@camstack/addon-osd-manager 0.1.231 → 0.1.232

package/dist/index.js

@@ -13026,2432 +13026,2464 @@ method(object({
 	password: string()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
-* How long one snapshot may take end to end: the pinned copy of the whole
-* database plus `PRAGMA integrity_check` over the copy, on the hub's slowest
-* disk. ~800 MB at a pessimistic 10 MB/s is under 3 minutes; the bound is
-* generous because a timeout fails the whole backup run.
+* Query filter for settings-store collections.
 */
-var DATABASE_SNAPSHOT_TIMEOUT_MS = 30 * 6e4;
+var QueryFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
+	whereNot: record(string(), unknown()).optional(),
+	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
+	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
+	whereNotIn: record(string(), array(unknown())).optional(),
+	orderBy: object({
+		field: string(),
+		direction: _enum(["asc", "desc"])
+	}).optional(),
+	limit: number().optional(),
+	offset: number().optional()
+});
 /**
-* The databases an owner snapshots — declared by the OWNER, so a caller never
-* guesses which file is live from what sits beside it (a cleanly closed
-* database has no sidecars and is just as owned). Paths are absolute on the
-* owner's host.
+* The predicate half of a filter, for BULK MUTATIONS.
+*
+* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
+* meaning for a statement that rewrites a set, and accepting them would invite
+* a caller to believe `limit` bounds the damage. Every field is optional here
+* only so the shape stays composable — the implementation REJECTS a filter
+* that compiles to no predicate, because that is the whole collection.
 */
-var DatabaseSnapshotTargetsSchema = object({ databases: array(object({ livePath: string() })) });
-/** One b-tree table of the snapshot and the rows it holds. */
-var DatabaseSnapshotTableSchema = object({
-	name: string(),
-	rows: number().int().nonnegative()
+var MutationFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	whereNot: record(string(), unknown()).optional(),
+	whereNotIn: record(string(), array(unknown())).optional()
 });
 /**
-* What the owner wrote. Every path is ABSOLUTE on the owner's host — the
-* caller pins the call to its own node, so it can read the file; a caller
-* that finds the path outside its own data root refuses it rather than
-* archiving something it cannot place.
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
 */
-var DatabaseSnapshotResultSchema = object({
-	/** The live database the snapshot copies. Never to be copied as a file. */
-	livePath: string(),
-	/** The verified copy: `<livePath>` + {@link DATABASE_SNAPSHOT_SUFFIX}. */
-	snapshotPath: string(),
-	sizeBytes: number().int().nonnegative(),
-	pageCount: number().int().nonnegative(),
-	pageSize: number().int().positive(),
-	/**
-	* Every b-tree table with its row count. Read inside the SAME read
-	* transaction the copy was taken from, and found EQUAL on the copy — so
-	* this is the content of the snapshot, not an estimate of the source.
-	*/
-	tables: array(DatabaseSnapshotTableSchema),
-	/** Wall time of the pinned copy (row counts included). */
-	copyMs: number().nonnegative(),
-	/** Wall time of the checks on the copy (`integrity_check`, row counts). */
-	verifyMs: number().nonnegative(),
-	/** When the pinned read transaction began (ms epoch) — the snapshot's instant. */
-	takenAt: number()
+var AggregateFieldSchema = object({
+	/** Result key. */
+	as: string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: string().min(1),
+	op: _enum([
+		"sum",
+		"min",
+		"max"
+	])
 });
 /**
-* A snapshot as an ARCHIVE records it (`ArchiveManifest.sqliteSnapshots`):
-* the same facts, with both paths relative to the archive root (the node's
-* data dir), because an archive outlives the host that made it.
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
 */
-var ArchiveSqliteSnapshotSchema = DatabaseSnapshotResultSchema.extend({
-	/** Archive-relative path of the live database the archive does NOT carry. */
-	livePath: string(),
-	/** Archive-relative path of the verified copy it carries in its place. */
-	snapshotPath: string()
+var AggregateResultSchema = object({
+	count: number().int(),
+	values: record(string(), number().nullable())
 });
-method(object({}), DatabaseSnapshotTargetsSchema, { auth: "admin" }), method(object({}), DatabaseSnapshotResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	timeoutMs: DATABASE_SNAPSHOT_TIMEOUT_MS
+/** A single stored record: `{ id, data }`. */
+var SettingsRecordSchema = object({
+	id: string(),
+	data: record(string(), unknown())
 });
 /**
-* Orchestrator-side destination metadata. The orchestrator computes
-* `id = <addonId>:<subId>` from its provider lookup so consumers
-* (admin UI, restore flow) see one canonical key.
-*
-* Phase 4 (admin UI redesign) adds the per-destination policy fields
-* (`enabled`, `retentionCount`, `label`) so the destinations table can
-* render the joined view without a follow-up round-trip. The backend
-* already joins these in `listDestinations` — we now surface them on
-* the wire.
+* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
+* optional.
 *
-* `lastSuccessAt` / `lastSuccessSizeBytes` are computed from each
-* location's `manifests.json` (newest archive). Optional — locations
-* with no archives yet leave them undefined.
+* A separate schema rather than loosening the shared one: every other method
+* on this cap addresses a row BY its id, and making that field optional
+* everywhere would turn a forgotten key into a silently generated one on
+* `update` and `delete` as well.
 */
-var BackupDestinationInfoSchema = object({
-	/**
-	* Sub-id within this addon. Convention `default` for single-
-	* destination addons; addons that host many (S3 with N buckets)
-	* pick stable per-bucket strings. The orchestrator stitches
-	* `<manifestId>:<subId>` for the wire format.
-	*/
-	subId: string(),
-	displayName: string(),
-	description: string().optional(),
-	kind: string(),
-	triggerSupported: boolean(),
-	restoreSupported: boolean()
-}).extend({
-	/** `<addonId>:<subId>` — globally-unique dispatch key. */
-	id: string(),
-	/**
-	* Manifest id of the owning addon. The Settings button on the
-	* destination card opens that addon's `globalSettingsSchema` panel.
-	*/
-	addonId: string(),
-	/** Operator-toggled enable flag from the destination-policy table. */
-	enabled: boolean(),
-	/** Operator-defined retention count (archives kept per destination). */
-	retentionCount: number(),
-	/** Operator-defined display label (overrides storage location displayName). */
-	label: string().optional(),
-	/** Newest-archive timestamp from `manifests.json`, or undefined. */
-	lastSuccessAt: number().optional(),
-	/** Newest-archive size from `manifests.json`, or undefined. */
-	lastSuccessSizeBytes: number().optional(),
-	/**
-	* Cron cadence(s) of the ENABLED schedules that fan out to this
-	* destination, comma-joined. Absent when no enabled schedule targets it
-	* — a destination nothing is scheduled to write to must not advertise a
-	* cadence (D384). This is never the `backup_destination_policies.cron`
-	* column: that per-location cron has scheduled nothing since 2026-07-28
-	* and reading it made a destination with a DISABLED schedule claim a
-	* nightly run.
-	*/
-	cron: string().optional(),
-	/** ms-epoch of the next firing across those schedules (earliest), if any. */
-	nextRunAt: number().optional(),
-	/**
-	* ms-epoch of the last time a run ATTEMPTED to write here — success or
-	* failure. Never a success stamp: pair it with `lastSuccessAt` (the
-	* newest archive that actually landed) and `lastError`.
-	*/
-	lastAttemptAt: number().optional(),
-	/**
-	* Why the last attempt failed, verbatim. Absent when the last attempt
-	* landed the archive. A destination that has never been written to has
-	* neither this nor `lastAttemptAt`.
-	*/
-	lastError: string().optional()
+var BulkRecordSchema = object({
+	id: string().optional(),
+	data: record(string(), unknown())
 });
 /**
-* How an archive is encrypted (operator decision 2026-10-09): to a backup
-* PUBLIC key the hub holds, so only the operator's secret key opens it.
-* Absent on a plain `.tar.gz` — every archive made before encryption, or
-* with it off — which restores without a key.
+* The database FILES one `sqlite-settings` engine process owns (D851).
+* Closed on purpose: a file is a thing the engine opens, backs up and gives a
+* serving thread, so a new one is a code change, never a string a caller
+* invents. `settings` is `camstack.db` and the default for every collection
+* that names no file.
 */
-var BackupArchiveEncryptionSchema = object({
-	/** `x25519-hkdf-aes256gcm-stream-v1`. */
-	scheme: string(),
-	/** 16 hex — the backup key whose secret restores this archive. */
-	keyId: string()
-});
+var DataStoreDatabaseSchema = _enum([
+	"settings",
+	"events",
+	"history"
+]);
+DataStoreDatabaseSchema.options;
 /**
-* The backup encryption setting. The hub keeps PUBLIC keys only: the active
-* one new archives are encrypted to, and the retired ones older archives
-* still need. The secret key is shown once, at `setupEncryption`.
+* One write inside a {@link settingsStoreCapability.methods.transact} call.
+* The three that a "replace this set, bump that revision" write needs, plus
+* the batched upsert a rollup writer needs.
 */
-var BackupEncryptionStatusSchema = object({
-	enabled: boolean(),
-	active: object({
-		keyId: string(),
-		publicKey: string(),
-		createdAt: number()
-	}).nullable(),
-	/** Every key ever set up, newest first. */
-	keys: array(object({
-		keyId: string(),
-		createdAt: number(),
-		retiredAt: number().nullable()
-	})).readonly()
-});
+var TransactOpSchema = discriminatedUnion("op", [
+	object({
+		op: literal("deleteWhere"),
+		collection: string(),
+		filter: MutationFilterSchema
+	}),
+	object({
+		op: literal("insertMany"),
+		collection: string(),
+		records: array(BulkRecordSchema).readonly()
+	}),
+	object({
+		op: literal("update"),
+		collection: string(),
+		id: string(),
+		data: record(string(), unknown())
+	}),
+	object({
+		op: literal("upsertMany"),
+		collection: string(),
+		conflict: array(string()).readonly(),
+		records: array(BulkRecordSchema).readonly()
+	})
+]);
 /**
-* Per-archive entry returned by `backup.listArchives({ destinationId })`.
-* Same shape the destination drill-in renders. Sourced from the per-
-* location `manifests.json` (no per-archive tarball read required).
+* The precondition of a transaction: the row `key` of `collection` must hold
+* `equals` in `column`, read INSIDE the transaction.
 */
-var BackupArchiveEntrySchema = object({
-	id: string(),
-	filename: string(),
-	createdAt: number(),
-	sizeBytes: number(),
-	label: string().optional(),
-	/** Top-level locations included in the archive (db, addons, tls, …). */
-	locations: array(string()).readonly(),
-	/** Present when the archive is encrypted; restore then needs that key. */
-	encryption: BackupArchiveEncryptionSchema.optional()
-});
-var BackupEntrySchema = object({
-	id: string(),
-	/** Addon id of the destination that owns this backup (e.g. `local-backup`, `s3-backup`). */
-	destinationId: string().optional(),
-	label: string().optional(),
-	createdAt: number(),
-	sizeBytes: number(),
-	locations: array(string()).optional(),
-	encryption: BackupArchiveEncryptionSchema.optional()
-});
-var ArchiveEntrySchema = object({
-	path: string(),
-	kind: _enum([
-		"file",
-		"dir",
-		"symlink"
-	]),
-	sizeBytes: number(),
-	mtime: number()
-});
-var ArchiveManifestSchema = object({
-	archiveVersion: literal(1),
-	createdAt: number(),
-	dataDir: string(),
-	locations: array(string()),
-	entries: array(ArchiveEntrySchema),
-	totalBytes: number(),
-	totalFiles: number(),
-	/**
-	* Live SQLite databases this archive carries as their OWNER's verified
-	* snapshot instead of as files (D693). Absent on archives made before.
-	*/
-	sqliteSnapshots: array(ArchiveSqliteSnapshotSchema).optional()
-});
-var LocationStatSchema = object({
-	name: string(),
-	sizeBytes: number(),
-	fileCount: number(),
-	present: boolean()
+var TransactGuardSchema = object({
+	collection: string(),
+	key: string(),
+	column: string(),
+	equals: unknown()
 });
-/** Lifecycle of a backup run. Terminal states: succeeded / failed / cancelled. */
-var BackupRunStateSchema = _enum([
-	"queued",
-	"running",
-	"succeeded",
-	"failed",
-	"cancelled"
-]);
-/**
-* Where a running backup currently is. `queued` before it starts,
-* `building` while the tar.gz is being staged, `uploading` during the
-* per-destination fan-out, `done` once terminal.
-*/
-var BackupRunPhaseSchema = _enum([
-	"queued",
-	"building",
-	"uploading",
-	"done"
-]);
 /**
-* Observable state of one backup run — readable WHILE it runs via
-* `backup.listRuns`. This is what makes the execution queue and
-* `backup.cancel` usable: the 2026-09-04 incident (two concurrent
-* multi-GB builds, staging 5.1 GB → 18 GB, load 62) was only
-* diagnosable with `du` because nothing reported that runs existed or
-* how large the staged archive had grown.
+* Column declaration for a structured (SQL-backed) collection.
+*
+* Logical types — the backend translates each to the matching SQLite
+* storage class and handles per-type marshaling:
+*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
+*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
+*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
 */
-var BackupRunSchema = object({
-	/** Stable run id — the handle `backup.cancel` takes. */
-	id: string(),
-	state: BackupRunStateSchema,
-	phase: BackupRunPhaseSchema,
-	/**
-	* Resolved destination location ids. Empty while queued (targets are
-	* resolved when the run starts, against the then-current policies).
-	*/
-	destinationIds: array(string()).readonly(),
-	label: string().optional(),
-	/** ms-epoch when the run was submitted (trigger call / schedule fire). */
-	requestedAt: number(),
-	/** ms-epoch when the run left the queue and started building. */
-	startedAt: number().optional(),
-	/** ms-epoch when the run reached a terminal state. */
-	finishedAt: number().optional(),
-	/** Compressed bytes of the staging archive written so far. */
-	stagedBytes: number(),
-	/** Final staged archive size, once the build phase completes. */
-	archiveSizeBytes: number().optional(),
-	/** Bytes pushed to the destination currently uploading. */
-	uploadedBytes: number(),
-	/** Destinations where the archive fully landed (uploaded + indexed). */
-	completedDestinationIds: array(string()).readonly(),
-	/** Destinations that failed during the fan-out. */
-	failedDestinationIds: array(string()).readonly(),
-	/** Failure message when `state === 'failed'`. */
-	error: string().optional(),
+var CollectionColumnSchema = object({
+	name: string(),
+	type: _enum([
+		"TEXT",
+		"INTEGER",
+		"REAL",
+		"JSON",
+		"BOOLEAN"
+	]),
+	primaryKey: boolean().optional(),
+	notNull: boolean().optional(),
+	unique: boolean().optional(),
 	/**
-	* 1-based place in the execution queue — 1 = runs next. Present only
-	* while `state === 'queued'`. Stamped by the orchestrator from the
-	* queue's OWN pending order, never derived from timestamps, so the
-	* UI cannot show an order the executor will not honour.
+	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
+	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
+	* collection surface simply cannot express their existing tables — which is
+	* why they were still on the uncapped `table*` API.
 	*/
-	queuePosition: number().int().min(1).optional()
+	defaultValue: union([
+		string(),
+		number(),
+		boolean()
+	]).optional()
 });
-/**
-* Result of `backup.trigger`. The call still resolves when the run
-* terminates (compat with schedule-driven runs and the admin UI), but
-* it now names the run and says whether it had to WAIT: a trigger that
-* arrives while another run is in flight is enqueued (or joined onto
-* an identical already-queued run), never started concurrently.
-*/
-var BackupTriggerResultSchema = object({
-	/** The run this trigger mapped to — poll it via `listRuns`, stop it via `cancel`. */
-	runId: string(),
-	/** True when the run waited behind an in-flight run instead of starting immediately. */
-	queued: boolean(),
-	/** True when this trigger was coalesced onto an identical already-queued run. */
-	joined: boolean(),
-	/** True when the run was cancelled before completing every destination. */
-	cancelled: boolean(),
-	/** One entry per destination the archive landed at (partial on cancel). */
-	entries: array(BackupEntrySchema).readonly()
+var CollectionIndexSchema = object({
+	name: string(),
+	columns: array(string()).readonly(),
+	unique: boolean().optional()
 });
 /**
-* A backup schedule — the N:M "entry" that binds one cron cadence to a
-* SET of destination locations. Supersedes the per-location cron on
-* `BackupDestinationPolicy`: an operator creates a schedule, picks the
-* `backups` locations it should write to, and the orchestrator fans a
-* single archive out to all of them when the cron fires.
-*
-* `retentionCount` is per-schedule (D-decision 2026-07-28): every
-* location targeted by this schedule keeps this many archives from
-* this schedule's runs.
+* The input of `declareCollection` — ONE schema for the door and for the
+* engine behind it, so the two surfaces cannot drift (the dispatcher forwards
+* the payload untouched).
 *
-* `dataSources` optionally narrows which top-level state locations
-* (db, addons, tls, …) are archived; omitted = the orchestrator's
-* default full set.
+* - `database` — the file the collection lives in (D851). Absent means
+*   `settings`. A declaration naming a file other than the one the table is
+*   already in is REFUSED by the engine, never moved.
+* - `primaryKey` — a COMPOSITE key, as column names. A single name is the same
+*   as `primaryKey: true` on that column. A composite-keyed collection has no
+*   `id`: it is written with `insertMany` / `upsertMany` / `transact` and read
+*   with `query` / `count` / `aggregate` / `deleteWhere`; the calls that
+*   address one row by id are refused.
+* - `withoutRowid` — emit `WITHOUT ROWID`. Requires a primary key.
 */
-var BackupScheduleSchema = object({
-	/** Stable id. Generated by the orchestrator on first upsert if absent. */
-	id: string(),
-	/** Operator-facing display name. */
-	label: string(),
-	/** 5-field POSIX cron. Empty = disabled cadence (kept for editing). */
-	cron: string(),
-	/** Master on/off toggle for the whole schedule. */
-	enabled: boolean(),
-	/** `backups`-location ids this schedule writes to (fan-out set). */
-	locationIds: array(string()).readonly(),
-	/** Archives kept per targeted location for this schedule. */
-	retentionCount: number().int().min(1).max(1e3),
-	/** Optional subset of source locations to include; omitted = all. */
-	dataSources: array(string()).readonly().optional(),
-	/**
-	* ms-epoch of the last tick that FIRED this schedule. Stamped before the
-	* archive runs (it is the dedupe anchor), so it says "attempted", never
-	* "succeeded" — a run refused by every destination stamps it too.
-	*/
-	lastAttemptAt: number().optional(),
-	/** ms-epoch of the last run of this schedule that landed at ≥1 destination. */
-	lastSuccessAt: number().optional(),
-	/** Why the last fired run failed, verbatim. Absent when it succeeded. */
-	lastError: string().optional(),
-	/** ms-epoch of next computed firing (read-only, filled on list). */
-	nextRunAt: number().optional()
+var DeclareCollectionInputSchema = object({
+	namespace: string().optional(),
+	collection: string(),
+	columns: array(CollectionColumnSchema).readonly(),
+	indexes: array(CollectionIndexSchema).readonly().optional(),
+	database: DataStoreDatabaseSchema.optional(),
+	primaryKey: array(string()).readonly().optional(),
+	withoutRowid: boolean().optional()
 });
-method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }), method(object({
-	/** Subset of registered `backup-destination` addon ids to write to. */
-	destinations: array(string()).optional(),
-	locations: array(string()).optional(),
-	label: string().optional(),
-	/**
-	* Per-run retention override applied to every targeted
-	* destination. Used by schedule-driven runs (per-entry
-	* retention). Omitted = each destination's own policy
-	* retention (manual runs).
-	*/
-	retentionCount: number().int().min(1).max(1e3).optional()
-}).optional(), BackupTriggerResultSchema, {
+method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), unknown(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string(),
+	value: unknown()
+}), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(BackupRunSchema).readonly(), { auth: "admin" }), method(object({ runId: string() }), object({ cancelled: boolean() }), {
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional(),
+	columns: array(string()).readonly().optional()
+}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	/** Declared columns identifying the slot; must be covered by a UNIQUE
+	*  index on the collection. Never empty. */
+	conflict: array(string()).readonly(),
+	record: BulkRecordSchema
+}), object({ 
+/** The id the row HAS: assigned by SQLite on an insert, or the existing
+*  row's own id on an update. */
+id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(BackupEntrySchema).readonly(), { auth: "admin" }), method(_void(), array(LocationStatSchema).readonly(), { auth: "admin" }), method(object({
-	destinationId: string(),
-	backupId: string()
-}), ArchiveManifestSchema.nullable(), { auth: "admin" }), method(object({
-	destinationId: string(),
-	backupId: string(),
-	/**
-	* Optional whitelist — only restore these top-level locations
-	* from the archive. Default = every location the archive
-	* carries (full restore). The boot-time apply hook reads
-	* this list and skips entries whose path doesn't start with
-	* any of them.
-	*/
-	locations: array(string()).optional(),
-	/**
-	* The backup SECRET key, for an encrypted archive (ignored for a plain
-	* one). The archive is decrypted into the hub's private staging
-	* before the restart; the key is not stored. A wrong or missing key
-	* is refused before the archive is downloaded.
-	*/
-	backupSecretKey: string().optional()
-}), _void(), {
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	conflict: array(string()).readonly(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ upserted: number().int() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), BackupEncryptionStatusSchema, { auth: "admin" }), method(object({}), object({
-	keyId: string(),
-	secretKey: string(),
-	publicKey: string(),
-	createdAt: number(),
-	replacedKeyId: string().nullable()
-}), {
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	record: object({
+		id: string().optional(),
+		data: record(string(), unknown())
+	})
+}), object({ 
+/**
+* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
+* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
+* primary key — which is the only place an auto key is knowable.
+*/
+id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), object({ disabledKeyId: string().nullable() }), {
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ inserted: number().int() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ backupSecretKey: string() }), object({
-	valid: boolean(),
-	keyId: string().nullable(),
-	/** The hub knows this key (active or retired). */
-	known: boolean(),
-	/** It is the key new archives are encrypted to. */
-	active: boolean(),
-	error: string().optional()
+}), method(object({
+	namespace: string().optional(),
+	guard: TransactGuardSchema.optional(),
+	ops: array(TransactOpSchema).readonly()
+}), object({
+	applied: boolean(),
+	current: unknown().optional()
 }), {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
-	destinationId: string(),
-	backupId: string()
+	namespace: string().optional(),
+	collection: string(),
+	id: string(),
+	data: record(string(), unknown())
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ destinationId: string() }), array(BackupArchiveEntrySchema).readonly(), { auth: "admin" }), method(object({
-	locationId: string(),
-	enabled: boolean(),
-	retentionCount: number().int().min(1).max(1e3),
-	label: string().optional()
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
-	cron: string(),
-	count: number().int().min(1).max(20).optional()
-}), object({
-	ok: boolean(),
-	error: string().optional(),
-	nextRuns: array(number()).readonly()
-})), method(_void(), array(BackupScheduleSchema).readonly(), { auth: "admin" }), method(object({
-	id: string().optional(),
-	label: string(),
-	cron: string(),
-	enabled: boolean(),
-	locationIds: array(string()).readonly(),
-	retentionCount: number().int().min(1).max(1e3),
-	dataSources: array(string()).readonly().optional()
-}), BackupScheduleSchema, {
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema
+}), object({ deleted: number().int() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ id: string() }), _void(), {
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema,
+	data: record(string(), unknown())
+}), object({ updated: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), number(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema, { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	field: string(),
+	bucketSize: number().int().positive(),
+	origin: number().int(),
+	filter: QueryFilterSchema.optional()
+}), array(object({
+	bucket: number().int(),
+	count: number().int()
+})).readonly(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string()
+}), boolean(), { auth: "admin" }), method(DeclareCollectionInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
 });
 /**
-* `broker` — unified pub/sub broker registry, system-scoped collection.
-*
-* The cap models any kind-tagged message broker the user wants to
-* register and that other addons might consume. The first two kinds
-* are MQTT (mosquitto / aedes embedded / cloud bridge) and
-* Home Assistant (HA WebSocket — subscribe_entities + call_service).
-* Future kinds (Zigbee2MQTT bridge, ZHA, KNX, Telegram, …) plug in
-* the same surface.
-*
-* Why one cap, not one cap per kind:
-*   - The integrations page wants a single table of "every broker"
-*     across kinds; a unified cap drives it without join logic.
-*   - Generic admin operations (add / remove / test / status) are
-*     identical across kinds — duplicating them per cap was busywork.
-*   - The `network-access` cap precedent: same interface, many
-*     `providerKind: 'ingress'` implementations (Tailscale, ngrok, …).
-*
-* What stays kind-specific:
-*   - `getBrokerConfig` payload (kind decides whether it returns
-*     mqtt URL+creds, HA baseUrl+token, …) — typed as
-*     `Record<string, unknown>` at the wire; consumers narrow.
-*   - `publish` / `subscribe` / `getState` arguments (target / filter /
-*     key) — also typed as `Record<string, unknown>` so each kind can
-*     evolve its surface (MQTT topic+qos vs HA entity_id+domain)
-*     without rebreaking the cap signature.
-*   - `add` `settings` payload (different fields per kind, validated by
-*     the kind-specific provider).
-*
-* Bidirectionality:
-*   - `publish` is RPC — synchronous result (provider-defined).
-*   - `subscribe` returns a subscription handle; the actual message
-*     stream flows over the typed event-bus as `broker.message` events
-*     keyed by `(brokerId, subscriptionId)`. Consumers filter in their
-*     event handler. Subscriptions persist across reconnects — the
-*     provider re-subscribes upstream after a transport drop.
-*
-* Why event-bus push (not a subscription RPC stream):
-*   - Matches the rest of CamStack's D8 contract — events for telemetry,
-*     RPC for loss-is-a-bug. Broker messages are telemetry (a single
-*     drop is recoverable via `getState({key})`).
-*   - Frees `broker.subscribe` from holding a long-lived RPC channel.
-*   - Cross-process: events already route through `$event-bus`; no
-*     per-broker wire-shaping needed.
+* How long one snapshot may take end to end: the pinned copy of the whole
+* database plus `PRAGMA integrity_check` over the copy, on the hub's slowest
+* disk. ~800 MB at a pessimistic 10 MB/s is under 3 minutes; the bound is
+* generous because a timeout fails the whole backup run.
 */
-var BrokerStatusEnum = _enum([
-	"connected",
-	"disconnected",
-	"connecting",
-	"auth-failed",
-	"unreachable",
-	"error"
-]);
-var BrokerInfoSchema = object({
-	/** Stable broker id. Persisted; survives addon restarts. */
-	id: string(),
-	/** Addon id of the provider that OWNS this broker.
-	*
-	*  The `broker` cap is a system-scoped collection: several addons
-	*  register a `broker` provider, each owning a DISJOINT set of
-	*  brokers (mqtt-broker owns `mqtt_*`, provider-homeassistant owns
-	*  `ha_*`). A broker therefore belongs to exactly one addon — like a
-	*  device belongs to one integration. The admin UI threads this id
-	*  back as the `{ addonId }` system-collection selector on every
-	*  id-keyed call (`get` / `getSettings` / `setSettings` / `remove` /
-	*  `testConnection`), so the call routes to the OWNING provider
-	*  instead of defaulting to the first-registered one. */
-	addonId: string(),
-	/** Human-readable name (operator-chosen at add-time). */
+var DATABASE_SNAPSHOT_TIMEOUT_MS = 30 * 6e4;
+/**
+* The databases an owner snapshots — declared by the OWNER, so a caller never
+* guesses which file is live from what sits beside it (a cleanly closed
+* database has no sidecars and is just as owned). Paths are absolute on the
+* owner's host.
+*/
+var DatabaseSnapshotTargetsSchema = object({ databases: array(object({
+	/** Which owned file this is — the handle `writeSnapshot` takes. */
+	databaseId: DataStoreDatabaseSchema,
+	livePath: string()
+})) });
+/** One b-tree table of the snapshot and the rows it holds. */
+var DatabaseSnapshotTableSchema = object({
 	name: string(),
-	/** Provider-defined kind tag — `mqtt` / `home-assistant` / future. */
-	kind: string(),
-	status: BrokerStatusEnum,
-	/** Free-form provider-specific info (HA version, MQTT broker
-	*  flavour, latency, mTLS active, …). */
-	info: record(string(), unknown()),
-	/** Ms epoch of the last connection probe / status update. */
-	lastCheckedAt: number().nullable(),
-	/** Last error message, when `status` indicates failure. */
-	error: string().nullable()
-});
-var RegistryStatusSchema = object({
-	brokerCount: number().int().nonnegative(),
-	connectedCount: number().int().nonnegative()
+	rows: number().int().nonnegative()
 });
 /**
-* One entry per `broker` provider — which addon provides which broker
-* kind(s). The unified create picker reads this to know, for each
-* (addonId, kind) pair the operator can pick, where to route the
-* follow-up `getSettingsSchema` / `testSettings` / `add` calls (via the
-* `{ addonId }` selector). A provider only advertises a kind here when
-* it implements `getSettingsSchema` for that kind (so the picker never
-* offers a kind whose creation form can't be rendered).
+* What the owner wrote. Every path is ABSOLUTE on the owner's host — the
+* caller pins the call to its own node, so it can read the file; a caller
+* that finds the path outside its own data root refuses it rather than
+* archiving something it cannot place.
 */
-var BrokerProviderInfoSchema = object({
-	/** Addon id of the `broker` provider this entry describes. */
-	addonId: string(),
-	/** Broker kinds this provider can create, with a display label. */
-	kinds: array(object({
-		kind: string(),
-		label: string(),
-		/**
-		* Relative hub path to start an interactive account link (OAuth popup).
-		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
-		*/
-		interactiveConnectPath: string().min(1).optional(),
-		/** Relative hub path to disconnect the linked account (same popup pattern). */
-		interactiveDisconnectPath: string().min(1).optional()
-	}))
-});
-var ListInputSchema = object({ 
-/** Optional kind filter — `list({kind:'home-assistant'})` returns
-*  only HA brokers. Omit to list every broker. */
-kind: string().optional() });
-var GetInputSchema = object({ id: string() });
-var AddInputSchema = object({
-	kind: string().min(1),
-	name: string().min(1),
+var DatabaseSnapshotResultSchema = object({
+	/** The live database the snapshot copies. Never to be copied as a file. */
+	livePath: string(),
+	/** The verified copy: `<livePath>` + {@link DATABASE_SNAPSHOT_SUFFIX}. */
+	snapshotPath: string(),
+	sizeBytes: number().int().nonnegative(),
+	pageCount: number().int().nonnegative(),
+	pageSize: number().int().positive(),
 	/**
-	* ADOPT an existing id instead of minting a new one.
-	*
-	* Written the day this cost an outage. A broker's id is not a detail: HA
-	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
-	* lost from config and re-added as `ha_001` leaves every one of its devices
-	* bound to a broker that no longer exists. Re-entering the password under the
-	* ORIGINAL id turns a multi-step device migration back into re-entering a
-	* password.
-	*
-	* A provider MUST refuse an id that is already in use — adopting a live
-	* broker's id would silently take it over.
+	* Every b-tree table with its row count. Read inside the SAME read
+	* transaction the copy was taken from, and found EQUAL on the copy — so
+	* this is the content of the snapshot, not an estimate of the source.
 	*/
-	id: string().min(1).optional(),
-	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
-	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
-	*  branch on receipt — invalid shape rejects the add. */
-	settings: record(string(), unknown())
-});
-var AddResultSchema = object({ id: string() });
-var RemoveInputSchema = object({ id: string() });
-var TestConnectionResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number().nonnegative()
-}), object({
-	ok: literal(false),
-	error: string()
-})]);
-var SettingsRecordSchema$1 = record(string(), unknown());
-var SettingsSchemaInputSchema = object({ kind: string() });
-var TestSettingsInputSchema = object({
-	kind: string(),
-	settings: SettingsRecordSchema$1
-});
-var TestSettingsResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number().nonnegative().optional()
-}).strict(), object({
-	ok: literal(false),
-	error: string()
-})]);
-var SettingsSchemaResultSchema = unknown().nullable();
-var PublishInputSchema = object({
-	brokerId: string(),
-	/** Kind-specific routing target.
-	*  MQTT: `{ topic: string, qos?: 0|1|2, retain?: boolean }`.
-	*  HA:   `{ domain: string, service: string, entityId?: string, area?: string }`. */
-	target: record(string(), unknown()),
-	/** Kind-specific payload.
-	*  MQTT: raw string / number / object (provider serialises).
-	*  HA:   service-call `data` object (transition, brightness, …). */
-	payload: unknown().optional()
-});
-var SubscribeInputSchema = object({
-	brokerId: string(),
-	/** Kind-specific filter.
-	*  MQTT: `{ topic: string, qos?: 0|1|2 }` — topic can include wildcards.
-	*  HA:   `{ entityIds: string[] }` or `{ domain: string }`. */
-	filter: record(string(), unknown())
-});
-var SubscribeResultSchema = object({ 
-/** Stable subscription id. Used to unsubscribe and to filter the
-*  matching `broker.message` events on the bus. */
-subscriptionId: string() });
-var UnsubscribeInputSchema = object({
-	brokerId: string(),
-	subscriptionId: string()
+	tables: array(DatabaseSnapshotTableSchema),
+	/** Wall time of the pinned copy (row counts included). */
+	copyMs: number().nonnegative(),
+	/** Wall time of the checks on the copy (`integrity_check`, row counts). */
+	verifyMs: number().nonnegative(),
+	/** When the pinned read transaction began (ms epoch) — the snapshot's instant. */
+	takenAt: number()
 });
-var GetStateInputSchema = object({
-	brokerId: string(),
-	/** Kind-specific lookup key.
-	*  MQTT: topic string (returns the last retained message).
-	*  HA:   entity_id (returns the cached entity state). */
-	key: string()
+/** A snapshot the owner wrote, with the file it belongs to. */
+var DatabaseSnapshotWrittenSchema = DatabaseSnapshotResultSchema.extend({ databaseId: DataStoreDatabaseSchema });
+/** Which database `writeSnapshot` copies. Required: an unstated ask is not guessed. */
+var DatabaseSnapshotRequestSchema = object({ databaseId: DataStoreDatabaseSchema });
+/**
+* A snapshot as an ARCHIVE records it (`ArchiveManifest.sqliteSnapshots`):
+* the same facts, with both paths relative to the archive root (the node's
+* data dir), because an archive outlives the host that made it.
+*/
+var ArchiveSqliteSnapshotSchema = DatabaseSnapshotResultSchema.extend({
+	/** Archive-relative path of the live database the archive does NOT carry. */
+	livePath: string(),
+	/** Archive-relative path of the verified copy it carries in its place. */
+	snapshotPath: string(),
+	/** Absent on an archive made before several files were owned: that was `settings`. */
+	databaseId: DataStoreDatabaseSchema.optional()
 });
-method(ListInputSchema, array(BrokerInfoSchema)), method(GetInputSchema, BrokerInfoSchema.nullable()), method(_void(), array(BrokerProviderInfoSchema), { auth: "admin" }), method(AddInputSchema, AddResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(RemoveInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(GetInputSchema, TestConnectionResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }), method(object({
-	id: string(),
-	settings: SettingsRecordSchema$1
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }), method(SettingsSchemaInputSchema, SettingsSchemaResultSchema, { auth: "admin" }), method(TestSettingsInputSchema, TestSettingsResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(PublishInputSchema, unknown(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(SubscribeInputSchema, SubscribeResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(UnsubscribeInputSchema, _void(), {
+method(object({}), DatabaseSnapshotTargetsSchema, { auth: "admin" }), method(DatabaseSnapshotRequestSchema, DatabaseSnapshotWrittenSchema, {
 	kind: "mutation",
-	auth: "admin"
-}), method(GetStateInputSchema, unknown().nullable(), { auth: "admin" }), method(_void(), RegistryStatusSchema);
-DeviceType.Camera;
-/** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
-var StreamFormatSchema = _enum([
-	"webrtc",
-	"hls",
-	"mjpeg",
-	"rtsp"
-]);
-/** A container `produceEventMedia` can emit. */
-var EventMediaKindSchema = _enum(["mp4", "gif"]);
+	auth: "admin",
+	timeoutMs: DATABASE_SNAPSHOT_TIMEOUT_MS
+});
 /**
-* One produced artifact, referenced by HANDLE.
+* Orchestrator-side destination metadata. The orchestrator computes
+* `id = <addonId>:<subId>` from its provider lookup so consumers
+* (admin UI, restore flow) see one canonical key.
 *
-* Never inline bytes: a produced clip is 200 KB–5 MB and every consumer of this
-* method is in another runner ([D9](../../../../docs/decisions/adr-0009.md),
-* [D18](../../../../docs/decisions/adr-0018.md) — cross-process media is fetched
-* on demand, compressed, by handle). `bytes` is here so a caller can decide
-* whether it wants the fetch at all.
+* Phase 4 (admin UI redesign) adds the per-destination policy fields
+* (`enabled`, `retentionCount`, `label`) so the destinations table can
+* render the joined view without a follow-up round-trip. The backend
+* already joins these in `listDestinations` — we now surface them on
+* the wire.
+*
+* `lastSuccessAt` / `lastSuccessSizeBytes` are computed from each
+* location's `manifests.json` (newest archive). Optional — locations
+* with no archives yet leave them undefined.
 */
-var EventMediaArtifactSchema = object({
-	kind: EventMediaKindSchema,
-	/** Opaque, single-camera, short-lived. Redeem with `fetchEventMedia`. */
-	handle: string(),
+var BackupDestinationInfoSchema = object({
 	/**
-	* The node holding the bytes — the ROUTING key for `fetchEventMedia`.
-	*
-	* `stream-broker` is a singleton cap and an unpinned call never leaves the
-	* hub, so a handle produced on an agent's broker would be redeemed against
-	* the hub's store and come back `null`. Same contract, same field name and
-	* the same reason as `FrameHandleSchema.nodeId`: the producer stamps where it
-	* lives and the consumer pins to it.
+	* Sub-id within this addon. Convention `default` for single-
+	* destination addons; addons that host many (S3 with N buckets)
+	* pick stable per-bucket strings. The orchestrator stitches
+	* `<manifestId>:<subId>` for the wire format.
 	*/
-	nodeId: string(),
-	mime: string(),
-	bytes: number().int(),
-	width: number().int(),
-	height: number().int()
+	subId: string(),
+	displayName: string(),
+	description: string().optional(),
+	kind: string(),
+	triggerSupported: boolean(),
+	restoreSupported: boolean()
+}).extend({
+	/** `<addonId>:<subId>` — globally-unique dispatch key. */
+	id: string(),
+	/**
+	* Manifest id of the owning addon. The Settings button on the
+	* destination card opens that addon's `globalSettingsSchema` panel.
+	*/
+	addonId: string(),
+	/** Operator-toggled enable flag from the destination-policy table. */
+	enabled: boolean(),
+	/** Operator-defined retention count (archives kept per destination). */
+	retentionCount: number(),
+	/** Operator-defined display label (overrides storage location displayName). */
+	label: string().optional(),
+	/** Newest-archive timestamp from `manifests.json`, or undefined. */
+	lastSuccessAt: number().optional(),
+	/** Newest-archive size from `manifests.json`, or undefined. */
+	lastSuccessSizeBytes: number().optional(),
+	/**
+	* Cron cadence(s) of the ENABLED schedules that fan out to this
+	* destination, comma-joined. Absent when no enabled schedule targets it
+	* — a destination nothing is scheduled to write to must not advertise a
+	* cadence (D384). This is never the `backup_destination_policies.cron`
+	* column: that per-location cron has scheduled nothing since 2026-07-28
+	* and reading it made a destination with a DISABLED schedule claim a
+	* nightly run.
+	*/
+	cron: string().optional(),
+	/** ms-epoch of the next firing across those schedules (earliest), if any. */
+	nextRunAt: number().optional(),
+	/**
+	* ms-epoch of the last time a run ATTEMPTED to write here — success or
+	* failure. Never a success stamp: pair it with `lastSuccessAt` (the
+	* newest archive that actually landed) and `lastError`.
+	*/
+	lastAttemptAt: number().optional(),
+	/**
+	* Why the last attempt failed, verbatim. Absent when the last attempt
+	* landed the archive. A destination that has never been written to has
+	* neither this nor `lastAttemptAt`.
+	*/
+	lastError: string().optional()
 });
 /**
-* What a production actually covered — the answer to the only question an
-* operator asks about a notification clip.
-*
-* `fromTs`/`toTs` are WALL CLOCK, derived from the ring's own packet timeline,
-* so a caller can state "this clip starts 4.1 s before the event" instead of
-* inferring it from a duration. A production whose `fromTs` is later than the
-* event is a production with no pre-roll, and that is exactly the defect this
-* method exists to make visible rather than plausible.
+* How an archive is encrypted (operator decision 2026-10-09): to a backup
+* PUBLIC key the hub holds, so only the operator's secret key opens it.
+* Absent on a plain `.tar.gz` — every archive made before encryption, or
+* with it off — which restores without a key.
 */
-var EventMediaCoverageSchema = object({
-	fromTs: number(),
-	toTs: number(),
-	/** Encoded packets in the muxed window. */
-	packets: number().int()
+var BackupArchiveEncryptionSchema = object({
+	/** `x25519-hkdf-aes256gcm-stream-v1`. */
+	scheme: string(),
+	/** 16 hex — the backup key whose secret restores this archive. */
+	keyId: string()
 });
 /**
-* The result of ONE cut, in every container the caller asked for.
-*
-* Every artifact in `media` came out of the SAME window of the SAME rendition —
-* that is the whole reason this is one method rather than one call per format.
-* A consumer attaching a gif and a video can no longer show two different
-* moments, because it never chose two sources.
+* The backup encryption setting. The hub keeps PUBLIC keys only: the active
+* one new archives are encrypted to, and the retired ones older archives
+* still need. The secret key is shown once, at `setupEncryption`.
 */
-var EventMediaProductionSchema = object({
-	media: array(EventMediaArtifactSchema).readonly(),
-	coverage: EventMediaCoverageSchema,
-	/** The rendition actually cut from — what the default or the fallback chose. */
-	profile: CamProfileSchema,
-	/** `copy` = the camera's own H.264, untouched. `encode` = re-encoded (H.265
-	*  source, a downscale, or a playback rate other than 1). */
-	video: _enum(["copy", "encode"])
-});
-var RtspRestreamEntrySchema = object({
-	brokerId: string(),
-	url: string(),
-	mutedUrl: string(),
+var BackupEncryptionStatusSchema = object({
 	enabled: boolean(),
+	active: object({
+		keyId: string(),
+		publicKey: string(),
+		createdAt: number()
+	}).nullable(),
+	/** Every key ever set up, newest first. */
+	keys: array(object({
+		keyId: string(),
+		createdAt: number(),
+		retiredAt: number().nullable()
+	})).readonly()
+});
+/**
+* Per-archive entry returned by `backup.listArchives({ destinationId })`.
+* Same shape the destination drill-in renders. Sourced from the per-
+* location `manifests.json` (no per-archive tarball read required).
+*/
+var BackupArchiveEntrySchema = object({
+	id: string(),
+	filename: string(),
+	createdAt: number(),
+	sizeBytes: number(),
+	label: string().optional(),
+	/** Top-level locations included in the archive (db, addons, tls, …). */
+	locations: array(string()).readonly(),
+	/** Present when the archive is encrypted; restore then needs that key. */
+	encryption: BackupArchiveEncryptionSchema.optional(),
 	/**
-	* Source-stream codec / resolution for the camStream this entry serves
-	* (the broker's "high"/"mid"/"low" profile slot for this device).
-	* Used by exporter pickers (`pickPreferredRtspEntry`) to resolve
-	* `streamPreference: 'auto'` to the slot whose source is closest to
-	* the consumer's target — Alexa wants ~720p, HomeKit wants ~1080p,
-	* and there's no point dialling the 4K slot for an Echo Show. Absent
-	* when the source publisher never advertised the field; pickers fall
-	* back to first-enabled in that case.
+	* The databases the run asked to carry (its retention class). Absent on an
+	* archive made before several files were owned: that was `['settings']`.
 	*/
-	codec: string().optional(),
-	resolution: object({
-		width: number().int().positive(),
-		height: number().int().positive()
-	}).optional()
-});
-var BrokerRtspClientSchema = object({
-	sessionId: string(),
-	remoteAddr: string(),
-	/** Client `User-Agent` (e.g. `recorder` for the recorder's RTSP pull), or
-	*  null/absent when the client sent none. Lets the UI label a consumer by
-	*  purpose. Optional so a client built against an older schema stays valid. */
-	userAgent: string().nullish(),
-	playing: boolean(),
-	muted: boolean(),
-	connectedAt: number(),
-	lastRtpAt: number(),
-	bytesSent: number()
+	databases: array(DataStoreDatabaseSchema).readonly().optional()
 });
-var BrokerAudioClientSchema = object({
-	tag: string(),
-	subscribedAt: number(),
-	chunksDelivered: number()
+var BackupEntrySchema = object({
+	id: string(),
+	/** Addon id of the destination that owns this backup (e.g. `local-backup`, `s3-backup`). */
+	destinationId: string().optional(),
+	label: string().optional(),
+	createdAt: number(),
+	sizeBytes: number(),
+	locations: array(string()).optional(),
+	encryption: BackupArchiveEncryptionSchema.optional()
 });
-var BrokerConsumerAttributionSchema = object({
+var ArchiveEntrySchema = object({
+	path: string(),
 	kind: _enum([
-		"alexa",
-		"homekit",
-		"webrtc-browser",
-		"webrtc-mobile",
-		"webrtc-whep",
-		"rtsp-listen",
-		"derived-broker",
-		"recording",
-		"pipeline",
-		"snapshot",
-		"warmup",
-		"unknown"
+		"file",
+		"dir",
+		"symlink"
 	]),
+	sizeBytes: number(),
+	mtime: number()
+});
+var ArchiveManifestSchema = object({
+	archiveVersion: literal(1),
+	createdAt: number(),
+	dataDir: string(),
+	locations: array(string()),
+	entries: array(ArchiveEntrySchema),
+	totalBytes: number(),
+	totalFiles: number(),
 	/**
-	* Free-form label intended to disambiguate consumers OF THE SAME kind
-	* on the same broker — e.g. user name, device alias. Should NOT repeat
-	* the kind / cam / cam-stream / sessionId (those are surfaced by
-	* dedicated fields). When empty the widget falls back to `${kind} ·
-	* <sessionId tail>`.
-	*/
-	label: string().optional(),
-	/**
-	* Which part of the encoded plane this subscription consumes:
-	*   - `'audio'` — audio packets only
-	*   - `'video'` — video packets only
-	*   - `'both'`  — both video + audio (typical for AnnexB push paths
-	*                 that don't split the source RTP)
-	*
-	* Missing field means "unknown" — older callers and the legacy
-	* paths that haven't been migrated yet.
+	* Live SQLite databases this archive carries as their OWNER's verified
+	* snapshot instead of as files (D693). Absent on archives made before.
 	*/
-	media: _enum([
-		"audio",
-		"video",
-		"both"
-	]).optional(),
+	sqliteSnapshots: array(ArchiveSqliteSnapshotSchema).optional(),
 	/**
-	* Codec the consumer receives AFTER any per-session re-encoding. For
-	* a WebRTC session this is the negotiated egress codec (e.g. `H264`,
-	* `H265`, `Opus`, `Pcmu`); for an RTSP restreamer it mirrors the
-	* source codec. Surfaced in the widget chip so operators see at a
-	* glance whether a viewer is on H.264 (Echo) or H.265 (Safari).
+	* Owned database files the run did NOT carry (not selected): left out of the
+	* tar and the entry list alike. Absent when every owned file was carried.
 	*/
-	targetCodec: string().optional(),
+	omittedDatabases: array(DataStoreDatabaseSchema).optional()
+});
+var LocationStatSchema = object({
+	name: string(),
+	sizeBytes: number(),
+	fileCount: number(),
+	present: boolean()
+});
+/** Lifecycle of a backup run. Terminal states: succeeded / failed / cancelled. */
+var BackupRunStateSchema = _enum([
+	"queued",
+	"running",
+	"succeeded",
+	"failed",
+	"cancelled"
+]);
+/**
+* Where a running backup currently is. `queued` before it starts,
+* `building` while the tar.gz is being staged, `uploading` during the
+* per-destination fan-out, `done` once terminal.
+*/
+var BackupRunPhaseSchema = _enum([
+	"queued",
+	"building",
+	"uploading",
+	"done"
+]);
+/**
+* Observable state of one backup run — readable WHILE it runs via
+* `backup.listRuns`. This is what makes the execution queue and
+* `backup.cancel` usable: the 2026-09-04 incident (two concurrent
+* multi-GB builds, staging 5.1 GB → 18 GB, load 62) was only
+* diagnosable with `du` because nothing reported that runs existed or
+* how large the staged archive had grown.
+*/
+var BackupRunSchema = object({
+	/** Stable run id — the handle `backup.cancel` takes. */
+	id: string(),
+	state: BackupRunStateSchema,
+	phase: BackupRunPhaseSchema,
 	/**
-	* Whether the broker is re-encoding for this consumer:
-	*   - `'passthrough'` — bytes flow source→consumer without ffmpeg
-	*   - `'repacketize'` — RTP payload is re-packetized but NOT re-encoded
-	*                       (preserves frames, just rebuilds headers; e.g.
-	*                       the H.265 repacketizer path)
-	*   - `'transcode'`   — a full encode/decode round (ffmpeg, libx264,
-	*                       libav…); the most expensive path
+	* Resolved destination location ids. Empty while queued (targets are
+	* resolved when the run starts, against the then-current policies).
 	*/
-	transport: _enum([
-		"passthrough",
-		"repacketize",
-		"transcode"
-	]).optional(),
-	/** Remote peer IP if the consumer terminates a network socket. */
-	remoteAddr: string().optional(),
+	destinationIds: array(string()).readonly(),
+	label: string().optional(),
+	/** ms-epoch when the run was submitted (trigger call / schedule fire). */
+	requestedAt: number(),
+	/** ms-epoch when the run left the queue and started building. */
+	startedAt: number().optional(),
+	/** ms-epoch when the run reached a terminal state. */
+	finishedAt: number().optional(),
+	/** Compressed bytes of the staging archive written so far. */
+	stagedBytes: number(),
+	/** Final staged archive size, once the build phase completes. */
+	archiveSizeBytes: number().optional(),
+	/** Bytes pushed to the destination currently uploading. */
+	uploadedBytes: number(),
+	/** Destinations where the archive fully landed (uploaded + indexed). */
+	completedDestinationIds: array(string()).readonly(),
+	/** Destinations that failed during the fan-out. */
+	failedDestinationIds: array(string()).readonly(),
+	/** Failure message when `state === 'failed'`. */
+	error: string().optional(),
 	/**
-	* Server-read User-Agent of the originating client; enriched by the hub
-	* from the tRPC request context (browser sessions).
+	* 1-based place in the execution queue — 1 = runs next. Present only
+	* while `state === 'queued'`. Stamped by the orchestrator from the
+	* queue's OWN pending order, never derived from timestamps, so the
+	* UI cannot show an order the executor will not honour.
 	*/
-	userAgent: string().optional(),
-	/** Authenticated user id (CamStack OAuth subject) when known. */
-	userId: string().optional(),
-	/** Higher-level session identifier (Alexa Echo sessionId, HAP session, …). */
-	sessionId: string().optional(),
-	/** Free-form key/value extras (e.g. clientHints from a WebRTC offer). */
-	extra: record(string(), string()).optional()
-}).readonly();
-var BrokerEncodedClientSchema = object({
-	/** Stable id assigned on attach; used by `killClient`. */
-	id: string(),
-	/** Which broker fanout the subscriber rides — annexB encoded packets vs raw RTP. */
-	channel: _enum(["annexb", "rtp"]),
-	attribution: BrokerConsumerAttributionSchema,
-	subscribedAt: number(),
-	/** Total packets delivered (annex-B EncodedPackets or RTP byte-buffers). */
-	packetsDelivered: number()
-});
-var BrokerClientsSchema = object({
-	rtsp: array(BrokerRtspClientSchema).readonly(),
-	audio: array(BrokerAudioClientSchema).readonly(),
-	encoded: array(BrokerEncodedClientSchema).readonly(),
-	pipeClients: number(),
-	/** Total encoded + raw-RTP callback subscriber count (sum of `encoded[].length`). */
-	encodedSubscribers: number()
+	queuePosition: number().int().min(1).optional()
 });
 /**
-* How many people are watching one camera LIVE right now — see
-* `getLiveViewerCounts`. A camera with nobody watching is absent from the list
-* (so `viewers` is always at least 1): the listing carries the cameras that
-* have viewers, never a row of zeros.
+* Result of `backup.trigger`. The call still resolves when the run
+* terminates (compat with schedule-driven runs and the admin UI), but
+* it now names the run and says whether it had to WAIT: a trigger that
+* arrives while another run is in flight is enqueued (or joined onto
+* an identical already-queued run), never started concurrently.
 */
-var LiveViewerCountSchema = object({
-	deviceId: number().int().nonnegative(),
-	viewers: number().int().positive()
-});
-_enum([
-	"reconnecting",
-	"sleeping",
-	"offline",
-	"disabled",
-	"waking"
-]);
-var VideoCodecTargetSchema = _enum([
-	"h264",
-	"h265",
-	"copy"
-]);
-var AudioCodecTargetSchema = _enum([
-	"aac",
-	"opus",
-	"pcmu",
-	"copy",
-	"none"
-]);
-var GetStreamWithCodecInputSchema = object({
-	deviceId: number().int().nonnegative(),
-	/** Target codec. `'copy'` = passthrough (no re-encode). */
-	video: VideoCodecTargetSchema,
-	/** Target audio codec. `'copy'` = passthrough. Defaults to `'aac'`. */
-	audio: AudioCodecTargetSchema.optional(),
-	/** Target a profile's assigned source camStream. Required to resolve a source. */
-	profile: CamProfileSchema.optional(),
-	/** Optional output resolution target. When set: drives the transcode
-	*  output scale (downscale toward WxH), and — when `profile` is absent —
-	*  selects the published source closest to this resolution. Ignored for
-	*  `video:'copy'` scaling (a copy can't be rescaled), but still used for
-	*  source selection. */
-	targetResolution: object({
-		width: number().int().positive(),
-		height: number().int().positive()
-	}).optional(),
-	/** Extra ffmpeg output flags appended verbatim by the consumer (in code).
-	*  Folded into the pipeline key so different args never share a child. */
-	outputArgs: array(string()).optional(),
-	/** Opt-in: carry transcoded audio over an RTP sidecar grafted into the
-	*  restreamer SDP (only for re-encoded audio targets — aac/opus/pcmu).
-	*  Default/absent = the live-verified video-only egress. */
-	audioEgress: boolean().optional(),
-	/** Host to embed in the returned restream `url`. The broker is hub-only, so
-	*  its restream URLs default to `127.0.0.1` (consumable only from the hub).
-	*  A REMOTE consumer (e.g. a recorder running on an agent designated as the
-	*  recording node) passes the hub's cluster-resolvable host here so the
-	*  returned `rtsp://<host>:<port>/<token>` is dialable from that node. The
-	*  port/token (and the underlying restreamer, bound on 0.0.0.0) are
-	*  unchanged — `hostname` only rewrites the client-facing dial address.
-	*  Absent/empty = `127.0.0.1` (the hub-local default). */
-	hostname: string().optional(),
-	tag: string().optional()
-});
-var RtpSourceSchema = object({
-	url: string(),
-	/**
-	* The SENTRY counterpart of {@link url} — the dial that asks for the stream
-	* WITHOUT asking for the camera — or `null` when this camera offers none.
-	*
-	* The broker answers it because the broker is the only thing that can:
-	* eligibility is `sentryEligible` (a BATTERY camera that DECLARES the signals
-	* cap), asked of facts only the broker holds. A consumer re-deriving it from
-	* cap bindings would be a second authority, and two authorities on the same
-	* question is how a composite camera ends up dialling a sleeping camera
-	* because its own copy of the rule was a release behind.
-	*
-	* `null` is a real answer and is never a live url in disguise: a consumer
-	* that silently fell back to {@link url} would perform exactly the wake this
-	* field exists to prevent. Only a PASSTHROUGH acquisition can offer one — a
-	* transcode hands back an egress the broker is feeding itself, which has no
-	* sentry counterpart.
-	*/
-	sentryUrl: string().nullable().optional(),
-	videoCodec: _enum(["H264", "H265"]),
-	audioCodec: string(),
-	resolution: object({
-		width: number().int().positive(),
-		height: number().int().positive()
-	}),
-	transcoded: boolean(),
-	encoder: string(),
-	pipelineKey: string()
+var BackupTriggerResultSchema = object({
+	/** The run this trigger mapped to — poll it via `listRuns`, stop it via `cancel`. */
+	runId: string(),
+	/** True when the run waited behind an in-flight run instead of starting immediately. */
+	queued: boolean(),
+	/** True when this trigger was coalesced onto an identical already-queued run. */
+	joined: boolean(),
+	/** True when the run was cancelled before completing every destination. */
+	cancelled: boolean(),
+	/** One entry per destination the archive landed at (partial on cancel). */
+	entries: array(BackupEntrySchema).readonly()
 });
 /**
-* The encode request — **structured and serialisable, with NO raw-flag escape
-* hatch.** This is deliberate and it is the one lesson taken from
-* `getStreamWithCodec`: that method's `outputArgs: string[]` is simultaneously
-* its extensibility mechanism AND part of `pipelineKeyFor`'s sharing key, so
-* adding a flag silently forks the shared child, and two consumers that mean
-* the same thing but spell it differently never share. Here every knob is a
-* NAMED field: a new requirement becomes a schema field (and a codegen run),
-* never an opaque array.
+* A backup schedule — the N:M "entry" that binds one cron cadence to a
+* SET of destination locations. Supersedes the per-location cron on
+* `BackupDestinationPolicy`: an operator creates a schedule, picks the
+* `backups` locations it should write to, and the orchestrator fans a
+* single archive out to all of them when the cron fires.
 *
-* `inputArgs` / `outputArgs` are omitted from the profile for the same reason.
-* The operator-facing derived-stream transform editor still has them — that is
-* a different surface (`publishCameraStream({ kind: 'derived' })`) with a
-* different purpose (reshaping a badly-behaved SOURCE), and it is unchanged.
-*/
-var EgressEncodeSchema = EncodeProfileSchema.omit({
-	inputArgs: true,
-	outputArgs: true
-});
-/**
-* How the encoder is bounded. `'tight'` is a one-second VBV window for a
-* consumer whose budget is enforced per second (HomeKit); `'relaxed'` is two
-* seconds, letting a keyframe spike borrow from the next second (a browser,
-* an Echo). Named rather than numeric so the INTENT survives.
+* `retentionCount` is per-schedule (D-decision 2026-07-28): every
+* location targeted by this schedule keeps this many archives from
+* this schedule's runs.
+*
+* `dataSources` optionally narrows which top-level state locations
+* (db, addons, tls, …) are archived; omitted = the orchestrator's
+* default full set.
 */
-var EgressRateControlSchema = _enum(["tight", "relaxed"]);
-var EgressTranscodeRequestSchema = object({
-	deviceId: number().int().nonnegative(),
-	/** Which published stream to read. */
-	source: discriminatedUnion("kind", [object({
-		kind: literal("profile"),
-		profile: CamProfileSchema
-	}), object({
-		kind: literal("cam-stream"),
-		camStreamId: string().min(1)
-	})]),
-	encode: EgressEncodeSchema,
-	rateControl: EgressRateControlSchema.optional(),
+var BackupScheduleSchema = object({
+	/** Stable id. Generated by the orchestrator on first upsert if absent. */
+	id: string(),
+	/** Operator-facing display name. */
+	label: string(),
+	/** 5-field POSIX cron. Empty = disabled cadence (kept for editing). */
+	cron: string(),
+	/** Master on/off toggle for the whole schedule. */
+	enabled: boolean(),
+	/** `backups`-location ids this schedule writes to (fan-out set). */
+	locationIds: array(string()).readonly(),
+	/** Archives kept per targeted location for this schedule. */
+	retentionCount: number().int().min(1).max(1e3),
+	/** Optional subset of source locations to include; omitted = all. */
+	dataSources: array(string()).readonly().optional(),
 	/**
-	* `-bsf:v`. A consumer that negotiates its OWN SDP (HomeKit) cannot carry
-	* out-of-band extradata and needs `dump_extra` on both the copy and encode
-	* branches. Enumerated, not free text.
+	* Which database files this schedule carries. Absent = `['settings']`
+	* (an unstated ask is the minimum, D382). Events and history run weekly,
+	* settings nightly (D852).
 	*/
-	bitstreamFilter: _enum([
-		"dump_extra",
-		"h264_mp4toannexb",
-		"hevc_mp4toannexb"
-	]).optional(),
+	databases: array(DataStoreDatabaseSchema).readonly().optional(),
 	/**
-	* Publish the transcode as a LOCAL push cam stream, instead of leaving the
-	* consumer to dial the returned url. The broker picks the id and returns it
-	* as `camStreamId` — a caller-supplied one would be circular, since the
-	* sharing key is computed FROM this request.
-	*
-	* The url is still returned and still the contract for a transcode pinned to
-	* another node. But dialling it locally costs an RTSP round trip that changes
-	* the transport underneath the consumer: a dialled stream is an RTP source,
-	* so `isRtpSource()` is true and the session takes the RTP-passthrough +
-	* repacketizer branch. The push branch — the one the derived mechanism has
-	* live hours on — is never reached. Measured on Alexa: broker registered, RTP
-	* arriving, key frame arriving, black screen, on a chain healthy at every
-	* other point.
-	*
-	* Same idea the transport already applies to CALLS, where `classifyCapRoute`
-	* gives priority to `hub-in-process` so a local call never leaves the node.
-	* This is that rule for media.
+	* ms-epoch of the last tick that FIRED this schedule. Stamped before the
+	* archive runs (it is the dedupe anchor), so it says "attempted", never
+	* "succeeded" — a run refused by every destination stamps it too.
 	*/
-	publishLocally: boolean().optional(),
-	pixelFormat: _enum(["yuv420p", "nv12"]).optional(),
+	lastAttemptAt: number().optional(),
+	/** ms-epoch of the last run of this schedule that landed at ≥1 destination. */
+	lastSuccessAt: number().optional(),
+	/** Why the last fired run failed, verbatim. Absent when it succeeded. */
+	lastError: string().optional(),
+	/** ms-epoch of next computed firing (read-only, filled on list). */
+	nextRunAt: number().optional()
+});
+method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }), method(object({
+	/** Subset of registered `backup-destination` addon ids to write to. */
+	destinations: array(string()).optional(),
+	locations: array(string()).optional(),
+	label: string().optional(),
 	/**
-	* Operator/consumer override for decode hardware. ABSENT is the normal case
-	* and the one that matters: the broker then resolves the backend from the
-	* DECODER ADDON's per-node `probedBestHwaccel` (see
-	* `@camstack/types` `ffmpeg/hwaccel.ts`), which is the ranking known to work
-	* on this hardware — never the raw kernel resolver's qsv-first order.
+	* Per-run retention override applied to every targeted
+	* destination. Used by schedule-driven runs (per-entry
+	* retention). Omitted = each destination's own policy
+	* retention (manual runs).
 	*/
-	decodeHwAccel: _enum([
-		"auto",
-		"none",
-		"videotoolbox",
-		"vaapi",
-		"qsv",
-		"cuda"
-	]).optional(),
+	retentionCount: number().int().min(1).max(1e3).optional(),
+	/** Database files to carry; omitted = `['settings']`. */
+	databases: array(DataStoreDatabaseSchema).optional()
+}).optional(), BackupTriggerResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), array(BackupRunSchema).readonly(), { auth: "admin" }), method(object({ runId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), array(BackupEntrySchema).readonly(), { auth: "admin" }), method(_void(), array(LocationStatSchema).readonly(), { auth: "admin" }), method(object({
+	destinationId: string(),
+	backupId: string()
+}), ArchiveManifestSchema.nullable(), { auth: "admin" }), method(object({
+	destinationId: string(),
+	backupId: string(),
 	/**
-	* Host to embed in the returned restream `url`. The broker mints hub-local
-	* `127.0.0.1` URLs; a consumer on another node passes a cluster-resolvable
-	* host (`NodeTopologyService.reachableHostByNode`) so the returned URL is
-	* dialable from there. Same contract as `getStreamWithCodec.hostname` —
-	* `substituteRtspHost` rewrites only the dial address, never the restreamer.
+	* Optional whitelist — only restore these top-level locations
+	* from the archive. Default = every location the archive
+	* carries (full restore). The boot-time apply hook reads
+	* this list and skips entries whose path doesn't start with
+	* any of them.
 	*/
-	hostname: string().optional(),
-	/** Attribution for the broker panel. Never part of the sharing key. */
-	tag: string().optional()
-});
-var EgressTranscodeSchema = object({
-	/** Dial-able RTSP url (host-substituted when `hostname` was supplied). */
-	url: string(),
-	/** Release handle. Refcounted — the child dies when the last holder releases. */
-	pipelineKey: string(),
-	videoCodec: _enum(["H264", "H265"]),
-	resolution: object({
-		width: number().int().positive(),
-		height: number().int().positive()
-	}),
-	transcoded: boolean(),
-	encoder: string(),
-	/**
-	* The decode backend the child ACTUALLY ran with — `null` for software.
-	* Returned rather than assumed: a consumer that asked for hardware and got
-	* software needs to be able to see that without reading the broker's logs.
-	*/
-	decodeHwAccel: string().nullable(),
+	locations: array(string()).optional(),
 	/**
-	* Set when `publishLocally` was honoured: attach to THIS instead of dialling
-	* `url`, and the session takes the push/deframe transport rather than the
-	* RTP-passthrough one. `null` means the consumer must dial.
+	* The backup SECRET key, for an encrypted archive (ignored for a plain
+	* one). The archive is decrypted into the hub's private staging
+	* before the restart; the key is not stored. A wrong or missing key
+	* is refused before the archive is downloaded.
 	*/
-	camStreamId: string().nullable()
-});
-method(object({
-	deviceId: number().int().nonnegative(),
-	/** The provider's signal code. */
-	code: string().min(1),
-	/** Ms epoch. Absent ⇒ now. */
-	at: number().optional()
-}), object({
-	/** Whether the broker acted on it, and if not, why. */
-	accepted: boolean(),
-	reason: _enum([
-		"woke",
-		"hold-extended",
-		"not-enabled",
-		"no-consumer",
-		"unknown-code"
-	])
-}), { kind: "mutation" }), method(object({
-	deviceId: number().int().nonnegative(),
-	camStreamId: string().min(1),
-	kind: CamStreamKindSchema,
-	url: string().optional(),
-	codec: string().optional(),
-	resolution: CamStreamResolutionSchema.optional(),
-	fps: number().positive().optional(),
-	label: string().optional(),
-	deviceFeatures: array(string()).optional(),
-	autoEligible: boolean().optional(),
-	/** The slot the publisher says this stream IS — see `CameraStreamSchema.profileHint`. */
-	profileHint: CamProfileSchema.optional(),
-	metadata: record(string(), unknown()).optional(),
-	/** Required when kind === 'derived' — the source camStreamId the
-	*  derived broker reads its encoded plane from.
-	*  The runtime guard (broker manager, Task 10) enforces presence for
-	*  kind === 'derived'; the schema stays permissive so ts-morph emits
-	*  full field types instead of collapsing to ZodEffects. */
-	sourceCamStreamId: string().min(1).optional(),
-	/** Required when kind === 'derived' — the ffmpeg params for the
-	*  spawn. Reuses the same brokerId for identical params (single-flight).
-	*  Runtime guard in broker manager; schema is permissive (see above). */
-	encodeProfile: EncodeProfileSchema.optional()
-}), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	camStreamId: string().min(1)
-}), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	profile: CamProfileSchema,
-	camStreamId: string().min(1)
-}), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	profile: CamProfileSchema
-}), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), object({
-	derivedStreamsDeleted: array(string()).readonly(),
-	assignmentsPurged: boolean(),
-	probeSnapshotsDropped: number().int().nonnegative(),
-	rtspTokenRowsDeleted: number().int().nonnegative()
-}), {
+	backupSecretKey: string().optional()
+}), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	/** Absent = the LOWEST assigned profile — a notification attachment is
-	*  watched on a phone, and the cheap rendition is the right default. */
-	profile: CamProfileSchema.optional(),
-	aroundMs: number(),
-	preRollSec: number().min(0).max(20).default(3),
-	postRollSec: number().min(0).max(20).default(5),
-	format: _enum(["gif", "mp4"]).default("gif"),
-	maxWidth: number().int().min(120).max(1920).default(480),
-	/** GIF only — MP4 keeps the source cadence. */
-	fps: number().int().min(1).max(15).default(5),
-	/**
-	* Playback rate. A notification clip is GLANCED at on a lock screen,
-	* not watched, so 2x is the default: the recipient sees the whole
-	* passage in half the time and the GIF is half the bytes. `1` is real
-	* time. Applies to MP4 as well — the operator set a speed, not a GIF
-	* speed.
-	*/
-	speed: number().min(1).max(8).default(2)
-}), object({
-	base64: string(),
-	mime: string(),
-	bytes: number().int(),
-	/** The profile actually rendered (what the default resolved to). */
-	profile: CamProfileSchema,
-	durationMs: number()
+}), method(_void(), BackupEncryptionStatusSchema, { auth: "admin" }), method(object({}), object({
+	keyId: string(),
+	secretKey: string(),
+	publicKey: string(),
+	createdAt: number(),
+	replacedKeyId: string().nullable()
 }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	/** Absent = the largest H.264 rendition at or below 1080p, which is
-	*  also the one that can be copied. Falls back to whatever the ring
-	*  actually retained, and the answer says which. */
-	profile: CamProfileSchema.optional(),
-	aroundMs: number(),
-	preSeconds: number().min(0).max(20).default(4),
-	postSeconds: number().min(0).max(20).default(6),
-	kinds: array(EventMediaKindSchema).min(1).default(["mp4"]),
-	/** GIF geometry. The video keeps the source's own. */
-	gifMaxWidth: number().int().min(120).max(1280).default(640),
-	/**
-	* The gif's own PLAYBACK rate in frames per second — what the finished
-	* gif runs at, not how many source frames feed it. The decimation that
-	* feeds it samples `gifFps / gifSpeed` source frames per second, so at
-	* the defaults a 12 fps gif is built out of 3 source frames a second.
-	*/
-	gifFps: number().int().min(1).max(15).default(12),
-	/**
-	* How fast the GIF plays against real time, independent of `speed`.
-	*
-	* 4× by default, by operator request: a notification gif is glanced at
-	* on a lock screen, so a ~12 s window has to be over in ~3 s. It stays
-	* a separate knob from `speed` even though both now default to 4 —
-	* a caller wanting a real-time video and a fast gif must not have to
-	* choose.
-	*/
-	gifSpeed: number().min(1).max(8).default(4),
-	/**
-	* Playback rate of the VIDEO. Also 4× by default, by operator decision.
-	*
-	* `1` is real time and is the ONLY value that allows the copy branch —
-	* anything else forces `libx264` over the window. That was priced
-	* before it was chosen: a per-event burst measured at 0.23 s and 254 KB
-	* on a real 615 720p cut, against 922 KB for the copy it replaces. A
-	* re-encode is capped at 720p (`EVENT_CLIP_ENCODE_MAX_WIDTH`), because
-	* once the decode is forced the width stops being free.
-	*/
-	speed: number().min(1).max(8).default(4)
-}), EventMediaProductionSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ handle: string() }), object({
-	base64: string(),
-	mime: string(),
-	bytes: number().int()
-}).nullable(), {
+}), method(object({}), object({ disabledKeyId: string().nullable() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(CameraStreamSchema).readonly()), method(_void(), array(ProfileSlotSchema).readonly()), method(object({ brokerId: string() }), BrokerStatsSchema), method(object({ brokerId: string() }), object({
-	probed: boolean(),
-	summary: string()
+}), method(object({ backupSecretKey: string() }), object({
+	valid: boolean(),
+	keyId: string().nullable(),
+	/** The hub knows this key (active or retired). */
+	known: boolean(),
+	/** It is the key new archives are encrypted to. */
+	active: boolean(),
+	error: string().optional()
 }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ brokerId: string() }), BrokerClientsSchema), method(_void(), array(LiveViewerCountSchema).readonly()), method(object({
-	brokerId: string(),
-	channel: _enum(["rtsp", "audio"]),
-	handle: string()
-}), object({ killed: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	profile: CamProfileSchema
-}), object({ success: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
 }), method(object({
-	streamId: string(),
-	format: StreamFormatSchema
-}), object({ url: string() })), method(GetStreamWithCodecInputSchema, RtpSourceSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ pipelineKey: string() }), object({
-	released: boolean(),
-	refcount: number().int().nonnegative()
-}), {
+	destinationId: string(),
+	backupId: string()
+}), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(EgressTranscodeRequestSchema, EgressTranscodeSchema, {
+}), method(object({ destinationId: string() }), array(BackupArchiveEntrySchema).readonly(), { auth: "admin" }), method(object({
+	locationId: string(),
+	enabled: boolean(),
+	retentionCount: number().int().min(1).max(1e3),
+	label: string().optional()
+}), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ pipelineKey: string() }), object({
-	released: boolean(),
-	refcount: number().int().nonnegative()
-}), {
+}), method(object({
+	cron: string(),
+	count: number().int().min(1).max(20).optional()
+}), object({
+	ok: boolean(),
+	error: string().optional(),
+	nextRuns: array(number()).readonly()
+})), method(_void(), array(BackupScheduleSchema).readonly(), { auth: "admin" }), method(_void(), object({
+	answered: boolean(),
+	databases: array(DataStoreDatabaseSchema).readonly()
+}), { auth: "admin" }), method(object({
+	id: string().optional(),
+	label: string(),
+	cron: string(),
+	enabled: boolean(),
+	locationIds: array(string()).readonly(),
+	retentionCount: number().int().min(1).max(1e3),
+	dataSources: array(string()).readonly().optional(),
+	databases: array(DataStoreDatabaseSchema).readonly().optional()
+}), BackupScheduleSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(SubscribeAudioChunksInputSchema, SubscribeAudioChunksResultSchema, { kind: "mutation" }), method(object({
-	subscriptionId: string(),
-	maxCount: number().int().positive().default(8)
-}), array(DecodedAudioChunkSchema).readonly()), method(object({ subscriptionId: string() }), object({ released: boolean() }), { kind: "mutation" }), method(object({
-	brokerId: string(),
-	seconds: number().min(0).max(30)
-}), _void(), {
+}), method(object({ id: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ brokerId: string() }), object({
-	configuredSec: number(),
-	bufferedMs: number(),
-	packetCount: number()
-})), method(_void(), number()), method(object({ hostname: string().optional() }), array(RtspRestreamEntrySchema).readonly()), method(object({
-	brokerId: string(),
-	hostname: string().optional()
-}), RtspRestreamEntrySchema.nullable()), method(object({ brokerId: string() }), string().nullable(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	brokerId: string(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ brokerId: string() }), boolean()), method(object({ deviceId: number().int() }), object({
-	muted: boolean(),
-	/**
-	* How many live non-derived brokers currently hold the mute. Purely
-	* diagnostic: `muted` is the policy and is authoritative on its own
-	* (it applies to brokers that do not exist yet), while this says
-	* whether anything is presently being silenced.
-	*/
-	appliedBrokers: number().int().nonnegative()
-})), method(object({
-	deviceId: number().int(),
-	muted: boolean()
-}), object({
-	muted: boolean(),
-	appliedBrokers: number().int().nonnegative()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), object({
-	deviceId: number().int().nonnegative(),
-	camStreamId: string(),
-	profile: CamProfileSchema
-}), object({
-	deviceId: number().int().nonnegative(),
-	camStreamId: string()
-}), object({
-	deviceId: number().int().nonnegative(),
-	camStreamId: string(),
-	brokerId: string()
 });
-var StreamCodecSchema = _enum([
-	"h264",
-	"h265",
-	"hevc",
-	"av1",
-	"mjpeg",
-	"vp8",
-	"vp9"
+/**
+* `broker` — unified pub/sub broker registry, system-scoped collection.
+*
+* The cap models any kind-tagged message broker the user wants to
+* register and that other addons might consume. The first two kinds
+* are MQTT (mosquitto / aedes embedded / cloud bridge) and
+* Home Assistant (HA WebSocket — subscribe_entities + call_service).
+* Future kinds (Zigbee2MQTT bridge, ZHA, KNX, Telegram, …) plug in
+* the same surface.
+*
+* Why one cap, not one cap per kind:
+*   - The integrations page wants a single table of "every broker"
+*     across kinds; a unified cap drives it without join logic.
+*   - Generic admin operations (add / remove / test / status) are
+*     identical across kinds — duplicating them per cap was busywork.
+*   - The `network-access` cap precedent: same interface, many
+*     `providerKind: 'ingress'` implementations (Tailscale, ngrok, …).
+*
+* What stays kind-specific:
+*   - `getBrokerConfig` payload (kind decides whether it returns
+*     mqtt URL+creds, HA baseUrl+token, …) — typed as
+*     `Record<string, unknown>` at the wire; consumers narrow.
+*   - `publish` / `subscribe` / `getState` arguments (target / filter /
+*     key) — also typed as `Record<string, unknown>` so each kind can
+*     evolve its surface (MQTT topic+qos vs HA entity_id+domain)
+*     without rebreaking the cap signature.
+*   - `add` `settings` payload (different fields per kind, validated by
+*     the kind-specific provider).
+*
+* Bidirectionality:
+*   - `publish` is RPC — synchronous result (provider-defined).
+*   - `subscribe` returns a subscription handle; the actual message
+*     stream flows over the typed event-bus as `broker.message` events
+*     keyed by `(brokerId, subscriptionId)`. Consumers filter in their
+*     event handler. Subscriptions persist across reconnects — the
+*     provider re-subscribes upstream after a transport drop.
+*
+* Why event-bus push (not a subscription RPC stream):
+*   - Matches the rest of CamStack's D8 contract — events for telemetry,
+*     RPC for loss-is-a-bug. Broker messages are telemetry (a single
+*     drop is recoverable via `getState({key})`).
+*   - Frees `broker.subscribe` from holding a long-lived RPC channel.
+*   - Cross-process: events already route through `$event-bus`; no
+*     per-broker wire-shaping needed.
+*/
+var BrokerStatusEnum = _enum([
+	"connected",
+	"disconnected",
+	"connecting",
+	"auth-failed",
+	"unreachable",
+	"error"
 ]);
-var PickStreamRequirementsSchema = object({
-	/**
-	* Codecs the consumer can decode without an intermediate transcode.
-	* Match is case-insensitive against the camera stream's `codec`.
-	* Default (omitted / empty array): no codec filter — useful when the
-	* consumer just wants "the highest-quality stream of any codec".
-	*/
-	acceptCodecs: array(StreamCodecSchema).readonly().optional(),
-	/** Minimum vertical resolution. Streams shorter than this are dropped. */
-	minHeight: number().int().positive().optional(),
-	/**
-	* Maximum vertical resolution. Streams TALLER than this are dropped.
-	*
-	* A consumer can have a ceiling as real as its floor: Alexa documents
-	* 480p to 1080p, and a 4K stream is as unusable to an Echo as a 360p one.
-	* Without this the ceiling had to be re-implemented by every caller — and
-	* one caller implementing it privately is how a second scoring authority
-	* gets born.
-	*/
-	maxHeight: number().int().positive().optional(),
-	/** Minimum horizontal resolution. */
-	minWidth: number().int().positive().optional(),
-	/**
-	* When true (default), `derived:*` streams (transcoded broker pipes)
-	* are excluded — the caller wants a SOURCE stream the broker can
-	* forward without a re-encode. Set false to allow derived in the
-	* picker (useful for a "best playable" fallback).
-	*/
-	excludeDerived: boolean().optional(),
-	/**
-	* Bypass gate. When set, the picker returns a hit ONLY IF the device
-	* also exposes a non-derived stream in one of these (rejected) codecs.
-	* Mirrors the Alexa "bypass only when the natural path WOULD have
-	* transcoded" guard: if the device is already serving the consumer's
-	* codec end-to-end, there's nothing to optimise.
-	*/
-	requireSiblingCodec: array(StreamCodecSchema).readonly().optional(),
-	/**
-	* Whether a stream the consumer CANNOT decode may still be picked, on the
-	* understanding that it will be transcoded.
-	*
-	* Default `false` — today's behaviour, and the right one for a bypass
-	* question ("is there a stream I can forward untouched?"). Set `true` to
-	* ask the larger question: "what is the best stream for me, transcoding if
-	* I must?" A stream that satisfies `acceptCodecs` always outranks one that
-	* does not, so a passthrough is never lost to a transcode; the answer says
-	* which it is in {@link PickedCamStreamSchema.transcodes}.
+var BrokerInfoSchema = object({
+	/** Stable broker id. Persisted; survives addon restarts. */
+	id: string(),
+	/** Addon id of the provider that OWNS this broker.
 	*
-	* This is what lets one picker serve both the bypass and the full source
-	* choice, instead of a consumer scoring privately when the bypass misses.
-	*/
-	allowTranscode: boolean().optional(),
+	*  The `broker` cap is a system-scoped collection: several addons
+	*  register a `broker` provider, each owning a DISJOINT set of
+	*  brokers (mqtt-broker owns `mqtt_*`, provider-homeassistant owns
+	*  `ha_*`). A broker therefore belongs to exactly one addon — like a
+	*  device belongs to one integration. The admin UI threads this id
+	*  back as the `{ addonId }` system-collection selector on every
+	*  id-keyed call (`get` / `getSettings` / `setSettings` / `remove` /
+	*  `testConnection`), so the call routes to the OWNING provider
+	*  instead of defaulting to the first-registered one. */
+	addonId: string(),
+	/** Human-readable name (operator-chosen at add-time). */
+	name: string(),
+	/** Provider-defined kind tag — `mqtt` / `home-assistant` / future. */
+	kind: string(),
+	status: BrokerStatusEnum,
+	/** Free-form provider-specific info (HA version, MQTT broker
+	*  flavour, latency, mTLS active, …). */
+	info: record(string(), unknown()),
+	/** Ms epoch of the last connection probe / status update. */
+	lastCheckedAt: number().nullable(),
+	/** Last error message, when `status` indicates failure. */
+	error: string().nullable()
+});
+var RegistryStatusSchema = object({
+	brokerCount: number().int().nonnegative(),
+	connectedCount: number().int().nonnegative()
+});
+/**
+* One entry per `broker` provider — which addon provides which broker
+* kind(s). The unified create picker reads this to know, for each
+* (addonId, kind) pair the operator can pick, where to route the
+* follow-up `getSettingsSchema` / `testSettings` / `add` calls (via the
+* `{ addonId }` selector). A provider only advertises a kind here when
+* it implements `getSettingsSchema` for that kind (so the picker never
+* offers a kind whose creation form can't be rendered).
+*/
+var BrokerProviderInfoSchema = object({
+	/** Addon id of the `broker` provider this entry describes. */
+	addonId: string(),
+	/** Broker kinds this provider can create, with a display label. */
+	kinds: array(object({
+		kind: string(),
+		label: string(),
+		/**
+		* Relative hub path to start an interactive account link (OAuth popup).
+		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
+		*/
+		interactiveConnectPath: string().min(1).optional(),
+		/** Relative hub path to disconnect the linked account (same popup pattern). */
+		interactiveDisconnectPath: string().min(1).optional()
+	}))
+});
+var ListInputSchema = object({ 
+/** Optional kind filter — `list({kind:'home-assistant'})` returns
+*  only HA brokers. Omit to list every broker. */
+kind: string().optional() });
+var GetInputSchema = object({ id: string() });
+var AddInputSchema = object({
+	kind: string().min(1),
+	name: string().min(1),
 	/**
-	* Consider ONLY streams the broker has bound to a profile slot.
+	* ADOPT an existing id instead of minting a new one.
 	*
-	* A consumer that dials the broker — which is every exporter, since none
-	* of them may open the camera's own URL — can do nothing with a source
-	* that has no slot: there is no restream to dial. Without this the picker
-	* can name such a stream, and each consumer discovers the dead end for
-	* itself: Alexa's `profileForCamStream` returns `null` and it quietly
-	* falls back, and HomeKit would have had to grow the same function again.
+	* Written the day this cost an outage. A broker's id is not a detail: HA
+	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
+	* lost from config and re-added as `ha_001` leaves every one of its devices
+	* bound to a broker that no longer exists. Re-entering the password under the
+	* ORIGINAL id turns a multi-step device migration back into re-entering a
+	* password.
 	*
-	* Default `false`, and deliberately so: the BROKER itself picks through
-	* here when it decides which source to BIND to a slot
-	* (`computeInitialAssignment`), and it must see the unbound ones or it
-	* could never bind them.
-	*/
-	requireProfileBound: boolean().optional()
-}).readonly();
-var PickStreamPreferencesSchema = object({
-	/**
-	* Ordered list of provider prefixes (e.g. `['native:', 'rtsp:']`) the
-	* picker prefers — earlier entries win ties. Defaults to
-	* `['native:']`, mirroring Alexa's "prefer the native dial path".
-	*/
-	preferredProviders: array(string()).readonly().optional(),
-	/**
-	* Resolution preference within the surviving candidates. `'highest'`
-	* picks the tallest stream; `'lowest'` picks the shortest (used by
-	* memory-constrained consumers / Apple Home guest sessions).
+	* A provider MUST refuse an id that is already in use — adopting a live
+	* broker's id would silently take it over.
 	*/
-	resolutionPreference: _enum(["highest", "lowest"]).optional(),
-	/**
-	* The height the consumer actually wants to DELIVER.
-	*
-	* Not a constraint — an ordering. With it set, the SMALLEST stream at or
-	* above the target wins, and only if nothing reaches it does the tallest
-	* take over. Pulling 1296 lines to draw 720 on a 1280x800 Echo panel costs
-	* a decode and buys nothing, and `resolutionPreference: 'highest'` cannot
-	* express that: it says "as big as possible", which is a different wish.
-	*
-	* Ignored when absent, so every existing caller keeps its ordering.
-	*/
-	targetHeight: number().int().positive().optional()
-}).readonly();
-var PickedCamStreamSchema = object({
-	camStreamId: string(),
-	codec: string().optional(),
-	resolution: CamStreamResolutionSchema.optional(),
-	/**
-	* Whether serving this stream requires a decode + re-encode.
-	*
-	* `false` is a stream the consumer can take as it stands. Only ever `true`
-	* when the caller asked for it with `allowTranscode`, so a caller that did
-	* not ask cannot be handed a cost it never agreed to pay.
-	*/
-	transcodes: boolean(),
-	/** One-line explanation of why this stream won — for logs / debug UI. */
-	reason: string(),
-	/**
-	* The broker profile slot this source is bound to, when it is bound.
-	*
-	* Answered HERE because every consumer needs it and none of them can get it
-	* from the `camStreamId` alone. Alexa wrote `profileForCamStream` for it —
-	* a second cap read plus a `null` branch — and HomeKit was about to write
-	* the same function a second time.
-	*
-	* Absent when the source has no slot, which a caller passing
-	* `requireProfileBound` can never see.
-	*/
-	profile: CamProfileSchema.optional(),
-	/** The broker id of that slot, for logs that must name what was dialled. */
-	brokerId: string().optional(),
-	/**
-	* The broker restream URL to dial for this stream.
-	*
-	* An exporter must never open the camera's own URL — the broker is the one
-	* that dials the camera, and every consumer goes through its restream. So
-	* the picker answers with the thing a consumer may actually use, instead of
-	* naming a source and leaving each caller to look the URL up.
-	*/
-	url: string().optional(),
-	/**
-	* Frames per second this stream really delivers, and where the number came
-	* from.
-	*
-	* It is here because getting it wrong is expensive and silent: a HomeKit
-	* accessory advertised 720p at 24 fps while the slot serving it ran at 9,
-	* and the controller rendered nothing at all. The source is carried with the
-	* value for the same reason the bitrate evidence is: `published` is what the
-	* publisher declares and `measured` is what the broker observed, and they
-	* are not interchangeable.
-	*/
-	fps: number().positive().optional(),
-	fpsSource: _enum(["published", "measured"]).optional()
+	id: string().min(1).optional(),
+	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
+	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
+	*  branch on receipt — invalid shape rejects the add. */
+	settings: record(string(), unknown())
 });
-DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), array(CameraStreamSchema).readonly()), method(object({ deviceId: number().int().nonnegative() }), array(ProfileSlotSchema).readonly()), method(object({
-	deviceId: number().int().nonnegative(),
-	/** Override hostname embedded in returned URLs. Defaults to the broker's bound address. */
-	hostname: string().optional()
-}), array(RtspRestreamEntrySchema).readonly()), method(object({
-	deviceId: number().int().nonnegative(),
-	/** Override hostname embedded in returned URLs. Defaults to the broker's bound address. */
-	hostname: string().optional()
-}), array(ProfileRtspEntrySchema).readonly()), method(object({
-	deviceId: number().int().nonnegative(),
-	requirements: PickStreamRequirementsSchema,
-	preferences: PickStreamPreferencesSchema.optional()
-}), PickedCamStreamSchema.nullable()), object({
-	deviceId: number().int().nonnegative(),
-	camStreams: array(CameraStreamSchema).readonly()
-}), object({
-	deviceId: number().int().nonnegative(),
-	profileSlots: array(ProfileSlotSchema).readonly()
+var AddResultSchema = object({ id: string() });
+var RemoveInputSchema = object({ id: string() });
+var TestConnectionResultSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	latencyMs: number().nonnegative()
 }), object({
-	online: boolean(),
-	slotStatuses: object({
-		high: ProfileSlotStatusSchema.optional(),
-		mid: ProfileSlotStatusSchema.optional(),
-		low: ProfileSlotStatusSchema.optional()
-	}),
-	slotErrors: object({
-		high: string().optional(),
-		mid: string().optional(),
-		low: string().optional()
-	}),
-	lastChangedAt: number()
+	ok: literal(false),
+	error: string()
+})]);
+var SettingsRecordSchema$1 = record(string(), unknown());
+var SettingsSchemaInputSchema = object({ kind: string() });
+var TestSettingsInputSchema = object({
+	kind: string(),
+	settings: SettingsRecordSchema$1
 });
-EventCategory.DoorbellOnPressed;
-var CompositionEventPlanSchema = object({
-	featureIndex: number().int().nonnegative(),
-	cap: string(),
-	eventName: string(),
-	category: _enum(EventCategory),
-	stateField: string(),
-	fieldKey: string()
+var TestSettingsResultSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	latencyMs: number().nonnegative().optional()
+}).strict(), object({
+	ok: literal(false),
+	error: string()
+})]);
+var SettingsSchemaResultSchema = unknown().nullable();
+var PublishInputSchema = object({
+	brokerId: string(),
+	/** Kind-specific routing target.
+	*  MQTT: `{ topic: string, qos?: 0|1|2, retain?: boolean }`.
+	*  HA:   `{ domain: string, service: string, entityId?: string, area?: string }`. */
+	target: record(string(), unknown()),
+	/** Kind-specific payload.
+	*  MQTT: raw string / number / object (provider serialises).
+	*  HA:   service-call `data` object (transition, brightness, …). */
+	payload: unknown().optional()
 });
-/** One refusal, named (D391). `path` points into the composition, e.g. `features[0].fields.celsius`. */
-var CompositionProblemSchema = object({
-	code: _enum([
-		"reserved-variant",
-		"unknown-capability",
-		"not-composable",
-		"wrong-device-type",
-		"has-commands",
-		"unknown-field",
-		"nested-field",
-		"missing-field",
-		"kind-mismatch",
-		"may-be-null",
-		"source-missing",
-		"source-unreadable",
-		"source-capability-missing",
-		"source-field-unknown",
-		"expression-invalid",
-		"cycle",
-		"duplicate-target",
-		"not-item-array",
-		"item-field-reserved",
-		"target-missing",
-		"target-unreadable",
-		"not-replaceable"
-	]),
-	path: string(),
-	message: string()
+var SubscribeInputSchema = object({
+	brokerId: string(),
+	/** Kind-specific filter.
+	*  MQTT: `{ topic: string, qos?: 0|1|2 }` — topic can include wildcards.
+	*  HA:   `{ entityIds: string[] }` or `{ domain: string }`. */
+	filter: record(string(), unknown())
 });
-var CompositionFieldKindSchema = _enum([
-	"string",
-	"number",
-	"boolean",
-	"enum"
+var SubscribeResultSchema = object({ 
+/** Stable subscription id. Used to unsubscribe and to filter the
+*  matching `broker.message` events on the bus. */
+subscriptionId: string() });
+var UnsubscribeInputSchema = object({
+	brokerId: string(),
+	subscriptionId: string()
+});
+var GetStateInputSchema = object({
+	brokerId: string(),
+	/** Kind-specific lookup key.
+	*  MQTT: topic string (returns the last retained message).
+	*  HA:   entity_id (returns the cached entity state). */
+	key: string()
+});
+method(ListInputSchema, array(BrokerInfoSchema)), method(GetInputSchema, BrokerInfoSchema.nullable()), method(_void(), array(BrokerProviderInfoSchema), { auth: "admin" }), method(AddInputSchema, AddResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(RemoveInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(GetInputSchema, TestConnectionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }), method(object({
+	id: string(),
+	settings: SettingsRecordSchema$1
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }), method(SettingsSchemaInputSchema, SettingsSchemaResultSchema, { auth: "admin" }), method(TestSettingsInputSchema, TestSettingsResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(PublishInputSchema, unknown(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(SubscribeInputSchema, SubscribeResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(UnsubscribeInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(GetStateInputSchema, unknown().nullable(), { auth: "admin" }), method(_void(), RegistryStatusSchema);
+DeviceType.Camera;
+/** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
+var StreamFormatSchema = _enum([
+	"webrtc",
+	"hls",
+	"mjpeg",
+	"rtsp"
 ]);
+/** A container `produceEventMedia` can emit. */
+var EventMediaKindSchema = _enum(["mp4", "gif"]);
 /**
-* How a field says "unavailable" (D393, D663): `null` when its schema allows it;
-* `unknown` — the enum's own word — for an ADDED field that has one; `release`
-* for a REPLACED field of an existing device, whose claim is released so the
-* native provider's reading shows again; else the (composed) device goes offline.
+* One produced artifact, referenced by HANDLE.
+*
+* Never inline bytes: a produced clip is 200 KB–5 MB and every consumer of this
+* method is in another runner ([D9](../../../../docs/decisions/adr-0009.md),
+* [D18](../../../../docs/decisions/adr-0018.md) — cross-process media is fetched
+* on demand, compressed, by handle). `bytes` is here so a caller can decide
+* whether it wants the fetch at all.
 */
-var CompositionUnavailableModeSchema = _enum([
-	"null",
-	"offline",
-	"unknown",
-	"release"
-]);
+var EventMediaArtifactSchema = object({
+	kind: EventMediaKindSchema,
+	/** Opaque, single-camera, short-lived. Redeem with `fetchEventMedia`. */
+	handle: string(),
+	/**
+	* The node holding the bytes — the ROUTING key for `fetchEventMedia`.
+	*
+	* `stream-broker` is a singleton cap and an unpinned call never leaves the
+	* hub, so a handle produced on an agent's broker would be redeemed against
+	* the hub's store and come back `null`. Same contract, same field name and
+	* the same reason as `FrameHandleSchema.nodeId`: the producer stamps where it
+	* lives and the consumer pins to it.
+	*/
+	nodeId: string(),
+	mime: string(),
+	bytes: number().int(),
+	width: number().int(),
+	height: number().int()
+});
 /**
-* `derived` reads a source · `clock` reads only `now`, recomputed when a sibling
-* field of its cap changes value · `constant` reads nothing, computed once ·
-* `accumulator` advances from the target's seed/current output.
+* What a production actually covered — the answer to the only question an
+* operator asks about a notification clip.
+*
+* `fromTs`/`toTs` are WALL CLOCK, derived from the ring's own packet timeline,
+* so a caller can state "this clip starts 4.1 s before the event" instead of
+* inferring it from a duration. A production whose `fromTs` is later than the
+* event is a production with no pre-roll, and that is exactly the defect this
+* method exists to make visible rather than plausible.
 */
-var CompositionFieldRoleSchema = _enum([
-	"derived",
-	"clock",
-	"constant",
-	"accumulator"
-]);
-/** The item a planned field belongs to; its `path` is then the dotted path INSIDE the item. */
-var CompositionFieldItemSchema = object({
-	arrayPath: string(),
-	key: string(),
-	label: string()
-});
-var CompositionFieldPlanSchema = object({
-	cap: string(),
-	/** Top-level field, or — when `item` is set — the dotted path inside that item. */
-	path: string(),
-	item: CompositionFieldItemSchema.optional(),
-	/** Index into `composition.features` this field's capability came from —
-	*  lets a source/cycle problem name its path as `features[N].fields.<path>`
-	*  (the same convention `planComposition`'s own problems already use). */
-	featureIndex: number().int().nonnegative(),
-	kind: CompositionFieldKindSchema,
-	nullable: boolean(),
-	required: boolean(),
-	unavailable: CompositionUnavailableModeSchema,
-	role: CompositionFieldRoleSchema,
-	source: CompositionFieldSourceSchema,
-	reads: array(CompositionFieldReadSchema)
+var EventMediaCoverageSchema = object({
+	fromTs: number(),
+	toTs: number(),
+	/** Encoded packets in the muxed window. */
+	packets: number().int()
 });
 /**
-* What a feature does to its target (D663): `new` builds a capability on a new
-* device; on an existing device it `add`s a capability the device lacks, or
-* `replace`s named fields of one it has natively.
+* The result of ONE cut, in every container the caller asked for.
+*
+* Every artifact in `media` came out of the SAME window of the SAME rendition —
+* that is the whole reason this is one method rather than one call per format.
+* A consumer attaching a gif and a video can no longer show two different
+* moments, because it never chose two sources.
 */
-var CompositionFeatureModeSchema = _enum([
-	"new",
-	"add",
-	"replace"
-]);
-var CompositionFeaturePlanSchema = object({
-	/** Index in the stored feature array; disabled features are omitted rather than re-indexed. */
-	featureIndex: number().int().nonnegative(),
-	cap: string(),
-	mode: CompositionFeatureModeSchema
+var EventMediaProductionSchema = object({
+	media: array(EventMediaArtifactSchema).readonly(),
+	coverage: EventMediaCoverageSchema,
+	/** The rendition actually cut from — what the default or the fallback chose. */
+	profile: CamProfileSchema,
+	/** `copy` = the camera's own H.264, untouched. `encode` = re-encoded (H.265
+	*  source, a downscale, or a playback rate other than 1). */
+	video: _enum(["copy", "encode"])
 });
-var CompositionValidationSchema = object({
-	ok: boolean(),
-	problems: array(CompositionProblemSchema),
-	fields: array(CompositionFieldPlanSchema),
-	features: array(CompositionFeaturePlanSchema),
-	events: array(CompositionEventPlanSchema)
+var RtspRestreamEntrySchema = object({
+	brokerId: string(),
+	url: string(),
+	mutedUrl: string(),
+	enabled: boolean(),
+	/**
+	* Source-stream codec / resolution for the camStream this entry serves
+	* (the broker's "high"/"mid"/"low" profile slot for this device).
+	* Used by exporter pickers (`pickPreferredRtspEntry`) to resolve
+	* `streamPreference: 'auto'` to the slot whose source is closest to
+	* the consumer's target — Alexa wants ~720p, HomeKit wants ~1080p,
+	* and there's no point dialling the 4K slot for an Echo Show. Absent
+	* when the source publisher never advertised the field; pickers fall
+	* back to first-enabled in that case.
+	*/
+	codec: string().optional(),
+	resolution: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}).optional()
 });
-/**
-* Mirrors `CoreBlockStatus`, pinned by `core-blocks-source.spec.ts`. `degraded`:
-* running, but a replaced field is released to the native provider while its
-* source is unavailable (ruling S1b, D663) — the reason names each such field.
-*/
-var CompositionRunStatusSchema = _enum([
-	"stopped",
-	"starting",
-	"running",
-	"degraded",
-	"failed"
-]);
-var CompositionFieldStateKindSchema = _enum([
-	"fresh",
-	"stale",
-	"unavailable"
-]);
-var CompositionFieldStateSchema = object({
-	cap: string(),
-	path: string(),
-	/** Same as the plan's: two items' `status` are told apart by it. */
-	item: CompositionFieldItemSchema.optional(),
-	state: CompositionFieldStateKindSchema,
-	/** `null` whenever `state === 'unavailable'`; never a plausible stand-in (D393). */
-	value: union([
-		string(),
-		number(),
-		boolean(),
-		_null()
-	]),
-	reason: string().optional()
+var BrokerRtspClientSchema = object({
+	sessionId: string(),
+	remoteAddr: string(),
+	/** Client `User-Agent` (e.g. `recorder` for the recorder's RTSP pull), or
+	*  null/absent when the client sent none. Lets the UI label a consumer by
+	*  purpose. Optional so a client built against an older schema stays valid. */
+	userAgent: string().nullish(),
+	playing: boolean(),
+	muted: boolean(),
+	connectedAt: number(),
+	lastRtpAt: number(),
+	bytesSent: number()
 });
-var CompositionBlockStateSchema = object({
-	blockId: string(),
-	deviceId: number().nullable(),
-	status: CompositionRunStatusSchema,
-	reason: string().optional(),
-	fields: array(CompositionFieldStateSchema)
+var BrokerAudioClientSchema = object({
+	tag: string(),
+	subscribedAt: number(),
+	chunksDelivered: number()
 });
-var ComposerBlockSchema = object({
-	id: string().min(1),
-	name: string().min(1).max(120),
-	enabled: boolean(),
-	updatedAt: number(),
-	composition: CompositionSchema
+var BrokerConsumerAttributionSchema = object({
+	kind: _enum([
+		"alexa",
+		"homekit",
+		"webrtc-browser",
+		"webrtc-mobile",
+		"webrtc-whep",
+		"rtsp-listen",
+		"derived-broker",
+		"recording",
+		"pipeline",
+		"snapshot",
+		"warmup",
+		"unknown"
+	]),
+	/**
+	* Free-form label intended to disambiguate consumers OF THE SAME kind
+	* on the same broker — e.g. user name, device alias. Should NOT repeat
+	* the kind / cam / cam-stream / sessionId (those are surfaced by
+	* dedicated fields). When empty the widget falls back to `${kind} ·
+	* <sessionId tail>`.
+	*/
+	label: string().optional(),
+	/**
+	* Which part of the encoded plane this subscription consumes:
+	*   - `'audio'` — audio packets only
+	*   - `'video'` — video packets only
+	*   - `'both'`  — both video + audio (typical for AnnexB push paths
+	*                 that don't split the source RTP)
+	*
+	* Missing field means "unknown" — older callers and the legacy
+	* paths that haven't been migrated yet.
+	*/
+	media: _enum([
+		"audio",
+		"video",
+		"both"
+	]).optional(),
+	/**
+	* Codec the consumer receives AFTER any per-session re-encoding. For
+	* a WebRTC session this is the negotiated egress codec (e.g. `H264`,
+	* `H265`, `Opus`, `Pcmu`); for an RTSP restreamer it mirrors the
+	* source codec. Surfaced in the widget chip so operators see at a
+	* glance whether a viewer is on H.264 (Echo) or H.265 (Safari).
+	*/
+	targetCodec: string().optional(),
+	/**
+	* Whether the broker is re-encoding for this consumer:
+	*   - `'passthrough'` — bytes flow source→consumer without ffmpeg
+	*   - `'repacketize'` — RTP payload is re-packetized but NOT re-encoded
+	*                       (preserves frames, just rebuilds headers; e.g.
+	*                       the H.265 repacketizer path)
+	*   - `'transcode'`   — a full encode/decode round (ffmpeg, libx264,
+	*                       libav…); the most expensive path
+	*/
+	transport: _enum([
+		"passthrough",
+		"repacketize",
+		"transcode"
+	]).optional(),
+	/** Remote peer IP if the consumer terminates a network socket. */
+	remoteAddr: string().optional(),
+	/**
+	* Server-read User-Agent of the originating client; enriched by the hub
+	* from the tRPC request context (browser sessions).
+	*/
+	userAgent: string().optional(),
+	/** Authenticated user id (CamStack OAuth subject) when known. */
+	userId: string().optional(),
+	/** Higher-level session identifier (Alexa Echo sessionId, HAP session, …). */
+	sessionId: string().optional(),
+	/** Free-form key/value extras (e.g. clientHints from a WebRTC offer). */
+	extra: record(string(), string()).optional()
+}).readonly();
+var BrokerEncodedClientSchema = object({
+	/** Stable id assigned on attach; used by `killClient`. */
+	id: string(),
+	/** Which broker fanout the subscriber rides — annexB encoded packets vs raw RTP. */
+	channel: _enum(["annexb", "rtp"]),
+	attribution: BrokerConsumerAttributionSchema,
+	subscribedAt: number(),
+	/** Total packets delivered (annex-B EncodedPackets or RTP byte-buffers). */
+	packetsDelivered: number()
+});
+var BrokerClientsSchema = object({
+	rtsp: array(BrokerRtspClientSchema).readonly(),
+	audio: array(BrokerAudioClientSchema).readonly(),
+	encoded: array(BrokerEncodedClientSchema).readonly(),
+	pipeClients: number(),
+	/** Total encoded + raw-RTP callback subscriber count (sum of `encoded[].length`). */
+	encodedSubscribers: number()
 });
 /**
-* A stored composition row that no longer PARSES — a schema a release
-* tightened, a row written by a newer build. Sent by id so the composer keeps
-* its device as a placeholder and reports the block `failed` naming the parse
-* error. Leaving it out would read, twice, exactly like a delete (D49).
+* How many people are watching one camera LIVE right now — see
+* `getLiveViewerCounts`. A camera with nobody watching is absent from the list
+* (so `viewers` is always at least 1): the listing carries the cameras that
+* have viewers, never a row of zeros.
 */
-var ComposerUnreadableBlockSchema = object({
-	id: string().min(1),
-	/** The row's stored name column; null when even that is unreadable (the device keeps the name it has). */
-	name: string().nullable(),
-	/** The parse error, in the operator's words. */
-	error: string()
+var LiveViewerCountSchema = object({
+	deviceId: number().int().nonnegative(),
+	viewers: number().int().positive()
+});
+_enum([
+	"reconnecting",
+	"sleeping",
+	"offline",
+	"disabled",
+	"waking"
+]);
+var VideoCodecTargetSchema = _enum([
+	"h264",
+	"h265",
+	"copy"
+]);
+var AudioCodecTargetSchema = _enum([
+	"aac",
+	"opus",
+	"pcmu",
+	"copy",
+	"none"
+]);
+var GetStreamWithCodecInputSchema = object({
+	deviceId: number().int().nonnegative(),
+	/** Target codec. `'copy'` = passthrough (no re-encode). */
+	video: VideoCodecTargetSchema,
+	/** Target audio codec. `'copy'` = passthrough. Defaults to `'aac'`. */
+	audio: AudioCodecTargetSchema.optional(),
+	/** Target a profile's assigned source camStream. Required to resolve a source. */
+	profile: CamProfileSchema.optional(),
+	/** Optional output resolution target. When set: drives the transcode
+	*  output scale (downscale toward WxH), and — when `profile` is absent —
+	*  selects the published source closest to this resolution. Ignored for
+	*  `video:'copy'` scaling (a copy can't be rescaled), but still used for
+	*  source selection. */
+	targetResolution: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}).optional(),
+	/** Extra ffmpeg output flags appended verbatim by the consumer (in code).
+	*  Folded into the pipeline key so different args never share a child. */
+	outputArgs: array(string()).optional(),
+	/** Opt-in: carry transcoded audio over an RTP sidecar grafted into the
+	*  restreamer SDP (only for re-encoded audio targets — aac/opus/pcmu).
+	*  Default/absent = the live-verified video-only egress. */
+	audioEgress: boolean().optional(),
+	/** Host to embed in the returned restream `url`. The broker is hub-only, so
+	*  its restream URLs default to `127.0.0.1` (consumable only from the hub).
+	*  A REMOTE consumer (e.g. a recorder running on an agent designated as the
+	*  recording node) passes the hub's cluster-resolvable host here so the
+	*  returned `rtsp://<host>:<port>/<token>` is dialable from that node. The
+	*  port/token (and the underlying restreamer, bound on 0.0.0.0) are
+	*  unchanged — `hostname` only rewrites the client-facing dial address.
+	*  Absent/empty = `127.0.0.1` (the hub-local default). */
+	hostname: string().optional(),
+	tag: string().optional()
+});
+var RtpSourceSchema = object({
+	url: string(),
+	/**
+	* The SENTRY counterpart of {@link url} — the dial that asks for the stream
+	* WITHOUT asking for the camera — or `null` when this camera offers none.
+	*
+	* The broker answers it because the broker is the only thing that can:
+	* eligibility is `sentryEligible` (a BATTERY camera that DECLARES the signals
+	* cap), asked of facts only the broker holds. A consumer re-deriving it from
+	* cap bindings would be a second authority, and two authorities on the same
+	* question is how a composite camera ends up dialling a sleeping camera
+	* because its own copy of the rule was a release behind.
+	*
+	* `null` is a real answer and is never a live url in disguise: a consumer
+	* that silently fell back to {@link url} would perform exactly the wake this
+	* field exists to prevent. Only a PASSTHROUGH acquisition can offer one — a
+	* transcode hands back an egress the broker is feeding itself, which has no
+	* sentry counterpart.
+	*/
+	sentryUrl: string().nullable().optional(),
+	videoCodec: _enum(["H264", "H265"]),
+	audioCodec: string(),
+	resolution: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	transcoded: boolean(),
+	encoder: string(),
+	pipelineKey: string()
+});
+/**
+* The encode request — **structured and serialisable, with NO raw-flag escape
+* hatch.** This is deliberate and it is the one lesson taken from
+* `getStreamWithCodec`: that method's `outputArgs: string[]` is simultaneously
+* its extensibility mechanism AND part of `pipelineKeyFor`'s sharing key, so
+* adding a flag silently forks the shared child, and two consumers that mean
+* the same thing but spell it differently never share. Here every knob is a
+* NAMED field: a new requirement becomes a schema field (and a codegen run),
+* never an opaque array.
+*
+* `inputArgs` / `outputArgs` are omitted from the profile for the same reason.
+* The operator-facing derived-stream transform editor still has them — that is
+* a different surface (`publishCameraStream({ kind: 'derived' })`) with a
+* different purpose (reshaping a badly-behaved SOURCE), and it is unchanged.
+*/
+var EgressEncodeSchema = EncodeProfileSchema.omit({
+	inputArgs: true,
+	outputArgs: true
+});
+/**
+* How the encoder is bounded. `'tight'` is a one-second VBV window for a
+* consumer whose budget is enforced per second (HomeKit); `'relaxed'` is two
+* seconds, letting a keyframe spike borrow from the next second (a browser,
+* an Echo). Named rather than numeric so the INTENT survives.
+*/
+var EgressRateControlSchema = _enum(["tight", "relaxed"]);
+var EgressTranscodeRequestSchema = object({
+	deviceId: number().int().nonnegative(),
+	/** Which published stream to read. */
+	source: discriminatedUnion("kind", [object({
+		kind: literal("profile"),
+		profile: CamProfileSchema
+	}), object({
+		kind: literal("cam-stream"),
+		camStreamId: string().min(1)
+	})]),
+	encode: EgressEncodeSchema,
+	rateControl: EgressRateControlSchema.optional(),
+	/**
+	* `-bsf:v`. A consumer that negotiates its OWN SDP (HomeKit) cannot carry
+	* out-of-band extradata and needs `dump_extra` on both the copy and encode
+	* branches. Enumerated, not free text.
+	*/
+	bitstreamFilter: _enum([
+		"dump_extra",
+		"h264_mp4toannexb",
+		"hevc_mp4toannexb"
+	]).optional(),
+	/**
+	* Publish the transcode as a LOCAL push cam stream, instead of leaving the
+	* consumer to dial the returned url. The broker picks the id and returns it
+	* as `camStreamId` — a caller-supplied one would be circular, since the
+	* sharing key is computed FROM this request.
+	*
+	* The url is still returned and still the contract for a transcode pinned to
+	* another node. But dialling it locally costs an RTSP round trip that changes
+	* the transport underneath the consumer: a dialled stream is an RTP source,
+	* so `isRtpSource()` is true and the session takes the RTP-passthrough +
+	* repacketizer branch. The push branch — the one the derived mechanism has
+	* live hours on — is never reached. Measured on Alexa: broker registered, RTP
+	* arriving, key frame arriving, black screen, on a chain healthy at every
+	* other point.
+	*
+	* Same idea the transport already applies to CALLS, where `classifyCapRoute`
+	* gives priority to `hub-in-process` so a local call never leaves the node.
+	* This is that rule for media.
+	*/
+	publishLocally: boolean().optional(),
+	pixelFormat: _enum(["yuv420p", "nv12"]).optional(),
+	/**
+	* Operator/consumer override for decode hardware. ABSENT is the normal case
+	* and the one that matters: the broker then resolves the backend from the
+	* DECODER ADDON's per-node `probedBestHwaccel` (see
+	* `@camstack/types` `ffmpeg/hwaccel.ts`), which is the ranking known to work
+	* on this hardware — never the raw kernel resolver's qsv-first order.
+	*/
+	decodeHwAccel: _enum([
+		"auto",
+		"none",
+		"videotoolbox",
+		"vaapi",
+		"qsv",
+		"cuda"
+	]).optional(),
+	/**
+	* Host to embed in the returned restream `url`. The broker mints hub-local
+	* `127.0.0.1` URLs; a consumer on another node passes a cluster-resolvable
+	* host (`NodeTopologyService.reachableHostByNode`) so the returned URL is
+	* dialable from there. Same contract as `getStreamWithCodec.hostname` —
+	* `substituteRtspHost` rewrites only the dial address, never the restreamer.
+	*/
+	hostname: string().optional(),
+	/** Attribution for the broker panel. Never part of the sharing key. */
+	tag: string().optional()
+});
+var EgressTranscodeSchema = object({
+	/** Dial-able RTSP url (host-substituted when `hostname` was supplied). */
+	url: string(),
+	/** Release handle. Refcounted — the child dies when the last holder releases. */
+	pipelineKey: string(),
+	videoCodec: _enum(["H264", "H265"]),
+	resolution: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	transcoded: boolean(),
+	encoder: string(),
+	/**
+	* The decode backend the child ACTUALLY ran with — `null` for software.
+	* Returned rather than assumed: a consumer that asked for hardware and got
+	* software needs to be able to see that without reading the broker's logs.
+	*/
+	decodeHwAccel: string().nullable(),
+	/**
+	* Set when `publishLocally` was honoured: attach to THIS instead of dialling
+	* `url`, and the session takes the push/deframe transport rather than the
+	* RTP-passthrough one. `null` means the consumer must dial.
+	*/
+	camStreamId: string().nullable()
 });
 method(object({
-	/** The shared Blocks integration; null until `core-blocks` has reconciled it. */
-	integrationId: string().nullable(),
-	/** False when the `core_blocks` read failed: then nothing may be withdrawn (D49). */
-	storeLoaded: boolean(),
-	blocks: array(ComposerBlockSchema),
-	/** Operator restarts: rebuild these runtimes and re-resolve their sources. Stores nothing (D62). */
-	restartBlockIds: array(string()),
-	/** Composition rows that exist but do not parse: held, never withdrawn, reported failed. */
-	unreadableBlocks: array(ComposerUnreadableBlockSchema)
+	deviceId: number().int().nonnegative(),
+	/** The provider's signal code. */
+	code: string().min(1),
+	/** Ms epoch. Absent ⇒ now. */
+	at: number().optional()
 }), object({
-	blocks: array(object({
-		blockId: string(),
-		status: CompositionRunStatusSchema,
-		reason: string().optional()
-	})),
+	/** Whether the broker acted on it, and if not, why. */
+	accepted: boolean(),
+	reason: _enum([
+		"woke",
+		"hold-extended",
+		"not-enabled",
+		"no-consumer",
+		"unknown-code"
+	])
+}), { kind: "mutation" }), method(object({
+	deviceId: number().int().nonnegative(),
+	camStreamId: string().min(1),
+	kind: CamStreamKindSchema,
+	url: string().optional(),
+	codec: string().optional(),
+	resolution: CamStreamResolutionSchema.optional(),
+	fps: number().positive().optional(),
+	label: string().optional(),
+	deviceFeatures: array(string()).optional(),
+	autoEligible: boolean().optional(),
+	/** The slot the publisher says this stream IS — see `CameraStreamSchema.profileHint`. */
+	profileHint: CamProfileSchema.optional(),
+	metadata: record(string(), unknown()).optional(),
+	/** Required when kind === 'derived' — the source camStreamId the
+	*  derived broker reads its encoded plane from.
+	*  The runtime guard (broker manager, Task 10) enforces presence for
+	*  kind === 'derived'; the schema stays permissive so ts-morph emits
+	*  full field types instead of collapsing to ZodEffects. */
+	sourceCamStreamId: string().min(1).optional(),
+	/** Required when kind === 'derived' — the ffmpeg params for the
+	*  spawn. Reuses the same brokerId for identical params (single-flight).
+	*  Runtime guard in broker manager; schema is permissive (see above). */
+	encodeProfile: EncodeProfileSchema.optional()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	camStreamId: string().min(1)
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	profile: CamProfileSchema,
+	camStreamId: string().min(1)
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	profile: CamProfileSchema
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), object({
+	derivedStreamsDeleted: array(string()).readonly(),
+	assignmentsPurged: boolean(),
+	probeSnapshotsDropped: number().int().nonnegative(),
+	rtspTokenRowsDeleted: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	/** Absent = the LOWEST assigned profile — a notification attachment is
+	*  watched on a phone, and the cheap rendition is the right default. */
+	profile: CamProfileSchema.optional(),
+	aroundMs: number(),
+	preRollSec: number().min(0).max(20).default(3),
+	postRollSec: number().min(0).max(20).default(5),
+	format: _enum(["gif", "mp4"]).default("gif"),
+	maxWidth: number().int().min(120).max(1920).default(480),
+	/** GIF only — MP4 keeps the source cadence. */
+	fps: number().int().min(1).max(15).default(5),
+	/**
+	* Playback rate. A notification clip is GLANCED at on a lock screen,
+	* not watched, so 2x is the default: the recipient sees the whole
+	* passage in half the time and the GIF is half the bytes. `1` is real
+	* time. Applies to MP4 as well — the operator set a speed, not a GIF
+	* speed.
+	*/
+	speed: number().min(1).max(8).default(2)
+}), object({
+	base64: string(),
+	mime: string(),
+	bytes: number().int(),
+	/** The profile actually rendered (what the default resolved to). */
+	profile: CamProfileSchema,
+	durationMs: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	/** Absent = the largest H.264 rendition at or below 1080p, which is
+	*  also the one that can be copied. Falls back to whatever the ring
+	*  actually retained, and the answer says which. */
+	profile: CamProfileSchema.optional(),
+	aroundMs: number(),
+	preSeconds: number().min(0).max(20).default(4),
+	postSeconds: number().min(0).max(20).default(6),
+	kinds: array(EventMediaKindSchema).min(1).default(["mp4"]),
+	/** GIF geometry. The video keeps the source's own. */
+	gifMaxWidth: number().int().min(120).max(1280).default(640),
+	/**
+	* The gif's own PLAYBACK rate in frames per second — what the finished
+	* gif runs at, not how many source frames feed it. The decimation that
+	* feeds it samples `gifFps / gifSpeed` source frames per second, so at
+	* the defaults a 12 fps gif is built out of 3 source frames a second.
+	*/
+	gifFps: number().int().min(1).max(15).default(12),
+	/**
+	* How fast the GIF plays against real time, independent of `speed`.
+	*
+	* 4× by default, by operator request: a notification gif is glanced at
+	* on a lock screen, so a ~12 s window has to be over in ~3 s. It stays
+	* a separate knob from `speed` even though both now default to 4 —
+	* a caller wanting a real-time video and a fast gif must not have to
+	* choose.
+	*/
+	gifSpeed: number().min(1).max(8).default(4),
+	/**
+	* Playback rate of the VIDEO. Also 4× by default, by operator decision.
+	*
+	* `1` is real time and is the ONLY value that allows the copy branch —
+	* anything else forces `libx264` over the window. That was priced
+	* before it was chosen: a per-event burst measured at 0.23 s and 254 KB
+	* on a real 615 720p cut, against 922 KB for the copy it replaces. A
+	* re-encode is capped at 720p (`EVENT_CLIP_ENCODE_MAX_WIDTH`), because
+	* once the decode is forced the width stops being free.
+	*/
+	speed: number().min(1).max(8).default(4)
+}), EventMediaProductionSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ handle: string() }), object({
+	base64: string(),
+	mime: string(),
+	bytes: number().int()
+}).nullable(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), array(CameraStreamSchema).readonly()), method(_void(), array(ProfileSlotSchema).readonly()), method(object({ brokerId: string() }), BrokerStatsSchema), method(object({ brokerId: string() }), object({
+	probed: boolean(),
+	summary: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ brokerId: string() }), BrokerClientsSchema), method(_void(), array(LiveViewerCountSchema).readonly()), method(object({
+	brokerId: string(),
+	channel: _enum(["rtsp", "audio"]),
+	handle: string()
+}), object({ killed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	profile: CamProfileSchema
+}), object({ success: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	streamId: string(),
+	format: StreamFormatSchema
+}), object({ url: string() })), method(GetStreamWithCodecInputSchema, RtpSourceSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ pipelineKey: string() }), object({
+	released: boolean(),
+	refcount: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(EgressTranscodeRequestSchema, EgressTranscodeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ pipelineKey: string() }), object({
+	released: boolean(),
+	refcount: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(SubscribeAudioChunksInputSchema, SubscribeAudioChunksResultSchema, { kind: "mutation" }), method(object({
+	subscriptionId: string(),
+	maxCount: number().int().positive().default(8)
+}), array(DecodedAudioChunkSchema).readonly()), method(object({ subscriptionId: string() }), object({ released: boolean() }), { kind: "mutation" }), method(object({
+	brokerId: string(),
+	seconds: number().min(0).max(30)
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ brokerId: string() }), object({
+	configuredSec: number(),
+	bufferedMs: number(),
+	packetCount: number()
+})), method(_void(), number()), method(object({ hostname: string().optional() }), array(RtspRestreamEntrySchema).readonly()), method(object({
+	brokerId: string(),
+	hostname: string().optional()
+}), RtspRestreamEntrySchema.nullable()), method(object({ brokerId: string() }), string().nullable(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	brokerId: string(),
+	enabled: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ brokerId: string() }), boolean()), method(object({ deviceId: number().int() }), object({
+	muted: boolean(),
+	/**
+	* How many live non-derived brokers currently hold the mute. Purely
+	* diagnostic: `muted` is the policy and is authoritative on its own
+	* (it applies to brokers that do not exist yet), while this says
+	* whether anything is presently being silenced.
+	*/
+	appliedBrokers: number().int().nonnegative()
+})), method(object({
+	deviceId: number().int(),
+	muted: boolean()
+}), object({
+	muted: boolean(),
+	appliedBrokers: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), object({
+	deviceId: number().int().nonnegative(),
+	camStreamId: string(),
+	profile: CamProfileSchema
+}), object({
+	deviceId: number().int().nonnegative(),
+	camStreamId: string()
+}), object({
+	deviceId: number().int().nonnegative(),
+	camStreamId: string(),
+	brokerId: string()
+});
+var StreamCodecSchema = _enum([
+	"h264",
+	"h265",
+	"hevc",
+	"av1",
+	"mjpeg",
+	"vp8",
+	"vp9"
+]);
+var PickStreamRequirementsSchema = object({
+	/**
+	* Codecs the consumer can decode without an intermediate transcode.
+	* Match is case-insensitive against the camera stream's `codec`.
+	* Default (omitted / empty array): no codec filter — useful when the
+	* consumer just wants "the highest-quality stream of any codec".
+	*/
+	acceptCodecs: array(StreamCodecSchema).readonly().optional(),
+	/** Minimum vertical resolution. Streams shorter than this are dropped. */
+	minHeight: number().int().positive().optional(),
+	/**
+	* Maximum vertical resolution. Streams TALLER than this are dropped.
+	*
+	* A consumer can have a ceiling as real as its floor: Alexa documents
+	* 480p to 1080p, and a 4K stream is as unusable to an Echo as a 360p one.
+	* Without this the ceiling had to be re-implemented by every caller — and
+	* one caller implementing it privately is how a second scoring authority
+	* gets born.
+	*/
+	maxHeight: number().int().positive().optional(),
+	/** Minimum horizontal resolution. */
+	minWidth: number().int().positive().optional(),
+	/**
+	* When true (default), `derived:*` streams (transcoded broker pipes)
+	* are excluded — the caller wants a SOURCE stream the broker can
+	* forward without a re-encode. Set false to allow derived in the
+	* picker (useful for a "best playable" fallback).
+	*/
+	excludeDerived: boolean().optional(),
+	/**
+	* Bypass gate. When set, the picker returns a hit ONLY IF the device
+	* also exposes a non-derived stream in one of these (rejected) codecs.
+	* Mirrors the Alexa "bypass only when the natural path WOULD have
+	* transcoded" guard: if the device is already serving the consumer's
+	* codec end-to-end, there's nothing to optimise.
+	*/
+	requireSiblingCodec: array(StreamCodecSchema).readonly().optional(),
+	/**
+	* Whether a stream the consumer CANNOT decode may still be picked, on the
+	* understanding that it will be transcoded.
+	*
+	* Default `false` — today's behaviour, and the right one for a bypass
+	* question ("is there a stream I can forward untouched?"). Set `true` to
+	* ask the larger question: "what is the best stream for me, transcoding if
+	* I must?" A stream that satisfies `acceptCodecs` always outranks one that
+	* does not, so a passthrough is never lost to a transcode; the answer says
+	* which it is in {@link PickedCamStreamSchema.transcodes}.
+	*
+	* This is what lets one picker serve both the bypass and the full source
+	* choice, instead of a consumer scoring privately when the bypass misses.
+	*/
+	allowTranscode: boolean().optional(),
+	/**
+	* Consider ONLY streams the broker has bound to a profile slot.
+	*
+	* A consumer that dials the broker — which is every exporter, since none
+	* of them may open the camera's own URL — can do nothing with a source
+	* that has no slot: there is no restream to dial. Without this the picker
+	* can name such a stream, and each consumer discovers the dead end for
+	* itself: Alexa's `profileForCamStream` returns `null` and it quietly
+	* falls back, and HomeKit would have had to grow the same function again.
+	*
+	* Default `false`, and deliberately so: the BROKER itself picks through
+	* here when it decides which source to BIND to a slot
+	* (`computeInitialAssignment`), and it must see the unbound ones or it
+	* could never bind them.
+	*/
+	requireProfileBound: boolean().optional()
+}).readonly();
+var PickStreamPreferencesSchema = object({
 	/**
-	* False when the composer declared and withdrew NOTHING (store not loaded,
-	* integration unknown, its own rows unread or read empty once). An empty
-	* apply the caller owes is paid off only by one the composer acted on (D49).
+	* Ordered list of provider prefixes (e.g. `['native:', 'rtsp:']`) the
+	* picker prefers — earlier entries win ties. Defaults to
+	* `['native:']`, mirroring Alexa's "prefer the native dial path".
 	*/
-	acted: boolean()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
-var NUMBER = {
-	kind: "fixed",
-	result: ["number"]
-};
-var BOOLEAN = {
-	kind: "fixed",
-	result: ["boolean"]
-};
-Object.freeze({
-	min: NUMBER,
-	max: NUMBER,
-	abs: NUMBER,
-	floor: NUMBER,
-	ceil: NUMBER,
-	sqrt: NUMBER,
-	round: NUMBER,
-	pow: NUMBER,
-	clamp: NUMBER,
-	avg: NUMBER,
-	sum: NUMBER,
-	age: NUMBER,
-	convert: NUMBER,
-	coalesce: { kind: "coalesce" },
-	any: BOOLEAN,
-	all: BOOLEAN,
-	within: BOOLEAN,
-	latest: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	number: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	rose: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	count: NUMBER
-});
-`${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
-/**
-* What a composition may BUILD on a device type (G2, D676): the caps a new
-* device of that type, or an existing one that lacks them, can be given. The
-* blockers are the validator's own refusal codes, and a spec compares this
-* listing with `planComposition` for every capability — the editor can never
-* offer a feature the save would refuse for the same reason.
-*/
-var ComposableFieldSchema = object({
-	path: string(),
-	kind: CompositionFieldKindSchema,
-	nullable: boolean(),
-	required: boolean(),
-	enumValues: array(string()).optional()
-});
-var ComposableCapabilitiesSchema = object({ caps: array(object({
-	cap: string(),
-	fields: array(ComposableFieldSchema),
-	/** Present for an item-array cap (`consumables.items`). */
-	itemArray: object({
-		path: string(),
-		keyField: string()
-	}).optional()
-})) });
-/** Where a block runs. The operator chooses — a block driving a device on an
-*  agent is the reason placement is not fixed to the hub. */
-var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
-/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
-*  a failing block reads the same way a failing addon does. `degraded` is a
-*  composition on an existing device with a field handed back to the native
-*  provider while its source is unavailable (S1b, D663); the error names it. */
-var CoreBlockStatusSchema = _enum([
-	"stopped",
-	"starting",
-	"running",
-	"degraded",
-	"failed"
-]);
-/** path → TypeScript source for a multi-file block. */
-var CoreBlockFilesSchema = record(string().min(1).max(260), string().max(2e5));
-/**
-* A block's settings form — the same ConfigUISchema addons declare.
-* Loose on the wire (field variants are polymorphic); typed for callers.
-*/
-var CoreBlockSettingsSchemaBridge = custom();
-/**
-* Client-authored fields (plain object). Kept separate from the refined create
-* schema because Zod 4 refuses `.partial()` on schemas that carry refinements —
-* `update` needs a partial of these fields.
-*/
-var CoreBlockInputFieldsSchema = object({
-	name: string().min(1).max(120),
+	preferredProviders: array(string()).readonly().optional(),
 	/**
-	* Single-file TypeScript source. Kept for backward compatibility: when
-	* `files` is absent, this IS `files[entry]`. On write, if `files` is
-	* provided, the server derives `code` from `files[entry]` so compile and
-	* runtime paths that still read `code` keep working.
+	* Resolution preference within the surviving candidates. `'highest'`
+	* picks the tallest stream; `'lowest'` picks the shortest (used by
+	* memory-constrained consumers / Apple Home guest sessions).
 	*/
-	code: string().max(2e5).optional(),
-	/** Multi-file project (path → source). Absent = legacy single-file `code`. */
-	files: CoreBlockFilesSchema.optional(),
-	/** Entry file inside `files`. Default {@link DEFAULT_CORE_BLOCK_ENTRY}. */
-	entry: string().min(1).max(260).optional(),
-	enabled: boolean(),
-	placement: CoreBlockPlacementSchema,
+	resolutionPreference: _enum(["highest", "lowest"]).optional(),
 	/**
-	* Integration the block's devices hang from. Absent = the system integration
-	* blocks share. A block may declare its own instead.
+	* The height the consumer actually wants to DELIVER.
+	*
+	* Not a constraint — an ordering. With it set, the SMALLEST stream at or
+	* above the target wins, and only if nothing reaches it does the tallest
+	* take over. Pulling 1296 lines to draw 720 on a 1280x800 Echo panel costs
+	* a decode and buys nothing, and `resolutionPreference: 'highest'` cannot
+	* express that: it says "as big as possible", which is a different wish.
+	*
+	* Ignored when absent, so every existing caller keeps its ordering.
 	*/
-	integrationId: string().optional(),
+	targetHeight: number().int().positive().optional()
+}).readonly();
+var PickedCamStreamSchema = object({
+	camStreamId: string(),
+	codec: string().optional(),
+	resolution: CamStreamResolutionSchema.optional(),
 	/**
-	* Cached settings form for this block. Prefer extracting `settingsSchema`
-	* from the compiled entry after a successful load; the editor may also set
-	* it. Absent ⇒ `getBlockSettings` returns null until one is known.
+	* Whether serving this stream requires a decode + re-encode.
+	*
+	* `false` is a stream the consumer can take as it stands. Only ever `true`
+	* when the caller asked for it with `allowTranscode`, so a caller that did
+	* not ask cannot be handed a cost it never agreed to pay.
 	*/
-	settingsSchema: CoreBlockSettingsSchemaBridge.optional()
+	transcodes: boolean(),
+	/** One-line explanation of why this stream won — for logs / debug UI. */
+	reason: string(),
+	/**
+	* The broker profile slot this source is bound to, when it is bound.
+	*
+	* Answered HERE because every consumer needs it and none of them can get it
+	* from the `camStreamId` alone. Alexa wrote `profileForCamStream` for it —
+	* a second cap read plus a `null` branch — and HomeKit was about to write
+	* the same function a second time.
+	*
+	* Absent when the source has no slot, which a caller passing
+	* `requireProfileBound` can never see.
+	*/
+	profile: CamProfileSchema.optional(),
+	/** The broker id of that slot, for logs that must name what was dialled. */
+	brokerId: string().optional(),
+	/**
+	* The broker restream URL to dial for this stream.
+	*
+	* An exporter must never open the camera's own URL — the broker is the one
+	* that dials the camera, and every consumer goes through its restream. So
+	* the picker answers with the thing a consumer may actually use, instead of
+	* naming a source and leaving each caller to look the URL up.
+	*/
+	url: string().optional(),
+	/**
+	* Frames per second this stream really delivers, and where the number came
+	* from.
+	*
+	* It is here because getting it wrong is expensive and silent: a HomeKit
+	* accessory advertised 720p at 24 fps while the slot serving it ran at 9,
+	* and the controller rendered nothing at all. The source is carried with the
+	* value for the same reason the bitrate evidence is: `published` is what the
+	* publisher declares and `measured` is what the broker observed, and they
+	* are not interchangeable.
+	*/
+	fps: number().positive().optional(),
+	fpsSource: _enum(["published", "measured"]).optional()
 });
-/** Client-authored fields for create — requires `code` or `files[entry]`. */
-var CoreBlockInputSchema = CoreBlockInputFieldsSchema.superRefine((val, ctx) => {
-	const entry = val.entry ?? "main.ts";
-	if (val.files !== void 0) {
-		if (val.files[entry] === void 0) ctx.addIssue({
-			code: "custom",
-			message: `files must include the entry "${entry}"`,
-			path: ["files"]
-		});
-		return;
-	}
-	if (val.code === void 0) ctx.addIssue({
-		code: "custom",
-		message: "code or files is required",
-		path: ["code"]
-	});
+DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), array(CameraStreamSchema).readonly()), method(object({ deviceId: number().int().nonnegative() }), array(ProfileSlotSchema).readonly()), method(object({
+	deviceId: number().int().nonnegative(),
+	/** Override hostname embedded in returned URLs. Defaults to the broker's bound address. */
+	hostname: string().optional()
+}), array(RtspRestreamEntrySchema).readonly()), method(object({
+	deviceId: number().int().nonnegative(),
+	/** Override hostname embedded in returned URLs. Defaults to the broker's bound address. */
+	hostname: string().optional()
+}), array(ProfileRtspEntrySchema).readonly()), method(object({
+	deviceId: number().int().nonnegative(),
+	requirements: PickStreamRequirementsSchema,
+	preferences: PickStreamPreferencesSchema.optional()
+}), PickedCamStreamSchema.nullable()), object({
+	deviceId: number().int().nonnegative(),
+	camStreams: array(CameraStreamSchema).readonly()
+}), object({
+	deviceId: number().int().nonnegative(),
+	profileSlots: array(ProfileSlotSchema).readonly()
+}), object({
+	online: boolean(),
+	slotStatuses: object({
+		high: ProfileSlotStatusSchema.optional(),
+		mid: ProfileSlotStatusSchema.optional(),
+		low: ProfileSlotStatusSchema.optional()
+	}),
+	slotErrors: object({
+		high: string().optional(),
+		mid: string().optional(),
+		low: string().optional()
+	}),
+	lastChangedAt: number()
+});
+EventCategory.DoorbellOnPressed;
+var CompositionEventPlanSchema = object({
+	featureIndex: number().int().nonnegative(),
+	cap: string(),
+	eventName: string(),
+	category: _enum(EventCategory),
+	stateField: string(),
+	fieldKey: string()
+});
+/** One refusal, named (D391). `path` points into the composition, e.g. `features[0].fields.celsius`. */
+var CompositionProblemSchema = object({
+	code: _enum([
+		"reserved-variant",
+		"unknown-capability",
+		"not-composable",
+		"wrong-device-type",
+		"has-commands",
+		"unknown-field",
+		"nested-field",
+		"missing-field",
+		"kind-mismatch",
+		"may-be-null",
+		"source-missing",
+		"source-unreadable",
+		"source-capability-missing",
+		"source-field-unknown",
+		"expression-invalid",
+		"cycle",
+		"duplicate-target",
+		"not-item-array",
+		"item-field-reserved",
+		"target-missing",
+		"target-unreadable",
+		"not-replaceable"
+	]),
+	path: string(),
+	message: string()
 });
+var CompositionFieldKindSchema = _enum([
+	"string",
+	"number",
+	"boolean",
+	"enum"
+]);
 /**
-* What a block IS (D659). Absent means `code` — every row stored before this
-* union keeps working unchanged.
-*  - `code`: the TypeScript in `code`, compiled and run in its own runner;
-*  - `recipe`: RESERVED (automations), stored shape only; refused at run by name;
-*  - `composition`: declarative, run by the shared `composer`; `code` is `''`.
+* How a field says "unavailable" (D393, D663): `null` when its schema allows it;
+* `unknown` — the enum's own word — for an ADDED field that has one; `release`
+* for a REPLACED field of an existing device, whose claim is released so the
+* native provider's reading shows again; else the (composed) device goes offline.
 */
-var CoreBlockSourceSchema = discriminatedUnion("kind", [
-	object({ kind: literal("code") }),
-	object({
-		kind: literal("recipe"),
-		recipe: AutomationRecipeSchema
-	}),
-	object({
-		kind: literal("composition"),
-		composition: CompositionSchema
-	})
+var CompositionUnavailableModeSchema = _enum([
+	"null",
+	"offline",
+	"unknown",
+	"release"
 ]);
 /**
-* The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7).
-*
-* `name`: REQUIRED for a `new` target — the block's name IS the device's name
-* (D659). ABSENT for an `existing` target — a customization has no name of its
-* own; the server derives one (`customizationBlockName`, D663) and refuses a
-* client-sent name by name.
+* `derived` reads a source · `clock` reads only `now`, recomputed when a sibling
+* field of its cap changes value · `constant` reads nothing, computed once ·
+* `accumulator` advances from the target's seed/current output.
 */
-var CompositionBlockInputSchema = object({
-	name: string().min(1).max(120).optional(),
-	enabled: boolean(),
-	composition: CompositionSchema
-});
-/** A stored block. `code` is always present after normalize (derived from files). */
-var CoreBlockSchema = object({
-	name: string().min(1).max(120),
-	/** Single-file source, or `files[entry]` when multi-file. Always set on disk. */
-	code: string().max(2e5),
-	files: CoreBlockFilesSchema.optional(),
-	entry: string().min(1).max(260).optional(),
-	enabled: boolean(),
-	placement: CoreBlockPlacementSchema,
-	integrationId: string().optional(),
-	settingsSchema: CoreBlockSettingsSchemaBridge.optional(),
-	id: string(),
-	createdAt: number(),
-	updatedAt: number(),
-	/** Server-stamped author. */
-	createdBy: string(),
-	status: CoreBlockStatusSchema,
-	/**
-	* Why the block is not running, when it is not. The operator's ONLY window
-	* into a block that failed at load — a block that is silently absent is the
-	* failure mode this whole feature has to avoid.
-	*/
-	lastError: string().optional(),
-	/** Ms epoch of the last state change. */
-	lastChangedAt: number(),
-	/** What the block is. Absent means `code` (D659). */
-	source: CoreBlockSourceSchema.optional()
+var CompositionFieldRoleSchema = _enum([
+	"derived",
+	"clock",
+	"constant",
+	"accumulator"
+]);
+/** The item a planned field belongs to; its `path` is then the dotted path INSIDE the item. */
+var CompositionFieldItemSchema = object({
+	arrayPath: string(),
+	key: string(),
+	label: string()
 });
-/** A stored composition block and what the composer says about it. */
-var CompositionViewSchema = object({
-	block: CoreBlockSchema,
-	state: discriminatedUnion("kind", [object({
-		kind: literal("answered"),
-		state: CompositionBlockStateSchema.nullable()
-	}), object({
-		kind: literal("unreachable"),
-		error: string()
-	})])
+var CompositionFieldPlanSchema = object({
+	cap: string(),
+	/** Top-level field, or — when `item` is set — the dotted path inside that item. */
+	path: string(),
+	item: CompositionFieldItemSchema.optional(),
+	/** Index into `composition.features` this field's capability came from —
+	*  lets a source/cycle problem name its path as `features[N].fields.<path>`
+	*  (the same convention `planComposition`'s own problems already use). */
+	featureIndex: number().int().nonnegative(),
+	kind: CompositionFieldKindSchema,
+	nullable: boolean(),
+	required: boolean(),
+	unavailable: CompositionUnavailableModeSchema,
+	role: CompositionFieldRoleSchema,
+	source: CompositionFieldSourceSchema,
+	reads: array(CompositionFieldReadSchema)
 });
 /**
-* A read of the stored compositions. `not-loaded` while the `core_blocks`
-* table has not been READ: an empty answer then would make "not yet known"
-* look like "none", and invite the operator to recreate what exists (D315).
+* What a feature does to its target (D663): `new` builds a capability on a new
+* device; on an existing device it `add`s a capability the device lacks, or
+* `replace`s named fields of one it has natively.
 */
-var CompositionsNotLoadedSchema = object({
-	state: literal("not-loaded"),
-	reason: string()
+var CompositionFeatureModeSchema = _enum([
+	"new",
+	"add",
+	"replace"
+]);
+var CompositionFeaturePlanSchema = object({
+	/** Index in the stored feature array; disabled features are omitted rather than re-indexed. */
+	featureIndex: number().int().nonnegative(),
+	cap: string(),
+	mode: CompositionFeatureModeSchema
 });
-var CompositionListReadSchema = discriminatedUnion("state", [object({
-	state: literal("loaded"),
-	views: array(CompositionViewSchema)
-}), CompositionsNotLoadedSchema]);
-var CompositionGetReadSchema = discriminatedUnion("state", [object({
-	state: literal("loaded"),
-	view: CompositionViewSchema.nullable()
-}), CompositionsNotLoadedSchema]);
-/** The customization of one existing device, found by its TARGET, or `not-loaded` (D315). */
-var CompositionCustomizationReadSchema = discriminatedUnion("state", [object({
-	state: literal("loaded"),
-	view: CompositionViewSchema.nullable()
-}), CompositionsNotLoadedSchema]);
-/** What a compile attempt produced. */
-var CoreBlockCompileResultSchema = object({
+var CompositionValidationSchema = object({
 	ok: boolean(),
-	/** Present when `ok` is false — the first error, in the author's words. */
-	error: string().optional(),
-	line: number().optional(),
-	column: number().optional()
+	problems: array(CompositionProblemSchema),
+	fields: array(CompositionFieldPlanSchema),
+	features: array(CompositionFeaturePlanSchema),
+	events: array(CompositionEventPlanSchema)
 });
 /**
-* Compile input: legacy single-file `{ code }`, or a multi-file project.
-* When `files` is present, it wins over `code`.
+* Mirrors `CoreBlockStatus`, pinned by `core-blocks-source.spec.ts`. `degraded`:
+* running, but a replaced field is released to the native provider while its
+* source is unavailable (ruling S1b, D663) — the reason names each such field.
 */
-var CoreBlockCompileInputSchema = object({
-	code: string().optional(),
-	files: CoreBlockFilesSchema.optional(),
-	entry: string().min(1).max(260).optional()
-}).superRefine((val, ctx) => {
-	if (val.files !== void 0) {
-		const entry = val.entry ?? "main.ts";
-		if (val.files[entry] === void 0) ctx.addIssue({
-			code: "custom",
-			message: `files must include the entry "${entry}"`,
-			path: ["files"]
-		});
-		return;
-	}
-	if (val.code === void 0) ctx.addIssue({
-		code: "custom",
-		message: "code or files is required",
-		path: ["code"]
-	});
-});
-method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }), method(object({ blockId: string() }), object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }), method(object({ block: CoreBlockInputSchema }), object({ block: CoreBlockSchema }), {
-	kind: "mutation",
-	auth: "admin",
-	caller: "required"
-}), method(object({
-	blockId: string(),
-	block: CoreBlockInputFieldsSchema.partial()
-}), object({ block: CoreBlockSchema }), {
-	kind: "mutation",
-	auth: "admin",
-	caller: "required"
-}), method(object({ blockId: string() }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	blockId: string(),
-	enabled: boolean()
-}), object({ block: CoreBlockSchema }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ blockId: string() }), object({ block: CoreBlockSchema }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(CoreBlockCompileInputSchema, CoreBlockCompileResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ blockId: string() }), SettingsSchemaWithValuesSchema.nullable(), { auth: "admin" }), method(object({
-	blockId: string(),
-	patch: SettingsPatchSchema
-}), SettingsUpdateResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), object({ libs: array(object({
-	filePath: string(),
-	content: string()
-})) }), { auth: "admin" }), method(object({ block: CompositionBlockInputSchema }), object({ block: CoreBlockSchema }), {
-	kind: "mutation",
-	auth: "admin",
-	caller: "required"
-}), method(object({
+var CompositionRunStatusSchema = _enum([
+	"stopped",
+	"starting",
+	"running",
+	"degraded",
+	"failed"
+]);
+var CompositionFieldStateKindSchema = _enum([
+	"fresh",
+	"stale",
+	"unavailable"
+]);
+var CompositionFieldStateSchema = object({
+	cap: string(),
+	path: string(),
+	/** Same as the plan's: two items' `status` are told apart by it. */
+	item: CompositionFieldItemSchema.optional(),
+	state: CompositionFieldStateKindSchema,
+	/** `null` whenever `state === 'unavailable'`; never a plausible stand-in (D393). */
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		_null()
+	]),
+	reason: string().optional()
+});
+var CompositionBlockStateSchema = object({
 	blockId: string(),
-	expectedUpdatedAt: number(),
-	block: CompositionBlockInputSchema.partial()
-}), object({ block: CoreBlockSchema }), {
-	kind: "mutation",
-	auth: "admin",
-	caller: "required"
-}), method(object({ blockId: string() }), CompositionGetReadSchema, { auth: "admin" }), method(object({}), CompositionListReadSchema, { auth: "admin" }), method(object({
-	addonId: string().min(1),
-	stableId: string().min(1)
-}), CompositionCustomizationReadSchema, { auth: "admin" }), method(object({ deviceType: _enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }), method(object({
-	composition: CompositionSchema,
-	blockId: string().optional()
-}), CompositionValidationSchema, {
-	kind: "mutation",
-	auth: "admin",
-	access: "view"
+	deviceId: number().nullable(),
+	status: CompositionRunStatusSchema,
+	reason: string().optional(),
+	fields: array(CompositionFieldStateSchema)
+});
+var ComposerBlockSchema = object({
+	id: string().min(1),
+	name: string().min(1).max(120),
+	enabled: boolean(),
+	updatedAt: number(),
+	composition: CompositionSchema
 });
 /**
-* `custom-model-registry` — collection cap exposing operator-registered
-* custom detection models. Each provider (today: `addon-model-studio`)
-* contributes a list of `CustomModelDescriptor`s; the hub auto-concatenates
-* them across providers (`concatCollection`).
-*
-* The detection-pipeline is *aware* of this cap: when at least one provider
-* exists it unions these descriptors into the per-step model picker and the
-* runtime model-resolution path, alongside the static catalog. When no
-* provider exists the consumer no-ops entirely (identical to the catalog-only
-* behaviour).
-*
-* A descriptor carries a full `ModelCatalogEntry` directly — the same shape
-* the static catalog uses — so the existing download/resolution code consumes
-* it unchanged. `stepId` is the detection step the model targets
-* (e.g. `'object-detection'`).
+* A stored composition row that no longer PARSES — a schema a release
+* tightened, a row written by a newer build. Sent by id so the composer keeps
+* its device as a placeholder and reports the block `failed` naming the parse
+* error. Leaving it out would read, twice, exactly like a delete (D49).
 */
-var CustomModelDescriptorSchema = object({
-	stepId: string(),
-	entry: ModelCatalogEntrySchema
-});
-/** One regular file of an imported bundle, as the producer measured it. */
-var ModelBundleFileSchema = object({
-	/** Relative path inside the bundle tar; an mlpackage member is `<x>.mlpackage/<member>`. */
-	path: string().min(1),
-	bytes: number().int().nonnegative(),
-	sha256: string().regex(/^[0-9a-f]{64}$/)
+var ComposerUnreadableBlockSchema = object({
+	id: string().min(1),
+	/** The row's stored name column; null when even that is unreadable (the device keeps the name it has). */
+	name: string().nullable(),
+	/** The parse error, in the operator's words. */
+	error: string()
 });
-var ImportModelBundleInputSchema = object({
-	/** The registry provider that keeps the model (Model Studio). */
-	addonId: string(),
-	stepId: string().min(1),
+method(object({
+	/** The shared Blocks integration; null until `core-blocks` has reconciled it. */
+	integrationId: string().nullable(),
+	/** False when the `core_blocks` read failed: then nothing may be withdrawn (D49). */
+	storeLoaded: boolean(),
+	blocks: array(ComposerBlockSchema),
+	/** Operator restarts: rebuild these runtimes and re-resolve their sources. Stores nothing (D62). */
+	restartBlockIds: array(string()),
+	/** Composition rows that exist but do not parse: held, never withdrawn, reported failed. */
+	unreadableBlocks: array(ComposerUnreadableBlockSchema)
+}), object({
+	blocks: array(object({
+		blockId: string(),
+		status: CompositionRunStatusSchema,
+		reason: string().optional()
+	})),
 	/**
-	* The catalog rows to register, complete, every format URL already
-	* `camstack-local://<modelId>/<file>` naming a file of the bundle. One
-	* bundle may carry several rows (a base and its INT8 variant).
+	* False when the composer declared and withdrew NOTHING (store not loaded,
+	* integration unknown, its own rows unread or read empty once). An empty
+	* apply the caller owes is paid off only by one the composer acted on (D49).
 	*/
-	entries: array(ModelCatalogEntrySchema).min(1).max(4),
-	/** The bundle tar, offered by the producer over `ctx.peerBytes` (same host). */
-	bundle: object({
-		ticket: PeerBytesTicketSchema,
-		bytes: number().int().positive(),
-		sha256: string().regex(/^[0-9a-f]{64}$/)
-	}),
-	/** Every file the tar must hold; anything missing, extra or different is refused. */
-	files: array(ModelBundleFileSchema).min(1).max(64),
-	/** Convert missing engine formats and push the model to every agent afterwards. */
-	distribute: boolean()
-});
-var ImportModelBundleResultSchema = discriminatedUnion("kind", [object({
-	kind: literal("imported"),
-	modelIds: array(string()).readonly(),
-	distributed: array(object({
-		modelId: string(),
-		nodeId: string(),
-		format: _enum(MODEL_FORMATS),
-		ok: boolean(),
-		error: string().optional()
-	})).readonly()
-}), object({
-	kind: literal("refused"),
-	reason: _enum([
-		"transfer-failed",
-		"checksum-mismatch",
-		"bundle-mismatch",
-		"invalid-entry",
-		"id-taken"
-	]),
-	detail: string()
-})]);
-method(_void(), array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }), method(ImportModelBundleInputSchema, ImportModelBundleResultSchema, {
+	acted: boolean()
+}), {
 	kind: "mutation",
-	auth: "admin",
-	timeoutMs: 30 * 6e4
-});
-/**
-* Query filter for settings-store collections.
-*/
-var QueryFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
-	whereNot: record(string(), unknown()).optional(),
-	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
-	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
-	whereNotIn: record(string(), array(unknown())).optional(),
-	orderBy: object({
-		field: string(),
-		direction: _enum(["asc", "desc"])
-	}).optional(),
-	limit: number().optional(),
-	offset: number().optional()
-});
-/**
-* The predicate half of a filter, for BULK MUTATIONS.
-*
-* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
-* meaning for a statement that rewrites a set, and accepting them would invite
-* a caller to believe `limit` bounds the damage. Every field is optional here
-* only so the shape stays composable — the implementation REJECTS a filter
-* that compiles to no predicate, because that is the whole collection.
-*/
-var MutationFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	whereNot: record(string(), unknown()).optional(),
-	whereNotIn: record(string(), array(unknown())).optional()
+	auth: "admin"
+}), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
+var NUMBER = {
+	kind: "fixed",
+	result: ["number"]
+};
+var BOOLEAN = {
+	kind: "fixed",
+	result: ["boolean"]
+};
+Object.freeze({
+	min: NUMBER,
+	max: NUMBER,
+	abs: NUMBER,
+	floor: NUMBER,
+	ceil: NUMBER,
+	sqrt: NUMBER,
+	round: NUMBER,
+	pow: NUMBER,
+	clamp: NUMBER,
+	avg: NUMBER,
+	sum: NUMBER,
+	age: NUMBER,
+	convert: NUMBER,
+	coalesce: { kind: "coalesce" },
+	any: BOOLEAN,
+	all: BOOLEAN,
+	within: BOOLEAN,
+	latest: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	number: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	rose: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	count: NUMBER
 });
+`${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
 /**
-* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
-*
-* `as` names the slot in the result, so the SAME column may be asked twice with
-* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
-* a `Record<column, op>` shape could not express.
+* What a composition may BUILD on a device type (G2, D676): the caps a new
+* device of that type, or an existing one that lacks them, can be given. The
+* blockers are the validator's own refusal codes, and a spec compares this
+* listing with `planComposition` for every capability — the editor can never
+* offer a feature the save would refuse for the same reason.
 */
-var AggregateFieldSchema = object({
-	/** Result key. */
-	as: string().min(1),
-	/** Column to aggregate. Must be a real column of a declared collection. */
-	field: string().min(1),
-	op: _enum([
-		"sum",
-		"min",
-		"max"
-	])
+var ComposableFieldSchema = object({
+	path: string(),
+	kind: CompositionFieldKindSchema,
+	nullable: boolean(),
+	required: boolean(),
+	enumValues: array(string()).optional()
 });
+var ComposableCapabilitiesSchema = object({ caps: array(object({
+	cap: string(),
+	fields: array(ComposableFieldSchema),
+	/** Present for an item-array cap (`consumables.items`). */
+	itemArray: object({
+		path: string(),
+		keyField: string()
+	}).optional()
+})) });
+/** Where a block runs. The operator chooses — a block driving a device on an
+*  agent is the reason placement is not fixed to the hub. */
+var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
+/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
+*  a failing block reads the same way a failing addon does. `degraded` is a
+*  composition on an existing device with a field handed back to the native
+*  provider while its source is unavailable (S1b, D663); the error names it. */
+var CoreBlockStatusSchema = _enum([
+	"stopped",
+	"starting",
+	"running",
+	"degraded",
+	"failed"
+]);
+/** path → TypeScript source for a multi-file block. */
+var CoreBlockFilesSchema = record(string().min(1).max(260), string().max(2e5));
 /**
-* `COUNT(*)` plus one number per requested field.
-*
-* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
-* that really is 0 are different facts, and an accounting caller that renders
-* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+* A block's settings form — the same ConfigUISchema addons declare.
+* Loose on the wire (field variants are polymorphic); typed for callers.
 */
-var AggregateResultSchema = object({
-	count: number().int(),
-	values: record(string(), number().nullable())
-});
-/** A single stored record: `{ id, data }`. */
-var SettingsRecordSchema = object({
-	id: string(),
-	data: record(string(), unknown())
-});
+var CoreBlockSettingsSchemaBridge = custom();
 /**
-* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
-* optional.
-*
-* A separate schema rather than loosening the shared one: every other method
-* on this cap addresses a row BY its id, and making that field optional
-* everywhere would turn a forgotten key into a silently generated one on
-* `update` and `delete` as well.
+* Client-authored fields (plain object). Kept separate from the refined create
+* schema because Zod 4 refuses `.partial()` on schemas that carry refinements —
+* `update` needs a partial of these fields.
 */
-var BulkRecordSchema = object({
-	id: string().optional(),
-	data: record(string(), unknown())
+var CoreBlockInputFieldsSchema = object({
+	name: string().min(1).max(120),
+	/**
+	* Single-file TypeScript source. Kept for backward compatibility: when
+	* `files` is absent, this IS `files[entry]`. On write, if `files` is
+	* provided, the server derives `code` from `files[entry]` so compile and
+	* runtime paths that still read `code` keep working.
+	*/
+	code: string().max(2e5).optional(),
+	/** Multi-file project (path → source). Absent = legacy single-file `code`. */
+	files: CoreBlockFilesSchema.optional(),
+	/** Entry file inside `files`. Default {@link DEFAULT_CORE_BLOCK_ENTRY}. */
+	entry: string().min(1).max(260).optional(),
+	enabled: boolean(),
+	placement: CoreBlockPlacementSchema,
+	/**
+	* Integration the block's devices hang from. Absent = the system integration
+	* blocks share. A block may declare its own instead.
+	*/
+	integrationId: string().optional(),
+	/**
+	* Cached settings form for this block. Prefer extracting `settingsSchema`
+	* from the compiled entry after a successful load; the editor may also set
+	* it. Absent ⇒ `getBlockSettings` returns null until one is known.
+	*/
+	settingsSchema: CoreBlockSettingsSchemaBridge.optional()
+});
+/** Client-authored fields for create — requires `code` or `files[entry]`. */
+var CoreBlockInputSchema = CoreBlockInputFieldsSchema.superRefine((val, ctx) => {
+	const entry = val.entry ?? "main.ts";
+	if (val.files !== void 0) {
+		if (val.files[entry] === void 0) ctx.addIssue({
+			code: "custom",
+			message: `files must include the entry "${entry}"`,
+			path: ["files"]
+		});
+		return;
+	}
+	if (val.code === void 0) ctx.addIssue({
+		code: "custom",
+		message: "code or files is required",
+		path: ["code"]
+	});
 });
 /**
-* The database FILES one `sqlite-settings` engine process owns (D851).
-* Closed on purpose: a file is a thing the engine opens, backs up and gives a
-* serving thread, so a new one is a code change, never a string a caller
-* invents. `settings` is `camstack.db` and the default for every collection
-* that names no file.
-*/
-var DataStoreDatabaseSchema = _enum([
-	"settings",
-	"events",
-	"history"
-]);
-DataStoreDatabaseSchema.options;
-/**
-* One write inside a {@link settingsStoreCapability.methods.transact} call.
-* The three that a "replace this set, bump that revision" write needs, plus
-* the batched upsert a rollup writer needs.
+* What a block IS (D659). Absent means `code` — every row stored before this
+* union keeps working unchanged.
+*  - `code`: the TypeScript in `code`, compiled and run in its own runner;
+*  - `recipe`: RESERVED (automations), stored shape only; refused at run by name;
+*  - `composition`: declarative, run by the shared `composer`; `code` is `''`.
 */
-var TransactOpSchema = discriminatedUnion("op", [
-	object({
-		op: literal("deleteWhere"),
-		collection: string(),
-		filter: MutationFilterSchema
-	}),
-	object({
-		op: literal("insertMany"),
-		collection: string(),
-		records: array(BulkRecordSchema).readonly()
-	}),
+var CoreBlockSourceSchema = discriminatedUnion("kind", [
+	object({ kind: literal("code") }),
 	object({
-		op: literal("update"),
-		collection: string(),
-		id: string(),
-		data: record(string(), unknown())
+		kind: literal("recipe"),
+		recipe: AutomationRecipeSchema
 	}),
 	object({
-		op: literal("upsertMany"),
-		collection: string(),
-		conflict: array(string()).readonly(),
-		records: array(BulkRecordSchema).readonly()
+		kind: literal("composition"),
+		composition: CompositionSchema
 	})
 ]);
 /**
-* The precondition of a transaction: the row `key` of `collection` must hold
-* `equals` in `column`, read INSIDE the transaction.
-*/
-var TransactGuardSchema = object({
-	collection: string(),
-	key: string(),
-	column: string(),
-	equals: unknown()
-});
-/**
-* Column declaration for a structured (SQL-backed) collection.
+* The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7).
 *
-* Logical types — the backend translates each to the matching SQLite
-* storage class and handles per-type marshaling:
-*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
-*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
-*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
+* `name`: REQUIRED for a `new` target — the block's name IS the device's name
+* (D659). ABSENT for an `existing` target — a customization has no name of its
+* own; the server derives one (`customizationBlockName`, D663) and refuses a
+* client-sent name by name.
 */
-var CollectionColumnSchema = object({
-	name: string(),
-	type: _enum([
-		"TEXT",
-		"INTEGER",
-		"REAL",
-		"JSON",
-		"BOOLEAN"
-	]),
-	primaryKey: boolean().optional(),
-	notNull: boolean().optional(),
-	unique: boolean().optional(),
+var CompositionBlockInputSchema = object({
+	name: string().min(1).max(120).optional(),
+	enabled: boolean(),
+	composition: CompositionSchema
+});
+/** A stored block. `code` is always present after normalize (derived from files). */
+var CoreBlockSchema = object({
+	name: string().min(1).max(120),
+	/** Single-file source, or `files[entry]` when multi-file. Always set on disk. */
+	code: string().max(2e5),
+	files: CoreBlockFilesSchema.optional(),
+	entry: string().min(1).max(260).optional(),
+	enabled: boolean(),
+	placement: CoreBlockPlacementSchema,
+	integrationId: string().optional(),
+	settingsSchema: CoreBlockSettingsSchemaBridge.optional(),
+	id: string(),
+	createdAt: number(),
+	updatedAt: number(),
+	/** Server-stamped author. */
+	createdBy: string(),
+	status: CoreBlockStatusSchema,
 	/**
-	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
-	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
-	* collection surface simply cannot express their existing tables — which is
-	* why they were still on the uncapped `table*` API.
+	* Why the block is not running, when it is not. The operator's ONLY window
+	* into a block that failed at load — a block that is silently absent is the
+	* failure mode this whole feature has to avoid.
 	*/
-	defaultValue: union([
-		string(),
-		number(),
-		boolean()
-	]).optional()
+	lastError: string().optional(),
+	/** Ms epoch of the last state change. */
+	lastChangedAt: number(),
+	/** What the block is. Absent means `code` (D659). */
+	source: CoreBlockSourceSchema.optional()
 });
-var CollectionIndexSchema = object({
-	name: string(),
-	columns: array(string()).readonly(),
-	unique: boolean().optional()
+/** A stored composition block and what the composer says about it. */
+var CompositionViewSchema = object({
+	block: CoreBlockSchema,
+	state: discriminatedUnion("kind", [object({
+		kind: literal("answered"),
+		state: CompositionBlockStateSchema.nullable()
+	}), object({
+		kind: literal("unreachable"),
+		error: string()
+	})])
 });
 /**
-* The input of `declareCollection` — ONE schema for the door and for the
-* engine behind it, so the two surfaces cannot drift (the dispatcher forwards
-* the payload untouched).
-*
-* - `database` — the file the collection lives in (D851). Absent means
-*   `settings`. A declaration naming a file other than the one the table is
-*   already in is REFUSED by the engine, never moved.
-* - `primaryKey` — a COMPOSITE key, as column names. A single name is the same
-*   as `primaryKey: true` on that column. A composite-keyed collection has no
-*   `id`: it is written with `insertMany` / `upsertMany` / `transact` and read
-*   with `query` / `count` / `aggregate` / `deleteWhere`; the calls that
-*   address one row by id are refused.
-* - `withoutRowid` — emit `WITHOUT ROWID`. Requires a primary key.
+* A read of the stored compositions. `not-loaded` while the `core_blocks`
+* table has not been READ: an empty answer then would make "not yet known"
+* look like "none", and invite the operator to recreate what exists (D315).
 */
-var DeclareCollectionInputSchema = object({
-	namespace: string().optional(),
-	collection: string(),
-	columns: array(CollectionColumnSchema).readonly(),
-	indexes: array(CollectionIndexSchema).readonly().optional(),
-	database: DataStoreDatabaseSchema.optional(),
-	primaryKey: array(string()).readonly().optional(),
-	withoutRowid: boolean().optional()
+var CompositionsNotLoadedSchema = object({
+	state: literal("not-loaded"),
+	reason: string()
+});
+var CompositionListReadSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	views: array(CompositionViewSchema)
+}), CompositionsNotLoadedSchema]);
+var CompositionGetReadSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
+/** The customization of one existing device, found by its TARGET, or `not-loaded` (D315). */
+var CompositionCustomizationReadSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
+/** What a compile attempt produced. */
+var CoreBlockCompileResultSchema = object({
+	ok: boolean(),
+	/** Present when `ok` is false — the first error, in the author's words. */
+	error: string().optional(),
+	line: number().optional(),
+	column: number().optional()
 });
-method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), unknown(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string(),
-	value: unknown()
-}), _void(), {
+/**
+* Compile input: legacy single-file `{ code }`, or a multi-file project.
+* When `files` is present, it wins over `code`.
+*/
+var CoreBlockCompileInputSchema = object({
+	code: string().optional(),
+	files: CoreBlockFilesSchema.optional(),
+	entry: string().min(1).max(260).optional()
+}).superRefine((val, ctx) => {
+	if (val.files !== void 0) {
+		const entry = val.entry ?? "main.ts";
+		if (val.files[entry] === void 0) ctx.addIssue({
+			code: "custom",
+			message: `files must include the entry "${entry}"`,
+			path: ["files"]
+		});
+		return;
+	}
+	if (val.code === void 0) ctx.addIssue({
+		code: "custom",
+		message: "code or files is required",
+		path: ["code"]
+	});
+});
+method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }), method(object({ blockId: string() }), object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }), method(object({ block: CoreBlockInputSchema }), object({ block: CoreBlockSchema }), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "admin",
+	caller: "required"
 }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional(),
-	columns: array(string()).readonly().optional()
-}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	/** Declared columns identifying the slot; must be covered by a UNIQUE
-	*  index on the collection. Never empty. */
-	conflict: array(string()).readonly(),
-	record: BulkRecordSchema
-}), object({ 
-/** The id the row HAS: assigned by SQLite on an insert, or the existing
-*  row's own id on an update. */
-id: union([string(), number()]) }), {
+	blockId: string(),
+	block: CoreBlockInputFieldsSchema.partial()
+}), object({ block: CoreBlockSchema }), {
 	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	conflict: array(string()).readonly(),
-	records: array(BulkRecordSchema).readonly()
-}), object({ upserted: number().int() }), {
+	auth: "admin",
+	caller: "required"
+}), method(object({ blockId: string() }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	record: object({
-		id: string().optional(),
-		data: record(string(), unknown())
-	})
-}), object({ 
-/**
-* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
-* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
-* primary key — which is the only place an auto key is knowable.
-*/
-id: union([string(), number()]) }), {
+	blockId: string(),
+	enabled: boolean()
+}), object({ block: CoreBlockSchema }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	records: array(BulkRecordSchema).readonly()
-}), object({ inserted: number().int() }), {
+}), method(object({ blockId: string() }), object({ block: CoreBlockSchema }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	guard: TransactGuardSchema.optional(),
-	ops: array(TransactOpSchema).readonly()
-}), object({
-	applied: boolean(),
-	current: unknown().optional()
-}), {
+}), method(CoreBlockCompileInputSchema, CoreBlockCompileResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	id: string(),
-	data: record(string(), unknown())
-}), _void(), {
+}), method(object({ blockId: string() }), SettingsSchemaWithValuesSchema.nullable(), { auth: "admin" }), method(object({
+	blockId: string(),
+	patch: SettingsPatchSchema
+}), SettingsUpdateResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), _void(), {
+}), method(object({}), object({ libs: array(object({
+	filePath: string(),
+	content: string()
+})) }), { auth: "admin" }), method(object({ block: CompositionBlockInputSchema }), object({ block: CoreBlockSchema }), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "admin",
+	caller: "required"
 }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: MutationFilterSchema
-}), object({ deleted: number().int() }), {
+	blockId: string(),
+	expectedUpdatedAt: number(),
+	block: CompositionBlockInputSchema.partial()
+}), object({ block: CoreBlockSchema }), {
 	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: MutationFilterSchema,
-	data: record(string(), unknown())
-}), object({ updated: number().int() }), {
+	auth: "admin",
+	caller: "required"
+}), method(object({ blockId: string() }), CompositionGetReadSchema, { auth: "admin" }), method(object({}), CompositionListReadSchema, { auth: "admin" }), method(object({
+	addonId: string().min(1),
+	stableId: string().min(1)
+}), CompositionCustomizationReadSchema, { auth: "admin" }), method(object({ deviceType: _enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }), method(object({
+	composition: CompositionSchema,
+	blockId: string().optional()
+}), CompositionValidationSchema, {
 	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), number(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	fields: array(AggregateFieldSchema).readonly(),
-	filter: QueryFilterSchema.optional()
-}), AggregateResultSchema, { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	field: string(),
-	bucketSize: number().int().positive(),
-	origin: number().int(),
-	filter: QueryFilterSchema.optional()
-}), array(object({
-	bucket: number().int(),
-	count: number().int()
-})).readonly(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string()
-}), boolean(), { auth: "admin" }), method(DeclareCollectionInputSchema, _void(), {
+	auth: "admin",
+	access: "view"
+});
+/**
+* `custom-model-registry` — collection cap exposing operator-registered
+* custom detection models. Each provider (today: `addon-model-studio`)
+* contributes a list of `CustomModelDescriptor`s; the hub auto-concatenates
+* them across providers (`concatCollection`).
+*
+* The detection-pipeline is *aware* of this cap: when at least one provider
+* exists it unions these descriptors into the per-step model picker and the
+* runtime model-resolution path, alongside the static catalog. When no
+* provider exists the consumer no-ops entirely (identical to the catalog-only
+* behaviour).
+*
+* A descriptor carries a full `ModelCatalogEntry` directly — the same shape
+* the static catalog uses — so the existing download/resolution code consumes
+* it unchanged. `stepId` is the detection step the model targets
+* (e.g. `'object-detection'`).
+*/
+var CustomModelDescriptorSchema = object({
+	stepId: string(),
+	entry: ModelCatalogEntrySchema
+});
+/** One regular file of an imported bundle, as the producer measured it. */
+var ModelBundleFileSchema = object({
+	/** Relative path inside the bundle tar; an mlpackage member is `<x>.mlpackage/<member>`. */
+	path: string().min(1),
+	bytes: number().int().nonnegative(),
+	sha256: string().regex(/^[0-9a-f]{64}$/)
+});
+var ImportModelBundleInputSchema = object({
+	/** The registry provider that keeps the model (Model Studio). */
+	addonId: string(),
+	stepId: string().min(1),
+	/**
+	* The catalog rows to register, complete, every format URL already
+	* `camstack-local://<modelId>/<file>` naming a file of the bundle. One
+	* bundle may carry several rows (a base and its INT8 variant).
+	*/
+	entries: array(ModelCatalogEntrySchema).min(1).max(4),
+	/** The bundle tar, offered by the producer over `ctx.peerBytes` (same host). */
+	bundle: object({
+		ticket: PeerBytesTicketSchema,
+		bytes: number().int().positive(),
+		sha256: string().regex(/^[0-9a-f]{64}$/)
+	}),
+	/** Every file the tar must hold; anything missing, extra or different is refused. */
+	files: array(ModelBundleFileSchema).min(1).max(64),
+	/** Convert missing engine formats and push the model to every agent afterwards. */
+	distribute: boolean()
+});
+var ImportModelBundleResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("imported"),
+	modelIds: array(string()).readonly(),
+	distributed: array(object({
+		modelId: string(),
+		nodeId: string(),
+		format: _enum(MODEL_FORMATS),
+		ok: boolean(),
+		error: string().optional()
+	})).readonly()
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"transfer-failed",
+		"checksum-mismatch",
+		"bundle-mismatch",
+		"invalid-entry",
+		"id-taken"
+	]),
+	detail: string()
+})]);
+method(_void(), array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }), method(ImportModelBundleInputSchema, ImportModelBundleResultSchema, {
 	kind: "mutation",
-	auth: "admin"
+	auth: "admin",
+	timeoutMs: 30 * 6e4
 });
 /**
 * What one engine says about itself. The orchestrator uses `kind` to pick
@@ -32489,6 +32521,18 @@ var CalendarInfoSchema = object({
 	source: CalendarSourceKindSchema,
 	enabled: boolean()
 });
+/**
+* Time contract of {@link CalendarEvent}.
+*
+* - Timed event: `startMs` / `endMs` are real instants; `endMs` is exclusive.
+* - All-day event (`allDay: true`): the event is a run of calendar DATES, not
+*   instants. `startMs` is UTC midnight of the first date and `endMs` is UTC
+*   midnight of the day AFTER the last date (RFC 5545 exclusive DTEND), so a
+*   one-day event spans exactly 24 h. Every provider produces that and no
+*   consumer may read the instants in a local timezone: use
+*   {@link calendarEventLocalSpan}. Reading UTC midnight as local time put an
+*   all-day event on the following day for any viewer ahead of UTC.
+*/
 var CalendarEventSchema = object({
 	id: string().min(1),
 	calendarId: string().min(1),
@@ -34631,7 +34675,15 @@ var HubAddressBookSchema = object({
 		publicEndpoint: HubAddressRoleResolutionSchema
 	}),
 	/** The `hub=` an app link carries (D709), or null. */
-	appLinkHub: string().nullable()
+	appLinkHub: string().nullable(),
+	/**
+	* Every origin a browser can really reach this hub at, in the scheme each
+	* listener serves: `https://<lan>:<httpsPort>`, and `http://<lan>:<httpPort>`
+	* while LAN HTTP is on, plus the public and custom addresses. Distinct from
+	* `rows`, which show `http://` only while LAN HTTP is on. Never loopback,
+	* never the app link. Absent on a hub older than D794's amendment.
+	*/
+	listenerOrigins: array(string()).readonly().optional()
 });
 var AllowedAddressesSchema = object({ 
 /**
@@ -41868,6 +41920,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"backup.listAvailableDatabases": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"backup.listDestinations": {
 		capName: "backup",
 		capScope: "system",