@attraccess/plugin-wago 0.1.0-nightly.1089.1 → 0.1.0-nightly.1106.2

package/dist/index.js

@@ -957,10 +957,10 @@ function sameRuntimeImage(left, right) {
   const digest = left.image.split("@")[1];
   return Boolean(digest) && digest === right.image.split("@")[1];
 }
-var import_common11, import_node_path, WagoBuildRuntimeCatalog;
+var import_common12, import_node_path, WagoBuildRuntimeCatalog;
 var init_build = __esm({
   "backend/runtime/artifacts/build.ts"() {
-    import_common11 = require("@nestjs/common");
+    import_common12 = require("@nestjs/common");
     import_node_path = require("node:path");
     init_catalog();
     init_verification();
@@ -976,7 +976,7 @@ var init_build = __esm({
       }
       async import(upload) {
         for (const stream of Object.values(upload)) stream.destroy();
-        throw new import_common11.ConflictException("The deployed server build owns the CC100 runtime. Deploy a new build to change it.");
+        throw new import_common12.ConflictException("The deployed server build owns the CC100 runtime. Deploy a new build to change it.");
       }
       current() {
         if (!this.build) {
@@ -992,7 +992,7 @@ var init_build = __esm({
       }
       async acquire(digest) {
         const build = await this.current();
-        if (digest && digest !== build.digest) throw new import_common11.ConflictException("Runtime does not belong to this server build.");
+        if (digest && digest !== build.digest) throw new import_common12.ConflictException("Runtime does not belong to this server build.");
         return Object.freeze({ ...await super.acquire(build.digest), ...build });
       }
       async loadBuild() {
@@ -1097,7 +1097,7 @@ async function writeArtifactStream(path, source, limit) {
         write(chunk, _encoding, callback) {
           bytes += chunk.length;
           if (bytes > limit) {
-            callback(new import_common12.BadRequestException("Runtime artifact upload exceeds the size limit"));
+            callback(new import_common13.BadRequestException("Runtime artifact upload exceeds the size limit"));
             return;
           }
           const write = async () => {
@@ -1115,10 +1115,10 @@ async function writeArtifactStream(path, source, limit) {
   }
   return bytes;
 }
-var import_common12, import_node_crypto9, import_node_fs, import_promises, import_node_os, import_node_path2, import_node_stream, import_promises2, digestPattern, hostId, processId, uuidPattern, temporaryPattern, WagoRuntimeArtifactCatalog, WagoRuntimeArtifactsService;
+var import_common13, import_node_crypto9, import_node_fs, import_promises, import_node_os, import_node_path2, import_node_stream, import_promises2, digestPattern, hostId, processId, uuidPattern, temporaryPattern, WagoRuntimeArtifactCatalog, WagoRuntimeArtifactsService;
 var init_catalog = __esm({
   "backend/runtime/artifacts/catalog.ts"() {
-    import_common12 = require("@nestjs/common");
+    import_common13 = require("@nestjs/common");
     import_node_crypto9 = require("node:crypto");
     import_node_fs = require("node:fs");
     import_promises = __toESM(require("node:fs/promises"));
@@ -1147,7 +1147,7 @@ var init_catalog = __esm({
       async acquire(digest) {
         const selected = digest ?? (await this.current())?.digest;
         if (!selected || !digestPattern.test(selected))
-          throw new import_common12.ConflictException("Import a verified runtime release first");
+          throw new import_common13.ConflictException("Import a verified runtime release first");
         const root = await this.root();
         await this.verifiedMetadata(root, selected);
         const directory = await this.createTemporaryDirectory((0, import_node_path2.join)(root, "snapshots"), "delivery");
@@ -1191,7 +1191,7 @@ var init_catalog = __esm({
         return result;
       }
       async get(digest) {
-        if (!digestPattern.test(digest)) throw new import_common12.ConflictException("Select a verified runtime release.");
+        if (!digestPattern.test(digest)) throw new import_common13.ConflictException("Select a verified runtime release.");
         return this.verifiedMetadata(await this.root(), digest);
       }
       async current() {
@@ -1209,7 +1209,7 @@ var init_catalog = __esm({
       async ingest(upload, publish) {
         if (this.activeImports >= 2) {
           for (const source of Object.values(upload)) source.destroy();
-          throw new import_common12.ConflictException("Another runtime import is in progress; retry shortly");
+          throw new import_common13.ConflictException("Another runtime import is in progress; retry shortly");
         }
         this.activeImports++;
         let directory;
@@ -1266,8 +1266,8 @@ var init_catalog = __esm({
           }
           return metadata2;
         } catch (error) {
-          if (error instanceof import_common12.ConflictException) throw error;
-          throw new import_common12.BadRequestException(
+          if (error instanceof import_common13.ConflictException) throw error;
+          throw new import_common13.BadRequestException(
             "Runtime import failed. Check the release files, size, and manifest compatibility."
           );
         } finally {
@@ -1456,16 +1456,16 @@ var init_catalog = __esm({
         return current ? [current] : [];
       }
       async acquire(digest) {
-        if (!await this.current()) throw new import_common12.ConflictException("Build and install the bundled CC100 runtime first.");
+        if (!await this.current()) throw new import_common13.ConflictException("Build and install the bundled CC100 runtime first.");
         return (await this.buildCatalog()).acquire(digest);
       }
       async import(upload) {
         for (const stream of Object.values(upload)) stream.destroy();
-        throw new import_common12.ConflictException("The server build owns the CC100 runtime. Custom runtime imports are not supported.");
+        throw new import_common13.ConflictException("The server build owns the CC100 runtime. Custom runtime imports are not supported.");
       }
     };
     WagoRuntimeArtifactsService = __decorateClass([
-      (0, import_common12.Injectable)()
+      (0, import_common13.Injectable)()
     ], WagoRuntimeArtifactsService);
   }
 });
@@ -1479,7 +1479,7 @@ module.exports = __toCommonJS(plugin_exports);
 
 // backend/controllers/controller.ts
 var import_plugins_backend_sdk16 = require("@attraccess/plugins-backend-sdk");
-var import_common30 = require("@nestjs/common");
+var import_common31 = require("@nestjs/common");
 
 // backend/audit/index.ts
 var import_common = require("@nestjs/common");
@@ -1542,6 +1542,17 @@ function parseMeasurement(value) {
   };
 }
 
+// modbus/channel-enabled.ts
+var DISABLEABLE_CAPABILITIES = /* @__PURE__ */ new Set(["input", "measurement"]);
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function canDisableChannel(capabilities, point) {
+  const list = [...capabilities];
+  const binding = isRecord(point) && isRecord(point.modbus) ? point.modbus : void 0;
+  return Boolean(
+    isRecord(point) && point.hardwareProfile === "modbus" && binding && typeof binding.measurementId === "string" && binding.measurementId && binding.actionId === void 0 && list.length && list.every((capability) => typeof capability === "string" && DISABLEABLE_CAPABILITIES.has(capability))
+  );
+}
+
 // modbus/model.ts
 var import_ipaddr = __toESM(require_ipaddr());
 
@@ -1695,6 +1706,19 @@ var base = {
 };
 var field = (id, name, address, unit, section, scale = 1, kind = "live") => ({ ...base, id, name, address, unit, section, scale, kind });
 var information = (id, name, address, dataType = "uint16", extra = {}) => ({ ...field(id, name, address, "number", "information"), dataType, ...extra });
+var WAGO_879_3020_DEFAULT_ENABLED = Object.freeze([
+  "active-power",
+  "import-energy",
+  "export-energy",
+  "voltage-l1",
+  "voltage-l2",
+  "voltage-l3",
+  "current-l1",
+  "current-l2",
+  "current-l3",
+  "frequency",
+  "current"
+]);
 function wago8793020Measurements() {
   const original = [
     field("active-power", "Active power", 20498, "watt", "electrical", 1e3),
@@ -2132,18 +2156,40 @@ function isNullableString(value) {
 function operationalWildcardTopic(prefix) {
   return `${normalizeOperationalPrefix(prefix)}/v${CONFIGURATION_PROTOCOL_VERSION}/controllers/+/#`;
 }
-function parseObject(payload, label) {
-  let value;
+var CONTROLLER_PAYLOAD_MAX_BYTES = 64 * 1024;
+var CONTROLLER_PAYLOAD_MAX_DEPTH = 8;
+function exceedsJsonDepth(text, maxDepth) {
+  let depth = 0;
+  let inString = false;
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (inString) {
+      if (char === "\\") index += 1;
+      else if (char === '"') inString = false;
+    } else if (char === '"') inString = true;
+    else if (char === "{" || char === "[") {
+      depth += 1;
+      if (depth > maxDepth) return true;
+    } else if (char === "}" || char === "]") depth -= 1;
+  }
+  return false;
+}
+function parseControllerJson(payload, label) {
+  if (payload.byteLength > CONTROLLER_PAYLOAD_MAX_BYTES) throw new Error(`${label} is too large`);
+  const text = payload.toString("utf8");
+  if (exceedsJsonDepth(text, CONTROLLER_PAYLOAD_MAX_DEPTH)) throw new Error(`${label} is nested too deeply`);
   try {
-    value = JSON.parse(payload.toString("utf8"));
+    return JSON.parse(text);
   } catch {
     throw new Error(`${label} is not valid JSON`);
   }
+}
+function parseObject(payload, label) {
+  const value = parseControllerJson(payload, label);
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
   return value;
 }
-function parseHeartbeat(payload) {
-  const input = parseObject(payload, "announcement");
+function heartbeatFromObject(input) {
   const required = ["hardwareId", "protocolVersion", "runtimeVersion"];
   for (const key of required)
     if (typeof input[key] !== "string" || !input[key].trim()) throw new Error(`announcement ${key} is required`);
@@ -2168,8 +2214,8 @@ function parseHeartbeat(payload) {
   };
 }
 function parseAnnouncement(payload) {
-  const heartbeat = parseHeartbeat(payload);
-  const input = JSON.parse(payload.toString("utf8"));
+  const input = parseObject(payload, "announcement");
+  const heartbeat = heartbeatFromObject(input);
   if (typeof input.pairingCode !== "string" || !input.pairingCode.trim())
     throw new Error("announcement pairingCode is required");
   return { ...heartbeat, pairingCode: input.pairingCode.trim() };
@@ -2367,6 +2413,7 @@ function validateFeedback(value, path, capabilities, currentChannelId, channelsB
       code: "invalid_feedback_channel",
       message: "feedback must reference a distinct input channel"
     });
+  if (feedbackChannel?.enabled === false) errors.push(disabledReferenceError(`${path}.channelId`));
   if (!["match", "inverse"].includes(value.expected))
     errors.push({ path: `${path}.expected`, code: "unsupported_value", message: "expected must be match or inverse" });
   if (!Number.isSafeInteger(value.timeoutMs) || value.timeoutMs <= 0)
@@ -2378,17 +2425,35 @@ function validateFeedback(value, path, capabilities, currentChannelId, channelsB
   if (!capabilities.has("feedback"))
     errors.push({ path, code: "unsupported_field", message: "feedback requires feedback capability" });
 }
-function validateGuard(value, path, capabilities, channelIds, errors) {
+function validateGuard(value, path, capabilities, channelIds, errors, disabledChannelIds = /* @__PURE__ */ new Set()) {
   if (value === void 0) return;
   if (!record(value, path, errors)) return;
   exactKeys(value, path, ["channelId", "when"], errors);
   if (typeof value.channelId !== "string" || !channelIds.has(value.channelId))
     errors.push(referenceError(`${path}.channelId`, "logical channel", value.channelId));
+  else if (disabledChannelIds.has(value.channelId)) errors.push(disabledReferenceError(`${path}.channelId`));
   if (!["on", "off"].includes(value.when))
     errors.push({ path: `${path}.when`, code: "unsupported_value", message: "when must be on or off" });
   if (!capabilities.has("guard"))
     errors.push({ path, code: "unsupported_field", message: "guard requires guard capability" });
 }
+function disabledReferenceError(path) {
+  return { path, code: "disabled_reference", message: "a guard or feedback cannot use a disabled channel" };
+}
+function validateEnabled(channel, path, capabilities, pointsById, errors) {
+  if (channel.enabled === void 0) return;
+  if (channel.enabled !== false) {
+    errors.push({ path: `${path}.enabled`, code: "invalid_enabled", message: "enabled must be false or omitted" });
+    return;
+  }
+  const point = typeof channel.physicalPointId === "string" ? pointsById.get(channel.physicalPointId) : void 0;
+  if (!canDisableChannel(capabilities, point))
+    errors.push({
+      path: `${path}.enabled`,
+      code: "invalid_enabled",
+      message: "only Modbus measurement channels without an action can be disabled"
+    });
+}
 function validateMeasurement(value, path, capabilities, errors) {
   if (value === void 0) return;
   if (!record(value, path, errors)) return;
@@ -2453,7 +2518,7 @@ function collection(value, path, errors) {
 function configurationHash(snapshot) {
   return (0, import_node_crypto.createHash)("sha256").update(canonicalSnapshot(snapshot)).digest("hex");
 }
-function isRecord(value) {
+function isRecord2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function diffValue(path, previous, current, changes) {
@@ -2464,7 +2529,7 @@ function diffValue(path, previous, current, changes) {
       diffValue(`${path}[${index}]`, previous[index], current[index], changes);
     return;
   }
-  if (isRecord(previous) && isRecord(current)) {
+  if (isRecord2(previous) && isRecord2(current)) {
     const keys = /* @__PURE__ */ new Set([...Object.keys(previous), ...Object.keys(current)]);
     for (const key of [...keys].sort()) diffValue(`${path}.${key}`, previous[key], current[key], changes);
     return;
@@ -2494,7 +2559,7 @@ function exactKeys(value, path, allowed, errors, optional = []) {
   );
 }
 function isConfigurationValidationError(value) {
-  return isRecord(value) && typeof value.path === "string" && Boolean(value.path.trim()) && typeof value.code === "string" && Boolean(value.code.trim()) && typeof value.message === "string" && Boolean(value.message.trim());
+  return isRecord2(value) && typeof value.path === "string" && Boolean(value.path.trim()) && typeof value.code === "string" && Boolean(value.code.trim()) && typeof value.message === "string" && Boolean(value.message.trim());
 }
 function parseConfigurationReport(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
@@ -2554,11 +2619,14 @@ function validateSnapshot(snapshot) {
   const pointIds = /* @__PURE__ */ new Set();
   const channelIds = /* @__PURE__ */ new Set();
   const channelsById = /* @__PURE__ */ new Map();
+  const pointsById = /* @__PURE__ */ new Map();
+  const disabledChannelIds = /* @__PURE__ */ new Set();
   points.forEach((point, index) => {
     const path = `physicalPoints[${index}]`;
     if (!record(point, path, errors)) return;
     exactKeys(point, path, ["id", "hardwareProfile", "channel", "modbus"], errors, ["modbus"]);
     addId(point.id, `${path}.id`, pointIds, errors);
+    if (typeof point.id === "string" && !pointsById.has(point.id)) pointsById.set(point.id, point);
     enumValue(point.hardwareProfile, `${path}.hardwareProfile`, HARDWARE_PROFILES, errors);
     if (typeof point.channel !== "number" || !Number.isSafeInteger(point.channel) || point.channel < 0)
       errors.push({
@@ -2572,6 +2640,7 @@ function validateSnapshot(snapshot) {
       const item = channel;
       addId(item.id, `logicalChannels[${index}].id`, channelIds, errors);
       if (typeof item.id === "string") channelsById.set(item.id, item);
+      if (typeof item.id === "string" && item.enabled === false) disabledChannelIds.add(item.id);
     }
   });
   channels.forEach((channel, index) => {
@@ -2585,6 +2654,7 @@ function validateSnapshot(snapshot) {
         "physicalPointId",
         "profile",
         "capabilities",
+        "enabled",
         "invert",
         "disconnectPolicy",
         "range",
@@ -2593,7 +2663,8 @@ function validateSnapshot(snapshot) {
         "feedback",
         "measurement"
       ],
-      errors
+      errors,
+      ["enabled"]
     );
     if (typeof channel.physicalPointId !== "string" || !pointIds.has(channel.physicalPointId))
       errors.push(referenceError(`${path}.physicalPointId`, "physical point", channel.physicalPointId));
@@ -2605,10 +2676,11 @@ function validateSnapshot(snapshot) {
         code: "invalid_invert",
         message: "invert requires a boolean and an input channel"
       });
+    validateEnabled(channel, path, capabilities, pointsById, errors);
     validateDisconnectPolicy(channel.disconnectPolicy, `${path}.disconnectPolicy`, errors);
     validateRange(channel.range, `${path}.range`, capabilities, errors);
     validatePulse(channel.pulse, `${path}.pulse`, capabilities, errors);
-    validateGuard(channel.guard, `${path}.guard`, capabilities, channelIds, errors);
+    validateGuard(channel.guard, `${path}.guard`, capabilities, channelIds, errors, disabledChannelIds);
     validateFeedback(channel.feedback, `${path}.feedback`, capabilities, channel.id, channelsById, errors);
     validateMeasurement(channel.measurement, `${path}.measurement`, capabilities, errors);
   });
@@ -2990,12 +3062,12 @@ function parseManagementInspection(output) {
 }
 
 // backend/commissioning/service.ts
-var import_common28 = require("@nestjs/common");
+var import_common29 = require("@nestjs/common");
 var import_promises9 = require("node:fs/promises");
 var import_plugins_backend_sdk14 = require("@attraccess/plugins-backend-sdk");
 
 // backend/controllers/service.ts
-var import_common9 = require("@nestjs/common");
+var import_common10 = require("@nestjs/common");
 
 // backend/controllers/model.ts
 var import_common3 = require("@nestjs/common");
@@ -3046,7 +3118,7 @@ function safeEqual(left, right) {
 }
 function isClaimAcknowledgement(payload, token) {
   try {
-    const value = JSON.parse(payload.toString("utf8"));
+    const value = parseObject(payload, "claim acknowledgement");
     return typeof value.acknowledgementToken === "string" && safeEqual(value.acknowledgementToken, token);
   } catch {
     return false;
@@ -3073,6 +3145,11 @@ var MqttSubscriptionError = class extends Error {
 var WagoCredentialOperationUncertainError = class extends import_common3.ConflictException {
 };
 
+// shared/capabilities.ts
+var BOUNDED_MESSAGES_CAPABILITY = "bounded-messages-v1";
+var DROP_REASONS = ["oversized", "overload"];
+var CHANNEL_ENABLED_CAPABILITY = "channel-enabled-v1";
+
 // shared/clock.ts
 var CONTROLLER_CLOCK_TOLERANCE_MS = 5e3;
 
@@ -3135,6 +3212,147 @@ function admitEnvelope(state, data, category, now) {
   return restart ? "restart" : "accepted";
 }
 
+// shared/configuration-limits.ts
+var CONFIGURATION_LIMIT_CODE = "configuration_limit_exceeded";
+var MAX_CONFIGURATION_BYTES = 1024 * 1024;
+var DESIRED_ENVELOPE_RESERVE_BYTES = 1024;
+var MAX_CONFIGURATION_DEPTH = 16;
+var MAX_IDENTIFIER_CHARS = 256;
+var MAX_CONFIGURATION_ITEMS = 2048;
+var MAX_ENABLED_CHANNELS = 256;
+var MAX_STATUS_REPORT_BYTES = 64 * 1024;
+var STATUS_ERROR_BUDGET_BYTES = 8 * 1024;
+var STATUS_FIXED_BYTES = 1024;
+var encoder = new TextEncoder();
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f]/;
+var IDENTIFIER_KEY = /^(?:id|[A-Za-z]*Id)$/;
+var byteLength = (value) => encoder.encode(JSON.stringify(value)).byteLength;
+function isRecord3(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function depthExceeds(root, max) {
+  const stack = [[root, 1]];
+  while (stack.length) {
+    const [value, depth] = stack.pop();
+    if (!value || typeof value !== "object") continue;
+    if (depth > max) return true;
+    for (const child of Array.isArray(value) ? value : Object.values(value)) stack.push([child, depth + 1]);
+  }
+  return false;
+}
+function identifierViolation(root) {
+  const stack = [[root, "$"]];
+  while (stack.length) {
+    const [value, path] = stack.pop();
+    if (Array.isArray(value)) value.forEach((item, index) => stack.push([item, `${path}[${index}]`]));
+    else if (isRecord3(value))
+      for (const [key, item] of Object.entries(value)) {
+        if (typeof item === "string" && IDENTIFIER_KEY.test(key)) {
+          if (item.length > MAX_IDENTIFIER_CHARS)
+            return { limit: "identifier", path: `${path}.${key}`, reason: "length", max: MAX_IDENTIFIER_CHARS };
+          if (CONTROL_CHARACTERS.test(item))
+            return { limit: "identifier", path: `${path}.${key}`, reason: "control", max: MAX_IDENTIFIER_CHARS };
+        }
+        stack.push([item, `${path}.${key}`]);
+      }
+  }
+  return void 0;
+}
+function channelEnabled(channel) {
+  return !isRecord3(channel) || channel.enabled !== false;
+}
+var capabilitiesOf = (channel) => Array.isArray(channel.capabilities) ? channel.capabilities : [];
+function worstCaseStatusReportBytes(snapshot) {
+  const pointIsModbus = /* @__PURE__ */ new Map();
+  for (const point of Array.isArray(snapshot.physicalPoints) ? snapshot.physicalPoints : [])
+    if (isRecord3(point) && typeof point.id === "string" && !pointIsModbus.has(point.id))
+      pointIsModbus.set(point.id, Boolean(point.modbus));
+  let total = STATUS_FIXED_BYTES + STATUS_ERROR_BUDGET_BYTES;
+  for (const channel of Array.isArray(snapshot.logicalChannels) ? snapshot.logicalChannels : []) {
+    if (!isRecord3(channel) || !channelEnabled(channel)) continue;
+    const capabilities = capabilitiesOf(channel);
+    const output = capabilities.includes("output");
+    const digitalInput = !output && capabilities.includes("input") && !(typeof channel.physicalPointId === "string" && pointIsModbus.get(channel.physicalPointId));
+    if (!output && !digitalInput) continue;
+    const id = typeof channel.id === "string" ? channel.id : "";
+    const idBytes = encoder.encode(JSON.stringify(id)).byteLength;
+    total += output ? (idBytes + 7) * 2 + idBytes + 1 : idBytes + 7;
+  }
+  return total;
+}
+function configurationLimitViolations(snapshot) {
+  const violations = [];
+  const bytes = (() => {
+    try {
+      return byteLength(snapshot) + DESIRED_ENVELOPE_RESERVE_BYTES;
+    } catch {
+      return Infinity;
+    }
+  })();
+  if (bytes > MAX_CONFIGURATION_BYTES) {
+    violations.push({ limit: "bytes", actual: bytes, max: MAX_CONFIGURATION_BYTES });
+    return violations;
+  }
+  if (depthExceeds(snapshot, MAX_CONFIGURATION_DEPTH)) {
+    violations.push({ limit: "depth", max: MAX_CONFIGURATION_DEPTH });
+    return violations;
+  }
+  const identifier3 = identifierViolation(snapshot);
+  if (identifier3) violations.push(identifier3);
+  if (isRecord3(snapshot)) {
+    for (const [limit, collection3] of [
+      ["points", snapshot.physicalPoints],
+      ["channels", snapshot.logicalChannels]
+    ])
+      if (Array.isArray(collection3) && collection3.length > MAX_CONFIGURATION_ITEMS)
+        violations.push({ limit, actual: collection3.length, max: MAX_CONFIGURATION_ITEMS });
+    if (Array.isArray(snapshot.logicalChannels)) {
+      const enabled = snapshot.logicalChannels.filter(channelEnabled).length;
+      if (enabled > MAX_ENABLED_CHANNELS)
+        violations.push({ limit: "enabled-channels", actual: enabled, max: MAX_ENABLED_CHANNELS });
+    }
+    const report = worstCaseStatusReportBytes(snapshot);
+    if (report > MAX_STATUS_REPORT_BYTES)
+      violations.push({ limit: "status-report", actual: report, max: MAX_STATUS_REPORT_BYTES });
+  }
+  return violations;
+}
+var CONFIGURATION_LIMIT_MESSAGES = {
+  bytes: "The configuration is too large to send to the controller (limit 1 MiB). Remove devices, channels or custom profiles.",
+  depth: "The configuration is nested deeper than 16 levels. Simplify custom profiles or remove nested settings.",
+  identifierLength: "An ID is longer than 256 characters. Shorten it.",
+  identifierControl: "An ID contains control characters such as line breaks or tabs. Remove them.",
+  points: "The configuration has more than 2048 physical points. Remove points or devices; each built-in 879-3020 meter adds 131.",
+  channels: "The configuration has more than 2048 channels. Remove channels or devices; each built-in 879-3020 meter adds 131 channels.",
+  enabledChannels: "More than 256 channels are enabled. Disable meter readings you do not need or remove channels; each built-in 879-3020 meter adds 131 channels, of which 11 are enabled by default.",
+  statusReport: "The controller status report could exceed 64 KiB with these digital and output channel IDs. Shorten those IDs or remove channels."
+};
+function describeConfigurationLimit(violation) {
+  switch (violation.limit) {
+    case "bytes":
+      return CONFIGURATION_LIMIT_MESSAGES.bytes;
+    case "depth":
+      return CONFIGURATION_LIMIT_MESSAGES.depth;
+    case "identifier":
+      return violation.reason === "length" ? CONFIGURATION_LIMIT_MESSAGES.identifierLength : CONFIGURATION_LIMIT_MESSAGES.identifierControl;
+    case "points":
+      return CONFIGURATION_LIMIT_MESSAGES.points;
+    case "channels":
+      return CONFIGURATION_LIMIT_MESSAGES.channels;
+    case "enabled-channels":
+      return CONFIGURATION_LIMIT_MESSAGES.enabledChannels;
+    case "status-report":
+      return CONFIGURATION_LIMIT_MESSAGES.statusReport;
+  }
+}
+function configurationLimitErrors(snapshot, rootPath = "snapshot") {
+  return configurationLimitViolations(snapshot).map((violation) => ({
+    path: violation.limit === "identifier" ? violation.path.replace(/^\$/, rootPath) : rootPath,
+    code: CONFIGURATION_LIMIT_CODE,
+    message: describeConfigurationLimit(violation)
+  }));
+}
+
 // backend/diagnostics/validation.ts
 var fields = new Set(
   "snapshot version physicalPoints logicalChannels id physicalPointId hardwareProfile channel profile capabilities disconnectPolicy mode timeoutMs range minimum maximum pulse durationMs guard channelId when feedback expected measurement unit scale offset".split(
@@ -3145,7 +3363,7 @@ var codes = new Set(
   "invalid_snapshot unsupported_version invalid_channel invalid_collection invalid_object unknown_field required_field invalid_id duplicate_id unsupported_value invalid_capabilities unsupported_capability duplicate_capability unsupported_field invalid_range invalid_duration invalid_measurement invalid_feedback_channel invalid_timeout missing_capability unknown_reference invalid_reference content_hash_mismatch revision_mismatch hardware_unavailable configuration_commit_failed".split(
     " "
   )
-);
+).add(CONFIGURATION_LIMIT_CODE);
 function safeValidationSummaries(value) {
   if (!Array.isArray(value)) return [];
   return value.slice(0, 50).map((item) => {
@@ -3161,6 +3379,18 @@ function safeValidationSummaries(value) {
 }
 
 // backend/diagnostics/store.ts
+function heartbeatDropCounts(data) {
+  const counts = data.dropCounts;
+  if (!Array.isArray(data.capabilities) || !data.capabilities.includes(BOUNDED_MESSAGES_CAPABILITY) || !counts || typeof counts !== "object" || Array.isArray(counts))
+    return void 0;
+  const result = {};
+  for (const reason of DROP_REASONS) {
+    const value = counts[reason];
+    if (!Number.isSafeInteger(value) || value < 0) return void 0;
+    result[reason] = value;
+  }
+  return result;
+}
 var faultCodes = /* @__PURE__ */ new Set([
   "measurement_read_failed",
   "device_write_failed",
@@ -3220,8 +3450,8 @@ var WagoDiagnosticsStore = class {
   applyEvents(id, state, kind, data, canonical, metadata2) {
     const { receivedAt } = metadata2;
     if (kind === "measurements" && identifier(data.channelId) && typeof data.value === "number" && Number.isFinite(data.value) && (canonical ? CANONICAL_UNITS : ["ampere", "volt", "watt", "percent"]).includes(data.unit)) {
-      const collection2 = canonical && data.kind === "cumulative" ? state.cumulativeMeasurements : state.measurements;
-      collection2[data.channelId] = {
+      const collection3 = canonical && data.kind === "cumulative" ? state.cumulativeMeasurements : state.measurements;
+      collection3[data.channelId] = {
         kind: "measurement",
         value: data.value,
         unit: data.unit,
@@ -3334,10 +3564,9 @@ var WagoDiagnosticsStore = class {
   }
   ingest(id, kind, payload) {
     this.prune();
-    if (payload.length > 65536) return false;
     let data;
     try {
-      data = JSON.parse(payload.toString("utf8"));
+      data = parseControllerJson(payload, "diagnostic message");
     } catch {
       return false;
     }
@@ -3350,7 +3579,7 @@ var WagoDiagnosticsStore = class {
     if (!this.controllers.has(id) && this.controllers.size >= MAX_CONTROLLERS && oldest === void 0) return false;
     if (!this.controllers.has(id) && this.controllers.size >= MAX_CONTROLLERS && oldest !== void 0)
       this.controllers.delete(oldest);
-    const state = this.read(id);
+    const state = this.working(id);
     if (!this.admitIncoming(id, state, kind, data, canonical)) return false;
     state.touched = this.now();
     const receivedAt = new Date(this.now()).toISOString();
@@ -3360,10 +3589,13 @@ var WagoDiagnosticsStore = class {
       streamId: canonical ? state.activeStream : null,
       sequence: canonical ? data.sequence : null
     };
-    if (kind === "heartbeat") state.heartbeatAt = canonical ? data.timestamp : receivedAt;
+    if (kind === "heartbeat") {
+      state.heartbeatAt = canonical ? data.timestamp : receivedAt;
+      state.dropCounts = heartbeatDropCounts(data);
+    }
     if (kind === "state") this.applyState(state, data, canonical, metadata2);
     this.applyEvents(id, state, kind, data, canonical, metadata2);
-    for (const collection2 of [
+    for (const collection3 of [
       state.cumulativeMeasurements,
       state.inputs,
       state.outputs,
@@ -3371,7 +3603,7 @@ var WagoDiagnosticsStore = class {
       state.faults,
       state.acknowledgements
     ]) {
-      while (Object.keys(collection2).length > MAX_CHANNELS) delete collection2[Object.keys(collection2)[0]];
+      while (Object.keys(collection3).length > MAX_CHANNELS) delete collection3[Object.keys(collection3)[0]];
     }
     state.events.push({ kind, receivedAt });
     state.events = state.events.slice(-50);
@@ -3405,10 +3637,18 @@ var WagoDiagnosticsStore = class {
     if (this.commands.size >= 1024 && oldest !== void 0) this.commands.delete(oldest);
     this.commands.set(id, { controllerId, channelId: channelId2, at: this.now() });
   }
+  /** The last heartbeat time without copying the whole diagnostics state, as `read(id).heartbeatAt`. */
+  heartbeatAt(id) {
+    this.prune();
+    return this.controllers.get(id)?.heartbeatAt;
+  }
   read(id) {
     this.prune();
     const state = this.controllers.get(id);
-    const copy = state ? JSON.parse(JSON.stringify(state)) : {
+    return this.retained(state ? JSON.parse(JSON.stringify(state)) : this.empty());
+  }
+  empty() {
+    return {
       touched: 0,
       inputs: {},
       outputs: {},
@@ -3419,6 +3659,20 @@ var WagoDiagnosticsStore = class {
       events: [],
       ...emptyStream()
     };
+  }
+  /**
+   * The copy `ingest` mutates and stores only once the message is admitted. It shares the immutable
+   * sample, fault and acknowledgement records with the stored state instead of deep-copying them on
+   * every message: those records are only ever replaced or deleted, never changed in place. Only the
+   * containers a message can change are copied, so a rejected message still leaves no trace.
+   */
+  working(id) {
+    const state = this.controllers.get(id);
+    if (!state) return this.retained(this.empty());
+    return this.retained({ ...state, retiredStreams: [...state.retiredStreams], watermarks: { ...state.watermarks } });
+  }
+  /** Copies the per-channel collections (shallowly) and drops everything past the retention window. */
+  retained(copy) {
     const cutoff = this.now() - RETENTION_MS;
     for (const field3 of [
       "inputs",
@@ -3430,7 +3684,7 @@ var WagoDiagnosticsStore = class {
     ]) {
       copy[field3] = Object.assign(/* @__PURE__ */ Object.create(null), copy[field3]);
     }
-    for (const collection2 of [
+    for (const collection3 of [
       copy.cumulativeMeasurements,
       copy.inputs,
       copy.outputs,
@@ -3438,8 +3692,8 @@ var WagoDiagnosticsStore = class {
       copy.faults,
       copy.acknowledgements
     ]) {
-      for (const key of Object.keys(collection2))
-        if (Date.parse(collection2[key].receivedAt) < cutoff) delete collection2[key];
+      for (const key of Object.keys(collection3))
+        if (Date.parse(collection3[key].receivedAt) < cutoff) delete collection3[key];
     }
     copy.events = copy.events.filter((event) => Date.parse(event.receivedAt) >= cutoff);
     if (copy.rejection && Date.parse(copy.rejection.receivedAt) < cutoff) delete copy.rejection;
@@ -3452,12 +3706,70 @@ var WagoDiagnosticsStore = class {
   }
 };
 
+// backend/configuration/channel-enabled.ts
+var import_common4 = require("@nestjs/common");
+var CHANNEL_ENABLED_UNSUPPORTED_CODE = "channel_enabled_unsupported";
+var CHANNEL_ENABLED_UNSUPPORTED_MESSAGE = "This configuration disables channels, but the CC100 runtime on this controller cannot disable channels. Update the CC100 runtime, or enable every channel before publishing.";
+var LEGACY_MAX_CONFIGURATION_ITEMS = 256;
+var LEGACY_RUNTIME_LIMIT_MESSAGES = {
+  points: "The CC100 runtime on this controller is older and accepts at most 256 physical points. Update the CC100 runtime to use the higher limits, or remove points or devices.",
+  channels: "The CC100 runtime on this controller is older and accepts at most 256 channels. Update the CC100 runtime to use the higher limits, or remove channels or devices.",
+  statusReport: "The CC100 runtime on this controller is older and counts every channel ID towards its 64 KiB status report. Update the CC100 runtime to use the higher limits, or shorten channel IDs or remove channels."
+};
+function controllerCapabilities(capabilities) {
+  if (Array.isArray(capabilities)) return capabilities;
+  try {
+    const parsed = JSON.parse(capabilities);
+    return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : [];
+  } catch {
+    return [];
+  }
+}
+var supportsChannelEnabled = (capabilities) => controllerCapabilities(capabilities).includes(CHANNEL_ENABLED_CAPABILITY);
+function collection2(snapshot, key) {
+  const value = snapshot && typeof snapshot === "object" ? snapshot[key] : void 0;
+  return Array.isArray(value) ? value : [];
+}
+function channelEnabledErrors(snapshot, capabilities) {
+  if (collection2(snapshot, "logicalChannels").every(channelEnabled) || supportsChannelEnabled(capabilities)) return [];
+  return [{ path: "$", code: CHANNEL_ENABLED_UNSUPPORTED_CODE, message: CHANNEL_ENABLED_UNSUPPORTED_MESSAGE }];
+}
+function legacyWorstCaseStatusReportBytes(snapshot) {
+  const encoder2 = new TextEncoder();
+  let total = STATUS_FIXED_BYTES + STATUS_ERROR_BUDGET_BYTES;
+  for (const channel of collection2(snapshot, "logicalChannels")) {
+    const id = channel && typeof channel === "object" && typeof channel.id === "string" ? channel.id : "";
+    const idBytes = encoder2.encode(JSON.stringify(id)).byteLength;
+    total += (idBytes + 7) * 2 + idBytes + 1;
+  }
+  return total;
+}
+function legacyRuntimeLimitErrors(snapshot, capabilities) {
+  if (supportsChannelEnabled(capabilities)) return [];
+  const error = (message) => ({ path: "$", code: CONFIGURATION_LIMIT_CODE, message });
+  const errors = [];
+  if (collection2(snapshot, "physicalPoints").length > LEGACY_MAX_CONFIGURATION_ITEMS)
+    errors.push(error(LEGACY_RUNTIME_LIMIT_MESSAGES.points));
+  if (collection2(snapshot, "logicalChannels").length > LEGACY_MAX_CONFIGURATION_ITEMS)
+    errors.push(error(LEGACY_RUNTIME_LIMIT_MESSAGES.channels));
+  if (legacyWorstCaseStatusReportBytes(snapshot) > MAX_STATUS_REPORT_BYTES)
+    errors.push(error(LEGACY_RUNTIME_LIMIT_MESSAGES.statusReport));
+  return errors;
+}
+function runtimeSupportErrors(snapshot, capabilities) {
+  return [...channelEnabledErrors(snapshot, capabilities), ...legacyRuntimeLimitErrors(snapshot, capabilities)];
+}
+function requireRuntimeSupport(snapshot, capabilities) {
+  const errors = runtimeSupportErrors(snapshot, capabilities);
+  if (errors.length) throw new import_common4.ConflictException({ message: errors[0].message, code: errors[0].code, errors });
+}
+
 // backend/controllers/enrollment.ts
-var import_common8 = require("@nestjs/common");
+var import_common9 = require("@nestjs/common");
 var import_node_crypto7 = require("node:crypto");
 
 // backend/configuration/revisions.ts
-var import_common7 = require("@nestjs/common");
+var import_common8 = require("@nestjs/common");
 
 // backend/configuration/flow-references.ts
 var import_plugins_backend_sdk = require("@attraccess/plugins-backend-sdk");
@@ -3485,6 +3797,10 @@ function editorMetadata(value) {
   return { names, presets };
 }
 function validateEditorSnapshot(snapshot) {
+  const limits2 = configurationLimitErrors(snapshot, "$");
+  return limits2.length ? limits2 : validateEditorModel(snapshot);
+}
+function validateEditorModel(snapshot) {
   const errors = validateSnapshot(snapshot);
   if (errors.length) return errors;
   const value = snapshot;
@@ -3583,6 +3899,8 @@ function selectPresetChanges(snapshot, application, paths, expectedHash) {
   if (errors.length) throw new Error(errors.map((error) => `${error.path}: ${error.message}`).join("; "));
   return candidate;
 }
+var CHANNEL_DISABLED_IMPACT_CODE = "channel_disabled";
+var CHANNEL_DISABLED_IMPACT_MESSAGE = "Channel disabled. Flows reading it will see it as unavailable.";
 function configurationImpacts(previous, current) {
   return (previous?.logicalChannels ?? []).flatMap((channel) => {
     const next = current.logicalChannels.find((item) => item.id === channel.id);
@@ -3590,6 +3908,8 @@ function configurationImpacts(previous, current) {
     const newPoint = current.physicalPoints.find((point) => point.id === next?.physicalPointId);
     if (next && configurationHash({ channel, point: oldPoint }) === configurationHash({ channel: next, point: newPoint }))
       return [];
+    if (next && next.enabled === false && channel.enabled !== false)
+      return [{ channelId: channel.id, code: CHANNEL_DISABLED_IMPACT_CODE, message: CHANNEL_DISABLED_IMPACT_MESSAGE }];
     return [
       {
         channelId: channel.id,
@@ -3626,7 +3946,7 @@ async function configurationFlowImpacts(context, controllerId, previous, current
 }
 
 // backend/configuration/drafts.ts
-var import_common6 = require("@nestjs/common");
+var import_common7 = require("@nestjs/common");
 
 // backend/controllers/settings.entity.ts
 var import_plugins_backend_sdk2 = require("@attraccess/plugins-backend-sdk");
@@ -3651,7 +3971,7 @@ WagoSettings = __decorateClass([
 ], WagoSettings);
 
 // backend/controllers/registry.ts
-var import_common5 = require("@nestjs/common");
+var import_common6 = require("@nestjs/common");
 
 // backend/controllers/entity.ts
 var import_plugins_backend_sdk3 = require("@attraccess/plugins-backend-sdk");
@@ -3829,6 +4149,7 @@ function channelLabel(config, channel, snapshot, names, text) {
     const terminal = DIGITAL_TERMINALS.find((item) => item.channel === point.channel)?.label;
     if (terminal && !channelName.includes(terminal)) channelName += ` \xB7 ${terminal}`;
   }
+  if (channel?.enabled === false) channelName += ` (${text("disabled, unavailable", "deaktiviert, nicht verf\xFCgbar")})`;
   return channelName;
 }
 function commandAction(config, channel, text) {
@@ -3981,7 +4302,7 @@ var WagoCommandHandler = class {
   acknowledge(controllerId, payload) {
     let acknowledgement;
     try {
-      acknowledgement = JSON.parse(payload.toString("utf8"));
+      acknowledgement = parseControllerJson(payload, "command acknowledgement");
     } catch {
       return;
     }
@@ -4346,7 +4667,7 @@ WagoConfigurationRevision = __decorateClass([
 ], WagoConfigurationRevision);
 
 // backend/controllers/state.ts
-var import_common4 = require("@nestjs/common");
+var import_common5 = require("@nestjs/common");
 var WagoServiceState = class {
   constructor(context) {
     __publicField(this, "context", context);
@@ -4374,7 +4695,7 @@ var WagoServiceState = class {
       claimedController: async (id) => {
         const controller = await this.claimedController(id);
         if (this.isRuntimeUpdateRequired(id))
-          throw new import_common4.ConflictException(
+          throw new import_common5.ConflictException(
             "Runtime update required; outputs are held in failsafe until the server runtime is installed"
           );
         return controller;
@@ -4392,7 +4713,7 @@ var WagoServiceState = class {
   }
 };
 WagoServiceState = __decorateClass([
-  __decorateParam(0, (0, import_common4.Inject)(PLUGIN_CONTEXT))
+  __decorateParam(0, (0, import_common5.Inject)(PLUGIN_CONTEXT))
 ], WagoServiceState);
 
 // backend/controllers/registry.ts
@@ -4402,7 +4723,7 @@ var WagoRegistry = class extends WagoServiceState {
   }
   async setSettings(serverId, operationalPrefix) {
     if (serverId !== void 0 && serverId !== null && !await this.context.getMqttServerConfig(serverId))
-      throw new import_common5.NotFoundException(`MQTT server ${serverId} not found`);
+      throw new import_common6.NotFoundException(`MQTT server ${serverId} not found`);
     const save = async () => {
       const settings2 = await this.getSettings();
       if (serverId !== void 0) settings2.defaultMqttServerId = serverId;
@@ -4411,7 +4732,7 @@ var WagoRegistry = class extends WagoServiceState {
         if (normalizedPrefix !== settings2.operationalPrefix) {
           const controllers = await this.controllers.find({ where: { trustState: "claimed" } });
           if (controllers.length)
-            throw new import_common5.ConflictException("operational MQTT prefix cannot change after a controller has been claimed");
+            throw new import_common6.ConflictException("operational MQTT prefix cannot change after a controller has been claimed");
           settings2.operationalPrefix = normalizedPrefix;
         }
       }
@@ -4444,7 +4765,13 @@ var WagoRegistry = class extends WagoServiceState {
       { qos: 1, retain: false }
     );
     const [revision2] = await this.revisions.find({ where: { controllerId }, order: { revision: "DESC" }, take: 1 });
-    if (revision2 && (revision2.state === "published" || revision2.state === "applied"))
+    const replay = revision2 && (revision2.state === "published" || revision2.state === "applied") ? revision2 : null;
+    const unsupported = replay ? runtimeSupportErrors(JSON.parse(replay.snapshot), controller.capabilities) : [];
+    if (replay && unsupported.length)
+      this.context.logger.warn(
+        `Not replaying WAGO configuration revision ${replay.revision} to controller ${controllerId}: ${unsupported[0].message}`
+      );
+    else if (replay)
       await this.context.mqtt.publish(
         controller.mqttServerId,
         topic,
@@ -4452,9 +4779,9 @@ var WagoRegistry = class extends WagoServiceState {
           protocolVersion: CONFIGURATION_PROTOCOL_VERSION,
           runtimeImageId: desired,
           runtimePolicyToken,
-          revision: revision2.revision,
-          contentHash: revision2.contentHash,
-          snapshot: JSON.parse(revision2.snapshot)
+          revision: replay.revision,
+          contentHash: replay.contentHash,
+          snapshot: JSON.parse(replay.snapshot)
         }),
         { qos: 1, retain: true }
       );
@@ -4487,7 +4814,7 @@ var WagoRegistry = class extends WagoServiceState {
       runtimeVersion: controller.runtimeVersion,
       capabilities: controller.capabilities,
       lastSequence: controller.lastSequence,
-      lastHeartbeatAt: this.diagnostics.read(controller.id).heartbeatAt ?? controller.lastHeartbeatAt,
+      lastHeartbeatAt: this.diagnostics.heartbeatAt(controller.id) ?? controller.lastHeartbeatAt,
       lastSeenAt: controller.lastSeenAt,
       compatibilityError: controller.compatibilityError,
       createdAt: controller.createdAt,
@@ -4504,12 +4831,12 @@ var WagoRegistry = class extends WagoServiceState {
   async manualCommand(controllerId, input, principal) {
     const keys = ["channelId", "action", "value", "expectedConfigurationRevision", "acknowledgementTimeoutSeconds"];
     if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).some((key) => !keys.includes(key)))
-      throw new import_common5.BadRequestException("Invalid manual command");
+      throw new import_common6.BadRequestException("Invalid manual command");
     if (typeof input.channelId !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(input.channelId))
-      throw new import_common5.BadRequestException("Invalid Logical Channel");
+      throw new import_common6.BadRequestException("Invalid Logical Channel");
     const config = { ...input, controllerId, completionBehavior: "acknowledged" };
     const errors = await this.commands.validate(config, /* @__PURE__ */ new Map(), true);
-    if (errors.length) throw new import_common5.BadRequestException("Manual command does not match the applied configuration");
+    if (errors.length) throw new import_common6.BadRequestException("Manual command does not match the applied configuration");
     const commandId = (0, import_node_crypto6.randomUUID)();
     const details = { commandId, channelId: input.channelId, operation: input.action };
     const lifecycle = new WagoAudit(this.context).begin(principal, controllerId, "manual_command", details);
@@ -4572,7 +4899,7 @@ var WagoRegistry = class extends WagoServiceState {
   async refreshNetworkConnection(controllerId) {
     const controller = await this.claimedController(controllerId), settings = await this.getSettings();
     const serverId = controller.mqttServerId;
-    if (!serverId) throw new import_common5.ConflictException("Controller MQTT server is unavailable");
+    if (!serverId) throw new import_common6.ConflictException("Controller MQTT server is unavailable");
     const subscriptions = [];
     let retained;
     const active2 = () => !this.destroyed && this.networkSubscriptions.get(controllerId) === subscriptions;
@@ -4656,12 +4983,12 @@ var WagoDrafts = class extends WagoRegistry {
       const draft = await this.draftForPreset(controllerId);
       const snapshot = JSON.parse(draft.snapshot);
       if (previewedDraftHash !== configurationHash(snapshot))
-        throw new import_common6.ConflictException("selected preset changes no longer match the configuration draft");
+        throw new import_common7.ConflictException("selected preset changes no longer match the configuration draft");
       const candidate = applyPreset(snapshot, application);
       const diff = configurationDiff(snapshot, candidate);
       const validPaths = new Set(diff.map((change) => change.path));
       if (!Array.isArray(selectedPaths) || selectedPaths.some((path) => !validPaths.has(path)))
-        throw new import_common6.ConflictException("selected preset changes no longer match the configuration draft");
+        throw new import_common7.ConflictException("selected preset changes no longer match the configuration draft");
       const updatedSnapshot = applySelectedChanges(snapshot, diff, selectedPaths);
       if (configurationHash(updatedSnapshot) === configurationHash(snapshot)) return draft;
       const provenance = parsePresetProvenance(draft.presetProvenance);
@@ -4716,13 +5043,13 @@ var WagoDrafts = class extends WagoRegistry {
   async draftForPreset(controllerId) {
     await this.claimedController(controllerId);
     const draft = await this.drafts.findOneBy({ controllerId });
-    if (!draft) throw new import_common6.NotFoundException(`WAGO controller ${controllerId} has no configuration draft`);
+    if (!draft) throw new import_common7.NotFoundException(`WAGO controller ${controllerId} has no configuration draft`);
     return draft;
   }
   async validateDraft(controllerId, snapshot) {
     const draft = await this.getDraft(controllerId);
     if (!draft && snapshot === void 0)
-      throw new import_common6.NotFoundException(`WAGO controller ${controllerId} has no configuration draft`);
+      throw new import_common7.NotFoundException(`WAGO controller ${controllerId} has no configuration draft`);
     const errors = validateEditorSnapshot(snapshot === void 0 && draft ? JSON.parse(draft.snapshot) : snapshot);
     return { valid: errors.length === 0, errors };
   }
@@ -4732,7 +5059,7 @@ var WagoDrafts = class extends WagoRegistry {
     try {
       return previewConfigurationPreset(source, application);
     } catch (error) {
-      throw new import_common6.BadRequestException(error instanceof Error ? error.message : "invalid preset");
+      throw new import_common7.BadRequestException(error instanceof Error ? error.message : "invalid preset");
     }
   }
   presets() {
@@ -4742,7 +5069,7 @@ var WagoDrafts = class extends WagoRegistry {
     return this.withConfigurationLock(controllerId, async () => {
       const previous = await this.getDraft(controllerId);
       if (expectedDraft !== void 0 && (expectedDraft === null ? previous !== null : !previous || expectedDraft.snapshot !== previous.snapshot || expectedDraft.updatedAt !== previous.updatedAt || expectedDraft.presetProvenance !== previous.presetProvenance)) {
-        throw new import_common6.ConflictException("Saved draft changed. Reload it before saving your edits.");
+        throw new import_common7.ConflictException("Saved draft changed. Reload it before saving your edits.");
       }
       const validatedMetadata = metadata2 === void 0 ? void 0 : editorMetadata(metadata2);
       const previousMetadata = this.metadataFromProvenance(previous?.presetProvenance);
@@ -4836,10 +5163,11 @@ var WagoRevisions = class extends WagoDrafts {
     const controller = await this.claimedController(controllerId);
     this.requireConfigurationCompatibility(controller);
     const draft = preparedDraft ?? await this.drafts.findOneBy({ controllerId });
-    if (!draft) throw new import_common7.NotFoundException(`WAGO controller ${controllerId} has no configuration draft`);
+    if (!draft) throw new import_common8.NotFoundException(`WAGO controller ${controllerId} has no configuration draft`);
     const validation = validateEditorSnapshot(JSON.parse(draft.snapshot));
     if (validation.length)
-      throw new import_common7.ConflictException({ message: "configuration draft is invalid", errors: validation });
+      throw new import_common8.ConflictException({ message: "configuration draft is invalid", errors: validation });
+    requireRuntimeSupport(JSON.parse(draft.snapshot), controller.capabilities);
     const contentHash = configurationHash(JSON.parse(draft.snapshot));
     const previous = await this.latestRevision(controllerId);
     const impacts = await configurationFlowImpacts(
@@ -4850,11 +5178,11 @@ var WagoRevisions = class extends WagoDrafts {
     );
     const reviewIdentity = this.reviewIdentity(draft, previous, impacts);
     if (reviewedHash !== void 0 && reviewedHash !== reviewIdentity)
-      throw new import_common7.ConflictException("draft changed since your review; review it again");
+      throw new import_common8.ConflictException("draft changed since your review; review it again");
     if (draft.reviewedHash !== reviewIdentity)
-      throw new import_common7.ConflictException("review the current configuration draft before publishing it");
+      throw new import_common8.ConflictException("review the current configuration draft before publishing it");
     if (impacts.length && !force)
-      throw new import_common7.ConflictException({ message: "acknowledge potential flow impacts before publishing", impacts });
+      throw new import_common8.ConflictException({ message: "acknowledge potential flow impacts before publishing", impacts });
     let allocatedRevision;
     const dispatch = (revision2) => {
       allocatedRevision = revision2.revision;
@@ -4886,12 +5214,12 @@ var WagoRevisions = class extends WagoDrafts {
       protocolVersion: controller.protocolVersion,
       capabilities: JSON.parse(controller.capabilities)
     });
-    if (incompatibility) throw new import_common7.ConflictException(`Cannot publish configuration: ${incompatibility}`);
+    if (incompatibility) throw new import_common8.ConflictException(`Cannot publish configuration: ${incompatibility}`);
   }
   async reviewDraftWhileLocked(controllerId) {
     await this.claimedController(controllerId);
     const draft = await this.drafts.findOneBy({ controllerId });
-    if (!draft) throw new import_common7.NotFoundException(`WAGO controller ${controllerId} has no configuration draft`);
+    if (!draft) throw new import_common8.NotFoundException(`WAGO controller ${controllerId} has no configuration draft`);
     const previous = await this.latestRevision(controllerId);
     const impacts = await configurationFlowImpacts(
       this.context,
@@ -4922,7 +5250,7 @@ var WagoRevisions = class extends WagoDrafts {
       try {
         provenance = JSON.stringify({ editor: editorMetadata(metadata2) });
       } catch (error) {
-        throw new import_common7.BadRequestException(error instanceof Error ? error.message : "invalid editor metadata");
+        throw new import_common8.BadRequestException(error instanceof Error ? error.message : "invalid editor metadata");
       }
     }
     const serialized = canonicalSnapshot(snapshot);
@@ -4979,27 +5307,30 @@ var WagoRevisions = class extends WagoDrafts {
   }
   async previewRevision(controllerId, revision2) {
     return this.withConfigurationLock(controllerId, async () => {
-      await this.claimedController(controllerId);
+      const controller = await this.claimedController(controllerId);
       const selected = await this.revisions.findOneBy({ controllerId, revision: revision2 });
-      if (!selected) throw new import_common7.NotFoundException(`WAGO configuration revision ${revision2} not found`);
+      if (!selected) throw new import_common8.NotFoundException(`WAGO configuration revision ${revision2} not found`);
       const [current] = await this.revisions.find({ where: { controllerId }, order: { revision: "DESC" }, take: 1 });
       const draft = await this.drafts.findOneBy({ controllerId });
+      const snapshot = JSON.parse(selected.snapshot);
       const impacts = await configurationFlowImpacts(
         this.context,
         controllerId,
         current ? JSON.parse(current.snapshot) : null,
-        JSON.parse(selected.snapshot)
+        snapshot
       );
       return {
         draftHash: this.rollbackIdentity(draft, current ?? null, selected, impacts),
         impacts,
         revision: selected,
         current: current ?? null,
-        diff: configurationDiff(current ? JSON.parse(current.snapshot) : null, JSON.parse(selected.snapshot)),
+        diff: configurationDiff(current ? JSON.parse(current.snapshot) : null, snapshot),
         metadataDiff: configurationDiff(
           this.metadataFromProvenance(current?.presetProvenance),
           this.metadataFromProvenance(selected.presetProvenance)
-        )
+        ),
+        // The same checks `rollback` runs, so the editor can refuse the rollback before publishing.
+        errors: [...validateEditorSnapshot(snapshot), ...runtimeSupportErrors(snapshot, controller.capabilities)]
       };
     });
   }
@@ -5007,9 +5338,9 @@ var WagoRevisions = class extends WagoDrafts {
     return this.withConfigurationLock(controllerId, async () => {
       await this.claimedController(controllerId);
       const rejected = await this.revisions.findOneBy({ controllerId, revision: revision2 });
-      if (!rejected) throw new import_common7.NotFoundException(`WAGO configuration revision ${revision2} not found`);
+      if (!rejected) throw new import_common8.NotFoundException(`WAGO configuration revision ${revision2} not found`);
       if (rejected.state !== "rejected" || !rejected.reportedAt || expected.contentHash !== rejected.contentHash || expected.reportedAt !== rejected.reportedAt)
-        throw new import_common7.ConflictException("rejection changed; refresh and review it before acknowledging");
+        throw new import_common8.ConflictException("rejection changed; refresh and review it before acknowledging");
       if (rejected.rejectionAcknowledgedAt) return rejected;
       return new WagoAudit(this.context).run(
         principal,
@@ -5031,12 +5362,13 @@ var WagoRevisions = class extends WagoDrafts {
       const controller = await this.claimedController(controllerId);
       this.requireConfigurationCompatibility(controller);
       const source = await this.revisions.findOneBy({ controllerId, revision: revision2 });
-      if (!source) throw new import_common7.NotFoundException(`WAGO configuration revision ${revision2} not found`);
+      if (!source) throw new import_common8.NotFoundException(`WAGO configuration revision ${revision2} not found`);
       const current = await this.latestRevision(controllerId);
       const draft = await this.drafts.findOneBy({ controllerId });
       const snapshot = JSON.parse(source.snapshot);
       const errors = validateEditorSnapshot(snapshot);
-      if (errors.length) throw new import_common7.ConflictException({ message: "rollback configuration is invalid", errors });
+      if (errors.length) throw new import_common8.ConflictException({ message: "rollback configuration is invalid", errors });
+      requireRuntimeSupport(snapshot, controller.capabilities);
       const approvedImpacts = await configurationFlowImpacts(
         this.context,
         controllerId,
@@ -5045,11 +5377,11 @@ var WagoRevisions = class extends WagoDrafts {
       );
       const assertPreview = (impacts) => {
         if (draftHash !== this.rollbackIdentity(draft, current, source, impacts) || sourceHash !== source.contentHash || currentHash !== (current?.contentHash ?? null))
-          throw new import_common7.ConflictException("configuration changed since rollback preview; preview and confirm again");
+          throw new import_common8.ConflictException("configuration changed since rollback preview; preview and confirm again");
       };
       assertPreview(approvedImpacts);
       if (approvedImpacts.length && !force)
-        throw new import_common7.ConflictException({
+        throw new import_common8.ConflictException({
           message: "acknowledge potential flow impacts before publishing",
           impacts: approvedImpacts
         });
@@ -5109,7 +5441,7 @@ var WagoControllerEnrollment = class extends WagoRevisions {
   }, assertOwned = async () => void 0) {
     await assertOwned();
     const manual = await this.context.getMqttCredentialProvisioning().revoke({ mqttServerId, identity, username: identity, vhost: "/" });
-    if (manual) throw new import_common8.ConflictException("Manual permanent credential revocation is required.");
+    if (manual) throw new import_common9.ConflictException("Manual permanent credential revocation is required.");
     await assertOwned();
     controller.credentialMqttServerId = null;
     controller.credentialEpoch = null;
@@ -5141,32 +5473,32 @@ var WagoControllerEnrollment = class extends WagoRevisions {
   }
   async prepareClaim(id, name, verifier, mqttServerId, assertOwned = async () => void 0, manualCredentials) {
     const controller = await this.controllers.findOneBy({ id });
-    if (!controller) throw new import_common8.NotFoundException(`WAGO controller ${id} not found`);
-    if (controller.trustState === "claimed") throw new import_common8.ConflictException("controller has already been claimed");
-    if (!name.trim()) throw new import_common8.ConflictException("a controller name is required");
+    if (!controller) throw new import_common9.NotFoundException(`WAGO controller ${id} not found`);
+    if (controller.trustState === "claimed") throw new import_common9.ConflictException("controller has already been claimed");
+    if (!name.trim()) throw new import_common9.ConflictException("a controller name is required");
     if (!this.matchesVerifier(controller, verifier))
-      throw new import_common8.ConflictException("physical pairing code or fingerprint does not match the controller");
-    if (controller.compatibilityError) throw new import_common8.ConflictException(controller.compatibilityError);
+      throw new import_common9.ConflictException("physical pairing code or fingerprint does not match the controller");
+    if (controller.compatibilityError) throw new import_common9.ConflictException(controller.compatibilityError);
     const selectedServerId = mqttServerId ?? controller.mqttServerId;
-    if (!selectedServerId) throw new import_common8.ConflictException("select an MQTT server before claiming this controller");
+    if (!selectedServerId) throw new import_common9.ConflictException("select an MQTT server before claiming this controller");
     if (selectedServerId !== controller.mqttServerId)
-      throw new import_common8.ConflictException("claim the controller on the MQTT server used for its enrollment package");
+      throw new import_common9.ConflictException("claim the controller on the MQTT server used for its enrollment package");
     if (!await this.context.getMqttServerConfig(selectedServerId))
-      throw new import_common8.NotFoundException(`MQTT server ${selectedServerId} not found`);
+      throw new import_common9.NotFoundException(`MQTT server ${selectedServerId} not found`);
     const enrollment = await this.activeEnrollment(controller.enrollmentId);
     if (!enrollment)
-      throw new import_common8.ConflictException(
+      throw new import_common9.ConflictException(
         "the controller enrollment package has expired or was already consumed; create a new one"
       );
     const identity = `wago-controller-${controller.hardwareId}`;
     const settings = await this.getSettings();
     const namespace = normalizeOperationalPrefix(settings.operationalPrefix);
     if (manualCredentials && (await this.context.getMqttCredentialProvisioning().availableProviders(selectedServerId)).length)
-      throw new import_common8.ConflictException(
+      throw new import_common9.ConflictException(
         "This broker uses automatic credential provisioning; use the standard claim operation"
       );
     if (controller.credentialMqttServerId && (!manualCredentials || controller.credentialMqttServerId !== selectedServerId))
-      throw new import_common8.ConflictException(
+      throw new import_common9.ConflictException(
         "Remove the controller registration to revoke its unfinished permanent credential before claiming again."
       );
     await assertOwned();
@@ -5190,7 +5522,7 @@ var WagoControllerEnrollment = class extends WagoRevisions {
     });
     await assertOwned();
     const credential = "password" in provisioned ? provisioned : manualCredentials;
-    if (!credential) throw new import_common8.ConflictException("Manual credential provisioning is required");
+    if (!credential) throw new import_common9.ConflictException("Manual credential provisioning is required");
     const previousController = {
       trustState: controller.trustState,
       name: controller.name,
@@ -5285,19 +5617,19 @@ var WagoControllerEnrollment = class extends WagoRevisions {
   }
   async completeManualCredentials(id, input, principal, assertOwned = async () => void 0) {
     const controller = await this.controllers.findOneBy({ id });
-    if (!controller) throw new import_common8.NotFoundException("controller not found");
+    if (!controller) throw new import_common9.NotFoundException("controller not found");
     if (input.username !== `wago-controller-${controller.hardwareId}` || !input.password || input.password.length > 4096)
-      throw new import_common8.BadRequestException("Supply the controller identity and provisioned password");
+      throw new import_common9.BadRequestException("Supply the controller identity and provisioned password");
     if (!JSON.parse(controller.capabilities).includes("claim-expiry-v1"))
-      throw new import_common8.ConflictException("Install a runtime supporting expiring claims before manual credential fallback");
+      throw new import_common9.ConflictException("Install a runtime supporting expiring claims before manual credential fallback");
     return new WagoAudit(this.context).run(principal, id, "manual_credential_fallback", {}, async () => {
       let active2 = true;
       let dispatched = false;
       const expiresAt = new Date(Date.now() + 3e4).toISOString();
       const assertActive = async () => {
-        if (!active2) throw new import_common8.ConflictException("Controller credential operation ended");
+        if (!active2) throw new import_common9.ConflictException("Controller credential operation ended");
         await assertOwned();
-        if (!active2) throw new import_common8.ConflictException("Controller credential operation ended");
+        if (!active2) throw new import_common9.ConflictException("Controller credential operation ended");
       };
       let acknowledged;
       const receipt = new Promise((resolve2) => {
@@ -5308,7 +5640,7 @@ var WagoControllerEnrollment = class extends WagoRevisions {
         timer = setTimeout(() => {
           active2 = false;
           reject(
-            dispatched ? new WagoCredentialOperationUncertainError("Controller credential acknowledgement timed out") : new import_common8.ConflictException("Controller credential acknowledgement timed out")
+            dispatched ? new WagoCredentialOperationUncertainError("Controller credential acknowledgement timed out") : new import_common9.ConflictException("Controller credential acknowledgement timed out")
           );
         }, 3e4);
       });
@@ -5348,7 +5680,7 @@ var WagoControllerEnrollment = class extends WagoRevisions {
       id,
       () => this.withClaimConfigurationLock(async () => {
         const controller = await this.controllers.findOneBy({ id });
-        if (!controller) throw new import_common8.NotFoundException(`WAGO controller ${id} not found`);
+        if (!controller) throw new import_common9.NotFoundException(`WAGO controller ${id} not found`);
         const credentialServerId = controller.credentialMqttServerId ?? (controller.trustState === "claimed" ? controller.mqttServerId : null);
         if (credentialServerId) {
           const identity = `wago-controller-${controller.hardwareId}`;
@@ -5360,7 +5692,7 @@ var WagoControllerEnrollment = class extends WagoRevisions {
             vhost: "/"
           });
           if (manual)
-            throw new import_common8.ConflictException(`Manual credential revocation is required: ${manual.instructions.join(" ")}`);
+            throw new import_common9.ConflictException(`Manual credential revocation is required: ${manual.instructions.join(" ")}`);
         }
         if (controller.enrollmentId) await this.revokeEnrollmentById(controller.enrollmentId, assertOwned);
         await assertOwned();
@@ -5390,11 +5722,11 @@ var WagoControllerEnrollment = class extends WagoRevisions {
   async createEnrollment(hardwareId, mqttServerId, manualCredentials, assertOwned = async () => void 0) {
     const normalizedHardwareId = hardwareId.trim();
     if (!isValidHardwareId(normalizedHardwareId))
-      throw new import_common8.ConflictException("a valid hardware ID without MQTT separators or wildcards is required");
+      throw new import_common9.ConflictException("a valid hardware ID without MQTT separators or wildcards is required");
     const selectedServerId = mqttServerId ?? (await this.getSettings()).defaultMqttServerId;
-    if (!selectedServerId) throw new import_common8.ConflictException("select an MQTT server before creating an enrollment package");
+    if (!selectedServerId) throw new import_common9.ConflictException("select an MQTT server before creating an enrollment package");
     const server = await this.context.getMqttServerConfig(selectedServerId);
-    if (!server) throw new import_common8.NotFoundException(`MQTT server ${selectedServerId} not found`);
+    if (!server) throw new import_common9.NotFoundException(`MQTT server ${selectedServerId} not found`);
     const claimSecret = (0, import_node_crypto7.randomBytes)(24).toString("base64url");
     const identity = `wago-enrollment-${(0, import_node_crypto7.randomBytes)(8).toString("hex")}`;
     const expiresAt = new Date(Date.now() + 15 * 6e4).toISOString();
@@ -5427,13 +5759,13 @@ var WagoControllerEnrollment = class extends WagoRevisions {
       if (timer) clearTimeout(timer);
       this.enrollmentExpiryTimers.delete(enrollment.id);
       await this.enrollments.delete(enrollment.id);
-      throw new import_common8.ConflictException(
+      throw new import_common9.ConflictException(
         `Manual discovery credentials are required: ${provisionedCredential.instructions.join(" ")}`
       );
     }
     const credential = "password" in provisionedCredential ? provisionedCredential : manualCredentials;
     if (!credential?.username.trim() || !credential.password)
-      throw new import_common8.ConflictException("a manual discovery username and password are required");
+      throw new import_common9.ConflictException("a manual discovery username and password are required");
     await assertOwned();
     if (!("password" in provisionedCredential)) {
       enrollment.identity = credential.username;
@@ -5471,7 +5803,7 @@ var WagoSubscriptions = class extends WagoControllerEnrollment {
     const canTrackDiagnostics = this.diagnostics.canTrack(controller.id);
     const admitted = this.diagnostics.ingest(controller.id, "heartbeat", payload);
     if (canTrackDiagnostics && !admitted) return;
-    const heartbeatAt = admitted ? this.diagnostics.read(controller.id).heartbeatAt : typeof rawHeartbeat.timestamp === "string" ? rawHeartbeat.timestamp : void 0;
+    const heartbeatAt = admitted ? this.diagnostics.heartbeatAt(controller.id) : typeof rawHeartbeat.timestamp === "string" ? rawHeartbeat.timestamp : void 0;
     if (canonical && !acceptedCanonicalHeartbeat(rawHeartbeat, heartbeatAt, controller.lastHeartbeatAt)) return;
     if (canonical && (admitted || !canTrackDiagnostics))
       this.reportRuntimeStatus(controller.id, heartbeat, rawHeartbeat);
@@ -5481,9 +5813,10 @@ var WagoSubscriptions = class extends WagoControllerEnrollment {
   }
   /** Parse a heartbeat for the expected controller; malformed packets are ignored. */
   parseHeartbeatPayload(hardwareId, payload) {
-    let heartbeat;
+    let heartbeat, rawHeartbeat;
     try {
-      heartbeat = parseHeartbeat(payload);
+      rawHeartbeat = parseObject(payload, "announcement");
+      heartbeat = heartbeatFromObject(rawHeartbeat);
     } catch (error) {
       this.context.logger.warn(
         `Ignoring invalid WAGO heartbeat: ${error instanceof Error ? error.message : String(error)}`
@@ -5491,11 +5824,7 @@ var WagoSubscriptions = class extends WagoControllerEnrollment {
       return void 0;
     }
     if (heartbeat.hardwareId !== hardwareId) return void 0;
-    try {
-      return { heartbeat, rawHeartbeat: JSON.parse(payload.toString("utf8")) };
-    } catch {
-      return void 0;
-    }
+    return { heartbeat, rawHeartbeat };
   }
   reportRuntimeStatus(controllerId, heartbeat, rawHeartbeat) {
     if (typeof rawHeartbeat.streamId !== "string" || typeof rawHeartbeat.timestamp !== "string") return;
@@ -5790,8 +6119,8 @@ var WagoService = class extends WagoSubscriptions {
   async claimedController(id) {
     const controller = await this.controllers.findOneBy({ id });
     if (!controller || controller.trustState !== "claimed")
-      throw new import_common9.NotFoundException(`claimed WAGO controller ${id} not found`);
-    if (!controller.mqttServerId) throw new import_common9.ConflictException(`WAGO controller ${id} has no MQTT server`);
+      throw new import_common10.NotFoundException(`claimed WAGO controller ${id} not found`);
+    if (!controller.mqttServerId) throw new import_common10.ConflictException(`WAGO controller ${id} has no MQTT server`);
     return controller;
   }
   async withClaimConfigurationLock(operation) {
@@ -5838,7 +6167,7 @@ var WagoService = class extends WagoSubscriptions {
         vhost: "/"
       });
       if (manual)
-        throw new import_common9.ConflictException(`Manual credential revocation is required: ${manual.instructions.join(" ")}`);
+        throw new import_common10.ConflictException(`Manual credential revocation is required: ${manual.instructions.join(" ")}`);
       await assertOwned();
       enrollment.revokedAt = (/* @__PURE__ */ new Date()).toISOString();
       await this.enrollments.save(enrollment);
@@ -5904,7 +6233,7 @@ var WagoService = class extends WagoSubscriptions {
   }
   connectivity(controller) {
     if (controller.trustState === "untrusted") return "untrusted";
-    const heartbeatAt = this.diagnostics.read(controller.id).heartbeatAt ?? controller.lastHeartbeatAt;
+    const heartbeatAt = this.diagnostics.heartbeatAt(controller.id) ?? controller.lastHeartbeatAt;
     if (freshness(heartbeatAt, Date.now(), STALE_AFTER_MS) !== "fresh") return "stale";
     if (this.isRuntimeUpdateRequired(controller.id)) {
       const policy = this.runtimePolicies.get(controller.id);
@@ -5913,12 +6242,13 @@ var WagoService = class extends WagoSubscriptions {
     return "online";
   }
   async publishRevision(controller, revision2) {
-    if (!controller.mqttServerId) throw new import_common9.ConflictException(`WAGO controller ${controller.id} has no MQTT server`);
+    if (!controller.mqttServerId) throw new import_common10.ConflictException(`WAGO controller ${controller.id} has no MQTT server`);
     const incompatibility = compatibilityError({
       protocolVersion: controller.protocolVersion,
       capabilities: JSON.parse(controller.capabilities)
     });
-    if (incompatibility) throw new import_common9.ConflictException(`Cannot publish configuration: ${incompatibility}`);
+    if (incompatibility) throw new import_common10.ConflictException(`Cannot publish configuration: ${incompatibility}`);
+    requireRuntimeSupport(JSON.parse(revision2.snapshot), controller.capabilities);
     const settings = await this.getSettings();
     const runtimePolicy = this.runtimePolicies.get(controller.id);
     await this.context.mqtt.publish(
@@ -5939,13 +6269,11 @@ var WagoService = class extends WagoSubscriptions {
     revision2.state = "published";
     return this.revisions.save(revision2);
   }
+  /** Revision a queued report acknowledges; throws for a report outside the controller payload limits. */
   configurationReportRevision(payload) {
-    try {
-      const report = JSON.parse(payload.toString("utf8"));
-      return Number.isSafeInteger(report.revision) && report.revision >= 1 ? report.revision : null;
-    } catch {
-      return null;
-    }
+    const report = parseControllerJson(payload, "configuration report");
+    const revision2 = report && typeof report === "object" ? report.revision : void 0;
+    return Number.isSafeInteger(revision2) && revision2 >= 1 ? revision2 : null;
   }
   async processConfigurationReports(controllerId, payload, queue) {
     let next = payload;
@@ -5970,7 +6298,15 @@ var WagoService = class extends WagoSubscriptions {
     const queue = this.configurationReportQueues.get(controllerId) ?? { pending: /* @__PURE__ */ new Map(), processing: false };
     this.configurationReportQueues.set(controllerId, queue);
     if (queue.processing) {
-      const revision2 = this.configurationReportRevision(payload);
+      let revision2;
+      try {
+        revision2 = this.configurationReportRevision(payload);
+      } catch (error) {
+        this.context.logger.warn(
+          `Dropping invalid WAGO configuration report for controller ${controllerId}: ${error.message}`
+        );
+        return;
+      }
       const key = revision2 ?? Number.NaN;
       if (queue.pending.has(key) || queue.pending.size < MAX_PENDING_CONFIGURATION_REPORTS)
         queue.pending.set(key, payload);
@@ -5986,7 +6322,7 @@ var WagoService = class extends WagoSubscriptions {
   async onConfigurationReported(controllerId, payload) {
     let report;
     try {
-      report = parseConfigurationReport(JSON.parse(payload.toString("utf8")));
+      report = parseConfigurationReport(parseControllerJson(payload, "configuration report"));
     } catch {
       this.context.logger.warn(`Ignoring invalid WAGO configuration report for controller ${controllerId}`);
       return;
@@ -6040,32 +6376,32 @@ var WagoService = class extends WagoSubscriptions {
   }
 };
 WagoService = __decorateClass([
-  (0, import_common9.Injectable)(),
-  __decorateParam(0, (0, import_common9.Inject)(PLUGIN_CONTEXT))
+  (0, import_common10.Injectable)(),
+  __decorateParam(0, (0, import_common10.Inject)(PLUGIN_CONTEXT))
 ], WagoService);
 
 // backend/commissioning/delivery/preflight.ts
-var import_common10 = require("@nestjs/common");
+var import_common11 = require("@nestjs/common");
 var import_node_crypto8 = require("node:crypto");
 function assertCommissioningBroker(config, now = Date.now()) {
   if (!/^[a-zA-Z0-9.-]+$/.test(config.host) || !Number.isInteger(config.port) || config.port < 1 || config.port > 65535)
-    throw new import_common10.ConflictException("Configure a valid MQTT hostname and port before commissioning.");
+    throw new import_common11.ConflictException("Configure a valid MQTT hostname and port before commissioning.");
   if (!config.useTls || config.tlsInsecure) return;
   if (config.caCert == null) return;
   const certificates = config.caCert.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
   if (!certificates?.length || config.caCert.replace(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g, "").trim())
-    throw new import_common10.ConflictException("The MQTT private CA must contain PEM certificates only.");
+    throw new import_common11.ConflictException("The MQTT private CA must contain PEM certificates only.");
   for (const pem of certificates) {
     let certificate;
     try {
       certificate = new import_node_crypto8.X509Certificate(pem);
     } catch {
-      throw new import_common10.ConflictException("The MQTT private CA certificate is invalid. Import a valid PEM CA certificate.");
+      throw new import_common11.ConflictException("The MQTT private CA certificate is invalid. Import a valid PEM CA certificate.");
     }
     if (!certificate.ca)
-      throw new import_common10.ConflictException("The MQTT trust bundle must contain CA certificates, not server certificates.");
+      throw new import_common11.ConflictException("The MQTT trust bundle must contain CA certificates, not server certificates.");
     if (now < Date.parse(certificate.validFrom) || now > Date.parse(certificate.validTo))
-      throw new import_common10.ConflictException(
+      throw new import_common11.ConflictException(
         "The MQTT CA certificate is expired or not yet valid. Check the server clock and renew the CA."
       );
   }
@@ -6075,7 +6411,7 @@ function assertCommissioningBroker(config, now = Date.now()) {
 init_catalog();
 
 // backend/commissioning/readiness/readiness.ts
-var import_common13 = require("@nestjs/common");
+var import_common14 = require("@nestjs/common");
 var import_plugins_backend_sdk8 = require("@attraccess/plugins-backend-sdk");
 function isReadiness(value) {
   return !!value && typeof value === "object" && "configurationAccepted" in value && typeof value.configurationAccepted === "boolean" && "hardwareAvailable" in value && typeof value.hardwareAvailable === "boolean" && "ready" in value && typeof value.ready === "boolean";
@@ -6107,10 +6443,6 @@ var WagoCommissioningReadiness = class {
       const current = entry;
       void this.context.mqtt.subscribe(serverId, topic, (message) => {
         if (message.serverId !== serverId || message.topic !== topic) return;
-        if (message.payload.length > 65536) {
-          current.state = void 0;
-          return;
-        }
         try {
           const parsed = parseOperationalMessage(prefix, topic, message.payload);
           if (!parsed || parsed.hardwareId !== hardwareId || parsed.message.category !== "state") {
@@ -6120,7 +6452,7 @@ var WagoCommissioningReadiness = class {
           const event = parsed.message;
           const timestamp = Date.parse(event.timestamp);
           const now = Date.now();
-          const value = JSON.parse(message.payload.toString("utf8"));
+          const value = parseObject(message.payload, "readiness state");
           const readiness = value.readiness;
           if (timestamp > now + CONTROLLER_CLOCK_TOLERANCE_MS || event.contentHash !== null && !/^[a-f0-9]{64}$/i.test(event.contentHash) || !isReadiness(readiness)) {
             current.state = void 0;
@@ -6163,12 +6495,12 @@ var WagoCommissioningReadiness = class {
   }
 };
 WagoCommissioningReadiness = __decorateClass([
-  (0, import_common13.Injectable)(),
-  __decorateParam(0, (0, import_common13.Inject)(import_plugins_backend_sdk8.PLUGIN_CONTEXT))
+  (0, import_common14.Injectable)(),
+  __decorateParam(0, (0, import_common14.Inject)(import_plugins_backend_sdk8.PLUGIN_CONTEXT))
 ], WagoCommissioningReadiness);
 
 // backend/runtime/managed/service.ts
-var import_common18 = require("@nestjs/common");
+var import_common19 = require("@nestjs/common");
 var import_node_crypto17 = require("node:crypto");
 
 // backend/host/shell/stat.ts
@@ -9672,7 +10004,7 @@ function managedSetupFailure(stage, error, timedOut) {
 init_catalog();
 
 // backend/runtime/managed/reconciliation.ts
-var import_common17 = require("@nestjs/common");
+var import_common18 = require("@nestjs/common");
 
 // backend/commissioning/sessions/verification.ts
 async function commissioningVerification(context, session, runtime) {
@@ -9927,11 +10259,11 @@ async function managedSsh(access, privateKey, header, signal, file) {
 }
 
 // backend/runtime/managed/access.ts
-var import_common16 = require("@nestjs/common");
+var import_common17 = require("@nestjs/common");
 
 // backend/runtime/managed/enrollment.ts
 var import_node_crypto15 = require("node:crypto");
-var import_common15 = require("@nestjs/common");
+var import_common16 = require("@nestjs/common");
 
 // backend/network/entity.ts
 var import_plugins_backend_sdk9 = require("@attraccess/plugins-backend-sdk");
@@ -10230,7 +10562,7 @@ var WagoDeviceOperations = class {
 };
 
 // backend/runtime/managed/state.ts
-var import_common14 = require("@nestjs/common");
+var import_common15 = require("@nestjs/common");
 init_catalog();
 var WagoManagedRuntimeServiceState = class {
   constructor(context, wago, artifacts, readiness) {
@@ -10262,10 +10594,10 @@ var WagoManagedRuntimeServiceState = class {
   }
 };
 WagoManagedRuntimeServiceState = __decorateClass([
-  __decorateParam(0, (0, import_common14.Inject)(/* @__PURE__ */ Symbol.for("attraccess.plugin.context"))),
-  __decorateParam(1, (0, import_common14.Inject)(WagoService)),
-  __decorateParam(2, (0, import_common14.Inject)(WagoRuntimeArtifactsService)),
-  __decorateParam(3, (0, import_common14.Inject)(WagoCommissioningReadiness))
+  __decorateParam(0, (0, import_common15.Inject)(/* @__PURE__ */ Symbol.for("attraccess.plugin.context"))),
+  __decorateParam(1, (0, import_common15.Inject)(WagoService)),
+  __decorateParam(2, (0, import_common15.Inject)(WagoRuntimeArtifactsService)),
+  __decorateParam(3, (0, import_common15.Inject)(WagoCommissioningReadiness))
 ], WagoManagedRuntimeServiceState);
 
 // backend/runtime/managed/enrollment.ts
@@ -10328,21 +10660,21 @@ var WagoManagedRuntimeEnrollment = class extends WagoManagedRuntimeServiceState
     if (controllerId === null && !fingerprint2) return;
     const change = await this.context.getRepository(WagoNetworkChange).findOneBy(controllerId === null ? { fingerprint: fingerprint2 } : { controllerId });
     if (change && change.phase !== "completed")
-      throw new import_common15.ConflictException("Finish the pending MQTT/address change before another controller operation.");
+      throw new import_common16.ConflictException("Finish the pending MQTT/address change before another controller operation.");
   }
   async assertUpdateSettled(controllerId) {
     await this.assertNetworkSettled(controllerId);
     const row = await this.updates.findOneBy({ controllerId });
     const update = row?.metadata ? JSON.parse(row.metadata) : null;
-    if (update?.token) throw new import_common15.ConflictException("Finish runtime update recovery before removing this controller");
+    if (update?.token) throw new import_common16.ConflictException("Finish runtime update recovery before removing this controller");
   }
   async assertRemovable(controllerId) {
     await this.assertUpdateSettled(controllerId);
     if (await this.context.getRepository(WagoMqttCredentialRetirement).countBy({ controllerId }))
-      throw new import_common15.ConflictException("Retire previous broker credentials before removing this controller.");
+      throw new import_common16.ConflictException("Retire previous broker credentials before removing this controller.");
     const access = await this.access.findOne({ where: { controllerId }, order: { sessionId: "DESC" } });
     if (access && access.state !== "retired")
-      throw new import_common15.ConflictException("Restore bootstrap SSH and retire managed access before removing this controller");
+      throw new import_common16.ConflictException("Restore bootstrap SSH and retire managed access before removing this controller");
   }
   async retire(controllerId) {
     await this.assertRemovable(controllerId);
@@ -10351,7 +10683,7 @@ var WagoManagedRuntimeEnrollment = class extends WagoManagedRuntimeServiceState
   }
   async recoverPassword(sessionId, principal) {
     const access = await this.loadSession(sessionId);
-    if (!access) throw new import_common15.NotFoundException("Managed recovery credential not found");
+    if (!access) throw new import_common16.NotFoundException("Managed recovery credential not found");
     const operationId = (0, import_node_crypto15.randomUUID)();
     await this.securityAudit(sessionId, "root_recovery", principal, operationId, "attempted");
     try {
@@ -10438,7 +10770,7 @@ var WagoManagedRuntimeEnrollment = class extends WagoManagedRuntimeServiceState
     const desired = await this.desired();
     let access = await this.loadSession(session.id);
     if (access && (access.fingerprint !== session.hostKeyFingerprint || access.host !== session.targetHost || ["retiring", "retired"].includes(access.state)))
-      throw new import_common15.ConflictException("Managed identity changed; create a fresh enrolment session.");
+      throw new import_common16.ConflictException("Managed identity changed; create a fresh enrolment session.");
     if (!access) {
       const key = generateManagementKey();
       const credentials2 = {
@@ -10454,7 +10786,7 @@ var WagoManagedRuntimeEnrollment = class extends WagoManagedRuntimeServiceState
       const plaintext = JSON.stringify(credentials2);
       const encryptedCredentials = this.context.secrets.encrypt(plaintext);
       if (!encryptedCredentials || encryptedCredentials === plaintext || this.context.secrets.decrypt(encryptedCredentials) !== plaintext)
-        throw new import_common15.ConflictException("Managed credential encryption failed.");
+        throw new import_common16.ConflictException("Managed credential encryption failed.");
       access = await this.access.save(
         this.access.create({
           sessionId: session.id,
@@ -10469,11 +10801,11 @@ var WagoManagedRuntimeEnrollment = class extends WagoManagedRuntimeServiceState
       );
       key.privateKey = "";
       access = await this.loadSession(session.id);
-      if (!access) throw new import_common15.ConflictException("Managed credential storage verification failed.");
+      if (!access) throw new import_common16.ConflictException("Managed credential storage verification failed.");
     }
     const credentials = this.credentials(access);
     if (credentials.hardwareId !== session.hardwareId)
-      throw new import_common15.ConflictException("Managed credentials belong to another controller identity");
+      throw new import_common16.ConflictException("Managed credentials belong to another controller identity");
     let stage = "filesystem";
     try {
       if (access.state !== "verified" && access.state !== "managed") {
@@ -10508,7 +10840,7 @@ var WagoManagedRuntimeEnrollment = class extends WagoManagedRuntimeServiceState
     const access = await this.loadSession(sessionId);
     if (!access) return;
     if (access.state !== "verified" || access.controllerId !== null && access.controllerId !== controllerId)
-      throw new import_common15.ConflictException("Managed enrolment is not verified for this controller");
+      throw new import_common16.ConflictException("Managed enrolment is not verified for this controller");
     await this.access.update(sessionId, { controllerId });
   }
   registerRetirementProbe(probe) {
@@ -10612,7 +10944,7 @@ var WagoManagedRuntimeAccess = class extends WagoManagedRuntimeEnrollment {
       installerPublicKey(value.installerPrivateKey);
       return value;
     } catch {
-      throw new import_common16.ConflictException("Managed credential envelope is unavailable or does not match this device");
+      throw new import_common17.ConflictException("Managed credential envelope is unavailable or does not match this device");
     }
   }
   async required(controllerId) {
@@ -10635,29 +10967,29 @@ var WagoManagedRuntimeAccess = class extends WagoManagedRuntimeEnrollment {
   async retryRuntime(controllerId) {
     await this.required(controllerId);
     if (await this.coordinator.reconcile(controllerId, true) === "busy")
-      throw new import_common16.ConflictException("Controller is busy; retry after its current operation finishes");
+      throw new import_common17.ConflictException("Controller is busy; retry after its current operation finishes");
   }
   async setActiveState(sessionId, state) {
     const result = await this.access.createQueryBuilder().update().set({ state }).where("session_id = :sessionId AND state NOT IN (:...retired)", {
       sessionId,
       retired: ["retiring", "retired"]
     }).execute();
-    if (result.affected !== 1) throw new import_common16.ConflictException("Managed access is being retired");
+    if (result.affected !== 1) throw new import_common17.ConflictException("Managed access is being retired");
   }
   async retryAccess(sessionId) {
     let access = await this.loadSession(sessionId);
     if (!access || ["retiring", "retired"].includes(access.state))
-      throw new import_common16.ConflictException("Managed access cannot be retried");
+      throw new import_common17.ConflictException("Managed access cannot be retried");
     const fingerprint2 = access.fingerprint;
     const owner = (0, import_node_crypto16.randomBytes)(16).toString("hex");
     if (!await this.operations.acquire(access.fingerprint, owner, Date.now(), Date.now() + 6e4))
-      throw new import_common16.ConflictException("Controller is busy");
+      throw new import_common17.ConflictException("Controller is busy");
     const operation = new AbortController();
     const timer = setTimeout(() => operation.abort(), 5e4).unref();
     try {
       access = await this.loadSession(sessionId);
       if (!access || ["retiring", "retired"].includes(access.state))
-        throw new import_common16.ConflictException("Managed access cannot be retried");
+        throw new import_common17.ConflictException("Managed access cannot be retried");
       if (access.controllerId) await this.assertNetworkSettled(access.controllerId);
       await this.prove(access, operation.signal);
       const status = await this.connection(access, `access-status ${access.token}`, operation.signal);
@@ -10670,7 +11002,7 @@ var WagoManagedRuntimeAccess = class extends WagoManagedRuntimeEnrollment {
         await this.setActiveState(sessionId, "verified");
         await this.connection(access, `access-key-commit ${access.token}`, operation.signal);
         await this.prove(access, operation.signal);
-      } else throw new import_common16.ConflictException("Wait for the SSH-policy watchdog to restore access before retrying");
+      } else throw new import_common17.ConflictException("Wait for the SSH-policy watchdog to restore access before retrying");
     } finally {
       clearTimeout(timer);
       operation.abort();
@@ -10681,11 +11013,11 @@ var WagoManagedRuntimeAccess = class extends WagoManagedRuntimeEnrollment {
   async restoreAccess(sessionId, principal) {
     const access = await this.loadSession(sessionId);
     if (!access || !this.rootProbe || !this.retirementProbe)
-      throw new import_common16.NotFoundException("Managed recovery access not found");
+      throw new import_common17.NotFoundException("Managed recovery access not found");
     if (access.controllerId) await this.assertUpdateSettled(access.controllerId);
     const owner = (0, import_node_crypto16.randomBytes)(16).toString("hex");
     if (!await this.operations.acquire(access.fingerprint, owner, Date.now(), Date.now() + 6e4))
-      throw new import_common16.ConflictException("Controller is busy");
+      throw new import_common17.ConflictException("Controller is busy");
     const operation = new AbortController();
     const timer = setTimeout(() => operation.abort(), 5e4).unref();
     const operationId = (0, import_node_crypto16.randomUUID)();
@@ -10709,12 +11041,12 @@ var WagoManagedRuntimeAccess = class extends WagoManagedRuntimeEnrollment {
           await new Promise((resolve2) => setTimeout(resolve2, 1e3));
         }
         if (!restored)
-          throw new import_common16.ConflictException("Bootstrap SSH restoration is unverified; retry administrator recovery");
+          throw new import_common17.ConflictException("Bootstrap SSH restoration is unverified; retry administrator recovery");
         await this.operations.assertOwned(access.fingerprint, owner);
         await this.connection(access, `access-retire ${access.token}`, operation.signal).catch(() => void 0);
       }
       if (!await this.retirementProbe(access.host, access.fingerprint, password))
-        throw new import_common16.ConflictException("Managed key retirement is unverified; retry administrator recovery");
+        throw new import_common17.ConflictException("Managed key retirement is unverified; retry administrator recovery");
       await this.operations.assertOwned(access.fingerprint, owner);
       await this.access.update(sessionId, { state: "retired" });
       await this.securityAudit(sessionId, "security_recover", principal, operationId, "succeeded");
@@ -10739,7 +11071,7 @@ var WagoManagedRuntimeAccess = class extends WagoManagedRuntimeEnrollment {
     if (!access || !this.rootProbe || !["pending", "verified", "recovery_required"].includes(access.state)) return null;
     const credentials = this.credentials(access);
     if (access.host !== session.targetHost || access.fingerprint !== session.hostKeyFingerprint || credentials.hardwareId !== session.hardwareId)
-      throw new import_common16.ConflictException("Managed recovery identity changed; check the saved controller identity.");
+      throw new import_common17.ConflictException("Managed recovery identity changed; check the saved controller identity.");
     return await this.rootProbe(access.host, access.fingerprint, credentials.recoveryPassword) ? credentials.recoveryPassword : null;
   }
   async hasAccess(sessionId) {
@@ -10759,7 +11091,7 @@ var WagoManagedRuntimeReconciliation = class extends WagoManagedRuntimeAccess {
       details: {}
     });
     if (receipt.status !== "recorded")
-      throw new import_common17.ConflictException("Durable audit is required for managed SSH recovery and transitions");
+      throw new import_common18.ConflictException("Durable audit is required for managed SSH recovery and transitions");
   }
   async finishSession(id) {
     await this.sessions.update(id, {
@@ -11252,21 +11584,21 @@ var WagoManagedRuntimeService = class extends WagoManagedRuntimeReconciliation {
   }
 };
 WagoManagedRuntimeService = __decorateClass([
-  (0, import_common18.Injectable)(),
-  __decorateParam(0, (0, import_common18.Inject)(/* @__PURE__ */ Symbol.for("attraccess.plugin.context"))),
-  __decorateParam(1, (0, import_common18.Inject)(WagoService)),
-  __decorateParam(2, (0, import_common18.Inject)(WagoRuntimeArtifactsService)),
-  __decorateParam(3, (0, import_common18.Inject)(WagoCommissioningReadiness))
+  (0, import_common19.Injectable)(),
+  __decorateParam(0, (0, import_common19.Inject)(/* @__PURE__ */ Symbol.for("attraccess.plugin.context"))),
+  __decorateParam(1, (0, import_common19.Inject)(WagoService)),
+  __decorateParam(2, (0, import_common19.Inject)(WagoRuntimeArtifactsService)),
+  __decorateParam(3, (0, import_common19.Inject)(WagoCommissioningReadiness))
 ], WagoManagedRuntimeService);
 
 // backend/commissioning/model.ts
-var import_common19 = require("@nestjs/common");
+var import_common20 = require("@nestjs/common");
 function requireDeliveryCredentials(input) {
   if (input?.confirmInstall !== true)
-    throw new import_common19.ConflictException("explicit installation confirmation is required for every delivery attempt");
+    throw new import_common20.ConflictException("explicit installation confirmation is required for every delivery attempt");
   const credential = input.temporarySsh;
   if (!credential || typeof credential.username !== "string" || !/^[a-zA-Z_][a-zA-Z0-9_.-]{0,63}$/.test(credential.username) || typeof credential.password !== "string" || !credential.password.trim() || /[\r\n\0]/.test(credential.password))
-    throw new import_common19.ConflictException("explicit valid SSH username and password are required for every delivery attempt");
+    throw new import_common20.ConflictException("explicit valid SSH username and password are required for every delivery attempt");
   return credential;
 }
 var WagoStorageCapacityError = class extends Error {
@@ -11279,7 +11611,7 @@ var WagoControllerLockError = class extends Error {
     super("The CC100 is busy with a runtime operation. Retry installation shortly; no preparation was started.");
   }
 };
-var RuntimeReleaseChangedError = class extends import_common19.ConflictException {
+var RuntimeReleaseChangedError = class extends import_common20.ConflictException {
   constructor() {
     super(
       "The runtime release changed during delivery. Recover any retained installation and retry with the current release."
@@ -11556,7 +11888,7 @@ timeout -s KILL 10 /etc/config-tools/config_clock type=utc "time=$time" "date=$d
 }
 
 // backend/commissioning/sessions/lifecycle.ts
-var import_common27 = require("@nestjs/common");
+var import_common28 = require("@nestjs/common");
 
 // backend/commissioning/delivery/transport.ts
 var import_promises8 = require("node:fs/promises");
@@ -11564,7 +11896,7 @@ var import_node_os5 = require("node:os");
 var import_node_path6 = require("node:path");
 
 // backend/commissioning/delivery/host-identity.ts
-var import_common20 = require("@nestjs/common");
+var import_common21 = require("@nestjs/common");
 var import_promises4 = require("node:fs/promises");
 var import_node_os3 = require("node:os");
 var import_node_path4 = require("node:path");
@@ -11660,14 +11992,14 @@ function scanHostKeys(host) {
 }
 async function pinnedHostKey(host, expectedFingerprint) {
   const key = (await scanHostKeys(host)).split("\n").find((line) => line.includes("ssh-ed25519"));
-  if (!key) throw new import_common20.ConflictException("the controller did not provide an Ed25519 SSH host key");
+  if (!key) throw new import_common21.ConflictException("the controller did not provide an Ed25519 SSH host key");
   const dir = await (0, import_promises4.mkdtemp)((0, import_node_path4.join)((0, import_node_os3.tmpdir)(), "attraccess-cc100-"));
   const knownHosts = (0, import_node_path4.join)(dir, "known_hosts");
   try {
     await (0, import_promises4.writeFile)(knownHosts, `${key}
 `, { mode: 384 });
     if (await fingerprintFor(knownHosts) !== expectedFingerprint)
-      throw new import_common20.ConflictException("controller SSH host key changed after automatic identity verification");
+      throw new import_common21.ConflictException("controller SSH host key changed after automatic identity verification");
     return `${key}
 `;
   } finally {
@@ -11679,7 +12011,7 @@ async function fingerprintFor(knownHosts) {
     timeoutMs: 5e3,
     maxOutputBytes: 1024
   })).match(/(SHA256:[A-Za-z0-9+/=]+)/)?.[1];
-  if (!result) throw new import_common20.ConflictException("the controller did not provide a supported SSH host key");
+  if (!result) throw new import_common21.ConflictException("the controller did not provide a supported SSH host key");
   return result;
 }
 
@@ -11783,13 +12115,13 @@ var ManagementPeerVersion = class {
 };
 
 // backend/commissioning/delivery/transport.ts
-var import_common26 = require("@nestjs/common");
+var import_common27 = require("@nestjs/common");
 
 // backend/commissioning/sessions/ownership.ts
-var import_common25 = require("@nestjs/common");
+var import_common26 = require("@nestjs/common");
 
 // backend/commissioning/delivery/recovery.ts
-var import_common24 = require("@nestjs/common");
+var import_common25 = require("@nestjs/common");
 var import_node_crypto22 = require("node:crypto");
 init_hardware_profile();
 var import_promises7 = require("node:fs/promises");
@@ -11798,7 +12130,7 @@ var import_promises7 = require("node:fs/promises");
 var import_promises6 = require("node:fs/promises");
 var import_node_os4 = require("node:os");
 var import_node_path5 = require("node:path");
-var import_common23 = require("@nestjs/common");
+var import_common24 = require("@nestjs/common");
 
 // backend/management/model.ts
 var import_node_crypto19 = require("node:crypto");
@@ -12129,7 +12461,7 @@ init_hardware_profile();
 var import_node_crypto21 = require("node:crypto");
 
 // backend/commissioning/sessions/sessions.ts
-var import_common22 = require("@nestjs/common");
+var import_common23 = require("@nestjs/common");
 var import_node_crypto20 = require("node:crypto");
 
 // backend/management/entity.ts
@@ -12465,7 +12797,7 @@ function createWagoManagementService(context, ssh) {
 }
 
 // backend/commissioning/state.ts
-var import_common21 = require("@nestjs/common");
+var import_common22 = require("@nestjs/common");
 var import_node_async_hooks = require("node:async_hooks");
 var import_plugins_backend_sdk13 = require("@attraccess/plugins-backend-sdk");
 init_catalog();
@@ -12486,21 +12818,21 @@ var WagoCommissioningServiceState = class {
   }
 };
 WagoCommissioningServiceState = __decorateClass([
-  __decorateParam(0, (0, import_common21.Inject)(import_plugins_backend_sdk13.PLUGIN_CONTEXT)),
-  __decorateParam(1, (0, import_common21.Inject)(WagoService)),
-  __decorateParam(2, (0, import_common21.Optional)()),
-  __decorateParam(2, (0, import_common21.Inject)(WagoRuntimeArtifactsService)),
-  __decorateParam(3, (0, import_common21.Optional)()),
-  __decorateParam(3, (0, import_common21.Inject)(WagoCommissioningReadiness)),
-  __decorateParam(4, (0, import_common21.Optional)()),
-  __decorateParam(4, (0, import_common21.Inject)(WagoManagedRuntimeService))
+  __decorateParam(0, (0, import_common22.Inject)(import_plugins_backend_sdk13.PLUGIN_CONTEXT)),
+  __decorateParam(1, (0, import_common22.Inject)(WagoService)),
+  __decorateParam(2, (0, import_common22.Optional)()),
+  __decorateParam(2, (0, import_common22.Inject)(WagoRuntimeArtifactsService)),
+  __decorateParam(3, (0, import_common22.Optional)()),
+  __decorateParam(3, (0, import_common22.Inject)(WagoCommissioningReadiness)),
+  __decorateParam(4, (0, import_common22.Optional)()),
+  __decorateParam(4, (0, import_common22.Inject)(WagoManagedRuntimeService))
 ], WagoCommissioningServiceState);
 
 // backend/commissioning/sessions/sessions.ts
 var WagoCommissioningSessions = class extends WagoCommissioningServiceState {
   async verification(id) {
     const session = await this.sessions.findOneBy({ id });
-    if (!session) throw new import_common22.NotFoundException("commissioning session not found");
+    if (!session) throw new import_common23.NotFoundException("commissioning session not found");
     const settings = this.readiness ? await this.wago.getSettings() : null;
     const runtime = this.readiness?.observe(session.mqttServerId, session.hardwareId, settings.operationalPrefix);
     const verification = await commissioningVerification(this.context, session, runtime);
@@ -12519,14 +12851,14 @@ var WagoCommissioningSessions = class extends WagoCommissioningServiceState {
   }
   async confirmHostKey(id, hostKeyFingerprint, trustMethod = "trusted_inventory", physicalIdentityConfirmed = false) {
     if (!["trusted_inventory", "isolated_service_connection"].includes(trustMethod) || trustMethod === "isolated_service_connection" && physicalIdentityConfirmed !== true)
-      throw new import_common22.ConflictException("Confirm the isolated service connection and physical controller identity.");
+      throw new import_common23.ConflictException("Confirm the isolated service connection and physical controller identity.");
     return this.withDeliveryLock(id, async () => {
       const session = await this.sessions.findOneBy({ id });
-      if (!session) throw new import_common22.NotFoundException("commissioning session not found");
+      if (!session) throw new import_common23.NotFoundException("commissioning session not found");
       if (session.state !== "awaiting_identity_confirmation")
-        throw new import_common22.ConflictException("commissioning session identity cannot be confirmed in its current state");
+        throw new import_common23.ConflictException("commissioning session identity cannot be confirmed in its current state");
       if (hostKeyFingerprint !== session.hostKeyFingerprint)
-        throw new import_common22.ConflictException(
+        throw new import_common23.ConflictException(
           "the supplied SSH host-key fingerprint does not match the scanned controller identity"
         );
       session.state = "awaiting_delivery";
@@ -12538,24 +12870,24 @@ var WagoCommissioningSessions = class extends WagoCommissioningServiceState {
   }
   async create(input, principal = null) {
     if (!isPrivateAddress(input.targetHost))
-      throw new import_common22.ConflictException("commissioning is limited to a protected controller address");
-    if (!input.name.trim()) throw new import_common22.ConflictException("a controller name is required");
+      throw new import_common23.ConflictException("commissioning is limited to a protected controller address");
+    if (!input.name.trim()) throw new import_common23.ConflictException("a controller name is required");
     if (!configuredFirmwareBaseline)
-      throw new import_common22.ConflictException(
+      throw new import_common23.ConflictException(
         "no CC100 firmware baseline is configured; commissioning is disabled until an exact supported baseline is set"
       );
     let brokerAvailable;
     try {
       brokerAvailable = Boolean(await this.context.getMqttServerConfig(input.mqttServerId));
     } catch {
-      throw new import_common22.ConflictException("Commissioning MQTT configuration could not be resolved.");
+      throw new import_common23.ConflictException("Commissioning MQTT configuration could not be resolved.");
     }
-    if (!brokerAvailable) throw new import_common22.NotFoundException("MQTT server not found");
+    if (!brokerAvailable) throw new import_common23.NotFoundException("MQTT server not found");
     let hostKeyFingerprint;
     try {
       hostKeyFingerprint = await scanHostKey(input.targetHost);
     } catch {
-      throw new import_common22.ConflictException("Commissioning SSH host-key scan failed.");
+      throw new import_common23.ConflictException("Commissioning SSH host-key scan failed.");
     }
     const hardwareId = `cc100-${(0, import_node_crypto20.createHash)("sha256").update(hostKeyFingerprint).digest("hex").slice(0, 16)}`;
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -12617,7 +12949,7 @@ var WagoCommissioningSessions = class extends WagoCommissioningServiceState {
             Buffer.from(script).toString("base64") + "\n",
             { timeoutMs: 12 * 6e4, maxOutputBytes: 1024, recoveryDiagnostic: true }
           );
-          if (result !== "OK\n") throw new import_common22.ConflictException("Commissioning acceptance could not be confirmed.");
+          if (result !== "OK\n") throw new import_common23.ConflictException("Commissioning acceptance could not be confirmed.");
           await guard.assertOwned();
         });
       }
@@ -12741,12 +13073,12 @@ var WagoCommissioningPlatform = class extends WagoCommissioningSessions {
       id,
       () => this.withDeliveryLock(id, async () => {
         const session = await this.sessions.findOneBy({ id });
-        if (!session) throw new import_common23.NotFoundException("commissioning session not found");
+        if (!session) throw new import_common24.NotFoundException("commissioning session not found");
         if (["awaiting_identity_confirmation", "delivering"].includes(session.state) || session.state === "revoked" && action !== "recover")
-          throw new import_common23.ConflictException("Confirm controller identity and finish delivery before management changes.");
+          throw new import_common24.ConflictException("Confirm controller identity and finish delivery before management changes.");
         if (!session.managementControllerId) {
           const controller = await this.context.getRepository(WagoController).findOneBy({ hardwareId: session.hardwareId, mqttServerId: session.mqttServerId });
-          if (!controller) throw new import_common23.ConflictException("Wait for controller enrollment before management inspection.");
+          if (!controller) throw new import_common24.ConflictException("Wait for controller enrollment before management inspection.");
           session.managementControllerId = controller.id;
           await this.save(session, "management_subject_bound");
         }
@@ -12783,7 +13115,7 @@ var WagoCommissioningPlatform = class extends WagoCommissioningSessions {
             this.operationContext.getStore()?.assertOwned
           );
         } catch (error) {
-          throw new import_common23.ConflictException(
+          throw new import_common24.ConflictException(
             error instanceof ManagementError ? `Management security: ${error.code}` : "Management security request failed."
           );
         }
@@ -12802,15 +13134,15 @@ var WagoCommissioningPlatform = class extends WagoCommissioningSessions {
   }
   async managementStatus(id) {
     const session = await this.sessions.findOneBy({ id });
-    if (!session) throw new import_common23.NotFoundException("commissioning session not found");
+    if (!session) throw new import_common24.NotFoundException("commissioning session not found");
     return session.managementControllerId ? this.management.status(session.managementControllerId) : null;
   }
   /** Persist ownership before destructive host changes so interruption is recoverable. */
   async prepareController(session, credential, verifiedBundleBytes, hardwareProfile = CC100_DIGITAL_PROFILE_ID) {
     if (session.deliveryToken)
-      throw new import_common23.ConflictException("Clean up the retained runtime installation before preparing the controller.");
+      throw new import_common24.ConflictException("Clean up the retained runtime installation before preparing the controller.");
     if (session.dockerProvisionToken && session.dockerProvisionState !== "started")
-      throw new import_common23.ConflictException("Clean up the retained controller preparation before retrying.");
+      throw new import_common24.ConflictException("Clean up the retained controller preparation before retrying.");
     await this.sudoRunScript(
       session.targetHost,
       session.hostKeyFingerprint,
@@ -12880,7 +13212,7 @@ var WagoCommissioningPlatform = class extends WagoCommissioningSessions {
   async platform(id, action, input, principal = null) {
     const credential = requireDeliveryCredentials({ temporarySsh: input.temporarySsh, confirmInstall: true });
     if (action !== "inspect" && input.reviewedDockerActivation !== true)
-      throw new import_common23.ConflictException("Explicit Docker activation or recovery approval is required.");
+      throw new import_common24.ConflictException("Explicit Docker activation or recovery approval is required.");
     return auditCommissioning(
       this.context,
       principal,
@@ -12890,9 +13222,9 @@ var WagoCommissioningPlatform = class extends WagoCommissioningSessions {
         id,
         () => this.withDeliveryLock(id, async () => {
           const session = await this.sessions.findOneBy({ id });
-          if (!session) throw new import_common23.NotFoundException("commissioning session not found");
+          if (!session) throw new import_common24.NotFoundException("commissioning session not found");
           if (["awaiting_identity_confirmation", "delivering"].includes(session.state) || session.state === "revoked" && action !== "recover")
-            throw new import_common23.ConflictException("Finish identity confirmation and any active delivery first.");
+            throw new import_common24.ConflictException("Finish identity confirmation and any active delivery first.");
           try {
             if (action === "inspect") {
               session.platformReport = null;
@@ -12919,13 +13251,13 @@ var WagoCommissioningPlatform = class extends WagoCommissioningSessions {
               }
             } else {
               if (!session.dockerProvisionToken)
-                throw new import_common23.ConflictException("No Docker provisioning attempt to recover.");
+                throw new import_common24.ConflictException("No Docker provisioning attempt to recover.");
               await this.cleanupControllerPreparation(session, credential);
             }
             session.failureReason = null;
             return this.toResponse(await this.save(session, `platform_${action}_succeeded`));
           } catch (error) {
-            if (error instanceof import_common23.ConflictException) throw error;
+            if (error instanceof import_common24.ConflictException) throw error;
             if (action !== "inspect" && session.dockerProvisionToken)
               session.dockerProvisionState = "recovery_required";
             session.failureReason = error instanceof WagoStorageCapacityError ? error.message : error instanceof WagoControllerLockError ? error.message : error instanceof WagoRecoveryError ? error.message : action === "inspect" ? "Controller preflight could not be read. Check the explicit SSH credential and supported firmware tools." : action === "activate" ? "Controller preparation failed. Check the runtime release, staging storage and required tools. CODESYS must be stopped and permanently disabled before IO or runtime startup. Clean up any retained preparation attempt before retrying." : "Controller preparation cleanup remains unverified. Clean up any runtime transaction first, then retry preparation cleanup. The recovery token is retained; previous workloads are not restored.";
@@ -12957,7 +13289,7 @@ var WagoCommissioningPlatform = class extends WagoCommissioningSessions {
 var WagoCommissioningRecovery = class extends WagoCommissioningPlatform {
   async withControllerLock(id, operation) {
     const session = await this.sessions.findOneBy({ id });
-    if (!session) throw new import_common24.NotFoundException("commissioning session not found");
+    if (!session) throw new import_common25.NotFoundException("commissioning session not found");
     const key = session.hostKeyFingerprint || session.targetHost || session.hardwareId;
     const previous = this.controllerLocks.get(key) ?? Promise.resolve();
     let release;
@@ -12973,7 +13305,7 @@ var WagoCommissioningRecovery = class extends WagoCommissioningPlatform {
       deadline,
       assertOwned: async () => {
         if (finished || controller.signal.aborted || Date.now() >= deadline)
-          throw new import_common24.ConflictException("Controller operation has stopped. Retry the request.");
+          throw new import_common25.ConflictException("Controller operation has stopped. Retry the request.");
       }
     };
     try {
@@ -12982,7 +13314,7 @@ var WagoCommissioningRecovery = class extends WagoCommissioningPlatform {
       if (this.managedRuntime) {
         deviceOperations = new WagoDeviceOperations(this.context.getRepository(WagoDeviceOperation));
         if (!await deviceOperations.acquire(key, owner, Date.now(), deadline + 6e4))
-          throw new import_common24.ConflictException("Another controller operation is active. Retry after it finishes.");
+          throw new import_common25.ConflictException("Another controller operation is active. Retry after it finishes.");
       }
       const originalAssert = guard.assertOwned;
       guard.assertOwned = async () => {
@@ -13011,7 +13343,7 @@ var WagoCommissioningRecovery = class extends WagoCommissioningPlatform {
       id,
       () => this.withDeliveryLock(id, async () => {
         const session = await this.sessions.findOneBy({ id });
-        if (!session) throw new import_common24.NotFoundException("commissioning session not found");
+        if (!session) throw new import_common25.NotFoundException("commissioning session not found");
         if (![
           "delivery_failed",
           "awaiting_discovery",
@@ -13022,10 +13354,10 @@ var WagoCommissioningRecovery = class extends WagoCommissioningPlatform {
           "delivering",
           "awaiting_codesys_confirmation"
         ].includes(session.state))
-          throw new import_common24.ConflictException("commissioning session cannot be recovered in its current state");
+          throw new import_common25.ConflictException("commissioning session cannot be recovered in its current state");
         const requiresNewSession = !session.pairingCode || ["claim_interrupted", "awaiting_verification"].includes(session.state);
         if (!session.deliveryToken)
-          throw new import_common24.ConflictException("commissioning session has no runtime recovery ownership token");
+          throw new import_common25.ConflictException("commissioning session has no runtime recovery ownership token");
         let restored = session.state === "recovery_revocation_pending";
         try {
           const recoveryPassword = await this.managedRuntime?.commissioningRecoveryPassword?.(session);
@@ -13085,7 +13417,7 @@ var WagoCommissioningRecovery = class extends WagoCommissioningPlatform {
   }
   async acquireRuntimeBundle(session) {
     await this.requireRuntimeArtifact();
-    if (!this.artifacts) throw new import_common24.ConflictException("Bundled CC100 runtime is unavailable.");
+    if (!this.artifacts) throw new import_common25.ConflictException("Bundled CC100 runtime is unavailable.");
     const acquired = await this.artifacts.acquire();
     const bundle = {
       ...acquired,
@@ -13104,13 +13436,13 @@ var WagoCommissioningRecovery = class extends WagoCommissioningPlatform {
   }
   async requireRuntimeArtifact() {
     if (!await this.artifacts?.has())
-      throw new import_common24.ConflictException("Build and install the bundled CC100 runtime before installation.");
+      throw new import_common25.ConflictException("Build and install the bundled CC100 runtime before installation.");
   }
   async loadDeliverableSession(id) {
     const session = await this.sessions.findOneBy({ id });
-    if (!session) throw new import_common24.NotFoundException("commissioning session not found");
+    if (!session) throw new import_common25.NotFoundException("commissioning session not found");
     if (!["awaiting_delivery", "delivering", "awaiting_codesys_confirmation", "delivery_failed"].includes(session.state))
-      throw new import_common24.ConflictException("commissioning session cannot be delivered in its current state");
+      throw new import_common25.ConflictException("commissioning session cannot be delivered in its current state");
     return session;
   }
   async deliver(id, input = {}, principal = null) {
@@ -13207,7 +13539,7 @@ var WagoCommissioningOwnership = class extends WagoCommissioningRecovery {
   /** The HTTP audit wrapper belongs inside remove(), so removal is audited once by ATT-983. */
   async removeControllerSafely(id, remove) {
     const controller = await this.context.getRepository(WagoController).findOneBy({ id });
-    if (!controller) throw new import_common25.NotFoundException("controller not found");
+    if (!controller) throw new import_common26.NotFoundException("controller not found");
     const sessions = await this.sessions.find({ where: { hardwareId: controller.hardwareId }, order: { id: "DESC" } });
     if (!sessions.length) {
       await remove(async () => void 0);
@@ -13215,7 +13547,7 @@ var WagoCommissioningOwnership = class extends WagoCommissioningRecovery {
     }
     await this.withControllerLock(sessions[0].id, async () => {
       const guard = this.operationContext.getStore();
-      if (!guard) throw new import_common25.ConflictException("Controller operation ownership is unavailable.");
+      if (!guard) throw new import_common26.ConflictException("Controller operation ownership is unavailable.");
       const assertOwned = guard.assertOwned;
       await assertOwned();
       await this.managedRuntime?.assertRemovable(id);
@@ -13247,15 +13579,15 @@ var WagoCommissioningOwnership = class extends WagoCommissioningRecovery {
   }
   async operateControllerSafely(id, operation, requireCommissioningSession = false) {
     const controller = await this.context.getRepository(WagoController).findOneBy({ id });
-    if (!controller) throw new import_common25.NotFoundException("controller not found");
+    if (!controller) throw new import_common26.NotFoundException("controller not found");
     const sessions = await this.sessions.find({ where: { hardwareId: controller.hardwareId }, order: { id: "DESC" } });
     if (!sessions.length) {
       if (requireCommissioningSession)
-        throw new import_common25.ConflictException("A commissioning session must remain pinned while rotating credentials.");
+        throw new import_common26.ConflictException("A commissioning session must remain pinned while rotating credentials.");
       const controller2 = new AbortController();
       const guard = {
         assertOwned: async () => {
-          if (controller2.signal.aborted) throw new import_common25.ConflictException("Controller operation ended");
+          if (controller2.signal.aborted) throw new import_common26.ConflictException("Controller operation ended");
         },
         signal: controller2.signal,
         deadline: Date.now() + 6e4
@@ -13268,7 +13600,7 @@ var WagoCommissioningOwnership = class extends WagoCommissioningRecovery {
     }
     return this.withControllerLock(sessions[0].id, async () => {
       const guard = this.operationContext.getStore();
-      if (!guard) throw new import_common25.ConflictException("Controller operation ownership is unavailable.");
+      if (!guard) throw new import_common26.ConflictException("Controller operation ownership is unavailable.");
       await guard.assertOwned();
       return operation(guard.assertOwned, guard);
     });
@@ -13282,26 +13614,26 @@ var WagoCommissioningOwnership = class extends WagoCommissioningRecovery {
       id,
       () => this.withDeliveryLock(id, async () => {
         const session = await this.sessions.findOneBy({ id });
-        if (!session) throw new import_common25.NotFoundException("commissioning session not found");
+        if (!session) throw new import_common26.NotFoundException("commissioning session not found");
         if (session.deliveryToken)
-          throw new import_common25.ConflictException("Clean up the retained runtime installation before deleting this session.");
+          throw new import_common26.ConflictException("Clean up the retained runtime installation before deleting this session.");
         if (session.dockerProvisionToken)
-          throw new import_common25.ConflictException("Clean up the retained controller preparation before deleting this session.");
+          throw new import_common26.ConflictException("Clean up the retained controller preparation before deleting this session.");
         if (await this.managedRuntime?.hasAccess(id))
-          throw new import_common25.ConflictException(
+          throw new import_common26.ConflictException(
             "Retain this session for audited managed SSH recovery. Re-enrolment creates a fresh management identity."
           );
         if (session.managementControllerId) {
           const security = await this.management.status(session.managementControllerId);
           if (security && (security.recoveryRequired || ["key_enrolled", "hardened"].includes(security.state)))
-            throw new import_common25.ConflictException("Recover the saved management access before deleting this session.");
+            throw new import_common26.ConflictException("Recover the saved management access before deleting this session.");
         }
         if (session.enrollmentId !== null) {
           try {
             await this.wago.revokeEnrollmentById(session.enrollmentId, this.operationContext.getStore()?.assertOwned);
             await this.wago.deleteEnrollmentById(session.enrollmentId, this.operationContext.getStore()?.assertOwned);
           } catch {
-            throw new import_common25.ConflictException("Commissioning enrollment removal failed.");
+            throw new import_common26.ConflictException("Commissioning enrollment removal failed.");
           }
         }
         await this.operationContext.getStore()?.assertOwned();
@@ -13314,7 +13646,7 @@ var WagoCommissioningOwnership = class extends WagoCommissioningRecovery {
       id,
       () => this.withDeliveryLock(id, async () => {
         const session = await this.sessions.findOneBy({ id });
-        if (!session) throw new import_common25.NotFoundException("commissioning session not found");
+        if (!session) throw new import_common26.NotFoundException("commissioning session not found");
         await this.revokeSessionEnrollment(session);
         session.state = "revoked";
         session.pairingCode = null;
@@ -13392,7 +13724,7 @@ printf '%s\\n' "$ATTRACCESS_SSH_PASSWORD"
         pinnedKey = await pinnedHostKey(host, fingerprint2);
       } catch (error) {
         if (limits2?.recoveryDiagnostic)
-          throw new WagoRecoveryError(error instanceof import_common26.ConflictException ? "identity" : "transport");
+          throw new WagoRecoveryError(error instanceof import_common27.ConflictException ? "identity" : "transport");
         throw error;
       }
       await (0, import_promises8.writeFile)(knownHosts, pinnedKey, { mode: 384 });
@@ -13619,7 +13951,7 @@ var WagoCommissioningProgress = class extends WagoCommissioningTransport {
       }
       if (page.length < 100) break;
     }
-    if (recoveryFailed) throw new import_common27.ConflictException("Commissioning recovery requires credential revocation.");
+    if (recoveryFailed) throw new import_common28.ConflictException("Commissioning recovery requires credential revocation.");
   }
   async invalidateVerifier(session) {
     session.state = "revoked";
@@ -13638,7 +13970,7 @@ var WagoCommissioningProgress = class extends WagoCommissioningTransport {
     try {
       await this.wago.revokeEnrollmentById(session.enrollmentId, this.operationContext.getStore()?.assertOwned);
     } catch {
-      throw new import_common27.ConflictException("Commissioning credential revocation requires attention.");
+      throw new import_common28.ConflictException("Commissioning credential revocation requires attention.");
     }
     session.enrollmentId = null;
     session.enrollmentExpiresAt = null;
@@ -13651,14 +13983,14 @@ var WagoCommissioningProgress = class extends WagoCommissioningTransport {
       if (!/^[A-Za-z0-9_-]{43}$/.test(plaintext)) throw new Error();
       return plaintext;
     } catch {
-      throw new import_common27.ConflictException("Commissioning verifier is unavailable; create a new session.");
+      throw new import_common28.ConflictException("Commissioning verifier is unavailable; create a new session.");
     }
   }
   encryptVerifier(plaintext) {
     try {
       return VERIFIER_PREFIX + this.context.secrets.encrypt(plaintext);
     } catch {
-      throw new import_common27.ConflictException("Commissioning verifier encryption failed.");
+      throw new import_common28.ConflictException("Commissioning verifier encryption failed.");
     }
   }
   reportPreparationProgress(session, checkpoint) {
@@ -13748,11 +14080,11 @@ var WagoCommissioningService = class extends WagoCommissioningProgress {
     };
     try {
       const broker = await this.context.getMqttServerConfig(session.mqttServerId);
-      if (!broker) throw new import_common28.ConflictException("MQTT server not found");
+      if (!broker) throw new import_common29.ConflictException("MQTT server not found");
       try {
         assertCommissioningBroker(broker);
       } catch (error) {
-        if (error instanceof import_common28.ConflictException) attempt.safeFailure = error.message;
+        if (error instanceof import_common29.ConflictException) attempt.safeFailure = error.message;
         throw error;
       }
       const providers = await this.context.getMqttCredentialProvisioning().availableProviders(session.mqttServerId);
@@ -13969,22 +14301,22 @@ var WagoCommissioningService = class extends WagoCommissioningProgress {
   }
 };
 WagoCommissioningService = __decorateClass([
-  (0, import_common28.Injectable)(),
-  __decorateParam(0, (0, import_common28.Inject)(import_plugins_backend_sdk14.PLUGIN_CONTEXT)),
-  __decorateParam(1, (0, import_common28.Inject)(WagoService)),
-  __decorateParam(2, (0, import_common28.Optional)()),
-  __decorateParam(2, (0, import_common28.Inject)(WagoRuntimeArtifactsService)),
-  __decorateParam(3, (0, import_common28.Optional)()),
-  __decorateParam(3, (0, import_common28.Inject)(WagoCommissioningReadiness)),
-  __decorateParam(4, (0, import_common28.Optional)()),
-  __decorateParam(4, (0, import_common28.Inject)(WagoManagedRuntimeService))
+  (0, import_common29.Injectable)(),
+  __decorateParam(0, (0, import_common29.Inject)(import_plugins_backend_sdk14.PLUGIN_CONTEXT)),
+  __decorateParam(1, (0, import_common29.Inject)(WagoService)),
+  __decorateParam(2, (0, import_common29.Optional)()),
+  __decorateParam(2, (0, import_common29.Inject)(WagoRuntimeArtifactsService)),
+  __decorateParam(3, (0, import_common29.Optional)()),
+  __decorateParam(3, (0, import_common29.Inject)(WagoCommissioningReadiness)),
+  __decorateParam(4, (0, import_common29.Optional)()),
+  __decorateParam(4, (0, import_common29.Inject)(WagoManagedRuntimeService))
 ], WagoCommissioningService);
 
 // backend/credentials/service.ts
 var import_plugins_backend_sdk15 = require("@attraccess/plugins-backend-sdk");
-var import_common29 = require("@nestjs/common");
+var import_common30 = require("@nestjs/common");
 var import_node_crypto24 = require("node:crypto");
-var WagoCredentialRotationUncertainError = class extends import_common29.ConflictException {
+var WagoCredentialRotationUncertainError = class extends import_common30.ConflictException {
   constructor() {
     super("Credential rotation is incomplete. Inspect its recovery state and retry the pending handoff.");
   }
@@ -14032,9 +14364,9 @@ var CAPABILITY = "credential-rotation-v1";
 var WAIT_MS = 3e4;
 function assertRotationController(controller, retry) {
   if (controller.trustState !== "claimed" || !controller.mqttServerId || controller.compatibilityError)
-    throw new import_common29.ConflictException("A compatible claimed controller is required.");
+    throw new import_common30.ConflictException("A compatible claimed controller is required.");
   if ("credentialMqttServerId" in controller && controller.credentialMqttServerId != null && controller.credentialMqttServerId !== controller.mqttServerId)
-    throw new import_common29.ConflictException("Use the original credential broker before rotating credentials.");
+    throw new import_common30.ConflictException("Use the original credential broker before rotating credentials.");
   let capabilities;
   try {
     capabilities = JSON.parse(controller.capabilities);
@@ -14042,22 +14374,22 @@ function assertRotationController(controller, retry) {
     capabilities = [];
   }
   if (!Array.isArray(capabilities) || !capabilities.includes(CAPABILITY))
-    throw new import_common29.ConflictException("Install a runtime supporting credential-rotation-v1 before rotating credentials.");
+    throw new import_common30.ConflictException("Install a runtime supporting credential-rotation-v1 before rotating credentials.");
   const heartbeatAt = sourceTime(controller.lastHeartbeatAt);
   const now = Date.now();
   if (!retry && (heartbeatAt === null || heartbeatAt > now + CONTROLLER_CLOCK_TOLERANCE_MS || now - heartbeatAt >= 9e4))
-    throw new import_common29.ConflictException("Wait for a fresh permanent controller heartbeat before rotating credentials.");
+    throw new import_common30.ConflictException("Wait for a fresh permanent controller heartbeat before rotating credentials.");
 }
 function checkPendingRotation(previous, credentialEpoch, retry, mqttServerId, prefix) {
   if (previous && previous.credentialEpoch !== credentialEpoch)
-    throw new import_common29.ConflictException("Recover the previous credential registration before rotating again.");
+    throw new import_common30.ConflictException("Recover the previous credential registration before rotating again.");
   if (previous && previous.phase !== "completed" && !retry)
-    throw new import_common29.ConflictException("Retry the pending credential handoff instead of rotating again.");
+    throw new import_common30.ConflictException("Retry the pending credential handoff instead of rotating again.");
   if (retry && (!previous || previous.phase === "provisioning"))
-    throw new import_common29.ConflictException("Broker rotation completion is uncertain. Recover broker credentials before retrying.");
+    throw new import_common30.ConflictException("Broker rotation completion is uncertain. Recover broker credentials before retrying.");
   if (retry && previous?.phase === "completed") return { state: "completed", revision: previous.revision };
   if (previous && (previous.mqttServerId !== mqttServerId || previous.prefix !== prefix))
-    throw new import_common29.ConflictException("Credential rotation must use its original broker and namespace.");
+    throw new import_common30.ConflictException("Credential rotation must use its original broker and namespace.");
   return void 0;
 }
 var WagoCredentialRotationService = class {
@@ -14085,10 +14417,10 @@ var WagoCredentialRotationService = class {
         (async () => {
           await guard.assertOwned();
           const pending = await this.context.mqtt.subscribe(row.mqttServerId, `${topic}/ack`, (message) => {
-            if (closed || guard.signal.aborted || message.serverId !== row.mqttServerId || message.topic !== `${topic}/ack` || message.payload.length > 1024)
+            if (closed || guard.signal.aborted || message.serverId !== row.mqttServerId || message.topic !== `${topic}/ack`)
               return;
             try {
-              const ack = JSON.parse(message.payload.toString("utf8"));
+              const ack = parseControllerJson(message.payload, "rotation acknowledgement");
               if (ack?.credentialEpoch === row.credentialEpoch && ack?.revision === row.revision && ack?.token === row.token && ack?.status === "reconnected")
                 acknowledge();
             } catch {
@@ -14127,7 +14459,7 @@ var WagoCredentialRotationService = class {
   async rotate(controllerId, prefix, principal, guard, retry = false) {
     await guard.assertOwned();
     const controller = await this.context.getRepository(WagoController).findOneBy({ id: controllerId });
-    if (!controller) throw new import_common29.NotFoundException("WAGO controller not found");
+    if (!controller) throw new import_common30.NotFoundException("WAGO controller not found");
     assertRotationController(controller, retry);
     const [epochRow] = await this.repository.query(
       "SELECT credential_epoch AS epoch FROM plugin_wago_controllers WHERE id = ?",
@@ -14135,7 +14467,7 @@ var WagoCredentialRotationService = class {
     );
     const credentialEpoch = epochRow?.epoch;
     if (typeof credentialEpoch !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(credentialEpoch))
-      throw new import_common29.ConflictException("Re-enroll this controller with a credential epoch before rotating credentials.");
+      throw new import_common30.ConflictException("Re-enroll this controller with a credential epoch before rotating credentials.");
     prefix = normalizeOperationalPrefix(prefix);
     const identity = `wago-controller-${controller.hardwareId}`;
     const previous = await this.repository.createQueryBuilder("rotation").addSelect("rotation.encryptedCredentials").where("rotation.controllerId = :controllerId", { controllerId }).getOne();
@@ -14148,7 +14480,7 @@ var WagoCredentialRotationService = class {
       let row = previous;
       if (!retry) {
         const revision2 = (previous?.revision ?? 0) + 1;
-        if (!Number.isSafeInteger(revision2)) throw new import_common29.ConflictException("Credential rotation revision exhausted.");
+        if (!Number.isSafeInteger(revision2)) throw new import_common30.ConflictException("Credential rotation revision exhausted.");
         row = this.repository.create({
           controllerId,
           revision: revision2,
@@ -14179,23 +14511,23 @@ var WagoCredentialRotationService = class {
           uncertain = false;
           if (previous) await this.repository.save(previous);
           else await this.repository.delete(controllerId);
-          throw new import_common29.ConflictException("Automatic broker credential rotation is unavailable.");
+          throw new import_common30.ConflictException("Automatic broker credential rotation is unavailable.");
         }
         if (credential2.username !== identity || !credential2.password || credential2.password.length > 4096)
-          throw new import_common29.ConflictException("Broker credential rotation needs recovery.");
+          throw new import_common30.ConflictException("Broker credential rotation needs recovery.");
         const plaintext = JSON.stringify({ username: identity, password: credential2.password });
         const encrypted = this.context.secrets.encrypt(plaintext);
         if (!encrypted || encrypted === plaintext || this.context.secrets.decrypt(encrypted) !== plaintext)
-          throw new import_common29.ConflictException("Credential recovery storage is unavailable.");
+          throw new import_common30.ConflictException("Credential recovery storage is unavailable.");
         row.encryptedCredentials = encrypted;
         row.phase = "pending";
         await guard.assertOwned();
         await this.repository.save(row);
       }
-      if (!row?.encryptedCredentials) throw new import_common29.ConflictException("Credential recovery storage is unavailable.");
+      if (!row?.encryptedCredentials) throw new import_common30.ConflictException("Credential recovery storage is unavailable.");
       const credential = JSON.parse(this.context.secrets.decrypt(row.encryptedCredentials));
       if (credential.username !== identity || typeof credential.password !== "string" || !credential.password || credential.password.length > 4096)
-        throw new import_common29.ConflictException("Credential recovery storage is unavailable.");
+        throw new import_common30.ConflictException("Credential recovery storage is unavailable.");
       await this.handoff(controller.hardwareId, row, credential, guard);
       await guard.assertOwned();
       row.phase = "completed";
@@ -14207,7 +14539,7 @@ var WagoCredentialRotationService = class {
     } catch {
       await lifecycle.finish("failed");
       if (uncertain) throw new WagoCredentialRotationUncertainError();
-      throw new import_common29.ConflictException(
+      throw new import_common30.ConflictException(
         "Credential rotation is incomplete. Inspect its recovery state and retry the pending handoff."
       );
     }
@@ -14216,7 +14548,7 @@ var WagoCredentialRotationService = class {
   async assertRemovalBroker(controllerId, mqttServerId) {
     const row = await this.repository.findOneBy({ controllerId });
     if (row && row.mqttServerId !== mqttServerId)
-      throw new import_common29.ConflictException("Revoke the original rotation broker identity before removing this controller.");
+      throw new import_common30.ConflictException("Revoke the original rotation broker identity before removing this controller.");
   }
   async status(controllerId) {
     const row = await this.repository.findOne({ where: { controllerId }, select: { phase: true, revision: true } });
@@ -14227,15 +14559,15 @@ var WagoCredentialRotationService = class {
   }
 };
 WagoCredentialRotationService = __decorateClass([
-  (0, import_common29.Injectable)(),
-  __decorateParam(0, (0, import_common29.Inject)(import_plugins_backend_sdk15.PLUGIN_CONTEXT))
+  (0, import_common30.Injectable)(),
+  __decorateParam(0, (0, import_common30.Inject)(import_plugins_backend_sdk15.PLUGIN_CONTEXT))
 ], WagoCredentialRotationService);
 
 // backend/controllers/controller.ts
 function validateCommissioningAttempt(body, intent) {
-  if (body?.confirmInstall !== true) throw new import_common30.BadRequestException(`Explicit ${intent} consent is required`);
+  if (body?.confirmInstall !== true) throw new import_common31.BadRequestException(`Explicit ${intent} consent is required`);
   if (typeof body.temporarySsh?.username !== "string" || !body.temporarySsh.username.trim() || typeof body.temporarySsh.password !== "string" || !body.temporarySsh.password) {
-    throw new import_common30.BadRequestException("Temporary SSH username and password are required");
+    throw new import_common31.BadRequestException("Temporary SSH username and password are required");
   }
   return {
     confirmInstall: true,
@@ -14283,7 +14615,7 @@ var WagoControllerApi = class {
     return this.wago.saveDraft(id, body?.snapshot, body?.metadata, wagoAuditPrincipal(request), body?.expectedDraft);
   }
   applyPreset(id, body, request) {
-    if (!body?.application) throw new import_common30.BadRequestException("application is required");
+    if (!body?.application) throw new import_common31.BadRequestException("application is required");
     return this.wago.applyPreset(
       id,
       body.application,
@@ -14294,7 +14626,7 @@ var WagoControllerApi = class {
     );
   }
   previewPreset(id, body) {
-    if (!body?.application) throw new import_common30.BadRequestException("application is required");
+    if (!body?.application) throw new import_common31.BadRequestException("application is required");
     return this.wago.previewPreset(id, body.application, body.snapshot);
   }
   presets() {
@@ -14317,9 +14649,9 @@ var WagoControllerApi = class {
   }
   async rotateCredentials(id, body, request) {
     if (!body || Object.keys(body).some((key) => key !== "confirm" && key !== "retry") || body.confirm !== true)
-      throw new import_common30.BadRequestException("Explicit credential rotation consent is required");
+      throw new import_common31.BadRequestException("Explicit credential rotation consent is required");
     if (body.retry !== void 0 && typeof body.retry !== "boolean")
-      throw new import_common30.BadRequestException("Invalid rotation retry flag");
+      throw new import_common31.BadRequestException("Invalid rotation retry flag");
     const settings = await this.wago.getSettings();
     return this.commissioning.operateControllerSafely(
       id,
@@ -14339,7 +14671,7 @@ var WagoControllerApi = class {
   completeManualCredentials(id, body, request) {
     const principal = wagoAuditPrincipal(request);
     if (!body || Object.keys(body).some((key) => !["name", "verifier", "username", "password"].includes(key)) || typeof body.name !== "string" || !body.name || typeof body.verifier !== "string" || !body.verifier || typeof body.username !== "string" || !body.username || typeof body.password !== "string" || !body.password)
-      throw new import_common30.BadRequestException("Controller name, physical verifier and provisioned credentials are required");
+      throw new import_common31.BadRequestException("Controller name, physical verifier and provisioned credentials are required");
     const input = { name: body.name, verifier: body.verifier, username: body.username, password: body.password };
     return this.commissioning.operateControllerSafely(
       id,
@@ -14363,7 +14695,7 @@ var WagoControllerApi = class {
   }
   manageSecurity(id, action, body, request) {
     if (!["inspect", "review", "apply", "recover"].includes(action))
-      throw new import_common30.BadRequestException("Unknown management action");
+      throw new import_common31.BadRequestException("Unknown management action");
     return this.commissioning.manageSecurity(
       id,
       action,
@@ -14372,7 +14704,7 @@ var WagoControllerApi = class {
     );
   }
   platformAction(id, action, body, request) {
-    if (!["inspect", "activate", "recover"].includes(action)) throw new import_common30.BadRequestException("Unknown platform action");
+    if (!["inspect", "activate", "recover"].includes(action)) throw new import_common31.BadRequestException("Unknown platform action");
     return this.commissioning.platform(
       id,
       action,
@@ -14401,7 +14733,7 @@ var WagoControllerApi = class {
     );
   }
   confirmCommissioningHostKey(id, body) {
-    if (!body?.hostKeyFingerprint) throw new import_common30.BadRequestException("SSH host-key fingerprint is required");
+    if (!body?.hostKeyFingerprint) throw new import_common31.BadRequestException("SSH host-key fingerprint is required");
     return this.commissioning.confirmHostKey(
       id,
       body.hostKeyFingerprint,
@@ -14410,8 +14742,8 @@ var WagoControllerApi = class {
     );
   }
   createCommissioningSession(body, request) {
-    if (!body?.mqttServerId) throw new import_common30.BadRequestException("MQTT server is required");
-    if (!body.name?.trim()) throw new import_common30.BadRequestException("controller name is required");
+    if (!body?.mqttServerId) throw new import_common31.BadRequestException("MQTT server is required");
+    if (!body.name?.trim()) throw new import_common31.BadRequestException("controller name is required");
     return this.commissioning.create(
       {
         mqttServerId: body.mqttServerId,
@@ -14438,208 +14770,208 @@ var WagoControllerApi = class {
   }
 };
 __decorateClass([
-  (0, import_common30.Get)("controllers/:id/configuration/revisions/:revision/preview"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Param)("revision", import_common30.ParseIntPipe))
+  (0, import_common31.Get)("controllers/:id/configuration/revisions/:revision/preview"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Param)("revision", import_common31.ParseIntPipe))
 ], WagoControllerApi.prototype, "previewRevision", 1);
 __decorateClass([
-  (0, import_common30.Post)("controllers/:id/configuration/revisions/:revision/acknowledge-rejection"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Param)("revision", import_common30.ParseIntPipe)),
-  __decorateParam(2, (0, import_common30.Req)()),
-  __decorateParam(3, (0, import_common30.Body)())
+  (0, import_common31.Post)("controllers/:id/configuration/revisions/:revision/acknowledge-rejection"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Param)("revision", import_common31.ParseIntPipe)),
+  __decorateParam(2, (0, import_common31.Req)()),
+  __decorateParam(3, (0, import_common31.Body)())
 ], WagoControllerApi.prototype, "acknowledgeRejection", 1);
 __decorateClass([
-  (0, import_common30.Post)("controllers/:id/configuration/rollback/:revision"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Param)("revision", import_common30.ParseIntPipe)),
-  __decorateParam(2, (0, import_common30.Req)()),
-  __decorateParam(3, (0, import_common30.Body)())
+  (0, import_common31.Post)("controllers/:id/configuration/rollback/:revision"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Param)("revision", import_common31.ParseIntPipe)),
+  __decorateParam(2, (0, import_common31.Req)()),
+  __decorateParam(3, (0, import_common31.Body)())
 ], WagoControllerApi.prototype, "rollback", 1);
 __decorateClass([
-  (0, import_common30.Post)("controllers/:id/configuration/publish"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Req)()),
-  __decorateParam(2, (0, import_common30.Body)())
+  (0, import_common31.Post)("controllers/:id/configuration/publish"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Req)()),
+  __decorateParam(2, (0, import_common31.Body)())
 ], WagoControllerApi.prototype, "publishDraft", 1);
 __decorateClass([
-  (0, import_common30.Get)("controllers/:id/configuration/revisions"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Query)("offset")),
-  __decorateParam(2, (0, import_common30.Query)("limit"))
+  (0, import_common31.Get)("controllers/:id/configuration/revisions"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Query)("offset")),
+  __decorateParam(2, (0, import_common31.Query)("limit"))
 ], WagoControllerApi.prototype, "revisions", 1);
 __decorateClass([
-  (0, import_common30.Post)("controllers/:id/configuration/review"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe))
+  (0, import_common31.Post)("controllers/:id/configuration/review"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe))
 ], WagoControllerApi.prototype, "reviewDraft", 1);
 __decorateClass([
-  (0, import_common30.Post)("controllers/:id/configuration/validate"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Body)())
+  (0, import_common31.Post)("controllers/:id/configuration/validate"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Body)())
 ], WagoControllerApi.prototype, "validateDraft", 1);
 __decorateClass([
-  (0, import_common30.Post)("controllers/:id/configuration/draft"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Body)()),
-  __decorateParam(2, (0, import_common30.Req)())
+  (0, import_common31.Post)("controllers/:id/configuration/draft"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Body)()),
+  __decorateParam(2, (0, import_common31.Req)())
 ], WagoControllerApi.prototype, "saveDraft", 1);
 __decorateClass([
-  (0, import_common30.Post)("controllers/:id/configuration/presets/apply"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Body)()),
-  __decorateParam(2, (0, import_common30.Req)())
+  (0, import_common31.Post)("controllers/:id/configuration/presets/apply"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Body)()),
+  __decorateParam(2, (0, import_common31.Req)())
 ], WagoControllerApi.prototype, "applyPreset", 1);
 __decorateClass([
-  (0, import_common30.Post)("controllers/:id/configuration/presets/preview"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Body)())
+  (0, import_common31.Post)("controllers/:id/configuration/presets/preview"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Body)())
 ], WagoControllerApi.prototype, "previewPreset", 1);
 __decorateClass([
-  (0, import_common30.Get)("configuration/presets")
+  (0, import_common31.Get)("configuration/presets")
 ], WagoControllerApi.prototype, "presets", 1);
 __decorateClass([
-  (0, import_common30.Get)("controllers/:id/configuration/baseline"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe))
+  (0, import_common31.Get)("controllers/:id/configuration/baseline"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe))
 ], WagoControllerApi.prototype, "baseline", 1);
 __decorateClass([
-  (0, import_common30.Get)("controllers/:id/configuration/draft"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe))
+  (0, import_common31.Get)("controllers/:id/configuration/draft"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe))
 ], WagoControllerApi.prototype, "draft", 1);
 __decorateClass([
-  (0, import_common30.Delete)("controllers/:id"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Req)())
+  (0, import_common31.Delete)("controllers/:id"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Req)())
 ], WagoControllerApi.prototype, "removeController", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("resources.update"),
-  (0, import_common30.Post)("controllers/:id/commands"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Body)()),
-  __decorateParam(2, (0, import_common30.Req)())
+  (0, import_common31.Post)("controllers/:id/commands"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Body)()),
+  __decorateParam(2, (0, import_common31.Req)())
 ], WagoControllerApi.prototype, "manualCommand", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Post)("controllers/:id/credentials/rotate"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Body)()),
-  __decorateParam(2, (0, import_common30.Req)())
+  (0, import_common31.Post)("controllers/:id/credentials/rotate"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Body)()),
+  __decorateParam(2, (0, import_common31.Req)())
 ], WagoControllerApi.prototype, "rotateCredentials", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Get)("controllers/:id/credentials/rotation"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe))
+  (0, import_common31.Get)("controllers/:id/credentials/rotation"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe))
 ], WagoControllerApi.prototype, "credentialRotationStatus", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Post)("controllers/:id/credentials/manual/complete"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Body)()),
-  __decorateParam(2, (0, import_common30.Req)())
+  (0, import_common31.Post)("controllers/:id/credentials/manual/complete"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Body)()),
+  __decorateParam(2, (0, import_common31.Req)())
 ], WagoControllerApi.prototype, "completeManualCredentials", 1);
 __decorateClass([
-  (0, import_common30.Post)("controllers/:id/claim"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Body)()),
-  __decorateParam(2, (0, import_common30.Req)())
+  (0, import_common31.Post)("controllers/:id/claim"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Body)()),
+  __decorateParam(2, (0, import_common31.Req)())
 ], WagoControllerApi.prototype, "claim", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Delete)("commissioning/sessions/:id"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe))
+  (0, import_common31.Delete)("commissioning/sessions/:id"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe))
 ], WagoControllerApi.prototype, "removeCommissioningSession", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Post)("commissioning/sessions/:id/revoke"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe))
+  (0, import_common31.Post)("commissioning/sessions/:id/revoke"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe))
 ], WagoControllerApi.prototype, "revokeCommissioningSession", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Post)("commissioning/sessions/:id/management/:action"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Param)("action")),
-  __decorateParam(2, (0, import_common30.Body)()),
-  __decorateParam(3, (0, import_common30.Req)())
+  (0, import_common31.Post)("commissioning/sessions/:id/management/:action"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Param)("action")),
+  __decorateParam(2, (0, import_common31.Body)()),
+  __decorateParam(3, (0, import_common31.Req)())
 ], WagoControllerApi.prototype, "manageSecurity", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Post)("commissioning/sessions/:id/platform/:action"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Param)("action")),
-  __decorateParam(2, (0, import_common30.Body)()),
-  __decorateParam(3, (0, import_common30.Req)())
+  (0, import_common31.Post)("commissioning/sessions/:id/platform/:action"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Param)("action")),
+  __decorateParam(2, (0, import_common31.Body)()),
+  __decorateParam(3, (0, import_common31.Req)())
 ], WagoControllerApi.prototype, "platformAction", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Get)("commissioning/sessions/:id/management"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe))
+  (0, import_common31.Get)("commissioning/sessions/:id/management"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe))
 ], WagoControllerApi.prototype, "managementStatus", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Get)("commissioning/sessions/:id/verification"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe))
+  (0, import_common31.Get)("commissioning/sessions/:id/verification"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe))
 ], WagoControllerApi.prototype, "commissioningVerification", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Post)("commissioning/sessions/:id/recover"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Body)()),
-  __decorateParam(2, (0, import_common30.Req)())
+  (0, import_common31.Post)("commissioning/sessions/:id/recover"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Body)()),
+  __decorateParam(2, (0, import_common31.Req)())
 ], WagoControllerApi.prototype, "recoverCommissioningSession", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Post)("commissioning/sessions/:id/deliver"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Body)()),
-  __decorateParam(2, (0, import_common30.Req)())
+  (0, import_common31.Post)("commissioning/sessions/:id/deliver"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Body)()),
+  __decorateParam(2, (0, import_common31.Req)())
 ], WagoControllerApi.prototype, "deliverCommissioningSession", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Post)("commissioning/sessions/:id/confirm-host-key"),
-  __decorateParam(0, (0, import_common30.Param)("id", import_common30.ParseIntPipe)),
-  __decorateParam(1, (0, import_common30.Body)())
+  (0, import_common31.Post)("commissioning/sessions/:id/confirm-host-key"),
+  __decorateParam(0, (0, import_common31.Param)("id", import_common31.ParseIntPipe)),
+  __decorateParam(1, (0, import_common31.Body)())
 ], WagoControllerApi.prototype, "confirmCommissioningHostKey", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Post)("commissioning/sessions"),
-  __decorateParam(0, (0, import_common30.Body)()),
-  __decorateParam(1, (0, import_common30.Req)())
+  (0, import_common31.Post)("commissioning/sessions"),
+  __decorateParam(0, (0, import_common31.Body)()),
+  __decorateParam(1, (0, import_common31.Req)())
 ], WagoControllerApi.prototype, "createCommissioningSession", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Get)("commissioning/sessions"),
-  __decorateParam(0, (0, import_common30.Query)("limit")),
-  __decorateParam(1, (0, import_common30.Query)("offset"))
+  (0, import_common31.Get)("commissioning/sessions"),
+  __decorateParam(0, (0, import_common31.Query)("limit")),
+  __decorateParam(1, (0, import_common31.Query)("offset"))
 ], WagoControllerApi.prototype, "commissioningSessions", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Get)("commissioning/support")
+  (0, import_common31.Get)("commissioning/support")
 ], WagoControllerApi.prototype, "commissioningSupport", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Post)("settings"),
-  __decorateParam(0, (0, import_common30.Body)())
+  (0, import_common31.Post)("settings"),
+  __decorateParam(0, (0, import_common31.Body)())
 ], WagoControllerApi.prototype, "setSettings", 1);
 __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("system.settings.manage"),
-  (0, import_common30.Get)("settings")
+  (0, import_common31.Get)("settings")
 ], WagoControllerApi.prototype, "settings", 1);
 __decorateClass([
-  (0, import_common30.Get)("controllers")
+  (0, import_common31.Get)("controllers")
 ], WagoControllerApi.prototype, "list", 1);
 WagoControllerApi = __decorateClass([
   (0, import_plugins_backend_sdk16.Auth)("resources.update"),
-  (0, import_common30.Controller)("wago"),
-  __decorateParam(0, (0, import_common30.Inject)(WagoService)),
-  __decorateParam(1, (0, import_common30.Inject)(WagoCommissioningService)),
-  __decorateParam(2, (0, import_common30.Inject)(WagoCredentialRotationService)),
-  __decorateParam(3, (0, import_common30.Inject)(/* @__PURE__ */ Symbol.for("attraccess.plugin.context")))
+  (0, import_common31.Controller)("wago"),
+  __decorateParam(0, (0, import_common31.Inject)(WagoService)),
+  __decorateParam(1, (0, import_common31.Inject)(WagoCommissioningService)),
+  __decorateParam(2, (0, import_common31.Inject)(WagoCredentialRotationService)),
+  __decorateParam(3, (0, import_common31.Inject)(/* @__PURE__ */ Symbol.for("attraccess.plugin.context")))
 ], WagoControllerApi);
 
 // backend/plugin.ts
 init_catalog();
 
 // backend/runtime/artifacts/controller.ts
-var import_common31 = require("@nestjs/common");
+var import_common32 = require("@nestjs/common");
 var import_plugins_backend_sdk17 = require("@attraccess/plugins-backend-sdk");
 init_catalog();
 var WagoArtifactsController = class {
@@ -14650,32 +14982,32 @@ var WagoArtifactsController = class {
     try {
       return await this.artifacts.list();
     } catch {
-      throw new import_common31.ServiceUnavailableException("Runtime releases could not be loaded. Retry shortly.");
+      throw new import_common32.ServiceUnavailableException("Runtime releases could not be loaded. Retry shortly.");
     }
   }
   async current() {
     try {
       return await this.artifacts.current();
     } catch {
-      throw new import_common31.ServiceUnavailableException("The selected runtime release could not be loaded. Retry shortly.");
+      throw new import_common32.ServiceUnavailableException("The selected runtime release could not be loaded. Retry shortly.");
     }
   }
 };
 __decorateClass([
-  (0, import_common31.Get)()
+  (0, import_common32.Get)()
 ], WagoArtifactsController.prototype, "list", 1);
 __decorateClass([
-  (0, import_common31.Get)("current")
+  (0, import_common32.Get)("current")
 ], WagoArtifactsController.prototype, "current", 1);
 WagoArtifactsController = __decorateClass([
   (0, import_plugins_backend_sdk17.Auth)("system.settings.manage"),
-  (0, import_common31.Controller)("wago/runtime-artifacts"),
-  __decorateParam(0, (0, import_common31.Inject)(WagoRuntimeArtifactsService))
+  (0, import_common32.Controller)("wago/runtime-artifacts"),
+  __decorateParam(0, (0, import_common32.Inject)(WagoRuntimeArtifactsService))
 ], WagoArtifactsController);
 
 // backend/diagnostics/service.ts
 var import_plugins_backend_sdk18 = require("@attraccess/plugins-backend-sdk");
-var import_common32 = require("@nestjs/common");
+var import_common33 = require("@nestjs/common");
 function configurationRejections(latest, runtime) {
   return latest?.rejectionErrors ? safeValidationSummaries(JSON.parse(latest.rejectionErrors)) : latest && runtime.rejection?.revision === latest.revision && runtime.rejection.contentHash === latest.contentHash ? runtime.rejection.errors : [];
 }
@@ -14729,6 +15061,7 @@ function diagnosticReferences(nodes, channelIds, revision2, capabilities) {
 function runtimeStreamSummary(runtime) {
   return {
     sequenceGaps: runtime.activeStream ? runtime.sequenceGaps : null,
+    dropCounts: runtime.dropCounts ?? null,
     activeStream: runtime.activeStream ?? null,
     trackingExhausted: runtime.trackingExhausted,
     stateConnected: runtime.connected ?? null,
@@ -14744,7 +15077,7 @@ var WagoDiagnosticsService = class {
   }
   async get(controllerId) {
     const controller = await this.context.getRepository(WagoController).findOneBy({ id: controllerId });
-    if (!controller) throw new import_common32.NotFoundException("WAGO controller not found");
+    if (!controller) throw new import_common33.NotFoundException("WAGO controller not found");
     const [draft, latest, applied, nodes] = await Promise.all([
       this.context.getRepository(WagoConfigurationDraft).findOneBy({ controllerId }),
       this.context.getRepository(WagoConfigurationRevision).findOne({ where: { controllerId }, order: { revision: "DESC" } }),
@@ -14760,6 +15093,14 @@ var WagoDiagnosticsService = class {
     const expected = latest?.state === "rejected" ? applied : latest;
     const revisionMismatch = !!expected && (applied?.revision !== expected.revision || runtime.revision !== expected.revision || runtime.activeStream !== void 0 && runtime.contentHash !== expected.contentHash);
     const connected = runtime.connected === false ? false : heartbeatFreshness === "fresh" || freshness(runtime.stateSourceAt) === "fresh";
+    const configuredChannels = (appliedSnapshot ?? snapshot)?.logicalChannels ?? [];
+    const enabledChannels = configuredChannels.filter(channelEnabled);
+    const disabledChannels = configuredChannels.filter((channel) => !channelEnabled(channel)).slice(0, MAX_CONFIGURATION_ITEMS).map((channel) => ({
+      id: channel.id,
+      profile: channel.profile,
+      capabilities: channel.capabilities,
+      availability: "disabled"
+    }));
     const references = diagnosticReferences(
       nodes.slice(0, 1e3),
       appliedSnapshot?.logicalChannels.map((channel) => channel.id) ?? [],
@@ -14786,7 +15127,7 @@ var WagoDiagnosticsService = class {
       ) : [],
       hardwareReadiness: "unknown",
       hardwareReadinessReason: "Reported hardware availability is shown when supplied; it does not prove physical I/O readiness. Applied configuration and cached output state are not physical proof.",
-      channels: ((appliedSnapshot ?? snapshot)?.logicalChannels ?? []).slice(0, 256).map((channel) => {
+      channels: enabledChannels.slice(0, MAX_CHANNELS).map((channel) => {
         const values = [
           channel.capabilities.includes("input") ? own(runtime.inputs, channel.id) : void 0,
           channel.capabilities.includes("output") ? own(runtime.outputs, channel.id) : void 0,
@@ -14810,13 +15151,14 @@ var WagoDiagnosticsService = class {
           acknowledgement: own(runtime.acknowledgements, channel.id) ?? null
         };
       }),
+      disabledChannels,
       faults: Object.entries(runtime.faults).map(([channelId2, fault]) => ({ channelId: channelId2, ...fault })),
       references,
       referencesTruncated: nodes.length > 1e3,
       events: runtime.events,
       limitations: [
         "Hardware readiness remains unknown. Legacy samples have no source time and are never current.",
-        "Diagnostics retain at most 256 channels, 50 recent events and 15 minutes in this process.",
+        "Diagnostics retain at most 256 enabled channels, 50 recent events and 15 minutes in this process. Disabled channels are listed without samples.",
         "Flow links select the affected node. Diagnostics warnings do not block resource usage; required flow nodes determine gating.",
         "The MQTT SDK exposes neither retained-message flags nor broker connection events. Source age is bounded to 90 seconds; immediate broker-disconnect detection is unavailable.",
         "Stream tracking keeps at most 16 retired boot stream IDs per controller and six category counters, and fails closed when exhausted. Replayed source times never become receipt times."
@@ -14921,9 +15263,9 @@ var WagoDiagnosticsService = class {
   }
 };
 WagoDiagnosticsService = __decorateClass([
-  (0, import_common32.Injectable)(),
-  __decorateParam(0, (0, import_common32.Inject)(/* @__PURE__ */ Symbol.for("attraccess.plugin.context"))),
-  __decorateParam(1, (0, import_common32.Inject)(WagoService))
+  (0, import_common33.Injectable)(),
+  __decorateParam(0, (0, import_common33.Inject)(/* @__PURE__ */ Symbol.for("attraccess.plugin.context"))),
+  __decorateParam(1, (0, import_common33.Inject)(WagoService))
 ], WagoDiagnosticsService);
 var WagoDiagnosticsController = class {
   constructor(diagnostics) {
@@ -14937,17 +15279,17 @@ var WagoDiagnosticsController = class {
   }
 };
 __decorateClass([
-  (0, import_common32.Get)("controllers/:id/diagnostics"),
-  __decorateParam(0, (0, import_common32.Param)("id", import_common32.ParseIntPipe))
+  (0, import_common33.Get)("controllers/:id/diagnostics"),
+  __decorateParam(0, (0, import_common33.Param)("id", import_common33.ParseIntPipe))
 ], WagoDiagnosticsController.prototype, "get", 1);
 __decorateClass([
-  (0, import_common32.Get)("resources/:id/diagnostics"),
-  __decorateParam(0, (0, import_common32.Param)("id", import_common32.ParseIntPipe))
+  (0, import_common33.Get)("resources/:id/diagnostics"),
+  __decorateParam(0, (0, import_common33.Param)("id", import_common33.ParseIntPipe))
 ], WagoDiagnosticsController.prototype, "getResource", 1);
 WagoDiagnosticsController = __decorateClass([
   (0, import_plugins_backend_sdk18.Auth)("resources.update"),
-  (0, import_common32.Controller)("wago"),
-  __decorateParam(0, (0, import_common32.Inject)(WagoDiagnosticsService))
+  (0, import_common33.Controller)("wago"),
+  __decorateParam(0, (0, import_common33.Inject)(WagoDiagnosticsService))
 ], WagoDiagnosticsController);
 
 // backend/flow/command-node.ts
@@ -14973,7 +15315,7 @@ function createWagoCommandNode(service) {
 }
 
 // backend/flow/service.ts
-var import_common34 = require("@nestjs/common");
+var import_common35 = require("@nestjs/common");
 
 // backend/flow/model.ts
 var MAX_CACHE_ENTRIES = 2e3;
@@ -15040,7 +15382,7 @@ function createWagoStateNodes(service) {
 }
 
 // backend/flow/state.ts
-var import_common33 = require("@nestjs/common");
+var import_common34 = require("@nestjs/common");
 var WagoFlowServiceState = class {
   constructor(context, wago) {
     __publicField(this, "context", context);
@@ -15053,6 +15395,8 @@ var WagoFlowServiceState = class {
     __publicField(this, "unavailableConfiguration", /* @__PURE__ */ new Set());
     __publicField(this, "appliedConfigurations", /* @__PURE__ */ new Map());
     __publicField(this, "channelCache", /* @__PURE__ */ new Map());
+    /** IDs of the disabled channels in `channelCache`, kept in step with it so reads need no scan. */
+    __publicField(this, "disabledChannelCache", /* @__PURE__ */ new Map());
     __publicField(this, "waiters", /* @__PURE__ */ new Set());
     __publicField(this, "waitersByKey", /* @__PURE__ */ new Map());
     __publicField(this, "subscriptions", []);
@@ -15074,14 +15418,14 @@ var WagoFlowServiceState = class {
   }
 };
 WagoFlowServiceState = __decorateClass([
-  __decorateParam(0, (0, import_common33.Inject)(PLUGIN_CONTEXT6)),
-  __decorateParam(1, (0, import_common33.Inject)(WagoService))
+  __decorateParam(0, (0, import_common34.Inject)(PLUGIN_CONTEXT6)),
+  __decorateParam(1, (0, import_common34.Inject)(WagoService))
 ], WagoFlowServiceState);
 
 // backend/flow/queries.ts
 var WagoFlowQueries = class extends WagoFlowServiceState {
   async wait(config) {
-    if (typeof config.controllerId !== "number" || typeof config.channelId !== "string" || typeof config.category !== "string")
+    if (typeof config.controllerId !== "number" || typeof config.channelId !== "string" || typeof config.category !== "string" || this.disabled(config.controllerId, config.channelId))
       return null;
     const current = this.read(config);
     if (current && this.matchesCondition(current, config)) return current;
@@ -15110,8 +15454,13 @@ var WagoFlowQueries = class extends WagoFlowServiceState {
       this.waitersByKey.set(waiterKey, waiters);
     });
   }
+  /** True when the applied configuration disables this channel; its readings are then unavailable. */
+  disabled(controllerId, channelId2) {
+    return this.disabledChannelCache.get(controllerId)?.has(channelId2) ?? false;
+  }
   read(config) {
-    if (typeof config.controllerId !== "number" || typeof config.channelId !== "string") return null;
+    if (typeof config.controllerId !== "number" || typeof config.channelId !== "string" || this.disabled(config.controllerId, config.channelId))
+      return null;
     if (typeof config.category === "string")
       return this.cache.get(this.cacheKey(config.controllerId, config.channelId, config.category)) ?? null;
     const entries = [...this.cache.values()].filter(
@@ -15196,10 +15545,10 @@ var WagoFlowQueries = class extends WagoFlowServiceState {
         type: "string",
         title: "Logical Channel",
         refreshesSchema: true,
-        oneOf: channels.map((channel2) => ({
-          const: channel2.id,
-          title: typeof names[channel2.id] === "string" ? names[channel2.id] : channel2.id
-        }))
+        oneOf: channels.map((channel2) => {
+          const title = typeof names[channel2.id] === "string" ? names[channel2.id] : channel2.id;
+          return { const: channel2.id, title: channel2.enabled === false ? `${title} (disabled)` : title };
+        })
       }
     };
     if (kind === "event") {
@@ -15253,6 +15602,7 @@ var WagoFlowQueries = class extends WagoFlowServiceState {
       if (!controllerIds.has(id)) this.appliedConfigurations.delete(id);
     for (const id of this.streams.keys()) if (!controllerIds.has(id)) this.streams.delete(id);
     this.channelCache.clear();
+    this.disabledChannelCache.clear();
     const revisions = await this.loadLatestAppliedRevisions(controllers.map((controller) => controller.id));
     for (const revision2 of revisions) this.cacheChannels(revision2);
     for (const controller of controllers)
@@ -15380,12 +15730,14 @@ var WagoFlowService = class extends WagoFlowQueries {
     return true;
   }
   readCategories(channel) {
+    if (channel?.enabled === false) return [];
     return [
       ...channel?.capabilities.some((capability) => capability === "input" || capability === "output") ? ["state"] : [],
       ...channel?.capabilities.includes("measurement") ? ["measurement"] : []
     ];
   }
   categories(channel) {
+    if (channel?.enabled === false) return [];
     return [
       ...channel?.capabilities.some((capability) => capability === "input" || capability === "output") ? ["state"] : [],
       ...channel?.capabilities.includes("measurement") ? ["measurement"] : [],
@@ -15409,9 +15761,14 @@ var WagoFlowService = class extends WagoFlowQueries {
         contentHash: revision2.contentHash
       });
       this.channelCache.set(revision2.controllerId, channels);
+      const disabled = new Set(channels.filter((channel) => channel.enabled === false).map((channel) => channel.id));
+      this.disabledChannelCache.set(revision2.controllerId, disabled);
+      for (const [key, state] of this.cache)
+        if (state.controllerId === revision2.controllerId && disabled.has(state.channelId)) this.cache.delete(key);
       return channels;
     } catch {
       this.channelCache.set(revision2.controllerId, []);
+      this.disabledChannelCache.delete(revision2.controllerId);
       return [];
     }
   }
@@ -15433,6 +15790,7 @@ var WagoFlowService = class extends WagoFlowQueries {
     });
     if (!revision2) {
       this.channelCache.set(controllerId, []);
+      this.disabledChannelCache.delete(controllerId);
       return [];
     }
     return this.cacheChannels(revision2);
@@ -15486,6 +15844,7 @@ var WagoFlowService = class extends WagoFlowQueries {
       if (invalidateSamples || state.category === "state") state.invalidated = true;
     }
     for (const channel of channels) {
+      if (channel.enabled === false) continue;
       const value = channel.capabilities.includes("input") && Object.hasOwn(event.inputs ?? {}, channel.id) ? event.inputs[channel.id] : channel.capabilities.includes("output") && Object.hasOwn(event.outputs, channel.id) ? event.outputs[channel.id] : void 0;
       if (typeof value === "boolean") this.store(controller, channel.id, event, value);
     }
@@ -15556,7 +15915,8 @@ var WagoFlowService = class extends WagoFlowQueries {
       this.applyState(controller, event, eventTime, stream, channels);
     } else if ("channelId" in event) {
       const channel = channels.find((channel2) => channel2.id === event.channelId);
-      if (!channel || event.category === "measurement" && !channel.capabilities.includes("measurement")) return;
+      if (!channel || channel.enabled === false || event.category === "measurement" && !channel.capabilities.includes("measurement"))
+        return;
       this.store(controller, event.channelId, event, event.category === "measurement" ? event.value : event);
     }
   }
@@ -15567,9 +15927,9 @@ var WagoFlowService = class extends WagoFlowQueries {
   }
 };
 WagoFlowService = __decorateClass([
-  (0, import_common34.Injectable)(),
-  __decorateParam(0, (0, import_common34.Inject)(PLUGIN_CONTEXT6)),
-  __decorateParam(1, (0, import_common34.Inject)(WagoService))
+  (0, import_common35.Injectable)(),
+  __decorateParam(0, (0, import_common35.Inject)(PLUGIN_CONTEXT6)),
+  __decorateParam(1, (0, import_common35.Inject)(WagoService))
 ], WagoFlowService);
 
 // backend/audit/policy.ts
@@ -15708,14 +16068,14 @@ var WAGO_AUDIT_DOMAIN = {
 
 // backend/runtime/update/controller.ts
 var import_plugins_backend_sdk19 = require("@attraccess/plugins-backend-sdk");
-var import_common37 = require("@nestjs/common");
+var import_common38 = require("@nestjs/common");
 
 // backend/network/service.ts
-var import_common36 = require("@nestjs/common");
+var import_common37 = require("@nestjs/common");
 var import_node_crypto25 = require("node:crypto");
 
 // backend/network/model.ts
-var import_common35 = require("@nestjs/common");
+var import_common36 = require("@nestjs/common");
 var NetworkChangeError = class extends Error {
   constructor(failure) {
     super(failure);
@@ -15726,24 +16086,24 @@ var EVIDENCE_MS = 12e4;
 var OPERATION_MS2 = 20 * 6e4;
 function networkChangeInput(body) {
   if (!body || typeof body !== "object" || Array.isArray(body))
-    throw new import_common35.BadRequestException("Invalid MQTT/address change");
+    throw new import_common36.BadRequestException("Invalid MQTT/address change");
   const input = body;
   if (Object.keys(input).some((k) => !["targetHost", "mqttServerId"].includes(k)) || typeof input.targetHost !== "string" || !/^(?:\d{1,3}\.){3}\d{1,3}$/.test(input.targetHost))
-    throw new import_common35.BadRequestException("Enter the CC100 private IPv4 address.");
+    throw new import_common36.BadRequestException("Enter the CC100 private IPv4 address.");
   const octets = input.targetHost.split(".").map(Number);
   if (octets.some((n) => n > 255) || octets.join(".") !== input.targetHost || !(octets[0] === 10 || octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31 || octets[0] === 192 && octets[1] === 168))
-    throw new import_common35.BadRequestException("Enter the CC100 private IPv4 address.");
+    throw new import_common36.BadRequestException("Enter the CC100 private IPv4 address.");
   if (input.mqttServerId !== null && (!Number.isSafeInteger(input.mqttServerId) || input.mqttServerId <= 0))
-    throw new import_common35.BadRequestException("Select a configured MQTT server or update only the address.");
+    throw new import_common36.BadRequestException("Select a configured MQTT server or update only the address.");
   return { targetHost: input.targetHost, mqttServerId: input.mqttServerId };
 }
 function assertNoUnfinishedChange(row) {
   if (row && row.phase !== "completed" && !(row.phase === "connecting" && row.failure))
-    throw new import_common35.ConflictException("Retry the pending MQTT/address change before starting another.");
+    throw new import_common36.ConflictException("Retry the pending MQTT/address change before starting another.");
 }
 function assertSameManagedIdentity(row, access) {
   if (!row || row.sessionId !== access.sessionId || row.fingerprint !== access.fingerprint)
-    throw new import_common35.ConflictException("Pending change belongs to another managed identity.");
+    throw new import_common36.ConflictException("Pending change belongs to another managed identity.");
 }
 
 // backend/network/service.ts
@@ -15757,14 +16117,14 @@ var WagoNetworkChangeService = class {
     __publicField(this, "destroyed", false);
   }
   async apply(controllerId, body, principal, retry = false) {
-    if (this.destroyed) throw new import_common36.ConflictException("Controller operation has stopped. Retry the request.");
+    if (this.destroyed) throw new import_common37.ConflictException("Controller operation has stopped. Retry the request.");
     const input = retry ? null : networkChangeInput(body);
     const access = await this.context.getRepository(WagoManagedAccess).findOne({ where: { controllerId, state: "managed" }, order: { sessionId: "DESC" } });
-    if (!access) throw new import_common36.ConflictException("Automatic SSH management is required for this operation.");
+    if (!access) throw new import_common37.ConflictException("Automatic SSH management is required for this operation.");
     const operations = new WagoDeviceOperations(this.context.getRepository(WagoDeviceOperation));
     const owner = (0, import_node_crypto25.randomBytes)(16).toString("hex"), now = Date.now();
     if (!await operations.acquire(access.fingerprint, owner, now, now + OPERATION_MS2 + 6e4))
-      throw new import_common36.ConflictException("Another controller operation is active. Retry after it finishes.");
+      throw new import_common37.ConflictException("Another controller operation is active. Retry after it finishes.");
     const abort = new AbortController();
     this.active.add(abort);
     const timer = setTimeout(() => abort.abort(), OPERATION_MS2).unref();
@@ -15778,7 +16138,7 @@ var WagoNetworkChangeService = class {
     try {
       const controller = await this.context.getRepository(WagoController).findOneBy({ id: controllerId, trustState: "claimed" });
       if (!controller?.mqttServerId || !controller.credentialEpoch)
-        throw new import_common36.ConflictException("Managed enrolled controller required.");
+        throw new import_common37.ConflictException("Managed enrolled controller required.");
       row = await this.repository.createQueryBuilder("change").addSelect("change.encryptedPayload").where("change.controllerId = :controllerId", { controllerId }).getOne();
       if (retry && (!row || row.phase === "completed")) return this.status(controllerId);
       if (!retry) assertNoUnfinishedChange(row);
@@ -15807,7 +16167,7 @@ var WagoNetworkChangeService = class {
     } catch (error) {
       if (row && row.phase !== "completed") await this.recordFailure(row, error, assertOwned);
       if (audited) await lifecycle.finish("failed");
-      throw new import_common36.ConflictException("MQTT/address change is incomplete. Check its status and retry the saved operation.");
+      throw new import_common37.ConflictException("MQTT/address change is incomplete. Check its status and retry the saved operation.");
     } finally {
       clearTimeout(timer);
       abort.abort();
@@ -15820,13 +16180,13 @@ var WagoNetworkChangeService = class {
     const rotation = await this.context.getRepository(WagoCredentialRotationEntity).findOneBy({ controllerId });
     const update = await this.context.getRepository(WagoRuntimeUpdateEntity).findOneBy({ controllerId });
     if (rotation && rotation.phase !== "completed" || update?.metadata && JSON.parse(update.metadata).token)
-      throw new import_common36.ConflictException(
+      throw new import_common37.ConflictException(
         "Finish credential rotation or runtime update recovery before changing MQTT/address settings."
       );
   }
   /** Durably record a new change intent before contacting the controller. */
   async savePendingChange(controllerId, access, input, assertOwned) {
-    if (!input) throw new import_common36.BadRequestException("Invalid MQTT/address change");
+    if (!input) throw new import_common37.BadRequestException("Invalid MQTT/address change");
     const row = this.repository.create({
       controllerId,
       sessionId: access.sessionId,
@@ -16048,7 +16408,7 @@ var WagoNetworkChangeService = class {
   }
   async status(controllerId) {
     const controller = await this.context.getRepository(WagoController).findOneBy({ id: controllerId });
-    if (!controller) throw new import_common36.NotFoundException("WAGO controller not found");
+    if (!controller) throw new import_common37.NotFoundException("WAGO controller not found");
     const access = await this.context.getRepository(WagoManagedAccess).findOne({ where: { controllerId }, order: { sessionId: "DESC" } });
     const row = await this.repository.findOneBy({ controllerId });
     const lease = row && await this.context.getRepository(WagoDeviceOperation).findOneBy({ fingerprint: row.fingerprint });
@@ -16068,10 +16428,10 @@ var WagoNetworkChangeService = class {
   }
   async retirePreviousCredentials(controllerId, principal) {
     const access = await this.context.getRepository(WagoManagedAccess).findOne({ where: { controllerId }, order: { sessionId: "DESC" } });
-    if (!access) throw new import_common36.ConflictException("Controller management identity is unavailable.");
+    if (!access) throw new import_common37.ConflictException("Controller management identity is unavailable.");
     const operations = new WagoDeviceOperations(this.context.getRepository(WagoDeviceOperation)), owner = (0, import_node_crypto25.randomBytes)(16).toString("hex");
     if (!await operations.acquire(access.fingerprint, owner, Date.now(), Date.now() + 12e4))
-      throw new import_common36.ConflictException("Controller is busy");
+      throw new import_common37.ConflictException("Controller is busy");
     const lifecycle = new WagoAudit(this.context).begin(principal, controllerId, "network_credential_retirement");
     let audited = false;
     try {
@@ -16119,7 +16479,7 @@ var WagoNetworkChangeService = class {
       return this.status(controllerId);
     } catch {
       if (audited) await lifecycle.finish("failed").catch(() => void 0);
-      throw new import_common36.ConflictException(
+      throw new import_common37.ConflictException(
         "Previous broker credentials could not be retired. Check the previous broker connection and retry."
       );
     } finally {
@@ -16135,10 +16495,10 @@ var WagoNetworkChangeService = class {
   }
 };
 WagoNetworkChangeService = __decorateClass([
-  (0, import_common36.Injectable)(),
-  __decorateParam(0, (0, import_common36.Inject)(/* @__PURE__ */ Symbol.for("attraccess.plugin.context"))),
-  __decorateParam(1, (0, import_common36.Inject)(WagoManagedRuntimeService)),
-  __decorateParam(2, (0, import_common36.Inject)(WagoService))
+  (0, import_common37.Injectable)(),
+  __decorateParam(0, (0, import_common37.Inject)(/* @__PURE__ */ Symbol.for("attraccess.plugin.context"))),
+  __decorateParam(1, (0, import_common37.Inject)(WagoManagedRuntimeService)),
+  __decorateParam(2, (0, import_common37.Inject)(WagoService))
 ], WagoNetworkChangeService);
 
 // backend/runtime/update/controller.ts
@@ -16170,7 +16530,7 @@ var WagoUpdatesController = class {
   }
   recovery(id, body, request) {
     if (body?.confirm !== true || Object.keys(body).length !== 1)
-      throw new import_common37.BadRequestException("Confirm administrator recovery disclosure");
+      throw new import_common38.BadRequestException("Confirm administrator recovery disclosure");
     return this.managed.recoverPassword(id, wagoAuditPrincipal(request));
   }
   retry(id) {
@@ -16178,70 +16538,70 @@ var WagoUpdatesController = class {
   }
   restore(id, body, request) {
     if (body?.confirm !== true || Object.keys(body).length !== 1)
-      throw new import_common37.BadRequestException("Confirm bootstrap SSH restoration");
+      throw new import_common38.BadRequestException("Confirm bootstrap SSH restoration");
     return this.managed.restoreAccess(id, wagoAuditPrincipal(request));
   }
 };
 __decorateClass([
-  (0, import_common37.Get)("controllers/:id/network-change"),
-  __decorateParam(0, (0, import_common37.Param)("id", import_common37.ParseIntPipe))
+  (0, import_common38.Get)("controllers/:id/network-change"),
+  __decorateParam(0, (0, import_common38.Param)("id", import_common38.ParseIntPipe))
 ], WagoUpdatesController.prototype, "networkStatus", 1);
 __decorateClass([
-  (0, import_common37.Post)("controllers/:id/network-change"),
-  (0, import_common37.Header)("Cache-Control", "no-store"),
-  __decorateParam(0, (0, import_common37.Param)("id", import_common37.ParseIntPipe)),
-  __decorateParam(1, (0, import_common37.Body)()),
-  __decorateParam(2, (0, import_common37.Req)())
+  (0, import_common38.Post)("controllers/:id/network-change"),
+  (0, import_common38.Header)("Cache-Control", "no-store"),
+  __decorateParam(0, (0, import_common38.Param)("id", import_common38.ParseIntPipe)),
+  __decorateParam(1, (0, import_common38.Body)()),
+  __decorateParam(2, (0, import_common38.Req)())
 ], WagoUpdatesController.prototype, "changeNetwork", 1);
 __decorateClass([
-  (0, import_common37.Post)("controllers/:id/network-change/retry"),
-  __decorateParam(0, (0, import_common37.Param)("id", import_common37.ParseIntPipe)),
-  __decorateParam(1, (0, import_common37.Req)())
+  (0, import_common38.Post)("controllers/:id/network-change/retry"),
+  __decorateParam(0, (0, import_common38.Param)("id", import_common38.ParseIntPipe)),
+  __decorateParam(1, (0, import_common38.Req)())
 ], WagoUpdatesController.prototype, "retryNetwork", 1);
 __decorateClass([
-  (0, import_common37.Post)("controllers/:id/network-change/retire-credentials"),
-  __decorateParam(0, (0, import_common37.Param)("id", import_common37.ParseIntPipe)),
-  __decorateParam(1, (0, import_common37.Req)())
+  (0, import_common38.Post)("controllers/:id/network-change/retire-credentials"),
+  __decorateParam(0, (0, import_common38.Param)("id", import_common38.ParseIntPipe)),
+  __decorateParam(1, (0, import_common38.Req)())
 ], WagoUpdatesController.prototype, "retirePreviousCredentials", 1);
 __decorateClass([
-  (0, import_common37.Get)("controllers/:id/runtime-update"),
-  __decorateParam(0, (0, import_common37.Param)("id", import_common37.ParseIntPipe))
+  (0, import_common38.Get)("controllers/:id/runtime-update"),
+  __decorateParam(0, (0, import_common38.Param)("id", import_common38.ParseIntPipe))
 ], WagoUpdatesController.prototype, "status", 1);
 __decorateClass([
-  (0, import_common37.Get)("commissioning/sessions/:id/managed-access"),
-  __decorateParam(0, (0, import_common37.Param)("id", import_common37.ParseIntPipe))
+  (0, import_common38.Get)("commissioning/sessions/:id/managed-access"),
+  __decorateParam(0, (0, import_common38.Param)("id", import_common38.ParseIntPipe))
 ], WagoUpdatesController.prototype, "sessionStatus", 1);
 __decorateClass([
-  (0, import_common37.Post)("controllers/:id/runtime-update/retry"),
-  __decorateParam(0, (0, import_common37.Param)("id", import_common37.ParseIntPipe))
+  (0, import_common38.Post)("controllers/:id/runtime-update/retry"),
+  __decorateParam(0, (0, import_common38.Param)("id", import_common38.ParseIntPipe))
 ], WagoUpdatesController.prototype, "retryRuntime", 1);
 __decorateClass([
-  (0, import_common37.Post)("commissioning/sessions/:id/root-recovery"),
-  (0, import_common37.Header)("Cache-Control", "no-store"),
-  (0, import_common37.Header)("Pragma", "no-cache"),
-  __decorateParam(0, (0, import_common37.Param)("id", import_common37.ParseIntPipe)),
-  __decorateParam(1, (0, import_common37.Body)()),
-  __decorateParam(2, (0, import_common37.Req)())
+  (0, import_common38.Post)("commissioning/sessions/:id/root-recovery"),
+  (0, import_common38.Header)("Cache-Control", "no-store"),
+  (0, import_common38.Header)("Pragma", "no-cache"),
+  __decorateParam(0, (0, import_common38.Param)("id", import_common38.ParseIntPipe)),
+  __decorateParam(1, (0, import_common38.Body)()),
+  __decorateParam(2, (0, import_common38.Req)())
 ], WagoUpdatesController.prototype, "recovery", 1);
 __decorateClass([
-  (0, import_common37.Post)("commissioning/sessions/:id/managed-access/retry"),
-  __decorateParam(0, (0, import_common37.Param)("id", import_common37.ParseIntPipe))
+  (0, import_common38.Post)("commissioning/sessions/:id/managed-access/retry"),
+  __decorateParam(0, (0, import_common38.Param)("id", import_common38.ParseIntPipe))
 ], WagoUpdatesController.prototype, "retry", 1);
 __decorateClass([
-  (0, import_common37.Post)("commissioning/sessions/:id/managed-access/restore"),
-  __decorateParam(0, (0, import_common37.Param)("id", import_common37.ParseIntPipe)),
-  __decorateParam(1, (0, import_common37.Body)()),
-  __decorateParam(2, (0, import_common37.Req)())
+  (0, import_common38.Post)("commissioning/sessions/:id/managed-access/restore"),
+  __decorateParam(0, (0, import_common38.Param)("id", import_common38.ParseIntPipe)),
+  __decorateParam(1, (0, import_common38.Body)()),
+  __decorateParam(2, (0, import_common38.Req)())
 ], WagoUpdatesController.prototype, "restore", 1);
 WagoUpdatesController = __decorateClass([
-  (0, import_common37.Controller)("wago"),
+  (0, import_common38.Controller)("wago"),
   (0, import_plugins_backend_sdk19.Auth)("system.settings.manage"),
-  __decorateParam(0, (0, import_common37.Inject)(WagoManagedRuntimeService)),
-  __decorateParam(1, (0, import_common37.Inject)(WagoNetworkChangeService))
+  __decorateParam(0, (0, import_common38.Inject)(WagoManagedRuntimeService)),
+  __decorateParam(1, (0, import_common38.Inject)(WagoNetworkChangeService))
 ], WagoUpdatesController);
 
 // backend/wago-live-updates.service.ts
-var import_common38 = require("@nestjs/common");
+var import_common39 = require("@nestjs/common");
 var import_plugins_backend_sdk20 = require("@attraccess/plugins-backend-sdk");
 var WagoLiveUpdatesService = class {
   constructor(context, wago, commissioning, diagnostics, managed, network) {
@@ -16261,14 +16621,14 @@ var WagoLiveUpdatesService = class {
         topic,
         identifier: kind === "none" ? "none" : "required",
         authorize: async ({ identifier: identifier3 }, user) => {
-          if (!user.effectivePermissions?.has(permission)) throw new import_common38.ForbiddenException();
+          if (!user.effectivePermissions?.has(permission)) throw new import_common39.ForbiddenException();
           if (kind === "none") return;
           const pattern = kind === "revisions" ? /^[1-9]\d*:(0|[1-9]\d*)$/ : /^[1-9]\d*$/;
-          if (!pattern.test(identifier3 ?? "")) throw new import_common38.NotFoundException();
+          if (!pattern.test(identifier3 ?? "")) throw new import_common39.NotFoundException();
           const [id, offset = 0] = identifier3.split(":").map(Number);
-          if (!Number.isSafeInteger(id) || !Number.isSafeInteger(offset)) throw new import_common38.NotFoundException();
+          if (!Number.isSafeInteger(id) || !Number.isSafeInteger(offset)) throw new import_common39.NotFoundException();
           const exists = kind === "session" ? await this.context.getRepository(WagoCommissioningSession).existsBy({ id }) : await this.context.getRepository(WagoController).existsBy({ id });
-          if (!exists) throw new import_common38.NotFoundException();
+          if (!exists) throw new import_common39.NotFoundException();
         },
         source: ({ identifier: identifier3 }) => this.sample(`${topic}:${identifier3 ?? ""}`, interval, () => {
           const [id = 0, offset = 0] = (identifier3 ?? "").split(":").map(Number);
@@ -16306,13 +16666,13 @@ var WagoLiveUpdatesService = class {
   }
 };
 WagoLiveUpdatesService = __decorateClass([
-  (0, import_common38.Injectable)(),
-  __decorateParam(0, (0, import_common38.Inject)(/* @__PURE__ */ Symbol.for("attraccess.plugin.context"))),
-  __decorateParam(1, (0, import_common38.Inject)(WagoService)),
-  __decorateParam(2, (0, import_common38.Inject)(WagoCommissioningService)),
-  __decorateParam(3, (0, import_common38.Inject)(WagoDiagnosticsService)),
-  __decorateParam(4, (0, import_common38.Inject)(WagoManagedRuntimeService)),
-  __decorateParam(5, (0, import_common38.Inject)(WagoNetworkChangeService))
+  (0, import_common39.Injectable)(),
+  __decorateParam(0, (0, import_common39.Inject)(/* @__PURE__ */ Symbol.for("attraccess.plugin.context"))),
+  __decorateParam(1, (0, import_common39.Inject)(WagoService)),
+  __decorateParam(2, (0, import_common39.Inject)(WagoCommissioningService)),
+  __decorateParam(3, (0, import_common39.Inject)(WagoDiagnosticsService)),
+  __decorateParam(4, (0, import_common39.Inject)(WagoManagedRuntimeService)),
+  __decorateParam(5, (0, import_common39.Inject)(WagoNetworkChangeService))
 ], WagoLiveUpdatesService);
 
 // backend/plugin.ts