@camstack/types 1.2.380 → 1.2.381

package/dist/{sleep-WsrozGDL.mjs → sleep-bZIhUvjd.mjs}

@@ -162,7 +162,7 @@ function collectKeychainStoredKeys(schema) {
 	return keys;
 }
 function walkKeychainField(field, out) {
-	if (!isRecord$5(field)) return;
+	if (!isRecord$6(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	const isSecret = type === "password" || field["secret"] === true;
@@ -187,21 +187,21 @@ function schemaDeclaresAnyField(schema) {
 	for (const section of sectionsOf(schema)) if (fieldsOf(section).length > 0) return true;
 	return false;
 }
-function isRecord$5(value) {
+function isRecord$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sectionsOf(schema) {
-	if (!isRecord$5(schema)) return [];
+	if (!isRecord$6(schema)) return [];
 	const sections = schema["sections"];
 	return Array.isArray(sections) ? sections : [];
 }
 function fieldsOf(node) {
-	if (!isRecord$5(node)) return [];
+	if (!isRecord$6(node)) return [];
 	const fields = node["fields"];
 	return Array.isArray(fields) ? fields : [];
 }
 function walkField(field, out) {
-	if (!isRecord$5(field)) return;
+	if (!isRecord$6(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
@@ -241,7 +241,7 @@ function walkField(field, out) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$4(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -252,19 +252,19 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$4(value)) return false;
+	if (!isRecord$5(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 /** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
 function isSecretMarkerLike(value) {
-	return isRecord$4(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+	return isRecord$5(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
 }
 function isSecretClear(value) {
-	return isRecord$4(value) && value["$secretClear"] === true;
+	return isRecord$5(value) && value["$secretClear"] === true;
 }
 function isSecretFieldView(value) {
-	return isRecord$4(value) && value["set"] === true && isSecretMarkerLike(value);
+	return isRecord$5(value) && value["set"] === true && isSecretMarkerLike(value);
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -677,6 +677,33 @@ function typeOf(field) {
 		default: return "other";
 	}
 }
+/** Strip inline `value` from a hydrated field for schema-only round-trips. */
+function dehydrateConfigField(field) {
+	if (field.type === "group") return {
+		...field,
+		fields: field.fields.map(dehydrateConfigField)
+	};
+	if (field.type === "sub-tabs") return {
+		...field,
+		tabs: field.tabs.map((tab) => ({
+			...tab,
+			fields: tab.fields.map(dehydrateConfigField)
+		}))
+	};
+	if (isValuelessField(field)) return field;
+	const { value: _drop, ...rest } = field;
+	return rest;
+}
+/** Inverse of {@link hydrateSchema} — drops resolved values from every leaf field. */
+function dehydrateSchema(schema) {
+	return {
+		...schema.tabs ? { tabs: [...schema.tabs] } : {},
+		sections: schema.sections.map((section) => ({
+			...section,
+			fields: section.fields.map(dehydrateConfigField)
+		}))
+	};
+}
 //#endregion
 //#region src/interfaces/event-bus.ts
 /**
@@ -1018,7 +1045,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$3(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -1031,7 +1058,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$3(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$4(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -1086,7 +1113,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$3) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$4) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -1102,7 +1129,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$3(row)) {
+		if (!isRecord$4(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -1127,7 +1154,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$3(incoming)) {
+			if (!isRecord$4(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -1135,7 +1162,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$3(stored) ? stored : {};
+			const storedObj = isRecord$4(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -1258,7 +1285,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$3(v)) {
+		if (isRecord$4(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -1292,7 +1319,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -1321,7 +1348,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord$2(item) && isRecord$2(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$3(item) && isRecord$3(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -1332,7 +1359,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord$2(value) && isRecord$2(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$3(value) && isRecord$3(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -1340,7 +1367,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord$2(incoming) || !isRecord$2(stored)) return incoming;
+	if (!isRecord$3(incoming) || !isRecord$3(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -1371,7 +1398,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord$2(a) && isRecord$2(b)) {
+	if (isRecord$3(a) && isRecord$3(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -1395,7 +1422,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord$2(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -2202,7 +2229,7 @@ var BaseAddon = class {
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
-			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
+			ctx.api.addons.restartAddon.mutate({ addonId }).then(() => {
 				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
@@ -3359,7 +3386,11 @@ function asRecordsError(err) {
 */
 var SECRET_META = { secret: true };
 function defOf(schema) {
-	return schema._zod?.def ?? {};
+	const zodBag = Reflect.get(schema, "_zod");
+	if (typeof zodBag !== "object" || zodBag === null) return {};
+	const def = Reflect.get(zodBag, "def");
+	if (typeof def !== "object" || def === null) return {};
+	return def;
 }
 function declaredHere(schema) {
 	return z.globalRegistry.get(schema)?.secret === true;
@@ -3459,11 +3490,11 @@ function secretArrayPrefixes(path) {
 	}
 	return prefixes;
 }
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function elementId(element, idKey, declared, prefix) {
-	const id = isRecord$1(element) ? element[idKey] : void 0;
+	const id = isRecord$2(element) ? element[idKey] : void 0;
 	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
 	return id;
 }
@@ -3474,7 +3505,7 @@ function elementId(element, idKey, declared, prefix) {
 */
 var REMOVE_LEAF = Symbol("remove-leaf");
 function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
-	if (!isRecord$1(node)) return node;
+	if (!isRecord$2(node)) return node;
 	const segment = segments[index];
 	if (segment === void 0) return node;
 	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
@@ -3711,7 +3742,7 @@ function declarationsOf(kinds) {
 }
 //#endregion
 //#region src/records/records-access.ts
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /** Run a transport call and give a wire failure its typed class back. */
@@ -3836,7 +3867,7 @@ var KindHandle = class {
 		}) : data;
 		const parsed = this.def.schema.safeParse(shaped);
 		if (!parsed.success) throw new InvalidRecordError(`${this.name}/${id}: ${zodSummary(parsed.error)}`);
-		if (!isRecord(parsed.data)) throw new InvalidRecordError(`${this.name}/${id}: the body must be an object`);
+		if (!isRecord$1(parsed.data)) throw new InvalidRecordError(`${this.name}/${id}: the body must be an object`);
 		return parsed.data;
 	}
 	async get(id) {
@@ -4005,7 +4036,7 @@ var KindHandle = class {
 	}
 };
 function toBody(value) {
-	if (!isRecord(value)) throw new InvalidRecordError("the record body must be an object");
+	if (!isRecord$1(value)) throw new InvalidRecordError("the record body must be an object");
 	return value;
 }
 /** Build the owner's records handle. */
@@ -4097,6 +4128,318 @@ function defineEntryKind(name, spec) {
 	return defined;
 }
 //#endregion
+//#region src/records/settings-brokers-adopts-from.ts
+/**
+* Legacy source for broker entry adoption (B2): brokers live in addon-settings
+* as one row `<addonId>.brokers` whose value is an array until records-adopt
+* copies them into the entry kind.
+*/
+var SETTINGS_BROKERS_ADOPTS_PREFIX = "@settings-brokers/";
+/** The `adoptsFrom` value for an addon's broker entry kind. */
+function settingsBrokersAdoptsFrom(addonId) {
+	return `${SETTINGS_BROKERS_ADOPTS_PREFIX}${addonId}`;
+}
+/** When non-null, `from` names an addon-settings brokers blob, not a SQL table. */
+function parseSettingsBrokersAdoptsFrom(from) {
+	if (!from.startsWith("@settings-brokers/")) return null;
+	const addonId = from.slice(18);
+	return addonId.length > 0 ? addonId : null;
+}
+//#endregion
+//#region src/records/settings-array-adopts-from.ts
+/**
+* Legacy source for entry adoption (B3): a list stored under addon-settings
+* `<addonId>.<key>` until records-adopt copies rows into the entry kind.
+*/
+var SETTINGS_ARRAY_ADOPTS_PREFIX = "@settings-array/";
+/** The `adoptsFrom` value for an addon-settings array field. */
+function settingsArrayAdoptsFrom(addonId, settingsKey) {
+	return `${SETTINGS_ARRAY_ADOPTS_PREFIX}${addonId}/${settingsKey}`;
+}
+/** When non-null, `from` names an addon-settings array blob, not a SQL table. */
+function parseSettingsArrayAdoptsFrom(from) {
+	if (!from.startsWith("@settings-array/")) return null;
+	const rest = from.slice(16);
+	const slash = rest.indexOf("/");
+	if (slash <= 0 || slash >= rest.length - 1) return null;
+	const addonId = rest.slice(0, slash);
+	const settingsKey = rest.slice(slash + 1);
+	if (addonId.length === 0 || settingsKey.length === 0) return null;
+	return {
+		addonId,
+		settingsKey
+	};
+}
+//#endregion
+//#region src/records/in-memory-records.ts
+/**
+* In-memory `RecordsAccess` for specs. Kinds are declared by the caller.
+* Lives in `@camstack/types` so a spec does not import another package's source.
+*/
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function markersOf(decl, body) {
+	const out = /* @__PURE__ */ new Map();
+	mapSecretLeaves(body, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+		if (isSecretMarker(leaf.value)) out.set(leaf.concrete, leaf.value.$secret);
+		return leaf.value;
+	});
+	return out;
+}
+function makeSpecKeychain(owner) {
+	const values = /* @__PURE__ */ new Map();
+	return { access: {
+		owner,
+		ref: (scope, fieldPath) => buildSecretRef({
+			owner,
+			scope,
+			fieldPath
+		}),
+		resolve: async (refs) => {
+			const out = {};
+			for (const ref of refs) {
+				const value = values.get(ref);
+				out[ref] = value === void 0 ? { kind: "missing" } : {
+					kind: "value",
+					value,
+					version: 1
+				};
+			}
+			return out;
+		},
+		put: async (ref, value) => {
+			values.set(ref, value);
+			return 1;
+		},
+		delete: async (refs) => {
+			let deleted = 0;
+			for (const ref of refs) if (values.delete(ref)) deleted += 1;
+			return deleted;
+		},
+		state: async () => ({ state: "ready" }),
+		onChange: () => () => void 0,
+		forOwner: null
+	} };
+}
+function makeInMemoryRecords(owner = "spec") {
+	const decls = /* @__PURE__ */ new Map();
+	const tables = /* @__PURE__ */ new Map();
+	let clock = 1;
+	let writesFail = false;
+	let readsFail = false;
+	const table = (kind) => {
+		let t = tables.get(kind);
+		if (t === void 0) {
+			t = /* @__PURE__ */ new Map();
+			tables.set(kind, t);
+		}
+		return t;
+	};
+	const declOf = (kind) => {
+		const decl = decls.get(kind);
+		if (decl === void 0) throw new Error(`kind "${kind}" is not declared`);
+		return decl;
+	};
+	const redact = (decl, body) => {
+		if (decl.secretPaths.length === 0) return body;
+		const out = mapSecretLeaves(body, decl.secretPaths, decl.secretArrayKeys, (leaf) => leaf.value === null ? null : REDACTED_SECRET);
+		return isRecord(out) ? out : body;
+	};
+	const view = (kind, row) => ({
+		id: row.id,
+		deviceId: null,
+		at: row.at,
+		expiresAt: null,
+		rev: row.rev,
+		updatedAt: row.updatedAt,
+		data: redact(declOf(kind), row.data)
+	});
+	const enforce = (kind, id, body, stored) => {
+		const decl = declOf(kind);
+		if (decl.secretPaths.length === 0) return {
+			body,
+			released: []
+		};
+		const before = stored === null ? /* @__PURE__ */ new Map() : markersOf(decl, stored);
+		const next = mapSecretLeaves(body, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+			const expected = recordSecretRef(owner, kind, id, leaf.concrete);
+			if (isSecretMarker(leaf.value)) {
+				if (leaf.value.$secret !== expected) throw new Error("foreign secret marker");
+				return leaf.value;
+			}
+			if (leaf.value === "__camstack_redacted__") {
+				const keep = before.get(leaf.concrete);
+				return keep === void 0 ? REMOVE_LEAF : {
+					$secret: keep,
+					v: 1
+				};
+			}
+			if (leaf.value === null || leaf.value === void 0) return REMOVE_LEAF;
+			throw new Error(`${kind}/${id}: a secret field takes a keychain marker, never a value`);
+		});
+		if (!isRecord(next)) throw new Error("the body must be an object");
+		const after = markersOf(decl, next);
+		return {
+			body: next,
+			released: [...before.entries()].filter(([p, ref]) => after.get(p) !== ref).map(([, r]) => r)
+		};
+	};
+	const write = (kind, input) => {
+		if (writesFail) throw new Error("records engine unreachable");
+		if (declOf(kind).at === "required" && input.at === void 0) throw new Error(`${kind}/${input.id}: the kind needs "at" on every write`);
+		const prev = table(kind).get(input.id);
+		const { body, released } = enforce(kind, input.id, input.data, prev?.data ?? null);
+		const rev = (prev?.rev ?? 0) + 1;
+		clock += 1;
+		table(kind).set(input.id, {
+			id: input.id,
+			at: input.at ?? null,
+			rev,
+			updatedAt: clock,
+			data: body
+		});
+		return {
+			rev,
+			released
+		};
+	};
+	const unimplemented = (op) => {
+		throw new Error(`the fake records transport does not implement ${op}`);
+	};
+	return {
+		records: createRecordsAccess({
+			owner,
+			transport: {
+				declareKinds: async ({ kinds }) => {
+					const out = {};
+					let n = 0;
+					for (const [name, decl] of Object.entries(kinds)) {
+						decls.set(name, decl);
+						n += 1;
+						out[name] = {
+							kindId: n,
+							state: "created",
+							createdIndexes: decl.indexes.map((i) => i.name),
+							adoptionPending: null
+						};
+					}
+					return { kinds: out };
+				},
+				get: async ({ kind, id }) => {
+					if (readsFail) throw new Error("records engine unreachable");
+					const row = table(kind).get(id);
+					return row === void 0 ? null : view(kind, row);
+				},
+				getMany: async ({ kind, ids }) => ids.flatMap((id) => {
+					const row = table(kind).get(id);
+					return row === void 0 ? [] : [view(kind, row)];
+				}),
+				secretRefs: async ({ kind, ids }) => {
+					const decl = declOf(kind);
+					const out = {};
+					for (const id of ids) {
+						const row = table(kind).get(id);
+						if (row !== void 0) out[id] = Object.fromEntries(markersOf(decl, row.data));
+					}
+					return out;
+				},
+				put: async ({ kind, record, ifRev }) => {
+					if (ifRev !== void 0 && (table(kind).get(record.id)?.rev ?? 0) !== ifRev) throw new Error("stale ifRev");
+					const { rev, released } = write(kind, record);
+					return {
+						rev,
+						releasedRefs: released
+					};
+				},
+				putMany: async ({ kind, records }) => {
+					const released = [];
+					for (const record of records) released.push(...write(kind, record).released);
+					return {
+						count: records.length,
+						releasedRefs: released
+					};
+				},
+				patch: async () => unimplemented("patch"),
+				delete: async ({ kind, id }) => {
+					if (writesFail) throw new Error("records engine unreachable");
+					const row = table(kind).get(id);
+					if (row === void 0) return {
+						deleted: false,
+						secretRefs: []
+					};
+					table(kind).delete(id);
+					return {
+						deleted: true,
+						secretRefs: [...markersOf(declOf(kind), row.data).values()]
+					};
+				},
+				deleteMany: async ({ kind, ids }) => {
+					let deleted = 0;
+					const refs = [];
+					for (const id of ids) {
+						const row = table(kind).get(id);
+						if (row === void 0) continue;
+						table(kind).delete(id);
+						deleted += 1;
+						refs.push(...markersOf(declOf(kind), row.data).values());
+					}
+					return {
+						deleted,
+						secretRefs: refs
+					};
+				},
+				query: async (q) => {
+					if (readsFail) throw new Error("records engine unreachable");
+					const decl = declOf(q.kind);
+					const asked = Object.keys(q.where ?? {});
+					if (asked.length > 0) {
+						if (!decl.indexes.some((index) => {
+							const leading = new Set(index.fields.slice(0, asked.length));
+							return asked.length <= index.fields.length && asked.every((f) => leading.has(f));
+						})) throw new Error(`${q.kind}: no declared index serves [${asked.join(", ")}]`);
+					}
+					let rows = [...table(q.kind).values()];
+					for (const [field, wanted] of Object.entries(q.where ?? {})) rows = rows.filter((r) => r.data[field] === wanted);
+					const byAt = q.order === "at" || q.order === void 0 && decl.at === "required";
+					rows.sort((a, b) => byAt ? (a.at ?? 0) - (b.at ?? 0) : a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+					if (q.desc === true) rows.reverse();
+					const start = q.cursor === void 0 ? 0 : Number(q.cursor);
+					const page = rows.slice(start, start + q.limit);
+					const more = start + q.limit < rows.length;
+					return {
+						records: page.map((r) => view(q.kind, r)),
+						nextCursor: more ? String(start + q.limit) : null
+					};
+				},
+				count: async ({ kind }) => ({ count: table(kind).size }),
+				histogram: async () => unimplemented("histogram"),
+				aggregate: async () => unimplemented("aggregate"),
+				deleteWhere: async () => unimplemented("deleteWhere"),
+				deleteDevice: async () => unimplemented("deleteDevice"),
+				allocateId: async () => unimplemented("allocateId")
+			},
+			secrets: makeSpecKeychain(owner).access
+		}),
+		tables,
+		failWrites: (on) => {
+			writesFail = on;
+		},
+		failReads: (on) => {
+			readsFail = on;
+		},
+		seed: (kind, row) => {
+			table(kind).set(row.id, {
+				id: row.id,
+				at: row.at ?? null,
+				rev: 1,
+				updatedAt: 1,
+				data: row.data
+			});
+		}
+	};
+}
+//#endregion
 //#region src/capabilities/schemas/streaming-shared.ts
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = z.enum([
@@ -5256,6 +5599,30 @@ function describeCustomActions(catalog) {
 	return out;
 }
 //#endregion
+//#region src/capabilities/caller-stamp.ts
+/**
+* Every cap whose provider reads a `callerAddonId` in its input (the keychain's
+* owner check, device-history's `not-owner`, records' owner).
+*
+* The stamp is set ONLY by the transport (`stampCallerAddonId`, or stated by a
+* hub in-process caller). The generated HTTP/tRPC mount parses input with
+* `.loose()`, so without this a session could add the key itself and act as
+* another addon. The mount strips it for these caps.
+*/
+var CALLER_STAMPED_CAPABILITIES = [
+	"keychain",
+	"device-history",
+	"records",
+	"integrations",
+	"device-manager"
+];
+/** A copy of `input` without the caller stamp. Anything that is not a plain object passes through. */
+function withoutCallerStamp(input) {
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return input;
+	if (!Object.prototype.hasOwnProperty.call(input, "callerAddonId")) return input;
+	return Object.fromEntries(Object.entries(input).filter(([key]) => key !== "callerAddonId"));
+}
+//#endregion
 //#region src/device/children-batch-max.ts
 /**
 * Most parents one `getChildrenBatch` may name.
@@ -5758,6 +6125,50 @@ function isSource(x) {
 	return typeof x.read === "function" && typeof x.watch === "function";
 }
 //#endregion
+//#region src/helpers/addon-slice-handle.ts
+/** Structural bridge: every `AddonApi` client carries `deviceState` (+ optional `live`). */
+function addonSliceHandleApi(api) {
+	return api;
+}
+//#endregion
+//#region src/helpers/trpc-leaf.ts
+function isTrpcProcedureLeaf(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return (typeof record.query === "function" || typeof record.mutate === "function" || typeof record.subscribe === "function") && !Array.isArray(value);
+}
+function readCapRecord(api, capProp) {
+	const cap = Reflect.get(api, capProp);
+	if (typeof cap !== "object" || cap === null || Array.isArray(cap)) return void 0;
+	return cap;
+}
+function readTrpcLeaf(api, capProp, method) {
+	const capRecord = readCapRecord(api, capProp);
+	if (!capRecord) throw new Error(`tRPC client has no router '${capProp}'`);
+	const leaf = capRecord[method];
+	if (!isTrpcProcedureLeaf(leaf)) throw new Error(`tRPC client has no '${capProp}.${method}'`);
+	return leaf;
+}
+/**
+* Invoke `api.<capProp>.<method>.{query|mutate|subscribe}(input)`.
+* `Result` is the generated proxy method's return. The leaf itself is only
+* `unknown` (the client is a structural bag), so the assertion is the one
+* boundary between that bag and the typed proxy.
+*/
+function invokeTrpcLeaf(api, capProp, method, kind, input, push) {
+	const fn = readTrpcLeaf(api, capProp, method);
+	if (kind === "mutation") {
+		if (typeof fn.mutate !== "function") throw new Error(`tRPC '${capProp}.${method}' has no mutate()`);
+		return fn.mutate(input);
+	}
+	if (kind === "subscription") {
+		if (typeof fn.subscribe !== "function") throw new Error(`tRPC '${capProp}.${method}' has no subscribe()`);
+		return fn.subscribe(input, push);
+	}
+	if (typeof fn.query !== "function") throw new Error(`tRPC '${capProp}.${method}' has no query()`);
+	return fn.query(input);
+}
+//#endregion
 //#region src/generated/device-proxy.ts
 /**
 * Build a DeviceProxy that pre-binds deviceId + nodeId on every method call
@@ -5775,8 +6186,7 @@ function isSource(x) {
 * field on the returned object.
 */
 function createDeviceProxy(api, binding, opts) {
-	const typedApi = api;
-	const stateSource = opts?.stateSource ?? createLazyTrpcSource(api);
+	const stateSource = opts?.stateSource ?? createLazyTrpcSource(addonSliceHandleApi(api));
 	/** Merge `{deviceId, nodeId?}` into the caller-supplied input. */
 	function mergeInput(input, nodeId) {
 		const base = typeof input === "object" && input !== null ? input : {};
@@ -5789,20 +6199,8 @@ function createDeviceProxy(api, binding, opts) {
 			deviceId: binding.deviceId
 		};
 	}
-	/**
-	* Invoke `api.<capProp>.<method>.{query|mutate|subscribe}(merged)`.
-	* Returns `any` so the caller-side per-method declaration assigns
-	* cleanly into the strongly-typed `InferDeviceProxyCap<...>` shape on
-	* the `DeviceProxy` interface — the proxy's contract is enforced by
-	* the interface, not the dispatch helper.
-	*/
 	function callLeaf(capProp, method, kind, merged, push) {
-		const leaf = typedApi[capProp]?.[method];
-		if (!leaf) throw new Error(`DeviceProxy: api has no '${capProp}.${method}'`);
-		const fn = leaf;
-		if (kind === "mutation") return fn.mutate(merged);
-		if (kind === "subscription") return fn.subscribe(merged, push);
-		return fn.query(merged);
+		return invokeTrpcLeaf(api, capProp, method, kind, merged, push);
 	}
 	/**
 	* Device-scoped cap dispatch. Looks up the binding entry for `capName`
@@ -7074,4 +7472,4 @@ function sleepCancellable(ms, signal) {
 	});
 }
 //#endregion
-export { nodePin as $, mergeSecretStatePaths as $n, AdoptionPendingError as $t, RawStateResultSchema as A, RECORD_SETTINGS_MAX_ROWS as An, isSecretFieldView as Ar, defineEntryKind as At, DEVICE_SETTINGS_CONTRIBUTION_METHODS as B, scrubKnownSecrets as Bn, schemaDeclaresAnyField as Br, declarationsOf as Bt, createLazyTrpcSource as C, RECORD_DELETE_BATCH as Cn, collectHydratedFieldEntries as Cr, StreamSourceSchema as Ct, HF_BASE_URL as D, RECORD_MAX_INDEX_FIELDS as Dn, SECRET_CLEAR as Dr, makeSourceBrokerId as Dt, DEFAULT_TOKEN_EXPIRY as E, RECORD_MAX_INDEXES as En, resolveHydratedFieldValue as Er, makeProfileBrokerId as Et, defineCustomActions as F, MIN_SCRUBBED_LENGTH as Fn, REDACTED_SECRET as Fr, RecordIndexSchema as Ft, event as G, PEER_BYTES_TICKET_TTL_MS as Gn, parseSecretPath as Gt, HISTORY_DEFAULT_MIN_INTERVAL_MS as H, PEER_BYTES_CHUNK_BYTES as Hn, audioChunkBytesPerSample as Hr, REMOVE_LEAF as Ht, describeCustomActions as I, clearKnownSecrets as In, collectKeychainStoredKeys as Ir, RecordKindDeclarationSchema as It, method as J, SHARE_VIEW_KINDS as Jn, recordSecretRef as Jt, expandCapMethods as K, PeerBytesTicketSchema as Kn, recordArrayItemPath as Kt, deviceCustomAction as L, forgetKnownSecret as Ln, collectSecretConfigKeys as Lr, RecordKindNameSchema as Lt, viewerUiCapability as M, resolveSecretViewsIn as Mn, isSecretMarkerLike as Mr, createRecordsAccess as Mt, DEVICE_CHILDREN_BATCH_MAX as N, REVALIDATE_AFTER_MS as Nn, makeSecretMarker as Nr, EntryDescriptorSchema as Nt, HF_REPO as O, RECORD_QUERY_MAX as On, classifySecretWrite as Or, parseProfileBrokerId as Ot, customAction as P, createSecretsAccess as Pn, toSecretFieldView as Pr, RecordFieldPathSchema as Pt, CAP_NODE_PIN_CONTEXT_KEY as Q, normalizeAddonInitResult as Qn, isZodSecret as Qt, adminUiCapability as R, knownSecretCount as Rn, isKeychainStoredField as Rr, RecordRetentionSchema as Rt, createEventBusSliceSource as S, RECORD_DEFAULT_MAX_DATA_BYTES as Sn, WELL_KNOWN_TAB_MAP as Sr, StreamSourceEntrySchema$1 as St, createSliceHandle as T, RECORD_MAX_DATA_BYTES as Tn, hydrateSchema as Tr, SubscribeAudioChunksResultSchema as Tt, HISTORY_UNIT_LABELS as U, PEER_BYTES_MAX_OUTSTANDING as Un, expandAudioChunkToF32le as Ur, collectSecretLeaves as Ut, DEVICE_STATUS_METHOD as V, shortSecretRefHash as Vn, AUDIO_CHUNK_FORMATS as Vr, defineRecordKinds as Vt, PROVIDER_PIN_FIELD as W, PEER_BYTES_STALL_MS as Wn, isAudioChunkFormat as Wr, mapSecretLeaves as Wt, resolveCapMount as X, BaseAddon as Xn, SECRET_META as Xt, optionalMethod as Y, DisposerChain as Yn, secretArrayPrefixes as Yt, systemMethod as Z, classifyStoreError as Zn, collectZodSecretPaths as Zt, readErrorI18n as _, recordsErrorFromMessage as _n, createDurableState as _r, DecodedAudioChunkSchema as _t, asJsonArray as a, NoCallerError as an, isSecretRefOwnedBy as ar, emitDownForOwnedCaps as at, isDeviceScopedCap as b, RECORD_CLASSES as bn, isEvent as br, ProfileSlotSchema as bt, asString as c, RecordNotFoundError as cn, SECRET_REF_SCHEME as cr, AudioChunkFormatSchema as ct, parseJsonUnknown as d, RecordUniqueViolationError as dn, formatSecretScope as dr, BrokerStatusSchema as dt, BatchTooLargeError as en, parseSecretStatePath as er, readNodePin as et, hfModelUrl as f, RecordsError as fn, globalSecretScope as fr, CAM_PROFILE_ORDER as ft, ErrorI18nPayloadSchema as g, asRecordsError as gn, normalizeNodeId as gr, CameraStreamSchema as gt, ErrorCodeSchema as h, UnknownRecordKindError as hn, parseSecretRef as hr, CamStreamResolutionSchema as ht, asBoolean as i, InvalidRecordError as in, collectSecretMarkerRefs as ir, ReadinessTimeoutError as it, deviceOpsCapability as j, RECORD_SWEEP_INTERVAL_MS as jn, isSecretMarker as jr, entryBody as jt, RUNTIME_DEFAULTS as k, RECORD_SECRET_COLLECTION_PREFIX as kn, isSecretClear as kr, selectAssignedProfileSlots as kt, parseJsonArray as l, RecordSecretUnavailableError as ln, arrayItemFieldPath as lr, AudioStreamPickSchema as lt, CamstackError as m, UnindexedFilterError as mn, normalizeSecretOwner as mr, CamStreamKindSchema as mt, sleepCancellable as n, FilterRequiredError as nn, secretTreeFromSchema as nr, MODEL_FORMATS as nt, asJsonObject as o, PlaintextSecretError as on, resolveSecretMarkers as or, readinessKey as ot, BOOT_RECOVERY_BACKOFF_MS as p, RevConflictError as pn, isSecretRef as pr, CamProfileSchema as pt, isDeviceConfigCap as q, DATAPLANE_SECRET_HEADER as qn, recordSecretCollection as qt, maskUrlCredentials as r, ForeignSecretMarkerError as rn, KeychainWriteRefusedError as rr, ReadinessRegistry as rt, asNumber as s, RECORDS_ERROR_CODES as sn, transformSecretWrite as sr, scopeKey as st, sleep as t, DeclarationRefusedError as tn, secretTreeFromPaths as tr, toNodeId as tt, parseJsonObject as u, RecordTooLargeError as un, buildSecretRef as ur, BrokerStatsSchema as ut, userError as v, RECORD_BATCH_MAX as vn, createEvent as vr, FrameHandleSchema as vt, createMirrorSource as w, RECORD_ID_MAX_LENGTH as wn, collectHydratedFieldValues as wr, SubscribeAudioChunksInputSchema as wt, createDeviceProxy as x, RECORD_DATABASES as xn, WELL_KNOWN_TABS as xr, ProfileSlotStatusSchema as xt, DEVICE_SCOPED_CAPS as y, RECORD_BATCH_MAX_BYTES as yn, emitReadiness as yr, ProfileRtspEntrySchema as yt, DEFAULT_RUNTIME_STATE_DURABILITY as z, registerKnownSecret as zn, isSecretConfigField as zr, assertValidDeclaration as zt };
+export { optionalMethod as $, PEER_BYTES_CHUNK_BYTES as $n, schemaDeclaresAnyField as $r, REMOVE_LEAF as $t, HF_REPO as A, RECORD_BATCH_MAX_BYTES as An, emitReadiness as Ar, makeProfileBrokerId as At, describeCustomActions as B, RECORD_SECRET_COLLECTION_PREFIX as Bn, SECRET_CLEAR as Br, settingsBrokersAdoptsFrom as Bt, addonSliceHandleApi as C, RecordsError as Cn, globalSecretScope as Cr, ProfileRtspEntrySchema as Ct, createSliceHandle as D, asRecordsError as Dn, normalizeNodeId as Dr, StreamSourceSchema as Dt, createMirrorSource as E, UnknownRecordKindError as En, parseSecretRef as Er, StreamSourceEntrySchema$1 as Et, DEVICE_CHILDREN_BATCH_MAX as F, RECORD_ID_MAX_LENGTH as Fn, collectHydratedFieldValues as Fr, SETTINGS_ARRAY_ADOPTS_PREFIX as Ft, DEVICE_STATUS_METHOD as G, createSecretsAccess as Gn, isSecretMarkerLike as Gr, RecordFieldPathSchema as Gt, adminUiCapability as H, RECORD_SWEEP_INTERVAL_MS as Hn, isSecretClear as Hr, entryBody as Ht, CALLER_STAMPED_CAPABILITIES as I, RECORD_MAX_DATA_BYTES as In, dehydrateConfigField as Ir, parseSettingsArrayAdoptsFrom as It, PROVIDER_PIN_FIELD as J, forgetKnownSecret as Jn, REDACTED_SECRET as Jr, RecordKindNameSchema as Jt, HISTORY_DEFAULT_MIN_INTERVAL_MS as K, MIN_SCRUBBED_LENGTH as Kn, makeSecretMarker as Kr, RecordIndexSchema as Kt, withoutCallerStamp as L, RECORD_MAX_INDEXES as Ln, dehydrateSchema as Lr, settingsArrayAdoptsFrom as Lt, RawStateResultSchema as M, RECORD_DATABASES as Mn, WELL_KNOWN_TABS as Mr, parseProfileBrokerId as Mt, deviceOpsCapability as N, RECORD_DEFAULT_MAX_DATA_BYTES as Nn, WELL_KNOWN_TAB_MAP as Nr, selectAssignedProfileSlots as Nt, DEFAULT_TOKEN_EXPIRY as O, recordsErrorFromMessage as On, createDurableState as Or, SubscribeAudioChunksInputSchema as Ot, viewerUiCapability as P, RECORD_DELETE_BATCH as Pn, collectHydratedFieldEntries as Pr, makeInMemoryRecords as Pt, method as Q, shortSecretRefHash as Qn, isSecretConfigField as Qr, defineRecordKinds as Qt, customAction as R, RECORD_MAX_INDEX_FIELDS as Rn, hydrateSchema as Rr, SETTINGS_BROKERS_ADOPTS_PREFIX as Rt, invokeTrpcLeaf as S, RecordUniqueViolationError as Sn, formatSecretScope as Sr, FrameHandleSchema as St, createLazyTrpcSource as T, UnindexedFilterError as Tn, normalizeSecretOwner as Tr, ProfileSlotStatusSchema as Tt, DEFAULT_RUNTIME_STATE_DURABILITY as U, resolveSecretViewsIn as Un, isSecretFieldView as Ur, createRecordsAccess as Ut, deviceCustomAction as V, RECORD_SETTINGS_MAX_ROWS as Vn, classifySecretWrite as Vr, defineEntryKind as Vt, DEVICE_SETTINGS_CONTRIBUTION_METHODS as W, REVALIDATE_AFTER_MS as Wn, isSecretMarker as Wr, EntryDescriptorSchema as Wt, expandCapMethods as X, registerKnownSecret as Xn, collectSecretConfigKeys as Xr, assertValidDeclaration as Xt, event as Y, knownSecretCount as Yn, collectKeychainStoredKeys as Yr, RecordRetentionSchema as Yt, isDeviceConfigCap as Z, scrubKnownSecrets as Zn, isKeychainStoredField as Zr, declarationsOf as Zt, readErrorI18n as _, PlaintextSecretError as _n, resolveSecretMarkers as _r, CamProfileSchema as _t, asJsonArray as a, recordSecretRef as an, SHARE_VIEW_KINDS as ar, toNodeId as at, isDeviceScopedCap as b, RecordSecretUnavailableError as bn, arrayItemFieldPath as br, CameraStreamSchema as bt, asString as c, collectZodSecretPaths as cn, classifyStoreError as cr, ReadinessTimeoutError as ct, parseJsonUnknown as d, BatchTooLargeError as dn, parseSecretStatePath as dr, scopeKey as dt, AUDIO_CHUNK_FORMATS as ei, collectSecretLeaves as en, PEER_BYTES_MAX_OUTSTANDING as er, resolveCapMount as et, hfModelUrl as f, DeclarationRefusedError as fn, secretTreeFromPaths as fr, AudioChunkFormatSchema as ft, ErrorI18nPayloadSchema as g, NoCallerError as gn, isSecretRefOwnedBy as gr, CAM_PROFILE_ORDER as gt, ErrorCodeSchema as h, InvalidRecordError as hn, collectSecretMarkerRefs as hr, BrokerStatusSchema as ht, asBoolean as i, recordSecretCollection as in, DATAPLANE_SECRET_HEADER as ir, readNodePin as it, RUNTIME_DEFAULTS as j, RECORD_CLASSES as jn, isEvent as jr, makeSourceBrokerId as jt, HF_BASE_URL as k, RECORD_BATCH_MAX as kn, createEvent as kr, SubscribeAudioChunksResultSchema as kt, parseJsonArray as l, isZodSecret as ln, normalizeAddonInitResult as lr, emitDownForOwnedCaps as lt, CamstackError as m, ForeignSecretMarkerError as mn, KeychainWriteRefusedError as mr, BrokerStatsSchema as mt, sleepCancellable as n, expandAudioChunkToF32le as ni, parseSecretPath as nn, PEER_BYTES_TICKET_TTL_MS as nr, CAP_NODE_PIN_CONTEXT_KEY as nt, asJsonObject as o, secretArrayPrefixes as on, DisposerChain as or, MODEL_FORMATS as ot, BOOT_RECOVERY_BACKOFF_MS as p, FilterRequiredError as pn, secretTreeFromSchema as pr, AudioStreamPickSchema as pt, HISTORY_UNIT_LABELS as q, clearKnownSecrets as qn, toSecretFieldView as qr, RecordKindDeclarationSchema as qt, maskUrlCredentials as r, isAudioChunkFormat as ri, recordArrayItemPath as rn, PeerBytesTicketSchema as rr, nodePin as rt, asNumber as s, SECRET_META as sn, BaseAddon as sr, ReadinessRegistry as st, sleep as t, audioChunkBytesPerSample as ti, mapSecretLeaves as tn, PEER_BYTES_STALL_MS as tr, systemMethod as tt, parseJsonObject as u, AdoptionPendingError as un, mergeSecretStatePaths as ur, readinessKey as ut, userError as v, RECORDS_ERROR_CODES as vn, transformSecretWrite as vr, CamStreamKindSchema as vt, createEventBusSliceSource as w, RevConflictError as wn, isSecretRef as wr, ProfileSlotSchema as wt, createDeviceProxy as x, RecordTooLargeError as xn, buildSecretRef as xr, DecodedAudioChunkSchema as xt, DEVICE_SCOPED_CAPS as y, RecordNotFoundError as yn, SECRET_REF_SCHEME as yr, CamStreamResolutionSchema as yt, defineCustomActions as z, RECORD_QUERY_MAX as zn, resolveHydratedFieldValue as zr, parseSettingsBrokersAdoptsFrom as zt };