@camstack/addon-matter-broker 0.2.115 → 0.2.116

package/dist/addon.mjs

@@ -5382,7 +5382,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-C-v96WpE.mjs
+//#region ../types/dist/sleep-gU6hqv4_.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7425,7 +7425,59 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-BK-GTFYb.mjs
+//#region ../types/dist/composition-Dq42XWp0.mjs
+/**
+* The ffmpeg build every CamStack node downloads, per platform and arch.
+*
+* ## Why a download, on every node, including the container
+*
+* The version of ffmpeg used to be CODE: baked into the image, changeable only
+* by rebuilding and rolling it. Now it is DATA — this file states the release,
+* and a node that boots with a different one downloads it. Changing ffmpeg is a
+* framework bump, not an image rebuild.
+*
+* It also settles the licence question by removing it. FFmpeg's licence is
+* chosen at compile time: the core is LGPL 2.1+, `--enable-gpl` makes it GPL
+* (for x264/x265), `--enable-version3` makes that v3, and `--enable-nonfree`
+* makes the result undistributable. These are GPL v3 builds, and we do not
+* distribute them: the user's own node fetches the archive from the project
+* that publishes it, so we convey no GPL work and inherit none of the
+* obligations that come with conveying one. That is the whole reason the image
+* no longer installs ffmpeg at all — not a technical preference.
+*
+* ## Why jellyfin-ffmpeg
+*
+* One vendor covering linux-amd64, linux-arm64, darwin-arm64 and darwin-x64
+* from one release, with the widest hardware surface of anything maintained:
+* VAAPI, QSV, NVENC/NVDEC, AMF, Vulkan, OpenCL and DRM on amd64, plus Rockchip
+* MPP on arm64. It reaches the vendor libraries through dlopen trampolines,
+* so the binary is not linked against a driver stack it may not find.
+*
+* **What it still needs from the host, measured 2026-09-19.** On the Unraid
+* HOST, which has no libva, `-vaapi_device` aborts the process outright —
+* `implib-gen: libva-drm.so.2: failed to load library ... Assertion '0 &&
+* "Assertion in generated code"' failed`. Inside our container, which installs
+* libva plus the iHD driver, the same command encodes: verified end to end with
+* `testsrc → format=nv12,hwupload → h264_vaapi`. So the image drops ffmpeg and
+* KEEPS the Intel media stack; the drivers are the part a binary cannot bring.
+*
+* ## Why each artifact carries a checksum and a claim
+*
+* The download is now the only source, so `sha256` is verified before anything
+* is extracted — jellyfin publishes no checksums on its release assets, so
+* these are ours, taken at the version bump. And `expectedHwaccels` is what the
+* build is supposed to be able to do: a binary that probes short of its own
+* claim is a source that changed under us, which is precisely what went
+* unnoticed for months when a static build turned out to carry no VAAPI at all
+* (D536).
+*/
+/** The pinned jellyfin-ffmpeg release. Changing this is the version change. */
+var FFMPEG_RELEASE = "8.1.2-5";
+var BASE = `https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v${FFMPEG_RELEASE}`;
+function portable(target) {
+	return `${BASE}/jellyfin-ffmpeg_${FFMPEG_RELEASE}_portable_${target}-gpl.tar.xz`;
+}
+portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac64");
 /**
 * LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
 * valutatore puro del suo FRONTE.
@@ -8899,6 +8951,82 @@ var ArchivedDebugNoteQueryInputSchema = object({
 	/** Max rows returned, newest-first. */
 	limit: number().int().min(1).max(1e3).optional()
 });
+var TrackRelationKindSchema = _enum(["same-subject", "different-subjects"]);
+var TrackSideSchema = _enum(["before", "after"]);
+var TrackPurityValueSchema = _enum(["mixed", "not-a-subject"]);
+var TrackRelationSchema = object({
+	id: string$2(),
+	deviceId: number().int(),
+	leftTrackId: string$2(),
+	rightTrackId: string$2(),
+	leftSide: TrackSideSchema.nullable(),
+	rightSide: TrackSideSchema.nullable(),
+	relation: TrackRelationKindSchema,
+	presence: literal("continuous").nullable(),
+	leftStartedAt: number().int().nullable(),
+	rightStartedAt: number().int().nullable(),
+	createdAt: number().int(),
+	updatedAt: number().int(),
+	author: string$2().nullable()
+});
+var TrackPuritySchema = object({
+	id: string$2(),
+	deviceId: number().int(),
+	sourceTrackId: string$2(),
+	purity: TrackPurityValueSchema,
+	switchAtMs: number().int().nullable(),
+	startedAt: number().int().nullable(),
+	createdAt: number().int(),
+	updatedAt: number().int(),
+	author: string$2().nullable()
+});
+var SetTrackRelationInputSchema = object({
+	deviceId: number().int(),
+	trackId: string$2().min(1),
+	otherTrackId: string$2().min(1),
+	relation: TrackRelationKindSchema,
+	presence: literal("continuous").optional(),
+	trackSide: TrackSideSchema.optional(),
+	otherSide: TrackSideSchema.optional()
+});
+var ClearTrackRelationInputSchema = object({
+	deviceId: number().int(),
+	trackId: string$2().min(1),
+	otherTrackId: string$2().min(1)
+});
+var ClearTrackRelationResultSchema = object({ cleared: boolean() });
+var SetTrackPurityInputSchema = object({
+	deviceId: number().int(),
+	trackId: string$2().min(1),
+	purity: _enum([
+		"pure",
+		"mixed",
+		"not-a-subject"
+	]),
+	switchAtMs: number().int().optional()
+});
+/** `null` when `pure` cleared the row. */
+var SetTrackPurityResultSchema = object({ purity: TrackPuritySchema.nullable() });
+var ListTrackRelationsInputSchema = object({
+	deviceId: number().int(),
+	trackId: string$2().optional(),
+	since: number().int().optional(),
+	until: number().int().optional(),
+	limit: number().int().min(1).max(5e3).optional()
+});
+var ListTrackRelationsResultSchema = object({
+	relations: array(TrackRelationSchema).readonly(),
+	purities: array(TrackPuritySchema).readonly(),
+	truncated: boolean()
+});
+_enum([
+	"unknown-track",
+	"cross-device",
+	"self-relation",
+	"contradiction",
+	"switch-outside-track",
+	"switch-needs-mixed"
+]);
 /**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
@@ -11452,6 +11580,68 @@ method(object({
 	password: string$2()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string$2() }), string$2()), method(record(string$2(), string$2()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string$2() }), AuthResultSchema.nullable());
 /**
+* How long one snapshot may take end to end: the pinned copy of the whole
+* database plus `PRAGMA integrity_check` over the copy, on the hub's slowest
+* disk. ~800 MB at a pessimistic 10 MB/s is under 3 minutes; the bound is
+* generous because a timeout fails the whole backup run.
+*/
+var DATABASE_SNAPSHOT_TIMEOUT_MS = 30 * 6e4;
+/**
+* The databases an owner snapshots — declared by the OWNER, so a caller never
+* guesses which file is live from what sits beside it (a cleanly closed
+* database has no sidecars and is just as owned). Paths are absolute on the
+* owner's host.
+*/
+var DatabaseSnapshotTargetsSchema = object({ databases: array(object({ livePath: string$2() })) });
+/** One b-tree table of the snapshot and the rows it holds. */
+var DatabaseSnapshotTableSchema = object({
+	name: string$2(),
+	rows: number().int().nonnegative()
+});
+/**
+* What the owner wrote. Every path is ABSOLUTE on the owner's host — the
+* caller pins the call to its own node, so it can read the file; a caller
+* that finds the path outside its own data root refuses it rather than
+* archiving something it cannot place.
+*/
+var DatabaseSnapshotResultSchema = object({
+	/** The live database the snapshot copies. Never to be copied as a file. */
+	livePath: string$2(),
+	/** The verified copy: `<livePath>` + {@link DATABASE_SNAPSHOT_SUFFIX}. */
+	snapshotPath: string$2(),
+	sizeBytes: number().int().nonnegative(),
+	pageCount: number().int().nonnegative(),
+	pageSize: number().int().positive(),
+	/**
+	* Every b-tree table with its row count. Read inside the SAME read
+	* transaction the copy was taken from, and found EQUAL on the copy — so
+	* this is the content of the snapshot, not an estimate of the source.
+	*/
+	tables: array(DatabaseSnapshotTableSchema),
+	/** Wall time of the pinned copy (row counts included). */
+	copyMs: number().nonnegative(),
+	/** Wall time of the checks on the copy (`integrity_check`, row counts). */
+	verifyMs: number().nonnegative(),
+	/** When the pinned read transaction began (ms epoch) — the snapshot's instant. */
+	takenAt: number()
+});
+/**
+* A snapshot as an ARCHIVE records it (`ArchiveManifest.sqliteSnapshots`):
+* the same facts, with both paths relative to the archive root (the node's
+* data dir), because an archive outlives the host that made it.
+*/
+var ArchiveSqliteSnapshotSchema = DatabaseSnapshotResultSchema.extend({
+	/** Archive-relative path of the live database the archive does NOT carry. */
+	livePath: string$2(),
+	/** Archive-relative path of the verified copy it carries in its place. */
+	snapshotPath: string$2()
+});
+method(object({}), DatabaseSnapshotTargetsSchema, { auth: "admin" }), method(object({}), DatabaseSnapshotResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: DATABASE_SNAPSHOT_TIMEOUT_MS
+});
+/**
 * Orchestrator-side destination metadata. The orchestrator computes
 * `id = <addonId>:<subId>` from its provider lookup so consumers
 * (admin UI, restore flow) see one canonical key.
@@ -11562,7 +11752,12 @@ var ArchiveManifestSchema = object({
 	locations: array(string$2()),
 	entries: array(ArchiveEntrySchema),
 	totalBytes: number(),
-	totalFiles: number()
+	totalFiles: number(),
+	/**
+	* Live SQLite databases this archive carries as their OWNER's verified
+	* snapshot instead of as files (D693). Absent on archives made before.
+	*/
+	sqliteSnapshots: array(ArchiveSqliteSnapshotSchema).optional()
 });
 var LocationStatSchema = object({
 	name: string$2(),
@@ -13137,6 +13332,116 @@ var CompositionBlockStateSchema = object({
 	reason: string$2().optional(),
 	fields: array(CompositionFieldStateSchema)
 });
+var ComposerBlockSchema = object({
+	id: string$2().min(1),
+	name: string$2().min(1).max(120),
+	enabled: boolean(),
+	updatedAt: number(),
+	composition: CompositionSchema
+});
+/**
+* A stored composition row that no longer PARSES — a schema a release
+* tightened, a row written by a newer build. Sent by id so the composer keeps
+* its device as a placeholder and reports the block `failed` naming the parse
+* error. Leaving it out would read, twice, exactly like a delete (D49).
+*/
+var ComposerUnreadableBlockSchema = object({
+	id: string$2().min(1),
+	/** The row's stored name column; null when even that is unreadable (the device keeps the name it has). */
+	name: string$2().nullable(),
+	/** The parse error, in the operator's words. */
+	error: string$2()
+});
+method(object({
+	/** The shared Blocks integration; null until `core-blocks` has reconciled it. */
+	integrationId: string$2().nullable(),
+	/** False when the `core_blocks` read failed: then nothing may be withdrawn (D49). */
+	storeLoaded: boolean(),
+	blocks: array(ComposerBlockSchema),
+	/** Operator restarts: rebuild these runtimes and re-resolve their sources. Stores nothing (D62). */
+	restartBlockIds: array(string$2()),
+	/** Composition rows that exist but do not parse: held, never withdrawn, reported failed. */
+	unreadableBlocks: array(ComposerUnreadableBlockSchema)
+}), object({
+	blocks: array(object({
+		blockId: string$2(),
+		status: CompositionRunStatusSchema,
+		reason: string$2().optional()
+	})),
+	/**
+	* False when the composer declared and withdrew NOTHING (store not loaded,
+	* integration unknown, its own rows unread or read empty once). An empty
+	* apply the caller owes is paid off only by one the composer acted on (D49).
+	*/
+	acted: boolean()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ blockIds: array(string$2()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
+var NUMBER = {
+	kind: "fixed",
+	result: ["number"]
+};
+var BOOLEAN = {
+	kind: "fixed",
+	result: ["boolean"]
+};
+Object.freeze({
+	min: NUMBER,
+	max: NUMBER,
+	abs: NUMBER,
+	floor: NUMBER,
+	ceil: NUMBER,
+	sqrt: NUMBER,
+	round: NUMBER,
+	pow: NUMBER,
+	clamp: NUMBER,
+	avg: NUMBER,
+	sum: NUMBER,
+	age: NUMBER,
+	convert: NUMBER,
+	coalesce: { kind: "coalesce" },
+	any: BOOLEAN,
+	all: BOOLEAN,
+	within: BOOLEAN,
+	latest: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	number: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	rose: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	count: NUMBER
+});
+`${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
+/**
+* What a composition may BUILD on a device type (G2, D676): the caps a new
+* device of that type, or an existing one that lacks them, can be given. The
+* blockers are the validator's own refusal codes, and a spec compares this
+* listing with `planComposition` for every capability — the editor can never
+* offer a feature the save would refuse for the same reason.
+*/
+var ComposableFieldSchema = object({
+	path: string$2(),
+	kind: CompositionFieldKindSchema,
+	nullable: boolean(),
+	required: boolean(),
+	enumValues: array(string$2()).optional()
+});
+var ComposableCapabilitiesSchema = object({ caps: array(object({
+	cap: string$2(),
+	fields: array(ComposableFieldSchema),
+	/** Present for an item-array cap (`consumables.items`). */
+	itemArray: object({
+		path: string$2(),
+		keyField: string$2()
+	}).optional()
+})) });
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string$2().min(1)]);
@@ -13301,7 +13606,7 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), method(object({ blockId: string$2() }), CompositionGetReadSchema, { auth: "admin" }), method(object({}), CompositionListReadSchema, { auth: "admin" }), method(object({
 	addonId: string$2().min(1),
 	stableId: string$2().min(1)
-}), CompositionCustomizationReadSchema, { auth: "admin" }), method(object({
+}), CompositionCustomizationReadSchema, { auth: "admin" }), method(object({ deviceType: _enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }), method(object({
 	composition: CompositionSchema,
 	blockId: string$2().optional()
 }), CompositionValidationSchema, {
@@ -13309,52 +13614,6 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 	auth: "admin",
 	access: "view"
 });
-var ComposerBlockSchema = object({
-	id: string$2().min(1),
-	name: string$2().min(1).max(120),
-	enabled: boolean(),
-	updatedAt: number(),
-	composition: CompositionSchema
-});
-/**
-* A stored composition row that no longer PARSES — a schema a release
-* tightened, a row written by a newer build. Sent by id so the composer keeps
-* its device as a placeholder and reports the block `failed` naming the parse
-* error. Leaving it out would read, twice, exactly like a delete (D49).
-*/
-var ComposerUnreadableBlockSchema = object({
-	id: string$2().min(1),
-	/** The row's stored name column; null when even that is unreadable (the device keeps the name it has). */
-	name: string$2().nullable(),
-	/** The parse error, in the operator's words. */
-	error: string$2()
-});
-method(object({
-	/** The shared Blocks integration; null until `core-blocks` has reconciled it. */
-	integrationId: string$2().nullable(),
-	/** False when the `core_blocks` read failed: then nothing may be withdrawn (D49). */
-	storeLoaded: boolean(),
-	blocks: array(ComposerBlockSchema),
-	/** Operator restarts: rebuild these runtimes and re-resolve their sources. Stores nothing (D62). */
-	restartBlockIds: array(string$2()),
-	/** Composition rows that exist but do not parse: held, never withdrawn, reported failed. */
-	unreadableBlocks: array(ComposerUnreadableBlockSchema)
-}), object({
-	blocks: array(object({
-		blockId: string$2(),
-		status: CompositionRunStatusSchema,
-		reason: string$2().optional()
-	})),
-	/**
-	* False when the composer declared and withdrew NOTHING (store not loaded,
-	* integration unknown, its own rows unread or read empty once). An empty
-	* apply the caller owes is paid off only by one the composer acted on (D49).
-	*/
-	acted: boolean()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ blockIds: array(string$2()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
 /**
 * `custom-model-registry` — collection cap exposing operator-registered
 * custom detection models. Each provider (today: `addon-model-studio`)
@@ -15409,6 +15668,219 @@ method(object({
 	caps: array(string$2()).readonly().optional()
 }), record(string$2(), record(string$2(), unknown().nullable())));
 /**
+* Doorbell button cap. Two kinds of providers coexist behind this cap
+* name (same pattern as `snapshot`):
+*
+*   - **Native** providers: registered per-device by device-driver
+*     addons via `ctx.registerNativeCap` — either on a
+*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
+*     or directly on the camera (Reolink registers at camera level).
+*     Emits an `onPressed` event every time the firmware pushes a
+*     ring; status tracks the last press and a pressCount since start
+*     (diagnostic).
+*
+*   - **Wrapper** provider: the `virtual-doorbell` system builtin
+*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
+*     device (contact / switch / event-emitter …) into a doorbell for
+*     a camera. `defaultActive: false` — the operator explicitly binds
+*     it per camera in the device-bindings UI, then picks the source
+*     device + trigger in the per-device settings.
+*
+* The DeviceEventPropagator re-emits `onPressed` on the camera parent
+* — subscribers listening at the camera level receive ring events
+* with `via[]` populated. No code on the parent needed.
+*/
+var DoorbellStatusSchema = object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: number()
+});
+var DoorbellPressEventSchema = object({
+	deviceId: number(),
+	timestamp: number()
+});
+/**
+* The `doorbell-source` extension slot's editable value (D648): the camera's
+* virtual-doorbell trigger devices, exactly what the wrapper's
+* `doorbellSources` persists (as `{ deviceId }` records).
+*/
+var DoorbellSourceSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+/**
+* The `doorbell-source` slot — which devices ring this camera's VIRTUAL
+* doorbell, owned by the `virtual-doorbell` wrapper over its
+* `doorbellSources` store (D648). A source rings when one of its
+* `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
+* different authority (`deviceManager.setWrapperActive`, D62) — the slot
+* reports it, it never writes it.
+*/
+var DOORBELL_SOURCE_SLOT = {
+	id: "doorbell-source",
+	label: "Doorbell trigger devices",
+	description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
+	shape: "association",
+	hostDeviceTypes: [DeviceType.Camera],
+	sourceCaps: SOURCE_CAPS,
+	cardinality: "many",
+	value: DoorbellSourceSlotValueSchema
+};
+var doorbellCapability = {
+	name: "doorbell",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: false,
+	deviceTypes: [DeviceType.Button, DeviceType.Camera],
+	extensionSlots: [DOORBELL_SOURCE_SLOT],
+	methods: {},
+	events: { 
+	/**
+	* Fires once per physical press. Reolink delivers via Baichuan
+	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
+	* release/duration — it's a pulse.
+	*/
+onPressed: {
+		data: DoorbellPressEventSchema,
+		fromState: {
+			field: "lastPressedAt",
+			on: "advance"
+		}
+	} },
+	status: {
+		schema: DoorbellStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — last press timestamp + lifetime press count.
+	* Mirrored by the kernel and readable via
+	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
+	* without subscribing.
+	*/
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+var ExtensionSlotIdSchema = _enum(["doorbell-source", "linked-devices"]);
+DeviceType.Camera, DeviceType.Camera;
+/** A slot's editable value, discriminated on `slot`. */
+var ExtensionSlotValueSchema = discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
+DeviceType.Camera;
+var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
+	state: literal("unreachable"),
+	reason: string$2()
+})]);
+/** One provider of slots — the D554 source-listing row. */
+var ExtensionSourceSchema = object({
+	/** The routing prefix of every `slotRef` this provider serves. */
+	source: string$2(),
+	label: string$2(),
+	/** Stamped by the dispatcher from the registry (D557). */
+	addonId: string$2().optional(),
+	availability: ExtensionSourceAvailabilitySchema
+});
+/**
+* How one picked source stands. `missing` — no such device (deleted, or an id
+* that never existed); `foreign` — a device the slot's owner cannot read from
+* (a source owned by another addon); `unavailable` — it exists but is not a
+* valid source now (a container, which is never a pick). A source in any of
+* these states is SHOWN, never silently dropped or re-pointed.
+*/
+var ExtensionSourceHealthSchema = _enum([
+	"ok",
+	"missing",
+	"foreign",
+	"unavailable"
+]);
+var ExtensionSlotSourceSchema = object({
+	deviceId: number().int(),
+	/** The device's name, or null when it could not be resolved (`missing`). */
+	name: string$2().nullable(),
+	health: ExtensionSourceHealthSchema,
+	detail: string$2().optional()
+});
+/**
+* A DIFFERENT authority that gates whether the slot's sources do anything —
+* reported read-only, named, never written through this contract (D62). The
+* virtual doorbell's sources ring only while the wrapper is bound to the
+* camera, and that binding belongs to `deviceManager.setWrapperActive`.
+* `unknown` means the gate could not be read; it is not "inactive" (D315).
+*/
+var ExtensionSlotActivationSchema = object({
+	state: _enum([
+		"active",
+		"inactive",
+		"unknown"
+	]),
+	authority: string$2(),
+	detail: string$2().optional()
+});
+var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
+	state: literal("ok"),
+	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
+	slotRef: string$2(),
+	slot: ExtensionSlotIdSchema,
+	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
+	authority: string$2(),
+	activation: ExtensionSlotActivationSchema.nullable(),
+	value: ExtensionSlotValueSchema,
+	sources: array(ExtensionSlotSourceSchema),
+	/**
+	* Devices the owner links to the host ON ITS OWN, by structure, and that
+	* are therefore not in `value` (D655): a camera's device-tree children, and
+	* the child a picked container stands for (D356 — a container is never a
+	* pick, its children are). Read-only; the editor shows them and may offer
+	* per-device options on them (the linked-devices tracked-event opt-in).
+	* Absent when the owner links nothing beyond the picks, and from an owner
+	* older than D655.
+	*/
+	impliedSources: array(ExtensionSlotSourceSchema).optional()
+}), object({
+	state: literal("unreachable"),
+	addonId: string$2(),
+	reason: string$2()
+})]);
+var ExtensionCandidatesSchema = object({ candidates: array(object({
+	deviceId: number().int(),
+	name: string$2(),
+	type: string$2(),
+	location: string$2().nullable(),
+	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
+	parentName: string$2().nullable(),
+	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
+	suggested: boolean(),
+	/** Why it is suggested ("same location"), null when it is not. */
+	reason: string$2().nullable()
+})) });
+/**
+* What a write did. `none` — applied in place. `host` / `parent` — the owner
+* reloaded the host (or, for an accessory child, its parent) because the
+* write changed what the host REGISTERS. A slot never adds a capability to its
+* host — that is a composition (D663) — so today's owners answer `none`.
+*/
+var ExtensionSetResultSchema = object({
+	applied: literal(true),
+	reload: _enum([
+		"none",
+		"host",
+		"parent"
+	])
+});
+var ExtensionSlotRefInputSchema = object({
+	deviceId: number().int(),
+	slotRef: string$2().min(1)
+});
+var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
+method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Per-field ownership (D663). A composition may CLAIM fields of a native
 * cap's runtime-state slice on an existing device: `replace` overlays the
 * claimed fields on the native slice, `add` builds a slice the device does
@@ -18418,17 +18890,25 @@ var NcScheduleSchema = object({
 */
 var NcSystemEventDeliveryModeSchema = _enum(["instant", "summary"]);
 /**
+* How a summary window is SENT (D698): `rule` (absent) = ONE notification with
+* every section; `section` = one notification per section with something to
+* say (an unavailable section included), each titled by its section.
+*/
+var NcStateSummarySplitSchema = _enum(["rule", "section"]);
+/**
 * `summary`: the rule sends NOTHING per event. When a window of `schedule`
 * CLOSES, it sends one notification with the current state of its kinds
 * (low batteries, consumables to replace, devices offline, updates
-* available, ...), after its own filters. Nothing to report sends nothing.
+* available, ...), after its own filters — or, with `split: 'section'`
+* (D698), one notification per section. Nothing to report sends nothing.
 * The schedule is the ordinary `NcSchedule` (weekly windows, IANA timezone,
 * midnight crossing); the send time is each window's END. Refused on the
 * `alarm` family, which stays instant (`systemEventDeliveryProblems`).
 */
 var NcSystemEventDeliverySchema = discriminatedUnion("mode", [object({ mode: literal("instant") }), object({
 	mode: literal("summary"),
-	schedule: NcScheduleSchema
+	schedule: NcScheduleSchema,
+	split: NcStateSummarySplitSchema.optional()
 })]);
 /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
 var NcPlateMatcherSchema = object({
@@ -18568,8 +19048,14 @@ var NcSensorTransitionSchema = _enum(["raised", "cleared"]);
 /** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
 var NcZoneConditionSchema = object({
 	ids: array(string$2().min(1)).min(1),
-	/** Quantifier over `ids` — at least one / every one visited. */
-	match: _enum(["any", "all"]).default("any")
+	/**
+	* LEGACY quantifier over `ids`. Absent = `any` (at least one visited), which
+	* is what both editors mean and all they write since D690: "all of" was
+	* removed from the editors because on an immediate rule it asked one
+	* detection to stand in every zone at once. Still ACCEPTED, and `all` still
+	* evaluated, so a stored rule keeps parsing and meaning what it meant.
+	*/
+	match: _enum(["any", "all"]).optional()
 });
 /**
 * The P1 condition set — a flat AND of groups; absent group = pass;
@@ -19073,10 +19559,12 @@ var NcMediaPolicySchema = object({
 /**
 * Cooldown GRANULARITY over the subject's class — how much a fired
 * notification suppresses.
-*  - `shared` (default, and the absent value) — one window for the whole
-*    rule/scope: a cat silences the next dog for `cooldownSec`.
-*  - `per-class` — an independent window per detected class, so cat→dog fires
-*    at once and cat→cat still waits.
+*  - `per-class` (default, and the absent value since 2026-10-01 — D36) — an
+*    independent window per detected class: cat→dog fires at once, cat→cat
+*    still waits.
+*  - `shared` — one window for the whole rule/scope: a cat silences the next
+*    dog for `cooldownSec`. Only written when an operator picks it; it is no
+*    longer what an unset rule means.
 *
 * AUDIO subjects are ALWAYS per-class regardless of this setting: a scream
 * must not be swallowed by a bark's window (the precedent this generalizes —
@@ -19091,8 +19579,11 @@ var NcThrottleSchema = object({
 	/**
 	* Class granularity of the cooldown key. Optional rather than defaulted:
 	* a Zod default does NOT run on the addon→addon cap path, so a persisted
-	* rule authored before this field simply carries none — and the engine
-	* reads absent as `shared`, the pre-existing behaviour.
+	* rule authored before this field simply carries none. The engine used to
+	* read absent as `shared` (D36); since 2026-10-01 it reads absent as
+	* `per-class` — the operator's default — and only an explicit `shared`
+	* still means `shared`. See `cooldownKey` / `keysPerClass` in the rule
+	* engine, and D36's dated note.
 	*/
 	granularity: NcThrottleGranularitySchema.optional()
 });
@@ -19416,11 +19907,23 @@ var NcStateSummaryPreviewSectionSchema = object({
 	reason: string$2().optional()
 });
 /**
+* One notification a previewed summary would send (D698): the whole summary on
+* a `rule` split (no `section`), one section's on a `section` split.
+*/
+var NcStateSummaryPreviewRowSchema = object({
+	section: string$2().optional(),
+	/** The section's name on a per-section row; every reported section's, joined, on a combined one. */
+	title: string$2(),
+	text: string$2(),
+	count: number().int().nonnegative()
+});
+/**
 * The summary a rule would send now. `empty` = nothing to report and every
 * section read: such a summary is NOT sent. `dropped` counts the open states
 * the rule's own filters (or a camera mute) left out, by reason.
 * `excludedGroups` names the kind groups selected that have no state to report
-* (backups & exports).
+* (backups & exports). `split` and `rows` (D698) say how it would be sent —
+* optional, so an older hub's answer still parses.
 */
 var NcStateSummaryPreviewSchema = object({
 	empty: boolean(),
@@ -19428,7 +19931,9 @@ var NcStateSummaryPreviewSchema = object({
 	text: string$2(),
 	sections: array(NcStateSummaryPreviewSectionSchema),
 	dropped: record(string$2(), number().int().nonnegative()),
-	excludedGroups: array(string$2())
+	excludedGroups: array(string$2()),
+	split: NcStateSummarySplitSchema.optional(),
+	rows: array(NcStateSummaryPreviewRowSchema).optional()
 });
 var NcTestResultSchema = object({
 	recordId: string$2(),
@@ -20444,7 +20949,7 @@ function cameraSensorRefKey(ref) {
 }
 /** CS-1 accepts exactly one mode; CS-2 (D673) widens it to confirm / replace. */
 var CameraSensorsModeSchema = _enum(["in-addition"]);
-object({
+var CameraSensorsConfigSchema = object({
 	mode: CameraSensorsModeSchema,
 	sensors: array(CameraSensorRefSchema).min(1).max(8)
 }).superRefine((value, ctx) => {
@@ -22349,7 +22854,8 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	trackIds: array(string$2()).min(1)
 }), object({
 	deleted: number().int(),
-	failed: array(string$2()).readonly()
+	failed: array(string$2()).readonly(),
+	sparedMediaIds: array(number().int()).readonly().optional()
 }), {
 	kind: "mutation",
 	auth: "admin"
@@ -22358,7 +22864,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	deviceId: number(),
 	trackId: string$2(),
 	flags: TrackFlagsPatchSchema
-}), TrackFlagsSchema, { kind: "mutation" }), method(ArchivedDebugNoteQueryInputSchema, array(ArchivedDebugNoteSchema).readonly(), { kind: "query" }), method(BirthDecisionQueryInputSchema, array(BirthDecisionRecordSchema).readonly(), { kind: "query" }), method(object({}), EventStoreFootprintSchema, {
+}), TrackFlagsSchema, { kind: "mutation" }), method(ArchivedDebugNoteQueryInputSchema, array(ArchivedDebugNoteSchema).readonly(), { kind: "query" }), method(SetTrackRelationInputSchema, TrackRelationSchema, { kind: "mutation" }), method(ClearTrackRelationInputSchema, ClearTrackRelationResultSchema, { kind: "mutation" }), method(SetTrackPurityInputSchema, SetTrackPurityResultSchema, { kind: "mutation" }), method(ListTrackRelationsInputSchema, ListTrackRelationsResultSchema, { kind: "query" }), method(BirthDecisionQueryInputSchema, array(BirthDecisionRecordSchema).readonly(), { kind: "query" }), method(object({}), EventStoreFootprintSchema, {
 	kind: "query",
 	auth: "admin"
 }), method(object({ deviceId: number().int().optional() }), EventMediaKindBreakdownSchema, {
@@ -24556,7 +25062,64 @@ var NodeInferenceDevicesSchema = object({
 	reachable: boolean(),
 	devices: array(NodeInferenceDeviceSchema).readonly()
 });
-method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
+/**
+* Pipeline Orchestrator capability — global load balancer + camera dispatcher.
+*
+* Lives on the hub. Tracks the camera-to-agent assignment map, listens to
+* device lifecycle events, queries each runner's capacity + hardware
+* profile, and dispatches `attachCamera` / `detachCamera` cap calls to the
+* appropriate runner instances. Persists assignments via the multi-level
+* settings store so they survive hub restarts.
+*
+* Strictly the control plane: never sees a frame, never calls inference,
+* never drains queues. The runner does that work locally on each agent.
+*/
+/**
+* The input of `setCameraSensors` (G5, D676): the ONE typed write path of a
+* camera's attached sensors (D672). `config: null` removes the attachment —
+* the camera reads `not-configured` again, never `unreadable`.
+*/
+var SetCameraSensorsInputSchema = object({
+	deviceId: number().int().nonnegative(),
+	/** `null` removes the attachment: the camera goes back to `not-configured`. */
+	config: CameraSensorsConfigSchema.nullable()
+});
+/**
+* Why an early occupancy look (D691) was not scheduled.
+*
+* - `unknown-camera` — no session was ever dispatched for it, so there is no
+*   node and no config to attach a burst with.
+* - `out-of-range` — the ask is negative or further out than the orchestrator
+*   will hold a timer for; the parked-object cadence is the answer there.
+* - `no-burst-producer` — this build has no burst producer at all.
+* - `already-looked` — this camera's ONE early look since its last session has
+*   been spent. A look's own burst can re-arm a flickering flip, and a look
+*   per arm would chain a burst every ~30 s forever (review H2); the next
+*   real session re-arms the budget.
+*/
+var OccupancyLookRefusalSchema = _enum([
+	"unknown-camera",
+	"out-of-range",
+	"no-burst-producer",
+	"already-looked"
+]);
+method(object({
+	deviceId: number().int().nonnegative(),
+	/** How long from NOW until the pending flip's sustain window ends. RELATIVE,
+	*  so the caller's clock and the orchestrator's never have to agree. */
+	afterMs: number().finite(),
+	/** Why, for the log. */
+	reason: string$2()
+}), object({
+	scheduled: boolean(),
+	/** When `scheduled`: how long until the burst is dialled. */
+	dueInMs: number().optional(),
+	/** When not `scheduled`: why. */
+	refusedBecause: OccupancyLookRefusalSchema.optional()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
 }), method(StorageMigrationLeaseInputSchema, object({ resumed: literal(true) }), {
@@ -24710,7 +25273,10 @@ method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
 }), CameraSwitchGroupSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), CameraStatusSchema), method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()), method(_void(), DiskReconcileJobSchema, {
+}), method(object({ deviceId: number() }), CameraStatusSchema), method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()), method(SetCameraSensorsInputSchema, object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), DiskReconcileJobSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(_void(), DiskReconcileJobSchema, { auth: "admin" }), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
@@ -26916,219 +27482,6 @@ DeviceType.Camera, method(object({
 	auth: "protected"
 });
 /**
-* Doorbell button cap. Two kinds of providers coexist behind this cap
-* name (same pattern as `snapshot`):
-*
-*   - **Native** providers: registered per-device by device-driver
-*     addons via `ctx.registerNativeCap` — either on a
-*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
-*     or directly on the camera (Reolink registers at camera level).
-*     Emits an `onPressed` event every time the firmware pushes a
-*     ring; status tracks the last press and a pressCount since start
-*     (diagnostic).
-*
-*   - **Wrapper** provider: the `virtual-doorbell` system builtin
-*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
-*     device (contact / switch / event-emitter …) into a doorbell for
-*     a camera. `defaultActive: false` — the operator explicitly binds
-*     it per camera in the device-bindings UI, then picks the source
-*     device + trigger in the per-device settings.
-*
-* The DeviceEventPropagator re-emits `onPressed` on the camera parent
-* — subscribers listening at the camera level receive ring events
-* with `via[]` populated. No code on the parent needed.
-*/
-var DoorbellStatusSchema = object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: number()
-});
-var DoorbellPressEventSchema = object({
-	deviceId: number(),
-	timestamp: number()
-});
-/**
-* The `doorbell-source` extension slot's editable value (D648): the camera's
-* virtual-doorbell trigger devices, exactly what the wrapper's
-* `doorbellSources` persists (as `{ deviceId }` records).
-*/
-var DoorbellSourceSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
-/**
-* The `doorbell-source` slot — which devices ring this camera's VIRTUAL
-* doorbell, owned by the `virtual-doorbell` wrapper over its
-* `doorbellSources` store (D648). A source rings when one of its
-* `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
-* different authority (`deviceManager.setWrapperActive`, D62) — the slot
-* reports it, it never writes it.
-*/
-var DOORBELL_SOURCE_SLOT = {
-	id: "doorbell-source",
-	label: "Doorbell trigger devices",
-	description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
-	shape: "association",
-	hostDeviceTypes: [DeviceType.Camera],
-	sourceCaps: SOURCE_CAPS,
-	cardinality: "many",
-	value: DoorbellSourceSlotValueSchema
-};
-var doorbellCapability = {
-	name: "doorbell",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: false,
-	deviceTypes: [DeviceType.Button, DeviceType.Camera],
-	extensionSlots: [DOORBELL_SOURCE_SLOT],
-	methods: {},
-	events: { 
-	/**
-	* Fires once per physical press. Reolink delivers via Baichuan
-	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
-	* release/duration — it's a pulse.
-	*/
-onPressed: {
-		data: DoorbellPressEventSchema,
-		fromState: {
-			field: "lastPressedAt",
-			on: "advance"
-		}
-	} },
-	status: {
-		schema: DoorbellStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — last press timestamp + lifetime press count.
-	* Mirrored by the kernel and readable via
-	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
-	* without subscribing.
-	*/
-	runtimeState: DoorbellStatusSchema,
-	/**
-	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-var ExtensionSlotIdSchema = _enum(["doorbell-source", "linked-devices"]);
-DeviceType.Camera, DeviceType.Camera;
-/** A slot's editable value, discriminated on `slot`. */
-var ExtensionSlotValueSchema = discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
-DeviceType.Camera;
-var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
-	state: literal("unreachable"),
-	reason: string$2()
-})]);
-/** One provider of slots — the D554 source-listing row. */
-var ExtensionSourceSchema = object({
-	/** The routing prefix of every `slotRef` this provider serves. */
-	source: string$2(),
-	label: string$2(),
-	/** Stamped by the dispatcher from the registry (D557). */
-	addonId: string$2().optional(),
-	availability: ExtensionSourceAvailabilitySchema
-});
-/**
-* How one picked source stands. `missing` — no such device (deleted, or an id
-* that never existed); `foreign` — a device the slot's owner cannot read from
-* (a source owned by another addon); `unavailable` — it exists but is not a
-* valid source now (a container, which is never a pick). A source in any of
-* these states is SHOWN, never silently dropped or re-pointed.
-*/
-var ExtensionSourceHealthSchema = _enum([
-	"ok",
-	"missing",
-	"foreign",
-	"unavailable"
-]);
-var ExtensionSlotSourceSchema = object({
-	deviceId: number().int(),
-	/** The device's name, or null when it could not be resolved (`missing`). */
-	name: string$2().nullable(),
-	health: ExtensionSourceHealthSchema,
-	detail: string$2().optional()
-});
-/**
-* A DIFFERENT authority that gates whether the slot's sources do anything —
-* reported read-only, named, never written through this contract (D62). The
-* virtual doorbell's sources ring only while the wrapper is bound to the
-* camera, and that binding belongs to `deviceManager.setWrapperActive`.
-* `unknown` means the gate could not be read; it is not "inactive" (D315).
-*/
-var ExtensionSlotActivationSchema = object({
-	state: _enum([
-		"active",
-		"inactive",
-		"unknown"
-	]),
-	authority: string$2(),
-	detail: string$2().optional()
-});
-var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
-	state: literal("ok"),
-	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
-	slotRef: string$2(),
-	slot: ExtensionSlotIdSchema,
-	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
-	authority: string$2(),
-	activation: ExtensionSlotActivationSchema.nullable(),
-	value: ExtensionSlotValueSchema,
-	sources: array(ExtensionSlotSourceSchema),
-	/**
-	* Devices the owner links to the host ON ITS OWN, by structure, and that
-	* are therefore not in `value` (D655): a camera's device-tree children, and
-	* the child a picked container stands for (D356 — a container is never a
-	* pick, its children are). Read-only; the editor shows them and may offer
-	* per-device options on them (the linked-devices tracked-event opt-in).
-	* Absent when the owner links nothing beyond the picks, and from an owner
-	* older than D655.
-	*/
-	impliedSources: array(ExtensionSlotSourceSchema).optional()
-}), object({
-	state: literal("unreachable"),
-	addonId: string$2(),
-	reason: string$2()
-})]);
-var ExtensionCandidatesSchema = object({ candidates: array(object({
-	deviceId: number().int(),
-	name: string$2(),
-	type: string$2(),
-	location: string$2().nullable(),
-	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
-	parentName: string$2().nullable(),
-	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
-	suggested: boolean(),
-	/** Why it is suggested ("same location"), null when it is not. */
-	reason: string$2().nullable()
-})) });
-/**
-* What a write did. `none` — applied in place. `host` / `parent` — the owner
-* reloaded the host (or, for an accessory child, its parent) because the
-* write changed what the host REGISTERS. A slot never adds a capability to its
-* host — that is a composition (D663) — so today's owners answer `none`.
-*/
-var ExtensionSetResultSchema = object({
-	applied: literal(true),
-	reload: _enum([
-		"none",
-		"host",
-		"parent"
-	])
-});
-var ExtensionSlotRefInputSchema = object({
-	deviceId: number().int(),
-	slotRef: string$2().min(1)
-});
-var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
-method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
 * nothing still gets a sane default. (Relocated from the retired `webrtc`
@@ -38311,47 +38664,6 @@ var zoneRulesCapability = {
 	*/
 	durability: "restored"
 };
-var NUMBER = {
-	kind: "fixed",
-	result: ["number"]
-};
-var BOOLEAN = {
-	kind: "fixed",
-	result: ["boolean"]
-};
-Object.freeze({
-	min: NUMBER,
-	max: NUMBER,
-	abs: NUMBER,
-	floor: NUMBER,
-	ceil: NUMBER,
-	sqrt: NUMBER,
-	round: NUMBER,
-	pow: NUMBER,
-	clamp: NUMBER,
-	avg: NUMBER,
-	sum: NUMBER,
-	age: NUMBER,
-	convert: NUMBER,
-	coalesce: { kind: "coalesce" },
-	any: BOOLEAN,
-	all: BOOLEAN,
-	within: BOOLEAN,
-	latest: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	number: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	rose: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	count: NUMBER
-});
-`${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
 /**
 * Accessory device helpers — shared across drivers.
 *
@@ -42297,6 +42609,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.listComposableCaps": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"coreBlocks.listCompositions": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -42375,6 +42693,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"databaseSnapshot.listDatabases": {
+		capName: "database-snapshot",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"databaseSnapshot.writeSnapshot": {
+		capName: "database-snapshot",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dataStoreProvider.aggregate": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -45111,6 +45441,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.clearTrackRelation": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineAnalytics.clearTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -45363,6 +45699,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listTrackRelations": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -45477,6 +45819,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setTrackPurity": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"pipelineAnalytics.setTrackRelation": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.startStorageMigrationMove": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -45915,6 +46269,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineOrchestrator.requestOccupancyLook": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.resetNodePipelineDefaults": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -45981,6 +46341,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraSensors": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraStepOverride": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -49391,6 +49757,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.clearTrackRelation": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.clearTracks": [{
 		name: "deviceId",
 		form: "single",
@@ -49541,6 +49912,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.listTrackRelations": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.listTracks": [{
 		name: "deviceId",
 		form: "single",
@@ -49611,6 +49987,16 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setTrackPurity": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.setTrackRelation": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.wipeAllAnalytics": [{
 		name: "deviceId",
 		form: "single",
@@ -49681,6 +50067,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.requestOccupancyLook": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.resolvePipeline": [{
 		name: "deviceId",
 		form: "single",
@@ -49691,6 +50082,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.setCameraSensors": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.setCameraStepOverride": [{
 		name: "deviceId",
 		form: "single",
@@ -50837,6 +51233,18 @@ var STATE_SUMMARY_VARS = [
 		systemEventKinds: [...SUMMARISABLE],
 		systemEventDeliveries: ["summary"]
 	},
+	{
+		name: "summarySection",
+		label: "Summary: this section",
+		description: "The section a per-section summary row is about (D698); on a summary sent as one message, every section it reports, comma-separated.",
+		example: "Batterie scariche",
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...SUMMARISABLE],
+		systemEventDeliveries: ["summary"]
+	},
 	...STATE_SUMMARY_SECTION_VARS.map((v) => ({
 		name: v.name,
 		label: v.label,
@@ -50913,6 +51321,37 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	...STATE_SUMMARY_VARS
 ];
+new Set([
+	"disarmed",
+	"armed_home",
+	"armed_away",
+	"armed_night",
+	"armed_vacation",
+	"armed_custom_bypass",
+	"arming",
+	"disarming",
+	"pending",
+	"triggered",
+	"open",
+	"opening",
+	"closing",
+	"closed",
+	"stopped",
+	"locked",
+	"unlocked",
+	"locking",
+	"unlocking",
+	"jammed",
+	"on",
+	"off",
+	"home",
+	"not_home",
+	"matched",
+	"diverged",
+	"unknown",
+	"latched",
+	"live"
+]);
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *