@camstack/addon-agent-ui 1.2.159 → 1.2.161

package/dist/addon.js

@@ -1,6 +1,6 @@
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-//#region ../types/dist/event-category-C5xZWqz6.mjs
+//#region ../types/dist/event-category-BGmz_oxW.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -533,6 +533,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["PipelineAudioInferenceResult"] = "pipeline.audio-inference-result";
 	EventCategory["DetectionPhaseTransition"] = "detection.phase-transition";
+	/**
+	* A camera provider's RAW onboard motion push (D673): the `MotionOnMotionChanged`
+	* data shape without `triggeredBy`, built by `providerMotionEvent`. Its one
+	* consumer is the orchestrator's camera-sensors bridge, which re-emits the
+	* camera's EFFECTIVE onboard motion as `MotionOnMotionChanged` (a pass-through
+	* for a camera with no attached sensor). Providers must not emit
+	* `MotionOnMotionChanged` themselves; `scripts/check-onboard-motion-emitters.ts`
+	* keeps it so (camera-grid is a named, deferred exception).
+	*/
 	EventCategory["ProviderMotion"] = "provider.motion";
 	EventCategory["ProviderDetection"] = "provider.detection";
 	EventCategory["EnrichmentEmbeddingStored"] = "enrichment.embedding.stored";
@@ -5371,7 +5380,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-gU6hqv4_.mjs
+//#region ../types/dist/sleep-CDCONfkt.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7418,7 +7427,7 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 	return DeviceRole;
 }({});
 //#endregion
-//#region ../types/dist/composition-Dq42XWp0.mjs
+//#region ../types/dist/composition-43aqsZQj.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -7475,13 +7484,12 @@ portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac
 * LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
 * valutatore puro del suo FRONTE.
 *
-* Viveva dentro il builtin virtual-doorbell
-* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
-* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
-* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
-* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
-* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
-* SPOSTA qui e il doorbell la ri-esporta.
+* UNA tabella per tutti quelli che chiedono "questo device è ALTO?": il
+* trigger `RecordingTriggers.sensorDeviceIds` del recorder, i marker dei
+* sensori della post-analysis, il bridge camera-sensors dell'orchestratore e
+* le sorgenti di un campanello composto (`doorbellFeatureSources`, D671).
+* Una seconda copia divergerebbe alla prima cap aggiunta, e il sintomo — "il
+* sensore fa suonare il campanello ma non registra" — è esattamente D62.
 *
 * ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
 * due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
@@ -9216,7 +9224,7 @@ var RecordingTriggersSchema = object({
 	*
 	* Cosa vuol dire "alto" dipende dal TIPO di device e non è deciso qui:
 	* `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) è LA tabella,
-	* la stessa che il virtual-doorbell usa dal 2026-08-05. Ed è il FRONTE, non
+	* la stessa del campanello composto (D671). Ed è il FRONTE, non
 	* il livello: un contatto trovato già aperto al riavvio del runner non fa
 	* registrare.
 	*/
@@ -11571,6 +11579,68 @@ method(object({
 	password: string()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
+* How long one snapshot may take end to end: the pinned copy of the whole
+* database plus `PRAGMA integrity_check` over the copy, on the hub's slowest
+* disk. ~800 MB at a pessimistic 10 MB/s is under 3 minutes; the bound is
+* generous because a timeout fails the whole backup run.
+*/
+var DATABASE_SNAPSHOT_TIMEOUT_MS = 30 * 6e4;
+/**
+* The databases an owner snapshots — declared by the OWNER, so a caller never
+* guesses which file is live from what sits beside it (a cleanly closed
+* database has no sidecars and is just as owned). Paths are absolute on the
+* owner's host.
+*/
+var DatabaseSnapshotTargetsSchema = object({ databases: array(object({ livePath: string() })) });
+/** One b-tree table of the snapshot and the rows it holds. */
+var DatabaseSnapshotTableSchema = object({
+	name: string(),
+	rows: number().int().nonnegative()
+});
+/**
+* What the owner wrote. Every path is ABSOLUTE on the owner's host — the
+* caller pins the call to its own node, so it can read the file; a caller
+* that finds the path outside its own data root refuses it rather than
+* archiving something it cannot place.
+*/
+var DatabaseSnapshotResultSchema = object({
+	/** The live database the snapshot copies. Never to be copied as a file. */
+	livePath: string(),
+	/** The verified copy: `<livePath>` + {@link DATABASE_SNAPSHOT_SUFFIX}. */
+	snapshotPath: string(),
+	sizeBytes: number().int().nonnegative(),
+	pageCount: number().int().nonnegative(),
+	pageSize: number().int().positive(),
+	/**
+	* Every b-tree table with its row count. Read inside the SAME read
+	* transaction the copy was taken from, and found EQUAL on the copy — so
+	* this is the content of the snapshot, not an estimate of the source.
+	*/
+	tables: array(DatabaseSnapshotTableSchema),
+	/** Wall time of the pinned copy (row counts included). */
+	copyMs: number().nonnegative(),
+	/** Wall time of the checks on the copy (`integrity_check`, row counts). */
+	verifyMs: number().nonnegative(),
+	/** When the pinned read transaction began (ms epoch) — the snapshot's instant. */
+	takenAt: number()
+});
+/**
+* A snapshot as an ARCHIVE records it (`ArchiveManifest.sqliteSnapshots`):
+* the same facts, with both paths relative to the archive root (the node's
+* data dir), because an archive outlives the host that made it.
+*/
+var ArchiveSqliteSnapshotSchema = DatabaseSnapshotResultSchema.extend({
+	/** Archive-relative path of the live database the archive does NOT carry. */
+	livePath: string(),
+	/** Archive-relative path of the verified copy it carries in its place. */
+	snapshotPath: string()
+});
+method(object({}), DatabaseSnapshotTargetsSchema, { auth: "admin" }), method(object({}), DatabaseSnapshotResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: DATABASE_SNAPSHOT_TIMEOUT_MS
+});
+/**
 * Orchestrator-side destination metadata. The orchestrator computes
 * `id = <addonId>:<subId>` from its provider lookup so consumers
 * (admin UI, restore flow) see one canonical key.
@@ -11681,7 +11751,12 @@ var ArchiveManifestSchema = object({
 	locations: array(string()),
 	entries: array(ArchiveEntrySchema),
 	totalBytes: number(),
-	totalFiles: number()
+	totalFiles: number(),
+	/**
+	* Live SQLite databases this archive carries as their OWNER's verified
+	* snapshot instead of as files (D693). Absent on archives made before.
+	*/
+	sqliteSnapshots: array(ArchiveSqliteSnapshotSchema).optional()
 });
 var LocationStatSchema = object({
 	name: string(),
@@ -13105,6 +13180,52 @@ var CompositionBlockStateSchema = object({
 	reason: string().optional(),
 	fields: array(CompositionFieldStateSchema)
 });
+var ComposerBlockSchema = object({
+	id: string().min(1),
+	name: string().min(1).max(120),
+	enabled: boolean(),
+	updatedAt: number(),
+	composition: CompositionSchema
+});
+/**
+* A stored composition row that no longer PARSES — a schema a release
+* tightened, a row written by a newer build. Sent by id so the composer keeps
+* its device as a placeholder and reports the block `failed` naming the parse
+* error. Leaving it out would read, twice, exactly like a delete (D49).
+*/
+var ComposerUnreadableBlockSchema = object({
+	id: string().min(1),
+	/** The row's stored name column; null when even that is unreadable (the device keeps the name it has). */
+	name: string().nullable(),
+	/** The parse error, in the operator's words. */
+	error: string()
+});
+method(object({
+	/** The shared Blocks integration; null until `core-blocks` has reconciled it. */
+	integrationId: string().nullable(),
+	/** False when the `core_blocks` read failed: then nothing may be withdrawn (D49). */
+	storeLoaded: boolean(),
+	blocks: array(ComposerBlockSchema),
+	/** Operator restarts: rebuild these runtimes and re-resolve their sources. Stores nothing (D62). */
+	restartBlockIds: array(string()),
+	/** Composition rows that exist but do not parse: held, never withdrawn, reported failed. */
+	unreadableBlocks: array(ComposerUnreadableBlockSchema)
+}), object({
+	blocks: array(object({
+		blockId: string(),
+		status: CompositionRunStatusSchema,
+		reason: string().optional()
+	})),
+	/**
+	* False when the composer declared and withdrew NOTHING (store not loaded,
+	* integration unknown, its own rows unread or read empty once). An empty
+	* apply the caller owes is paid off only by one the composer acted on (D49).
+	*/
+	acted: boolean()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
 var NUMBER = {
 	kind: "fixed",
 	result: ["number"]
@@ -13341,52 +13462,6 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 	auth: "admin",
 	access: "view"
 });
-var ComposerBlockSchema = object({
-	id: string().min(1),
-	name: string().min(1).max(120),
-	enabled: boolean(),
-	updatedAt: number(),
-	composition: CompositionSchema
-});
-/**
-* A stored composition row that no longer PARSES — a schema a release
-* tightened, a row written by a newer build. Sent by id so the composer keeps
-* its device as a placeholder and reports the block `failed` naming the parse
-* error. Leaving it out would read, twice, exactly like a delete (D49).
-*/
-var ComposerUnreadableBlockSchema = object({
-	id: string().min(1),
-	/** The row's stored name column; null when even that is unreadable (the device keeps the name it has). */
-	name: string().nullable(),
-	/** The parse error, in the operator's words. */
-	error: string()
-});
-method(object({
-	/** The shared Blocks integration; null until `core-blocks` has reconciled it. */
-	integrationId: string().nullable(),
-	/** False when the `core_blocks` read failed: then nothing may be withdrawn (D49). */
-	storeLoaded: boolean(),
-	blocks: array(ComposerBlockSchema),
-	/** Operator restarts: rebuild these runtimes and re-resolve their sources. Stores nothing (D62). */
-	restartBlockIds: array(string()),
-	/** Composition rows that exist but do not parse: held, never withdrawn, reported failed. */
-	unreadableBlocks: array(ComposerUnreadableBlockSchema)
-}), object({
-	blocks: array(object({
-		blockId: string(),
-		status: CompositionRunStatusSchema,
-		reason: string().optional()
-	})),
-	/**
-	* False when the composer declared and withdrew NOTHING (store not loaded,
-	* integration unknown, its own rows unread or read empty once). An empty
-	* apply the caller owes is paid off only by one the composer acted on (D49).
-	*/
-	acted: boolean()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
 /**
 * `custom-model-registry` — collection cap exposing operator-registered
 * custom detection models. Each provider (today: `addon-model-studio`)
@@ -15235,6 +15310,121 @@ method(object({
 	deviceIds: array(number()).readonly(),
 	caps: array(string()).readonly().optional()
 }), record(string(), record(string(), unknown().nullable())));
+var ExtensionSlotIdSchema = _enum(["linked-devices"]);
+DeviceType.Camera;
+/** A slot's editable value, discriminated on `slot`. */
+var ExtensionSlotValueSchema = discriminatedUnion("slot", [LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
+DeviceType.Camera;
+var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
+	state: literal("unreachable"),
+	reason: string()
+})]);
+/** One provider of slots — the D554 source-listing row. */
+var ExtensionSourceSchema = object({
+	/** The routing prefix of every `slotRef` this provider serves. */
+	source: string(),
+	label: string(),
+	/** Stamped by the dispatcher from the registry (D557). */
+	addonId: string().optional(),
+	availability: ExtensionSourceAvailabilitySchema
+});
+/**
+* How one picked source stands. `missing` — no such device (deleted, or an id
+* that never existed); `foreign` — a device the slot's owner cannot read from
+* (a source owned by another addon); `unavailable` — it exists but is not a
+* valid source now (a container, which is never a pick). A source in any of
+* these states is SHOWN, never silently dropped or re-pointed.
+*/
+var ExtensionSourceHealthSchema = _enum([
+	"ok",
+	"missing",
+	"foreign",
+	"unavailable"
+]);
+var ExtensionSlotSourceSchema = object({
+	deviceId: number().int(),
+	/** The device's name, or null when it could not be resolved (`missing`). */
+	name: string().nullable(),
+	health: ExtensionSourceHealthSchema,
+	detail: string().optional()
+});
+/**
+* A DIFFERENT authority that gates whether the slot's sources do anything —
+* reported read-only, named, never written through this contract (D62) — e.g.
+* a slot whose sources act only while a wrapper is bound to the host, a
+* binding that belongs to `deviceManager.setWrapperActive`. No slot reports
+* one today (`linked-devices` answers `null`). `unknown` means the gate could
+* not be read; it is not "inactive" (D315).
+*/
+var ExtensionSlotActivationSchema = object({
+	state: _enum([
+		"active",
+		"inactive",
+		"unknown"
+	]),
+	authority: string(),
+	detail: string().optional()
+});
+var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
+	state: literal("ok"),
+	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
+	slotRef: string(),
+	slot: ExtensionSlotIdSchema,
+	/** Names the store written (D62), e.g. `device-manager:_linkedDeviceIds`. */
+	authority: string(),
+	activation: ExtensionSlotActivationSchema.nullable(),
+	value: ExtensionSlotValueSchema,
+	sources: array(ExtensionSlotSourceSchema),
+	/**
+	* Devices the owner links to the host ON ITS OWN, by structure, and that
+	* are therefore not in `value` (D655): a camera's device-tree children, and
+	* the child a picked container stands for (D356 — a container is never a
+	* pick, its children are). Read-only; the editor shows them and may offer
+	* per-device options on them (the linked-devices tracked-event opt-in).
+	* Absent when the owner links nothing beyond the picks, and from an owner
+	* older than D655.
+	*/
+	impliedSources: array(ExtensionSlotSourceSchema).optional()
+}), object({
+	state: literal("unreachable"),
+	addonId: string(),
+	reason: string()
+})]);
+var ExtensionCandidatesSchema = object({ candidates: array(object({
+	deviceId: number().int(),
+	name: string(),
+	type: string(),
+	location: string().nullable(),
+	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
+	parentName: string().nullable(),
+	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
+	suggested: boolean(),
+	/** Why it is suggested ("same location"), null when it is not. */
+	reason: string().nullable()
+})) });
+/**
+* What a write did. `none` — applied in place. `host` / `parent` — the owner
+* reloaded the host (or, for an accessory child, its parent) because the
+* write changed what the host REGISTERS. A slot never adds a capability to its
+* host — that is a composition (D663) — so today's owners answer `none`.
+*/
+var ExtensionSetResultSchema = object({
+	applied: literal(true),
+	reload: _enum([
+		"none",
+		"host",
+		"parent"
+	])
+});
+var ExtensionSlotRefInputSchema = object({
+	deviceId: number().int(),
+	slotRef: string().min(1)
+});
+var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
+method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * Per-field ownership (D663). A composition may CLAIM fields of a native
 * cap's runtime-state slice on an existing device: `replace` overlays the
@@ -18207,17 +18397,25 @@ var NcScheduleSchema = object({
 */
 var NcSystemEventDeliveryModeSchema = _enum(["instant", "summary"]);
 /**
+* How a summary window is SENT (D698): `rule` (absent) = ONE notification with
+* every section; `section` = one notification per section with something to
+* say (an unavailable section included), each titled by its section.
+*/
+var NcStateSummarySplitSchema = _enum(["rule", "section"]);
+/**
 * `summary`: the rule sends NOTHING per event. When a window of `schedule`
 * CLOSES, it sends one notification with the current state of its kinds
 * (low batteries, consumables to replace, devices offline, updates
-* available, ...), after its own filters. Nothing to report sends nothing.
+* available, ...), after its own filters — or, with `split: 'section'`
+* (D698), one notification per section. Nothing to report sends nothing.
 * The schedule is the ordinary `NcSchedule` (weekly windows, IANA timezone,
 * midnight crossing); the send time is each window's END. Refused on the
 * `alarm` family, which stays instant (`systemEventDeliveryProblems`).
 */
 var NcSystemEventDeliverySchema = discriminatedUnion("mode", [object({ mode: literal("instant") }), object({
 	mode: literal("summary"),
-	schedule: NcScheduleSchema
+	schedule: NcScheduleSchema,
+	split: NcStateSummarySplitSchema.optional()
 })]);
 /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
 var NcPlateMatcherSchema = object({
@@ -18868,10 +19066,12 @@ var NcMediaPolicySchema = object({
 /**
 * Cooldown GRANULARITY over the subject's class — how much a fired
 * notification suppresses.
-*  - `shared` (default, and the absent value) — one window for the whole
-*    rule/scope: a cat silences the next dog for `cooldownSec`.
-*  - `per-class` — an independent window per detected class, so cat→dog fires
-*    at once and cat→cat still waits.
+*  - `per-class` (default, and the absent value since 2026-10-01 — D36) — an
+*    independent window per detected class: cat→dog fires at once, cat→cat
+*    still waits.
+*  - `shared` — one window for the whole rule/scope: a cat silences the next
+*    dog for `cooldownSec`. Only written when an operator picks it; it is no
+*    longer what an unset rule means.
 *
 * AUDIO subjects are ALWAYS per-class regardless of this setting: a scream
 * must not be swallowed by a bark's window (the precedent this generalizes —
@@ -18886,8 +19086,11 @@ var NcThrottleSchema = object({
 	/**
 	* Class granularity of the cooldown key. Optional rather than defaulted:
 	* a Zod default does NOT run on the addon→addon cap path, so a persisted
-	* rule authored before this field simply carries none — and the engine
-	* reads absent as `shared`, the pre-existing behaviour.
+	* rule authored before this field simply carries none. The engine used to
+	* read absent as `shared` (D36); since 2026-10-01 it reads absent as
+	* `per-class` — the operator's default — and only an explicit `shared`
+	* still means `shared`. See `cooldownKey` / `keysPerClass` in the rule
+	* engine, and D36's dated note.
 	*/
 	granularity: NcThrottleGranularitySchema.optional()
 });
@@ -19211,11 +19414,23 @@ var NcStateSummaryPreviewSectionSchema = object({
 	reason: string().optional()
 });
 /**
+* One notification a previewed summary would send (D698): the whole summary on
+* a `rule` split (no `section`), one section's on a `section` split.
+*/
+var NcStateSummaryPreviewRowSchema = object({
+	section: string().optional(),
+	/** The section's name on a per-section row; every reported section's, joined, on a combined one. */
+	title: string(),
+	text: string(),
+	count: number().int().nonnegative()
+});
+/**
 * The summary a rule would send now. `empty` = nothing to report and every
 * section read: such a summary is NOT sent. `dropped` counts the open states
 * the rule's own filters (or a camera mute) left out, by reason.
 * `excludedGroups` names the kind groups selected that have no state to report
-* (backups & exports).
+* (backups & exports). `split` and `rows` (D698) say how it would be sent —
+* optional, so an older hub's answer still parses.
 */
 var NcStateSummaryPreviewSchema = object({
 	empty: boolean(),
@@ -19223,7 +19438,9 @@ var NcStateSummaryPreviewSchema = object({
 	text: string(),
 	sections: array(NcStateSummaryPreviewSectionSchema),
 	dropped: record(string(), number().int().nonnegative()),
-	excludedGroups: array(string())
+	excludedGroups: array(string()),
+	split: NcStateSummarySplitSchema.optional(),
+	rows: array(NcStateSummaryPreviewRowSchema).optional()
 });
 var NcTestResultSchema = object({
 	recordId: string(),
@@ -20237,12 +20454,26 @@ var CameraSensorRefSchema = object({
 function cameraSensorRefKey(ref) {
 	return `${ref.addonId}/${ref.stableId}`;
 }
-/** CS-1 accepts exactly one mode; CS-2 (D673) widens it to confirm / replace. */
-var CameraSensorsModeSchema = _enum(["in-addition"]);
-var CameraSensorsConfigSchema = object({
-	mode: CameraSensorsModeSchema,
-	sensors: array(CameraSensorRefSchema).min(1).max(8)
-}).superRefine((value, ctx) => {
+/**
+* A sensor's mode (D673). `in-addition`: its motion is the camera's motion too.
+* `replace`: its motion is the camera's, and while one is READY the camera's
+* own motion no longer counts on its own. `confirm`: while one is READY the
+* camera's own motion counts only while a confirm sensor is active — with or
+* without a replace sensor (spec C2, the controller's ruling on Q1).
+*/
+var CameraSensorModeSchema = _enum([
+	"in-addition",
+	"confirm",
+	"replace"
+]);
+/** A stored sensor with no mode — every CS-1 row — is in addition. */
+var DEFAULT_CAMERA_SENSOR_MODE = "in-addition";
+/**
+* A camera's attached sensors. A CS-1 row carried an envelope
+* `mode: 'in-addition'`: `z.object` drops it on parse, and the PARSED value is
+* what the write stores (D672 rule 3), so it is never written again.
+*/
+var CameraSensorsConfigSchema = object({ sensors: array(CameraSensorRefSchema.extend({ mode: CameraSensorModeSchema.default(DEFAULT_CAMERA_SENSOR_MODE) })).min(1).max(8) }).superRefine((value, ctx) => {
 	const seen = /* @__PURE__ */ new Set();
 	value.sensors.forEach((ref, index) => {
 		const key = cameraSensorRefKey(ref);
@@ -20254,39 +20485,41 @@ var CameraSensorsConfigSchema = object({
 		seen.add(key);
 	});
 });
-var RefFields = {
+/** Every attachment names its mode; an older orchestrator that does not is in addition. */
+var AttachmentFields = {
 	addonId: string(),
-	stableId: string()
+	stableId: string(),
+	mode: CameraSensorModeSchema.default(DEFAULT_CAMERA_SENSOR_MODE)
 };
 var CameraSensorAttachmentSchema = discriminatedUnion("state", [
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("ready"),
 		deviceId: number(),
 		name: string(),
 		caps: array(string()).readonly()
 	}),
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("offline"),
 		deviceId: number(),
 		name: string(),
 		reason: _enum(["offline", "disabled"])
 	}),
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("missing"),
 		reason: string()
 	}),
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("unsupported"),
 		deviceId: number(),
 		name: string(),
 		reason: string()
 	}),
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("unreadable"),
 		reason: string()
 	})
@@ -20299,17 +20532,49 @@ var CameraSensorAttachmentSchema = discriminatedUnion("state", [
 * say.
 */
 var CameraSensorsNotForwardedSchema = _enum(["onboard-not-listed", "no-active-detection"]);
+/** Whether the camera's OWN motion counts on its own (D673 C2), from its READY sensors (C3). */
+var CameraOwnMotionSchema = _enum([
+	"always",
+	"when-confirmed",
+	"never"
+]);
+/** Confirm / Replace cannot suppress this camera's motion: its provider still emits it directly (D673 C13). */
+var CameraSensorsNotEnforcedSchema = _enum(["provider-not-split"]);
+/**
+* The camera's OWN onboard motion (D696): the raw input the bridge combines,
+* never the effective value. The camera's `motion` slice is the effective one,
+* so a view of the camera's own row reads this.
+* - `atMs`: when the bridge received the camera's last own edge.
+* - `detected`: evaluated WHEN THE STATUS IS ASKED — the last edge said `true`
+*   AND it is younger than the window the bridge counts the camera's own motion
+*   for (`motionCooldownMs`, floored at two sustain ticks). A camera that never
+*   sends a clear (heartbeats only) therefore reads `false` once no push came
+*   within the window; a status read is a snapshot, so a live view re-asks.
+* Absent = this orchestrator has not received the camera's own motion since it
+* started (unknown, never "quiet"), or an orchestrator older than D696.
+*/
+var CameraRawLevelSchema = object({
+	detected: boolean(),
+	atMs: number()
+});
 var CameraSensorsStatusSchema = discriminatedUnion("state", [
-	object({ state: literal("not-configured") }),
+	object({
+		state: literal("not-configured"),
+		cameraLevel: CameraRawLevelSchema.optional()
+	}),
 	object({
 		state: literal("unreadable"),
-		reason: string()
+		reason: string(),
+		cameraLevel: CameraRawLevelSchema.optional()
 	}),
 	object({
 		state: literal("configured"),
-		mode: CameraSensorsModeSchema,
+		cameraLevel: CameraRawLevelSchema.optional(),
 		sensors: array(CameraSensorAttachmentSchema).readonly(),
-		notForwarded: CameraSensorsNotForwardedSchema.optional()
+		/** Absent = an orchestrator older than CS-2: it does not say (D315). */
+		cameraMotion: CameraOwnMotionSchema.optional(),
+		notForwarded: CameraSensorsNotForwardedSchema.optional(),
+		notEnforced: CameraSensorsNotEnforcedSchema.optional()
 	})
 ]);
 Object.freeze({
@@ -23500,8 +23765,10 @@ var RunnerCameraConfigSchema = object({
 	* - `analyzer`: ML/frame-diff motion detection (motion-wasm or other
 	*   analyzer providers) running on decoded frames in this runner.
 	* - `onboard`: camera-native motion pushes (Reolink Baichuan, ONVIF
-	*   analytics). The provider emits ProviderMotion
-	*   events; the orchestrator forwards to `reportMotion`.
+	*   analytics). The provider emits its raw push as `ProviderMotion`
+	*   (D673); the orchestrator's camera-sensors bridge re-emits the camera's
+	*   effective motion as `MotionOnMotionChanged`, which is what reaches
+	*   `reportMotion`.
 	*/
 	motionSources: MotionSourcesSchema.default(["analyzer"]),
 	/**
@@ -23678,7 +23945,15 @@ var RunnerLocalLoadSchema = object({
 		hasGpu: boolean(),
 		inferenceBackend: string().optional(),
 		cpuCores: number().optional()
-	})
+	}),
+	/**
+	* Who writes a camera's `motion` runtime slice (D696). `'orchestrator'`: this
+	* runner never writes it. ABSENT = a runner older than D696, which still
+	* writes the slice from its phase machine; the orchestrator does not write
+	* while any runner node is absent-or-unanswered, so one slice never has two
+	* writers.
+	*/
+	motionSliceWriter: literal("orchestrator").optional()
 });
 /**
 * Aggregate runtime metrics for the runner's whole local pool. Mirrors the
@@ -26702,138 +26977,6 @@ DeviceType.Camera, method(object({
 	kind: "query",
 	auth: "protected"
 });
-object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: number()
-});
-object({
-	deviceId: number(),
-	timestamp: number()
-});
-/**
-* The `doorbell-source` extension slot's editable value (D648): the camera's
-* virtual-doorbell trigger devices, exactly what the wrapper's
-* `doorbellSources` persists (as `{ deviceId }` records).
-*/
-var DoorbellSourceSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
-DeviceType.Camera;
-DeviceType.Button, DeviceType.Camera;
-var ExtensionSlotIdSchema = _enum(["doorbell-source", "linked-devices"]);
-DeviceType.Camera, DeviceType.Camera;
-/** A slot's editable value, discriminated on `slot`. */
-var ExtensionSlotValueSchema = discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
-DeviceType.Camera;
-var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
-	state: literal("unreachable"),
-	reason: string()
-})]);
-/** One provider of slots — the D554 source-listing row. */
-var ExtensionSourceSchema = object({
-	/** The routing prefix of every `slotRef` this provider serves. */
-	source: string(),
-	label: string(),
-	/** Stamped by the dispatcher from the registry (D557). */
-	addonId: string().optional(),
-	availability: ExtensionSourceAvailabilitySchema
-});
-/**
-* How one picked source stands. `missing` — no such device (deleted, or an id
-* that never existed); `foreign` — a device the slot's owner cannot read from
-* (a source owned by another addon); `unavailable` — it exists but is not a
-* valid source now (a container, which is never a pick). A source in any of
-* these states is SHOWN, never silently dropped or re-pointed.
-*/
-var ExtensionSourceHealthSchema = _enum([
-	"ok",
-	"missing",
-	"foreign",
-	"unavailable"
-]);
-var ExtensionSlotSourceSchema = object({
-	deviceId: number().int(),
-	/** The device's name, or null when it could not be resolved (`missing`). */
-	name: string().nullable(),
-	health: ExtensionSourceHealthSchema,
-	detail: string().optional()
-});
-/**
-* A DIFFERENT authority that gates whether the slot's sources do anything —
-* reported read-only, named, never written through this contract (D62). The
-* virtual doorbell's sources ring only while the wrapper is bound to the
-* camera, and that binding belongs to `deviceManager.setWrapperActive`.
-* `unknown` means the gate could not be read; it is not "inactive" (D315).
-*/
-var ExtensionSlotActivationSchema = object({
-	state: _enum([
-		"active",
-		"inactive",
-		"unknown"
-	]),
-	authority: string(),
-	detail: string().optional()
-});
-var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
-	state: literal("ok"),
-	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
-	slotRef: string(),
-	slot: ExtensionSlotIdSchema,
-	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
-	authority: string(),
-	activation: ExtensionSlotActivationSchema.nullable(),
-	value: ExtensionSlotValueSchema,
-	sources: array(ExtensionSlotSourceSchema),
-	/**
-	* Devices the owner links to the host ON ITS OWN, by structure, and that
-	* are therefore not in `value` (D655): a camera's device-tree children, and
-	* the child a picked container stands for (D356 — a container is never a
-	* pick, its children are). Read-only; the editor shows them and may offer
-	* per-device options on them (the linked-devices tracked-event opt-in).
-	* Absent when the owner links nothing beyond the picks, and from an owner
-	* older than D655.
-	*/
-	impliedSources: array(ExtensionSlotSourceSchema).optional()
-}), object({
-	state: literal("unreachable"),
-	addonId: string(),
-	reason: string()
-})]);
-var ExtensionCandidatesSchema = object({ candidates: array(object({
-	deviceId: number().int(),
-	name: string(),
-	type: string(),
-	location: string().nullable(),
-	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
-	parentName: string().nullable(),
-	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
-	suggested: boolean(),
-	/** Why it is suggested ("same location"), null when it is not. */
-	reason: string().nullable()
-})) });
-/**
-* What a write did. `none` — applied in place. `host` / `parent` — the owner
-* reloaded the host (or, for an accessory child, its parent) because the
-* write changed what the host REGISTERS. A slot never adds a capability to its
-* host — that is a composition (D663) — so today's owners answer `none`.
-*/
-var ExtensionSetResultSchema = object({
-	applied: literal(true),
-	reload: _enum([
-		"none",
-		"host",
-		"parent"
-	])
-});
-var ExtensionSlotRefInputSchema = object({
-	deviceId: number().int(),
-	slotRef: string().min(1)
-});
-var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
-method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
 /**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
@@ -28651,6 +28794,17 @@ object({
 	deviceId: number(),
 	status: DeviceStatusSchema
 });
+object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: number()
+});
+object({
+	deviceId: number(),
+	timestamp: number()
+});
+DeviceType.Button, DeviceType.Camera;
 /**
 * Enum-state sensor — a string value picked from a finite option set.
 * Drives HA `sensor` entries with `state_class: enum` (HVAC action
@@ -30295,9 +30449,9 @@ object({
 	/** Ms epoch of the last detected-true observation. Null if never detected. */
 	lastDetectedAt: number().nullable(),
 	/**
-	* `MOTION_CLOSE_AFTER_MS` while `detected: true` on a `Camera` device,
-	* `null` while false and on every `Sensor` device (D475) — see that
-	* constant's doc for the one-authority rule.
+	* `MOTION_CLOSE_AFTER_MS` while `detected: true` on a `Camera` device (the
+	* orchestrator writes it, D696), `null` while false and on every `Sensor`
+	* device (D475) — see that constant's doc for the one-authority rule.
 	*
 	* ## Reading this field still arms nothing
 	*
@@ -30315,38 +30469,41 @@ object({
 	* `addon-export-alexa/src/motion-clear-hold.ts` and
 	* `addon-export-hap`'s `RESET_DEBOUNCE_MS` both do.
 	*
-	* ## Who writes it
-	*
-	* - **Cameras** — the runner's phase machine, `active → watching` on
-	*   `cooldown_expired`, which then writes this slice with
-	*   `detected: false` (`handlePhaseChanged` in
-	*   `pipeline-runner/index.ts`). It produces the FALLING edge, which
-	*   matters most for the sources that only ever push a rising one:
-	*   Reolink emits `MotionOnMotionChanged { detected: true }` and never
-	*   a false.
-	* - **Sensors** (Home Assistant binary sensors, Homematic) — the
-	*   provider pushes the false itself, from the upstream system's own
-	*   state change. No phase machine is involved.
-	*
-	* ### The phase machine is CANONICAL, not sole — and that is a defect
-	*
-	* An earlier revision of this docblock (mine, 2026-09-12) claimed the
-	* phase machine is the sole writer for a camera. It is not.
-	* `hikvision-camera.ts:3464` and `amcrest-camera.ts:445` both call
-	* `setCapSlice(motionCapability, …)` on their own rising edge, and
-	* Hikvision's comment says why: it read THIS docblock, agreed the
-	* runner is canonical, and wrote anyway to avoid per-tick churn. So
-	* two authorities can disagree about one slice, which this repo
-	* forbids, and the doc said otherwise — which is worse than saying
-	* nothing, because it reads as verification.
-	*
-	* This predates D475 and is not fixed there: the fix touches every
-	* camera provider. Recorded in D475's Consequences. Do not restore the
-	* "sole writer" wording without also removing the other writers.
+	* ## Who writes it (D696)
+	*
+	* - **Cameras** — the orchestrator, and nothing else. It writes the camera's
+	*   EFFECTIVE motion (`addon-pipeline-orchestrator`
+	*   `camera-sensors/motion-slice.ts`), alongside the effective
+	*   `MotionOnMotionChanged` it emits or receives: the camera-sensors bridge
+	*   for a split camera, an unsplit emitter's direct event, the analyzer and
+	*   device activity, as the camera's `motionSources` counts them. A source
+	*   that never sends a clear falls one window after its last `true`.
+	*   `lastDetectedAt` moves only on an effective rise. No camera provider
+	*   writes this slice (not even a boot seed), and neither does the runner's
+	*   phase machine: its phase is "a session is attached" for every on-motion
+	*   session, not motion, and it now has its own `DetectionPhaseTransition`.
+	*   A provider's `isDetected` answers from the hub's slice.
+	* - **Sensors** (Home Assistant binary sensors, Homematic, Matter, Alexa
+	*   imports) — the provider pushes both edges itself, from the upstream
+	*   system's own state change. That is the sensor's own fact.
+	*
+	* `scripts/check-onboard-motion-emitters.ts` refuses any other writer of a
+	* `motion` slice; each sensor writer is a named exemption.
+	*
+	* This replaces the D475 §4 rule ("the phase machine is the sole writer").
+	* That rule was never true: Hikvision and Amcrest wrote the slice raw beside
+	* it, every provider seeded it at boot, and every session left it
+	* `detected: true` after its detach.
 	*/
 	autoClearAfterMs: number().nullable()
 });
-object({
+/**
+* Payload of `motion.onMotionChanged` event + the corresponding bus
+* event `EventCategory.MotionOnMotionChanged`. Single source of truth
+* — both the cap event surface and the bus payload type alias to this
+* schema.
+*/
+var MotionOnMotionChangedDataSchema = object({
 	deviceId: number(),
 	detected: boolean(),
 	timestamp: number(),
@@ -37933,6 +38090,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"databaseSnapshot.listDatabases": {
+		capName: "database-snapshot",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"databaseSnapshot.writeSnapshot": {
+		capName: "database-snapshot",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dataStoreProvider.aggregate": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -46461,6 +46630,18 @@ var STATE_SUMMARY_VARS = [
 		systemEventKinds: [...SUMMARISABLE],
 		systemEventDeliveries: ["summary"]
 	},
+	{
+		name: "summarySection",
+		label: "Summary: this section",
+		description: "The section a per-section summary row is about (D698); on a summary sent as one message, every section it reports, comma-separated.",
+		example: "Batterie scariche",
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...SUMMARISABLE],
+		systemEventDeliveries: ["summary"]
+	},
 	...STATE_SUMMARY_SECTION_VARS.map((v) => ({
 		name: v.name,
 		label: v.label,
@@ -46799,6 +46980,7 @@ TimelapseRuleInputSchema.extend({
 	createdAt: number(),
 	updatedAt: number()
 });
+MotionOnMotionChangedDataSchema.omit({ triggeredBy: true });
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -47002,7 +47184,7 @@ var AgentUIAddon = class extends BaseAddon {
 			capability: adminUiCapability,
 			provider: {
 				getStaticDir: async () => ({ staticDir: path.resolve(__dirname) }),
-				getVersion: async () => ({ version: "1.2.159" })
+				getVersion: async () => ({ version: "1.2.161" })
 			}
 		}];
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-agent-ui",
-  "version": "1.2.159",
+  "version": "1.2.161",
   "description": "Agent UI — lightweight status dashboard served by every agent node",
   "keywords": [
     "camstack",