camstack 1.2.202 → 1.2.203

package/dist/{launcher-R27OU5QD.js → launcher-J5GG4YZB.js}

@@ -24024,9 +24024,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-Dwi4JA96.js
-var require_dist_Dwi4JA96 = __commonJS({
-  "../system/dist/dist-Dwi4JA96.js"(exports) {
+// ../system/dist/dist-QyW9hVO2.js
+var require_dist_QyW9hVO2 = __commonJS({
+  "../system/dist/dist-QyW9hVO2.js"(exports) {
     "use strict";
     var zod = require_zod();
     __require("crypto");
@@ -24110,6 +24110,8 @@ var require_dist_Dwi4JA96 = __commonJS({
       EventCategory2["PipelineCameraUnassigned"] = "pipeline.camera-unassigned";
       EventCategory2["PipelineNodeInferenceUnavailable"] = "pipeline.node-inference-unavailable";
       EventCategory2["PipelineDetectionBlind"] = "pipeline.detection-blind";
+      EventCategory2["PipelineMotionNoisy"] = "pipeline.motion-noisy";
+      EventCategory2["PipelineMotionCalm"] = "pipeline.motion-calm";
       EventCategory2["PipelineCameraUpdated"] = "pipeline.camera-updated";
       EventCategory2["PipelineIngestOwnerChanged"] = "pipeline.ingest-owner-changed";
       EventCategory2["PipelineRunnerLoadSnapshot"] = "pipeline.runner-load-snapshot";
@@ -26475,6 +26477,12 @@ var require_dist_Dwi4JA96 = __commonJS({
         this.name = "BatchTooLargeError";
       }
     };
+    var TransactRefusedError = class extends RecordsError {
+      constructor(detail) {
+        super("transact-refused", detail);
+        this.name = "TransactRefusedError";
+      }
+    };
     function defOf(schema) {
       const zodBag = Reflect.get(schema, "_zod");
       if (typeof zodBag !== "object" || zodBag === null) return {};
@@ -26655,7 +26663,7 @@ var require_dist_Dwi4JA96 = __commonJS({
       /** JSON Schema of the entry body; `secret: true` marks a password field. */
       fields: zod.z.record(zod.z.string(), zod.z.unknown())
     }).strict();
-    var RecordKindDeclarationSchema = zod.z.object({
+    var RecordKindDeclarationShape = zod.z.object({
       database: zod.z.enum(RECORD_DATABASES).default("settings"),
       class: zod.z.enum(RECORD_CLASSES),
       writeTrigger: zod.z.string().min(1),
@@ -26673,18 +26681,12 @@ var require_dist_Dwi4JA96 = __commonJS({
       secretPaths: zod.z.array(zod.z.string().min(1)).default([]),
       /** The id key of each array that carries a secret (`{ headers: 'name' }`). */
       secretArrayKeys: zod.z.record(zod.z.string(), zod.z.string()).default({}),
-      /**
-      * RETIRED (D900): the legacy table a kind adopted from during the records
-      * migration. Nothing declares it any more and nothing reads it; the schema
-      * still ACCEPTS it because the catalog rows the migration wrote carry it
-      * (an orphaned kind is never redeclared) and an addon built before the
-      * removal still sends it. Never set it.
-      */
-      adoptsFrom: zod.z.string().min(1).optional(),
       /** Kinds that must agree through `transact` sit in one file under one family name. */
       transactFamily: zod.z.string().min(1).optional(),
       entry: EntryDescriptorSchema.optional()
-    }).strict();
+    });
+    var RecordKindDeclarationSchema = RecordKindDeclarationShape.strict();
+    var StoredRecordKindDeclarationSchema = RecordKindDeclarationShape;
     var RecordKindNameSchema = zod.z.string().regex(/^[a-z][a-z0-9-]{0,47}$/);
     function assertValidDeclaration(name, decl) {
       const refuse = (why) => {
@@ -26762,6 +26764,16 @@ var require_dist_Dwi4JA96 = __commonJS({
       }
       return out;
     }
+    function assertTransactScope(members) {
+      const byKind = /* @__PURE__ */ new Map();
+      for (const m of members) byKind.set(m.kind, m);
+      const kinds = [...byKind.values()];
+      if (new Set(kinds.map((m) => m.declaration.database)).size > 1) throw new TransactRefusedError(`cross-file: the ops span more than one database file (${kinds.map((m) => `${m.kind}@${m.declaration.database}`).join(", ")}); a transaction lives in ONE file`);
+      if (kinds.length <= 1) return;
+      const missing = kinds.filter((m) => m.declaration.transactFamily === void 0);
+      if (missing.length > 0) throw new TransactRefusedError(`no-family: ${missing.map((m) => m.kind).join(", ")} declare no transactFamily; kinds that must agree through transact share one`);
+      if (new Set(kinds.map((m) => m.declaration.transactFamily)).size > 1) throw new TransactRefusedError(`cross-family: the ops span more than one transactFamily (${kinds.map((m) => `${m.kind}=${String(m.declaration.transactFamily)}`).join(", ")})`);
+    }
     var CamProfileSchema = zod.z.enum([
       "high",
       "mid",
@@ -31484,17 +31496,6 @@ var require_dist_Dwi4JA96 = __commonJS({
       createdAt: zod.z.number(),
       updatedAt: zod.z.number()
     });
-    var ApiKeyRecordSchema = zod.z.object({
-      id: zod.z.string(),
-      label: zod.z.string(),
-      isAdmin: zod.z.boolean().default(false),
-      allowedProviders: AllowedProviderSchema,
-      allowedDevices: AllowedDevicesSchema,
-      tokenHash: zod.z.string(),
-      tokenPrefix: zod.z.string(),
-      createdAt: zod.z.number(),
-      lastUsedAt: zod.z.number().optional()
-    });
     var ScopedTokenSchema = zod.z.object({
       id: zod.z.string(),
       userId: zod.z.string(),
@@ -36858,15 +36859,31 @@ var require_dist_Dwi4JA96 = __commonJS({
     var DeclareKindResultSchema = zod.z.object({
       kindId: zod.z.number().int(),
       state: RecordKindStateSchema,
-      createdIndexes: zod.z.array(zod.z.string()),
-      /**
-      * RETIRED (D900): always `null`. It carried the records-migration boot guard;
-      * it stays on the wire, null, because an addon built before the removal reads
-      * an ABSENT field as "adoption pending" and refuses to start.
-      */
-      adoptionPending: zod.z.null()
+      createdIndexes: zod.z.array(zod.z.string())
     });
     var SecretRefsList = zod.z.array(zod.z.string());
+    var RecordTransactOpSchema = zod.z.discriminatedUnion("op", [
+      zod.z.object({
+        op: zod.z.literal("put"),
+        kind: RecordKindNameSchema,
+        record: RecordInputSchema,
+        ifRev: zod.z.number().int().min(0).optional()
+      }),
+      zod.z.object({
+        op: zod.z.literal("patch"),
+        kind: RecordKindNameSchema,
+        id: RecordIdSchema,
+        data: RecordBodySchema,
+        at: zod.z.number().int().nullable().optional(),
+        expiresAt: zod.z.number().int().nullable().optional(),
+        ifRev: zod.z.number().int().min(1).optional()
+      }),
+      zod.z.object({
+        op: zod.z.literal("delete"),
+        kind: RecordKindNameSchema,
+        id: RecordIdSchema
+      })
+    ]);
     var RecordSecretRefsSchema = zod.z.record(zod.z.string(), zod.z.record(zod.z.string(), zod.z.string()));
     var recordsCapability = {
       name: "records",
@@ -36998,6 +37015,22 @@ var require_dist_Dwi4JA96 = __commonJS({
           kind: "mutation",
           auth: "admin"
         }),
+        /**
+        * Several single-row writes (put / patch / delete) in ONE SQLite transaction:
+        * all land or none does. Every op's kind must sit in one file and share one
+        * `transactFamily` (`records/transact-refused` otherwise). Results are in op order.
+        */
+        transact: method(zod.z.object({ ops: zod.z.array(RecordTransactOpSchema).min(1).max(RECORD_BATCH_MAX) }), zod.z.object({
+          results: zod.z.array(zod.z.object({
+            rev: zod.z.number().int().nullable(),
+            deleted: zod.z.boolean()
+          })),
+          releasedRefs: SecretRefsList,
+          secretRefs: SecretRefsList
+        }), {
+          kind: "mutation",
+          auth: "admin"
+        }),
         /** The D865 hook body: every kind of this addon declared `deviceRemoval: 'delete'`. */
         deleteDevice: method(zod.z.object({
           deviceId: zod.z.number().int(),
@@ -63094,9 +63127,13 @@ var require_dist_Dwi4JA96 = __commonJS({
       "node-updating",
       "node-inference-unavailable",
       "detection-blind",
+      "motion-noisy",
+      "motion-calm",
       "recording-stalled",
       "recording-healthy",
       "recording-degraded",
+      "device-attention-required",
+      "device-attention-resolved",
       "storage-location-low",
       "storage-location-critical",
       "storage-location-ok",
@@ -76537,6 +76574,16 @@ var require_dist_Dwi4JA96 = __commonJS({
       powerState: zod.z.string().nullable(),
       saltLevel: DishwasherConsumableLevelSchema.nullable(),
       rinseAidLevel: DishwasherConsumableLevelSchema.nullable(),
+      /**
+      * True while the appliance asks for its filter to be cleaned (smart-filter, filter-system or
+      * combined care-and-filter reminder raised); false when every such reminder reads clear; null
+      * when none is reported. A cleared reminder is not an unknown one.
+      */
+      filterCleaningDue: zod.z.boolean().nullable(),
+      /** True while the machine-care (descaling / cleaning-program) reminder is raised; false when clear; null when not reported. */
+      machineCareDue: zod.z.boolean().nullable(),
+      /** Program runs left before the machine-care reminder is due; null when the appliance does not say. */
+      machineCareRemainingRuns: zod.z.number().int().nonnegative().nullable(),
       /** Option states: null when the appliance does not expose the option or has not said. */
       halfLoad: zod.z.boolean().nullable(),
       hygienePlus: zod.z.boolean().nullable(),
@@ -84663,16 +84710,6 @@ var require_dist_Dwi4JA96 = __commonJS({
       allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])).optional(),
       scopes: zod.z.array(TokenScopeSchema).optional()
     });
-    var ApiKeySummarySchema = zod.z.object({
-      id: zod.z.string(),
-      label: zod.z.string(),
-      isAdmin: zod.z.boolean().default(false),
-      allowedProviders: zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")]).optional(),
-      allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])).optional(),
-      tokenPrefix: zod.z.string(),
-      createdAt: zod.z.number(),
-      lastUsedAt: zod.z.number().optional()
-    });
     var OauthSessionSummarySchema = zod.z.object({
       id: zod.z.string(),
       userId: zod.z.string(),
@@ -84753,12 +84790,6 @@ var require_dist_Dwi4JA96 = __commonJS({
           kind: "mutation",
           access: "view"
         }),
-        listApiKeys: method(zod.z.void(), zod.z.array(ApiKeySummarySchema), { auth: "admin" }),
-        revokeApiKey: method(zod.z.object({ id: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
-          kind: "mutation",
-          auth: "admin",
-          access: "delete"
-        }),
         setupTotp: method(zod.z.object({ userId: zod.z.string() }), TotpSetupResultSchema, {
           kind: "mutation",
           auth: "admin",
@@ -94106,6 +94137,12 @@ var require_dist_Dwi4JA96 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "records.transact": {
+        capName: "records",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "sceneMonitor.captureReference": {
         capName: "scene-monitor",
         capScope: "device",
@@ -95438,12 +95475,6 @@ var require_dist_Dwi4JA96 = __commonJS({
         addonId: null,
         access: "view"
       },
-      "userManagement.listApiKeys": {
-        capName: "user-management",
-        capScope: "system",
-        addonId: null,
-        access: "view"
-      },
       "userManagement.listExternalIdentities": {
         capName: "user-management",
         capScope: "system",
@@ -95498,12 +95529,6 @@ var require_dist_Dwi4JA96 = __commonJS({
         addonId: null,
         access: "create"
       },
-      "userManagement.revokeApiKey": {
-        capName: "user-management",
-        capScope: "system",
-        addonId: null,
-        access: "delete"
-      },
       "userManagement.revokeOauthSession": {
         capName: "user-management",
         capScope: "system",
@@ -99702,9 +99727,13 @@ var require_dist_Dwi4JA96 = __commonJS({
       "stream-online": "device-events",
       "stream-offline": "device-events",
       "detection-blind": "device-events",
+      "motion-noisy": "device-events",
+      "motion-calm": "device-events",
       "recording-stalled": "device-events",
       "recording-healthy": "device-events",
       "recording-degraded": "device-events",
+      "device-attention-required": "device-events",
+      "device-attention-resolved": "device-events",
       "node-online": "system",
       "node-offline": "system",
       "node-restarting": "system",
@@ -99787,6 +99816,12 @@ var require_dist_Dwi4JA96 = __commonJS({
         label: "Detecting nothing",
         kinds: ["detection-blind"]
       },
+      {
+        id: "motion-noise",
+        family: "device-events",
+        label: "Motion without a subject",
+        kinds: ["motion-noisy", "motion-calm"]
+      },
       {
         id: "recording",
         family: "device-events",
@@ -99797,6 +99832,12 @@ var require_dist_Dwi4JA96 = __commonJS({
           "recording-degraded"
         ]
       },
+      {
+        id: "device-attention",
+        family: "device-events",
+        label: "Needs attention",
+        kinds: ["device-attention-required", "device-attention-resolved"]
+      },
       {
         id: "nodes",
         family: "system",
@@ -99948,6 +99989,7 @@ var require_dist_Dwi4JA96 = __commonJS({
       "alert-error",
       "alert-critical-resolved"
     ];
+    var DEVICE_ATTENTION = ["device-attention-required", "device-attention-resolved"];
     var UPDATES = [
       "addon-update-available",
       "server-update-available",
@@ -99977,9 +100019,12 @@ var require_dist_Dwi4JA96 = __commonJS({
       "stream-online",
       "stream-offline",
       "detection-blind",
+      "motion-noisy",
+      "motion-calm",
       "recording-stalled",
       "recording-healthy",
       "recording-degraded",
+      ...DEVICE_ATTENTION,
       ...ALARM
     ];
     var SUMMARISABLE = [...systemEventKindsOfFamily("device-events"), ...systemEventKindsOfFamily("system")];
@@ -100144,7 +100189,9 @@ var require_dist_Dwi4JA96 = __commonJS({
       [...RULE_TEXT],
       [...RULE_TEXT],
       [...RULE_TEXT],
-      ([...RULE_TEXT], [...ALERT_EPISODE]),
+      [...RULE_TEXT],
+      [...RULE_TEXT],
+      ([...RULE_TEXT], [...DEVICE_ATTENTION, ...ALERT_EPISODE]),
       [...RULE_TEXT],
       [...RULE_TEXT],
       [...RULE_TEXT],
@@ -100166,11 +100213,11 @@ var require_dist_Dwi4JA96 = __commonJS({
       [...RULE_TEXT],
       [...RULE_TEXT],
       [...RULE_TEXT],
+      ([...RULE_TEXT], [...DEVICE_ATTENTION, ...ALERT_EPISODE]),
       ([...RULE_TEXT], [...ALERT_EPISODE]),
+      ([...RULE_TEXT], [...DEVICE_ATTENTION, ...ALERT_EPISODE]),
       ([...RULE_TEXT], [...ALERT_EPISODE]),
-      ([...RULE_TEXT], [...ALERT_EPISODE]),
-      ([...RULE_TEXT], [...ALERT_EPISODE]),
-      ([...RULE_TEXT], [...ALERT_EPISODE]),
+      ([...RULE_TEXT], [...DEVICE_ATTENTION, ...ALERT_EPISODE]),
       [...RULE_TEXT],
       [...RULE_TEXT],
       [...RULE_TEXT],
@@ -100246,6 +100293,15 @@ var require_dist_Dwi4JA96 = __commonJS({
         snapshotLabel: "Tanks low or full now",
         snapshotSection: "tanks"
       },
+      {
+        id: "motion-noise",
+        family: "device-events",
+        label: "Motion without a subject (constant / calm again)",
+        bad: ["motion-noisy"],
+        recovery: ["motion-calm"],
+        snapshotLabel: "Cameras with constant motion now",
+        snapshotSection: null
+      },
       {
         id: "recording-health",
         family: "device-events",
@@ -100255,6 +100311,15 @@ var require_dist_Dwi4JA96 = __commonJS({
         snapshotLabel: "Recordings stalled now",
         snapshotSection: null
       },
+      {
+        id: "device-attention",
+        family: "device-events",
+        label: "Device needs attention (raised / resolved)",
+        bad: ["device-attention-required"],
+        recovery: ["device-attention-resolved"],
+        snapshotLabel: "Devices needing attention now",
+        snapshotSection: null
+      },
       {
         id: "node-connectivity",
         family: "system",
@@ -100899,12 +100964,6 @@ var require_dist_Dwi4JA96 = __commonJS({
         return AlertSchema;
       }
     });
-    Object.defineProperty(exports, "ApiKeyRecordSchema", {
-      enumerable: true,
-      get: function() {
-        return ApiKeyRecordSchema;
-      }
-    });
     Object.defineProperty(exports, "BaseAddon", {
       enumerable: true,
       get: function() {
@@ -101475,12 +101534,24 @@ var require_dist_Dwi4JA96 = __commonJS({
         return StorageMigrationJobSchema;
       }
     });
+    Object.defineProperty(exports, "StoredRecordKindDeclarationSchema", {
+      enumerable: true,
+      get: function() {
+        return StoredRecordKindDeclarationSchema;
+      }
+    });
     Object.defineProperty(exports, "TokenScopeSchema", {
       enumerable: true,
       get: function() {
         return TokenScopeSchema;
       }
     });
+    Object.defineProperty(exports, "TransactRefusedError", {
+      enumerable: true,
+      get: function() {
+        return TransactRefusedError;
+      }
+    });
     Object.defineProperty(exports, "UNATTRIBUTED_BUCKET_KEY", {
       enumerable: true,
       get: function() {
@@ -101571,6 +101642,12 @@ var require_dist_Dwi4JA96 = __commonJS({
         return asString$1;
       }
     });
+    Object.defineProperty(exports, "assertTransactScope", {
+      enumerable: true,
+      get: function() {
+        return assertTransactScope;
+      }
+    });
     Object.defineProperty(exports, "assertValidDeclaration", {
       enumerable: true,
       get: function() {
@@ -102636,40 +102713,6 @@ var require_dist_Dwi4JA96 = __commonJS({
   }
 });
 
-// ../system/dist/read-all-rows-CVoO1ONM.js
-var require_read_all_rows_CVoO1ONM = __commonJS({
-  "../system/dist/read-all-rows-CVoO1ONM.js"(exports) {
-    "use strict";
-    var require_read_all_rows = /* @__PURE__ */ require_chunk_Cek0wNdY().__commonJSMin(((exports2) => {
-      Object.defineProperty(exports2, "__esModule", { value: true });
-      exports2.readAllRows = readAllRows;
-      var PAGE_SIZE = 1e3;
-      var MAX_PAGES = 100;
-      async function readAllRows(kind, query = {}, options = {}) {
-        const out = [];
-        let cursor;
-        for (let page = 0; page < MAX_PAGES; page += 1) {
-          const answer = await kind.query({
-            ...query,
-            limit: PAGE_SIZE,
-            ...cursor === void 0 ? {} : { cursor }
-          }, options);
-          out.push(...answer.records);
-          if (answer.nextCursor === null) return out;
-          cursor = answer.nextCursor;
-        }
-        throw new Error(`record kind "${kind.name}" holds more than ${MAX_PAGES * PAGE_SIZE} rows`);
-      }
-    }));
-    Object.defineProperty(exports, "require_read_all_rows", {
-      enumerable: true,
-      get: function() {
-        return require_read_all_rows;
-      }
-    });
-  }
-});
-
 // ../system/dist/x509.es-C4cOo48M.js
 var require_x509_es_C4cOo48M = __commonJS({
   "../system/dist/x509.es-C4cOo48M.js"(exports) {
@@ -114141,11 +114184,11 @@ ${values.join("\n")}` : `${blockName} :`;
   }
 });
 
-// ../system/dist/device-ca-B-Txwl4W.js
-var require_device_ca_B_Txwl4W = __commonJS({
-  "../system/dist/device-ca-B-Txwl4W.js"(exports) {
+// ../system/dist/device-ca-DpvQ5wrb.js
+var require_device_ca_DpvQ5wrb = __commonJS({
+  "../system/dist/device-ca-DpvQ5wrb.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_x509_es = require_x509_es_C4cOo48M();
     var node_crypto = __require("crypto");
     var SYSTEM_SECRET_OWNER = "system";
@@ -114560,6 +114603,40 @@ var require_device_ca_B_Txwl4W = __commonJS({
   }
 });
 
+// ../system/dist/read-all-rows-CVoO1ONM.js
+var require_read_all_rows_CVoO1ONM = __commonJS({
+  "../system/dist/read-all-rows-CVoO1ONM.js"(exports) {
+    "use strict";
+    var require_read_all_rows = /* @__PURE__ */ require_chunk_Cek0wNdY().__commonJSMin(((exports2) => {
+      Object.defineProperty(exports2, "__esModule", { value: true });
+      exports2.readAllRows = readAllRows;
+      var PAGE_SIZE = 1e3;
+      var MAX_PAGES = 100;
+      async function readAllRows(kind, query = {}, options = {}) {
+        const out = [];
+        let cursor;
+        for (let page = 0; page < MAX_PAGES; page += 1) {
+          const answer = await kind.query({
+            ...query,
+            limit: PAGE_SIZE,
+            ...cursor === void 0 ? {} : { cursor }
+          }, options);
+          out.push(...answer.records);
+          if (answer.nextCursor === null) return out;
+          cursor = answer.nextCursor;
+        }
+        throw new Error(`record kind "${kind.name}" holds more than ${MAX_PAGES * PAGE_SIZE} rows`);
+      }
+    }));
+    Object.defineProperty(exports, "require_read_all_rows", {
+      enumerable: true,
+      get: function() {
+        return require_read_all_rows;
+      }
+    });
+  }
+});
+
 // ../system/dist/builtins/alerts/alerts.addon.js
 var require_alerts_addon = __commonJS({
   "../system/dist/builtins/alerts/alerts.addon.js"(exports) {
@@ -114569,7 +114646,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
     function nextEpisodeId(input) {
       const { previous } = input;
@@ -116037,7 +116114,7 @@ var require_calendars_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_settle_sources = require_settle_sources_Bhsy57y();
     var zod = require_zod();
     var CALENDAR_COLOR_PALETTE = [
@@ -116253,11 +116330,11 @@ var require_calendars = __commonJS({
   }
 });
 
-// ../system/dist/composition-sources-BG0E76VO.js
-var require_composition_sources_BG0E76VO = __commonJS({
-  "../system/dist/composition-sources-BG0E76VO.js"(exports) {
+// ../system/dist/composition-sources-DqHwltDV.js
+var require_composition_sources_DqHwltDV = __commonJS({
+  "../system/dist/composition-sources-DqHwltDV.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     function normalizedNativeOwner(owner) {
       const trimmed = owner?.trim();
       return trimmed ? trimmed : null;
@@ -116372,8 +116449,8 @@ var require_composer_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
-    var require_composition_sources = require_composition_sources_BG0E76VO();
+    var require_dist10 = require_dist_QyW9hVO2();
+    var require_composition_sources = require_composition_sources_DqHwltDV();
     var zod = require_zod();
     function isRecord$2(value) {
       return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -120183,7 +120260,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -124847,9 +124924,9 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
-    var require_composition_sources = require_composition_sources_BG0E76VO();
+    var require_composition_sources = require_composition_sources_DqHwltDV();
     var require_prefix_range = require_prefix_range_D_KueXbQ();
     var require_prefix_walk = require_prefix_walk_Dv6MLZlM();
     var zod = require_zod();
@@ -127047,9 +127124,9 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../types/dist/event-category-kpu1bZMs.js
-var require_event_category_kpu1bZMs = __commonJS({
-  "../types/dist/event-category-kpu1bZMs.js"(exports) {
+// ../types/dist/event-category-7AwNbPjm.js
+var require_event_category_7AwNbPjm = __commonJS({
+  "../types/dist/event-category-7AwNbPjm.js"(exports) {
     "use strict";
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
       EventCategory2["SystemBoot"] = "system.boot";
@@ -127131,6 +127208,8 @@ var require_event_category_kpu1bZMs = __commonJS({
       EventCategory2["PipelineCameraUnassigned"] = "pipeline.camera-unassigned";
       EventCategory2["PipelineNodeInferenceUnavailable"] = "pipeline.node-inference-unavailable";
       EventCategory2["PipelineDetectionBlind"] = "pipeline.detection-blind";
+      EventCategory2["PipelineMotionNoisy"] = "pipeline.motion-noisy";
+      EventCategory2["PipelineMotionCalm"] = "pipeline.motion-calm";
       EventCategory2["PipelineCameraUpdated"] = "pipeline.camera-updated";
       EventCategory2["PipelineIngestOwnerChanged"] = "pipeline.ingest-owner-changed";
       EventCategory2["PipelineRunnerLoadSnapshot"] = "pipeline.runner-load-snapshot";
@@ -127254,11 +127333,11 @@ var require_event_category_kpu1bZMs = __commonJS({
   }
 });
 
-// ../types/dist/sleep-Bo7fq491.js
-var require_sleep_Bo7fq491 = __commonJS({
-  "../types/dist/sleep-Bo7fq491.js"(exports) {
+// ../types/dist/sleep-CD18m9HF.js
+var require_sleep_CD18m9HF = __commonJS({
+  "../types/dist/sleep-CD18m9HF.js"(exports) {
     "use strict";
-    var require_event_category = require_event_category_kpu1bZMs();
+    var require_event_category = require_event_category_7AwNbPjm();
     var zod = require_zod();
     var AUDIO_CHUNK_FORMATS = [
       "f32le",
@@ -129936,7 +130015,8 @@ var require_sleep_Bo7fq491 = __commonJS({
       "invalid-record",
       "declaration-refused",
       "no-caller",
-      "batch-too-large"
+      "batch-too-large",
+      "transact-refused"
     ];
     var PREFIX = "records/";
     var RecordsError = class extends Error {
@@ -130033,6 +130113,12 @@ var require_sleep_Bo7fq491 = __commonJS({
         this.name = "BatchTooLargeError";
       }
     };
+    var TransactRefusedError = class extends RecordsError {
+      constructor(detail) {
+        super("transact-refused", detail);
+        this.name = "TransactRefusedError";
+      }
+    };
     var FACTORIES = {
       "rev-conflict": (d) => new RevConflictError(d),
       "too-large": (d) => new RecordTooLargeError(d),
@@ -130047,7 +130133,8 @@ var require_sleep_Bo7fq491 = __commonJS({
       "invalid-record": (d) => new InvalidRecordError(d),
       "declaration-refused": (d) => new DeclarationRefusedError(d),
       "no-caller": (d) => new NoCallerError(d),
-      "batch-too-large": (d) => new BatchTooLargeError(d)
+      "batch-too-large": (d) => new BatchTooLargeError(d),
+      "transact-refused": (d) => new TransactRefusedError(d)
     };
     function isCode(value) {
       return RECORDS_ERROR_CODES.some((code) => code === value);
@@ -130250,7 +130337,7 @@ var require_sleep_Bo7fq491 = __commonJS({
       /** JSON Schema of the entry body; `secret: true` marks a password field. */
       fields: zod.z.record(zod.z.string(), zod.z.unknown())
     }).strict();
-    var RecordKindDeclarationSchema = zod.z.object({
+    var RecordKindDeclarationShape = zod.z.object({
       database: zod.z.enum(RECORD_DATABASES).default("settings"),
       class: zod.z.enum(RECORD_CLASSES),
       writeTrigger: zod.z.string().min(1),
@@ -130268,18 +130355,12 @@ var require_sleep_Bo7fq491 = __commonJS({
       secretPaths: zod.z.array(zod.z.string().min(1)).default([]),
       /** The id key of each array that carries a secret (`{ headers: 'name' }`). */
       secretArrayKeys: zod.z.record(zod.z.string(), zod.z.string()).default({}),
-      /**
-      * RETIRED (D900): the legacy table a kind adopted from during the records
-      * migration. Nothing declares it any more and nothing reads it; the schema
-      * still ACCEPTS it because the catalog rows the migration wrote carry it
-      * (an orphaned kind is never redeclared) and an addon built before the
-      * removal still sends it. Never set it.
-      */
-      adoptsFrom: zod.z.string().min(1).optional(),
       /** Kinds that must agree through `transact` sit in one file under one family name. */
       transactFamily: zod.z.string().min(1).optional(),
       entry: EntryDescriptorSchema.optional()
-    }).strict();
+    });
+    var RecordKindDeclarationSchema = RecordKindDeclarationShape.strict();
+    var StoredRecordKindDeclarationSchema = RecordKindDeclarationShape;
     var RecordKindNameSchema = zod.z.string().regex(/^[a-z][a-z0-9-]{0,47}$/);
     function assertValidDeclaration(name, decl) {
       const refuse = (why) => {
@@ -130360,6 +130441,16 @@ var require_sleep_Bo7fq491 = __commonJS({
     function declarationsOf(kinds) {
       return Object.fromEntries(Object.entries(kinds).map(([name, kind]) => [name, kind.declaration]));
     }
+    function assertTransactScope(members) {
+      const byKind = /* @__PURE__ */ new Map();
+      for (const m of members) byKind.set(m.kind, m);
+      const kinds = [...byKind.values()];
+      if (new Set(kinds.map((m) => m.declaration.database)).size > 1) throw new TransactRefusedError(`cross-file: the ops span more than one database file (${kinds.map((m) => `${m.kind}@${m.declaration.database}`).join(", ")}); a transaction lives in ONE file`);
+      if (kinds.length <= 1) return;
+      const missing = kinds.filter((m) => m.declaration.transactFamily === void 0);
+      if (missing.length > 0) throw new TransactRefusedError(`no-family: ${missing.map((m) => m.kind).join(", ")} declare no transactFamily; kinds that must agree through transact share one`);
+      if (new Set(kinds.map((m) => m.declaration.transactFamily)).size > 1) throw new TransactRefusedError(`cross-family: the ops span more than one transactFamily (${kinds.map((m) => `${m.kind}=${String(m.declaration.transactFamily)}`).join(", ")})`);
+    }
     function isRecord$2(value) {
       return typeof value === "object" && value !== null && !Array.isArray(value);
     }
@@ -130533,6 +130624,48 @@ var require_sleep_Bo7fq491 = __commonJS({
           };
         });
       }
+      async txPut(input, opts = {}) {
+        const checked = this.validate(input.data, input.id);
+        const { body, rollback } = await this.storeSecrets(input.id, checked, "put");
+        return {
+          wire: {
+            op: "put",
+            kind: this.name,
+            record: {
+              ...input,
+              data: toBody(body)
+            },
+            ...opts.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+          },
+          rollback
+        };
+      }
+      async txPatch(id, partial, opts = {}) {
+        const { body, rollback } = await this.storeSecrets(id, partial, "patch");
+        return {
+          wire: {
+            op: "patch",
+            kind: this.name,
+            id,
+            data: toBody(body),
+            ...opts.at === void 0 ? {} : { at: opts.at },
+            ...opts.expiresAt === void 0 ? {} : { expiresAt: opts.expiresAt },
+            ...opts.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+          },
+          rollback
+        };
+      }
+      txDelete(id) {
+        return {
+          wire: {
+            op: "delete",
+            kind: this.name,
+            id
+          },
+          rollback: async () => {
+          }
+        };
+      }
       async put(input, opts = {}) {
         const checked = this.validate(input.data, input.id);
         const { body, rollback } = await this.storeSecrets(input.id, checked, "put");
@@ -130686,6 +130819,23 @@ var require_sleep_Bo7fq491 = __commonJS({
           handles.set(definition, handle);
           return handle;
         },
+        async transact(ops) {
+          if (ops.length === 0) return [];
+          const result = await call(() => options.transport.transact({ ops: ops.map((op) => op.wire) })).catch(async (err) => {
+            for (const op of ops) await op.rollback();
+            throw err;
+          });
+          const released = [...result.releasedRefs, ...result.secretRefs];
+          if (released.length > 0 && options.secrets !== null) try {
+            await options.secrets.delete(released);
+          } catch (err) {
+            options.logger?.warn("records: could not remove released keychain values", { meta: {
+              count: released.length,
+              error: err instanceof Error ? err.message : "unknown"
+            } });
+          }
+          return result.results;
+        },
         async deleteDevice(deviceId, opts = {}) {
           const result = await call(() => options.transport.deleteDevice({
             deviceId,
@@ -131177,312 +131327,372 @@ var require_sleep_Bo7fq491 = __commonJS({
           secretRefs: refsOf(decl, gone)
         };
       };
-      return {
-        records: createRecordsAccess({
-          owner,
-          transport: {
-            declareKinds: async ({ kinds }) => {
-              const out = {};
-              for (const [name, raw] of Object.entries(kinds)) {
-                const decl = RecordKindDeclarationSchema.parse(raw);
-                assertValidDeclaration(name, decl);
-                const prior = decls.get(name);
-                if (prior !== void 0) assertAdditive(name, prior, decl);
-                const kindId = kindIds.get(name) ?? kindIds.size + 1;
-                kindIds.set(name, kindId);
-                const created = decl.indexes.filter((i) => prior?.indexes.every((p) => p.name !== i.name) ?? true).map((i) => i.name);
-                const state = prior === void 0 ? "created" : JSON.stringify(prior) === JSON.stringify(decl) ? "unchanged" : "updated";
-                decls.set(name, decl);
-                out[name] = {
-                  kindId,
-                  state,
-                  createdIndexes: created,
-                  adoptionPending: null
-                };
-              }
-              return { kinds: out };
-            },
-            get: async ({ kind, id }) => {
-              reading();
-              const decl = declOf(kind);
-              const row = table(kind).get(id);
-              return row === void 0 ? null : view(decl, row);
-            },
-            getMany: async ({ kind, ids }) => {
-              reading();
-              const decl = declOf(kind);
-              return [...new Set(ids)].sort((a, b) => compareSql(a, b)).flatMap((id) => {
-                const row = table(kind).get(id);
-                return row === void 0 ? [] : [view(decl, row)];
-              });
-            },
-            secretRefs: async ({ kind, ids }) => {
-              reading();
-              const decl = declOf(kind);
-              const out = {};
-              for (const id of ids) {
-                const row = table(kind).get(id);
-                if (row === void 0) continue;
-                const refs = Object.fromEntries(markersOf(decl, row.data));
-                if (Object.keys(refs).length > 0) out[id] = refs;
-              }
-              return out;
-            },
-            put: async ({ kind, record, ifRev }) => {
-              writing();
-              const written = writeRecord(kind, record, ifRev, now());
-              afterWrite(kind, [record.deviceId]);
-              return {
-                rev: written.rev,
-                releasedRefs: [...written.released]
-              };
-            },
-            putMany: async ({ kind, records }) => {
-              writing();
-              declOf(kind);
-              if (records.length > 1e3) throw new BatchTooLargeError(`${records.length} records exceed ${RECORD_BATCH_MAX}`);
-              const bytes = records.reduce((sum, r) => sum + Buffer.byteLength(JSON.stringify(r.data), "utf8"), 0);
-              if (bytes > 4194304) throw new BatchTooLargeError(`${bytes} bytes exceed ${RECORD_BATCH_MAX_BYTES}`);
-              const nowMs = now();
-              const before = new Map(table(kind));
-              const ridBefore = nextRid;
-              const released = [];
-              try {
-                for (const rec of records) released.push(...writeRecord(kind, rec, void 0, nowMs).released);
-              } catch (err) {
-                tables.set(kind, before);
-                nextRid = ridBefore;
-                throw err;
+      const transport = {
+        declareKinds: async ({ kinds }) => {
+          const out = {};
+          for (const [name, raw] of Object.entries(kinds)) {
+            const decl = RecordKindDeclarationSchema.parse(raw);
+            assertValidDeclaration(name, decl);
+            const prior = decls.get(name);
+            if (prior !== void 0) assertAdditive(name, prior, decl);
+            const kindId = kindIds.get(name) ?? kindIds.size + 1;
+            kindIds.set(name, kindId);
+            const created = decl.indexes.filter((i) => prior?.indexes.every((p) => p.name !== i.name) ?? true).map((i) => i.name);
+            const state = prior === void 0 ? "created" : JSON.stringify(prior) === JSON.stringify(decl) ? "unchanged" : "updated";
+            decls.set(name, decl);
+            out[name] = {
+              kindId,
+              state,
+              createdIndexes: created
+            };
+          }
+          return { kinds: out };
+        },
+        get: async ({ kind, id }) => {
+          reading();
+          const decl = declOf(kind);
+          const row = table(kind).get(id);
+          return row === void 0 ? null : view(decl, row);
+        },
+        getMany: async ({ kind, ids }) => {
+          reading();
+          const decl = declOf(kind);
+          return [...new Set(ids)].sort((a, b) => compareSql(a, b)).flatMap((id) => {
+            const row = table(kind).get(id);
+            return row === void 0 ? [] : [view(decl, row)];
+          });
+        },
+        secretRefs: async ({ kind, ids }) => {
+          reading();
+          const decl = declOf(kind);
+          const out = {};
+          for (const id of ids) {
+            const row = table(kind).get(id);
+            if (row === void 0) continue;
+            const refs = Object.fromEntries(markersOf(decl, row.data));
+            if (Object.keys(refs).length > 0) out[id] = refs;
+          }
+          return out;
+        },
+        put: async ({ kind, record, ifRev }) => {
+          writing();
+          const written = writeRecord(kind, record, ifRev, now());
+          afterWrite(kind, [record.deviceId]);
+          return {
+            rev: written.rev,
+            releasedRefs: [...written.released]
+          };
+        },
+        putMany: async ({ kind, records }) => {
+          writing();
+          declOf(kind);
+          if (records.length > 1e3) throw new BatchTooLargeError(`${records.length} records exceed ${RECORD_BATCH_MAX}`);
+          const bytes = records.reduce((sum, r) => sum + Buffer.byteLength(JSON.stringify(r.data), "utf8"), 0);
+          if (bytes > 4194304) throw new BatchTooLargeError(`${bytes} bytes exceed ${RECORD_BATCH_MAX_BYTES}`);
+          const nowMs = now();
+          const before = new Map(table(kind));
+          const ridBefore = nextRid;
+          const released = [];
+          try {
+            for (const rec of records) released.push(...writeRecord(kind, rec, void 0, nowMs).released);
+          } catch (err) {
+            tables.set(kind, before);
+            nextRid = ridBefore;
+            throw err;
+          }
+          let top = -1;
+          for (const r of records) if (/^\d{1,15}$/.test(r.id)) top = Math.max(top, Number(r.id));
+          if (top >= 0) sequences.set(kind, Math.max(sequences.get(kind) ?? 0, top + 1));
+          afterWrite(kind, records.map((r) => r.deviceId));
+          return {
+            count: records.length,
+            releasedRefs: released
+          };
+        },
+        patch: async (input) => {
+          writing();
+          const decl = declOf(input.kind);
+          if (input.at !== void 0 && decl.at !== "required") throw new InvalidRecordError(`${input.kind}: declared at: "none"`);
+          if (input.at === null) throw new InvalidRecordError(`${input.kind}: "at" cannot be removed`);
+          if (input.expiresAt !== void 0 && decl.secretPaths.length > 0) throw new InvalidRecordError(`${input.kind}: a kind with secret fields cannot expire by the engine (its keychain values would be orphaned)`);
+          if (input.expiresAt !== void 0 && "ttlMs" in decl.retention) throw new InvalidRecordError(`${input.kind}: expiresAt is set by the engine`);
+          const before = table(input.kind).get(input.id);
+          const checked = enforceSecrets(owner, input.kind, decl, input.id, input.data, before?.data ?? null, "patch");
+          if (before === void 0) throw new RecordNotFoundError(`${input.kind}/${input.id}: no such row`);
+          if (input.ifRev !== void 0 && before.rev !== input.ifRev) throw new RevConflictError(`${input.kind}/${input.id}: expected rev ${String(input.ifRev)}, found rev ${before.rev}`);
+          const merged = jsonCopy(mergePatch(before.data, jsonCopy(checked.body)));
+          const size = [...JSON.stringify(merged)].length;
+          if (size > decl.maxDataBytes) throw new RecordTooLargeError(`${input.kind}/${input.id}: the patched body is ${size} bytes, over maxDataBytes ${decl.maxDataBytes}`);
+          assertUnique(input.kind, decl, input.id, merged);
+          const rev = before.rev + 1;
+          store2(input.kind, before, {
+            ...before,
+            at: input.at ?? before.at,
+            expiresAt: input.expiresAt === void 0 ? before.expiresAt : input.expiresAt,
+            rev,
+            updatedAt: now(),
+            data: merged
+          });
+          const kept = new Set(markersOf(decl, merged).values());
+          return {
+            rev,
+            releasedRefs: [...markersOf(decl, before.data).values()].filter((r) => !kept.has(r))
+          };
+        },
+        delete: async ({ kind, id }) => {
+          writing();
+          const decl = declOf(kind);
+          const row = table(kind).get(id);
+          if (row === void 0) return {
+            deleted: false,
+            secretRefs: []
+          };
+          table(kind).delete(id);
+          return {
+            deleted: true,
+            secretRefs: refsOf(decl, [row])
+          };
+        },
+        deleteMany: async ({ kind, ids }) => {
+          writing();
+          const wanted = new Set(ids);
+          return removeWhere(kind, (row) => wanted.has(row.id));
+        },
+        query: async (q) => {
+          reading();
+          const decl = declOf(q.kind);
+          queries.push({
+            kind: q.kind,
+            limit: q.limit
+          });
+          assertWindowAllowed(q.kind, decl, q);
+          const desc = q.desc === true;
+          const dir = desc ? "DESC" : "ASC";
+          const where = planWhere(q.kind, decl, q.where, { allowIn: false });
+          const cursor = q.cursor === void 0 ? void 0 : decodeCursor(q.cursor);
+          let rows = [...table(q.kind).values()].filter((r) => inWindow(r, q));
+          let keysOf;
+          let keyCount;
+          let tag;
+          if (where !== null) {
+            if (q.order !== void 0) throw new InvalidRecordError(`${q.kind}: with a where the order is the index's; drop "order"`);
+            const fields = where.orderFields;
+            keysOf = (row) => [...fields.map((f) => extractField(row.data, f)), row.rid];
+            keyCount = fields.length;
+            tag = `rx:${where.indexName}:${dir}`;
+            rows = rows.filter((r) => where.matches(r.data));
+            if (cursor !== void 0) {
+              assertCursor(cursor, tag, fields.length + 1);
+              rows = rows.filter((r) => rowValueAfter(keysOf(r), cursor.values, desc));
+            }
+          } else {
+            const order = q.order ?? (decl.at === "required" ? "at" : "id");
+            keyCount = 1;
+            if (order === "at") {
+              if (decl.at !== "required") throw new InvalidRecordError(`${q.kind}: declared at: "none", it has no time order - use order: "id"`);
+              keysOf = (row) => [row.at, row.rid];
+              tag = `at:${dir}`;
+              if (cursor !== void 0) {
+                assertCursor(cursor, tag, 2);
+                rows = rows.filter((r) => rowValueAfter(keysOf(r), cursor.values, desc));
               }
-              let top = -1;
-              for (const r of records) if (/^\d{1,15}$/.test(r.id)) top = Math.max(top, Number(r.id));
-              if (top >= 0) sequences.set(kind, Math.max(sequences.get(kind) ?? 0, top + 1));
-              afterWrite(kind, records.map((r) => r.deviceId));
-              return {
-                count: records.length,
-                releasedRefs: released
-              };
-            },
-            patch: async (input) => {
-              writing();
-              const decl = declOf(input.kind);
-              if (input.at !== void 0 && decl.at !== "required") throw new InvalidRecordError(`${input.kind}: declared at: "none"`);
-              if (input.at === null) throw new InvalidRecordError(`${input.kind}: "at" cannot be removed`);
-              if (input.expiresAt !== void 0 && decl.secretPaths.length > 0) throw new InvalidRecordError(`${input.kind}: a kind with secret fields cannot expire by the engine (its keychain values would be orphaned)`);
-              if (input.expiresAt !== void 0 && "ttlMs" in decl.retention) throw new InvalidRecordError(`${input.kind}: expiresAt is set by the engine`);
-              const before = table(input.kind).get(input.id);
-              const checked = enforceSecrets(owner, input.kind, decl, input.id, input.data, before?.data ?? null, "patch");
-              if (before === void 0) throw new RecordNotFoundError(`${input.kind}/${input.id}: no such row`);
-              if (input.ifRev !== void 0 && before.rev !== input.ifRev) throw new RevConflictError(`${input.kind}/${input.id}: expected rev ${String(input.ifRev)}, found rev ${before.rev}`);
-              const merged = jsonCopy(mergePatch(before.data, jsonCopy(checked.body)));
-              const size = [...JSON.stringify(merged)].length;
-              if (size > decl.maxDataBytes) throw new RecordTooLargeError(`${input.kind}/${input.id}: the patched body is ${size} bytes, over maxDataBytes ${decl.maxDataBytes}`);
-              assertUnique(input.kind, decl, input.id, merged);
-              const rev = before.rev + 1;
-              store2(input.kind, before, {
-                ...before,
-                at: input.at ?? before.at,
-                expiresAt: input.expiresAt === void 0 ? before.expiresAt : input.expiresAt,
-                rev,
-                updatedAt: now(),
-                data: merged
+            } else {
+              if (q.deviceId !== void 0 || q.atFrom !== void 0 || q.atTo !== void 0) throw new UnindexedFilterError(`${q.kind}: order "id" cannot be combined with a device or time window (use order "at")`);
+              keysOf = (row) => [row.id, row.rid];
+              tag = `id:${dir}`;
+              if (cursor !== void 0) {
+                assertCursor(cursor, tag, 2);
+                const last2 = cursor.values[0] ?? null;
+                rows = rows.filter((r) => rowValueAfter([r.id], [last2], desc));
+              }
+            }
+          }
+          rows.sort((a, b) => (desc ? -1 : 1) * compareKeys(keysOf(a), keysOf(b)));
+          const page = rows.slice(0, q.limit);
+          const more = rows.length > q.limit;
+          const last = page.at(-1);
+          let nextCursor = null;
+          if (more && last !== void 0) {
+            const all = keysOf(last);
+            const keys = [];
+            for (let i = 0; i < keyCount; i += 1) {
+              const value = all[i];
+              if (typeof value !== "string" && typeof value !== "number") throw new InvalidRecordError(`${q.kind}: a row has no value for an ordering field, so this query cannot be paged`);
+              keys.push(value);
+            }
+            keys.push(last.rid);
+            nextCursor = encodeCursor(tag, keys);
+          }
+          return {
+            records: page.map((r) => view(decl, r)),
+            nextCursor
+          };
+        },
+        count: async (q) => {
+          reading();
+          const decl = declOf(q.kind);
+          assertWindowAllowed(q.kind, decl, q);
+          const where = planWhere(q.kind, decl, q.where, { allowIn: true });
+          let n = 0;
+          for (const row of table(q.kind).values()) if (inWindow(row, q) && (where === null || where.matches(row.data))) n += 1;
+          return { count: n };
+        },
+        histogram: async (q) => {
+          reading();
+          const decl = declOf(q.kind);
+          assertWindowAllowed(q.kind, decl, {
+            deviceId: q.deviceId,
+            atFrom: q.from
+          });
+          if (!(q.to > q.from)) throw new InvalidRecordError(`${q.kind}: histogram needs from < to`);
+          if (Math.ceil((q.to - q.from) / q.bucketMs) > 1e4) throw new InvalidRecordError(`${q.kind}: histogram would exceed ${HISTOGRAM_MAX_BUCKETS} buckets`);
+          const from = Math.floor(q.from);
+          const to = Math.ceil(q.to);
+          const step = Math.trunc(q.bucketMs);
+          const counts = /* @__PURE__ */ new Map();
+          for (const row of table(q.kind).values()) {
+            if (q.deviceId !== void 0 && row.deviceId !== q.deviceId) continue;
+            if (row.at === null || row.at < from || row.at >= to) continue;
+            const b = Math.trunc((row.at - from) / step);
+            counts.set(b, (counts.get(b) ?? 0) + 1);
+          }
+          return { buckets: [...counts.entries()].sort(([a], [b]) => a - b).map(([b, count]) => ({
+            bucketStart: from + b * q.bucketMs,
+            count
+          })) };
+        },
+        aggregate: async (q) => {
+          reading();
+          const decl = declOf(q.kind);
+          if (q.op !== "count" && q.field === void 0) throw new InvalidRecordError(`${q.kind}: ${q.op} needs a field`);
+          const extra = [q.field, q.groupBy].filter((f) => f !== void 0);
+          if (extra.length === 0 && q.where === void 0) throw new InvalidRecordError(`${q.kind}: a count with no field and no groupBy is "count"`);
+          const where = planWhere(q.kind, decl, q.where, {
+            allowIn: true,
+            extraFields: extra,
+            groupBy: q.groupBy
+          });
+          if (where === null) throw new InvalidRecordError(`${q.kind}: aggregate has nothing to read`);
+          const rows = [...table(q.kind).values()].filter((r) => where.matches(r.data));
+          const groups = /* @__PURE__ */ new Map();
+          if (q.groupBy === void 0) groups.set(null, rows);
+          else {
+            const by = q.groupBy;
+            for (const row of rows) {
+              const g = extractField(row.data, by);
+              groups.set(g, [...groups.get(g) ?? [], row]);
+            }
+          }
+          return { rows: [...groups.entries()].sort(([a], [b]) => compareSql(a, b)).map(([group, members]) => ({
+            group,
+            value: aggregateOf(q.op, q.field, members)
+          })) };
+        },
+        deleteWhere: async (q) => {
+          writing();
+          const decl = declOf(q.kind);
+          if (q.deviceId === void 0 && q.atBefore === void 0 && (q.where === void 0 || Object.keys(q.where).length === 0)) throw new FilterRequiredError(`${q.kind}: deleteWhere needs deviceId, atBefore or where - there is no "delete all"`);
+          assertWindowAllowed(q.kind, decl, {
+            deviceId: q.deviceId,
+            atFrom: q.atBefore
+          });
+          const where = planWhere(q.kind, decl, q.where, { allowIn: true });
+          return removeWhere(q.kind, (row) => {
+            if (where !== null && !where.matches(row.data)) return false;
+            if (q.deviceId !== void 0 && row.deviceId !== q.deviceId) return false;
+            if (q.atBefore !== void 0 && (row.at === null || row.at >= q.atBefore)) return false;
+            return true;
+          });
+        },
+        transact: async ({ ops }) => {
+          writing();
+          assertTransactScope(ops.map((op) => ({
+            kind: op.kind,
+            declaration: declOf(op.kind)
+          })));
+          const before = new Map([...tables].map(([name, rows]) => [name, new Map(rows)]));
+          const ridBefore = nextRid;
+          const results = [];
+          const releasedRefs = [];
+          const secretRefs = [];
+          try {
+            for (const op of ops) if (op.op === "put") {
+              const r = await transport.put({
+                kind: op.kind,
+                record: op.record,
+                ...op.ifRev === void 0 ? {} : { ifRev: op.ifRev }
               });
-              const kept = new Set(markersOf(decl, merged).values());
-              return {
-                rev,
-                releasedRefs: [...markersOf(decl, before.data).values()].filter((r) => !kept.has(r))
-              };
-            },
-            delete: async ({ kind, id }) => {
-              writing();
-              const decl = declOf(kind);
-              const row = table(kind).get(id);
-              if (row === void 0) return {
-                deleted: false,
-                secretRefs: []
-              };
-              table(kind).delete(id);
-              return {
-                deleted: true,
-                secretRefs: refsOf(decl, [row])
-              };
-            },
-            deleteMany: async ({ kind, ids }) => {
-              writing();
-              const wanted = new Set(ids);
-              return removeWhere(kind, (row) => wanted.has(row.id));
-            },
-            query: async (q) => {
-              reading();
-              const decl = declOf(q.kind);
-              queries.push({
-                kind: q.kind,
-                limit: q.limit
+              releasedRefs.push(...r.releasedRefs);
+              results.push({
+                rev: r.rev,
+                deleted: false
               });
-              assertWindowAllowed(q.kind, decl, q);
-              const desc = q.desc === true;
-              const dir = desc ? "DESC" : "ASC";
-              const where = planWhere(q.kind, decl, q.where, { allowIn: false });
-              const cursor = q.cursor === void 0 ? void 0 : decodeCursor(q.cursor);
-              let rows = [...table(q.kind).values()].filter((r) => inWindow(r, q));
-              let keysOf;
-              let keyCount;
-              let tag;
-              if (where !== null) {
-                if (q.order !== void 0) throw new InvalidRecordError(`${q.kind}: with a where the order is the index's; drop "order"`);
-                const fields = where.orderFields;
-                keysOf = (row) => [...fields.map((f) => extractField(row.data, f)), row.rid];
-                keyCount = fields.length;
-                tag = `rx:${where.indexName}:${dir}`;
-                rows = rows.filter((r) => where.matches(r.data));
-                if (cursor !== void 0) {
-                  assertCursor(cursor, tag, fields.length + 1);
-                  rows = rows.filter((r) => rowValueAfter(keysOf(r), cursor.values, desc));
-                }
-              } else {
-                const order = q.order ?? (decl.at === "required" ? "at" : "id");
-                keyCount = 1;
-                if (order === "at") {
-                  if (decl.at !== "required") throw new InvalidRecordError(`${q.kind}: declared at: "none", it has no time order - use order: "id"`);
-                  keysOf = (row) => [row.at, row.rid];
-                  tag = `at:${dir}`;
-                  if (cursor !== void 0) {
-                    assertCursor(cursor, tag, 2);
-                    rows = rows.filter((r) => rowValueAfter(keysOf(r), cursor.values, desc));
-                  }
-                } else {
-                  if (q.deviceId !== void 0 || q.atFrom !== void 0 || q.atTo !== void 0) throw new UnindexedFilterError(`${q.kind}: order "id" cannot be combined with a device or time window (use order "at")`);
-                  keysOf = (row) => [row.id, row.rid];
-                  tag = `id:${dir}`;
-                  if (cursor !== void 0) {
-                    assertCursor(cursor, tag, 2);
-                    const last2 = cursor.values[0] ?? null;
-                    rows = rows.filter((r) => rowValueAfter([r.id], [last2], desc));
-                  }
-                }
-              }
-              rows.sort((a, b) => (desc ? -1 : 1) * compareKeys(keysOf(a), keysOf(b)));
-              const page = rows.slice(0, q.limit);
-              const more = rows.length > q.limit;
-              const last = page.at(-1);
-              let nextCursor = null;
-              if (more && last !== void 0) {
-                const all = keysOf(last);
-                const keys = [];
-                for (let i = 0; i < keyCount; i += 1) {
-                  const value = all[i];
-                  if (typeof value !== "string" && typeof value !== "number") throw new InvalidRecordError(`${q.kind}: a row has no value for an ordering field, so this query cannot be paged`);
-                  keys.push(value);
-                }
-                keys.push(last.rid);
-                nextCursor = encodeCursor(tag, keys);
-              }
-              return {
-                records: page.map((r) => view(decl, r)),
-                nextCursor
-              };
-            },
-            count: async (q) => {
-              reading();
-              const decl = declOf(q.kind);
-              assertWindowAllowed(q.kind, decl, q);
-              const where = planWhere(q.kind, decl, q.where, { allowIn: true });
-              let n = 0;
-              for (const row of table(q.kind).values()) if (inWindow(row, q) && (where === null || where.matches(row.data))) n += 1;
-              return { count: n };
-            },
-            histogram: async (q) => {
-              reading();
-              const decl = declOf(q.kind);
-              assertWindowAllowed(q.kind, decl, {
-                deviceId: q.deviceId,
-                atFrom: q.from
+            } else if (op.op === "patch") {
+              const r = await transport.patch({
+                kind: op.kind,
+                id: op.id,
+                data: op.data,
+                ...op.at === void 0 ? {} : { at: op.at },
+                ...op.expiresAt === void 0 ? {} : { expiresAt: op.expiresAt },
+                ...op.ifRev === void 0 ? {} : { ifRev: op.ifRev }
               });
-              if (!(q.to > q.from)) throw new InvalidRecordError(`${q.kind}: histogram needs from < to`);
-              if (Math.ceil((q.to - q.from) / q.bucketMs) > 1e4) throw new InvalidRecordError(`${q.kind}: histogram would exceed ${HISTOGRAM_MAX_BUCKETS} buckets`);
-              const from = Math.floor(q.from);
-              const to = Math.ceil(q.to);
-              const step = Math.trunc(q.bucketMs);
-              const counts = /* @__PURE__ */ new Map();
-              for (const row of table(q.kind).values()) {
-                if (q.deviceId !== void 0 && row.deviceId !== q.deviceId) continue;
-                if (row.at === null || row.at < from || row.at >= to) continue;
-                const b = Math.trunc((row.at - from) / step);
-                counts.set(b, (counts.get(b) ?? 0) + 1);
-              }
-              return { buckets: [...counts.entries()].sort(([a], [b]) => a - b).map(([b, count]) => ({
-                bucketStart: from + b * q.bucketMs,
-                count
-              })) };
-            },
-            aggregate: async (q) => {
-              reading();
-              const decl = declOf(q.kind);
-              if (q.op !== "count" && q.field === void 0) throw new InvalidRecordError(`${q.kind}: ${q.op} needs a field`);
-              const extra = [q.field, q.groupBy].filter((f) => f !== void 0);
-              if (extra.length === 0 && q.where === void 0) throw new InvalidRecordError(`${q.kind}: a count with no field and no groupBy is "count"`);
-              const where = planWhere(q.kind, decl, q.where, {
-                allowIn: true,
-                extraFields: extra,
-                groupBy: q.groupBy
+              releasedRefs.push(...r.releasedRefs);
+              results.push({
+                rev: r.rev,
+                deleted: false
               });
-              if (where === null) throw new InvalidRecordError(`${q.kind}: aggregate has nothing to read`);
-              const rows = [...table(q.kind).values()].filter((r) => where.matches(r.data));
-              const groups = /* @__PURE__ */ new Map();
-              if (q.groupBy === void 0) groups.set(null, rows);
-              else {
-                const by = q.groupBy;
-                for (const row of rows) {
-                  const g = extractField(row.data, by);
-                  groups.set(g, [...groups.get(g) ?? [], row]);
-                }
-              }
-              return { rows: [...groups.entries()].sort(([a], [b]) => compareSql(a, b)).map(([group, members]) => ({
-                group,
-                value: aggregateOf(q.op, q.field, members)
-              })) };
-            },
-            deleteWhere: async (q) => {
-              writing();
-              const decl = declOf(q.kind);
-              if (q.deviceId === void 0 && q.atBefore === void 0 && (q.where === void 0 || Object.keys(q.where).length === 0)) throw new FilterRequiredError(`${q.kind}: deleteWhere needs deviceId, atBefore or where - there is no "delete all"`);
-              assertWindowAllowed(q.kind, decl, {
-                deviceId: q.deviceId,
-                atFrom: q.atBefore
+            } else {
+              const r = await transport.delete({
+                kind: op.kind,
+                id: op.id
               });
-              const where = planWhere(q.kind, decl, q.where, { allowIn: true });
-              return removeWhere(q.kind, (row) => {
-                if (where !== null && !where.matches(row.data)) return false;
-                if (q.deviceId !== void 0 && row.deviceId !== q.deviceId) return false;
-                if (q.atBefore !== void 0 && (row.at === null || row.at >= q.atBefore)) return false;
-                return true;
+              secretRefs.push(...r.secretRefs);
+              results.push({
+                rev: null,
+                deleted: r.deleted
               });
-            },
-            deleteDevice: async ({ deviceId, kinds }) => {
-              writing();
-              const deleted = {};
-              const secretRefs = [];
-              for (const [kind, decl] of decls) {
-                if (decl.deviceRemoval !== "delete") continue;
-                if (kinds !== void 0 && !kinds.includes(kind)) continue;
-                const result = removeWhere(kind, (row) => row.deviceId === deviceId);
-                deleted[kind] = result.deleted;
-                secretRefs.push(...result.secretRefs);
-              }
-              return {
-                deleted,
-                secretRefs
-              };
-            },
-            allocateId: async ({ kind }) => {
-              writing();
-              declOf(kind);
-              const id = sequences.get(kind) ?? 1;
-              sequences.set(kind, id + 1);
-              pendingAllocated.add(`${kind}:${id}`);
-              return { id };
             }
-          },
+          } catch (err) {
+            tables.clear();
+            for (const [name, rows] of before) tables.set(name, rows);
+            nextRid = ridBefore;
+            throw err;
+          }
+          return {
+            results,
+            releasedRefs,
+            secretRefs
+          };
+        },
+        deleteDevice: async ({ deviceId, kinds }) => {
+          writing();
+          const deleted = {};
+          const secretRefs = [];
+          for (const [kind, decl] of decls) {
+            if (decl.deviceRemoval !== "delete") continue;
+            if (kinds !== void 0 && !kinds.includes(kind)) continue;
+            const result = removeWhere(kind, (row) => row.deviceId === deviceId);
+            deleted[kind] = result.deleted;
+            secretRefs.push(...result.secretRefs);
+          }
+          return {
+            deleted,
+            secretRefs
+          };
+        },
+        allocateId: async ({ kind }) => {
+          writing();
+          declOf(kind);
+          const id = sequences.get(kind) ?? 1;
+          sequences.set(kind, id + 1);
+          pendingAllocated.add(`${kind}:${id}`);
+          return { id };
+        }
+      };
+      return {
+        records: createRecordsAccess({
+          owner,
+          transport,
           secrets: makeSpecKeychain(owner).access
         }),
         tables,
@@ -134507,6 +134717,12 @@ var require_sleep_Bo7fq491 = __commonJS({
         return SHARE_VIEW_KINDS;
       }
     });
+    Object.defineProperty(exports, "StoredRecordKindDeclarationSchema", {
+      enumerable: true,
+      get: function() {
+        return StoredRecordKindDeclarationSchema;
+      }
+    });
     Object.defineProperty(exports, "StreamSourceEntrySchema", {
       enumerable: true,
       get: function() {
@@ -134531,6 +134747,12 @@ var require_sleep_Bo7fq491 = __commonJS({
         return SubscribeAudioChunksResultSchema;
       }
     });
+    Object.defineProperty(exports, "TransactRefusedError", {
+      enumerable: true,
+      get: function() {
+        return TransactRefusedError;
+      }
+    });
     Object.defineProperty(exports, "UnindexedFilterError", {
       enumerable: true,
       get: function() {
@@ -134609,6 +134831,12 @@ var require_sleep_Bo7fq491 = __commonJS({
         return asString;
       }
     });
+    Object.defineProperty(exports, "assertTransactScope", {
+      enumerable: true,
+      get: function() {
+        return assertTransactScope;
+      }
+    });
     Object.defineProperty(exports, "assertValidDeclaration", {
       enumerable: true,
       get: function() {
@@ -135265,8 +135493,8 @@ var require_addon = __commonJS({
   "../types/dist/addon.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_sleep = require_sleep_Bo7fq491();
-    var require_event_category = require_event_category_kpu1bZMs();
+    var require_sleep = require_sleep_CD18m9HF();
+    var require_event_category = require_event_category_7AwNbPjm();
     var require_err_msg = require_err_msg_BhVbr0NX();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -136282,6 +136510,18 @@ var require_addon = __commonJS({
             "empty"
           ]
         },
+        {
+          "path": "filterCleaningDue",
+          "valueType": "boolean"
+        },
+        {
+          "path": "machineCareDue",
+          "valueType": "boolean"
+        },
+        {
+          "path": "machineCareRemainingRuns",
+          "valueType": "number"
+        },
         {
           "path": "halfLoad",
           "valueType": "boolean"
@@ -137543,6 +137783,8 @@ var require_addon = __commonJS({
     exports.RevConflictError = require_sleep.RevConflictError;
     exports.SECRET_CLEAR = require_sleep.SECRET_CLEAR;
     exports.SECRET_REF_SCHEME = require_sleep.SECRET_REF_SCHEME;
+    exports.StoredRecordKindDeclarationSchema = require_sleep.StoredRecordKindDeclarationSchema;
+    exports.TransactRefusedError = require_sleep.TransactRefusedError;
     exports.UnindexedFilterError = require_sleep.UnindexedFilterError;
     exports.UnknownRecordKindError = require_sleep.UnknownRecordKindError;
     exports.addonSliceHandleApi = require_sleep.addonSliceHandleApi;
@@ -137551,6 +137793,7 @@ var require_addon = __commonJS({
     exports.asJsonObject = require_sleep.asJsonObject;
     exports.asRecordsError = require_sleep.asRecordsError;
     exports.asString = require_sleep.asString;
+    exports.assertTransactScope = require_sleep.assertTransactScope;
     exports.assertValidDeclaration = require_sleep.assertValidDeclaration;
     exports.buildSecretRef = require_sleep.buildSecretRef;
     exports.classifySecretWrite = require_sleep.classifySecretWrite;
@@ -137908,7 +138151,7 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
     var require_prefix_range = require_prefix_range_D_KueXbQ();
     var require_prefix_walk = require_prefix_walk_Dv6MLZlM();
@@ -146980,7 +147223,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -147114,7 +147357,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -147477,11 +147720,11 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
-    var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_safe_buffer$1 = require_safe_buffer_D3aoa_7X();
     var require_ms$1 = require_ms_LB3giGoU();
-    var require_device_ca = require_device_ca_B_Txwl4W();
+    var require_device_ca = require_device_ca_DpvQ5wrb();
+    var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
     var zod = require_zod();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
@@ -147491,75 +147734,6 @@ var require_local_auth_addon = __commonJS({
     node_path = require_chunk.__toESM(node_path);
     var node_fs = __require("fs");
     node_fs = require_chunk.__toESM(node_fs);
-    function parseRecord$2(kind, schema, data) {
-      try {
-        return schema.parse(data);
-      } catch (err) {
-        const topKeys = data && typeof data === "object" && !Array.isArray(data) ? Object.keys(data).join(", ") || "(empty)" : `(non-object: ${typeof data})`;
-        const detail = err instanceof Error ? err.message : String(err);
-        const hint = data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 1 && "data" in data ? " This shape is the legacy double-wrap from a stale settings-store query path. Restart the server with the latest @camstack/system build." : "";
-        throw new Error(`Failed to parse ${kind} from settings store. Top-level keys=[${topKeys}].${hint} Underlying: ${detail}`, { cause: err });
-      }
-    }
-    var import_read_all_rows = require_read_all_rows$1.require_read_all_rows();
-    var API_KEYS_COLLECTION$1 = "api_keys";
-    function parseApiKey(data) {
-      return parseRecord$2("api-key", require_dist10.ApiKeyRecordSchema, data);
-    }
-    function rowToApiKey(id, body) {
-      return parseApiKey({
-        id,
-        ...body
-      });
-    }
-    var ApiKeyManager = class {
-      kind;
-      legacyStore;
-      constructor(deps) {
-        if ("apiKeysKind" in deps) {
-          this.kind = deps.apiKeysKind;
-          this.legacyStore = deps.legacyStore ?? null;
-        } else {
-          this.kind = null;
-          this.legacyStore = deps.getStore();
-        }
-      }
-      get store() {
-        if (this.legacyStore === null) throw new Error("ApiKeyManager: legacy store unavailable on records-only path");
-        return this.legacyStore;
-      }
-      async listAll() {
-        const kind = this.kind;
-        return (kind !== null ? (await (0, import_read_all_rows.readAllRows)(kind)).map((row) => rowToApiKey(row.id, row.data)) : (await this.store.query.query({ collection: API_KEYS_COLLECTION$1 })).map((r2) => parseApiKey(r2.data))).map((parsed) => {
-          const { tokenHash: _th, ...rest } = parsed;
-          return rest;
-        });
-      }
-      async revoke(id) {
-        const kind = this.kind;
-        if (kind !== null) {
-          await kind.delete(id);
-          return;
-        }
-        await this.store.delete.mutate({
-          collection: API_KEYS_COLLECTION$1,
-          key: id
-        });
-      }
-      async findById(id) {
-        const kind = this.kind;
-        if (kind !== null) {
-          const row = await kind.get(id);
-          return row === null ? null : rowToApiKey(row.id, row.data);
-        }
-        const results = await this.store.query.query({
-          collection: API_KEYS_COLLECTION$1,
-          filter: { where: { id } }
-        });
-        if (results.length === 0) return null;
-        return parseApiKey(results[0].data);
-      }
-    };
     var randomFallback = null;
     function randomBytes$1(len) {
       try {
@@ -152264,6 +152438,7 @@ var require_local_auth_addon = __commonJS({
         }
       }
     };
+    var import_read_all_rows = require_read_all_rows$1.require_read_all_rows();
     var AUTH_AUDIT_COLLECTION = "auth_audit";
     var AUTH_AUDIT_COLUMNS = [
       {
@@ -152312,7 +152487,7 @@ var require_local_auth_addon = __commonJS({
     ];
     var RETENTION_MS = 90 * 864e5;
     var MAX_LIST = 500;
-    function parseRecord$1(data) {
+    function parseRecord$2(data) {
       const id = data["id"];
       const rawAt = data["at"];
       const at = typeof rawAt === "number" ? rawAt : typeof rawAt === "string" && rawAt.trim() !== "" && Number.isFinite(Number(rawAt)) ? Number(rawAt) : null;
@@ -152405,7 +152580,7 @@ var require_local_auth_addon = __commonJS({
           order: "at",
           desc: true,
           limit
-        })).records.map((row) => parseRecord$1({
+        })).records.map((row) => parseRecord$2({
           id: row.id,
           at: row.at,
           action: row.data.action,
@@ -152416,7 +152591,7 @@ var require_local_auth_addon = __commonJS({
         return (await this.store.query.query({
           collection: AUTH_AUDIT_COLLECTION,
           ...input.userId !== void 0 ? { filter: { where: { userId: input.userId } } } : {}
-        })).map((row) => parseRecord$1(row.data)).filter((r2) => r2 !== null).toSorted((a2, b) => b.at - a2.at).slice(0, limit);
+        })).map((row) => parseRecord$2(row.data)).filter((r2) => r2 !== null).toSorted((a2, b) => b.at - a2.at).slice(0, limit);
       }
       /** Delete rows older than 90 days. Returns how many. */
       async reap() {
@@ -152590,7 +152765,7 @@ var require_local_auth_addon = __commonJS({
       "web",
       "other"
     ];
-    function parseRecord(data) {
+    function parseRecord$1(data) {
       const id = str$1(data, "id");
       const userId = str$1(data, "userId");
       const deviceName = str$1(data, "deviceName");
@@ -152655,7 +152830,7 @@ var require_local_auth_addon = __commonJS({
         const kind = this.deps.deviceCredentialsKind ?? null;
         if (kind !== null) {
           for (const row of await (0, import_read_all_rows.readAllRows)(kind)) {
-            const record = parseRecord({
+            const record = parseRecord$1({
               id: row.id,
               ...row.data
             });
@@ -152665,7 +152840,7 @@ var require_local_auth_addon = __commonJS({
         }
         const rows = await this.store.query.query({ collection: DEVICE_CREDENTIALS_COLLECTION });
         for (const row of rows) {
-          const record = parseRecord(row.data);
+          const record = parseRecord$1(row.data);
           if (record !== null) this.records.set(record.id, record);
         }
       }
@@ -153066,7 +153241,6 @@ var require_local_auth_addon = __commonJS({
       }
     };
     var USERS_COLLECTION$1 = "users";
-    var API_KEYS_COLLECTION = "api_keys";
     var SCOPED_TOKENS_COLLECTION = "scoped_tokens";
     var USER_TOTP_COLLECTION = "user_totp";
     var USER_EXTERNAL_IDENTITIES_COLLECTION = "user_external_identities";
@@ -153116,52 +153290,6 @@ var require_local_auth_addon = __commonJS({
         notNull: true
       }
     ];
-    var API_KEYS_COLUMNS = [
-      {
-        name: "id",
-        type: "TEXT",
-        primaryKey: true,
-        notNull: true
-      },
-      {
-        name: "label",
-        type: "TEXT",
-        notNull: true
-      },
-      {
-        name: "isAdmin",
-        type: "BOOLEAN",
-        notNull: true
-      },
-      {
-        name: "tokenHash",
-        type: "TEXT",
-        notNull: true,
-        unique: true
-      },
-      {
-        name: "tokenPrefix",
-        type: "TEXT",
-        notNull: true
-      },
-      {
-        name: "allowedProviders",
-        type: "JSON"
-      },
-      {
-        name: "allowedDevices",
-        type: "JSON"
-      },
-      {
-        name: "createdAt",
-        type: "INTEGER",
-        notNull: true
-      },
-      {
-        name: "lastUsedAt",
-        type: "INTEGER"
-      }
-    ];
     var USER_TOTP_COLUMNS = [
       {
         name: "userId",
@@ -153273,14 +153401,6 @@ var require_local_auth_addon = __commonJS({
         collection: USERS_COLLECTION$1,
         columns: USERS_COLUMNS
       });
-      if (!skip.has("api_keys")) await store.declareCollection.mutate({
-        collection: API_KEYS_COLLECTION,
-        columns: API_KEYS_COLUMNS,
-        indexes: [{
-          name: "idx_api_keys_token_prefix",
-          columns: ["tokenPrefix"]
-        }]
-      });
       if (!skip.has("scoped_tokens")) await store.declareCollection.mutate({
         collection: SCOPED_TOKENS_COLLECTION,
         columns: SCOPED_TOKENS_COLUMNS,
@@ -153340,7 +153460,6 @@ var require_local_auth_addon = __commonJS({
     }
     var DAY_MS = 864e5;
     var UserBodySchema = require_dist10.UserRecordSchema.omit({ id: true });
-    var ApiKeyBodySchema = require_dist10.ApiKeyRecordSchema.omit({ id: true });
     var ScopedTokenBodySchema = require_dist10.ScopedTokenSchema.omit({ id: true });
     var AdminTokenBodySchema = zod.z.object({
       createdBy: zod.z.string(),
@@ -153428,18 +153547,6 @@ var require_local_auth_addon = __commonJS({
         }],
         retention: { none: "row goes only when an operator deletes the user; destructive declareCollection rebuild wipes all accounts" }
       },
-      "api-keys": {
-        schema: ApiKeyBodySchema,
-        class: "config",
-        writeTrigger: "legacy list/revoke only \u2014 nothing creates new API keys",
-        device: "none",
-        at: "none",
-        indexes: [{
-          name: "prefix",
-          fields: ["tokenPrefix"]
-        }],
-        retention: { none: "explicit revoke only" }
-      },
       "scoped-tokens": {
         schema: ScopedTokenBodySchema,
         class: "config",
@@ -153576,7 +153683,6 @@ var require_local_auth_addon = __commonJS({
     });
     var localAuthRecordKinds = _localAuthRecordKinds;
     var localAuthUsersRecordKind = _localAuthRecordKinds.users;
-    var localAuthApiKeysRecordKind = _localAuthRecordKinds["api-keys"];
     _localAuthRecordKinds["scoped-tokens"];
     _localAuthRecordKinds["admin-tokens"];
     var localAuthLoginSessionsRecordKind = _localAuthRecordKinds["login-sessions"];
@@ -153588,7 +153694,6 @@ var require_local_auth_addon = __commonJS({
     var localAuthAuthAuditRecordKind = _localAuthRecordKinds["auth-audit"];
     var LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS = [
       USERS_COLLECTION$1,
-      API_KEYS_COLLECTION,
       SCOPED_TOKENS_COLLECTION,
       ADMIN_TOKENS_COLLECTION,
       LOGIN_SESSIONS_COLLECTION,
@@ -153601,7 +153706,6 @@ var require_local_auth_addon = __commonJS({
     function localAuthRecordStoresOf(records) {
       return {
         users: records.kind(localAuthUsersRecordKind),
-        apiKeys: records.kind(localAuthApiKeysRecordKind),
         loginSessions: records.kind(localAuthLoginSessionsRecordKind),
         loginSessionCutoffs: records.kind(localAuthLoginSessionCutoffsRecordKind),
         oauthSessions: records.kind(localAuthOauthSessionsRecordKind),
@@ -154433,11 +154537,21 @@ var require_local_auth_addon = __commonJS({
       if (internal === null || typeof internal !== "object") return null;
       return internal;
     }
+    function parseRecord(kind, schema, data) {
+      try {
+        return schema.parse(data);
+      } catch (err) {
+        const topKeys = data && typeof data === "object" && !Array.isArray(data) ? Object.keys(data).join(", ") || "(empty)" : `(non-object: ${typeof data})`;
+        const detail = err instanceof Error ? err.message : String(err);
+        const hint = data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 1 && "data" in data ? " This shape is the legacy double-wrap from a stale settings-store query path. Restart the server with the latest @camstack/system build." : "";
+        throw new Error(`Failed to parse ${kind} from settings store. Top-level keys=[${topKeys}].${hint} Underlying: ${detail}`, { cause: err });
+      }
+    }
     var USERS_COLLECTION = "users";
     var FIRST_BOOT_ADMIN_USERNAME = "admin";
     var FIRST_BOOT_ADMIN_PASSWORD = "changeme";
     function parseUser(data) {
-      return parseRecord$2("user", require_dist10.UserRecordSchema, data);
+      return parseRecord("user", require_dist10.UserRecordSchema, data);
     }
     function userToBody(user) {
       const { id: _id, ...body } = user;
@@ -157253,7 +157367,6 @@ var require_local_auth_addon = __commonJS({
     var LocalAuthAddon = class extends require_dist10.BaseAddon {
       authManager = null;
       userManager = null;
-      apiKeyManager = null;
       oauthSessionManager = null;
       reapTimer = null;
       totpManager = null;
@@ -157289,10 +157402,6 @@ var require_local_auth_addon = __commonJS({
             usersKind: authStores.users,
             legacyStore: store
           }, this.authManager);
-          this.apiKeyManager = new ApiKeyManager({
-            apiKeysKind: authStores.apiKeys,
-            legacyStore: store
-          });
           this.oauthSessionManager = new OauthSessionManager({ oauthSessionsKind: authStores.oauthSessions });
           this.totpManager = new TotpManager({
             userTotpKind: authStores.userTotp,
@@ -157457,15 +157566,6 @@ var require_local_auth_addon = __commonJS({
               totpEnabled
             };
           },
-          listApiKeys: async () => {
-            if (!this.apiKeyManager) return [];
-            return this.apiKeyManager.listAll();
-          },
-          revokeApiKey: async (input) => {
-            if (!this.apiKeyManager) throw new Error("API key management not available");
-            await this.apiKeyManager.revoke(input.id);
-            return { success: true };
-          },
           oauthIssueCode: async (input) => {
             return lazyOauthGrants().oauthIssueCode(input);
           },
@@ -157826,7 +157926,6 @@ var require_local_auth_addon = __commonJS({
         }
         this.authManager = null;
         this.userManager = null;
-        this.apiKeyManager = null;
         this.oauthSessionManager = null;
         this.externalIdentities = null;
         this.loginSessions = null;
@@ -157835,7 +157934,6 @@ var require_local_auth_addon = __commonJS({
         this.deviceCa = null;
       }
     };
-    exports.ApiKeyManager = ApiKeyManager;
     exports.AuthAuditLog = AuthAuditLog;
     exports.AuthManager = AuthManager;
     exports.DeviceCaStore = DeviceCaStore;
@@ -158013,7 +158111,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_log_read_filter = require_log_read_filter_Bi066jwU();
     var zod = require_zod();
     function sanitizeLabelName(raw) {
@@ -158974,7 +159072,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var node_fs_promises = __require("fs/promises");
     var node_util = __require("util");
     var node_os = __require("os");
@@ -161541,7 +161639,7 @@ var require_device_history_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var FIVE_MINUTES_MS = 5 * 6e4;
     var HOUR_MS = 60 * 6e4;
     var DAY_MS = 24 * HOUR_MS;
@@ -164587,7 +164685,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -165697,12 +165795,12 @@ var require_lib = __commonJS({
   }
 });
 
-// ../system/dist/wal-maintenance-BQlvAduo.js
-var require_wal_maintenance_BQlvAduo = __commonJS({
-  "../system/dist/wal-maintenance-BQlvAduo.js"(exports) {
+// ../system/dist/wal-maintenance-BIpPCYDi.js
+var require_wal_maintenance_BIpPCYDi = __commonJS({
+  "../system/dist/wal-maintenance-BIpPCYDi.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_prefix_range = require_prefix_range_D_KueXbQ();
     var node_crypto = __require("crypto");
     var node_module = __require("module");
@@ -166162,7 +166260,7 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
         database: asDatabase(row.database),
         hash: row.manifest_hash,
         state: asState(row.state),
-        declaration: require_dist10.RecordKindDeclarationSchema.parse(JSON.parse(row.declaration))
+        declaration: require_dist10.StoredRecordKindDeclarationSchema.parse(JSON.parse(row.declaration))
       };
     }
     function ensureRecordsSchema(db) {
@@ -166202,8 +166300,10 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
           state = "created";
         } else {
           kindId = prior.kindId;
-          if (prior.hash === hash) state = "unchanged";
-          else {
+          if (prior.hash === hash) {
+            db.prepare("UPDATE _record_kinds SET declaration = ? WHERE kind_id = ? AND declaration <> ?").run(JSON.stringify(declaration), kindId, JSON.stringify(declaration));
+            state = "unchanged";
+          } else {
             db.prepare("UPDATE _record_kinds SET manifest_hash = ?, declaration = ?, state = 'declared', orphaned_at = NULL WHERE kind_id = ?").run(hash, JSON.stringify(declaration), kindId);
             state = "updated";
           }
@@ -166230,8 +166330,7 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
           result: {
             kindId,
             state,
-            createdIndexes: created,
-            adoptionPending: null
+            createdIndexes: created
           }
         };
       })();
@@ -166861,13 +166960,17 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
       }
       async patch(input) {
         const k = this.kindOf(input.owner, input.kind);
-        const decl = k.declaration;
         const nowMs = this.now();
+        return this.timed("patch", input.kind, () => this.db.transaction(() => this.patchRecord(k, input, nowMs))());
+      }
+      /** One patch, inside the caller's transaction (shared with `transact`). */
+      patchRecord(k, input, nowMs) {
+        const decl = k.declaration;
         if (input.at !== void 0 && decl.at !== "required") throw new require_dist10.InvalidRecordError(`${input.kind}: declared at: "none"`);
         if (input.at === null) throw new require_dist10.InvalidRecordError(`${input.kind}: "at" cannot be removed`);
         if (input.expiresAt !== void 0 && decl.secretPaths.length > 0) throw new require_dist10.InvalidRecordError(`${input.kind}: a kind with secret fields cannot expire by the engine (its keychain values would be orphaned)`);
         if (input.expiresAt !== void 0 && "ttlMs" in decl.retention) throw new require_dist10.InvalidRecordError(`${input.kind}: expiresAt is set by the engine`);
-        const run = this.db.transaction(() => {
+        {
           const hasSecrets = decl.secretPaths.length > 0;
           const before = hasSecrets || input.ifRev !== void 0 ? this.storedRow(k, input.id) : void 0;
           const checked = enforceSecrets(input.owner, input.kind, decl, input.id, input.data, before === void 0 ? null : parseBody(before.data), "patch");
@@ -166904,22 +167007,83 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
             rev: updated.rev,
             releasedRefs: released
           };
-        });
-        return this.timed("patch", input.kind, () => run());
+        }
       }
       refsOfRows(k, rows) {
         if (k.declaration.secretPaths.length === 0) return [];
         return rows.flatMap((row) => [...markersOf(k.declaration, parseBody(row.data)).values()]);
       }
       async delete(input) {
-        const k = this.kindOf(input.owner, input.kind);
+        return this.deleteRecord(this.kindOf(input.owner, input.kind), input.id);
+      }
+      /** One delete (shared with `transact`). */
+      deleteRecord(k, id) {
         const hasSecrets = k.declaration.secretPaths.length > 0;
-        const rows = this.db.prepare(`DELETE FROM records WHERE ${kindClause(k.kindId)} AND id = ? RETURNING ${hasSecrets ? "json(data)" : "'{}'"} AS data`).all(input.id);
+        const rows = this.db.prepare(`DELETE FROM records WHERE ${kindClause(k.kindId)} AND id = ? RETURNING ${hasSecrets ? "json(data)" : "'{}'"} AS data`).all(id);
         return {
           deleted: rows.length > 0,
           secretRefs: this.refsOfRows(k, rows)
         };
       }
+      /**
+      * Several put / patch / delete in ONE SQLite transaction. The scope rule
+      * (one file, one `transactFamily`) is checked before a row moves; each op then
+      * runs the very code of the single-row write, so secrets, indexes and size
+      * bounds behave exactly as there. Any op throwing rolls the whole call back.
+      */
+      async transact(input) {
+        const kinds = /* @__PURE__ */ new Map();
+        for (const op of input.ops) if (!kinds.has(op.kind)) kinds.set(op.kind, this.kindOf(input.owner, op.kind));
+        require_dist10.assertTransactScope([...kinds.values()].map((k) => ({
+          kind: k.kind,
+          declaration: k.declaration
+        })));
+        const nowMs = this.now();
+        const results = [];
+        const releasedRefs = [];
+        const secretRefs = [];
+        const label = [...kinds.keys()].join("+");
+        this.timed("transact", label, () => this.db.transaction(() => {
+          for (const op of input.ops) {
+            const k = kinds.get(op.kind);
+            if (k === void 0) throw new require_dist10.UnknownRecordKindError(`"${input.owner}" declared no kind "${op.kind}"`);
+            if (op.op === "put") {
+              const w = this.writeRecord(input.owner, k, op.record, op.ifRev, nowMs);
+              releasedRefs.push(...w.releasedRefs);
+              results.push({
+                rev: w.rev,
+                deleted: false
+              });
+            } else if (op.op === "patch") {
+              const w = this.patchRecord(k, {
+                ...op,
+                owner: input.owner
+              }, nowMs);
+              releasedRefs.push(...w.releasedRefs);
+              results.push({
+                rev: w.rev,
+                deleted: false
+              });
+            } else {
+              const d = this.deleteRecord(k, op.id);
+              secretRefs.push(...d.secretRefs);
+              results.push({
+                rev: null,
+                deleted: d.deleted
+              });
+            }
+          }
+        })());
+        for (const [name, k] of kinds) {
+          const devices = input.ops.flatMap((op) => op.op === "put" && op.kind === name ? [op.record.deviceId] : []);
+          if (devices.length > 0) this.afterWrite(k, devices);
+        }
+        return {
+          results,
+          releasedRefs,
+          secretRefs
+        };
+      }
       async deleteMany(input) {
         const k = this.kindOf(input.owner, input.kind);
         const hasSecrets = k.declaration.secretPaths.length > 0;
@@ -167074,6 +167238,7 @@ CREATE TABLE IF NOT EXISTS _record_sequences (
       "histogram",
       "aggregate",
       "deleteWhere",
+      "transact",
       "deleteDevice",
       "allocateId",
       "listKinds",
@@ -169819,9 +169984,9 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_retired_settings_keys = require_retired_settings_keys_CGUqX_Oz();
-    var require_wal_maintenance = require_wal_maintenance_BQlvAduo();
+    var require_wal_maintenance = require_wal_maintenance_BIpPCYDi();
     var require_sqlite_snapshot_protocol = require_sqlite_snapshot_protocol_B9OndqZv();
     var require_wal_checkpoint_policy = require_wal_checkpoint_policy_d2z2qPqx();
     var node_fs_promises = __require("fs/promises");
@@ -170994,12 +171159,6 @@ var require_sqlite_settings_addon = __commonJS({
     function keyOf(owner, kind) {
       return `${owner}\0${kind}`;
     }
-    function withoutRetiredKeys(declaration) {
-      return {
-        ...declaration,
-        adoptsFrom: void 0
-      };
-    }
     var RecordsProvider = class {
       router;
       logger;
@@ -171033,7 +171192,7 @@ var require_sqlite_settings_addon = __commonJS({
         const owner = recordsCallerOf(input);
         const byDatabase = /* @__PURE__ */ new Map();
         const parsed = /* @__PURE__ */ new Map();
-        for (const [kind, raw] of Object.entries(input.kinds)) parsed.set(kind, withoutRetiredKeys(require_dist10.RecordKindDeclarationSchema.parse(raw)));
+        for (const [kind, raw] of Object.entries(input.kinds)) parsed.set(kind, require_dist10.RecordKindDeclarationSchema.parse(raw));
         await this.assertFamiliesInOneFile(owner, parsed);
         for (const [kind, declaration] of parsed) {
           const known = this.placement.get(keyOf(owner, kind));
@@ -171177,6 +171336,27 @@ var require_sqlite_settings_addon = __commonJS({
           owner
         });
       }
+      /**
+      * All ops must resolve to ONE file (`records/transact-refused` `cross-file`
+      * otherwise); that file's engine then checks the family and runs one SQLite
+      * transaction.
+      */
+      async transact(input) {
+        const owner = recordsCallerOf(input);
+        const files = /* @__PURE__ */ new Map();
+        for (const op of input.ops) {
+          const database = this.placement.get(keyOf(owner, op.kind));
+          if (database === void 0) throw new require_dist10.UnknownRecordKindError(`"${owner}" declared no kind "${op.kind}"`);
+          files.set(database, [...files.get(database) ?? [], op.kind]);
+        }
+        if (files.size > 1) throw new require_dist10.TransactRefusedError(`cross-file: the ops span more than one database file (${[...files.entries()].map(([db, kinds]) => `${[...new Set(kinds)].join("+")}@${db}`).join(", ")}); a transaction lives in ONE file`);
+        const first = input.ops[0];
+        if (first === void 0) throw new require_dist10.InvalidRecordError("transact: no ops");
+        return (await this.fileOf(owner, first.kind)).records("transact", {
+          ...input,
+          owner
+        });
+      }
       async allocateId(input) {
         const owner = recordsCallerOf(input);
         return (await this.fileOf(owner, input.kind)).records("allocateId", {
@@ -171434,7 +171614,7 @@ var require_sqlite_storage = __commonJS({
     });
     require_chunk_Cek0wNdY();
     var require_builtins_sqlite_storage_filesystem_storage_addon = require_filesystem_storage_addon();
-    var require_wal_maintenance = require_wal_maintenance_BQlvAduo();
+    var require_wal_maintenance = require_wal_maintenance_BIpPCYDi();
     var require_builtins_sqlite_storage_sqlite_settings_addon = require_sqlite_settings_addon();
     var ConfigStore = class {
       db;
@@ -171518,7 +171698,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -176105,12 +176285,12 @@ var require_storage_orchestrator = __commonJS({
   }
 });
 
-// ../system/dist/agent-https-CzA1AmyI.js
-var require_agent_https_CzA1AmyI = __commonJS({
-  "../system/dist/agent-https-CzA1AmyI.js"(exports) {
+// ../system/dist/agent-https-OIvfjiTx.js
+var require_agent_https_OIvfjiTx = __commonJS({
+  "../system/dist/agent-https-OIvfjiTx.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_x509_es = require_x509_es_C4cOo48M();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -177168,11 +177348,11 @@ var require_agent_https_CzA1AmyI = __commonJS({
   }
 });
 
-// ../system/dist/constants-BYJ4ni7h.js
-var require_constants_BYJ4ni7h = __commonJS({
-  "../system/dist/constants-BYJ4ni7h.js"(exports) {
+// ../system/dist/constants-CdgJF4V6.js
+var require_constants_CdgJF4V6 = __commonJS({
+  "../system/dist/constants-CdgJF4V6.js"(exports) {
     "use strict";
-    var MESH_CA_KEY_REF = require_dist_Dwi4JA96().buildSecretRef({
+    var MESH_CA_KEY_REF = require_dist_QyW9hVO2().buildSecretRef({
       owner: "system",
       scope: { kind: "global" },
       fieldPath: "meshCaKey"
@@ -194269,11 +194449,11 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_safe_buffer$1 = require_safe_buffer_D3aoa_7X();
     var require_x509_es = require_x509_es_C4cOo48M();
-    var require_agent_https = require_agent_https_CzA1AmyI();
-    var require_constants$8 = require_constants_BYJ4ni7h();
+    var require_agent_https = require_agent_https_OIvfjiTx();
+    var require_constants$8 = require_constants_CdgJF4V6();
     var require_src$1 = require_src_CnAqG6EF();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -275325,7 +275505,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_formatter = require_formatter_DqAKDlvN();
     var require_log_file_read_protocol = require_log_file_read_protocol_D0WcLbIV();
     var node_path = __require("path");
@@ -283128,14 +283308,14 @@ var require_lib_8oZrELLm = __commonJS({
   }
 });
 
-// ../system/dist/hub-mdns-ciao-3qdHbtyp.js
-var require_hub_mdns_ciao_3qdHbtyp = __commonJS({
-  "../system/dist/hub-mdns-ciao-3qdHbtyp.js"(exports) {
+// ../system/dist/hub-mdns-ciao-CWkX17zX.js
+var require_hub_mdns_ciao_CWkX17zX = __commonJS({
+  "../system/dist/hub-mdns-ciao-CWkX17zX.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var require_x509_es = require_x509_es_C4cOo48M();
-    var require_agent_https = require_agent_https_CzA1AmyI();
+    var require_agent_https = require_agent_https_OIvfjiTx();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var node_fs_promises = __require("fs/promises");
@@ -284147,12 +284327,12 @@ var require_platform_key_source_Di7HrlGR = __commonJS({
   }
 });
 
-// ../system/dist/restore-archive-D1uxP8Eb.js
-var require_restore_archive_D1uxP8Eb = __commonJS({
-  "../system/dist/restore-archive-D1uxP8Eb.js"(exports) {
+// ../system/dist/restore-archive-DMgpNgX5.js
+var require_restore_archive_DMgpNgX5 = __commonJS({
+  "../system/dist/restore-archive-DMgpNgX5.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
     var zod = require_zod();
     var node_crypto = __require("crypto");
     var buffer = __require("buffer");
@@ -295393,9 +295573,9 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dwi4JA96();
+    var require_dist10 = require_dist_QyW9hVO2();
+    var require_device_ca = require_device_ca_DpvQ5wrb();
     var require_read_all_rows$1 = require_read_all_rows_CVoO1ONM();
-    var require_device_ca = require_device_ca_B_Txwl4W();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_builtins_calendars_calendars_addon = require_calendars_addon();
@@ -295419,21 +295599,21 @@ var require_dist3 = __commonJS({
     var require_builtins_native_metrics_native_metrics_addon = require_native_metrics_addon();
     var require_builtins_device_history_device_history_addon = require_device_history_addon();
     var require_builtins_sqlite_storage_filesystem_storage_addon = require_filesystem_storage_addon();
-    var require_wal_maintenance = require_wal_maintenance_BQlvAduo();
+    var require_wal_maintenance = require_wal_maintenance_BIpPCYDi();
     var require_builtins_sqlite_storage_sqlite_settings_addon = require_sqlite_settings_addon();
     var require_builtins_sqlite_storage_index = require_sqlite_storage();
     var require_builtins_storage_orchestrator_storage_orchestrator_addon = require_storage_orchestrator_addon();
     require_storage_orchestrator();
-    var require_agent_https = require_agent_https_CzA1AmyI();
-    var require_constants15 = require_constants_BYJ4ni7h();
+    var require_agent_https = require_agent_https_OIvfjiTx();
+    var require_constants15 = require_constants_CdgJF4V6();
     var require_builtins_system_config_system_config_addon = require_system_config_addon();
     require_system_config();
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_custom_action_registry = require_custom_action_registry_MRyes5j0();
-    var require_hub_mdns_ciao = require_hub_mdns_ciao_3qdHbtyp();
+    var require_hub_mdns_ciao = require_hub_mdns_ciao_CWkX17zX();
     var require_platform_key_source = require_platform_key_source_Di7HrlGR();
     var require_resource_monitor = require_resource_monitor_mio9dSCT();
-    var require_restore_archive = require_restore_archive_D1uxP8Eb();
+    var require_restore_archive = require_restore_archive_DMgpNgX5();
     var require_coral_accelerators = require_coral_accelerators_oUXmmbc2();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -308448,6 +308628,7 @@ var require_dist3 = __commonJS({
         histogram: (input) => r.histogram.query(input),
         aggregate: (input) => r.aggregate.query(input),
         deleteWhere: (input) => r.deleteWhere.mutate(input),
+        transact: (input) => r.transact.mutate(input),
         deleteDevice: (input) => r.deleteDevice.mutate(input),
         allocateId: (input) => r.allocateId.mutate(input)
       };
@@ -318037,7 +318218,6 @@ var require_dist3 = __commonJS({
     exports.AgentMeshIdentityGate = AgentMeshIdentityGate;
     exports.AgentPairing = require_builtins_system_config_system_config_addon.AgentPairing;
     exports.AlertCenterAddon = require_builtins_alerts_alerts_addon.AlertCenterAddon;
-    exports.ApiKeyManager = require_builtins_local_auth_local_auth_addon.ApiKeyManager;
     exports.AuthAuditLog = require_builtins_local_auth_local_auth_addon.AuthAuditLog;
     exports.AuthManager = require_builtins_local_auth_local_auth_addon.AuthManager;
     exports.BackupDecryptError = require_restore_archive.BackupDecryptError;
@@ -318857,7 +319037,7 @@ var require_enums = __commonJS({
   "../types/dist/enums.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_kpu1bZMs();
+    var require_event_category = require_event_category_7AwNbPjm();
     var EventSourceType = /* @__PURE__ */ (function(EventSourceType2) {
       EventSourceType2["Addon"] = "addon";
       EventSourceType2["Core"] = "core";
@@ -318877,8 +319057,8 @@ var require_dist4 = __commonJS({
   "../types/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_sleep = require_sleep_Bo7fq491();
-    var require_event_category = require_event_category_kpu1bZMs();
+    var require_sleep = require_sleep_CD18m9HF();
+    var require_event_category = require_event_category_7AwNbPjm();
     var require_composition = require_composition_eoYYVfOp();
     var require_node_color2 = require_node_color();
     var require_err_msg = require_err_msg_BhVbr0NX();
@@ -323149,17 +323329,6 @@ var require_dist4 = __commonJS({
       createdAt: zod.z.number(),
       updatedAt: zod.z.number()
     });
-    var ApiKeyRecordSchema = zod.z.object({
-      id: zod.z.string(),
-      label: zod.z.string(),
-      isAdmin: zod.z.boolean().default(false),
-      allowedProviders: AllowedProviderSchema,
-      allowedDevices: AllowedDevicesSchema,
-      tokenHash: zod.z.string(),
-      tokenPrefix: zod.z.string(),
-      createdAt: zod.z.number(),
-      lastUsedAt: zod.z.number().optional()
-    });
     var ScopedTokenSchema = zod.z.object({
       id: zod.z.string(),
       userId: zod.z.string(),
@@ -329217,15 +329386,31 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var DeclareKindResultSchema = zod.z.object({
       kindId: zod.z.number().int(),
       state: RecordKindStateSchema,
-      createdIndexes: zod.z.array(zod.z.string()),
-      /**
-      * RETIRED (D900): always `null`. It carried the records-migration boot guard;
-      * it stays on the wire, null, because an addon built before the removal reads
-      * an ABSENT field as "adoption pending" and refuses to start.
-      */
-      adoptionPending: zod.z.null()
+      createdIndexes: zod.z.array(zod.z.string())
     });
     var SecretRefsList = zod.z.array(zod.z.string());
+    var RecordTransactOpSchema = zod.z.discriminatedUnion("op", [
+      zod.z.object({
+        op: zod.z.literal("put"),
+        kind: require_sleep.RecordKindNameSchema,
+        record: RecordInputSchema,
+        ifRev: zod.z.number().int().min(0).optional()
+      }),
+      zod.z.object({
+        op: zod.z.literal("patch"),
+        kind: require_sleep.RecordKindNameSchema,
+        id: RecordIdSchema,
+        data: RecordBodySchema,
+        at: zod.z.number().int().nullable().optional(),
+        expiresAt: zod.z.number().int().nullable().optional(),
+        ifRev: zod.z.number().int().min(1).optional()
+      }),
+      zod.z.object({
+        op: zod.z.literal("delete"),
+        kind: require_sleep.RecordKindNameSchema,
+        id: RecordIdSchema
+      })
+    ]);
     var RecordSecretRefsSchema = zod.z.record(zod.z.string(), zod.z.record(zod.z.string(), zod.z.string()));
     var recordsCapability = {
       name: "records",
@@ -329357,6 +329542,22 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "mutation",
           auth: "admin"
         }),
+        /**
+        * Several single-row writes (put / patch / delete) in ONE SQLite transaction:
+        * all land or none does. Every op's kind must sit in one file and share one
+        * `transactFamily` (`records/transact-refused` otherwise). Results are in op order.
+        */
+        transact: require_sleep.method(zod.z.object({ ops: zod.z.array(RecordTransactOpSchema).min(1).max(require_sleep.RECORD_BATCH_MAX) }), zod.z.object({
+          results: zod.z.array(zod.z.object({
+            rev: zod.z.number().int().nullable(),
+            deleted: zod.z.boolean()
+          })),
+          releasedRefs: SecretRefsList,
+          secretRefs: SecretRefsList
+        }), {
+          kind: "mutation",
+          auth: "admin"
+        }),
         /** The D865 hook body: every kind of this addon declared `deviceRemoval: 'delete'`. */
         deleteDevice: require_sleep.method(zod.z.object({
           deviceId: zod.z.number().int(),
@@ -356174,9 +356375,13 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "node-updating",
       "node-inference-unavailable",
       "detection-blind",
+      "motion-noisy",
+      "motion-calm",
       "recording-stalled",
       "recording-healthy",
       "recording-degraded",
+      "device-attention-required",
+      "device-attention-resolved",
       "storage-location-low",
       "storage-location-critical",
       "storage-location-ok",
@@ -357286,6 +357491,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
             value: "detection-blind",
             label: "Camera detecting nothing"
           },
+          {
+            value: "motion-noisy",
+            label: "Camera motion constant, no subject"
+          },
+          {
+            value: "motion-calm",
+            label: "Camera motion calm again"
+          },
           {
             value: "recording-stalled",
             label: "Recording stalled"
@@ -357298,6 +357511,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
             value: "recording-degraded",
             label: "Recording degraded (restart storm)"
           },
+          {
+            value: "device-attention-required",
+            label: "Device needs attention"
+          },
+          {
+            value: "device-attention-resolved",
+            label: "Device attention resolved"
+          },
           {
             value: "storage-location-low",
             label: "Storage location low"
@@ -370685,6 +370906,16 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       powerState: zod.z.string().nullable(),
       saltLevel: DishwasherConsumableLevelSchema.nullable(),
       rinseAidLevel: DishwasherConsumableLevelSchema.nullable(),
+      /**
+      * True while the appliance asks for its filter to be cleaned (smart-filter, filter-system or
+      * combined care-and-filter reminder raised); false when every such reminder reads clear; null
+      * when none is reported. A cleared reminder is not an unknown one.
+      */
+      filterCleaningDue: zod.z.boolean().nullable(),
+      /** True while the machine-care (descaling / cleaning-program) reminder is raised; false when clear; null when not reported. */
+      machineCareDue: zod.z.boolean().nullable(),
+      /** Program runs left before the machine-care reminder is due; null when the appliance does not say. */
+      machineCareRemainingRuns: zod.z.number().int().nonnegative().nullable(),
       /** Option states: null when the appliance does not expose the option or has not said. */
       halfLoad: zod.z.boolean().nullable(),
       hygienePlus: zod.z.boolean().nullable(),
@@ -379178,16 +379409,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])).optional(),
       scopes: zod.z.array(TokenScopeSchema).optional()
     });
-    var ApiKeySummarySchema = zod.z.object({
-      id: zod.z.string(),
-      label: zod.z.string(),
-      isAdmin: zod.z.boolean().default(false),
-      allowedProviders: zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")]).optional(),
-      allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])).optional(),
-      tokenPrefix: zod.z.string(),
-      createdAt: zod.z.number(),
-      lastUsedAt: zod.z.number().optional()
-    });
     var OauthSessionSummarySchema = zod.z.object({
       id: zod.z.string(),
       userId: zod.z.string(),
@@ -379268,12 +379489,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "mutation",
           access: "view"
         }),
-        listApiKeys: require_sleep.method(zod.z.void(), zod.z.array(ApiKeySummarySchema), { auth: "admin" }),
-        revokeApiKey: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
-          kind: "mutation",
-          auth: "admin",
-          access: "delete"
-        }),
         setupTotp: require_sleep.method(zod.z.object({ userId: zod.z.string() }), TotpSetupResultSchema, {
           kind: "mutation",
           auth: "admin",
@@ -389960,6 +390175,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "records.transact": {
+        capName: "records",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "sceneMonitor.captureReference": {
         capName: "scene-monitor",
         capScope: "device",
@@ -391292,12 +391513,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
-      "userManagement.listApiKeys": {
-        capName: "user-management",
-        capScope: "system",
-        addonId: null,
-        access: "view"
-      },
       "userManagement.listExternalIdentities": {
         capName: "user-management",
         capScope: "system",
@@ -391352,12 +391567,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
-      "userManagement.revokeApiKey": {
-        capName: "user-management",
-        capScope: "system",
-        addonId: null,
-        access: "delete"
-      },
       "userManagement.revokeOauthSession": {
         capName: "user-management",
         capScope: "system",
@@ -399617,8 +399826,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           resetPassword: (input) => dispatch("userManagement", "resetPassword", "mutation", input),
           setUserScopes: (input) => dispatch("userManagement", "setUserScopes", "mutation", input),
           validateCredentials: (input) => dispatch("userManagement", "validateCredentials", "mutation", input),
-          listApiKeys: (input) => dispatch("userManagement", "listApiKeys", "query", input),
-          revokeApiKey: (input) => dispatch("userManagement", "revokeApiKey", "mutation", input),
           setupTotp: (input) => dispatch("userManagement", "setupTotp", "mutation", input),
           confirmTotp: (input) => dispatch("userManagement", "confirmTotp", "mutation", input),
           disableTotp: (input) => dispatch("userManagement", "disableTotp", "mutation", input),
@@ -400056,9 +400263,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     function systemEventFilterApplies(kind, filter) {
       switch (filter) {
         case "deviceIds":
-          return kind.startsWith("device-") || kind.startsWith("stream-") || kind === "detection-blind" || kind.startsWith("recording-") || kind === "alarm-triggered";
+          return kind.startsWith("device-") || kind.startsWith("stream-") || kind === "detection-blind" || kind.startsWith("motion-") || kind.startsWith("recording-") || kind === "alarm-triggered";
         case "deviceTypes":
-          return kind.startsWith("device-") || kind === "detection-blind";
+          return kind.startsWith("device-") || kind === "detection-blind" || kind.startsWith("motion-");
         case "nodeIds":
           return kind.startsWith("node-") || kind === "addon-crash-loop" || kind === "addon-update-available" || kind === "addon-updated" || kind === "server-update-available" || kind === "wrapper-update-available" || kind === "server-updated" || kind.startsWith("storage-location-") || kind.startsWith("alert-");
         case "packageNames":
@@ -400093,9 +400300,13 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "stream-online": "device-events",
       "stream-offline": "device-events",
       "detection-blind": "device-events",
+      "motion-noisy": "device-events",
+      "motion-calm": "device-events",
       "recording-stalled": "device-events",
       "recording-healthy": "device-events",
       "recording-degraded": "device-events",
+      "device-attention-required": "device-events",
+      "device-attention-resolved": "device-events",
       "node-online": "system",
       "node-offline": "system",
       "node-restarting": "system",
@@ -400189,6 +400400,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         label: "Detecting nothing",
         kinds: ["detection-blind"]
       },
+      {
+        id: "motion-noise",
+        family: "device-events",
+        label: "Motion without a subject",
+        kinds: ["motion-noisy", "motion-calm"]
+      },
       {
         id: "recording",
         family: "device-events",
@@ -400199,6 +400416,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           "recording-degraded"
         ]
       },
+      {
+        id: "device-attention",
+        family: "device-events",
+        label: "Needs attention",
+        kinds: ["device-attention-required", "device-attention-resolved"]
+      },
       {
         id: "nodes",
         family: "system",
@@ -401607,6 +401830,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       if (severity === "error" && phase === "raised") return "alert-error";
       return null;
     }
+    function deviceAttentionKind(severity, phase) {
+      if (severity !== "critical") return null;
+      return phase === "raised" ? "device-attention-required" : "device-attention-resolved";
+    }
     function alertEpisodePayload(alert, phase, at) {
       const nodeId = alertNodeId(alert);
       return {
@@ -401640,6 +401867,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "alert-error",
       "alert-critical-resolved"
     ];
+    var DEVICE_ATTENTION = ["device-attention-required", "device-attention-resolved"];
     var UPDATES = [
       "addon-update-available",
       "server-update-available",
@@ -401669,9 +401897,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "stream-online",
       "stream-offline",
       "detection-blind",
+      "motion-noisy",
+      "motion-calm",
       "recording-stalled",
       "recording-healthy",
       "recording-degraded",
+      ...DEVICE_ATTENTION,
       ...ALARM
     ];
     var SUMMARISABLE = [...systemEventKindsOfFamily("device-events"), ...systemEventKindsOfFamily("system")];
@@ -402242,7 +402473,36 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         families: ["rule"],
         fields: [...RULE_TEXT],
         kinds: ["system"],
-        systemEventKinds: ["detection-blind", "recording-stalled"]
+        systemEventKinds: [
+          "detection-blind",
+          "motion-noisy",
+          "motion-calm",
+          "recording-stalled"
+        ]
+      },
+      {
+        name: "duty",
+        label: "Motion share (%)",
+        example: "55",
+        group: "system",
+        families: ["rule"],
+        fields: [...RULE_TEXT],
+        kinds: ["system"],
+        systemEventKinds: ["motion-noisy", "motion-calm"]
+      },
+      {
+        name: "sessions",
+        label: "Detection sessions",
+        example: "96",
+        group: "system",
+        families: ["rule"],
+        fields: [...RULE_TEXT],
+        kinds: ["system"],
+        systemEventKinds: [
+          "detection-blind",
+          "motion-noisy",
+          "motion-calm"
+        ]
       },
       {
         name: "message",
@@ -402252,7 +402512,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         families: ["rule"],
         fields: [...RULE_TEXT],
         kinds: ["system"],
-        systemEventKinds: ["recording-degraded", ...ALERT_EPISODE]
+        systemEventKinds: [
+          "recording-degraded",
+          ...DEVICE_ATTENTION,
+          ...ALERT_EPISODE
+        ]
       },
       {
         name: "ruleName",
@@ -402496,7 +402760,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         families: ["rule"],
         fields: [...RULE_TEXT],
         kinds: ["system"],
-        systemEventKinds: ["export-completed", ...ALERT_EPISODE]
+        systemEventKinds: [
+          "export-completed",
+          ...DEVICE_ATTENTION,
+          ...ALERT_EPISODE
+        ]
       },
       {
         name: "severity",
@@ -402516,7 +402784,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         families: ["rule"],
         fields: [...RULE_TEXT],
         kinds: ["system"],
-        systemEventKinds: [...ALERT_EPISODE]
+        systemEventKinds: [...DEVICE_ATTENTION, ...ALERT_EPISODE]
       },
       {
         name: "source",
@@ -402536,7 +402804,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         families: ["rule"],
         fields: [...RULE_TEXT],
         kinds: ["system"],
-        systemEventKinds: [...ALERT_EPISODE]
+        systemEventKinds: [...DEVICE_ATTENTION, ...ALERT_EPISODE]
       },
       {
         name: "exportId",
@@ -402736,6 +403004,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "alert-critical",
       "alert-error",
       "alert-critical-resolved",
+      "device-attention-required",
+      "device-attention-resolved",
       "rule-broken",
       "rule-repaired"
     ];
@@ -402849,6 +403119,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         snapshotLabel: "Tanks low or full now",
         snapshotSection: "tanks"
       },
+      {
+        id: "motion-noise",
+        family: "device-events",
+        label: "Motion without a subject (constant / calm again)",
+        bad: ["motion-noisy"],
+        recovery: ["motion-calm"],
+        snapshotLabel: "Cameras with constant motion now",
+        snapshotSection: null
+      },
       {
         id: "recording-health",
         family: "device-events",
@@ -402858,6 +403137,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         snapshotLabel: "Recordings stalled now",
         snapshotSection: null
       },
+      {
+        id: "device-attention",
+        family: "device-events",
+        label: "Device needs attention (raised / resolved)",
+        bad: ["device-attention-required"],
+        recovery: ["device-attention-resolved"],
+        snapshotLabel: "Devices needing attention now",
+        snapshotSection: null
+      },
       {
         id: "node-connectivity",
         family: "system",
@@ -407035,8 +407323,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.AlertStatusSchema = AlertStatusSchema;
     exports.AmbientLightSensorStatusSchema = AmbientLightSensorStatusSchema;
     exports.AnalyticsLtsSeriesSchema = AnalyticsLtsSeriesSchema;
-    exports.ApiKeyRecordSchema = ApiKeyRecordSchema;
-    exports.ApiKeySummarySchema = ApiKeySummarySchema;
     exports.AppFlowPurposeSchema = AppFlowPurposeSchema;
     exports.AppLoginPathSchema = AppLoginPathSchema;
     exports.AppPageLangSchema = AppPageLangSchema;
@@ -408423,6 +408709,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.RecordSecretRefsSchema = RecordSecretRefsSchema;
     exports.RecordSecretUnavailableError = require_sleep.RecordSecretUnavailableError;
     exports.RecordTooLargeError = require_sleep.RecordTooLargeError;
+    exports.RecordTransactOpSchema = RecordTransactOpSchema;
     exports.RecordTriggerSchema = RecordTriggerSchema;
     exports.RecordUniqueViolationError = require_sleep.RecordUniqueViolationError;
     exports.RecordViewSchema = RecordViewSchema;
@@ -408692,6 +408979,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.StorageTableSchema = StorageTableSchema;
     exports.StorageTestLocationResultSchema = TestLocationResultSchema;
     exports.StorageWriteChunkInputSchema = WriteChunkInputSchema;
+    exports.StoredRecordKindDeclarationSchema = require_sleep.StoredRecordKindDeclarationSchema;
     exports.StreamCodecSchema = StreamCodecSchema;
     exports.StreamFormatSchema = StreamFormatSchema;
     exports.StreamNetworkStatsSchema = StreamNetworkStatsSchema;
@@ -408798,6 +409086,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.TrainingResultSchema = TrainingResultSchema;
     exports.TrainingSplitPlanSchema = TrainingSplitPlanSchema;
     exports.TrainingStageSchema = TrainingStageSchema;
+    exports.TransactRefusedError = require_sleep.TransactRefusedError;
     exports.TransportPlaneCountsSchema = TransportPlaneCountsSchema;
     exports.TransportPlaneSchema = TransportPlaneSchema;
     exports.TurnServerSchema = TurnServerSchema;
@@ -408932,6 +409221,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.asRecordsError = require_sleep.asRecordsError;
     exports.asString = require_sleep.asString;
     exports.assertTimelapseCadences = assertTimelapseCadences;
+    exports.assertTransactScope = require_sleep.assertTransactScope;
     exports.assertValidDeclaration = require_sleep.assertValidDeclaration;
     exports.assignNodeColorId = require_node_color2.assignNodeColorId;
     exports.audioAnalysisCapability = audioAnalysisCapability;
@@ -409129,6 +409419,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.detectionPipelineCapability = detectionPipelineCapability;
     exports.deviceAdminLinkCapability = deviceAdminLinkCapability;
     exports.deviceAdoptionCapability = deviceAdoptionCapability;
+    exports.deviceAttentionKind = deviceAttentionKind;
     exports.deviceBackendToFormat = deviceBackendToFormat;
     exports.deviceCredentialsCapability = deviceCredentialsCapability;
     exports.deviceCustomAction = require_sleep.deviceCustomAction;
@@ -589765,6 +590056,7 @@ var require_addon_registry_service = __commonJS({
           histogram: (input) => provider().histogram(as(input)),
           aggregate: (input) => provider().aggregate(as(input)),
           deleteWhere: (input) => provider().deleteWhere(as(input)),
+          transact: (input) => provider().transact(as(input)),
           deleteDevice: (input) => provider().deleteDevice(as(input)),
           allocateId: (input) => provider().allocateId(as(input))
         };