@attraccess/plugin-wago 0.1.0-nightly.953.1 → 0.1.0-nightly.954.1

package/dist/index.js

@@ -661,9 +661,9 @@ var require_vary = __commonJS({
       if (!field2) {
         throw new TypeError("field argument is required");
       }
-      var fields = !Array.isArray(field2) ? parse(String(field2)) : field2;
-      for (var j = 0; j < fields.length; j++) {
-        if (!FIELD_NAME_REGEXP.test(fields[j])) {
+      var fields2 = !Array.isArray(field2) ? parse(String(field2)) : field2;
+      for (var j = 0; j < fields2.length; j++) {
+        if (!FIELD_NAME_REGEXP.test(fields2[j])) {
           throw new TypeError("field argument contains an invalid header name");
         }
       }
@@ -672,14 +672,14 @@ var require_vary = __commonJS({
       }
       var val = header;
       var vals = parse(header.toLowerCase());
-      if (fields.indexOf("*") !== -1 || vals.indexOf("*") !== -1) {
+      if (fields2.indexOf("*") !== -1 || vals.indexOf("*") !== -1) {
         return "*";
       }
-      for (var i = 0; i < fields.length; i++) {
-        var fld = fields[i].toLowerCase();
+      for (var i = 0; i < fields2.length; i++) {
+        var fld = fields2[i].toLowerCase();
         if (vals.indexOf(fld) === -1) {
           vals.push(fld);
-          val = val ? val + ", " + fields[i] : fields[i];
+          val = val ? val + ", " + fields2[i] : fields2[i];
         }
       }
       return val;
@@ -2092,11 +2092,11 @@ var require_codes = __commonJS({
 var require_statuses = __commonJS({
   "../../../node_modules/.pnpm/statuses@2.0.2/node_modules/statuses/index.js"(exports2, module2) {
     "use strict";
-    var codes = require_codes();
+    var codes2 = require_codes();
     module2.exports = status;
-    status.message = codes;
-    status.code = createMessageToStatusCodeMap(codes);
-    status.codes = createStatusCodeList(codes);
+    status.message = codes2;
+    status.code = createMessageToStatusCodeMap(codes2);
+    status.codes = createStatusCodeList(codes2);
     status.redirect = {
       300: true,
       301: true,
@@ -2116,17 +2116,17 @@ var require_statuses = __commonJS({
       503: true,
       504: true
     };
-    function createMessageToStatusCodeMap(codes2) {
+    function createMessageToStatusCodeMap(codes3) {
       var map = {};
-      Object.keys(codes2).forEach(function forEachCode(code) {
-        var message = codes2[code];
+      Object.keys(codes3).forEach(function forEachCode(code) {
+        var message = codes3[code];
         var status2 = Number(code);
         map[message.toLowerCase()] = status2;
       });
       return map;
     }
-    function createStatusCodeList(codes2) {
-      return Object.keys(codes2).map(function mapCode(code) {
+    function createStatusCodeList(codes3) {
+      return Object.keys(codes3).map(function mapCode(code) {
         return Number(code);
       });
     }
@@ -2358,8 +2358,8 @@ var require_http_errors = __commonJS({
         Object.defineProperty(func, "name", desc);
       }
     }
-    function populateConstructorExports(exports3, codes, HttpError) {
-      codes.forEach(function forEachCode(code) {
+    function populateConstructorExports(exports3, codes2, HttpError) {
+      codes2.forEach(function forEachCode(code) {
         var CodeError;
         var name = toIdentifier(statuses.message[code]);
         switch (codeClass(code)) {
@@ -36301,7 +36301,7 @@ var require_multipart = __commonJS({
         const fieldsLimit = limits2 && typeof limits2.fields === "number" ? limits2.fields : Infinity;
         const partsLimit = limits2 && typeof limits2.parts === "number" ? limits2.parts : Infinity;
         let parts = -1;
-        let fields = 0;
+        let fields2 = 0;
         let files = 0;
         let skipPart = false;
         this._fileEndsLeft = 0;
@@ -36387,7 +36387,7 @@ var require_multipart = __commonJS({
               }
             );
           } else {
-            if (fields === fieldsLimit) {
+            if (fields2 === fieldsLimit) {
               if (!hitFieldsLimit) {
                 hitFieldsLimit = true;
                 this.emit("fieldsLimit");
@@ -36395,7 +36395,7 @@ var require_multipart = __commonJS({
               skipPart = true;
               return;
             }
-            ++fields;
+            ++fields2;
             if (this.listenerCount("field") === 0) {
               skipPart = true;
               return;
@@ -38635,7 +38635,7 @@ var require_destroy = __commonJS({
 var require_errors = __commonJS({
   "../../../node_modules/.pnpm/readable-stream@3.6.2/node_modules/readable-stream/errors.js"(exports2, module2) {
     "use strict";
-    var codes = {};
+    var codes2 = {};
     function createErrorType(code, message, Base) {
       if (!Base) {
         Base = Error;
@@ -38654,7 +38654,7 @@ var require_errors = __commonJS({
       }
       NodeError.prototype.name = Base.name;
       NodeError.prototype.code = code;
-      codes[code] = NodeError;
+      codes2[code] = NodeError;
     }
     function oneOf(expected, thing) {
       if (Array.isArray(expected)) {
@@ -38727,7 +38727,7 @@ var require_errors = __commonJS({
       return "Unknown encoding: " + arg;
     }, TypeError);
     createErrorType("ERR_STREAM_UNSHIFT_AFTER_END_EVENT", "stream.unshift() after end event");
-    module2.exports.codes = codes;
+    module2.exports.codes = codes2;
   }
 });
 
@@ -41732,11 +41732,11 @@ var require_multer = __commonJS({
       this.defParamCharset = options.defParamCharset || "latin1";
       this.fileFilter = options.fileFilter || allowAll;
     }
-    Multer.prototype._makeMiddleware = function(fields, fileStrategy) {
+    Multer.prototype._makeMiddleware = function(fields2, fileStrategy) {
       function setup() {
         var fileFilter = this.fileFilter;
         var filesLeft = /* @__PURE__ */ Object.create(null);
-        fields.forEach(function(field2) {
+        fields2.forEach(function(field2) {
           if (typeof field2.maxCount === "number") {
             filesLeft[field2.name] = field2.maxCount;
           } else {
@@ -41767,8 +41767,8 @@ var require_multer = __commonJS({
     Multer.prototype.array = function(name, maxCount) {
       return this._makeMiddleware([{ name, maxCount }], "ARRAY");
     };
-    Multer.prototype.fields = function(fields) {
-      return this._makeMiddleware(fields, "OBJECT");
+    Multer.prototype.fields = function(fields2) {
+      return this._makeMiddleware(fields2, "OBJECT");
     };
     Multer.prototype.none = function() {
       return this._makeMiddleware([], "NONE");
@@ -51633,7 +51633,7 @@ module.exports = __toCommonJS(plugin_exports);
 
 // backend/wago.controller.ts
 var import_common8 = require("@nestjs/common");
-var import_plugins_backend_sdk12 = require("@attraccess/plugins-backend-sdk");
+var import_plugins_backend_sdk13 = require("@attraccess/plugins-backend-sdk");
 
 // backend/wago.service.ts
 var import_node_crypto3 = require("node:crypto");
@@ -52047,6 +52047,16 @@ var WAGO_PRESETS = [
     description: "A monitored digital input foundation."
   }
 ];
+function applyPreset(snapshot, application) {
+  const preset = application && WAGO_PRESETS.find((item) => item.id === application.presetId);
+  if (!preset) throw new Error("unknown WAGO preset");
+  const channel = presetChannel(application);
+  const existingIndex = snapshot.logicalChannels.findIndex((item) => item.id === application.channelId);
+  const logicalChannels = [...snapshot.logicalChannels];
+  if (existingIndex === -1) logicalChannels.push(channel);
+  else logicalChannels[existingIndex] = channel;
+  return { ...snapshot, logicalChannels };
+}
 function canonicalSnapshot(snapshot) {
   if (!snapshot || typeof snapshot !== "object" || Array.isArray(snapshot))
     throw new Error("configuration snapshot must be an object");
@@ -52066,7 +52076,7 @@ function parseConfigurationReport(value) {
   if (!Number.isSafeInteger(report.revision) || report.revision < 1 || typeof report.contentHash !== "string" || !report.contentHash.trim() || report.errors !== void 0 && !Array.isArray(report.errors))
     return null;
   const errors = report.errors ?? [];
-  if (!errors.every(isConfigurationValidationError)) return null;
+  if (!Array.isArray(errors) || !errors.every(isConfigurationValidationError)) return null;
   return { revision: report.revision, contentHash: report.contentHash, errors };
 }
 function validateSnapshot(snapshot) {
@@ -52097,7 +52107,7 @@ function validateSnapshot(snapshot) {
     exactKeys(point, path, ["id", "hardwareProfile", "channel"], errors);
     addId(point.id, `${path}.id`, pointIds, errors);
     enumValue(point.hardwareProfile, `${path}.hardwareProfile`, HARDWARE_PROFILES, errors);
-    if (!Number.isSafeInteger(point.channel) || point.channel < 0)
+    if (typeof point.channel !== "number" || !Number.isSafeInteger(point.channel) || point.channel < 0)
       errors.push({
         path: `${path}.channel`,
         code: "invalid_channel",
@@ -52337,6 +52347,35 @@ function validateProfile(value, capabilities, path, errors) {
     })
   );
 }
+function presetChannel(application) {
+  const base = {
+    id: application.channelId,
+    physicalPointId: application.physicalPointId,
+    profile: application.presetId,
+    disconnectPolicy: { mode: application.presetId === "generic-monitored-input" ? "hold" : "immediate" }
+  };
+  switch (application.presetId) {
+    case "metered-switched-load":
+      return { ...base, capabilities: ["output", "measurement"], measurement: { unit: "watt", scale: 1, offset: 0 } };
+    case "pulsed-lock-bank":
+      return { ...base, capabilities: ["output", "pulse"], pulse: { durationMs: 500 } };
+    case "guarded-enable-request":
+      if (!application.guardChannelId) throw new Error("guarded enable requests require a guard channel");
+      return {
+        ...base,
+        capabilities: ["output", "guard"],
+        guard: { channelId: application.guardChannelId, when: "on" }
+      };
+    case "generic-monitored-input":
+      return { ...base, capabilities: ["input"] };
+    case "generic-digital-output":
+      return {
+        ...base,
+        capabilities: application.feedbackChannelId ? ["output", "feedback"] : ["output"],
+        ...application.feedbackChannelId ? { feedback: { channelId: application.feedbackChannelId, expected: "match", timeoutMs: 1e3 } } : {}
+      };
+  }
+}
 function referenceError(path, type, id) {
   return { path, code: "missing_reference", message: `${type} ${String(id)} does not exist in this snapshot` };
 }
@@ -52348,6 +52387,143 @@ function sortValue(value) {
   );
 }
 
+// backend/configuration-digital.ts
+var DIGITAL_TERMINALS = [
+  ...Array.from({ length: 4 }, (_, channel) => ({ channel, label: `DO${channel + 1}`, direction: "output" })),
+  ...Array.from({ length: 8 }, (_, index) => ({
+    channel: index + 4,
+    label: `DI${index + 1}`,
+    direction: "input"
+  }))
+];
+
+// backend/configuration-editor.ts
+function editorMetadata(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("editor metadata must be an object");
+  const { names, presets } = value;
+  if (!names || typeof names !== "object" || Array.isArray(names) || !Object.values(names).every((name) => typeof name === "string" && name.trim().length > 0 && name.length <= 120))
+    throw new Error("channel names must contain 1\u2013120 characters");
+  if (!Array.isArray(presets) || !presets.every(
+    (preset) => preset && WAGO_PRESETS.some((item) => item.id === preset.presetId) && typeof preset.channelId === "string" && typeof preset.physicalPointId === "string"
+  ))
+    throw new Error("preset provenance must contain valid preset applications");
+  return { names, presets };
+}
+function validateEditorSnapshot(snapshot) {
+  const errors = validateSnapshot(snapshot);
+  if (errors.length) return errors;
+  const value = snapshot;
+  const terminals = /* @__PURE__ */ new Set();
+  const assignedPoints = /* @__PURE__ */ new Set();
+  value.physicalPoints.forEach((point, index) => {
+    if (point.hardwareProfile !== "751-9301") return;
+    if (!DIGITAL_TERMINALS.some((terminal) => terminal.channel === point.channel))
+      errors.push({
+        path: `physicalPoints[${index}].channel`,
+        code: "unsupported_terminal",
+        message: "select DO1\u2013DO4 or DI1\u2013DI8"
+      });
+    if (terminals.has(point.channel))
+      errors.push({
+        path: `physicalPoints[${index}].channel`,
+        code: "duplicate_terminal",
+        message: "each digital terminal can have only one physical assignment"
+      });
+    terminals.add(point.channel);
+  });
+  value.logicalChannels.forEach((channel, index) => {
+    const path = `logicalChannels[${index}]`;
+    const point = value.physicalPoints.find((point2) => point2.id === channel.physicalPointId);
+    if (point?.hardwareProfile === "751-9301") {
+      const terminal = DIGITAL_TERMINALS.find((terminal2) => terminal2.channel === point.channel);
+      if (terminal && (!channel.capabilities.includes(terminal.direction) || channel.capabilities.includes(terminal.direction === "input" ? "output" : "input")))
+        errors.push({
+          path: `${path}.physicalPointId`,
+          code: "direction_mismatch",
+          message: `${terminal.label} requires an ${terminal.direction} channel`
+        });
+      if (assignedPoints.has(point.id))
+        errors.push({
+          path: `${path}.physicalPointId`,
+          code: "duplicate_assignment",
+          message: "each digital terminal can be assigned to only one logical channel"
+        });
+      assignedPoints.add(point.id);
+    }
+    for (const capability of ["pulse", "guard", "feedback"]) {
+      if (channel.capabilities.includes(capability) && !channel[capability])
+        errors.push({
+          path: `${path}.${capability}`,
+          code: "required_field",
+          message: `configure ${capability} settings for this capability`
+        });
+    }
+    if (channel.guard) {
+      const input = value.logicalChannels.find((item) => item.id === channel.guard?.channelId);
+      if (!input || input.id === channel.id || !input.capabilities.includes("input"))
+        errors.push({
+          path: `${path}.guard.channelId`,
+          code: "invalid_guard_channel",
+          message: "guard must reference a distinct input channel"
+        });
+    }
+  });
+  return errors;
+}
+function previewConfigurationPreset(snapshot, application) {
+  const errors = validateSnapshot(snapshot);
+  if (errors.length) throw new Error(errors.map((error) => `${error.path}: ${error.message}`).join("; "));
+  const candidate = applyPreset(snapshot, application);
+  return {
+    draftHash: configurationHash(snapshot),
+    snapshot: candidate,
+    diff: configurationDiff(snapshot, candidate),
+    errors: validateEditorSnapshot(candidate)
+  };
+}
+function selectPresetChanges(snapshot, application, paths, expectedHash) {
+  const preview = previewConfigurationPreset(snapshot, application);
+  if (expectedHash !== preview.draftHash) throw new Error("draft changed; preview the preset again");
+  if (!Array.isArray(paths) || paths.some((path) => !preview.diff.some((change) => change.path === path)))
+    throw new Error("unknown preset change");
+  const selected = new Set(paths);
+  function copy(previous, current, path) {
+    if (selected.has(path)) return current;
+    if (Array.isArray(previous) && Array.isArray(current))
+      return Array.from(
+        { length: Math.max(previous.length, current.length) },
+        (_, index) => copy(previous[index], current[index], `${path}[${index}]`)
+      ).filter((item) => item !== void 0);
+    if (previous && current && typeof previous === "object" && typeof current === "object" && !Array.isArray(previous) && !Array.isArray(current)) {
+      const before = previous;
+      const after = current;
+      return Object.fromEntries(
+        [.../* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])].map((key) => [key, copy(before[key], after[key], `${path}.${key}`)]).filter(([, value]) => value !== void 0)
+      );
+    }
+    return previous;
+  }
+  const candidate = copy(snapshot, preview.snapshot, "$");
+  const errors = validateEditorSnapshot(candidate);
+  if (errors.length) throw new Error(errors.map((error) => `${error.path}: ${error.message}`).join("; "));
+  return candidate;
+}
+function configurationImpacts(previous, current) {
+  return (previous?.logicalChannels ?? []).flatMap((channel) => {
+    const next = current.logicalChannels.find((item) => item.id === channel.id);
+    const oldPoint = previous?.physicalPoints.find((point) => point.id === channel.physicalPointId);
+    const newPoint = current.physicalPoints.find((point) => point.id === next?.physicalPointId);
+    if (next && configurationHash({ channel, point: oldPoint }) === configurationHash({ channel: next, point: newPoint }))
+      return [];
+    return [
+      {
+        channelId: channel.id,
+        message: next ? "Channel behavior or physical assignment changed. Existing flow commands may behave differently." : "Channel removed. Existing flow references may fail."
+      }
+    ];
+  });
+}
+
 // backend/wago-configuration-draft.entity.ts
 var import_plugins_backend_sdk4 = require("@attraccess/plugins-backend-sdk");
 var WagoConfigurationDraft = class {
@@ -52382,14 +52558,42 @@ WagoConfigurationDraft = __decorateClass([
   (0, import_plugins_backend_sdk4.Entity)({ name: "plugin_wago_configuration_drafts" })
 ], WagoConfigurationDraft);
 
-// backend/wago-configuration-revision.entity.ts
+// backend/configuration-flow-references.ts
 var import_plugins_backend_sdk5 = require("@attraccess/plugins-backend-sdk");
+async function configurationFlowImpacts(context, controllerId, previous, current) {
+  const impacts = configurationImpacts(previous, current);
+  const affected = new Set(impacts.map((impact) => impact.channelId));
+  for (const channel of previous?.logicalChannels ?? []) {
+    if (!affected.has(channel.id) && (channel.guard && affected.has(channel.guard.channelId) || channel.feedback && affected.has(channel.feedback.channelId))) {
+      affected.add(channel.id);
+      impacts.push({ channelId: channel.id, message: "An input used by this channel as a guard or feedback changed." });
+    }
+  }
+  const nodes = await context.dataSource.getRepository(import_plugins_backend_sdk5.ResourceFlowNode).createQueryBuilder("node").select(["node.id", "node.resourceId", "node.type", "node.data"]).where("node.type LIKE :type", { type: "plugin.wago.%" }).andWhere("node.data ->> 'controllerId' = :controllerId", { controllerId }).getMany();
+  for (const node of nodes) {
+    const channelId = node.data?.channelId;
+    if (String(node.type) !== "plugin.wago.command" || typeof channelId !== "string" || !channelId) continue;
+    const message = "Publication changes the configuration revision. Reopen and save this channel's command nodes after it applies.";
+    const impact = impacts.find((item) => item.channelId === channelId);
+    if (impact) {
+      if (!impact.message.includes(message)) impact.message += ` ${message}`;
+    } else impacts.push({ channelId, message });
+  }
+  return impacts.map((impact) => ({
+    ...impact,
+    references: nodes.filter((node) => node.data?.channelId === impact.channelId).map((node) => ({ resourceId: node.resourceId, nodeId: node.id, nodeType: node.type }))
+  }));
+}
+
+// backend/wago-configuration-revision.entity.ts
+var import_plugins_backend_sdk6 = require("@attraccess/plugins-backend-sdk");
 var WagoConfigurationRevision = class {
   constructor() {
     __publicField(this, "id");
     __publicField(this, "controllerId");
     __publicField(this, "revision");
     __publicField(this, "snapshot");
+    __publicField(this, "presetProvenance");
     __publicField(this, "contentHash");
     __publicField(this, "state");
     __publicField(this, "rejectionErrors");
@@ -52398,39 +52602,42 @@ var WagoConfigurationRevision = class {
   }
 };
 __decorateClass([
-  (0, import_plugins_backend_sdk5.PrimaryGeneratedColumn)({ type: "integer" })
+  (0, import_plugins_backend_sdk6.PrimaryGeneratedColumn)({ type: "integer" })
 ], WagoConfigurationRevision.prototype, "id", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk5.Column)({ type: "integer", name: "controller_id" })
+  (0, import_plugins_backend_sdk6.Column)({ type: "integer", name: "controller_id" })
 ], WagoConfigurationRevision.prototype, "controllerId", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk5.Column)({ type: "integer" })
+  (0, import_plugins_backend_sdk6.Column)({ type: "integer" })
 ], WagoConfigurationRevision.prototype, "revision", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk5.Column)({ type: "text" })
+  (0, import_plugins_backend_sdk6.Column)({ type: "text" })
 ], WagoConfigurationRevision.prototype, "snapshot", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk5.Column)({ type: "varchar", name: "content_hash" })
+  (0, import_plugins_backend_sdk6.Column)({ type: "text", name: "preset_provenance", nullable: true })
+], WagoConfigurationRevision.prototype, "presetProvenance", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "content_hash" })
 ], WagoConfigurationRevision.prototype, "contentHash", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk5.Column)({ type: "varchar" })
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar" })
 ], WagoConfigurationRevision.prototype, "state", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk5.Column)({ type: "text", name: "rejection_errors", nullable: true })
+  (0, import_plugins_backend_sdk6.Column)({ type: "text", name: "rejection_errors", nullable: true })
 ], WagoConfigurationRevision.prototype, "rejectionErrors", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk5.Column)({ type: "varchar", name: "published_at" })
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "published_at" })
 ], WagoConfigurationRevision.prototype, "publishedAt", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk5.Column)({ type: "varchar", name: "reported_at", nullable: true })
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "reported_at", nullable: true })
 ], WagoConfigurationRevision.prototype, "reportedAt", 2);
 WagoConfigurationRevision = __decorateClass([
-  (0, import_plugins_backend_sdk5.Entity)({ name: "plugin_wago_configuration_revisions" })
+  (0, import_plugins_backend_sdk6.Entity)({ name: "plugin_wago_configuration_revisions" })
 ], WagoConfigurationRevision);
 
 // backend/wago-command-handler.ts
 var import_node_crypto2 = require("node:crypto");
-var import_plugins_backend_sdk6 = require("@attraccess/plugins-backend-sdk");
+var import_plugins_backend_sdk7 = require("@attraccess/plugins-backend-sdk");
 var DEFAULT_COMMAND_TIMEOUT_SECONDS = 30;
 var MAX_COMMAND_TIMEOUT_SECONDS = 300;
 var WagoCommandError = class extends Error {
@@ -52457,7 +52664,8 @@ var WagoCommandHandler = class {
       const draft = await this.dependencies.context.getRepository(WagoConfigurationDraft).findOneBy({ controllerId });
       try {
         const draftMatchesAppliedRevision = typeof draft?.snapshot === "string" && configurationHash(JSON.parse(draft.snapshot)) === revision?.contentHash;
-        const storedNames = draftMatchesAppliedRevision && JSON.parse(draft?.presetProvenance ?? "null")?.editor?.names;
+        const provenance = revision?.presetProvenance ?? (draftMatchesAppliedRevision ? draft?.presetProvenance : null);
+        const storedNames = JSON.parse(provenance ?? "null")?.editor?.names;
         if (storedNames && typeof storedNames === "object" && !Array.isArray(storedNames)) names = storedNames;
       } catch {
       }
@@ -52601,6 +52809,7 @@ var WagoCommandHandler = class {
       throw new WagoCommandError(`WAGO controller ${controllerId} has no MQTT server`, "transport-dispatch");
     const settings = await this.dependencies.getSettings();
     const id = (0, import_node_crypto2.randomUUID)();
+    this.dependencies.onCommand?.(controllerId, channelId, id);
     const command = JSON.stringify({
       id,
       expiresAt: new Date(Date.now() + acknowledgementTimeoutSeconds * 1e3).toISOString(),
@@ -52618,6 +52827,7 @@ var WagoCommandHandler = class {
         { qos: 1, retain: false }
       );
     } catch (error) {
+      this.dependencies.onCommandFailure?.(id, "dispatch-failed");
       const dispatchError = new WagoCommandError(
         `Failed to publish WAGO command: ${String(error)}`,
         "transport-dispatch"
@@ -52657,7 +52867,7 @@ var WagoCommandHandler = class {
     }
   }
   async references(controllerId, channelId, resourceId) {
-    const nodes = await this.dependencies.context.dataSource.getRepository(import_plugins_backend_sdk6.ResourceFlowNode).createQueryBuilder("node").select(["node.id", "node.resourceId"]).where("node.type = :type", { type: "plugin.wago.command" }).andWhere("node.resourceId <> :resourceId", { resourceId }).andWhere("node.data ->> 'controllerId' = :controllerId", { controllerId }).andWhere("node.data ->> 'channelId' = :channelId", { channelId }).getMany();
+    const nodes = await this.dependencies.context.dataSource.getRepository(import_plugins_backend_sdk7.ResourceFlowNode).createQueryBuilder("node").select(["node.id", "node.resourceId"]).where("node.type = :type", { type: "plugin.wago.command" }).andWhere("node.resourceId <> :resourceId", { resourceId }).andWhere("node.data ->> 'controllerId' = :controllerId", { controllerId }).andWhere("node.data ->> 'channelId' = :channelId", { channelId }).getMany();
     return nodes.map((node) => `resource ${node.resourceId} / node ${node.id}`);
   }
   parse(config) {
@@ -52739,6 +52949,8 @@ var WagoCommandHandler = class {
     pending.resolve();
   }
   reject(id, error) {
+    if (error instanceof WagoCommandError && error.kind === "acknowledgement-timeout")
+      this.dependencies.onCommandFailure?.(id, "timeout");
     const pending = this.pending.get(id);
     if (!pending) return;
     this.pending.delete(id);
@@ -52757,6 +52969,349 @@ function positiveInteger(value) {
   return Number.isSafeInteger(value) && value > 0 ? value : void 0;
 }
 
+// backend/diagnostics-envelope.ts
+var DIAGNOSTIC_CATEGORIES = [
+  "heartbeat",
+  "state",
+  "measurements",
+  "faults",
+  "acknowledgements",
+  "configuration/reported"
+];
+var MILLI_UNITS = ["milliampere", "millivolt", "milliwatt", "milliwatt-hour", "millipercent"];
+var CANONICAL_UNITS = [...MILLI_UNITS, "ampere", "volt", "watt", "watt-hour", "percent"];
+function sourceTime(value) {
+  if (typeof value !== "string") return null;
+  const match = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.\d{1,3})?(Z|([+-])(\d{2}):(\d{2}))$/.exec(value);
+  if (!match || Number(match[4] ?? 0) > 23 || Number(match[5] ?? 0) > 59) return null;
+  const time = Date.parse(value);
+  if (!Number.isFinite(time)) return null;
+  const offset = match[2] === "Z" ? 0 : (match[3] === "+" ? 1 : -1) * (Number(match[4]) * 60 + Number(match[5])) * 6e4;
+  return new Date(time + offset).toISOString().slice(0, 19) === match[1] ? time : null;
+}
+function emptyStream() {
+  return { lastSourceTime: 0, retiredStreams: [], watermarks: {}, sequenceGaps: 0, trackingExhausted: false };
+}
+function canonicalEnvelope(data, category) {
+  return "timestamp" in data || "streamId" in data || category !== "heartbeat" && "sequence" in data;
+}
+function validEnvelope(data, now) {
+  const time = sourceTime(data.timestamp);
+  return time !== null && time <= now && typeof data.streamId === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(data.streamId) && Number.isSafeInteger(data.sequence) && data.sequence >= 1;
+}
+function admitEnvelope(state, data, category, now) {
+  const stream = data.streamId.toLowerCase();
+  const timestamp = sourceTime(data.timestamp);
+  const sequence = data.sequence;
+  if (state.retiredStreams.includes(stream) || state.trackingExhausted) return "rejected";
+  const restart = state.activeStream !== stream;
+  if (restart) {
+    if (!(category === "heartbeat" || category === "state" && data.connected === true) || now - timestamp > 9e4 || timestamp < state.lastSourceTime)
+      return "rejected";
+    if (state.retiredStreams.length >= 16) {
+      state.trackingExhausted = true;
+      return "rejected";
+    }
+  }
+  const previous = restart ? void 0 : state.watermarks[category];
+  if (previous && (sequence <= previous.sequence || timestamp < previous.timestamp)) return "rejected";
+  if (restart) {
+    if (state.activeStream) state.retiredStreams.push(state.activeStream);
+    state.activeStream = stream;
+    state.watermarks = {};
+  }
+  state.sequenceGaps = Math.min(
+    Number.MAX_SAFE_INTEGER,
+    state.sequenceGaps + Math.max(0, sequence - (previous?.sequence ?? 0) - 1)
+  );
+  state.watermarks[category] = { sequence, timestamp };
+  state.lastSourceTime = Math.max(state.lastSourceTime, timestamp);
+  return restart ? "restart" : "accepted";
+}
+
+// backend/diagnostics-validation.ts
+var fields = new Set(
+  "version physicalPoints logicalChannels id physicalPointId hardwareProfile channel profile capabilities disconnectPolicy mode timeoutMs range minimum maximum pulse durationMs guard channelId when feedback expected measurement unit scale offset".split(
+    " "
+  )
+);
+var codes = new Set(
+  "invalid_snapshot unsupported_version invalid_channel invalid_collection invalid_object unknown_field required_field invalid_id duplicate_id unsupported_value invalid_capabilities unsupported_capability duplicate_capability unsupported_field invalid_range invalid_duration invalid_measurement invalid_feedback_channel invalid_timeout missing_capability unknown_reference invalid_reference content_hash_mismatch revision_mismatch hardware_unavailable".split(
+    " "
+  )
+);
+function safeValidationSummaries(value) {
+  if (!Array.isArray(value)) return [];
+  return value.slice(0, 50).map((item) => {
+    const error = item && typeof item === "object" ? item : {};
+    const path = typeof error.path === "string" && error.path.length <= 256 ? error.path : "$";
+    const tokens = path.replace(/\[(\d{1,5})\]/g, ".$1").split(".");
+    const safe = tokens[0] === "$" && tokens.slice(1).every((token) => fields.has(token) || /^\d{1,5}$/.test(token));
+    return {
+      path: safe ? path : "$",
+      code: codes.has(error.code) ? error.code : "validation_error"
+    };
+  });
+}
+
+// backend/diagnostics-store.ts
+function freshness(timestamp, now = Date.now(), maxAge = 9e4) {
+  if (!timestamp) return "missing";
+  const time = sourceTime(timestamp);
+  if (time === null) return "invalid";
+  if (time > now) return "future";
+  return now - time > maxAge ? "stale" : "fresh";
+}
+var MAX_CONTROLLERS = 256;
+var MAX_CHANNELS = 256;
+var RETENTION_MS = 15 * 6e4;
+var faultCodes = /* @__PURE__ */ new Set([
+  "measurement_read_failed",
+  "device_write_failed",
+  "feedback_mismatch",
+  "feedback_read_failed"
+]);
+function identifier(value) {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= 256 && !Array.from(value).some((character) => character.charCodeAt(0) < 32);
+}
+var WagoDiagnosticsStore = class {
+  constructor(now = Date.now) {
+    __publicField(this, "now", now);
+    __publicField(this, "controllers", /* @__PURE__ */ new Map());
+    __publicField(this, "commands", /* @__PURE__ */ new Map());
+  }
+  prune() {
+    const cutoff = this.now() - RETENTION_MS;
+    for (const [id, state] of this.controllers) if (state.touched < cutoff) this.controllers.delete(id);
+    for (const [id, command] of this.commands) if (command.at < cutoff) this.commands.delete(id);
+  }
+  read(id) {
+    this.prune();
+    const state = this.controllers.get(id);
+    const copy = state ? JSON.parse(JSON.stringify(state)) : {
+      touched: 0,
+      inputs: {},
+      outputs: {},
+      measurements: {},
+      cumulativeMeasurements: {},
+      faults: {},
+      acknowledgements: {},
+      events: [],
+      ...emptyStream()
+    };
+    const cutoff = this.now() - RETENTION_MS;
+    for (const field2 of [
+      "inputs",
+      "outputs",
+      "measurements",
+      "cumulativeMeasurements",
+      "faults",
+      "acknowledgements"
+    ]) {
+      copy[field2] = Object.assign(/* @__PURE__ */ Object.create(null), copy[field2]);
+    }
+    for (const collection2 of [
+      copy.cumulativeMeasurements,
+      copy.inputs,
+      copy.outputs,
+      copy.measurements,
+      copy.faults,
+      copy.acknowledgements
+    ]) {
+      for (const key of Object.keys(collection2))
+        if (Date.parse(collection2[key].receivedAt) < cutoff) delete collection2[key];
+    }
+    copy.events = copy.events.filter((event) => Date.parse(event.receivedAt) >= cutoff);
+    if (copy.rejection && Date.parse(copy.rejection.receivedAt) < cutoff) delete copy.rejection;
+    return copy;
+  }
+  command(controllerId, channelId, id) {
+    this.prune();
+    if (!identifier(channelId) || !identifier(id)) return;
+    if (!this.controllers.has(controllerId) && this.controllers.size >= MAX_CONTROLLERS) return;
+    const state = this.read(controllerId);
+    state.touched = this.now();
+    this.controllers.set(controllerId, state);
+    const oldest = this.commands.keys().next().value;
+    if (this.commands.size >= 1024 && oldest !== void 0) this.commands.delete(oldest);
+    this.commands.set(id, { controllerId, channelId, at: this.now() });
+  }
+  commandFailed(id, status) {
+    this.prune();
+    const command = this.commands.get(id);
+    if (!command) return;
+    this.commands.delete(id);
+    const state = this.controllers.get(command.controllerId);
+    if (!state) return;
+    state.touched = this.now();
+    state.acknowledgements[command.channelId] = { id, status, receivedAt: new Date(this.now()).toISOString() };
+    while (Object.keys(state.acknowledgements).length > MAX_CHANNELS)
+      delete state.acknowledgements[Object.keys(state.acknowledgements)[0]];
+  }
+  canTrack(id) {
+    this.prune();
+    return this.controllers.has(id) || this.controllers.size < MAX_CONTROLLERS || [...this.controllers.values()].some((state) => !state.activeStream);
+  }
+  ingest(id, kind, payload) {
+    this.prune();
+    if (payload.length > 65536) return false;
+    let data;
+    try {
+      data = JSON.parse(payload.toString("utf8"));
+    } catch {
+      return false;
+    }
+    if (!data || typeof data !== "object" || Array.isArray(data)) return false;
+    if (!DIAGNOSTIC_CATEGORIES.includes(kind)) return false;
+    const canonical = canonicalEnvelope(data, kind);
+    if (canonical && !validEnvelope(data, this.now())) return false;
+    const isObject = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+    if (canonical && kind === "state" && data.readiness !== void 0 && (!isObject(data.readiness) || data.readiness.hardwareAvailable !== void 0 && typeof data.readiness.hardwareAvailable !== "boolean"))
+      return false;
+    if (canonical && kind === "state" && !(data.contentHash === null || typeof data.contentHash === "string" && /^[0-9a-f]{64}$/i.test(data.contentHash)))
+      return false;
+    if (canonical && kind === "configuration/reported" && (!Number.isSafeInteger(data.revision) || data.revision < 1 || typeof data.contentHash !== "string" || !/^[0-9a-f]{64}$/i.test(data.contentHash) || !Array.isArray(data.errors)))
+      return false;
+    if (canonical && kind === "state" && (typeof data.connected !== "boolean" || !(data.revision === null || Number.isSafeInteger(data.revision) && data.revision >= 0) || !isObject(data.outputs) || data.inputs !== void 0 && !isObject(data.inputs) || ![...Object.values(data.outputs), ...Object.values(isObject(data.inputs) ? data.inputs : {})].every(
+      (value) => typeof value === "boolean"
+    )))
+      return false;
+    if (kind === "measurements" && (!identifier(data.channelId) || typeof data.value !== "number" || !Number.isFinite(data.value) || (canonical ? !Number.isSafeInteger(data.value) || !CANONICAL_UNITS.includes(data.unit) || !["live", "cumulative"].includes(data.kind) : !["ampere", "volt", "watt", "percent"].includes(data.unit))))
+      return false;
+    if (kind === "faults" && !identifier(data.channelId)) return false;
+    if (kind === "acknowledgements" && (!identifier(data.id) || !["accepted", "duplicate", "rejected"].includes(data.status)))
+      return false;
+    const oldest = [...this.controllers].find(([, value]) => !value.activeStream)?.[0];
+    if (!this.controllers.has(id) && this.controllers.size >= MAX_CONTROLLERS && oldest === void 0) return false;
+    if (!this.controllers.has(id) && this.controllers.size >= MAX_CONTROLLERS && oldest !== void 0)
+      this.controllers.delete(oldest);
+    const state = this.read(id);
+    if (!canonical && kind === "heartbeat" && typeof data.sequence === "number") {
+      if (data.sequence < (state.legacyHeartbeatSequence ?? 0)) return false;
+      state.legacyHeartbeatSequence = data.sequence;
+    }
+    if (canonical) {
+      if (kind === "measurements" && state.measurementAfter !== void 0 && sourceTime(data.timestamp) <= state.measurementAfter)
+        return false;
+      const previousStream = state.activeStream;
+      const admission = admitEnvelope(state, data, kind, this.now());
+      if (admission === "rejected") {
+        if (state.trackingExhausted) {
+          state.connected = false;
+          this.controllers.set(id, state);
+        }
+        return false;
+      }
+      if (admission === "restart") {
+        state.measurementAfter = sourceTime(data.timestamp) - (previousStream ? 0 : 1);
+        state.inputs = /* @__PURE__ */ Object.create(null);
+        state.outputs = /* @__PURE__ */ Object.create(null);
+        state.measurements = /* @__PURE__ */ Object.create(null);
+        state.cumulativeMeasurements = /* @__PURE__ */ Object.create(null);
+        state.connected = void 0;
+        state.heartbeatAt = void 0;
+        state.rejection = void 0;
+        state.hardwareAvailable = void 0;
+        state.stateSourceAt = void 0;
+        state.revision = void 0;
+        state.contentHash = void 0;
+      }
+    } else if (state.activeStream && !["heartbeat", "configuration/reported"].includes(kind)) {
+      if (kind === "state" && data.connected === false) {
+        state.connected = false;
+        state.measurementAfter = this.now();
+        state.stateSourceAt = void 0;
+        this.controllers.set(id, state);
+      }
+      return false;
+    }
+    state.touched = this.now();
+    const receivedAt = new Date(this.now()).toISOString();
+    const metadata = {
+      sourceAt: canonical ? data.timestamp : null,
+      receivedAt,
+      streamId: canonical ? state.activeStream : null,
+      sequence: canonical ? data.sequence : null
+    };
+    if (kind === "heartbeat") state.heartbeatAt = canonical ? data.timestamp : receivedAt;
+    if (kind === "state") {
+      const contentHash = typeof data.contentHash === "string" && /^[0-9a-f]{64}$/i.test(data.contentHash) ? data.contentHash : void 0;
+      const hardwareAvailable = isObject(data.readiness) && typeof data.readiness.hardwareAvailable === "boolean" ? data.readiness.hardwareAvailable : void 0;
+      if (state.connected !== data.connected || state.revision !== data.revision || state.contentHash !== contentHash || state.hardwareAvailable !== hardwareAvailable) {
+        if (canonical || state.stateSourceAt)
+          state.measurementAfter = canonical ? sourceTime(data.timestamp) : this.now();
+        state.measurements = /* @__PURE__ */ Object.create(null);
+        state.cumulativeMeasurements = /* @__PURE__ */ Object.create(null);
+      }
+      state.inputs = /* @__PURE__ */ Object.create(null);
+      state.outputs = /* @__PURE__ */ Object.create(null);
+      if (typeof data.connected === "boolean") state.connected = data.connected;
+      state.revision = Number.isSafeInteger(data.revision) ? data.revision : void 0;
+      state.contentHash = contentHash;
+      state.hardwareAvailable = hardwareAvailable;
+      state.stateSourceAt = canonical ? data.timestamp : void 0;
+      if (data.outputs && typeof data.outputs === "object" && !Array.isArray(data.outputs)) {
+        for (const [channelId, value] of Object.entries(data.outputs).slice(0, MAX_CHANNELS)) {
+          if (identifier(channelId) && typeof value === "boolean")
+            state.outputs[channelId] = { kind: "output", value, ...metadata };
+        }
+      }
+      if (isObject(data.inputs))
+        for (const [channelId, value] of Object.entries(data.inputs).slice(0, MAX_CHANNELS)) {
+          if (identifier(channelId) && typeof value === "boolean")
+            state.inputs[channelId] = { kind: "input", value, ...metadata };
+        }
+    }
+    if (kind === "measurements" && identifier(data.channelId) && typeof data.value === "number" && Number.isFinite(data.value) && (canonical ? CANONICAL_UNITS : ["ampere", "volt", "watt", "percent"]).includes(data.unit)) {
+      const collection2 = canonical && data.kind === "cumulative" ? state.cumulativeMeasurements : state.measurements;
+      collection2[data.channelId] = {
+        kind: "measurement",
+        value: data.value,
+        unit: data.unit,
+        ...canonical ? { measurementKind: data.kind } : {},
+        ...metadata
+      };
+    }
+    if (kind === "faults" && identifier(data.channelId))
+      state.faults[data.channelId] = {
+        code: faultCodes.has(data.code) ? data.code : "runtime_fault",
+        receivedAt
+      };
+    if (kind === "acknowledgements" && identifier(data.id) && ["accepted", "duplicate", "rejected"].includes(data.status)) {
+      const command = this.commands.get(data.id);
+      if (command?.controllerId === id) {
+        state.acknowledgements[command.channelId] = {
+          id: data.id,
+          status: data.status,
+          receivedAt
+        };
+        this.commands.delete(data.id);
+      }
+    }
+    if (kind === "configuration/reported" && Number.isSafeInteger(data.revision) && typeof data.contentHash === "string")
+      state.rejection = {
+        revision: data.revision,
+        contentHash: data.contentHash,
+        receivedAt,
+        errors: safeValidationSummaries(data.errors)
+      };
+    for (const collection2 of [
+      state.cumulativeMeasurements,
+      state.inputs,
+      state.outputs,
+      state.measurements,
+      state.faults,
+      state.acknowledgements
+    ]) {
+      while (Object.keys(collection2).length > MAX_CHANNELS) delete collection2[Object.keys(collection2)[0]];
+    }
+    state.events.push({ kind, receivedAt });
+    state.events = state.events.slice(-50);
+    this.controllers.set(id, state);
+    return true;
+  }
+};
+
 // backend/wago.service.ts
 var PLUGIN_CONTEXT = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
 var STALE_AFTER_MS = 9e4;
@@ -52771,6 +53326,7 @@ var MqttSubscriptionError = class extends Error {
 var WagoService = class {
   constructor(context) {
     __publicField(this, "context", context);
+    __publicField(this, "diagnostics", new WagoDiagnosticsStore());
     __publicField(this, "controllers");
     __publicField(this, "settings");
     __publicField(this, "enrollments");
@@ -52788,7 +53344,9 @@ var WagoService = class {
       controllers: () => this.controllers,
       claimedController: (id) => this.claimedController(id),
       getSettings: () => this.getSettings(),
-      appliedRevision: (id) => this.appliedRevision(id)
+      appliedRevision: (id) => this.appliedRevision(id),
+      onCommand: (controllerId, channelId, id) => this.diagnostics.command(controllerId, channelId, id),
+      onCommandFailure: (id, status) => this.diagnostics.commandFailed(id, status)
     }));
     __publicField(this, "claimConfigurationLock", Promise.resolve());
     __publicField(this, "subscriptionRebuild", Promise.resolve());
@@ -52852,7 +53410,7 @@ var WagoService = class {
       runtimeVersion: controller.runtimeVersion,
       capabilities: controller.capabilities,
       lastSequence: controller.lastSequence,
-      lastHeartbeatAt: controller.lastHeartbeatAt,
+      lastHeartbeatAt: this.diagnostics.read(controller.id).heartbeatAt ?? controller.lastHeartbeatAt,
       lastSeenAt: controller.lastSeenAt,
       compatibilityError: controller.compatibilityError,
       createdAt: controller.createdAt,
@@ -52898,13 +53456,40 @@ var WagoService = class {
     await this.claimedController(controllerId);
     return this.drafts.findOneBy({ controllerId });
   }
-  async saveDraft(controllerId, snapshot) {
-    return this.withConfigurationLock(controllerId, () => this.saveDraftWhileLocked(controllerId, snapshot));
+  async saveDraft(controllerId, snapshot, metadata) {
+    return this.withConfigurationLock(controllerId, () => this.saveDraftWhileLocked(controllerId, snapshot, metadata));
+  }
+  presets() {
+    return WAGO_PRESETS;
   }
-  async validateDraft(controllerId) {
+  async previewPreset(controllerId, application, snapshot) {
     const draft = await this.getDraft(controllerId);
-    if (!draft) throw new import_common.NotFoundException(`WAGO controller ${controllerId} has no configuration draft`);
-    const errors = validateSnapshot(JSON.parse(draft.snapshot));
+    const source = snapshot ?? (draft ? JSON.parse(draft.snapshot) : { version: 1, physicalPoints: [], logicalChannels: [] });
+    try {
+      return previewConfigurationPreset(source, application);
+    } catch (error) {
+      throw new import_common.BadRequestException(error instanceof Error ? error.message : "invalid preset");
+    }
+  }
+  async applyPreset(controllerId, application, selectedPaths, previewedDraftHash, snapshot) {
+    return this.withConfigurationLock(controllerId, async () => {
+      const draft = await this.getDraft(controllerId);
+      const source = snapshot ?? (draft ? JSON.parse(draft.snapshot) : { version: 1, physicalPoints: [], logicalChannels: [] });
+      let candidate;
+      try {
+        candidate = selectPresetChanges(source, application, selectedPaths, previewedDraftHash);
+      } catch (error) {
+        throw new import_common.BadRequestException(error instanceof Error ? error.message : "invalid preset");
+      }
+      if (snapshot) return { snapshot: canonicalSnapshot(candidate) };
+      return this.saveDraftWhileLocked(controllerId, candidate);
+    });
+  }
+  async validateDraft(controllerId, snapshot) {
+    const draft = await this.getDraft(controllerId);
+    if (!draft && snapshot === void 0)
+      throw new import_common.NotFoundException(`WAGO controller ${controllerId} has no configuration draft`);
+    const errors = validateEditorSnapshot(snapshot === void 0 && draft ? JSON.parse(draft.snapshot) : snapshot);
     return { valid: errors.length === 0, errors };
   }
   async revisionsFor(controllerId, offset = 0, limit = 20) {
@@ -52922,7 +53507,8 @@ var WagoService = class {
         "state",
         "rejectionErrors",
         "publishedAt",
-        "reportedAt"
+        "reportedAt",
+        "presetProvenance"
       ],
       skip: pageOffset,
       take: pageLimit
@@ -52932,35 +53518,93 @@ var WagoService = class {
   async reviewDraft(controllerId) {
     return this.withConfigurationLock(controllerId, () => this.reviewDraftWhileLocked(controllerId));
   }
-  async publishDraft(controllerId) {
-    return this.withConfigurationLock(controllerId, () => this.publishDraftWhileLocked(controllerId));
+  async publishDraft(controllerId, force = false, reviewedHash) {
+    return this.withConfigurationLock(
+      controllerId,
+      () => this.publishDraftWhileLocked(controllerId, force, reviewedHash)
+    );
   }
-  async rollback(controllerId, revision) {
+  async rollback(controllerId, revision, force = false, sourceHash, currentHash, draftHash, impactHash) {
     return this.withConfigurationLock(controllerId, async () => {
+      await this.claimedController(controllerId);
       const source = await this.revisions.findOneBy({ controllerId, revision });
       if (!source) throw new import_common.NotFoundException(`WAGO configuration revision ${revision} not found`);
-      await this.saveDraftWhileLocked(controllerId, JSON.parse(source.snapshot));
+      const current = await this.latestRevision(controllerId);
+      const draft = await this.drafts.findOneBy({ controllerId });
+      if (draftHash !== this.draftIdentity(draft) || sourceHash !== source.contentHash || currentHash !== this.revisionIdentity(current))
+        throw new import_common.ConflictException("configuration changed since rollback preview; preview and confirm again");
+      const snapshot = JSON.parse(source.snapshot);
+      const errors = validateEditorSnapshot(snapshot);
+      if (errors.length) throw new import_common.ConflictException({ message: "rollback configuration is invalid", errors });
+      await this.requireImpactAcknowledgement(controllerId, current, snapshot, force, impactHash);
+      await this.saveDraftWhileLocked(
+        controllerId,
+        snapshot,
+        (source.presetProvenance ? JSON.parse(source.presetProvenance).editor : null) ?? { names: {}, presets: [] }
+      );
       await this.reviewDraftWhileLocked(controllerId);
-      return this.publishDraftWhileLocked(controllerId);
+      return this.publishDraftWhileLocked(controllerId, force);
     });
   }
   async previewRevision(controllerId, revision) {
-    await this.claimedController(controllerId);
-    const selected = await this.revisions.findOneBy({ controllerId, revision });
-    if (!selected) throw new import_common.NotFoundException(`WAGO configuration revision ${revision} not found`);
-    const [current] = await this.revisions.find({ where: { controllerId }, order: { revision: "DESC" }, take: 1 });
-    return {
-      revision: selected,
-      current: current ?? null,
-      diff: configurationDiff(current ? JSON.parse(current.snapshot) : null, JSON.parse(selected.snapshot))
-    };
+    return this.withConfigurationLock(controllerId, async () => {
+      await this.claimedController(controllerId);
+      const selected = await this.revisions.findOneBy({ controllerId, revision });
+      if (!selected) throw new import_common.NotFoundException(`WAGO configuration revision ${revision} not found`);
+      const [current] = await this.revisions.find({ where: { controllerId }, order: { revision: "DESC" }, take: 1 });
+      const draft = await this.drafts.findOneBy({ controllerId });
+      const impacts = await configurationFlowImpacts(
+        this.context,
+        controllerId,
+        current ? JSON.parse(current.snapshot) : null,
+        JSON.parse(selected.snapshot)
+      );
+      return {
+        draftHash: this.draftIdentity(draft),
+        impacts,
+        revision: selected,
+        current: current ?? null,
+        diff: configurationDiff(current ? JSON.parse(current.snapshot) : null, JSON.parse(selected.snapshot)),
+        metadataDiff: configurationDiff(
+          this.metadataFromProvenance(current?.presetProvenance),
+          this.metadataFromProvenance(selected.presetProvenance)
+        ),
+        impactHash: configurationHash({ impacts })
+      };
+    });
+  }
+  draftIdentity(draft) {
+    return configurationHash(draft ? { snapshot: draft.snapshot, metadata: draft.presetProvenance ?? null } : null);
+  }
+  revisionIdentity(revision) {
+    return revision ? `${revision.revision}:${revision.contentHash}` : null;
+  }
+  reviewIdentity(draft, impacts) {
+    return configurationHash({ draft: this.draftIdentity(draft), impacts });
   }
-  async saveDraftWhileLocked(controllerId, snapshot) {
+  metadataFromProvenance(provenance) {
+    if (!provenance) return { names: {}, presets: [] };
+    try {
+      return editorMetadata(JSON.parse(provenance).editor);
+    } catch {
+      return { names: {}, presets: [] };
+    }
+  }
+  async saveDraftWhileLocked(controllerId, snapshot, metadata) {
     await this.claimedController(controllerId);
+    let provenance;
+    if (metadata !== void 0) {
+      try {
+        provenance = JSON.stringify({ editor: editorMetadata(metadata) });
+      } catch (error) {
+        throw new import_common.BadRequestException(error instanceof Error ? error.message : "invalid editor metadata");
+      }
+    }
     const serialized = canonicalSnapshot(snapshot);
     const existing = await this.drafts.findOneBy({ controllerId });
     const draft = existing ?? this.drafts.create({ controllerId, snapshot: serialized, reviewedHash: null, updatedAt: "" });
     draft.snapshot = serialized;
+    if (provenance !== void 0) draft.presetProvenance = provenance;
     draft.reviewedHash = null;
     draft.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     return this.drafts.save(draft);
@@ -52970,28 +53614,66 @@ var WagoService = class {
     const draft = await this.drafts.findOneBy({ controllerId });
     if (!draft) throw new import_common.NotFoundException(`WAGO controller ${controllerId} has no configuration draft`);
     const previous = await this.latestRevision(controllerId);
-    draft.reviewedHash = configurationHash(JSON.parse(draft.snapshot));
+    const impacts = await configurationFlowImpacts(
+      this.context,
+      controllerId,
+      previous ? JSON.parse(previous.snapshot) : null,
+      JSON.parse(draft.snapshot)
+    );
+    draft.reviewedHash = this.reviewIdentity(draft, impacts);
     await this.drafts.save(draft);
     const diff = configurationDiff(previous ? JSON.parse(previous.snapshot) : null, JSON.parse(draft.snapshot));
-    return { draft, previous, changed: diff.length > 0, diff };
+    const metadataDiff = configurationDiff(
+      this.metadataFromProvenance(previous?.presetProvenance),
+      this.metadataFromProvenance(draft.presetProvenance)
+    );
+    return {
+      draft,
+      previous,
+      changed: diff.length > 0 || metadataDiff.length > 0,
+      diff,
+      metadataDiff,
+      impacts
+    };
   }
-  async publishDraftWhileLocked(controllerId) {
+  async requireImpactAcknowledgement(controllerId, previous, snapshot, force, expectedImpactHash) {
+    const impacts = await configurationFlowImpacts(
+      this.context,
+      controllerId,
+      previous ? JSON.parse(previous.snapshot) : null,
+      snapshot
+    );
+    if (impacts.length && !force)
+      throw new import_common.ConflictException({ message: "acknowledge potential flow impacts before publishing", impacts });
+    if (force && expectedImpactHash !== void 0 && expectedImpactHash !== configurationHash({ impacts }))
+      throw new import_common.ConflictException({
+        message: "flow impacts changed since preview; preview and confirm again",
+        impacts
+      });
+    return impacts;
+  }
+  async publishDraftWhileLocked(controllerId, force = false, reviewedHash) {
     const controller = await this.claimedController(controllerId);
     const draft = await this.drafts.findOneBy({ controllerId });
     if (!draft) throw new import_common.NotFoundException(`WAGO controller ${controllerId} has no configuration draft`);
-    const validation = validateSnapshot(JSON.parse(draft.snapshot));
+    const validation = validateEditorSnapshot(JSON.parse(draft.snapshot));
     if (validation.length)
       throw new import_common.ConflictException({ message: "configuration draft is invalid", errors: validation });
     const contentHash = configurationHash(JSON.parse(draft.snapshot));
-    if (draft.reviewedHash !== contentHash)
-      throw new import_common.ConflictException("review the current configuration draft before publishing it");
     const previous = await this.latestRevision(controllerId);
-    if (previous?.state === "pending" && previous.contentHash === contentHash)
+    const impacts = await this.requireImpactAcknowledgement(controllerId, previous, JSON.parse(draft.snapshot), force);
+    const reviewIdentity = this.reviewIdentity(draft, impacts);
+    if (reviewedHash !== void 0 && reviewedHash !== reviewIdentity)
+      throw new import_common.ConflictException("draft changed since your review; review it again");
+    if (draft.reviewedHash !== reviewIdentity)
+      throw new import_common.ConflictException("review the current configuration draft before publishing it");
+    if (previous?.state === "pending" && previous.contentHash === contentHash && (previous.presetProvenance ?? null) === (draft.presetProvenance ?? null))
       return this.publishRevision(controller, previous);
     const revision = this.revisions.create({
       controllerId,
       revision: (previous?.revision ?? 0) + 1,
       snapshot: draft.snapshot,
+      presetProvenance: draft.presetProvenance ?? null,
       contentHash,
       state: "pending",
       rejectionErrors: null,
@@ -53307,6 +53989,7 @@ var WagoService = class {
     });
     const generation = this.activeSubscriptionGeneration + 1;
     const replacements = [];
+    const retainedStates = /* @__PURE__ */ new Map();
     try {
       for (const serverId of serverIds) {
         replacements.push(
@@ -53333,7 +54016,10 @@ var WagoService = class {
               if (!this.isActiveSubscriptionGeneration(generation)) return;
               const hardwareId = configurationReportedHardwareId(settings.operationalPrefix, message.topic);
               const controller = hardwareId ? controllersByHardwareId.get(hardwareId) : void 0;
-              if (controller) this.enqueueConfigurationReport(controller.id, message.payload);
+              if (controller) {
+                this.diagnostics.ingest(controller.id, "configuration/reported", message.payload);
+                this.enqueueConfigurationReport(controller.id, message.payload);
+              }
             }
           )
         );
@@ -53342,7 +54028,10 @@ var WagoService = class {
             if (!this.isActiveSubscriptionGeneration(generation)) return;
             const hardwareId = acknowledgementHardwareId(settings.operationalPrefix, message.topic);
             const controller = hardwareId ? controllersByHardwareId.get(hardwareId) : void 0;
-            if (controller) this.onCommandAcknowledgement(controller.id, message.payload);
+            if (controller) {
+              this.diagnostics.ingest(controller.id, "acknowledgements", message.payload);
+              this.onCommandAcknowledgement(controller.id, message.payload);
+            }
           })
         );
         if (this.destroyed) {
@@ -53350,6 +54039,20 @@ var WagoService = class {
           return;
         }
         for (const controller of claimedControllers) {
+          for (const suffix of ["state", "measurements", "faults"]) {
+            replacements.push(
+              await this.subscribeMqtt(
+                serverId,
+                `${settings.operationalPrefix}/v1/controllers/${controller.hardwareId}/${suffix}`,
+                (message) => {
+                  if (this.isActiveSubscriptionGeneration(generation))
+                    this.diagnostics.ingest(controller.id, suffix, message.payload);
+                  else if (!this.destroyed && suffix === "state" && message.payload.length <= 65536)
+                    retainedStates.set(controller.id, Buffer.from(message.payload));
+                }
+              )
+            );
+          }
           replacements.push(
             await this.subscribeMqtt(
               serverId,
@@ -53375,6 +54078,7 @@ var WagoService = class {
       return;
     }
     this.activeSubscriptionGeneration = generation;
+    retainedStates.forEach((payload, controllerId) => this.diagnostics.ingest(controllerId, "state", payload));
     this.unsubscribe();
     this.subscriptions.push(...replacements);
   }
@@ -53466,15 +54170,35 @@ var WagoService = class {
       return;
     }
     if (heartbeat.hardwareId !== hardwareId) return;
+    let rawHeartbeat;
+    try {
+      rawHeartbeat = JSON.parse(payload.toString("utf8"));
+    } catch {
+      return;
+    }
+    const canonical = canonicalEnvelope(rawHeartbeat, "heartbeat");
     const controller = await this.controllers.findOneBy({ hardwareId });
-    if (!controller || controller.trustState !== "claimed" || heartbeat.sequence !== void 0 && heartbeat.sequence < controller.lastSequence)
+    if (!controller || controller.trustState !== "claimed" || !canonical && heartbeat.sequence !== void 0 && heartbeat.sequence < controller.lastSequence)
       return;
     const now = (/* @__PURE__ */ new Date()).toISOString();
+    const canTrackDiagnostics = this.diagnostics.canTrack(controller.id);
+    const admitted = this.diagnostics.ingest(controller.id, "heartbeat", payload);
+    const heartbeatAt = admitted ? this.diagnostics.read(controller.id).heartbeatAt : typeof rawHeartbeat.timestamp === "string" ? rawHeartbeat.timestamp : void 0;
+    const persistedHeartbeatAt = sourceTime(controller.lastHeartbeatAt);
+    if (canonical && (!validEnvelope(rawHeartbeat, Date.now()) || canTrackDiagnostics && !admitted || !heartbeatAt || persistedHeartbeatAt !== null && sourceTime(heartbeatAt) < persistedHeartbeatAt))
+      return;
+    const metadataChanged = controller.protocolVersion !== heartbeat.protocolVersion || controller.runtimeVersion !== heartbeat.runtimeVersion || controller.capabilities !== JSON.stringify(heartbeat.capabilities) || controller.compatibilityError !== compatibilityError(heartbeat);
+    if (controller.lastHeartbeatAt && freshness(controller.lastSeenAt, Date.now(), 3e4) === "fresh" && !metadataChanged)
+      return;
     controller.protocolVersion = heartbeat.protocolVersion;
     controller.runtimeVersion = heartbeat.runtimeVersion;
     controller.capabilities = JSON.stringify(heartbeat.capabilities);
-    controller.lastSequence = heartbeat.sequence ?? controller.lastSequence;
-    controller.lastHeartbeatAt = now;
+    if (!canonical) {
+      controller.lastSequence = this.diagnostics.read(controller.id).legacyHeartbeatSequence ?? controller.lastSequence;
+      controller.lastHeartbeatAt = now;
+    } else {
+      controller.lastHeartbeatAt = heartbeatAt;
+    }
     controller.lastSeenAt = now;
     controller.compatibilityError = compatibilityError(heartbeat);
     controller.updatedAt = now;
@@ -53585,7 +54309,8 @@ var WagoService = class {
   }
   connectivity(controller) {
     if (controller.trustState === "untrusted") return "untrusted";
-    return controller.lastHeartbeatAt && Date.now() - Date.parse(controller.lastHeartbeatAt) <= STALE_AFTER_MS ? "online" : "stale";
+    const heartbeatAt = this.diagnostics.read(controller.id).heartbeatAt ?? controller.lastHeartbeatAt;
+    return freshness(heartbeatAt, Date.now(), STALE_AFTER_MS) === "fresh" ? "online" : "stale";
   }
   async appliedRevision(controllerId) {
     const [revision] = await this.revisions.find({
@@ -53757,10 +54482,10 @@ var import_node_fs2 = require("node:fs");
 var import_promises4 = require("node:fs/promises");
 var import_node_os2 = require("node:os");
 var import_node_path2 = require("node:path");
-var import_plugins_backend_sdk11 = require("@attraccess/plugins-backend-sdk");
+var import_plugins_backend_sdk12 = require("@attraccess/plugins-backend-sdk");
 
 // backend/wago-commissioning-session.entity.ts
-var import_plugins_backend_sdk7 = require("@attraccess/plugins-backend-sdk");
+var import_plugins_backend_sdk8 = require("@attraccess/plugins-backend-sdk");
 var WagoCommissioningSession = class {
   constructor() {
     __publicField(this, "id");
@@ -53792,85 +54517,85 @@ var WagoCommissioningSession = class {
   }
 };
 __decorateClass([
-  (0, import_plugins_backend_sdk7.PrimaryGeneratedColumn)({ type: "integer" })
+  (0, import_plugins_backend_sdk8.PrimaryGeneratedColumn)({ type: "integer" })
 ], WagoCommissioningSession.prototype, "id", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "hardware_id" })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "hardware_id" })
 ], WagoCommissioningSession.prototype, "hardwareId", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "integer", name: "mqtt_server_id" })
+  (0, import_plugins_backend_sdk8.Column)({ type: "integer", name: "mqtt_server_id" })
 ], WagoCommissioningSession.prototype, "mqttServerId", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "target_host" })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "target_host" })
 ], WagoCommissioningSession.prototype, "targetHost", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "host_key_fingerprint" })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "host_key_fingerprint" })
 ], WagoCommissioningSession.prototype, "hostKeyFingerprint", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "firmware_baseline" })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "firmware_baseline" })
 ], WagoCommissioningSession.prototype, "firmwareBaseline", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "controller_name", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "controller_name", nullable: true })
 ], WagoCommissioningSession.prototype, "controllerName", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar" })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar" })
 ], WagoCommissioningSession.prototype, "state", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "enrollment_expires_at", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "enrollment_expires_at", nullable: true })
 ], WagoCommissioningSession.prototype, "enrollmentExpiresAt", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "integer", name: "enrollment_id", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "integer", name: "enrollment_id", nullable: true })
 ], WagoCommissioningSession.prototype, "enrollmentId", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "pairing_code", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "pairing_code", nullable: true })
 ], WagoCommissioningSession.prototype, "pairingCode", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "delivery_token", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "delivery_token", nullable: true })
 ], WagoCommissioningSession.prototype, "deliveryToken", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "text", name: "initiating_principal", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "text", name: "initiating_principal", nullable: true })
 ], WagoCommissioningSession.prototype, "initiatingPrincipal", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "runtime_artifact_digest", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "runtime_artifact_digest", nullable: true })
 ], WagoCommissioningSession.prototype, "runtimeArtifactDigest", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "integer", name: "management_controller_id", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "integer", name: "management_controller_id", nullable: true })
 ], WagoCommissioningSession.prototype, "managementControllerId", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "docker_provision_token", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "docker_provision_token", nullable: true })
 ], WagoCommissioningSession.prototype, "dockerProvisionToken", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "docker_provision_state", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "docker_provision_state", nullable: true })
 ], WagoCommissioningSession.prototype, "dockerProvisionState", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "text", name: "platform_report", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "text", name: "platform_report", nullable: true })
 ], WagoCommissioningSession.prototype, "platformReport", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "codesys_state", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "codesys_state", nullable: true })
 ], WagoCommissioningSession.prototype, "codesysState", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "integer", name: "progress_percent", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "integer", name: "progress_percent", nullable: true })
 ], WagoCommissioningSession.prototype, "progressPercent", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "progress_step", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "progress_step", nullable: true })
 ], WagoCommissioningSession.prototype, "progressStep", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "progress_detail", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "progress_detail", nullable: true })
 ], WagoCommissioningSession.prototype, "progressDetail", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "audit_log" })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "audit_log" })
 ], WagoCommissioningSession.prototype, "auditLog", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "failure_reason", nullable: true })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "failure_reason", nullable: true })
 ], WagoCommissioningSession.prototype, "failureReason", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "created_at" })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "created_at" })
 ], WagoCommissioningSession.prototype, "createdAt", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk7.Column)({ type: "varchar", name: "updated_at" })
+  (0, import_plugins_backend_sdk8.Column)({ type: "varchar", name: "updated_at" })
 ], WagoCommissioningSession.prototype, "updatedAt", 2);
 WagoCommissioningSession = __decorateClass([
-  (0, import_plugins_backend_sdk7.Entity)({ name: "plugin_wago_commissioning_sessions" })
+  (0, import_plugins_backend_sdk8.Entity)({ name: "plugin_wago_commissioning_sessions" })
 ], WagoCommissioningSession);
 
 // backend/wago-commissioning-verification.ts
@@ -54268,13 +54993,13 @@ async function verifyRuntimeSignature(file, armor, trustedKey = WAGO_RUNTIME_REL
   if (!match) invalid();
   const packet = Buffer.from(match[1].replace(/\s/g, ""), "base64");
   if (packet.length < 10 || packet.subarray(0, 6).toString() !== "SSHSIG" || packet.readUInt32BE(6) !== 1) invalid();
-  const fields = reader(packet.subarray(10));
-  const key = fields.string();
-  const namespace = fields.string();
-  const reserved = fields.string();
-  const algorithm2 = fields.string();
-  const signature = reader(fields.string());
-  fields.end();
+  const fields2 = reader(packet.subarray(10));
+  const key = fields2.string();
+  const namespace = fields2.string();
+  const reserved = fields2.string();
+  const algorithm2 = fields2.string();
+  const signature = reader(fields2.string());
+  fields2.end();
   if (!key.equals(Buffer.from(trustedKey, "base64")) || namespace.toString() !== "attraccess-wago-runtime" || reserved.length)
     invalid();
   if (!["sha256", "sha512"].includes(algorithm2.toString()) || signature.string().toString() !== "ssh-ed25519")
@@ -54739,7 +55464,7 @@ WagoRuntimeArtifactsService = __decorateClass([
 
 // backend/wago-commissioning-readiness.ts
 var import_common5 = require("@nestjs/common");
-var import_plugins_backend_sdk8 = require("@attraccess/plugins-backend-sdk");
+var import_plugins_backend_sdk9 = require("@attraccess/plugins-backend-sdk");
 var WagoCommissioningReadiness = class {
   constructor(context) {
     __publicField(this, "context", context);
@@ -54803,14 +55528,14 @@ var WagoCommissioningReadiness = class {
 };
 WagoCommissioningReadiness = __decorateClass([
   (0, import_common5.Injectable)(),
-  __decorateParam(0, (0, import_common5.Inject)(import_plugins_backend_sdk8.PLUGIN_CONTEXT))
+  __decorateParam(0, (0, import_common5.Inject)(import_plugins_backend_sdk9.PLUGIN_CONTEXT))
 ], WagoCommissioningReadiness);
 
 // backend/wago-commissioning-lease.ts
 var import_node_crypto8 = require("node:crypto");
 
 // backend/wago-commissioning-lease.entity.ts
-var import_plugins_backend_sdk9 = require("@attraccess/plugins-backend-sdk");
+var import_plugins_backend_sdk10 = require("@attraccess/plugins-backend-sdk");
 var WagoCommissioningLeaseEntity = class {
   constructor() {
     __publicField(this, "fingerprintHash");
@@ -54821,22 +55546,22 @@ var WagoCommissioningLeaseEntity = class {
   }
 };
 __decorateClass([
-  (0, import_plugins_backend_sdk9.PrimaryColumn)({ type: "varchar", name: "fingerprint_hash", length: 64 })
+  (0, import_plugins_backend_sdk10.PrimaryColumn)({ type: "varchar", name: "fingerprint_hash", length: 64 })
 ], WagoCommissioningLeaseEntity.prototype, "fingerprintHash", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk9.Column)({ type: "varchar", name: "owner" })
+  (0, import_plugins_backend_sdk10.Column)({ type: "varchar", name: "owner" })
 ], WagoCommissioningLeaseEntity.prototype, "owner", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk9.Column)({ type: "bigint", name: "lease_until" })
+  (0, import_plugins_backend_sdk10.Column)({ type: "bigint", name: "lease_until" })
 ], WagoCommissioningLeaseEntity.prototype, "leaseUntil", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk9.Column)({ type: "bigint", name: "operation_until" })
+  (0, import_plugins_backend_sdk10.Column)({ type: "bigint", name: "operation_until" })
 ], WagoCommissioningLeaseEntity.prototype, "operationUntil", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk9.Column)({ type: "bigint", name: "recovery_after" })
+  (0, import_plugins_backend_sdk10.Column)({ type: "bigint", name: "recovery_after" })
 ], WagoCommissioningLeaseEntity.prototype, "recoveryAfter", 2);
 WagoCommissioningLeaseEntity = __decorateClass([
-  (0, import_plugins_backend_sdk9.Entity)({ name: "plugin_wago_commissioning_lease" })
+  (0, import_plugins_backend_sdk10.Entity)({ name: "plugin_wago_commissioning_lease" })
 ], WagoCommissioningLeaseEntity);
 
 // backend/wago-commissioning-lease.ts
@@ -55012,7 +55737,7 @@ function createWagoCommissioningLeaseService(context) {
 }
 
 // backend/wago-management.entity.ts
-var import_plugins_backend_sdk10 = require("@attraccess/plugins-backend-sdk");
+var import_plugins_backend_sdk11 = require("@attraccess/plugins-backend-sdk");
 var WagoManagementEntity = class {
   constructor() {
     __publicField(this, "controllerId");
@@ -55023,22 +55748,22 @@ var WagoManagementEntity = class {
   }
 };
 __decorateClass([
-  (0, import_plugins_backend_sdk10.PrimaryColumn)({ type: "integer", name: "controller_id" })
+  (0, import_plugins_backend_sdk11.PrimaryColumn)({ type: "integer", name: "controller_id" })
 ], WagoManagementEntity.prototype, "controllerId", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk10.Column)({ type: "text", name: "metadata_json", nullable: true })
+  (0, import_plugins_backend_sdk11.Column)({ type: "text", name: "metadata_json", nullable: true })
 ], WagoManagementEntity.prototype, "metadataJson", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk10.Column)({ type: "text", name: "encrypted_private_key", nullable: true, select: false })
+  (0, import_plugins_backend_sdk11.Column)({ type: "text", name: "encrypted_private_key", nullable: true, select: false })
 ], WagoManagementEntity.prototype, "encryptedPrivateKey", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk10.Column)({ type: "varchar", name: "lease_owner", nullable: true })
+  (0, import_plugins_backend_sdk11.Column)({ type: "varchar", name: "lease_owner", nullable: true })
 ], WagoManagementEntity.prototype, "leaseOwner", 2);
 __decorateClass([
-  (0, import_plugins_backend_sdk10.Column)({ type: "bigint", name: "lease_until", default: 0 })
+  (0, import_plugins_backend_sdk11.Column)({ type: "bigint", name: "lease_until", default: 0 })
 ], WagoManagementEntity.prototype, "leaseUntil", 2);
 WagoManagementEntity = __decorateClass([
-  (0, import_plugins_backend_sdk10.Entity)({ name: "plugin_wago_management" })
+  (0, import_plugins_backend_sdk11.Entity)({ name: "plugin_wago_management" })
 ], WagoManagementEntity);
 
 // backend/wago-management-inspection.ts
@@ -55503,7 +56228,7 @@ var transitionStates = [
   "recovery_required"
 ];
 var exceptionNames = ["wbm_exposed", "other_services_exposed", "unqualified_privileges"];
-var identifier = () => (0, import_node_crypto10.randomBytes)(16).toString("hex");
+var identifier2 = () => (0, import_node_crypto10.randomBytes)(16).toString("hex");
 var REVIEW_MS = 3e5;
 var LEASE_MS = 30 * 6e4;
 var ManagementError = class extends Error {
@@ -55570,7 +56295,7 @@ var WagoManagementService = class {
       record3.support = this.adapter.qualify(record3.inspection, input.mode).support;
       if (input.mode === "key_only" && (!record3.exceptions.includes("unqualified_privileges") || record3.inspection.wbm !== "not_observed" && !record3.exceptions.includes("wbm_exposed") || record3.inspection.otherManagement !== "not_observed" && !record3.exceptions.includes("other_services_exposed")))
         throw new ManagementError("invalid_request");
-      record3.reviewToken = identifier();
+      record3.reviewToken = identifier2();
       record3.reviewedAt = this.now();
       record3.state = "reviewed";
       await this.save(record3, owner, guard);
@@ -55603,7 +56328,7 @@ var WagoManagementService = class {
         if (this.secrets.decrypt(record2.encryptedPrivateKey) !== key.privateKey) throw new Error();
         record2.keyFingerprint = key.fingerprint;
         record2.transaction = {
-          id: identifier(),
+          id: identifier2(),
           target: record2.target,
           username: input.temporarySsh.username,
           deadline: this.now() + 15e4
@@ -55659,7 +56384,7 @@ var WagoManagementService = class {
     });
   }
   async verify(record2, privateKey, guard) {
-    const nonce = identifier();
+    const nonce = identifier2();
     const tx = this.transaction(record2);
     const proof = await this.remote(guard, () => this.adapter.verifyKey(tx, privateKey, nonce));
     if (proof.nonce !== nonce || !proof.keyOnly || proof.hostKeyFingerprint !== tx.target.hostKeyFingerprint || proof.keyFingerprint !== record2.keyFingerprint || !Number.isSafeInteger(proof.uid) || proof.uid <= 0 || proof.uid !== this.inspection(record2).uid || !proof.managementOperationSucceeded)
@@ -55731,7 +56456,7 @@ var WagoManagementService = class {
   }
   async locked(controllerId, fingerprint2, action) {
     validId(controllerId);
-    const owner = identifier();
+    const owner = identifier2();
     let acquired = false;
     let mutationStarted = false;
     try {
@@ -57342,7 +58067,7 @@ printf '%s\\n' "$ATTRACCESS_SSH_PASSWORD"
 };
 WagoCommissioningService = __decorateClass([
   (0, import_common6.Injectable)(),
-  __decorateParam(0, (0, import_common6.Inject)(import_plugins_backend_sdk11.PLUGIN_CONTEXT)),
+  __decorateParam(0, (0, import_common6.Inject)(import_plugins_backend_sdk12.PLUGIN_CONTEXT)),
   __decorateParam(1, (0, import_common6.Inject)(WagoService)),
   __decorateParam(2, (0, import_common6.Optional)()),
   __decorateParam(2, (0, import_common6.Inject)(WagoRuntimeArtifactsService)),
@@ -57777,17 +58502,23 @@ var WagoControllerApi = class {
   }
   previewPreset(id, body) {
     if (!body?.application) throw new import_common8.BadRequestException("application is required");
-    return this.wago.previewPreset(id, body.application);
+    return this.wago.previewPreset(id, body.application, body.snapshot);
   }
   applyPreset(id, body) {
     if (!body?.application) throw new import_common8.BadRequestException("application is required");
-    return this.wago.applyPreset(id, body.application, body.selectedPaths ?? [], body.previewedDraftHash ?? "");
+    return this.wago.applyPreset(
+      id,
+      body.application,
+      body.selectedPaths ?? [],
+      body.previewedDraftHash ?? "",
+      body.snapshot
+    );
   }
   saveDraft(id, body) {
-    return this.wago.saveDraft(id, body?.snapshot);
+    return this.wago.saveDraft(id, body?.snapshot, body?.metadata);
   }
-  validateDraft(id) {
-    return this.wago.validateDraft(id);
+  validateDraft(id, body) {
+    return this.wago.validateDraft(id, body?.snapshot);
   }
   reviewDraft(id) {
     return this.wago.reviewDraft(id);
@@ -57795,23 +58526,31 @@ var WagoControllerApi = class {
   revisions(id, offset, limit) {
     return this.wago.revisionsFor(id, Number(offset), Number(limit));
   }
-  publishDraft(id, request) {
+  publishDraft(id, request, body) {
     return this.audit.run(
       wagoAuditPrincipal(request),
       id,
       "publication",
-      {},
-      () => this.wago.publishDraft(id),
+      body?.force === true ? { force: true } : {},
+      () => this.wago.publishDraft(id, body?.force === true, body?.reviewedHash),
       (published) => ({ revision: published.revision })
     );
   }
-  rollback(id, revision, request) {
+  rollback(id, revision, request, body) {
     return this.audit.run(
       wagoAuditPrincipal(request),
       id,
       "rollback",
-      { sourceRevision: revision },
-      () => this.wago.rollback(id, revision),
+      body?.force === true ? { sourceRevision: revision, force: true } : { sourceRevision: revision },
+      () => this.wago.rollback(
+        id,
+        revision,
+        body?.force === true,
+        body?.sourceHash,
+        body?.currentHash,
+        body?.draftHash,
+        body?.impactHash
+      ),
       (published) => ({ revision: published.revision })
     );
   }
@@ -57823,61 +58562,61 @@ __decorateClass([
   (0, import_common8.Get)("controllers")
 ], WagoControllerApi.prototype, "list", 1);
 __decorateClass([
-  (0, import_plugins_backend_sdk12.Auth)("system.settings.manage"),
+  (0, import_plugins_backend_sdk13.Auth)("system.settings.manage"),
   (0, import_common8.Get)("settings")
 ], WagoControllerApi.prototype, "settings", 1);
 __decorateClass([
-  (0, import_plugins_backend_sdk12.Auth)("system.settings.manage"),
+  (0, import_plugins_backend_sdk13.Auth)("system.settings.manage"),
   (0, import_common8.Post)("settings"),
   __decorateParam(0, (0, import_common8.Body)())
 ], WagoControllerApi.prototype, "setSettings", 1);
 __decorateClass([
-  (0, import_plugins_backend_sdk12.Auth)("system.settings.manage"),
+  (0, import_plugins_backend_sdk13.Auth)("system.settings.manage"),
   (0, import_common8.Get)("commissioning/support")
 ], WagoControllerApi.prototype, "commissioningSupport", 1);
 __decorateClass([
-  (0, import_plugins_backend_sdk12.Auth)("system.settings.manage"),
+  (0, import_plugins_backend_sdk13.Auth)("system.settings.manage"),
   (0, import_common8.Get)("commissioning/sessions"),
   __decorateParam(0, (0, import_common8.Query)("limit")),
   __decorateParam(1, (0, import_common8.Query)("offset"))
 ], WagoControllerApi.prototype, "commissioningSessions", 1);
 __decorateClass([
-  (0, import_plugins_backend_sdk12.Auth)("system.settings.manage"),
+  (0, import_plugins_backend_sdk13.Auth)("system.settings.manage"),
   (0, import_common8.Post)("commissioning/sessions"),
   __decorateParam(0, (0, import_common8.Body)())
 ], WagoControllerApi.prototype, "createCommissioningSession", 1);
 __decorateClass([
-  (0, import_plugins_backend_sdk12.Auth)("system.settings.manage"),
+  (0, import_plugins_backend_sdk13.Auth)("system.settings.manage"),
   (0, import_common8.Post)("commissioning/sessions/:id/confirm-host-key"),
   __decorateParam(0, (0, import_common8.Param)("id", import_common8.ParseIntPipe)),
   __decorateParam(1, (0, import_common8.Body)())
 ], WagoControllerApi.prototype, "confirmCommissioningHostKey", 1);
 __decorateClass([
-  (0, import_plugins_backend_sdk12.Auth)("system.settings.manage"),
+  (0, import_plugins_backend_sdk13.Auth)("system.settings.manage"),
   (0, import_common8.Post)("commissioning/sessions/:id/deliver"),
   __decorateParam(0, (0, import_common8.Param)("id", import_common8.ParseIntPipe)),
   __decorateParam(1, (0, import_common8.Body)()),
   __decorateParam(2, (0, import_common8.Req)())
 ], WagoControllerApi.prototype, "deliverCommissioningSession", 1);
 __decorateClass([
-  (0, import_plugins_backend_sdk12.Auth)("system.settings.manage"),
+  (0, import_plugins_backend_sdk13.Auth)("system.settings.manage"),
   (0, import_common8.Post)("commissioning/sessions/:id/recover"),
   __decorateParam(0, (0, import_common8.Param)("id", import_common8.ParseIntPipe)),
   __decorateParam(1, (0, import_common8.Body)()),
   __decorateParam(2, (0, import_common8.Req)())
 ], WagoControllerApi.prototype, "recoverCommissioningSession", 1);
 __decorateClass([
-  (0, import_plugins_backend_sdk12.Auth)("system.settings.manage"),
+  (0, import_plugins_backend_sdk13.Auth)("system.settings.manage"),
   (0, import_common8.Get)("commissioning/sessions/:id/verification"),
   __decorateParam(0, (0, import_common8.Param)("id", import_common8.ParseIntPipe))
 ], WagoControllerApi.prototype, "commissioningVerification", 1);
 __decorateClass([
-  (0, import_plugins_backend_sdk12.Auth)("system.settings.manage"),
+  (0, import_plugins_backend_sdk13.Auth)("system.settings.manage"),
   (0, import_common8.Post)("commissioning/sessions/:id/revoke"),
   __decorateParam(0, (0, import_common8.Param)("id", import_common8.ParseIntPipe))
 ], WagoControllerApi.prototype, "revokeCommissioningSession", 1);
 __decorateClass([
-  (0, import_plugins_backend_sdk12.Auth)("system.settings.manage"),
+  (0, import_plugins_backend_sdk13.Auth)("system.settings.manage"),
   (0, import_common8.Delete)("commissioning/sessions/:id"),
   __decorateParam(0, (0, import_common8.Param)("id", import_common8.ParseIntPipe))
 ], WagoControllerApi.prototype, "removeCommissioningSession", 1);
@@ -57916,7 +58655,8 @@ __decorateClass([
 ], WagoControllerApi.prototype, "saveDraft", 1);
 __decorateClass([
   (0, import_common8.Post)("controllers/:id/configuration/validate"),
-  __decorateParam(0, (0, import_common8.Param)("id", import_common8.ParseIntPipe))
+  __decorateParam(0, (0, import_common8.Param)("id", import_common8.ParseIntPipe)),
+  __decorateParam(1, (0, import_common8.Body)())
 ], WagoControllerApi.prototype, "validateDraft", 1);
 __decorateClass([
   (0, import_common8.Post)("controllers/:id/configuration/review"),
@@ -57931,13 +58671,15 @@ __decorateClass([
 __decorateClass([
   (0, import_common8.Post)("controllers/:id/configuration/publish"),
   __decorateParam(0, (0, import_common8.Param)("id", import_common8.ParseIntPipe)),
-  __decorateParam(1, (0, import_common8.Req)())
+  __decorateParam(1, (0, import_common8.Req)()),
+  __decorateParam(2, (0, import_common8.Body)())
 ], WagoControllerApi.prototype, "publishDraft", 1);
 __decorateClass([
   (0, import_common8.Post)("controllers/:id/configuration/rollback/:revision"),
   __decorateParam(0, (0, import_common8.Param)("id", import_common8.ParseIntPipe)),
   __decorateParam(1, (0, import_common8.Param)("revision", import_common8.ParseIntPipe)),
-  __decorateParam(2, (0, import_common8.Req)())
+  __decorateParam(2, (0, import_common8.Req)()),
+  __decorateParam(3, (0, import_common8.Body)())
 ], WagoControllerApi.prototype, "rollback", 1);
 __decorateClass([
   (0, import_common8.Get)("controllers/:id/configuration/revisions/:revision/preview"),
@@ -57945,7 +58687,7 @@ __decorateClass([
   __decorateParam(1, (0, import_common8.Param)("revision", import_common8.ParseIntPipe))
 ], WagoControllerApi.prototype, "previewRevision", 1);
 WagoControllerApi = __decorateClass([
-  (0, import_plugins_backend_sdk12.Auth)("resources.update"),
+  (0, import_plugins_backend_sdk13.Auth)("resources.update"),
   (0, import_common8.Controller)("wago"),
   __decorateParam(0, (0, import_common8.Inject)(WagoService)),
   __decorateParam(1, (0, import_common8.Inject)(WagoCommissioningService)),
@@ -57954,7 +58696,7 @@ WagoControllerApi = __decorateClass([
 
 // backend/wago-artifacts.controller.ts
 var import_common9 = require("@nestjs/common");
-var import_plugins_backend_sdk13 = require("@attraccess/plugins-backend-sdk");
+var import_plugins_backend_sdk14 = require("@attraccess/plugins-backend-sdk");
 var import_platform_express = __toESM(require_platform_express());
 var import_promises5 = require("node:fs/promises");
 var import_node_path3 = require("node:path");
@@ -58172,7 +58914,7 @@ __decorateClass([
   __decorateParam(0, (0, import_common9.UploadedFiles)())
 ], WagoArtifactsController.prototype, "import", 1);
 WagoArtifactsController = __decorateClass([
-  (0, import_plugins_backend_sdk13.Auth)("system.settings.manage"),
+  (0, import_plugins_backend_sdk14.Auth)("system.settings.manage"),
   (0, import_common9.Controller)("wago/runtime-artifacts"),
   __decorateParam(0, (0, import_common9.Inject)(WagoRuntimeArtifactsService))
 ], WagoArtifactsController);
@@ -58642,6 +59384,167 @@ WagoFlowService = __decorateClass([
   __decorateParam(0, (0, import_common10.Inject)(PLUGIN_CONTEXT4))
 ], WagoFlowService);
 
+// backend/diagnostics.controller.ts
+var import_common12 = require("@nestjs/common");
+var import_plugins_backend_sdk16 = require("@attraccess/plugins-backend-sdk");
+
+// backend/diagnostics.service.ts
+var import_common11 = require("@nestjs/common");
+var import_plugins_backend_sdk15 = require("@attraccess/plugins-backend-sdk");
+function own(values, key) {
+  return Object.prototype.hasOwnProperty.call(values, key) ? values[key] : void 0;
+}
+function metadataFromProvenance(provenance) {
+  if (!provenance) return { names: {}, presets: [] };
+  try {
+    return editorMetadata(JSON.parse(provenance).editor);
+  } catch {
+    return { names: {}, presets: [] };
+  }
+}
+function diagnosticReferences(nodes, channelIds, revision, capabilities) {
+  return nodes.map((node) => {
+    const channelId = typeof node.data.channelId === "string" ? node.data.channelId : "";
+    const control = node.type === "plugin.wago.command";
+    return {
+      nodeId: node.id,
+      resourceId: node.resourceId,
+      channelId,
+      control,
+      href: `/resources/${node.resourceId}/flows`,
+      invalid: !channelIds.includes(channelId) || control && (node.data.expectedConfigurationRevision !== revision || capabilities && (!own(capabilities, channelId)?.includes("output") || node.data.action === "pulse" && !own(capabilities, channelId)?.includes("pulse"))),
+      conflict: control && nodes.some(
+        (other) => other.type === "plugin.wago.command" && other.resourceId !== node.resourceId && other.data.channelId === channelId
+      )
+    };
+  });
+}
+var WagoDiagnosticsService = class {
+  constructor(context, wago) {
+    __publicField(this, "context", context);
+    __publicField(this, "wago", wago);
+  }
+  async get(controllerId) {
+    const controller = await this.context.getRepository(WagoController).findOneBy({ id: controllerId });
+    if (!controller) throw new import_common11.NotFoundException("WAGO controller not found");
+    const [draft, latest, applied, nodes] = await Promise.all([
+      this.context.getRepository(WagoConfigurationDraft).findOneBy({ controllerId }),
+      this.context.getRepository(WagoConfigurationRevision).findOne({ where: { controllerId }, order: { revision: "DESC" } }),
+      this.context.getRepository(WagoConfigurationRevision).findOne({ where: { controllerId, state: "applied" }, order: { revision: "DESC" } }),
+      this.context.dataSource.getRepository(import_plugins_backend_sdk15.ResourceFlowNode).createQueryBuilder("node").where("node.type LIKE :type", { type: "plugin.wago.%" }).andWhere("node.data ->> 'controllerId' = :controllerId", { controllerId }).take(1001).getMany()
+    ]);
+    const runtime = this.wago.diagnostics.read(controllerId);
+    const snapshot = latest ? JSON.parse(latest.snapshot) : null;
+    const appliedSnapshot = applied ? JSON.parse(applied.snapshot) : null;
+    const heartbeatAt = runtime.heartbeatAt ?? controller.lastHeartbeatAt;
+    const heartbeatFreshness = freshness(heartbeatAt);
+    const revisionMismatch = !!latest && (applied?.revision !== latest.revision || runtime.revision !== latest.revision || runtime.activeStream !== void 0 && runtime.contentHash !== latest.contentHash);
+    const connected = runtime.connected === false ? false : heartbeatFreshness === "fresh" || freshness(runtime.stateSourceAt) === "fresh";
+    const references = diagnosticReferences(
+      nodes.slice(0, 1e3),
+      appliedSnapshot?.logicalChannels.map((channel) => channel.id) ?? [],
+      applied?.revision ?? null,
+      Object.fromEntries(appliedSnapshot?.logicalChannels.map((channel) => [channel.id, channel.capabilities]) ?? [])
+    );
+    const validationErrors = draft ? validateSnapshot(JSON.parse(draft.snapshot)) : [];
+    return {
+      controllerId,
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      name: controller.name ?? controller.hardwareId,
+      connectivity: controller.trustState !== "claimed" ? "untrusted" : runtime.connected === false ? "disconnected" : connected ? "online" : "stale",
+      heartbeatAt,
+      heartbeatFreshness,
+      runtimeVersion: controller.runtimeVersion,
+      protocolVersion: controller.protocolVersion,
+      capabilities: JSON.parse(controller.capabilities).slice(0, 64),
+      incompatible: !!controller.compatibilityError,
+      sequenceGaps: runtime.activeStream ? runtime.sequenceGaps : null,
+      activeStream: runtime.activeStream ?? null,
+      trackingExhausted: runtime.trackingExhausted,
+      stateConnected: runtime.connected ?? null,
+      stateHardwareAvailable: runtime.hardwareAvailable ?? null,
+      stateSourceAt: runtime.stateSourceAt ?? null,
+      sequenceExplanation: runtime.activeStream ? "Gaps are scoped to boot UUID and message category; duplicates and retired streams are ignored." : "Legacy payloads have no source envelope; sequence gaps and source freshness are unavailable.",
+      configuration: {
+        draftUpdatedAt: draft?.updatedAt ?? null,
+        draftChanged: !!draft && (!latest || configurationHash(JSON.parse(draft.snapshot)) !== latest.contentHash || configurationHash(metadataFromProvenance(draft.presetProvenance)) !== configurationHash(metadataFromProvenance(latest.presetProvenance))),
+        validationErrorCount: validationErrors.length,
+        // Codes originate in our validator. Omit messages and dynamic paths, which can include arbitrary draft values.
+        validationCodes: [...new Set(validationErrors.map((error) => error.code))].slice(0, 50),
+        validationErrors: safeValidationSummaries(validationErrors),
+        rejectionErrors: latest?.rejectionErrors ? safeValidationSummaries(JSON.parse(latest.rejectionErrors)) : latest && runtime.rejection?.revision === latest.revision && runtime.rejection.contentHash === latest.contentHash ? runtime.rejection.errors : [],
+        publishedRevision: latest?.revision ?? null,
+        publishedState: latest?.state ?? null,
+        appliedRevision: applied?.revision ?? null,
+        reportedRevision: runtime.revision ?? null,
+        revisionMismatch,
+        rejected: latest?.state === "rejected"
+      },
+      hardwareReadiness: "unknown",
+      hardwareReadinessReason: "Reported hardware availability is shown when supplied; it does not prove physical I/O readiness. Applied configuration and cached output state are not physical proof.",
+      channels: (snapshot?.logicalChannels ?? []).slice(0, 256).map((channel) => {
+        const values = [
+          channel.capabilities.includes("input") ? own(runtime.inputs, channel.id) : void 0,
+          channel.capabilities.includes("output") ? own(runtime.outputs, channel.id) : void 0,
+          channel.capabilities.includes("measurement") ? own(runtime.measurements, channel.id) : void 0,
+          channel.capabilities.includes("measurement") ? own(runtime.cumulativeMeasurements, channel.id) : void 0
+        ].filter((value) => value !== void 0);
+        const samples = values.map((value) => {
+          const sourceFreshness = freshness(value.sourceAt);
+          const availabilityReason = controller.trustState !== "claimed" ? "untrusted" : controller.compatibilityError ? "incompatible-runtime" : runtime.trackingExhausted ? "stream-tracking-exhausted" : runtime.connected !== true || !connected ? "disconnected-or-unknown" : runtime.hardwareAvailable === false ? "hardware-unavailable" : revisionMismatch || !applied ? "configuration-mismatch" : own(runtime.faults, channel.id) ? "recent-fault" : freshness(runtime.stateSourceAt) !== "fresh" ? "state-source-unavailable-or-stale" : value.streamId !== runtime.activeStream ? "old-or-legacy-stream" : sourceFreshness !== "fresh" ? `source-${sourceFreshness}` : "current";
+          return { ...value, sourceFreshness, current: availabilityReason === "current", availabilityReason };
+        });
+        return {
+          id: channel.id,
+          profile: channel.profile,
+          capabilities: channel.capabilities,
+          disconnectPolicy: channel.disconnectPolicy,
+          safeState: channel.capabilities.includes("output") ? "off (runtime default)" : "not applicable",
+          samples,
+          current: samples.length > 0 && samples.every((value) => value.current),
+          fault: own(runtime.faults, channel.id) ?? null,
+          acknowledgement: own(runtime.acknowledgements, channel.id) ?? null
+        };
+      }),
+      faults: Object.entries(runtime.faults).map(([channelId, fault]) => ({ channelId, ...fault })),
+      references,
+      referencesTruncated: nodes.length > 1e3,
+      events: runtime.events,
+      limitations: [
+        "Hardware readiness remains unknown. Legacy samples have no source time and are never current.",
+        "Diagnostics retain at most 256 channels, 50 recent events and 15 minutes in this process.",
+        "Resource-page slots are not integrated. Flow links open the affected resource flow; node IDs identify the exact nodes.",
+        "The MQTT SDK exposes neither retained-message flags nor broker connection events. Source age is bounded to 90 seconds; immediate broker-disconnect detection is unavailable.",
+        "Stream tracking keeps at most 16 retired boot UUIDs per controller and six category counters, and fails closed when exhausted. Replayed source times never become receipt times."
+      ]
+    };
+  }
+};
+WagoDiagnosticsService = __decorateClass([
+  (0, import_common11.Injectable)(),
+  __decorateParam(0, (0, import_common11.Inject)(/* @__PURE__ */ Symbol.for("attraccess.plugin.context"))),
+  __decorateParam(1, (0, import_common11.Inject)(WagoService))
+], WagoDiagnosticsService);
+
+// backend/diagnostics.controller.ts
+var WagoDiagnosticsController = class {
+  constructor(diagnostics) {
+    __publicField(this, "diagnostics", diagnostics);
+  }
+  get(id) {
+    return this.diagnostics.get(id);
+  }
+};
+__decorateClass([
+  (0, import_common12.Get)("controllers/:id/diagnostics"),
+  __decorateParam(0, (0, import_common12.Param)("id", import_common12.ParseIntPipe))
+], WagoDiagnosticsController.prototype, "get", 1);
+WagoDiagnosticsController = __decorateClass([
+  (0, import_plugins_backend_sdk16.Auth)("resources.update"),
+  (0, import_common12.Controller)("wago"),
+  __decorateParam(0, (0, import_common12.Inject)(WagoDiagnosticsService))
+], WagoDiagnosticsController);
+
 // backend/plugin.ts
 var PLUGIN_CONTEXT5 = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
 var WagoPluginModule = class {
@@ -58698,7 +59601,7 @@ var plugin = {
     flowService = new WagoFlowService(context);
     return {
       module: WagoPluginModule,
-      controllers: [WagoControllerApi, WagoArtifactsController],
+      controllers: [WagoControllerApi, WagoArtifactsController, WagoDiagnosticsController],
       providers: [
         { provide: PLUGIN_CONTEXT5, useValue: context },
         WagoService,
@@ -58706,6 +59609,7 @@ var plugin = {
         WagoArtifactUploadInterceptor,
         WagoCommissioningReadiness,
         WagoCommissioningService,
+        WagoDiagnosticsService,
         { provide: WagoFlowService, useValue: flowService }
       ]
     };