict(),
+	z.object({
+		maxRows: z.number().int().positive().optional(),
+		maxRowsPerDevice: z.number().int().positive().optional()
+	}).strict().refine((r) => r.maxRows !== void 0 || r.maxRowsPerDevice !== void 0, { message: "name maxRows, maxRowsPerDevice or both" }),
+	z.object({
+		owner: z.string().min(1),
+		reason: z.string().min(1)
+	}).strict(),
+	z.object({ none: z.string().min(1) }).strict()
+]);
+/** The descriptor a generic entries UI reads (D881 "generic entries"). */
+var EntryDescriptorSchema = z.object({
+	title: z.string().min(1),
+	/** The record body field shown as the entry's name. */
+	nameField: z.string().min(1),
+	/** JSON Schema of the entry body; `secret: true` marks a password field. */
+	fields: z.record(z.string(), z.unknown())
+}).strict();
+/** What crosses the wire and sits in the engine's catalog: JSON only, no Zod. */
+var RecordKindDeclarationSchema = z.object({
+	database: z.enum(RECORD_DATABASES).default("settings"),
+	class: z.enum(RECORD_CLASSES),
+	writeTrigger: z.string().min(1),
+	device: z.enum([
+		"required",
+		"optional",
+		"none"
+	]).default("none"),
+	at: z.enum(["required", "none"]).default("none"),
+	indexes: z.array(RecordIndexSchema).max(8).default([]),
+	retention: RecordRetentionSchema,
+	deviceRemoval: z.enum(["delete", "none"]).default("none"),
+	maxDataBytes: z.number().int().positive().max(RECORD_MAX_DATA_BYTES).default(RECORD_DEFAULT_MAX_DATA_BYTES),
+	/** Derived from the Zod schema; never written by hand. */
+	secretPaths: z.array(z.string().min(1)).default([]),
+	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
+	secretArrayKeys: z.record(z.string(), z.string()).default({}),
+	/** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+	adoptsFrom: z.string().min(1).optional(),
+	/** Kinds that must agree through `transact` sit in one file under one family name. */
+	transactFamily: z.string().min(1).optional(),
+	entry: EntryDescriptorSchema.optional()
+}).strict();
+/** The kind names: lower-case, dash separated, short enough for an index name. */
+var RecordKindNameSchema = z.string().regex(/^[a-z][a-z0-9-]{0,47}$/);
+/** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
+function assertValidDeclaration(name, decl) {
+	const refuse = (why) => {
+		throw new DeclarationRefusedError(`kind "${name}": ${why}`);
+	};
+	if (!RecordKindNameSchema.safeParse(name).success) refuse("the name must be lower-case-dashed");
+	const seen = /* @__PURE__ */ new Set();
+	for (const index of decl.indexes) {
+		if (seen.has(index.name)) refuse(`index name "${index.name}" is declared twice`);
+		seen.add(index.name);
+	}
+	const { retention } = decl;
+	const hasSecrets = decl.secretPaths.length > 0;
+	if ("ttlMs" in retention) {
+		if (retention.from === "at" && decl.at !== "required") refuse("a ttl from \"at\" needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use engine TTL (its keychain values would be orphaned)");
+	}
+	if ("maxRows" in retention || "maxRowsPerDevice" in retention) {
+		if (retention.maxRowsPerDevice !== void 0 && decl.device !== "required") refuse("maxRowsPerDevice needs device: \"required\"");
+		if (decl.at !== "required") refuse("a row bound trims the oldest \"at\": it needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use an engine row bound");
+		const bound = Math.max(retention.maxRows ?? 0, retention.maxRowsPerDevice ?? 0);
+		if (decl.database === "settings" && bound > 5e4) refuse(`a row bound above ${RECORD_SETTINGS_MAX_ROWS} belongs in database: "events" (a big delete on the settings thread stalls every configuration read)`);
+	}
+	if (decl.deviceRemoval === "delete" && decl.device === "none") refuse("deviceRemoval: \"delete\" needs a device: \"required\" or \"optional\"");
+	for (const path of decl.secretPaths) for (const prefix of secretArrayPrefixes(path)) if (decl.secretArrayKeys[prefix] === void 0) refuse(`secret path "${path}" crosses the array "${prefix}": declare its id key in secretArrayKeys`);
+}
+function bodyFieldsOf(schema) {
+	return { ...z.toJSONSchema(schema, {
+		unrepresentable: "any",
+		io: "input"
+	}) };
+}
+function isRecordLike(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Does every branch of the body schema carry `field`? (A discriminated union has several.) */
+function hasNameField(json, field) {
+	const branches = json["oneOf"] ?? json["anyOf"];
+	if (Array.isArray(branches)) return branches.length > 0 && branches.every((b) => isRecordLike(b) && hasNameField(b, field));
+	const properties = json["properties"];
+	return isRecordLike(properties) && Object.prototype.hasOwnProperty.call(properties, field);
+}
+/**
+* Declare the kinds of a package. The keys are the kind names. The result is
+* what `ctx.records.declare` sends to the engine and what `ctx.records.kind`
+* types its handle from.
+*/
+function defineRecordKinds(specs) {
+	const out = {};
+	for (const [name, spec] of Object.entries(specs)) {
+		const secretPaths = collectZodSecretPaths(spec.schema);
+		const nameField = spec.entry?.nameField ?? "name";
+		const fields = bodyFieldsOf(spec.schema);
+		if (spec.entry !== void 0 && !hasNameField(fields, nameField)) throw new DeclarationRefusedError(`kind "${name}": an entry kind's schema needs a "${nameField}" field`);
+		const parsed = RecordKindDeclarationSchema.parse({
+			database: spec.database,
+			class: spec.class,
+			writeTrigger: spec.writeTrigger,
+			device: spec.device,
+			at: spec.at,
+			indexes: spec.indexes === void 0 ? void 0 : [...spec.indexes],
+			retention: spec.retention,
+			deviceRemoval: spec.deviceRemoval,
+			maxDataBytes: spec.maxDataBytes,
+			secretPaths: [...secretPaths],
+			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
+			adoptsFrom: spec.adoptsFrom,
+			transactFamily: spec.transactFamily,
+			entry: spec.entry === void 0 ? void 0 : {
+				title: spec.entry.title,
+				nameField,
+				fields
+			}
+		});
+		assertValidDeclaration(name, parsed);
+		out[name] = {
+			name,
+			schema: spec.schema,
+			declaration: parsed
+		};
+	}
+	return out;
+}
+/** The wire form of a package's kinds: name -> declaration. */
+function declarationsOf(kinds) {
+	return Object.fromEntries(Object.entries(kinds).map(([name, kind]) => [name, kind.declaration]));
+}
+//#endregion
+//#region src/records/records-access.ts
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Run a transport call and give a wire failure its typed class back. */
+async function call(fn) {
+	try {
+		return await fn();
+	} catch (err) {
+		throw asRecordsError(err);
+	}
+}
+function zodSummary(error) {
+	return error.issues.slice(0, 5).map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
+}
+function toRow(view, data) {
+	return {
+		id: view.id,
+		deviceId: view.deviceId,
+		at: view.at,
+		expiresAt: view.expiresAt,
+		rev: view.rev,
+		updatedAt: view.updatedAt,
+		data
+	};
+}
+var KindHandle = class {
+	def;
+	o;
+	name;
+	decl;
+	constructor(def, o) {
+		this.def = def;
+		this.o = o;
+		this.name = def.name;
+		this.decl = def.declaration;
+	}
+	get hasSecrets() {
+		return this.decl.secretPaths.length > 0;
+	}
+	requireSecrets() {
+		if (this.o.secrets === null) throw new RecordSecretUnavailableError(`kind "${this.name}" has secret fields and this process has no keychain door`);
+		return this.o.secrets;
+	}
+	/** Read the body as the schema's type. The engine already redacted the secrets. */
+	typed(view) {
+		return toRow(view, view.data);
+	}
+	/**
+	* Classify and store the secret leaves of a body about to be written. The
+	* keychain is written FIRST (a failure throws before any row is touched), and
+	* what each ref held before is remembered: when the row write is then refused
+	* (a stale `ifRev`, too large, a unique index) `rollback` puts the previous
+	* values back, so a refused write never destroys the secret that was stored.
+	*/
+	async storeSecrets(id, body, mode) {
+		if (!this.hasSecrets) return {
+			body,
+			rollback: async () => {}
+		};
+		const secrets = this.requireSecrets();
+		const writes = [];
+		const prepared = mapSecretLeaves(body, this.decl.secretPaths, this.decl.secretArrayKeys, (leaf) => {
+			const intent = classifySecretWrite(leaf.value);
+			if (intent.kind === "clear") return REMOVE_LEAF;
+			if (intent.kind === "keep") {
+				if (mode === "put") return REDACTED_SECRET;
+				if (leaf.value === null) return null;
+				return leaf.concrete.includes("[") ? REDACTED_SECRET : REMOVE_LEAF;
+			}
+			const ref = recordSecretRef(this.o.owner, this.name, id, leaf.concrete);
+			writes.push({
+				ref,
+				value: intent.value
+			});
+			return makeSecretMarker(ref);
+		});
+		const done = [];
+		const rollback = async () => {
+			for (const { ref, previous } of done) try {
+				if (previous === void 0) await secrets.delete([ref]);
+				else await secrets.put(ref, previous);
+			} catch (err) {
+				this.o.logger?.warn("records: could not restore a keychain value after a refused write", { meta: {
+					kind: this.name,
+					error: err instanceof Error ? err.message : "unknown"
+				} });
+			}
+		};
+		for (const write of writes) try {
+			const before = (await secrets.resolve([write.ref]))[write.ref];
+			const previous = before?.kind === "value" ? before.value : void 0;
+			await secrets.put(write.ref, write.value);
+			done.push({
+				ref: write.ref,
+				previous
+			});
+		} catch (err) {
+			await rollback();
+			throw new RecordSecretUnavailableError(`cannot store a secret of ${this.name}/${id}: ${err instanceof Error ? err.message : "the keychain refused"}. Unlock the keychain (System -> Secrets) and save again`);
+		}
+		return {
+			body: prepared,
+			rollback
+		};
+	}
+	async releaseRefs(refs) {
+		if (refs.length === 0 || this.o.secrets === null) return;
+		try {
+			await this.o.secrets.delete(refs);
+		} catch (err) {
+			this.o.logger?.warn("records: could not remove released keychain values", { meta: {
+				kind: this.name,
+				count: refs.length,
+				error: err instanceof Error ? err.message : "unknown"
+			} });
+		}
+	}
+	validate(data, id) {
+		const shaped = this.hasSecrets ? mapSecretLeaves(data, this.decl.secretPaths, this.decl.secretArrayKeys, (leaf) => {
+			const intent = classifySecretWrite(leaf.value);
+			if (intent.kind === "clear") return REMOVE_LEAF;
+			return intent.kind === "keep" ? REDACTED_SECRET : leaf.value;
+		}) : data;
+		const parsed = this.def.schema.safeParse(shaped);
+		if (!parsed.success) throw new InvalidRecordError(`${this.name}/${id}: ${zodSummary(parsed.error)}`);
+		if (!isRecord$1(parsed.data)) throw new InvalidRecordError(`${this.name}/${id}: the body must be an object`);
+		return parsed.data;
+	}
+	async get(id) {
+		const view = await call(() => this.o.transport.get({
+			kind: this.name,
+			id
+		}));
+		return view === null ? null : this.typed(view);
+	}
+	async getMany(ids) {
+		if (ids.length === 0) return [];
+		return (await call(() => this.o.transport.getMany({
+			kind: this.name,
+			ids: [...ids]
+		}))).map((v) => this.typed(v));
+	}
+	async getResolved(id) {
+		const row = await this.get(id);
+		if (row === null) return null;
+		return (await this.resolveRows([row]))[0] ?? row;
+	}
+	async resolveRows(rows) {
+		if (!this.hasSecrets || rows.length === 0) return rows;
+		const secrets = this.requireSecrets();
+		const refsById = await call(() => this.o.transport.secretRefs({
+			kind: this.name,
+			ids: rows.map((r) => r.id)
+		}));
+		const refs = Object.values(refsById).flatMap((byPath) => Object.values(byPath));
+		if (refs.length === 0) return rows;
+		const answers = await secrets.resolve(refs);
+		return rows.map((row) => {
+			const byPath = refsById[row.id] ?? {};
+			const resolved = mapSecretLeaves(row.data, this.decl.secretPaths, this.decl.secretArrayKeys, (leaf) => {
+				const ref = byPath[leaf.concrete];
+				if (ref === void 0) return leaf.value;
+				const answer = answers[ref];
+				if (answer?.kind === "value") return answer.value;
+				const why = answer?.kind === "unavailable" ? answer.reason : answer?.kind ?? "no answer";
+				throw new RecordSecretUnavailableError(`the secret "${leaf.concrete}" of ${this.name}/${row.id} cannot be served (${why})`);
+			});
+			return {
+				...row,
+				data: resolved
+			};
+		});
+	}
+	async put(input, opts = {}) {
+		const checked = this.validate(input.data, input.id);
+		const { body, rollback } = await this.storeSecrets(input.id, checked, "put");
+		const result = await call(() => this.o.transport.put({
+			kind: this.name,
+			record: {
+				...input,
+				data: toBody(body)
+			},
+			...opts.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+		})).catch(async (err) => {
+			await rollback();
+			throw err;
+		});
+		await this.releaseRefs(result.releasedRefs);
+		return { rev: result.rev };
+	}
+	async putMany(inputs) {
+		if (inputs.length === 0) return { count: 0 };
+		const prepared = [];
+		const rollbacks = [];
+		try {
+			for (const input of inputs) {
+				const checked = this.validate(input.data, input.id);
+				const { body, rollback } = await this.storeSecrets(input.id, checked, "put");
+				rollbacks.push(rollback);
+				prepared.push({
+					...input,
+					data: toBody(body)
+				});
+			}
+		} catch (err) {
+			for (const rollback of rollbacks) await rollback();
+			throw err;
+		}
+		const result = await call(() => this.o.transport.putMany({
+			kind: this.name,
+			records: prepared
+		})).catch(async (err) => {
+			for (const rollback of rollbacks) await rollback();
+			throw err;
+		});
+		await this.releaseRefs(result.releasedRefs);
+		return { count: result.count };
+	}
+	async patch(id, partial, opts = {}) {
+		const { body, rollback } = await this.storeSecrets(id, partial, "patch");
+		const result = await call(() => this.o.transport.patch({
+			kind: this.name,
+			id,
+			data: toBody(body),
+			...opts.at === void 0 ? {} : { at: opts.at },
+			...opts.expiresAt === void 0 ? {} : { expiresAt: opts.expiresAt },
+			...opts.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+		})).catch(async (err) => {
+			await rollback();
+			throw err;
+		});
+		await this.releaseRefs(result.releasedRefs);
+		return { rev: result.rev };
+	}
+	async delete(id) {
+		const result = await call(() => this.o.transport.delete({
+			kind: this.name,
+			id
+		}));
+		await this.releaseRefs(result.secretRefs);
+		return result.deleted;
+	}
+	async deleteMany(ids) {
+		if (ids.length === 0) return 0;
+		const result = await call(() => this.o.transport.deleteMany({
+			kind: this.name,
+			ids: [...ids]
+		}));
+		await this.releaseRefs(result.secretRefs);
+		return result.deleted;
+	}
+	async query(q, opts = {}) {
+		const result = await call(() => this.o.transport.query({
+			...q,
+			kind: this.name,
+			limit: q.limit ?? 100
+		}));
+		const rows = result.records.map((v) => this.typed(v));
+		return {
+			records: opts.resolveSecrets === true ? await this.resolveRows(rows) : rows,
+			nextCursor: result.nextCursor
+		};
+	}
+	async count(q) {
+		return (await call(() => this.o.transport.count({
+			...q,
+			kind: this.name
+		}))).count;
+	}
+	async histogram(q) {
+		return (await call(() => this.o.transport.histogram({
+			...q,
+			kind: this.name
+		}))).buckets;
+	}
+	async aggregate(q) {
+		return (await call(() => this.o.transport.aggregate({
+			...q,
+			kind: this.name
+		}))).rows;
+	}
+	async deleteWhere(q) {
+		const result = await call(() => this.o.transport.deleteWhere({
+			...q,
+			kind: this.name
+		}));
+		await this.releaseRefs(result.secretRefs);
+		return result.deleted;
+	}
+	async allocateId() {
+		return (await call(() => this.o.transport.allocateId({ kind: this.name }))).id;
+	}
+};
+function toBody(value) {
+	if (!isRecord$1(value)) throw new InvalidRecordError("the record body must be an object");
+	return value;
+}
+/** Build the owner's records handle. */
+function createRecordsAccess(options) {
+	const handles = /* @__PURE__ */ new WeakMap();
+	const delegates = /* @__PURE__ */ new Map();
+	return {
+		owner: options.owner,
+		forOwner: options.transportForOwner === void 0 ? null : (other) => {
+			const existing = delegates.get(other);
+			if (existing !== void 0) return existing;
+			const build = options.transportForOwner;
+			if (build === void 0) throw new Error("forOwner: no delegate transport");
+			const delegate = createRecordsAccess({
+				owner: other,
+				transport: build(other),
+				secrets: options.secrets?.forOwner?.(other) ?? null,
+				...options.logger === void 0 ? {} : { logger: options.logger }
+			});
+			delegates.set(other, delegate);
+			return delegate;
+		},
+		async declare(kinds) {
+			const result = await call(() => options.transport.declareKinds({ kinds: { ...declarationsOf(kinds) } }));
+			const pending = Object.entries(result.kinds).filter((entry) => entry[1].adoptionPending !== null);
+			if (pending.length > 0) throw new AdoptionPendingError(`${pending.map(([name, r]) => r.adoptionPending === null ? name : `${name} (legacy table "${r.adoptionPending.legacyTable}" holds ${r.adoptionPending.legacyRows} rows)`).join(", ")}. Stop the addon and run scripts/hub/records-adopt.ts --copy --apply before starting this build`);
+			return result.kinds;
+		},
+		kind(definition) {
+			const existing = handles.get(definition);
+			if (existing !== void 0) return existing;
+			const handle = new KindHandle(definition, options);
+			handles.set(definition, handle);
+			return handle;
+		},
+		async deleteDevice(deviceId, opts = {}) {
+			const result = await call(() => options.transport.deleteDevice({
+				deviceId,
+				...opts.kinds === void 0 ? {} : { kinds: [...opts.kinds] }
+			}));
+			if (result.secretRefs.length > 0 && options.secrets !== null) try {
+				await options.secrets.delete(result.secretRefs);
+			} catch (err) {
+				options.logger?.warn("records: could not remove released keychain values", { meta: {
+					count: result.secretRefs.length,
+					error: err instanceof Error ? err.message : "unknown"
+				} });
+			}
+			return result.deleted;
+		}
+	};
+}
+//#endregion
+//#region src/records/entry-kind.ts
+/**
+* Entry kinds (D881): every list of user-created entries (notification
+* targets, brokers, LLM profiles) is ONE record kind with an id, a name and a
+* kind-specific body, and the admin UI lists/adds/edits/deletes all of them
+* through the `record-entries` capability with password fields derived from
+* the schema (`.meta({ secret: true })`).
+*/
+/** The body of a plain entry: a name and the fields the kind adds. */
+function entryBody(shape) {
+	return z.object({
+		name: z.string().min(1),
+		...shape
+	});
+}
+/**
+* Declare one entry kind. An entry is configuration: never trimmed by the
+* engine, never aged, belonging to no device.
+*/
+function defineEntryKind(name, spec) {
+	const defined = defineRecordKinds({ [name]: {
+		schema: spec.schema,
+		class: "config",
+		writeTrigger: spec.writeTrigger ?? "an operator adds or edits an entry in the entries UI",
+		retention: { none: "an entry goes only when the operator deletes it" },
+		...spec.database === void 0 ? {} : { database: spec.database },
+		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
+		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
+		...spec.adoptsFrom === void 0 ? {} : { adoptsFrom: spec.adoptsFrom },
+		entry: {
+			title: spec.title,
+			...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
+		}
+	} })[name];
+	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
+	return defined;
+}
+//#endregion
+//#region src/records/settings-brokers-adopts-from.ts
+/**
+* Legacy source for broker entry adoption (B2): brokers live in addon-settings
+* as one row `<addonId>.brokers` whose value is an array until records-adopt
+* copies them into the entry kind.
+*/
+var SETTINGS_BROKERS_ADOPTS_PREFIX = "@settings-brokers/";
+/** The `adoptsFrom` value for an addon's broker entry kind. */
+function settingsBrokersAdoptsFrom(addonId) {
+	return `${SETTINGS_BROKERS_ADOPTS_PREFIX}${addonId}`;
+}
+/** When non-null, `from` names an addon-settings brokers blob, not a SQL table. */
+function parseSettingsBrokersAdoptsFrom(from) {
+	if (!from.startsWith("@settings-brokers/")) return null;
+	const addonId = from.slice(18);
+	return addonId.length > 0 ? addonId : null;
+}
+//#endregion
+//#region src/records/settings-array-adopts-from.ts
+/**
+* Legacy source for entry adoption (B3): a list stored under addon-settings
+* `<addonId>.<key>` until records-adopt copies rows into the entry kind.
+*/
+var SETTINGS_ARRAY_ADOPTS_PREFIX = "@settings-array/";
+/** The `adoptsFrom` value for an addon-settings array field. */
+function settingsArrayAdoptsFrom(addonId, settingsKey) {
+	return `${SETTINGS_ARRAY_ADOPTS_PREFIX}${addonId}/${settingsKey}`;
+}
+/** When non-null, `from` names an addon-settings array blob, not a SQL table. */
+function parseSettingsArrayAdoptsFrom(from) {
+	if (!from.startsWith("@settings-array/")) return null;
+	const rest = from.slice(16);
+	const slash = rest.indexOf("/");
+	if (slash <= 0 || slash >= rest.length - 1) return null;
+	const addonId = rest.slice(0, slash);
+	const settingsKey = rest.slice(slash + 1);
+	if (addonId.length === 0 || settingsKey.length === 0) return null;
+	return {
+		addonId,
+		settingsKey
+	};
+}
+//#endregion
+//#region src/records/in-memory-records.ts
+/**
+* In-memory `RecordsAccess` for specs. Kinds are declared by the caller.
+* Lives in `@camstack/types` so a spec does not import another package's source.
+*/
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function markersOf(decl, body) {
+	const out = /* @__PURE__ */ new Map();
+	mapSecretLeaves(body, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+		if (isSecretMarker(leaf.value)) out.set(leaf.concrete, leaf.value.$secret);
+		return leaf.value;
+	});
+	return out;
+}
+function makeSpecKeychain(owner) {
+	const values = /* @__PURE__ */ new Map();
+	return { access: {
+		owner,
+		ref: (scope, fieldPath) => buildSecretRef({
+			owner,
+			scope,
+			fieldPath
+		}),
+		resolve: async (refs) => {
+			const out = {};
+			for (const ref of refs) {
+				const value = values.get(ref);
+				out[ref] = value === void 0 ? { kind: "missing" } : {
+					kind: "value",
+					value,
+					version: 1
+				};
+			}
+			return out;
+		},
+		put: async (ref, value) => {
+			values.set(ref, value);
+			return 1;
+		},
+		delete: async (refs) => {
+			let deleted = 0;
+			for (const ref of refs) if (values.delete(ref)) deleted += 1;
+			return deleted;
+		},
+		state: async () => ({ state: "ready" }),
+		onChange: () => () => void 0,
+		forOwner: null
+	} };
+}
+function makeInMemoryRecords(owner = "spec") {
+	const decls = /* @__PURE__ */ new Map();
+	const tables = /* @__PURE__ */ new Map();
+	let clock = 1;
+	let writesFail = false;
+	let readsFail = false;
+	const table = (kind) => {
+		let t = tables.get(kind);
+		if (t === void 0) {
+			t = /* @__PURE__ */ new Map();
+			tables.set(kind, t);
+		}
+		return t;
+	};
+	const declOf = (kind) => {
+		const decl = decls.get(kind);
+		if (decl === void 0) throw new Error(`kind "${kind}" is not declared`);
+		return decl;
+	};
+	const redact = (decl, body) => {
+		if (decl.secretPaths.length === 0) return body;
+		const out = mapSecretLeaves(body, decl.secretPaths, decl.secretArrayKeys, (leaf) => leaf.value === null ? null : REDACTED_SECRET);
+		return isRecord(out) ? out : body;
+	};
+	const view = (kind, row) => ({
+		id: row.id,
+		deviceId: null,
+		at: row.at,
+		expiresAt: null,
+		rev: row.rev,
+		updatedAt: row.updatedAt,
+		data: redact(declOf(kind), row.data)
+	});
+	const enforce = (kind, id, body, stored) => {
+		const decl = declOf(kind);
+		if (decl.secretPaths.length === 0) return {
+			body,
+			released: []
+		};
+		const before = stored === null ? /* @__PURE__ */ new Map() : markersOf(decl, stored);
+		const next = mapSecretLeaves(body, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+			const expected = recordSecretRef(owner, kind, id, leaf.concrete);
+			if (isSecretMarker(leaf.value)) {
+				if (leaf.value.$secret !== expected) throw new Error("foreign secret marker");
+				return leaf.value;
+			}
+			if (leaf.value === "__camstack_redacted__") {
+				const keep = before.get(leaf.concrete);
+				return keep === void 0 ? REMOVE_LEAF : {
+					$secret: keep,
+					v: 1
+				};
+			}
+			if (leaf.value === null || leaf.value === void 0) return REMOVE_LEAF;
+			throw new Error(`${kind}/${id}: a secret field takes a keychain marker, never a value`);
+		});
+		if (!isRecord(next)) throw new Error("the body must be an object");
+		const after = markersOf(decl, next);
+		return {
+			body: next,
+			released: [...before.entries()].filter(([p, ref]) => after.get(p) !== ref).map(([, r]) => r)
+		};
+	};
+	const write = (kind, input) => {
+		if (writesFail) throw new Error("records engine unreachable");
+		if (declOf(kind).at === "required" && input.at === void 0) throw new Error(`${kind}/${input.id}: the kind needs "at" on every write`);
+		const prev = table(kind).get(input.id);
+		const { body, released } = enforce(kind, input.id, input.data, prev?.data ?? null);
+		const rev = (prev?.rev ?? 0) + 1;
+		clock += 1;
+		table(kind).set(input.id, {
+			id: input.id,
+			at: input.at ?? null,
+			rev,
+			updatedAt: clock,
+			data: body
+		});
+		return {
+			rev,
+			released
+		};
+	};
+	const unimplemented = (op) => {
+		throw new Error(`the fake records transport does not implement ${op}`);
+	};
+	return {
+		records: createRecordsAccess({
+			owner,
+			transport: {
+				declareKinds: async ({ kinds }) => {
+					const out = {};
+					let n = 0;
+					for (const [name, decl] of Object.entries(kinds)) {
+						decls.set(name, decl);
+						n += 1;
+						out[name] = {
+							kindId: n,
+							state: "created",
+							createdIndexes: decl.indexes.map((i) => i.name),
+							adoptionPending: null
+						};
+					}
+					return { kinds: out };
+				},
+				get: async ({ kind, id }) => {
+					if (readsFail) throw new Error("records engine unreachable");
+					const row = table(kind).get(id);
+					return row === void 0 ? null : view(kind, row);
+				},
+				getMany: async ({ kind, ids }) => ids.flatMap((id) => {
+					const row = table(kind).get(id);
+					return row === void 0 ? [] : [view(kind, row)];
+				}),
+				secretRefs: async ({ kind, ids }) => {
+					const decl = declOf(kind);
+					const out = {};
+					for (const id of ids) {
+						const row = table(kind).get(id);
+						if (row !== void 0) out[id] = Object.fromEntries(markersOf(decl, row.data));
+					}
+					return out;
+				},
+				put: async ({ kind, record, ifRev }) => {
+					if (ifRev !== void 0 && (table(kind).get(record.id)?.rev ?? 0) !== ifRev) throw new Error("stale ifRev");
+					const { rev, released } = write(kind, record);
+					return {
+						rev,
+						releasedRefs: released
+					};
+				},
+				putMany: async ({ kind, records }) => {
+					const released = [];
+					for (const record of records) released.push(...write(kind, record).released);
+					return {
+						count: records.length,
+						releasedRefs: released
+					};
+				},
+				patch: async () => unimplemented("patch"),
+				delete: async ({ kind, id }) => {
+					if (writesFail) throw new Error("records engine unreachable");
+					const row = table(kind).get(id);
+					if (row === void 0) return {
+						deleted: false,
+						secretRefs: []
+					};
+					table(kind).delete(id);
+					return {
+						deleted: true,
+						secretRefs: [...markersOf(declOf(kind), row.data).values()]
+					};
+				},
+				deleteMany: async ({ kind, ids }) => {
+					let deleted = 0;
+					const refs = [];
+					for (const id of ids) {
+						const row = table(kind).get(id);
+						if (row === void 0) continue;
+						table(kind).delete(id);
+						deleted += 1;
+						refs.push(...markersOf(declOf(kind), row.data).values());
+					}
+					return {
+						deleted,
+						secretRefs: refs
+					};
+				},
+				query: async (q) => {
+					if (readsFail) throw new Error("records engine unreachable");
+					const decl = declOf(q.kind);
+					const asked = Object.keys(q.where ?? {});
+					if (asked.length > 0) {
+						if (!decl.indexes.some((index) => {
+							const leading = new Set(index.fields.slice(0, asked.length));
+							return asked.length <= index.fields.length && asked.every((f) => leading.has(f));
+						})) throw new Error(`${q.kind}: no declared index serves [${asked.join(", ")}]`);
+					}
+					let rows = [...table(q.kind).values()];
+					for (const [field, wanted] of Object.entries(q.where ?? {})) rows = rows.filter((r) => r.data[field] === wanted);
+					const byAt = q.order === "at" || q.order === void 0 && decl.at === "required";
+					rows.sort((a, b) => byAt ? (a.at ?? 0) - (b.at ?? 0) : a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+					if (q.desc === true) rows.reverse();
+					const start = q.cursor === void 0 ? 0 : Number(q.cursor);
+					const page = rows.slice(start, start + q.limit);
+					const more = start + q.limit < rows.length;
+					return {
+						records: page.map((r) => view(q.kind, r)),
+						nextCursor: more ? String(start + q.limit) : null
+					};
+				},
+				count: async ({ kind }) => ({ count: table(kind).size }),
+				histogram: async () => unimplemented("histogram"),
+				aggregate: async () => unimplemented("aggregate"),
+				deleteWhere: async () => unimplemented("deleteWhere"),
+				deleteDevice: async () => unimplemented("deleteDevice"),
+				allocateId: async () => unimplemented("allocateId")
+			},
+			secrets: makeSpecKeychain(owner).access
+		}),
+		tables,
+		failWrites: (on) => {
+			writesFail = on;
+		},
+		failReads: (on) => {
+			readsFail = on;
+		},
+		seed: (kind, row) => {
+			table(kind).set(row.id, {
+				id: row.id,
+				at: row.at ?? null,
+				rev: 1,
+				updatedAt: 1,
+				data: row.data
+			});
+		}
+	};
+}
+//#endregion
 //#region src/capabilities/schemas/streaming-shared.ts
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = z.enum([
@@ -4281,6 +5599,30 @@ function describeCustomActions(catalog) {
 	return out;
 }
 //#endregion
+//#region src/capabilities/caller-stamp.ts
+/**
+* Every cap whose provider reads a `callerAddonId` in its input (the keychain's
+* owner check, device-history's `not-owner`, records' owner).
+*
+* The stamp is set ONLY by the transport (`stampCallerAddonId`, or stated by a
+* hub in-process caller). The generated HTTP/tRPC mount parses input with
+* `.loose()`, so without this a session could add the key itself and act as
+* another addon. The mount strips it for these caps.
+*/
+var CALLER_STAMPED_CAPABILITIES = [
+	"keychain",
+	"device-history",
+	"records",
+	"integrations",
+	"device-manager"
+];
+/** A copy of `input` without the caller stamp. Anything that is not a plain object passes through. */
+function withoutCallerStamp(input) {
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return input;
+	if (!Object.prototype.hasOwnProperty.call(input, "callerAddonId")) return input;
+	return Object.fromEntries(Object.entries(input).filter(([key]) => key !== "callerAddonId"));
+}
+//#endregion
 //#region src/device/children-batch-max.ts
 /**
 * Most parents one `getChildrenBatch` may name.
@@ -4537,94 +5879,6 @@ var RUNTIME_DEFAULTS = {
 	"auth.tokenExpiry": "30d"
 };
 //#endregion
-//#region src/device/zod-secret.ts
-/**
-* Secret declaration on a Zod config schema (D783).
-*
-* A field is a secret because its schema SAYS so — `.meta({ secret: true })`,
-* spelled {@link SECRET_META} — never because its key looks like a credential.
-* It is the Zod twin of `secret: true` / `type: 'password'` on a config-UI
-* field (`isSecretConfigField`), and every consumer that treats secrets
-* specially reads it: the settings form (`zodEntriesToConfigUI`), the paths a
-* device advertises at `registerDevice` (`secretConfigPaths`, which the
-* non-admin redaction withholds at any depth), and the keychain later.
-*
-* Zod keeps `.meta()` in `z.globalRegistry`, which lives on `globalThis`, so a
-* declaration made by an addon's own copy of zod is visible here.
-*/
-/**
-* `{ secret: true }` — the one spelling of "this field holds a credential".
-*
-* Addons write the LITERAL `.meta({ secret: true })` rather than importing
-* this constant: an addon running against an older `@camstack/types` would
-* otherwise call `.meta(undefined)`, which in zod v4 is the metadata GETTER
-* and returns no schema at all.
-*/
-var SECRET_META = { secret: true };
-function defOf(schema) {
-	return schema._zod?.def ?? {};
-}
-function declaredHere(schema) {
-	return z.globalRegistry.get(schema)?.secret === true;
-}
-/** Wrapper kinds whose `innerType` is the field itself. */
-var WRAPPERS = new Set([
-	"optional",
-	"nullable",
-	"default",
-	"prefault",
-	"catch",
-	"readonly",
-	"nonoptional"
-]);
-/**
-* The schema layers that make up ONE field: the schema itself and every
-* wrapper below it (optional / default / nullable / readonly / catch), plus
-* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
-* `.transform` on `in`).
-*/
-function layersOf(schema) {
-	const out = [];
-	const queue = [schema];
-	while (queue.length > 0) {
-		const s = queue.shift();
-		if (!s || out.includes(s)) continue;
-		out.push(s);
-		const def = defOf(s);
-		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
-		if (def.type === "pipe") {
-			if (def.in) queue.push(def.in);
-			if (def.out) queue.push(def.out);
-		}
-	}
-	return out;
-}
-/** True when any layer of this field declares `.meta({ secret: true })`. */
-function isZodSecret(schema) {
-	return layersOf(schema).some(declaredHere);
-}
-/**
-* Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
-* object or array is reported as one path and not descended into — everything
-* under it is secret.
-*/
-function collectZodSecretPaths(schema, prefix = "") {
-	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
-	const paths = [];
-	for (const layer of layersOf(schema)) {
-		const def = defOf(layer);
-		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
-		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
-		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
-		else if (def.type === "intersection") {
-			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
-			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
-		}
-	}
-	return [...new Set(paths)];
-}
-//#endregion
 //#region src/device/device-state-handle.ts
 var DEVICE_STATE_EVENT_CATEGORY = "device.state-changed";
 /**
@@ -4871,6 +6125,50 @@ function isSource(x) {
 	return typeof x.read === "function" && typeof x.watch === "function";
 }
 //#endregion
+//#region src/helpers/addon-slice-handle.ts
+/** Structural bridge: every `AddonApi` client carries `deviceState` (+ optional `live`). */
+function addonSliceHandleApi(api) {
+	return api;
+}
+//#endregion
+//#region src/helpers/trpc-leaf.ts
+function isTrpcProcedureLeaf(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return (typeof record.query === "function" || typeof record.mutate === "function" || typeof record.subscribe === "function") && !Array.isArray(value);
+}
+function readCapRecord(api, capProp) {
+	const cap = Reflect.get(api, capProp);
+	if (typeof cap !== "object" || cap === null || Array.isArray(cap)) return void 0;
+	return cap;
+}
+function readTrpcLeaf(api, capProp, method) {
+	const capRecord = readCapRecord(api, capProp);
+	if (!capRecord) throw new Error(`tRPC client has no router '${capProp}'`);
+	const leaf = capRecord[method];
+	if (!isTrpcProcedureLeaf(leaf)) throw new Error(`tRPC client has no '${capProp}.${method}'`);
+	return leaf;
+}
+/**
+* Invoke `api.<capProp>.<method>.{query|mutate|subscribe}(input)`.
+* `Result` is the generated proxy method's return. The leaf itself is only
+* `unknown` (the client is a structural bag), so the assertion is the one
+* boundary between that bag and the typed proxy.
+*/
+function invokeTrpcLeaf(api, capProp, method, kind, input, push) {
+	const fn = readTrpcLeaf(api, capProp, method);
+	if (kind === "mutation") {
+		if (typeof fn.mutate !== "function") throw new Error(`tRPC '${capProp}.${method}' has no mutate()`);
+		return fn.mutate(input);
+	}
+	if (kind === "subscription") {
+		if (typeof fn.subscribe !== "function") throw new Error(`tRPC '${capProp}.${method}' has no subscribe()`);
+		return fn.subscribe(input, push);
+	}
+	if (typeof fn.query !== "function") throw new Error(`tRPC '${capProp}.${method}' has no query()`);
+	return fn.query(input);
+}
+//#endregion
 //#region src/generated/device-proxy.ts
 /**
 * Build a DeviceProxy that pre-binds deviceId + nodeId on every method call
@@ -4888,8 +6186,7 @@ function isSource(x) {
 * field on the returned object.
 */
 function createDeviceProxy(api, binding, opts) {
-	const typedApi = api;
-	const stateSource = opts?.stateSource ?? createLazyTrpcSource(api);
+	const stateSource = opts?.stateSource ?? createLazyTrpcSource(addonSliceHandleApi(api));
 	/** Merge `{deviceId, nodeId?}` into the caller-supplied input. */
 	function mergeInput(input, nodeId) {
 		const base = typeof input === "object" && input !== null ? input : {};
@@ -4902,20 +6199,8 @@ function createDeviceProxy(api, binding, opts) {
 			deviceId: binding.deviceId
 		};
 	}
-	/**
-	* Invoke `api.<capProp>.<method>.{query|mutate|subscribe}(merged)`.
-	* Returns `any` so the caller-side per-method declaration assigns
-	* cleanly into the strongly-typed `InferDeviceProxyCap<...>` shape on
-	* the `DeviceProxy` interface — the proxy's contract is enforced by
-	* the interface, not the dispatch helper.
-	*/
 	function callLeaf(capProp, method, kind, merged, push) {
-		const leaf = typedApi[capProp]?.[method];
-		if (!leaf) throw new Error(`DeviceProxy: api has no '${capProp}.${method}'`);
-		const fn = leaf;
-		if (kind === "mutation") return fn.mutate(merged);
-		if (kind === "subscription") return fn.subscribe(merged, push);
-		return fn.query(merged);
+		return invokeTrpcLeaf(api, capProp, method, kind, merged, push);
 	}
 	/**
 	* Device-scoped cap dispatch. Looks up the binding entry for `capName`
@@ -6187,4 +7472,4 @@ function sleepCancellable(ms, signal) {
 	});
 }
 //#endregion
-export { resolveCapMount as $, normalizeAddonInitResult as $t, HF_BASE_URL as A, isSecretClear as An, makeSourceBrokerId as At, deviceCustomAction as B, isSecretConfigField as Bn, registerKnownSecret as Bt, createLazyTrpcSource as C, WELL_KNOWN_TAB_MAP as Cn, ProfileSlotSchema as Ct, collectZodSecretPaths as D, resolveHydratedFieldValue as Dn, SubscribeAudioChunksInputSchema as Dt, SECRET_META as E, hydrateSchema as En, StreamSourceSchema as Et, viewerUiCapability as F, toSecretFieldView as Fn, createSecretsAccess as Ft, HISTORY_DEFAULT_MIN_INTERVAL_MS as G, isAudioChunkFormat as Gn, PEER_BYTES_STALL_MS as Gt, DEFAULT_RUNTIME_STATE_DURABILITY as H, AUDIO_CHUNK_FORMATS as Hn, shortSecretRefHash as Ht, DEVICE_CHILDREN_BATCH_MAX as I, REDACTED_SECRET as In, MIN_SCRUBBED_LENGTH as It, event as J, DATAPLANE_SECRET_HEADER as Jt, HISTORY_UNIT_LABELS as K, PEER_BYTES_TICKET_TTL_MS as Kt, customAction as L, collectKeychainStoredKeys as Ln, clearKnownSecrets as Lt, RUNTIME_DEFAULTS as M, isSecretMarker as Mn, selectAssignedProfileSlots as Mt, RawStateResultSchema as N, isSecretMarkerLike as Nn, resolveSecretViewsIn as Nt, isZodSecret as O, SECRET_CLEAR as On, SubscribeAudioChunksResultSchema as Ot, deviceOpsCapability as P, makeSecretMarker as Pn, REVALIDATE_AFTER_MS as Pt, optionalMethod as Q, classifyStoreError as Qt, defineCustomActions as R, collectSecretConfigKeys as Rn, forgetKnownSecret as Rt, createEventBusSliceSource as S, WELL_KNOWN_TABS as Sn, ProfileRtspEntrySchema as St, createSliceHandle as T, collectHydratedFieldValues as Tn, StreamSourceEntrySchema$1 as Tt, DEVICE_SETTINGS_CONTRIBUTION_METHODS as U, audioChunkBytesPerSample as Un, PEER_BYTES_CHUNK_BYTES as Ut, adminUiCapability as V, schemaDeclaresAnyField as Vn, scrubKnownSecrets as Vt, DEVICE_STATUS_METHOD as W, expandAudioChunkToF32le as Wn, PEER_BYTES_MAX_OUTSTANDING as Wt, isDeviceConfigCap as X, DisposerChain as Xt, expandCapMethods as Y, SHARE_VIEW_KINDS as Yt, method as Z, BaseAddon as Zt, readErrorI18n as _, normalizeNodeId as _n, CamStreamKindSchema as _t, asJsonArray as a, collectSecretMarkerRefs as an, MODEL_FORMATS as at, isDeviceScopedCap as b, emitReadiness as bn, DecodedAudioChunkSchema as bt, asString as c, transformSecretWrite as cn, emitDownForOwnedCaps as ct, parseJsonUnknown as d, buildSecretRef as dn, AudioChunkFormatSchema as dt, mergeSecretStatePaths as en, systemMethod as et, hfModelUrl as f, formatSecretScope as fn, AudioStreamPickSchema as ft, ErrorI18nPayloadSchema as g, parseSecretRef as gn, CamProfileSchema as gt, ErrorCodeSchema as h, normalizeSecretOwner as hn, CAM_PROFILE_ORDER as ht, asBoolean as i, KeychainWriteRefusedError as in, toNodeId as it, HF_REPO as j, isSecretFieldView as jn, parseProfileBrokerId as jt, DEFAULT_TOKEN_EXPIRY as k, classifySecretWrite as kn, makeProfileBrokerId as kt, parseJsonArray as l, SECRET_REF_SCHEME as ln, readinessKey as lt, CamstackError as m, isSecretRef as mn, BrokerStatusSchema as mt, sleepCancellable as n, secretTreeFromPaths as nn, nodePin as nt, asJsonObject as o, isSecretRefOwnedBy as on, ReadinessRegistry as ot, BOOT_RECOVERY_BACKOFF_MS as p, globalSecretScope as pn, BrokerStatsSchema as pt, PROVIDER_PIN_FIELD as q, PeerBytesTicketSchema as qt, maskUrlCredentials as r, secretTreeFromSchema as rn, readNodePin as rt, asNumber as s, resolveSecretMarkers as sn, ReadinessTimeoutError as st, sleep as t, parseSecretStatePath as tn, CAP_NODE_PIN_CONTEXT_KEY as tt, parseJsonObject as u, arrayItemFieldPath as un, scopeKey as ut, userError as v, createDurableState as vn, CamStreamResolutionSchema as vt, createMirrorSource as w, collectHydratedFieldEntries as wn, ProfileSlotStatusSchema as wt, createDeviceProxy as x, isEvent as xn, FrameHandleSchema as xt, DEVICE_SCOPED_CAPS as y, createEvent as yn, CameraStreamSchema as yt, describeCustomActions as z, isKeychainStoredField as zn, knownSecretCount as zt };
+export { optionalMethod as $, PEER_BYTES_CHUNK_BYTES as $n, schemaDeclaresAnyField as $r, REMOVE_LEAF as $t, HF_REPO as A, RECORD_BATCH_MAX_BYTES as An, emitReadiness as Ar, makeProfileBrokerId as At, describeCustomActions as B, RECORD_SECRET_COLLECTION_PREFIX as Bn, SECRET_CLEAR as Br, settingsBrokersAdoptsFrom as Bt, addonSliceHandleApi as C, RecordsError as Cn, globalSecretScope as Cr, ProfileRtspEntrySchema as Ct, createSliceHandle as D, asRecordsError as Dn, normalizeNodeId as Dr, StreamSourceSchema as Dt, createMirrorSource as E, UnknownRecordKindError as En, parseSecretRef as Er, StreamSourceEntrySchema$1 as Et, DEVICE_CHILDREN_BATCH_MAX as F, RECORD_ID_MAX_LENGTH as Fn, collectHydratedFieldValues as Fr, SETTINGS_ARRAY_ADOPTS_PREFIX as Ft, DEVICE_STATUS_METHOD as G, createSecretsAccess as Gn, isSecretMarkerLike as Gr, RecordFieldPathSchema as Gt, adminUiCapability as H, RECORD_SWEEP_INTERVAL_MS as Hn, isSecretClear as Hr, entryBody as Ht, CALLER_STAMPED_CAPABILITIES as I, RECORD_MAX_DATA_BYTES as In, dehydrateConfigField as Ir, parseSettingsArrayAdoptsFrom as It, PROVIDER_PIN_FIELD as J, forgetKnownSecret as Jn, REDACTED_SECRET as Jr, RecordKindNameSchema as Jt, HISTORY_DEFAULT_MIN_INTERVAL_MS as K, MIN_SCRUBBED_LENGTH as Kn, makeSecretMarker as Kr, RecordIndexSchema as Kt, withoutCallerStamp as L, RECORD_MAX_INDEXES as Ln, dehydrateSchema as Lr, settingsArrayAdoptsFrom as Lt, RawStateResultSchema as M, RECORD_DATABASES as Mn, WELL_KNOWN_TABS as Mr, parseProfileBrokerId as Mt, deviceOpsCapability as N, RECORD_DEFAULT_MAX_DATA_BYTES as Nn, WELL_KNOWN_TAB_MAP as Nr, selectAssignedProfileSlots as Nt, DEFAULT_TOKEN_EXPIRY as O, recordsErrorFromMessage as On, createDurableState as Or, SubscribeAudioChunksInputSchema as Ot, viewerUiCapability as P, RECORD_DELETE_BATCH as Pn, collectHydratedFieldEntries as Pr, makeInMemoryRecords as Pt, method as Q, shortSecretRefHash as Qn, isSecretConfigField as Qr, defineRecordKinds as Qt, customAction as R, RECORD_MAX_INDEX_FIELDS as Rn, hydrateSchema as Rr, SETTINGS_BROKERS_ADOPTS_PREFIX as Rt, invokeTrpcLeaf as S, RecordUniqueViolationError as Sn, formatSecretScope as Sr, FrameHandleSchema as St, createLazyTrpcSource as T, UnindexedFilterError as Tn, normalizeSecretOwner as Tr, ProfileSlotStatusSchema as Tt, DEFAULT_RUNTIME_STATE_DURABILITY as U, resolveSecretViewsIn as Un, isSecretFieldView as Ur, createRecordsAccess as Ut, deviceCustomAction as V, RECORD_SETTINGS_MAX_ROWS as Vn, classifySecretWrite as Vr, defineEntryKind as Vt, DEVICE_SETTINGS_CONTRIBUTION_METHODS as W, REVALIDATE_AFTER_MS as Wn, isSecretMarker as Wr, EntryDescriptorSchema as Wt, expandCapMethods as X, registerKnownSecret as Xn, collectSecretConfigKeys as Xr, assertValidDeclaration as Xt, event as Y, knownSecretCount as Yn, collectKeychainStoredKeys as Yr, RecordRetentionSchema as Yt, isDeviceConfigCap as Z, scrubKnownSecrets as Zn, isKeychainStoredField as Zr, declarationsOf as Zt, readErrorI18n as _, PlaintextSecretError as _n, resolveSecretMarkers as _r, CamProfileSchema as _t, asJsonArray as a, recordSecretRef as an, SHARE_VIEW_KINDS as ar, toNodeId as at, isDeviceScopedCap as b, RecordSecretUnavailableError as bn, arrayItemFieldPath as br, CameraStreamSchema as bt, asString as c, collectZodSecretPaths as cn, classifyStoreError as cr, ReadinessTimeoutError as ct, parseJsonUnknown as d, BatchTooLargeError as dn, parseSecretStatePath as dr, scopeKey as dt, AUDIO_CHUNK_FORMATS as ei, collectSecretLeaves as en, PEER_BYTES_MAX_OUTSTANDING as er, resolveCapMount as et, hfModelUrl as f, DeclarationRefusedError as fn, secretTreeFromPaths as fr, AudioChunkFormatSchema as ft, ErrorI18nPayloadSchema as g, NoCallerError as gn, isSecretRefOwnedBy as gr, CAM_PROFILE_ORDER as gt, ErrorCodeSchema as h, InvalidRecordError as hn, collectSecretMarkerRefs as hr, BrokerStatusSchema as ht, asBoolean as i, recordSecretCollection as in, DATAPLANE_SECRET_HEADER as ir, readNodePin as it, RUNTIME_DEFAULTS as j, RECORD_CLASSES as jn, isEvent as jr, makeSourceBrokerId as jt, HF_BASE_URL as k, RECORD_BATCH_MAX as kn, createEvent as kr, SubscribeAudioChunksResultSchema as kt, parseJsonArray as l, isZodSecret as ln, normalizeAddonInitResult as lr, emitDownForOwnedCaps as lt, CamstackError as m, ForeignSecretMarkerError as mn, KeychainWriteRefusedError as mr, BrokerStatsSchema as mt, sleepCancellable as n, expandAudioChunkToF32le as ni, parseSecretPath as nn, PEER_BYTES_TICKET_TTL_MS as nr, CAP_NODE_PIN_CONTEXT_KEY as nt, asJsonObject as o, secretArrayPrefixes as on, DisposerChain as or, MODEL_FORMATS as ot, BOOT_RECOVERY_BACKOFF_MS as p, FilterRequiredError as pn, secretTreeFromSchema as pr, AudioStreamPickSchema as pt, HISTORY_UNIT_LABELS as q, clearKnownSecrets as qn, toSecretFieldView as qr, RecordKindDeclarationSchema as qt, maskUrlCredentials as r, isAudioChunkFormat as ri, recordArrayItemPath as rn, PeerBytesTicketSchema as rr, nodePin as rt, asNumber as s, SECRET_META as sn, BaseAddon as sr, ReadinessRegistry as st, sleep as t, audioChunkBytesPerSample as ti, mapSecretLeaves as tn, PEER_BYTES_STALL_MS as tr, systemMethod as tt, parseJsonObject as u, AdoptionPendingError as un, mergeSecretStatePaths as ur, readinessKey as ut, userError as v, RECORDS_ERROR_CODES as vn, transformSecretWrite as vr, CamStreamKindSchema as vt, createEventBusSliceSource as w, RevConflictError as wn, isSecretRef as wr, ProfileSlotSchema as wt, createDeviceProxy as x, RecordTooLargeError as xn, buildSecretRef as xr, DecodedAudioChunkSchema as xt, DEVICE_SCOPED_CAPS as y, RecordNotFoundError as yn, SECRET_REF_SCHEME as yr, CamStreamResolutionSchema as yt, defineCustomActions as z, RECORD_QUERY_MAX as zn, resolveHydratedFieldValue as zr, parseSettingsBrokersAdoptsFrom as zt };