@camstack/addon-provider-enpal 0.1.5 → 0.1.6

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-//#region ../types/dist/event-category-DmZDPDf_.mjs
+//#region ../types/dist/event-category-CaURIwQA.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -715,6 +715,10 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["NotificationRuleBroken"] = "notification.rule-broken";
 	/** The clear of {@link NotificationRuleBroken}: the rule loads and names nothing deleted. */
 	EventCategory["NotificationRuleRepaired"] = "notification.rule-repaired";
+	/** A migration failed or was blocked; the Alert Center re-reads the ledger. */
+	EventCategory["MigrationFailed"] = "migration.failed";
+	/** A migration applied or a failure cleared; the Alert Center re-reads the ledger. */
+	EventCategory["MigrationApplied"] = "migration.applied";
 	EventCategory["DeviceUpdated"] = "device.updated";
 	/**
 	* Transport-level connectivity. Emitted by the device driver when
@@ -777,6 +781,378 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
+//#region ../types/dist/device-type-CEqjmUnR.mjs
+/**
+import { errMsg } from '@camstack/types'
+* Extract a human-readable message from an unknown error value.
+* Replaces the ubiquitous `errMsg(err)` pattern.
+*/
+function errMsg(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	return String(err);
+}
+var DeviceType = /* @__PURE__ */ function(DeviceType) {
+	DeviceType["Camera"] = "camera";
+	DeviceType["Hub"] = "hub";
+	DeviceType["Light"] = "light";
+	DeviceType["Siren"] = "siren";
+	DeviceType["Switch"] = "switch";
+	DeviceType["Sensor"] = "sensor";
+	DeviceType["Thermostat"] = "thermostat";
+	/** Air-conditioner / heat-pump climate device (HVAC) — shares the
+	*  `climate-control` cap surface with `Thermostat` but renders a
+	*  dedicated AC-appropriate control UI (mode chips, fan speed,
+	*  independent vertical/horizontal swing). Sources: native Gree, and
+	*  reusable by other AC integrations. */
+	DeviceType["Climate"] = "climate";
+	DeviceType["Button"] = "button";
+	/** Generic stateless event emitter — carries a device's EXACT declared
+	*  event vocabulary verbatim (no normalization). Installed with the
+	*  `event-emitter` cap. Sources: HA `event.*` entities (structured) and
+	*  HA bus events (e.g. `zha_event`, generic). */
+	DeviceType["EventEmitter"] = "event-emitter";
+	/** Firmware/software update entity — current vs available version,
+	*  updatable flag, update state, and an install action. Installed with
+	*  the `update` cap. Sources: Homematic firmware-update channels (and
+	*  reusable by other providers, e.g. HA `update.*` entities). */
+	DeviceType["Update"] = "update";
+	DeviceType["Generic"] = "generic";
+	/** Generic notification delivery target (HA `notify.<service>`, future
+	*  Telegram / Discord / ntfy / SMTP, …). One device per delivery
+	*  endpoint; the `notifier` cap defines the send surface. */
+	DeviceType["Notifier"] = "notifier";
+	/** Pre-recorded action sequence with optional parameters
+	*  (HA `script.*`). Runnable via `script-runner` cap. */
+	DeviceType["Script"] = "script";
+	/** Automation rule (HA `automation.*`) — enable/disable + manual
+	*  trigger surface exposed via `automation-control` cap. */
+	DeviceType["Automation"] = "automation";
+	/** Door / smart lock device (HA `lock.*`). `lock-control` cap. */
+	DeviceType["Lock"] = "lock";
+	/** Window covering, blinds, garage door, valve, etc. (HA `cover.*`,
+	*  `valve.*`). `cover` cap with sub-roles for variant. */
+	DeviceType["Cover"] = "cover";
+	/** Pipe / water / gas valve with open/close/stop and optional
+	*  position (HA `valve.*`). `valve` cap — a cover-sibling actuator
+	*  modelled on the same open/closed lifecycle. */
+	DeviceType["Valve"] = "valve";
+	/** Humidifier / dehumidifier with on/off + target humidity + mode
+	*  (HA `humidifier.*`). `humidifier` cap — a climate-family actuator
+	*  modelled on the same target / mode lifecycle. */
+	DeviceType["Humidifier"] = "humidifier";
+	/** Water heater / boiler with target temperature + operation mode +
+	*  away mode (HA `water_heater.*`). `water-heater` cap — a
+	*  climate-family actuator. */
+	DeviceType["WaterHeater"] = "water-heater";
+	/** Ceiling / standing / exhaust fan (HA `fan.*`). `fan-control` cap. */
+	DeviceType["Fan"] = "fan";
+	/** Audio / video playback endpoint (HA `media_player.*`). Disjoint from
+	*  the camera surface — those use `Camera`. `media-player` cap. */
+	DeviceType["MediaPlayer"] = "media-player";
+	/** Security panel / alarm system (HA `alarm_control_panel.*`).
+	*  `alarm-panel` cap. */
+	DeviceType["AlarmPanel"] = "alarm-panel";
+	/** Generic user-settable input (HA `number` / `input_number` / `select`
+	*  / `input_select` / `text` / `input_text` / `input_datetime`).
+	*  Sub-type via `DeviceRole`: NumericControl / SelectControl /
+	*  TextControl / DateTimeControl. */
+	DeviceType["Control"] = "control";
+	/** Person / device-tracker presence (HA `person.*`, `device_tracker.*`).
+	*  `presence` cap. */
+	DeviceType["Presence"] = "presence";
+	/** Weather provider (HA `weather.*`). Tier-3, low MVP priority.
+	*  `weather` cap. */
+	DeviceType["Weather"] = "weather";
+	/** Robot vacuum (HA `vacuum.*`). Tier-3. `vacuum-control` cap. */
+	DeviceType["Vacuum"] = "vacuum";
+	/** Robotic lawn mower (HA `lawn_mower.*`). Tier-3.
+	*  `lawn-mower-control` cap. */
+	DeviceType["LawnMower"] = "lawn-mower";
+	/** Physical HA device group — parent container for entity-children
+	*  adopted from a single HA device entry. Not renderable as a
+	*  standalone device; exists only to anchor child entities. */
+	DeviceType["Container"] = "container";
+	/** Single still-image entity (HA `image.*`). Read-only display of an
+	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
+	DeviceType["Image"] = "image";
+	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
+	*  level, battery, desiccant life, feeding state and manual-feed /
+	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
+	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
+	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
+	*  integrations sharing the same food/desiccant/hopper surface. */
+	DeviceType["PetFeeder"] = "pet-feeder";
+	/** Pet water fountain — tank level, water drunk, pump and its duty cycle.
+	*  Installed with the `pet-fountain` cap. Reaches CamStack as loose entities
+	*  of a container and is BUILT as a composed device (D967). */
+	DeviceType["PetFountain"] = "pet-fountain";
+	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
+	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
+	*  Sources: native Bosch Home Connect, reusable by similar integrations.
+	*  A plug-built dishwasher carries running-state and power instead. */
+	DeviceType["Dishwasher"] = "dishwasher";
+	/** Washing machine. A plug-built one is running while its power stays
+	*  above a threshold. No program cap — that surface is the dishwasher's. */
+	DeviceType["Washer"] = "washer";
+	/** Tumble dryer. Same plug-built running surface as {@link Washer}. */
+	DeviceType["Dryer"] = "dryer";
+	/** The physical bridge box of a vendor ecosystem (Velux KLF-200, and later
+	*  other radio-to-IP bridges). It carries the box's own facts (firmware,
+	*  address, connection state) and the actions the box really supports
+	*  (`reboot`, `device-admin-link`). Products are NOT its children — they are
+	*  adopted beside it — and its connection settings stay on the integration. */
+	DeviceType["Gateway"] = "gateway";
+	return DeviceType;
+}({});
+var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
+	DeviceFeature["BatteryOperated"] = "battery-operated";
+	DeviceFeature["Rebootable"] = "rebootable";
+	/**
+	* Device supports an on-demand re-sync of its derived spec with its
+	* upstream source — drives the generic Re-sync button. The owning
+	* provider implements the action via the `device-adoption.resync` cap.
+	*/
+	DeviceFeature["Resyncable"] = "resyncable";
+	DeviceFeature["NativeSnapshot"] = "native-snapshot";
+	DeviceFeature["DoorbellButton"] = "doorbell-button";
+	DeviceFeature["TwoWayAudio"] = "two-way-audio";
+	DeviceFeature["PanTiltZoom"] = "pan-tilt-zoom";
+	/**
+	* Camera supports the on-firmware autotrack subsystem (subject-
+	* following). Distinct from `PanTiltZoom` because not every PTZ
+	* camera ships autotrack — the admin UI uses this flag to gate
+	* the autotrack toggle / settings card without re-deriving from
+	* the cap registry. Mirrors `ptz-autotrack` cap registration:
+	* driver sets this feature when probe confirms the firmware
+	* surface, and registers the cap in the same code path.
+	*/
+	DeviceFeature["PtzAutotrack"] = "ptz-autotrack";
+	/**
+	* Accessory exposes a "trigger on motion" toggle — the parent camera's
+	* motion detection automatically activates this device. Mirrors
+	* `motion-trigger` cap registration: drivers set this feature in the
+	* same code path that calls `ctx.registerNativeCap(motionTriggerCapability, ...)`.
+	*
+	* Used by admin UI (gate the in-hero `MotionTriggerToggle` against a
+	* fast scalar without binding fetch), notifier rules, and `listAll`
+	* filters that want "all devices with on-motion behaviour".
+	*/
+	DeviceFeature["MotionTrigger"] = "motion-trigger";
+	/** Light supports rgb-triplet color via `color` cap. */
+	DeviceFeature["LightColorRgb"] = "light-color-rgb";
+	/** Light supports HSV color via `color` cap. */
+	DeviceFeature["LightColorHsv"] = "light-color-hsv";
+	/** Light supports color-temperature (mired) via `color` cap. */
+	DeviceFeature["LightColorMired"] = "light-color-mired";
+	/** Thermostat supports a `heat_cool` dual setpoint (targetLow +
+	*  targetHigh). Gates the range slider UI. */
+	DeviceFeature["ClimateDualSetpoint"] = "climate-dual-setpoint";
+	/** Thermostat exposes target humidity and/or current humidity
+	*  readings. Gates the humidity controls. */
+	DeviceFeature["ClimateHumidity"] = "climate-humidity";
+	/** Thermostat exposes a fan-mode selector. */
+	DeviceFeature["ClimateFanMode"] = "climate-fan-mode";
+	/** Thermostat exposes preset modes (eco / away / sleep / vendor). */
+	DeviceFeature["ClimatePreset"] = "climate-preset";
+	/** Thermostat exposes a vertical louver swing toggle. Gates the
+	*  vertical-swing switch in the climate UI. Independent of horizontal. */
+	DeviceFeature["ClimateSwingVertical"] = "climate-swing-vertical";
+	/** Thermostat exposes a horizontal louver swing toggle. Gates the
+	*  horizontal-swing switch in the climate UI. Independent of vertical. */
+	DeviceFeature["ClimateSwingHorizontal"] = "climate-swing-horizontal";
+	/** Cover exposes intermediate position control (0..100). Gates the
+	*  position slider UI. */
+	DeviceFeature["CoverPositionable"] = "cover-positionable";
+	/** Cover exposes slat-tilt control. Gates the tilt slider UI. */
+	DeviceFeature["CoverTilt"] = "cover-tilt";
+	/** Valve exposes intermediate position control (0..100). Gates the
+	*  position slider / drag surface UI. */
+	DeviceFeature["ValvePositionable"] = "valve-positionable";
+	/** Fan exposes a speed-percentage setter. Gates the speed slider UI. */
+	DeviceFeature["FanSpeed"] = "fan-speed";
+	/** Fan exposes a preset mode selector. */
+	DeviceFeature["FanPreset"] = "fan-preset";
+	/** Fan exposes blade direction (forward/reverse) — typical of
+	*  ceiling fans. */
+	DeviceFeature["FanDirection"] = "fan-direction";
+	/** Fan exposes an oscillation toggle. */
+	DeviceFeature["FanOscillating"] = "fan-oscillating";
+	/** Lock requires a PIN code on lock/unlock. Gates the code-entry
+	*  field on the UI lock-controls panel. */
+	DeviceFeature["LockPinRequired"] = "lock-pin-required";
+	/** Lock supports a latch-release ("open door") action distinct from
+	*  unlock. Mirrors HA `LockEntityFeature.OPEN` (bit 1) in
+	*  `supported_features`. Gates the Open Door button in the UI. */
+	DeviceFeature["LockOpen"] = "lock-open";
+	/** Media player exposes a seek-to-position surface. */
+	DeviceFeature["MediaPlayerSeek"] = "media-player-seek";
+	/** Media player exposes a volume-level setter. */
+	DeviceFeature["MediaPlayerVolume"] = "media-player-volume";
+	/** Media player exposes a mute toggle distinct from volume=0. */
+	DeviceFeature["MediaPlayerMute"] = "media-player-mute";
+	/** Media player exposes a shuffle toggle. */
+	DeviceFeature["MediaPlayerShuffle"] = "media-player-shuffle";
+	/** Media player exposes a repeat mode (off / all / one). */
+	DeviceFeature["MediaPlayerRepeat"] = "media-player-repeat";
+	/** Media player exposes a source / input selector. */
+	DeviceFeature["MediaPlayerSelectSource"] = "media-player-select-source";
+	/** Media player exposes a play-arbitrary-media surface (URL / id). */
+	DeviceFeature["MediaPlayerPlayMedia"] = "media-player-play-media";
+	/** Media player exposes next-track. */
+	DeviceFeature["MediaPlayerNext"] = "media-player-next";
+	/** Media player exposes previous-track. */
+	DeviceFeature["MediaPlayerPrevious"] = "media-player-previous";
+	/** Media player exposes stop distinct from pause. */
+	DeviceFeature["MediaPlayerStop"] = "media-player-stop";
+	/** Alarm panel requires a PIN code on arm/disarm. */
+	DeviceFeature["AlarmPinRequired"] = "alarm-pin-required";
+	/** Presence device carries GPS coordinates (lat/lng/accuracy) in
+	*  addition to a textual location. */
+	DeviceFeature["PresenceGps"] = "presence-gps";
+	/** Notifier accepts an inline / URL image attachment. */
+	DeviceFeature["NotifierImage"] = "notifier-image";
+	/** Notifier accepts a priority hint (high/normal/low). */
+	DeviceFeature["NotifierPriority"] = "notifier-priority";
+	/** Notifier accepts a free-form `data` payload for platform-specific
+	*  fields. */
+	DeviceFeature["NotifierData"] = "notifier-data";
+	/** Notifier supports interactive action buttons / callbacks. */
+	DeviceFeature["NotifierActions"] = "notifier-actions";
+	/** Notifier supports per-call recipient targeting (multi-user). */
+	DeviceFeature["NotifierRecipients"] = "notifier-recipients";
+	/** Script runner accepts a variables map on each run invocation. */
+	DeviceFeature["ScriptVariables"] = "script-variables";
+	/** Automation `trigger` accepts a skipCondition flag — fires the
+	*  automation's actions while bypassing its condition block. */
+	DeviceFeature["AutomationSkipCondition"] = "automation-skip-condition";
+	/** Robot vacuum exposes a live cleaning map (image child). Gates the
+	*  map tile in the vacuum UI. */
+	DeviceFeature["VacuumHasMap"] = "vacuum-has-map";
+	/** Robot vacuum exposes AI obstacle-detection toggles. Gates the AI
+	*  switches group. */
+	DeviceFeature["VacuumHasAi"] = "vacuum-has-ai";
+	/** Robot mower exposes a live mowing map (SVG image child). Gates the
+	*  mower map tile. */
+	DeviceFeature["MowerHasMap"] = "mower-has-map";
+	/** Robot mower exposes targeted mowing (all-area / zones / edges /
+	*  spots) — gates the Mow action + map selectors. */
+	DeviceFeature["MowerHasTargetedMowing"] = "mower-has-targeted-mowing";
+	return DeviceFeature;
+}({});
+/**
+* Semantic role a device plays within its parent. Populated by driver
+* addons when creating accessory devices (Reolink siren/floodlight/
+* PIR/chime/autotrack/doorbell, ONVIF relay outputs, …). Used by the
+* admin UI to pick icons, labels, and widgets — a `Switch` with
+* `role: Floodlight` renders as a bulb with a brightness slider,
+* whereas a `Switch` with `role: Siren` renders as a klaxon.
+*
+* Undefined for top-level devices (cameras, NVRs, hubs). Persisted in
+* sqlite as a nullable TEXT column — old rows keep working unchanged.
+*/
+var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
+	DeviceRole["Siren"] = "siren";
+	DeviceRole["Floodlight"] = "floodlight";
+	DeviceRole["Spotlight"] = "spotlight";
+	DeviceRole["PirSensor"] = "pir-sensor";
+	DeviceRole["Chime"] = "chime";
+	DeviceRole["Autotrack"] = "autotrack";
+	DeviceRole["Nightvision"] = "nightvision";
+	DeviceRole["PrivacyMask"] = "privacy-mask";
+	DeviceRole["Doorbell"] = "doorbell";
+	/** Interior blind / shade / roller blind. HA `device_class: blind|shade`. */
+	DeviceRole["CoverBlind"] = "cover-blind";
+	/** Exterior roller shutter. HA `device_class: shutter`; Homematic BROLL. */
+	DeviceRole["CoverShutter"] = "cover-shutter";
+	/** Exterior awning. HA `device_class: awning`. */
+	DeviceRole["CoverAwning"] = "cover-awning";
+	/** Curtain / drape. HA `device_class: curtain`. */
+	DeviceRole["CoverCurtain"] = "cover-curtain";
+	/** Garage door. HA `device_class: garage`. A security actuator: exports gate it. */
+	DeviceRole["CoverGarage"] = "cover-garage";
+	/** Gate. HA `device_class: gate`. A security actuator: exports gate it. */
+	DeviceRole["CoverGate"] = "cover-gate";
+	/** Door. HA `device_class: door`. A security actuator: exports gate it. */
+	DeviceRole["CoverDoor"] = "cover-door";
+	/** Window. HA `device_class: window`. */
+	DeviceRole["CoverWindow"] = "cover-window";
+	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
+	*  real Switch device for UI rendering / export adapters. */
+	DeviceRole["BinaryHelper"] = "binary-helper";
+	/** A smart plug: a `switch` whose source says it is an outlet (HA
+	*  `device_class: outlet`). The Alexa export shows it as a SMARTPLUG. */
+	DeviceRole["Outlet"] = "outlet";
+	/** Generic motion / occupancy / moving event source. Distinct from
+	*  the camera accessory PirSensor role: that one is a camera child;
+	*  this is a standalone HA / 3rd-party motion sensor. */
+	DeviceRole["MotionSensor"] = "motion-sensor";
+	DeviceRole["ContactSensor"] = "contact-sensor";
+	DeviceRole["LeakSensor"] = "leak-sensor";
+	DeviceRole["SmokeSensor"] = "smoke-sensor";
+	DeviceRole["COSensor"] = "co-sensor";
+	DeviceRole["GasSensor"] = "gas-sensor";
+	DeviceRole["TamperSensor"] = "tamper-sensor";
+	DeviceRole["VibrationSensor"] = "vibration-sensor";
+	DeviceRole["ConnectivitySensor"] = "connectivity-sensor";
+	DeviceRole["SoundSensor"] = "sound-sensor";
+	/** Fallback for `binary_sensor` without a known `device_class`. */
+	DeviceRole["BinarySensor"] = "binary-sensor";
+	DeviceRole["TemperatureSensor"] = "temperature-sensor";
+	DeviceRole["HumiditySensor"] = "humidity-sensor";
+	DeviceRole["AmbientLightSensor"] = "ambient-light-sensor";
+	DeviceRole["PressureSensor"] = "pressure-sensor";
+	/** Wind speed or direction (weather-station `wind-sensor` cap). */
+	DeviceRole["WindSensor"] = "wind-sensor";
+	/** Rain accumulation or rate (weather-station `rain-sensor` cap). */
+	DeviceRole["RainSensor"] = "rain-sensor";
+	/** UV index (weather-station `uv-sensor` cap). */
+	DeviceRole["UvSensor"] = "uv-sensor";
+	/** Solar irradiance W/m² (weather-station `solar-radiation-sensor` cap).
+	*  Distinct from AmbientLightSensor (lux). */
+	DeviceRole["SolarRadiationSensor"] = "solar-radiation-sensor";
+	/** Soil moisture % (garden/weather `soil-moisture-sensor` cap). */
+	DeviceRole["SoilMoistureSensor"] = "soil-moisture-sensor";
+	DeviceRole["PowerSensor"] = "power-sensor";
+	DeviceRole["EnergySensor"] = "energy-sensor";
+	DeviceRole["VoltageSensor"] = "voltage-sensor";
+	DeviceRole["CurrentSensor"] = "current-sensor";
+	DeviceRole["AirQualitySensor"] = "air-quality-sensor";
+	/** Battery level (numeric % via `sensor` OR low-bool via
+	*  `binary_sensor` — the cap distinguishes via the value type). */
+	DeviceRole["BatterySensor"] = "battery-sensor";
+	/** Fallback for `sensor` numeric without a known `device_class`. */
+	DeviceRole["NumericSensor"] = "numeric-sensor";
+	/** String / enum state (HA `sensor` with `state_class: enum` or
+	*  `attributes.options`). */
+	DeviceRole["EnumSensor"] = "enum-sensor";
+	/** Date / timestamp state (HA `sensor` with `device_class: timestamp`
+	*  or `date`). The slice carries the raw ISO string verbatim (hosted on
+	*  the `enum-sensor` cap); the UI renders it locale-formatted. */
+	DeviceRole["DateTimeSensor"] = "datetime-sensor";
+	/** Last-resort fallback when nothing else matches. */
+	DeviceRole["GenericSensor"] = "generic-sensor";
+	DeviceRole["NumericControl"] = "numeric-control";
+	DeviceRole["SelectControl"] = "select-control";
+	DeviceRole["TextControl"] = "text-control";
+	DeviceRole["DateTimeControl"] = "datetime-control";
+	/** Mobile push notifier (HA `notify.mobile_app_*`) — supports
+	*  rich features (image, priority, channel routing). */
+	DeviceRole["MobilePushNotifier"] = "mobile-push-notifier";
+	/** Chat / messaging service (HA `notify.telegram_*`,
+	*  `notify.discord_*`, etc.). */
+	DeviceRole["MessagingNotifier"] = "messaging-notifier";
+	/** Email-based delivery (HA `notify.smtp`, etc.). */
+	DeviceRole["EmailNotifier"] = "email-notifier";
+	/** Fallback when the notifier service name doesn't match a known
+	*  pattern. */
+	DeviceRole["GenericNotifier"] = "generic-notifier";
+	/** Emits a pulse train (infrared or RF) on request — the `ir-transmitter`
+	*  cap. A `DeviceType.Generic` device. */
+	DeviceRole["IrTransmitter"] = "ir-transmitter";
+	return DeviceRole;
+}({});
+//#endregion
 //#region ../../node_modules/zod/v4/core/core.js
 var _a$1;
 function $constructor(name, initializer, params) {
@@ -5455,7 +5831,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DSVWZfJC.mjs
+//#region ../types/dist/sleep-CSYuxssh.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5975,6 +6351,102 @@ function emitReadiness(bus, params) {
 		ts
 	}));
 }
+var NOT_RUN = {
+	declared: false,
+	snapshot: null,
+	applied: [],
+	failed: [],
+	blocked: [],
+	skipped: [],
+	blockOwner: []
+};
+/**
+* Offer `migrations` to the engine and run what it says to run, in its order. Never
+* throws: an unreachable or refusing engine is logged and reported `declared: false`,
+* because the hub (and this addon's boot) must not hang on a migration.
+*/
+async function runAddonMigrations(host, migrations, logger) {
+	const first = migrations[0];
+	if (first === void 0) return NOT_RUN;
+	const owner = first.meta.owner;
+	const log = logger.withTags({ migrationOwner: owner });
+	const byId = new Map(migrations.map((m) => [m.meta.id, m]));
+	let declaration;
+	try {
+		declaration = await host.declareOwner({
+			owner,
+			metas: migrations.map((m) => m.meta)
+		});
+	} catch (err) {
+		log.error("the migration engine refused or could not take this addon catalogue — none ran", { meta: { error: errMsg(err) } });
+		return {
+			...NOT_RUN,
+			blockOwner: migrations.filter((m) => m.meta.onFailure === "block-owner").map((m) => m.meta.id)
+		};
+	}
+	const applied = [];
+	const failed = [];
+	const blocked = [];
+	const skipped = [];
+	const settle = (id, status) => {
+		if (status === "applied") applied.push(id);
+		else if (status === "failed") failed.push(id);
+		else if (status === "blocked") blocked.push(id);
+		else skipped.push(id);
+	};
+	for (const step of declaration.steps) {
+		const bound = byId.get(step.id);
+		if (bound === void 0 || step.action === "skip") {
+			skipped.push(step.id);
+			continue;
+		}
+		const tags = { migrationId: step.id };
+		try {
+			const gate = await host.startMigration({ id: step.id });
+			if (!gate.proceed) {
+				log.warn("migration not run", {
+					tags,
+					meta: {
+						state: gate.state,
+						reason: gate.reason
+					}
+				});
+				settle(step.id, gate.state === "pending" ? "blocked" : gate.state);
+				continue;
+			}
+			const result = await bound.execute();
+			const outcome = await host.finishMigration({
+				id: step.id,
+				result
+			});
+			if (outcome.status === "applied") log.info("migration applied", {
+				tags,
+				meta: { rowsChanged: outcome.rowsChanged }
+			});
+			else log.error("migration failed", {
+				tags,
+				meta: { error: outcome.error }
+			});
+			settle(step.id, outcome.status);
+		} catch (err) {
+			log.error("migration could not be completed with the engine", {
+				tags,
+				meta: { error: errMsg(err) }
+			});
+			failed.push(step.id);
+		}
+	}
+	const blockOwner = [...failed, ...blocked].filter((id) => byId.get(id)?.meta.onFailure === "block-owner");
+	return {
+		declared: true,
+		snapshot: declaration.snapshot,
+		applied,
+		failed,
+		blocked,
+		skipped,
+		blockOwner
+	};
+}
 /**
 * Build a {@link DurableState} over a single store key. Transport-agnostic:
 * `read`/`write` are the addon-store or device-store accessors. The whole
@@ -7030,6 +7502,28 @@ var BaseAddon = class {
 		return normalized;
 	}
 	/**
+	* Run this addon's migration catalogue (D987 M3) through the hub's `migrations`
+	* engine. Call it at the point of the boot where the data must already have the new
+	* shape — `onInitialize`, or `onRestoreDevices` for a migration that needs the
+	* restored devices — with the catalogue bound to the addon's ports
+	* (`defineAddonMigrations(ADDON_MIGRATIONS, ports)`).
+	*
+	* An engine that cannot be reached or refuses the catalogue is logged and runs
+	* nothing; the boot continues. A migration that FAILED (or was blocked by one)
+	* and declares `onFailure: 'block-owner'` makes this throw, so the addon does not
+	* serve data whose shape it cannot trust; `tolerate` migrations never do.
+	*/
+	async runMigrations(migrations) {
+		const api = this.ctx.api.migrations;
+		const report = await runAddonMigrations({
+			declareOwner: (input) => api.declareOwner.mutate(input),
+			startMigration: (input) => api.startMigration.mutate(input),
+			finishMigration: (input) => api.finishMigration.mutate(input)
+		}, migrations, this.ctx.logger);
+		if (report.blockOwner.length > 0) throw new Error(`migration(s) ${report.blockOwner.join(", ")} did not apply and block this addon — fix or retry them (migrations.retry), then restart it`);
+		return report;
+	}
+	/**
 	* Called by the isolated-process runner AFTER `broker.start()`.
 	* In-process addons never need this because the hub broker is already
 	* running when `initialize()` fires. For forked children the broker
@@ -8139,407 +8633,6 @@ var RecordKindDeclarationSchema = object({
 }).strict();
 /** The kind names: lower-case, dash separated, short enough for an index name. */
 var RecordKindNameSchema = string().regex(/^[a-z][a-z0-9-]{0,47}$/);
-var READING_QUANTITIES = [
-	"temperature",
-	"pressure",
-	"speed",
-	"precipitation",
-	"precipitation-rate",
-	"length",
-	"area",
-	"illuminance",
-	"irradiance",
-	"power",
-	"energy",
-	"voltage",
-	"current",
-	"apparent-power",
-	"humidity",
-	"percentage",
-	"concentration-volume",
-	"concentration-mass",
-	"concentration-ppb",
-	"volume",
-	"duration",
-	"duration-ms",
-	"information",
-	"sound-level",
-	"signal-level",
-	"colour-temperature",
-	"angle",
-	"bitrate",
-	"rate",
-	"mass",
-	"index",
-	"ratio",
-	"count",
-	"none",
-	"device"
-];
-var ReadingQuantitySchema = _enum(READING_QUANTITIES);
-new Set(READING_QUANTITIES);
-/**
-* Stored unit symbol for a quantity. `none` means the number is dimensionless
-* (or an index / ratio / count). `device` means the cap has no single unit.
-*/
-var QUANTITY_BASE = {
-	temperature: "°C",
-	pressure: "hPa",
-	speed: "m/s",
-	precipitation: "mm",
-	"precipitation-rate": "mm/h",
-	length: "m",
-	area: "m²",
-	illuminance: "lx",
-	irradiance: "W/m²",
-	power: "W",
-	energy: "kWh",
-	voltage: "V",
-	current: "A",
-	"apparent-power": "VA",
-	humidity: "%",
-	percentage: "%",
-	"concentration-volume": "ppm",
-	"concentration-mass": "µg/m³",
-	"concentration-ppb": "ppb",
-	volume: "L",
-	duration: "s",
-	"duration-ms": "ms",
-	information: "B",
-	"sound-level": "dBFS",
-	"signal-level": "dBm",
-	"colour-temperature": "mired",
-	angle: "°",
-	bitrate: "kbps",
-	rate: "fps",
-	mass: "kg",
-	index: "none",
-	ratio: "none",
-	count: "none",
-	none: "none",
-	device: "device"
-};
-/** The stored unit, or `undefined` when the quantity has no unit symbol. */
-function baseUnitOf(quantity) {
-	const symbol = QUANTITY_BASE[quantity];
-	if (symbol === "none" || symbol === "device") return void 0;
-	return symbol;
-}
-function readingMeta(quantity, extras) {
-	return {
-		quantity,
-		...extras?.precision !== void 0 ? { precision: extras.precision } : {},
-		...extras?.label !== void 0 ? { label: extras.label } : {}
-	};
-}
-/** Shared Zod schemas used across streaming capabilities. */
-var CamProfileSchema = _enum([
-	"high",
-	"mid",
-	"low"
-]);
-/**
-* Which rung a per-camera consumer listens on: an explicit profile, or `auto`.
-*
-* `auto` is a REAL value, not an absent one — it means "resolve it by the rule
-* that consumer owns". It lives beside `CamProfile` because a rung is the only
-* operator-facing way to name a stream: a cam-stream id is broker-internal and
-* moves when a slot is reassigned, so a stored id silently stops meaning what
-* the operator picked. Today's one user is the audio analyser, whose rule is
-* "the lowest AVAILABLE native rung" (D537).
-*/
-var AudioStreamPickSchema = union([CamProfileSchema, literal("auto")]);
-var CamStreamKindSchema = _enum([
-	"pull-rtsp",
-	"pull-rtmp",
-	"pull-http",
-	"pull-flv",
-	"pull-rfc4571",
-	"push-annexb",
-	"derived"
-]);
-var CamStreamResolutionSchema = object({
-	width: number().int().positive().meta(readingMeta("none")),
-	height: number().int().positive().meta(readingMeta("none"))
-});
-var CameraStreamSchema = object({
-	/** Stable, provider-assigned id unique within the (deviceId) scope. */
-	camStreamId: string().min(1),
-	deviceId: number().int().nonnegative(),
-	kind: CamStreamKindSchema,
-	/** Required for pull-* kinds. Ignored for push-annexb. */
-	url: string().optional(),
-	codec: string().optional(),
-	resolution: CamStreamResolutionSchema.optional(),
-	fps: number().positive().optional(),
-	/** Human label surfaced in the Admin UI "Camera Stream" dropdown. */
-	label: string().optional(),
-	/**
-	* Device-level features the publisher advertised (e.g. `battery-operated`).
-	* The broker, snapshot orchestrator, and prebuffer manager all consult
-	* this list to derive policy — relaxed stall watchdog for battery
-	* cams, prebuffer off by default, longer snapshot rate-limit, etc.
-	*
-	* Single source of truth replacing per-stream flags like the
-	* historical `allowStall`: if the publisher knows the camera is
-	* battery-powered, every downstream service derives the right policy
-	* from this list.
-	*/
-	deviceFeatures: array(string()).optional(),
-	/**
-	* Whether this stream participates in the broker's automatic profile
-	* assignment (`computeInitialAssignment`). Defaults to `true`. Publishers
-	* use `false` when they want a stream to be SELECTABLE in the UI but not
-	* picked by default — e.g. Reolink publishes its native Baichuan streams
-	* as `autoEligible: true` (the recommended path) and its RTSP / RTMP
-	* mirrors as `autoEligible: false` (still pickable per slot, just not
-	* the auto choice). Manual `assignProfile` calls remain valid for
-	* non-eligible streams.
-	*/
-	autoEligible: boolean().optional(),
-	/**
-	* The profile slot the PUBLISHER says this stream is: `low` for a stream
-	* whose only sensible role is the low-bandwidth one, `high` for a main
-	* stream. Consulted by the broker's automatic ranking
-	* (`rankInitialAssignment`) BEFORE the pixel-count heuristic, and only there:
-	* an operator's manual assignment still wins, and an absent hint is the
-	* pixel-ranked default every camera had before this field existed.
-	*
-	* Why it exists: a camera with ONE stream ranked to `mid` — the slot no
-	* storage class is written for on its own (`recordings` is high|mid,
-	* `recordingsLow` is low) and the one profile scrub does not read. The robot
-	* camera's single 720p relay is a `low` in every respect except the slot the
-	* heuristic put it in.
-	*/
-	profileHint: CamProfileSchema.optional(),
-	/**
-	* Transport-specific opaque metadata. The broker passes it through to
-	* the source reader without inspecting it. Currently used by
-	* `pull-rfc4571` streams to carry the upstream SDP (so the reader can
-	* route RTP packets to the right depacketizer without an in-band
-	* DESCRIBE phase). Other kinds typically leave it undefined.
-	*/
-	metadata: record(string(), unknown()).optional()
-});
-var ProfileSlotStatusSchema = _enum([
-	"unassigned",
-	"idle",
-	"connecting",
-	"streaming",
-	"error"
-]);
-var ProfileSlotSchema = object({
-	deviceId: number().int().nonnegative(),
-	profile: CamProfileSchema,
-	/** Broker id the rest of the system addresses: `${deviceId}/${profile}`. */
-	brokerId: string(),
-	/** `null` when the profile is unassigned. */
-	sourceCamStreamId: string().nullable(),
-	status: ProfileSlotStatusSchema,
-	resolution: CamStreamResolutionSchema.optional(),
-	codec: string().optional(),
-	preBufferSec: number().nonnegative().optional(),
-	errorMessage: string().optional()
-});
-/**
-* Zod schema for StreamSourceEntry — the canonical stream descriptor
-* exposed by ICameraDevice.getStreamSources() and consumed by the broker.
-*/
-var StreamSourceEntrySchema$1 = object({
-	id: string(),
-	label: string(),
-	protocol: _enum([
-		"rtsp",
-		"rtmp",
-		"annexb",
-		"http-mjpeg",
-		"webrtc",
-		"custom"
-	]),
-	url: string().optional(),
-	resolution: object({
-		width: number(),
-		height: number()
-	}).readonly().optional(),
-	fps: number().optional(),
-	bitrate: number().optional(),
-	codec: string().optional(),
-	profileHint: CamProfileSchema.optional()
-});
-object({
-	type: string(),
-	url: string(),
-	videoCodec: string().optional(),
-	audioCodec: string().optional(),
-	metadata: record(string(), unknown()).readonly().optional()
-});
-/**
-* Wire schema for `FrameHandle` — a zero-pixel, serialisable reference to a
-* frame in a shared-memory ring (Phase 5 / D9). Mirrors the `FrameHandle` TS
-* interface in `interfaces/frame-handle.ts` field-for-field so a cap method
-* (the runner's native-crop and pipeline-executor inputs) can carry handles
-* over tRPC / Moleculer.
-*
-* The `satisfies` assertion below pins this schema to the interface: if a
-* field is added to / removed from `FrameHandle` without a matching schema
-* edit, `z.infer<typeof FrameHandleSchema>` stops being assignable to
-* `FrameHandle` and the build fails — no silent drift.
-*/
-var FrameHandleSchema = object({
-	shmId: string(),
-	slot: number().int().nonnegative(),
-	seq: number().int().nonnegative(),
-	width: number().int().positive(),
-	height: number().int().positive(),
-	format: _enum([
-		"jpeg",
-		"rgb",
-		"bgr",
-		"yuv420",
-		"gray"
-	]),
-	pts: number(),
-	byteLength: number().int().nonnegative(),
-	nodeId: string(),
-	slotCount: number().int().positive()
-});
-/**
-* Wire schema for a decoded audio chunk (Phase 5 / D9). Mirrors the
-* `DecodedAudioChunk` TS interface in `interfaces/stream-broker.ts`: PCM
-* sample bytes plus the track parameters a consumer needs to interpret them.
-*
-* Audio chunks are tiny (a ~500ms AudioCodecSession window is a few KB of
-* Float32 PCM), so unlike video frames they ship their bytes INLINE over
-* tRPC / Moleculer — no shared-memory plane. `data` is typed `Uint8Array`
-* (the wire-serialisable supertype of `Buffer`); a `Buffer` is assignable to
-* it.
-*/
-var AudioChunkFormatSchema = _enum(AUDIO_CHUNK_FORMATS);
-var DecodedAudioChunkSchema = object({
-	data: _instanceof(Uint8Array),
-	sampleRate: number().int().positive(),
-	channels: number().int().positive(),
-	timestamp: number(),
-	/**
-	* Byte format of `data`. ABSENT MEANS `f32le` — today's bytes, byte for
-	* byte, for any peer that never heard of this field. A coded window
-	* (`pcmu` / `pcma`, one byte per sample) is only ever emitted to a
-	* subscription that DECLARED it accepts one, so absence can never mean
-	* "coded bytes a consumer will read as floats" (D455).
-	*/
-	format: AudioChunkFormatSchema.optional()
-});
-/**
-* Input for `stream-broker.subscribeAudioChunks` (Phase 5 / D9). Audio ships
-* its bytes inline: a consumer asks the broker for the decoded audio-chunk
-* stream of one broker; the broker keeps a per-subscription bounded FIFO queue
-* the consumer drains via `pullAudioChunks`.
-*/
-var SubscribeAudioChunksInputSchema = object({
-	brokerId: string(),
-	/** Short caller-identity tag (`audio-analyzer`, …) for `listClients`. */
-	tag: string().optional(),
-	/**
-	* Byte formats this subscriber can READ, best first. The broker serves the
-	* chunk's own format when it is in this list and expands to `f32le`
-	* otherwise, so a subscriber is never handed bytes it cannot interpret.
-	*
-	* Absent (or without the source format) means `f32le` — the behaviour every
-	* subscriber had before D455, unchanged. This is the negotiation half of
-	* the source-bytes lever: it is what lets the broker and its consumers
-	* deploy one at a time across three nodes.
-	*/
-	accept: array(AudioChunkFormatSchema).readonly().optional()
-});
-/** Result of `stream-broker.subscribeAudioChunks`. */
-var SubscribeAudioChunksResultSchema = object({ 
-/** Opaque id passed to `pullAudioChunks` / `unsubscribeAudioChunks`. */
-subscriptionId: string() });
-var BrokerStatsSchema = object({
-	status: _enum([
-		"idle",
-		"connecting",
-		"streaming",
-		"error",
-		"stopped"
-	]),
-	inputFps: number(),
-	encodedSubscribers: number(),
-	uptimeMs: number(),
-	bitrateKbps: number(),
-	idrIntervalMs: number(),
-	codec: string().optional(),
-	totalBytes: number(),
-	packetCount: number(),
-	rtspClients: number(),
-	pipeClients: number(),
-	preBufferSec: number(),
-	preBufferMs: number(),
-	preBufferPackets: number(),
-	/**
-	* Detected audio track parameters from the RTSP DESCRIBE / SDP. `null`
-	* when the stream has no audio track or the broker is in cold start.
-	* `supported = false` means the codec was detected but the local
-	* decoder pipeline cannot produce PCM chunks (e.g. AAC without the
-	* AAC pipeline wired). Surfaced in the UI device-overview so operators
-	* can pre-pick the audio-analysis model that matches the codec.
-	*/
-	audio: object({
-		codec: string(),
-		sampleRate: number(),
-		channels: number(),
-		supported: boolean()
-	}).nullable().optional(),
-	/**
-	* BROKER-SIDE AUDIO MUTE (D83). `true` = this broker is deliberately
-	* distributing none of the device's audio, on live or recording.
-	*
-	* Present so a silent camera can be told apart from a broken one on the
-	* stream panel itself, without cross-referencing the switch group: a
-	* broker holding an `audio` track descriptor while `audioMuted` is true is
-	* working exactly as asked. `audioMutedDropped` counts the audio units
-	* thrown away since the current dial — it is how you confirm from stats
-	* alone that the mute is on the packet path and not merely persisted.
-	*/
-	audioMuted: boolean().optional(),
-	audioMutedDropped: number().optional()
-});
-/**
-* Exporter-facing "profile restream" entry. Returned by
-* `cameraStreams.getProfileRtspEntries` — one per ASSIGNED profile slot
-* (high/mid/low). `brokerId` is the PROFILE-keyed broker id
-* (`${deviceId}/${profile}`, e.g. `15/high`); its `url` is a broker
-* RTSP restream that aliases the profile's assigned source broker, so
-* every consumer dialling a profile converges on the same single pull.
-* `codec`/`resolution` describe the assigned SOURCE camStream (for the
-* `auto` resolution-closest pick). Distinct from `RtspRestreamEntry`
-* (raw per-camStream, live-view only).
-*/
-var ProfileRtspEntrySchema = object({
-	profile: CamProfileSchema,
-	/** Profile-keyed broker id, format `${deviceId}/${profile}` (e.g. `"15/high"`). */
-	brokerId: string(),
-	url: string(),
-	mutedUrl: string(),
-	enabled: boolean(),
-	codec: string().optional(),
-	resolution: CamStreamResolutionSchema.optional()
-});
-/**
-* The model weight formats a catalog entry can ship. Schema-free on purpose:
-* `types/models.ts` builds Zod schemas from it, but a runner-closure consumer
-* (the model downloader in `@camstack/system`) needs only the list and must
-* reach it through `@camstack/types/addon` without building the cap schema
-* graph (D28).
-*/
-var MODEL_FORMATS = [
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt",
-	"gguf"
-];
 object({
 	field: string().min(1),
 	on: literal("advance")
@@ -8632,6 +8725,407 @@ function optionalMethod(input, output, options) {
 function event(data) {
 	return { data };
 }
+var READING_QUANTITIES = [
+	"temperature",
+	"pressure",
+	"speed",
+	"precipitation",
+	"precipitation-rate",
+	"length",
+	"area",
+	"illuminance",
+	"irradiance",
+	"power",
+	"energy",
+	"voltage",
+	"current",
+	"apparent-power",
+	"humidity",
+	"percentage",
+	"concentration-volume",
+	"concentration-mass",
+	"concentration-ppb",
+	"volume",
+	"duration",
+	"duration-ms",
+	"information",
+	"sound-level",
+	"signal-level",
+	"colour-temperature",
+	"angle",
+	"bitrate",
+	"rate",
+	"mass",
+	"index",
+	"ratio",
+	"count",
+	"none",
+	"device"
+];
+var ReadingQuantitySchema = _enum(READING_QUANTITIES);
+new Set(READING_QUANTITIES);
+/**
+* Stored unit symbol for a quantity. `none` means the number is dimensionless
+* (or an index / ratio / count). `device` means the cap has no single unit.
+*/
+var QUANTITY_BASE = {
+	temperature: "°C",
+	pressure: "hPa",
+	speed: "m/s",
+	precipitation: "mm",
+	"precipitation-rate": "mm/h",
+	length: "m",
+	area: "m²",
+	illuminance: "lx",
+	irradiance: "W/m²",
+	power: "W",
+	energy: "kWh",
+	voltage: "V",
+	current: "A",
+	"apparent-power": "VA",
+	humidity: "%",
+	percentage: "%",
+	"concentration-volume": "ppm",
+	"concentration-mass": "µg/m³",
+	"concentration-ppb": "ppb",
+	volume: "L",
+	duration: "s",
+	"duration-ms": "ms",
+	information: "B",
+	"sound-level": "dBFS",
+	"signal-level": "dBm",
+	"colour-temperature": "mired",
+	angle: "°",
+	bitrate: "kbps",
+	rate: "fps",
+	mass: "kg",
+	index: "none",
+	ratio: "none",
+	count: "none",
+	none: "none",
+	device: "device"
+};
+/** The stored unit, or `undefined` when the quantity has no unit symbol. */
+function baseUnitOf(quantity) {
+	const symbol = QUANTITY_BASE[quantity];
+	if (symbol === "none" || symbol === "device") return void 0;
+	return symbol;
+}
+function readingMeta(quantity, extras) {
+	return {
+		quantity,
+		...extras?.precision !== void 0 ? { precision: extras.precision } : {},
+		...extras?.label !== void 0 ? { label: extras.label } : {}
+	};
+}
+/** Shared Zod schemas used across streaming capabilities. */
+var CamProfileSchema = _enum([
+	"high",
+	"mid",
+	"low"
+]);
+/**
+* Which rung a per-camera consumer listens on: an explicit profile, or `auto`.
+*
+* `auto` is a REAL value, not an absent one — it means "resolve it by the rule
+* that consumer owns". It lives beside `CamProfile` because a rung is the only
+* operator-facing way to name a stream: a cam-stream id is broker-internal and
+* moves when a slot is reassigned, so a stored id silently stops meaning what
+* the operator picked. Today's one user is the audio analyser, whose rule is
+* "the lowest AVAILABLE native rung" (D537).
+*/
+var AudioStreamPickSchema = union([CamProfileSchema, literal("auto")]);
+var CamStreamKindSchema = _enum([
+	"pull-rtsp",
+	"pull-rtmp",
+	"pull-http",
+	"pull-flv",
+	"pull-rfc4571",
+	"push-annexb",
+	"derived"
+]);
+var CamStreamResolutionSchema = object({
+	width: number().int().positive().meta(readingMeta("none")),
+	height: number().int().positive().meta(readingMeta("none"))
+});
+var CameraStreamSchema = object({
+	/** Stable, provider-assigned id unique within the (deviceId) scope. */
+	camStreamId: string().min(1),
+	deviceId: number().int().nonnegative(),
+	kind: CamStreamKindSchema,
+	/** Required for pull-* kinds. Ignored for push-annexb. */
+	url: string().optional(),
+	codec: string().optional(),
+	resolution: CamStreamResolutionSchema.optional(),
+	fps: number().positive().optional(),
+	/** Human label surfaced in the Admin UI "Camera Stream" dropdown. */
+	label: string().optional(),
+	/**
+	* Device-level features the publisher advertised (e.g. `battery-operated`).
+	* The broker, snapshot orchestrator, and prebuffer manager all consult
+	* this list to derive policy — relaxed stall watchdog for battery
+	* cams, prebuffer off by default, longer snapshot rate-limit, etc.
+	*
+	* Single source of truth replacing per-stream flags like the
+	* historical `allowStall`: if the publisher knows the camera is
+	* battery-powered, every downstream service derives the right policy
+	* from this list.
+	*/
+	deviceFeatures: array(string()).optional(),
+	/**
+	* Whether this stream participates in the broker's automatic profile
+	* assignment (`computeInitialAssignment`). Defaults to `true`. Publishers
+	* use `false` when they want a stream to be SELECTABLE in the UI but not
+	* picked by default — e.g. Reolink publishes its native Baichuan streams
+	* as `autoEligible: true` (the recommended path) and its RTSP / RTMP
+	* mirrors as `autoEligible: false` (still pickable per slot, just not
+	* the auto choice). Manual `assignProfile` calls remain valid for
+	* non-eligible streams.
+	*/
+	autoEligible: boolean().optional(),
+	/**
+	* The profile slot the PUBLISHER says this stream is: `low` for a stream
+	* whose only sensible role is the low-bandwidth one, `high` for a main
+	* stream. Consulted by the broker's automatic ranking
+	* (`rankInitialAssignment`) BEFORE the pixel-count heuristic, and only there:
+	* an operator's manual assignment still wins, and an absent hint is the
+	* pixel-ranked default every camera had before this field existed.
+	*
+	* Why it exists: a camera with ONE stream ranked to `mid` — the slot no
+	* storage class is written for on its own (`recordings` is high|mid,
+	* `recordingsLow` is low) and the one profile scrub does not read. The robot
+	* camera's single 720p relay is a `low` in every respect except the slot the
+	* heuristic put it in.
+	*/
+	profileHint: CamProfileSchema.optional(),
+	/**
+	* Transport-specific opaque metadata. The broker passes it through to
+	* the source reader without inspecting it. Currently used by
+	* `pull-rfc4571` streams to carry the upstream SDP (so the reader can
+	* route RTP packets to the right depacketizer without an in-band
+	* DESCRIBE phase). Other kinds typically leave it undefined.
+	*/
+	metadata: record(string(), unknown()).optional()
+});
+var ProfileSlotStatusSchema = _enum([
+	"unassigned",
+	"idle",
+	"connecting",
+	"streaming",
+	"error"
+]);
+var ProfileSlotSchema = object({
+	deviceId: number().int().nonnegative(),
+	profile: CamProfileSchema,
+	/** Broker id the rest of the system addresses: `${deviceId}/${profile}`. */
+	brokerId: string(),
+	/** `null` when the profile is unassigned. */
+	sourceCamStreamId: string().nullable(),
+	status: ProfileSlotStatusSchema,
+	resolution: CamStreamResolutionSchema.optional(),
+	codec: string().optional(),
+	preBufferSec: number().nonnegative().optional(),
+	errorMessage: string().optional()
+});
+/**
+* Zod schema for StreamSourceEntry — the canonical stream descriptor
+* exposed by ICameraDevice.getStreamSources() and consumed by the broker.
+*/
+var StreamSourceEntrySchema$1 = object({
+	id: string(),
+	label: string(),
+	protocol: _enum([
+		"rtsp",
+		"rtmp",
+		"annexb",
+		"http-mjpeg",
+		"webrtc",
+		"custom"
+	]),
+	url: string().optional(),
+	resolution: object({
+		width: number(),
+		height: number()
+	}).readonly().optional(),
+	fps: number().optional(),
+	bitrate: number().optional(),
+	codec: string().optional(),
+	profileHint: CamProfileSchema.optional()
+});
+object({
+	type: string(),
+	url: string(),
+	videoCodec: string().optional(),
+	audioCodec: string().optional(),
+	metadata: record(string(), unknown()).readonly().optional()
+});
+/**
+* Wire schema for `FrameHandle` — a zero-pixel, serialisable reference to a
+* frame in a shared-memory ring (Phase 5 / D9). Mirrors the `FrameHandle` TS
+* interface in `interfaces/frame-handle.ts` field-for-field so a cap method
+* (the runner's native-crop and pipeline-executor inputs) can carry handles
+* over tRPC / Moleculer.
+*
+* The `satisfies` assertion below pins this schema to the interface: if a
+* field is added to / removed from `FrameHandle` without a matching schema
+* edit, `z.infer<typeof FrameHandleSchema>` stops being assignable to
+* `FrameHandle` and the build fails — no silent drift.
+*/
+var FrameHandleSchema = object({
+	shmId: string(),
+	slot: number().int().nonnegative(),
+	seq: number().int().nonnegative(),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum([
+		"jpeg",
+		"rgb",
+		"bgr",
+		"yuv420",
+		"gray"
+	]),
+	pts: number(),
+	byteLength: number().int().nonnegative(),
+	nodeId: string(),
+	slotCount: number().int().positive()
+});
+/**
+* Wire schema for a decoded audio chunk (Phase 5 / D9). Mirrors the
+* `DecodedAudioChunk` TS interface in `interfaces/stream-broker.ts`: PCM
+* sample bytes plus the track parameters a consumer needs to interpret them.
+*
+* Audio chunks are tiny (a ~500ms AudioCodecSession window is a few KB of
+* Float32 PCM), so unlike video frames they ship their bytes INLINE over
+* tRPC / Moleculer — no shared-memory plane. `data` is typed `Uint8Array`
+* (the wire-serialisable supertype of `Buffer`); a `Buffer` is assignable to
+* it.
+*/
+var AudioChunkFormatSchema = _enum(AUDIO_CHUNK_FORMATS);
+var DecodedAudioChunkSchema = object({
+	data: _instanceof(Uint8Array),
+	sampleRate: number().int().positive(),
+	channels: number().int().positive(),
+	timestamp: number(),
+	/**
+	* Byte format of `data`. ABSENT MEANS `f32le` — today's bytes, byte for
+	* byte, for any peer that never heard of this field. A coded window
+	* (`pcmu` / `pcma`, one byte per sample) is only ever emitted to a
+	* subscription that DECLARED it accepts one, so absence can never mean
+	* "coded bytes a consumer will read as floats" (D455).
+	*/
+	format: AudioChunkFormatSchema.optional()
+});
+/**
+* Input for `stream-broker.subscribeAudioChunks` (Phase 5 / D9). Audio ships
+* its bytes inline: a consumer asks the broker for the decoded audio-chunk
+* stream of one broker; the broker keeps a per-subscription bounded FIFO queue
+* the consumer drains via `pullAudioChunks`.
+*/
+var SubscribeAudioChunksInputSchema = object({
+	brokerId: string(),
+	/** Short caller-identity tag (`audio-analyzer`, …) for `listClients`. */
+	tag: string().optional(),
+	/**
+	* Byte formats this subscriber can READ, best first. The broker serves the
+	* chunk's own format when it is in this list and expands to `f32le`
+	* otherwise, so a subscriber is never handed bytes it cannot interpret.
+	*
+	* Absent (or without the source format) means `f32le` — the behaviour every
+	* subscriber had before D455, unchanged. This is the negotiation half of
+	* the source-bytes lever: it is what lets the broker and its consumers
+	* deploy one at a time across three nodes.
+	*/
+	accept: array(AudioChunkFormatSchema).readonly().optional()
+});
+/** Result of `stream-broker.subscribeAudioChunks`. */
+var SubscribeAudioChunksResultSchema = object({ 
+/** Opaque id passed to `pullAudioChunks` / `unsubscribeAudioChunks`. */
+subscriptionId: string() });
+var BrokerStatsSchema = object({
+	status: _enum([
+		"idle",
+		"connecting",
+		"streaming",
+		"error",
+		"stopped"
+	]),
+	inputFps: number(),
+	encodedSubscribers: number(),
+	uptimeMs: number(),
+	bitrateKbps: number(),
+	idrIntervalMs: number(),
+	codec: string().optional(),
+	totalBytes: number(),
+	packetCount: number(),
+	rtspClients: number(),
+	pipeClients: number(),
+	preBufferSec: number(),
+	preBufferMs: number(),
+	preBufferPackets: number(),
+	/**
+	* Detected audio track parameters from the RTSP DESCRIBE / SDP. `null`
+	* when the stream has no audio track or the broker is in cold start.
+	* `supported = false` means the codec was detected but the local
+	* decoder pipeline cannot produce PCM chunks (e.g. AAC without the
+	* AAC pipeline wired). Surfaced in the UI device-overview so operators
+	* can pre-pick the audio-analysis model that matches the codec.
+	*/
+	audio: object({
+		codec: string(),
+		sampleRate: number(),
+		channels: number(),
+		supported: boolean()
+	}).nullable().optional(),
+	/**
+	* BROKER-SIDE AUDIO MUTE (D83). `true` = this broker is deliberately
+	* distributing none of the device's audio, on live or recording.
+	*
+	* Present so a silent camera can be told apart from a broken one on the
+	* stream panel itself, without cross-referencing the switch group: a
+	* broker holding an `audio` track descriptor while `audioMuted` is true is
+	* working exactly as asked. `audioMutedDropped` counts the audio units
+	* thrown away since the current dial — it is how you confirm from stats
+	* alone that the mute is on the packet path and not merely persisted.
+	*/
+	audioMuted: boolean().optional(),
+	audioMutedDropped: number().optional()
+});
+/**
+* Exporter-facing "profile restream" entry. Returned by
+* `cameraStreams.getProfileRtspEntries` — one per ASSIGNED profile slot
+* (high/mid/low). `brokerId` is the PROFILE-keyed broker id
+* (`${deviceId}/${profile}`, e.g. `15/high`); its `url` is a broker
+* RTSP restream that aliases the profile's assigned source broker, so
+* every consumer dialling a profile converges on the same single pull.
+* `codec`/`resolution` describe the assigned SOURCE camStream (for the
+* `auto` resolution-closest pick). Distinct from `RtspRestreamEntry`
+* (raw per-camStream, live-view only).
+*/
+var ProfileRtspEntrySchema = object({
+	profile: CamProfileSchema,
+	/** Profile-keyed broker id, format `${deviceId}/${profile}` (e.g. `"15/high"`). */
+	brokerId: string(),
+	url: string(),
+	mutedUrl: string(),
+	enabled: boolean(),
+	codec: string().optional(),
+	resolution: CamStreamResolutionSchema.optional()
+});
+/**
+* The model weight formats a catalog entry can ship. Schema-free on purpose:
+* `types/models.ts` builds Zod schemas from it, but a runner-closure consumer
+* (the model downloader in `@camstack/server/system`) needs only the list and must
+* reach it through `@camstack/types/addon` without building the cap schema
+* graph (D28).
+*/
+var MODEL_FORMATS = [
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
+];
 /**
 * `addon-pages-source` — collection cap exposing per-provider raw page
 * declarations. Every addon that contributes a UI page registers a
@@ -8873,6 +9367,7 @@ var CAP_NAMES = Object.freeze([
 	"mesh-network",
 	"meter",
 	"metrics-provider",
+	"migrations",
 	"model-convert",
 	"model-distributor",
 	"motion",
@@ -8905,6 +9400,7 @@ var CAP_NAMES = Object.freeze([
 	"plate-gallery",
 	"platform-probe",
 	"power-meter",
+	"power-source",
 	"presence",
 	"pressure-sensor",
 	"privacy-mask",
@@ -10256,6 +10752,13 @@ Object.freeze({
 			"valueType": "number"
 		}
 	],
+	"power-source": [{
+		"path": "switchOn",
+		"valueType": "boolean"
+	}, {
+		"path": "offSeconds",
+		"valueType": "number"
+	}],
 	"presence": [
 		{
 			"path": "state",
@@ -10767,379 +11270,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/err-msg-BD5buxvT.mjs
-var DeviceType = /* @__PURE__ */ function(DeviceType) {
-	DeviceType["Camera"] = "camera";
-	DeviceType["Hub"] = "hub";
-	DeviceType["Light"] = "light";
-	DeviceType["Siren"] = "siren";
-	DeviceType["Switch"] = "switch";
-	DeviceType["Sensor"] = "sensor";
-	DeviceType["Thermostat"] = "thermostat";
-	/** Air-conditioner / heat-pump climate device (HVAC) — shares the
-	*  `climate-control` cap surface with `Thermostat` but renders a
-	*  dedicated AC-appropriate control UI (mode chips, fan speed,
-	*  independent vertical/horizontal swing). Sources: native Gree, and
-	*  reusable by other AC integrations. */
-	DeviceType["Climate"] = "climate";
-	DeviceType["Button"] = "button";
-	/** Generic stateless event emitter — carries a device's EXACT declared
-	*  event vocabulary verbatim (no normalization). Installed with the
-	*  `event-emitter` cap. Sources: HA `event.*` entities (structured) and
-	*  HA bus events (e.g. `zha_event`, generic). */
-	DeviceType["EventEmitter"] = "event-emitter";
-	/** Firmware/software update entity — current vs available version,
-	*  updatable flag, update state, and an install action. Installed with
-	*  the `update` cap. Sources: Homematic firmware-update channels (and
-	*  reusable by other providers, e.g. HA `update.*` entities). */
-	DeviceType["Update"] = "update";
-	DeviceType["Generic"] = "generic";
-	/** Generic notification delivery target (HA `notify.<service>`, future
-	*  Telegram / Discord / ntfy / SMTP, …). One device per delivery
-	*  endpoint; the `notifier` cap defines the send surface. */
-	DeviceType["Notifier"] = "notifier";
-	/** Pre-recorded action sequence with optional parameters
-	*  (HA `script.*`). Runnable via `script-runner` cap. */
-	DeviceType["Script"] = "script";
-	/** Automation rule (HA `automation.*`) — enable/disable + manual
-	*  trigger surface exposed via `automation-control` cap. */
-	DeviceType["Automation"] = "automation";
-	/** Door / smart lock device (HA `lock.*`). `lock-control` cap. */
-	DeviceType["Lock"] = "lock";
-	/** Window covering, blinds, garage door, valve, etc. (HA `cover.*`,
-	*  `valve.*`). `cover` cap with sub-roles for variant. */
-	DeviceType["Cover"] = "cover";
-	/** Pipe / water / gas valve with open/close/stop and optional
-	*  position (HA `valve.*`). `valve` cap — a cover-sibling actuator
-	*  modelled on the same open/closed lifecycle. */
-	DeviceType["Valve"] = "valve";
-	/** Humidifier / dehumidifier with on/off + target humidity + mode
-	*  (HA `humidifier.*`). `humidifier` cap — a climate-family actuator
-	*  modelled on the same target / mode lifecycle. */
-	DeviceType["Humidifier"] = "humidifier";
-	/** Water heater / boiler with target temperature + operation mode +
-	*  away mode (HA `water_heater.*`). `water-heater` cap — a
-	*  climate-family actuator. */
-	DeviceType["WaterHeater"] = "water-heater";
-	/** Ceiling / standing / exhaust fan (HA `fan.*`). `fan-control` cap. */
-	DeviceType["Fan"] = "fan";
-	/** Audio / video playback endpoint (HA `media_player.*`). Disjoint from
-	*  the camera surface — those use `Camera`. `media-player` cap. */
-	DeviceType["MediaPlayer"] = "media-player";
-	/** Security panel / alarm system (HA `alarm_control_panel.*`).
-	*  `alarm-panel` cap. */
-	DeviceType["AlarmPanel"] = "alarm-panel";
-	/** Generic user-settable input (HA `number` / `input_number` / `select`
-	*  / `input_select` / `text` / `input_text` / `input_datetime`).
-	*  Sub-type via `DeviceRole`: NumericControl / SelectControl /
-	*  TextControl / DateTimeControl. */
-	DeviceType["Control"] = "control";
-	/** Person / device-tracker presence (HA `person.*`, `device_tracker.*`).
-	*  `presence` cap. */
-	DeviceType["Presence"] = "presence";
-	/** Weather provider (HA `weather.*`). Tier-3, low MVP priority.
-	*  `weather` cap. */
-	DeviceType["Weather"] = "weather";
-	/** Robot vacuum (HA `vacuum.*`). Tier-3. `vacuum-control` cap. */
-	DeviceType["Vacuum"] = "vacuum";
-	/** Robotic lawn mower (HA `lawn_mower.*`). Tier-3.
-	*  `lawn-mower-control` cap. */
-	DeviceType["LawnMower"] = "lawn-mower";
-	/** Physical HA device group — parent container for entity-children
-	*  adopted from a single HA device entry. Not renderable as a
-	*  standalone device; exists only to anchor child entities. */
-	DeviceType["Container"] = "container";
-	/** Single still-image entity (HA `image.*`). Read-only display of an
-	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
-	DeviceType["Image"] = "image";
-	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
-	*  level, battery, desiccant life, feeding state and manual-feed /
-	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
-	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
-	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
-	*  integrations sharing the same food/desiccant/hopper surface. */
-	DeviceType["PetFeeder"] = "pet-feeder";
-	/** Pet water fountain — tank level, water drunk, pump and its duty cycle.
-	*  Installed with the `pet-fountain` cap. Reaches CamStack as loose entities
-	*  of a container and is BUILT as a composed device (D967). */
-	DeviceType["PetFountain"] = "pet-fountain";
-	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
-	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
-	*  Sources: native Bosch Home Connect, reusable by similar integrations.
-	*  A plug-built dishwasher carries running-state and power instead. */
-	DeviceType["Dishwasher"] = "dishwasher";
-	/** Washing machine. A plug-built one is running while its power stays
-	*  above a threshold. No program cap — that surface is the dishwasher's. */
-	DeviceType["Washer"] = "washer";
-	/** Tumble dryer. Same plug-built running surface as {@link Washer}. */
-	DeviceType["Dryer"] = "dryer";
-	/** The physical bridge box of a vendor ecosystem (Velux KLF-200, and later
-	*  other radio-to-IP bridges). It carries the box's own facts (firmware,
-	*  address, connection state) and the actions the box really supports
-	*  (`reboot`, `device-admin-link`). Products are NOT its children — they are
-	*  adopted beside it — and its connection settings stay on the integration. */
-	DeviceType["Gateway"] = "gateway";
-	return DeviceType;
-}({});
-var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
-	DeviceFeature["BatteryOperated"] = "battery-operated";
-	DeviceFeature["Rebootable"] = "rebootable";
-	/**
-	* Device supports an on-demand re-sync of its derived spec with its
-	* upstream source — drives the generic Re-sync button. The owning
-	* provider implements the action via the `device-adoption.resync` cap.
-	*/
-	DeviceFeature["Resyncable"] = "resyncable";
-	DeviceFeature["NativeSnapshot"] = "native-snapshot";
-	DeviceFeature["DoorbellButton"] = "doorbell-button";
-	DeviceFeature["TwoWayAudio"] = "two-way-audio";
-	DeviceFeature["PanTiltZoom"] = "pan-tilt-zoom";
-	/**
-	* Camera supports the on-firmware autotrack subsystem (subject-
-	* following). Distinct from `PanTiltZoom` because not every PTZ
-	* camera ships autotrack — the admin UI uses this flag to gate
-	* the autotrack toggle / settings card without re-deriving from
-	* the cap registry. Mirrors `ptz-autotrack` cap registration:
-	* driver sets this feature when probe confirms the firmware
-	* surface, and registers the cap in the same code path.
-	*/
-	DeviceFeature["PtzAutotrack"] = "ptz-autotrack";
-	/**
-	* Accessory exposes a "trigger on motion" toggle — the parent camera's
-	* motion detection automatically activates this device. Mirrors
-	* `motion-trigger` cap registration: drivers set this feature in the
-	* same code path that calls `ctx.registerNativeCap(motionTriggerCapability, ...)`.
-	*
-	* Used by admin UI (gate the in-hero `MotionTriggerToggle` against a
-	* fast scalar without binding fetch), notifier rules, and `listAll`
-	* filters that want "all devices with on-motion behaviour".
-	*/
-	DeviceFeature["MotionTrigger"] = "motion-trigger";
-	/** Light supports rgb-triplet color via `color` cap. */
-	DeviceFeature["LightColorRgb"] = "light-color-rgb";
-	/** Light supports HSV color via `color` cap. */
-	DeviceFeature["LightColorHsv"] = "light-color-hsv";
-	/** Light supports color-temperature (mired) via `color` cap. */
-	DeviceFeature["LightColorMired"] = "light-color-mired";
-	/** Thermostat supports a `heat_cool` dual setpoint (targetLow +
-	*  targetHigh). Gates the range slider UI. */
-	DeviceFeature["ClimateDualSetpoint"] = "climate-dual-setpoint";
-	/** Thermostat exposes target humidity and/or current humidity
-	*  readings. Gates the humidity controls. */
-	DeviceFeature["ClimateHumidity"] = "climate-humidity";
-	/** Thermostat exposes a fan-mode selector. */
-	DeviceFeature["ClimateFanMode"] = "climate-fan-mode";
-	/** Thermostat exposes preset modes (eco / away / sleep / vendor). */
-	DeviceFeature["ClimatePreset"] = "climate-preset";
-	/** Thermostat exposes a vertical louver swing toggle. Gates the
-	*  vertical-swing switch in the climate UI. Independent of horizontal. */
-	DeviceFeature["ClimateSwingVertical"] = "climate-swing-vertical";
-	/** Thermostat exposes a horizontal louver swing toggle. Gates the
-	*  horizontal-swing switch in the climate UI. Independent of vertical. */
-	DeviceFeature["ClimateSwingHorizontal"] = "climate-swing-horizontal";
-	/** Cover exposes intermediate position control (0..100). Gates the
-	*  position slider UI. */
-	DeviceFeature["CoverPositionable"] = "cover-positionable";
-	/** Cover exposes slat-tilt control. Gates the tilt slider UI. */
-	DeviceFeature["CoverTilt"] = "cover-tilt";
-	/** Valve exposes intermediate position control (0..100). Gates the
-	*  position slider / drag surface UI. */
-	DeviceFeature["ValvePositionable"] = "valve-positionable";
-	/** Fan exposes a speed-percentage setter. Gates the speed slider UI. */
-	DeviceFeature["FanSpeed"] = "fan-speed";
-	/** Fan exposes a preset mode selector. */
-	DeviceFeature["FanPreset"] = "fan-preset";
-	/** Fan exposes blade direction (forward/reverse) — typical of
-	*  ceiling fans. */
-	DeviceFeature["FanDirection"] = "fan-direction";
-	/** Fan exposes an oscillation toggle. */
-	DeviceFeature["FanOscillating"] = "fan-oscillating";
-	/** Lock requires a PIN code on lock/unlock. Gates the code-entry
-	*  field on the UI lock-controls panel. */
-	DeviceFeature["LockPinRequired"] = "lock-pin-required";
-	/** Lock supports a latch-release ("open door") action distinct from
-	*  unlock. Mirrors HA `LockEntityFeature.OPEN` (bit 1) in
-	*  `supported_features`. Gates the Open Door button in the UI. */
-	DeviceFeature["LockOpen"] = "lock-open";
-	/** Media player exposes a seek-to-position surface. */
-	DeviceFeature["MediaPlayerSeek"] = "media-player-seek";
-	/** Media player exposes a volume-level setter. */
-	DeviceFeature["MediaPlayerVolume"] = "media-player-volume";
-	/** Media player exposes a mute toggle distinct from volume=0. */
-	DeviceFeature["MediaPlayerMute"] = "media-player-mute";
-	/** Media player exposes a shuffle toggle. */
-	DeviceFeature["MediaPlayerShuffle"] = "media-player-shuffle";
-	/** Media player exposes a repeat mode (off / all / one). */
-	DeviceFeature["MediaPlayerRepeat"] = "media-player-repeat";
-	/** Media player exposes a source / input selector. */
-	DeviceFeature["MediaPlayerSelectSource"] = "media-player-select-source";
-	/** Media player exposes a play-arbitrary-media surface (URL / id). */
-	DeviceFeature["MediaPlayerPlayMedia"] = "media-player-play-media";
-	/** Media player exposes next-track. */
-	DeviceFeature["MediaPlayerNext"] = "media-player-next";
-	/** Media player exposes previous-track. */
-	DeviceFeature["MediaPlayerPrevious"] = "media-player-previous";
-	/** Media player exposes stop distinct from pause. */
-	DeviceFeature["MediaPlayerStop"] = "media-player-stop";
-	/** Alarm panel requires a PIN code on arm/disarm. */
-	DeviceFeature["AlarmPinRequired"] = "alarm-pin-required";
-	/** Presence device carries GPS coordinates (lat/lng/accuracy) in
-	*  addition to a textual location. */
-	DeviceFeature["PresenceGps"] = "presence-gps";
-	/** Notifier accepts an inline / URL image attachment. */
-	DeviceFeature["NotifierImage"] = "notifier-image";
-	/** Notifier accepts a priority hint (high/normal/low). */
-	DeviceFeature["NotifierPriority"] = "notifier-priority";
-	/** Notifier accepts a free-form `data` payload for platform-specific
-	*  fields. */
-	DeviceFeature["NotifierData"] = "notifier-data";
-	/** Notifier supports interactive action buttons / callbacks. */
-	DeviceFeature["NotifierActions"] = "notifier-actions";
-	/** Notifier supports per-call recipient targeting (multi-user). */
-	DeviceFeature["NotifierRecipients"] = "notifier-recipients";
-	/** Script runner accepts a variables map on each run invocation. */
-	DeviceFeature["ScriptVariables"] = "script-variables";
-	/** Automation `trigger` accepts a skipCondition flag — fires the
-	*  automation's actions while bypassing its condition block. */
-	DeviceFeature["AutomationSkipCondition"] = "automation-skip-condition";
-	/** Robot vacuum exposes a live cleaning map (image child). Gates the
-	*  map tile in the vacuum UI. */
-	DeviceFeature["VacuumHasMap"] = "vacuum-has-map";
-	/** Robot vacuum exposes AI obstacle-detection toggles. Gates the AI
-	*  switches group. */
-	DeviceFeature["VacuumHasAi"] = "vacuum-has-ai";
-	/** Robot mower exposes a live mowing map (SVG image child). Gates the
-	*  mower map tile. */
-	DeviceFeature["MowerHasMap"] = "mower-has-map";
-	/** Robot mower exposes targeted mowing (all-area / zones / edges /
-	*  spots) — gates the Mow action + map selectors. */
-	DeviceFeature["MowerHasTargetedMowing"] = "mower-has-targeted-mowing";
-	return DeviceFeature;
-}({});
-/**
-* Semantic role a device plays within its parent. Populated by driver
-* addons when creating accessory devices (Reolink siren/floodlight/
-* PIR/chime/autotrack/doorbell, ONVIF relay outputs, …). Used by the
-* admin UI to pick icons, labels, and widgets — a `Switch` with
-* `role: Floodlight` renders as a bulb with a brightness slider,
-* whereas a `Switch` with `role: Siren` renders as a klaxon.
-*
-* Undefined for top-level devices (cameras, NVRs, hubs). Persisted in
-* sqlite as a nullable TEXT column — old rows keep working unchanged.
-*/
-var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
-	DeviceRole["Siren"] = "siren";
-	DeviceRole["Floodlight"] = "floodlight";
-	DeviceRole["Spotlight"] = "spotlight";
-	DeviceRole["PirSensor"] = "pir-sensor";
-	DeviceRole["Chime"] = "chime";
-	DeviceRole["Autotrack"] = "autotrack";
-	DeviceRole["Nightvision"] = "nightvision";
-	DeviceRole["PrivacyMask"] = "privacy-mask";
-	DeviceRole["Doorbell"] = "doorbell";
-	/** Interior blind / shade / roller blind. HA `device_class: blind|shade`. */
-	DeviceRole["CoverBlind"] = "cover-blind";
-	/** Exterior roller shutter. HA `device_class: shutter`; Homematic BROLL. */
-	DeviceRole["CoverShutter"] = "cover-shutter";
-	/** Exterior awning. HA `device_class: awning`. */
-	DeviceRole["CoverAwning"] = "cover-awning";
-	/** Curtain / drape. HA `device_class: curtain`. */
-	DeviceRole["CoverCurtain"] = "cover-curtain";
-	/** Garage door. HA `device_class: garage`. A security actuator: exports gate it. */
-	DeviceRole["CoverGarage"] = "cover-garage";
-	/** Gate. HA `device_class: gate`. A security actuator: exports gate it. */
-	DeviceRole["CoverGate"] = "cover-gate";
-	/** Door. HA `device_class: door`. A security actuator: exports gate it. */
-	DeviceRole["CoverDoor"] = "cover-door";
-	/** Window. HA `device_class: window`. */
-	DeviceRole["CoverWindow"] = "cover-window";
-	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
-	*  real Switch device for UI rendering / export adapters. */
-	DeviceRole["BinaryHelper"] = "binary-helper";
-	/** A smart plug: a `switch` whose source says it is an outlet (HA
-	*  `device_class: outlet`). The Alexa export shows it as a SMARTPLUG. */
-	DeviceRole["Outlet"] = "outlet";
-	/** Generic motion / occupancy / moving event source. Distinct from
-	*  the camera accessory PirSensor role: that one is a camera child;
-	*  this is a standalone HA / 3rd-party motion sensor. */
-	DeviceRole["MotionSensor"] = "motion-sensor";
-	DeviceRole["ContactSensor"] = "contact-sensor";
-	DeviceRole["LeakSensor"] = "leak-sensor";
-	DeviceRole["SmokeSensor"] = "smoke-sensor";
-	DeviceRole["COSensor"] = "co-sensor";
-	DeviceRole["GasSensor"] = "gas-sensor";
-	DeviceRole["TamperSensor"] = "tamper-sensor";
-	DeviceRole["VibrationSensor"] = "vibration-sensor";
-	DeviceRole["ConnectivitySensor"] = "connectivity-sensor";
-	DeviceRole["SoundSensor"] = "sound-sensor";
-	/** Fallback for `binary_sensor` without a known `device_class`. */
-	DeviceRole["BinarySensor"] = "binary-sensor";
-	DeviceRole["TemperatureSensor"] = "temperature-sensor";
-	DeviceRole["HumiditySensor"] = "humidity-sensor";
-	DeviceRole["AmbientLightSensor"] = "ambient-light-sensor";
-	DeviceRole["PressureSensor"] = "pressure-sensor";
-	/** Wind speed or direction (weather-station `wind-sensor` cap). */
-	DeviceRole["WindSensor"] = "wind-sensor";
-	/** Rain accumulation or rate (weather-station `rain-sensor` cap). */
-	DeviceRole["RainSensor"] = "rain-sensor";
-	/** UV index (weather-station `uv-sensor` cap). */
-	DeviceRole["UvSensor"] = "uv-sensor";
-	/** Solar irradiance W/m² (weather-station `solar-radiation-sensor` cap).
-	*  Distinct from AmbientLightSensor (lux). */
-	DeviceRole["SolarRadiationSensor"] = "solar-radiation-sensor";
-	/** Soil moisture % (garden/weather `soil-moisture-sensor` cap). */
-	DeviceRole["SoilMoistureSensor"] = "soil-moisture-sensor";
-	DeviceRole["PowerSensor"] = "power-sensor";
-	DeviceRole["EnergySensor"] = "energy-sensor";
-	DeviceRole["VoltageSensor"] = "voltage-sensor";
-	DeviceRole["CurrentSensor"] = "current-sensor";
-	DeviceRole["AirQualitySensor"] = "air-quality-sensor";
-	/** Battery level (numeric % via `sensor` OR low-bool via
-	*  `binary_sensor` — the cap distinguishes via the value type). */
-	DeviceRole["BatterySensor"] = "battery-sensor";
-	/** Fallback for `sensor` numeric without a known `device_class`. */
-	DeviceRole["NumericSensor"] = "numeric-sensor";
-	/** String / enum state (HA `sensor` with `state_class: enum` or
-	*  `attributes.options`). */
-	DeviceRole["EnumSensor"] = "enum-sensor";
-	/** Date / timestamp state (HA `sensor` with `device_class: timestamp`
-	*  or `date`). The slice carries the raw ISO string verbatim (hosted on
-	*  the `enum-sensor` cap); the UI renders it locale-formatted. */
-	DeviceRole["DateTimeSensor"] = "datetime-sensor";
-	/** Last-resort fallback when nothing else matches. */
-	DeviceRole["GenericSensor"] = "generic-sensor";
-	DeviceRole["NumericControl"] = "numeric-control";
-	DeviceRole["SelectControl"] = "select-control";
-	DeviceRole["TextControl"] = "text-control";
-	DeviceRole["DateTimeControl"] = "datetime-control";
-	/** Mobile push notifier (HA `notify.mobile_app_*`) — supports
-	*  rich features (image, priority, channel routing). */
-	DeviceRole["MobilePushNotifier"] = "mobile-push-notifier";
-	/** Chat / messaging service (HA `notify.telegram_*`,
-	*  `notify.discord_*`, etc.). */
-	DeviceRole["MessagingNotifier"] = "messaging-notifier";
-	/** Email-based delivery (HA `notify.smtp`, etc.). */
-	DeviceRole["EmailNotifier"] = "email-notifier";
-	/** Fallback when the notifier service name doesn't match a known
-	*  pattern. */
-	DeviceRole["GenericNotifier"] = "generic-notifier";
-	/** Emits a pulse train (infrared or RF) on request — the `ir-transmitter`
-	*  cap. A `DeviceType.Generic` device. */
-	DeviceRole["IrTransmitter"] = "ir-transmitter";
-	return DeviceRole;
-}({});
-/**
-import { errMsg } from '@camstack/types'
-* Extract a human-readable message from an unknown error value.
-* Replaces the ubiquitous `errMsg(err)` pattern.
-*/
-function errMsg(err) {
-	if (err instanceof Error) return err.message;
-	if (typeof err === "string") return err;
-	return String(err);
-}
-//#endregion
-//#region ../types/dist/composition-C7WdThmP.mjs
+//#region ../types/dist/composition-BBzVf2xd.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -12358,6 +12489,71 @@ var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
 var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
 new Set(EVENT_OWNER_TYPES);
 /**
+* What a published package needs from the rest of the install (D989).
+*
+* One published framework package (`@camstack/server`) carries the kernel, the
+* builtins and the capability contracts, so "which addon runs on which
+* framework" is a question of version, and the answer is DECLARED by the
+* package that knows it:
+*
+*   - an addon says the oldest server it runs on (`requires.server: ">=X"`);
+*   - the server says the oldest addon it works with
+*     (`requires.addons: { "@camstack/addon-x": ">=Y" }`) and the oldest shell
+*     around it (`requires.wrapper: { desktop, image }`);
+*   - a wrapper (the desktop app, the container starter) says which server
+*     range it can host, and reports its own kind and version.
+*
+* The publish workflow STAMPS these after the version bump
+* (`scripts/ci/stamp-requires.mjs`); nobody types a number by hand.
+*
+* A requirement that cannot be checked is NOT met: a shell that reports no
+* version counts as below the minimum, and an unreadable running version is
+* named in the result (a failed read is never a pass).
+*/
+/** `>=MAJOR.MINOR.PATCH[-prerelease]` — the only range shape a requirement uses. */
+var MinVersionSchema = string().regex(/^>=\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, "a minimum is written \">=X.Y.Z\"");
+object({
+	/** The oldest `@camstack/server` this package runs on. */
+	server: MinVersionSchema.optional(),
+	/** The oldest installed version of each named addon package. */
+	addons: record(string(), MinVersionSchema).optional(),
+	/** The oldest shell around the server, per shell kind. */
+	wrapper: object({
+		desktop: MinVersionSchema.optional(),
+		image: MinVersionSchema.optional()
+	}).optional()
+});
+/** One unmet requirement; each names the versions on both sides. */
+var UnmetRequirementSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("server-too-old"),
+		required: string(),
+		/** `null` — the running server version could not be read. */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("addon-too-old"),
+		packageName: string(),
+		required: string(),
+		/** `null` — the addon is not installed (or its version is unreadable). */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("wrapper-too-old"),
+		wrapper: _enum(["desktop", "image"]),
+		required: string(),
+		/** `null` — the wrapper reported no version. */
+		running: string().nullable()
+	})
+]);
+var RequiredAddonUpdateSchema = object({
+	packageName: string(),
+	/** The minimum the target server declares. */
+	required: string(),
+	/** What this node has; `null` when the addon is not installed. */
+	installed: string().nullable()
+});
+/**
 * Which integration instance a settings form is for. An addon that serves several instances
 * (`instanceMode: multiple`) can show a different form per instance — an NVR integration
 * needs its connection, the default integration needs the addon's own sections.
@@ -12832,6 +13028,613 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* Query filter for settings-store collections.
+*/
+var QueryFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
+	whereNot: record(string(), unknown()).optional(),
+	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
+	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
+	whereNotIn: record(string(), array(unknown())).optional(),
+	orderBy: object({
+		field: string(),
+		direction: _enum(["asc", "desc"])
+	}).optional(),
+	limit: number().optional(),
+	offset: number().optional()
+});
+/**
+* The predicate half of a filter, for BULK MUTATIONS.
+*
+* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
+* meaning for a statement that rewrites a set, and accepting them would invite
+* a caller to believe `limit` bounds the damage. Every field is optional here
+* only so the shape stays composable — the implementation REJECTS a filter
+* that compiles to no predicate, because that is the whole collection.
+*/
+var MutationFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	whereNot: record(string(), unknown()).optional(),
+	whereNotIn: record(string(), array(unknown())).optional()
+});
+/**
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
+*/
+var AggregateFieldSchema = object({
+	/** Result key. */
+	as: string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: string().min(1),
+	op: _enum([
+		"sum",
+		"min",
+		"max"
+	])
+});
+/**
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+*/
+var AggregateResultSchema = object({
+	count: number().int(),
+	values: record(string(), number().nullable())
+});
+/** A single stored record: `{ id, data }`. */
+var SettingsRecordSchema = object({
+	id: string(),
+	data: record(string(), unknown())
+});
+/**
+* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
+* optional.
+*
+* A separate schema rather than loosening the shared one: every other method
+* on this cap addresses a row BY its id, and making that field optional
+* everywhere would turn a forgotten key into a silently generated one on
+* `update` and `delete` as well.
+*/
+var BulkRecordSchema = object({
+	id: string().optional(),
+	data: record(string(), unknown())
+});
+/**
+* The database FILES one `sqlite-settings` engine process owns (D851).
+* Closed on purpose: a file is a thing the engine opens, backs up and gives a
+* serving thread, so a new one is a code change, never a string a caller
+* invents. `settings` is `camstack.db` and the default for every collection
+* that names no file.
+*/
+var DataStoreDatabaseSchema = _enum([
+	"settings",
+	"events",
+	"history"
+]);
+DataStoreDatabaseSchema.options;
+/**
+* One write inside a {@link settingsStoreCapability.methods.transact} call.
+* The three that a "replace this set, bump that revision" write needs, plus
+* the batched upsert a rollup writer needs.
+*/
+var TransactOpSchema = discriminatedUnion("op", [
+	object({
+		op: literal("deleteWhere"),
+		collection: string(),
+		filter: MutationFilterSchema
+	}),
+	object({
+		op: literal("insertMany"),
+		collection: string(),
+		records: array(BulkRecordSchema).readonly()
+	}),
+	object({
+		op: literal("update"),
+		collection: string(),
+		id: string(),
+		data: record(string(), unknown())
+	}),
+	object({
+		op: literal("upsertMany"),
+		collection: string(),
+		conflict: array(string()).readonly(),
+		records: array(BulkRecordSchema).readonly()
+	})
+]);
+/**
+* The precondition of a transaction: the row `key` of `collection` must hold
+* `equals` in `column`, read INSIDE the transaction.
+*/
+var TransactGuardSchema = object({
+	collection: string(),
+	key: string(),
+	column: string(),
+	equals: unknown()
+});
+/**
+* Column declaration for a structured (SQL-backed) collection.
+*
+* Logical types — the backend translates each to the matching SQLite
+* storage class and handles per-type marshaling:
+*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
+*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
+*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
+*/
+var CollectionColumnSchema = object({
+	name: string(),
+	type: _enum([
+		"TEXT",
+		"INTEGER",
+		"REAL",
+		"JSON",
+		"BOOLEAN"
+	]),
+	primaryKey: boolean().optional(),
+	notNull: boolean().optional(),
+	unique: boolean().optional(),
+	/**
+	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
+	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
+	* collection surface simply cannot express their existing tables — which is
+	* why they were still on the uncapped `table*` API.
+	*/
+	defaultValue: union([
+		string(),
+		number(),
+		boolean()
+	]).optional()
+});
+var CollectionIndexSchema = object({
+	name: string(),
+	columns: array(string()).readonly(),
+	unique: boolean().optional()
+});
+/**
+* The input of `declareCollection` — ONE schema for the door and for the
+* engine behind it, so the two surfaces cannot drift (the dispatcher forwards
+* the payload untouched).
+*
+* - `database` — the file the collection lives in (D851). Absent means
+*   `settings`. A declaration naming a file other than the one the table is
+*   already in is REFUSED by the engine, never moved.
+* - `primaryKey` — a COMPOSITE key, as column names. A single name is the same
+*   as `primaryKey: true` on that column. A composite-keyed collection has no
+*   `id`: it is written with `insertMany` / `upsertMany` / `transact` and read
+*   with `query` / `count` / `aggregate` / `deleteWhere`; the calls that
+*   address one row by id are refused.
+* - `withoutRowid` — emit `WITHOUT ROWID`. Requires a primary key.
+*/
+var DeclareCollectionInputSchema = object({
+	namespace: string().optional(),
+	collection: string(),
+	columns: array(CollectionColumnSchema).readonly(),
+	indexes: array(CollectionIndexSchema).readonly().optional(),
+	database: DataStoreDatabaseSchema.optional(),
+	primaryKey: array(string()).readonly().optional(),
+	withoutRowid: boolean().optional()
+});
+method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), unknown(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string(),
+	value: unknown()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional(),
+	columns: array(string()).readonly().optional()
+}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	/** Declared columns identifying the slot; must be covered by a UNIQUE
+	*  index on the collection. Never empty. */
+	conflict: array(string()).readonly(),
+	record: BulkRecordSchema
+}), object({ 
+/** The id the row HAS: assigned by SQLite on an insert, or the existing
+*  row's own id on an update. */
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	conflict: array(string()).readonly(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ upserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	record: object({
+		id: string().optional(),
+		data: record(string(), unknown())
+	})
+}), object({ 
+/**
+* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
+* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
+* primary key — which is the only place an auto key is knowable.
+*/
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ inserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	guard: TransactGuardSchema.optional(),
+	ops: array(TransactOpSchema).readonly()
+}), object({
+	applied: boolean(),
+	current: unknown().optional()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	id: string(),
+	data: record(string(), unknown())
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema
+}), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema,
+	data: record(string(), unknown())
+}), object({ updated: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), number(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema, { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	field: string(),
+	bucketSize: number().int().positive(),
+	origin: number().int(),
+	filter: QueryFilterSchema.optional()
+}), array(object({
+	bucket: number().int(),
+	count: number().int()
+})).readonly(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string()
+}), boolean(), { auth: "admin" }), method(DeclareCollectionInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+var MigrationIdSchema = string().regex(/^[a-z0-9-]+\/\d{4}-\d{2}-\d{2}-[a-z0-9-]+$/, "a migration id is \"<owner>/<yyyy-mm-dd>-<slug>\"");
+var MigrationLevelSchema = _enum([
+	"hub-store",
+	"addon-state",
+	"node-config",
+	"viewer",
+	"addon-internal"
+]);
+var MigrationStoreSchema = _enum([
+	"settings",
+	"events",
+	"history",
+	"node-local",
+	"addon-files"
+]);
+var MigrationScopeSchema = _enum(["cluster", "per-node"]);
+/** What depends on a migration while it is pending: `block-owner` is the default. */
+var MigrationOnFailureSchema = _enum(["block-owner", "tolerate"]);
+/**
+* `sql` is a hub-only body over the owner's connection. `plan` returns edits the
+* engine applies inside the migration's own transaction (hub-owned: computed in
+* that transaction; addon-owned: computed by the owner and shipped to the engine).
+* `procedure` is addon-owned work that is not SQL (keychain, integration registry,
+* device tombstones); the ledger records its outcome and it must be idempotent.
+*/
+var MigrationBodyKindSchema = _enum([
+	"sql",
+	"plan",
+	"procedure"
+]);
+var MigrationMetaSchema = object({
+	id: MigrationIdSchema,
+	/** `hub`, an addon id, `node` or `viewer`. */
+	owner: string().regex(/^[a-z0-9-]+$/),
+	level: MigrationLevelSchema,
+	/** Strictly increasing per owner: the order within an owner. */
+	seq: number().int().positive(),
+	/** Ids of any owner: the order across owners. */
+	dependsOn: array(MigrationIdSchema),
+	store: MigrationStoreSchema,
+	scope: MigrationScopeSchema,
+	onFailure: MigrationOnFailureSchema,
+	bodyKind: MigrationBodyKindSchema,
+	description: string().min(1),
+	/** The marked field the migration's spec must assert survived. */
+	fixtureMark: string().min(1)
+}).refine((m) => m.id.startsWith(`${m.owner}/`), {
+	message: "the id must start with \"<owner>/\"",
+	path: ["id"]
+});
+/** A cycle in the dependency graph, named by the ids on it. */
+var MigrationCycleError = class extends Error {
+	ids;
+	constructor(ids) {
+		super(`migration dependsOn cycle: ${ids.join(" -> ")}`);
+		this.ids = ids;
+		this.name = "MigrationCycleError";
+	}
+};
+/**
+* Topological order over `dependsOn` plus the implicit edge "a lower `seq` of an
+* owner runs first". Ties are broken by `(owner, seq)`. Throws
+* {@link MigrationCycleError} on a cycle. A `dependsOn` id that is not in the list
+* is ignored here — the catalogue schema is what refuses it.
+*/
+function orderMigrations(items) {
+	const byId = new Map(items.map((item) => [item.id, item]));
+	const deps = /* @__PURE__ */ new Map();
+	const ownerSorted = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const list = ownerSorted.get(item.owner) ?? [];
+		list.push(item);
+		ownerSorted.set(item.owner, list);
+	}
+	for (const item of items) deps.set(item.id, new Set(item.dependsOn.filter((id) => byId.has(id))));
+	for (const list of ownerSorted.values()) {
+		list.sort((a, b) => a.seq - b.seq);
+		for (let i = 1; i < list.length; i++) {
+			const previous = list[i - 1];
+			const current = list[i];
+			if (previous !== void 0 && current !== void 0) deps.get(current.id)?.add(previous.id);
+		}
+	}
+	const tie = (a, b) => a.owner < b.owner ? -1 : a.owner > b.owner ? 1 : a.seq - b.seq;
+	const done = /* @__PURE__ */ new Set();
+	const ordered = [];
+	let remaining = [...items];
+	while (remaining.length > 0) {
+		const ready = remaining.filter((item) => [...deps.get(item.id) ?? []].every((dep) => done.has(dep)));
+		if (ready.length === 0) throw new MigrationCycleError(remaining.map((item) => item.id).sort());
+		ready.sort(tie);
+		const next = ready[0];
+		if (next === void 0) break;
+		ordered.push(next);
+		done.add(next.id);
+		remaining = remaining.filter((item) => item.id !== next.id);
+	}
+	return ordered;
+}
+/** Every way a list of migrations (in declaration order) is not a catalogue. */
+function catalogueIssues(items) {
+	const issues = [];
+	const seen = /* @__PURE__ */ new Set();
+	const known = new Set(items.map((item) => item.id));
+	const lastSeq = /* @__PURE__ */ new Map();
+	const seqUsed = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		if (seen.has(item.id)) issues.push({
+			code: "duplicate-id",
+			ids: [item.id],
+			message: `duplicate id ${item.id}`
+		});
+		seen.add(item.id);
+		const used = seqUsed.get(item.owner) ?? /* @__PURE__ */ new Set();
+		if (used.has(item.seq)) issues.push({
+			code: "duplicate-seq",
+			ids: [item.id],
+			message: `owner ${item.owner} has two migrations with seq ${item.seq}`
+		});
+		else if (item.seq < (lastSeq.get(item.owner) ?? 0)) issues.push({
+			code: "seq-order",
+			ids: [item.id],
+			message: `seq ${item.seq} of ${item.id} does not increase in declaration order (owner ${item.owner})`
+		});
+		used.add(item.seq);
+		seqUsed.set(item.owner, used);
+		lastSeq.set(item.owner, Math.max(item.seq, lastSeq.get(item.owner) ?? 0));
+		for (const dep of item.dependsOn) if (!known.has(dep)) issues.push({
+			code: "unknown-dependency",
+			ids: [item.id, dep],
+			message: `${item.id} dependsOn unknown id ${dep}`
+		});
+	}
+	try {
+		orderMigrations(items);
+	} catch (err) {
+		if (err instanceof MigrationCycleError) issues.push({
+			code: "cycle",
+			ids: err.ids,
+			message: err.message
+		});
+		else throw err;
+	}
+	return issues;
+}
+array(MigrationMetaSchema).superRefine((items, ctx) => {
+	for (const issue of catalogueIssues(items)) ctx.addIssue({
+		code: "custom",
+		message: `${issue.code}: ${issue.message}`
+	});
+});
+/**
+* The canonical JSON (`preconditionOf`) of the value a plan read; the apply step
+* re-reads, and a plan whose read no longer matches is refused (the migration is
+* `failed`, nothing it edited is kept).
+*/
+var PreconditionSchema = string().min(1).optional();
+var MigrationPlanSchema = object({ edits: array(discriminatedUnion("op", [
+	object({
+		op: literal("setKeys"),
+		scope: string().min(1),
+		values: record(string(), unknown()),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("deleteKeys"),
+		scope: string().min(1),
+		keys: array(string().min(1)).min(1),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("putRow"),
+		table: string().min(1),
+		key: record(string(), unknown()),
+		row: record(string(), unknown()),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("deleteRow"),
+		table: string().min(1),
+		key: record(string(), unknown()),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("upsertRecord"),
+		kind: string().min(1),
+		recordKey: string().min(1),
+		value: unknown(),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("deleteRecord"),
+		kind: string().min(1),
+		recordKey: string().min(1),
+		precondition: PreconditionSchema
+	})
+])) });
+/**
+* What a `procedure` body reports. `already-done` means the rerun observed the
+* work finished (a crash between the work and the ledger row, or a manual fix)
+* and did none of it again; the ledger records `applied` either way.
+*/
+var MigrationProcedureResultSchema = object({
+	outcome: _enum(["done", "already-done"]),
+	summary: record(string(), unknown())
+});
+/** What an owner hands the engine when one of its migrations ran. */
+var MigrationOwnerResultSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("plan"),
+		plan: MigrationPlanSchema
+	}),
+	object({
+		kind: literal("procedure"),
+		result: MigrationProcedureResultSchema
+	}),
+	object({
+		kind: literal("failed"),
+		error: string().min(1)
+	})
+]);
+/**
+* `held`: a restore of a pre-migration snapshot undid this id; it does not rerun
+* until the operator retries or a new code version ships.
+* `skipped-newer`: the database knows an id this code does not.
+*/
+var MigrationStatusSchema = _enum([
+	"applied",
+	"failed",
+	"blocked",
+	"running",
+	"held",
+	"skipped-newer"
+]);
+var MigrationLedgerEntrySchema = object({
+	id: string(),
+	database: DataStoreDatabaseSchema,
+	owner: string(),
+	level: MigrationLevelSchema,
+	seq: number().int().nonnegative(),
+	status: MigrationStatusSchema,
+	attempts: number().int().nonnegative(),
+	appliedAt: number().nullable(),
+	codeVersion: string().nullable(),
+	/** What the apply changed: rows per table, as the engine counted them. */
+	planSummary: record(string(), unknown()).nullable(),
+	progress: record(string(), unknown()).nullable(),
+	error: string().nullable(),
+	/** Why it is `blocked` or `held` (`dependency-failed`, `snapshot-refused`, …). */
+	reason: string().nullable(),
+	nodeId: string().nullable(),
+	bootId: string().nullable()
+});
+/** A catalogued migration that is not applied, with where it stands. */
+var MigrationPendingEntrySchema = object({
+	meta: MigrationMetaSchema,
+	database: DataStoreDatabaseSchema,
+	state: _enum([
+		"pending",
+		"failed",
+		"blocked",
+		"held"
+	]),
+	reason: string().nullable()
+});
+/** Rows per table before and after a dry run, and what it would have changed. */
+var MigrationDryRunResultSchema = object({
+	id: string(),
+	ok: boolean(),
+	error: string().nullable(),
+	rowsChanged: number().int().nonnegative(),
+	tables: array(object({
+		table: string(),
+		before: number().int().nonnegative(),
+		after: number().int().nonnegative()
+	}))
+});
+/** One of an owner's migrations, as the engine tells the owner to treat it this boot. */
+var MigrationOwnerStepSchema = object({
+	id: MigrationIdSchema,
+	action: _enum(["run", "skip"]),
+	/** The ledger state the engine found: `pending` has no row yet. */
+	state: union([literal("pending"), MigrationStatusSchema])
+});
+/**
 * The trainer contract — what the hub hands the cloud trainer and what it
 * gets back (cloud training, D805+).
 *
@@ -16234,6 +17037,41 @@ var ACTUATOR_CAP_VOCABULARY = {
 			icon: "droplets"
 		}]
 	},
+	"power-source": {
+		scope: "device",
+		noun: t("Power source", "Alimentazione"),
+		actions: [
+			{
+				id: "powerSource.on",
+				method: "powerOn",
+				label: t("Power on", "Dai corrente"),
+				phrase: t("Power on {device}", "Dai corrente a {device}"),
+				icon: "power"
+			},
+			{
+				id: "powerSource.off",
+				method: "powerOff",
+				label: t("Power off", "Togli corrente"),
+				phrase: t("Cut the power of {device}", "Togli la corrente a {device}"),
+				icon: "power-off"
+			},
+			{
+				id: "powerSource.forceRestart",
+				method: "forceRestart",
+				label: t("Force restart", "Riavvio forzato"),
+				phrase: t("Force restart {device} by cutting its power", "Riavvia {device} togliendo la corrente"),
+				icon: "refresh-cw"
+			}
+		],
+		state: [{
+			kind: "boolean",
+			field: "switchOn",
+			label: t("Power switch on", "Presa accesa"),
+			whenTrue: t("When the power of {device} comes on", "Quando arriva la corrente a {device}"),
+			whenFalse: t("When the power of {device} is cut", "Quando manca la corrente a {device}"),
+			icon: "power"
+		}]
+	},
 	"lock-control": {
 		scope: "device",
 		noun: t("Lock", "Serratura"),
@@ -16709,7 +17547,7 @@ var ACTUATOR_CAP_VOCABULARY = {
 				method: "setDirection",
 				label: t("Spin forward", "Rotazione avanti"),
 				phrase: t("Spin {device} forward", "Fai girare {device} in avanti"),
-				icon: "rotate-cw",
+				icon: "refresh-cw",
 				effect: {
 					field: "direction",
 					value: "forward"
@@ -19787,6 +20625,7 @@ var SYSTEM_CAP_VOCABULARY = {
 	"login-method": system(IDENTITY),
 	"mesh-network": system(NETWORK),
 	"metrics-provider": system(CLUSTER),
+	migrations: system(INTERNAL),
 	"model-convert": system(ML),
 	"model-distributor": system(ML),
 	"mqtt-broker": system(NETWORK),
@@ -39989,7 +40828,8 @@ function normalizeUnit(raw) {
 	if (lower === "dbm") return "dBm";
 	if (lower === "dbfs") return "dBFS";
 	if (lower === "inhg") return "inHg";
-	if (lower === "mm/h") return "mm/h";
+	if (lower === "mm/h" || lower === "mm/hr") return "mm/h";
+	if (lower === "in/h" || lower === "in/hr") return "in/h";
 	if (lower === "w/m²" || lower === "w/m2") return "W/m²";
 	if (lower === "°" || lower === "deg" || lower === "degree" || lower === "degrees") return "°";
 	if (lower === "kbps") return "kbps";
@@ -42208,7 +43048,7 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 * rebuilds without manual reload.
 *
 * The hub-local builtin `addon-pages-aggregator` (see
-* `@camstack/system/builtins/addon-pages-aggregator`) registers the
+* `@camstack/server/system/builtins/addon-pages-aggregator`) registers the
 * provider. Splitting the public aggregator from the raw collection
 * keeps both ends in codegen — there's no hand-written
 * `addon-pages.router.ts` wrapper anymore.
@@ -42508,7 +43348,7 @@ method(_void(), array(WidgetMetadataSchema).readonly(), { auth: "admin" });
 * manual reload — same scheme used by `addon-pages`.
 *
 * The hub-local builtin `addon-widgets-aggregator` (see
-* `@camstack/system/builtins/addon-widgets-aggregator`) registers the
+* `@camstack/server/system/builtins/addon-widgets-aggregator`) registers the
 * provider. Splitting the public aggregator from the raw collection
 * keeps both ends in codegen — there's no hand-written wrapper.
 */
@@ -42869,329 +43709,6 @@ method(object({
 	password: string()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
-* Query filter for settings-store collections.
-*/
-var QueryFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
-	whereNot: record(string(), unknown()).optional(),
-	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
-	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
-	whereNotIn: record(string(), array(unknown())).optional(),
-	orderBy: object({
-		field: string(),
-		direction: _enum(["asc", "desc"])
-	}).optional(),
-	limit: number().optional(),
-	offset: number().optional()
-});
-/**
-* The predicate half of a filter, for BULK MUTATIONS.
-*
-* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
-* meaning for a statement that rewrites a set, and accepting them would invite
-* a caller to believe `limit` bounds the damage. Every field is optional here
-* only so the shape stays composable — the implementation REJECTS a filter
-* that compiles to no predicate, because that is the whole collection.
-*/
-var MutationFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	whereNot: record(string(), unknown()).optional(),
-	whereNotIn: record(string(), array(unknown())).optional()
-});
-/**
-* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
-*
-* `as` names the slot in the result, so the SAME column may be asked twice with
-* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
-* a `Record<column, op>` shape could not express.
-*/
-var AggregateFieldSchema = object({
-	/** Result key. */
-	as: string().min(1),
-	/** Column to aggregate. Must be a real column of a declared collection. */
-	field: string().min(1),
-	op: _enum([
-		"sum",
-		"min",
-		"max"
-	])
-});
-/**
-* `COUNT(*)` plus one number per requested field.
-*
-* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
-* that really is 0 are different facts, and an accounting caller that renders
-* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
-*/
-var AggregateResultSchema = object({
-	count: number().int(),
-	values: record(string(), number().nullable())
-});
-/** A single stored record: `{ id, data }`. */
-var SettingsRecordSchema = object({
-	id: string(),
-	data: record(string(), unknown())
-});
-/**
-* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
-* optional.
-*
-* A separate schema rather than loosening the shared one: every other method
-* on this cap addresses a row BY its id, and making that field optional
-* everywhere would turn a forgotten key into a silently generated one on
-* `update` and `delete` as well.
-*/
-var BulkRecordSchema = object({
-	id: string().optional(),
-	data: record(string(), unknown())
-});
-/**
-* The database FILES one `sqlite-settings` engine process owns (D851).
-* Closed on purpose: a file is a thing the engine opens, backs up and gives a
-* serving thread, so a new one is a code change, never a string a caller
-* invents. `settings` is `camstack.db` and the default for every collection
-* that names no file.
-*/
-var DataStoreDatabaseSchema = _enum([
-	"settings",
-	"events",
-	"history"
-]);
-DataStoreDatabaseSchema.options;
-/**
-* One write inside a {@link settingsStoreCapability.methods.transact} call.
-* The three that a "replace this set, bump that revision" write needs, plus
-* the batched upsert a rollup writer needs.
-*/
-var TransactOpSchema = discriminatedUnion("op", [
-	object({
-		op: literal("deleteWhere"),
-		collection: string(),
-		filter: MutationFilterSchema
-	}),
-	object({
-		op: literal("insertMany"),
-		collection: string(),
-		records: array(BulkRecordSchema).readonly()
-	}),
-	object({
-		op: literal("update"),
-		collection: string(),
-		id: string(),
-		data: record(string(), unknown())
-	}),
-	object({
-		op: literal("upsertMany"),
-		collection: string(),
-		conflict: array(string()).readonly(),
-		records: array(BulkRecordSchema).readonly()
-	})
-]);
-/**
-* The precondition of a transaction: the row `key` of `collection` must hold
-* `equals` in `column`, read INSIDE the transaction.
-*/
-var TransactGuardSchema = object({
-	collection: string(),
-	key: string(),
-	column: string(),
-	equals: unknown()
-});
-/**
-* Column declaration for a structured (SQL-backed) collection.
-*
-* Logical types — the backend translates each to the matching SQLite
-* storage class and handles per-type marshaling:
-*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
-*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
-*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
-*/
-var CollectionColumnSchema = object({
-	name: string(),
-	type: _enum([
-		"TEXT",
-		"INTEGER",
-		"REAL",
-		"JSON",
-		"BOOLEAN"
-	]),
-	primaryKey: boolean().optional(),
-	notNull: boolean().optional(),
-	unique: boolean().optional(),
-	/**
-	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
-	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
-	* collection surface simply cannot express their existing tables — which is
-	* why they were still on the uncapped `table*` API.
-	*/
-	defaultValue: union([
-		string(),
-		number(),
-		boolean()
-	]).optional()
-});
-var CollectionIndexSchema = object({
-	name: string(),
-	columns: array(string()).readonly(),
-	unique: boolean().optional()
-});
-/**
-* The input of `declareCollection` — ONE schema for the door and for the
-* engine behind it, so the two surfaces cannot drift (the dispatcher forwards
-* the payload untouched).
-*
-* - `database` — the file the collection lives in (D851). Absent means
-*   `settings`. A declaration naming a file other than the one the table is
-*   already in is REFUSED by the engine, never moved.
-* - `primaryKey` — a COMPOSITE key, as column names. A single name is the same
-*   as `primaryKey: true` on that column. A composite-keyed collection has no
-*   `id`: it is written with `insertMany` / `upsertMany` / `transact` and read
-*   with `query` / `count` / `aggregate` / `deleteWhere`; the calls that
-*   address one row by id are refused.
-* - `withoutRowid` — emit `WITHOUT ROWID`. Requires a primary key.
-*/
-var DeclareCollectionInputSchema = object({
-	namespace: string().optional(),
-	collection: string(),
-	columns: array(CollectionColumnSchema).readonly(),
-	indexes: array(CollectionIndexSchema).readonly().optional(),
-	database: DataStoreDatabaseSchema.optional(),
-	primaryKey: array(string()).readonly().optional(),
-	withoutRowid: boolean().optional()
-});
-method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), unknown(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string(),
-	value: unknown()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional(),
-	columns: array(string()).readonly().optional()
-}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	/** Declared columns identifying the slot; must be covered by a UNIQUE
-	*  index on the collection. Never empty. */
-	conflict: array(string()).readonly(),
-	record: BulkRecordSchema
-}), object({ 
-/** The id the row HAS: assigned by SQLite on an insert, or the existing
-*  row's own id on an update. */
-id: union([string(), number()]) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	conflict: array(string()).readonly(),
-	records: array(BulkRecordSchema).readonly()
-}), object({ upserted: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	record: object({
-		id: string().optional(),
-		data: record(string(), unknown())
-	})
-}), object({ 
-/**
-* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
-* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
-* primary key — which is the only place an auto key is knowable.
-*/
-id: union([string(), number()]) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	records: array(BulkRecordSchema).readonly()
-}), object({ inserted: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	guard: TransactGuardSchema.optional(),
-	ops: array(TransactOpSchema).readonly()
-}), object({
-	applied: boolean(),
-	current: unknown().optional()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	id: string(),
-	data: record(string(), unknown())
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: MutationFilterSchema
-}), object({ deleted: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: MutationFilterSchema,
-	data: record(string(), unknown())
-}), object({ updated: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), number(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	fields: array(AggregateFieldSchema).readonly(),
-	filter: QueryFilterSchema.optional()
-}), AggregateResultSchema, { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	field: string(),
-	bucketSize: number().int().positive(),
-	origin: number().int(),
-	filter: QueryFilterSchema.optional()
-}), array(object({
-	bucket: number().int(),
-	count: number().int()
-})).readonly(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string()
-}), boolean(), { auth: "admin" }), method(DeclareCollectionInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * How long one snapshot may take end to end: the pinned copy of the whole
 * database plus `PRAGMA integrity_check` over the copy, on the hub's slowest
 * disk. ~800 MB at a pessimistic 10 MB/s is under 3 minutes; the bound is
@@ -45105,7 +45622,7 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Gateway, DeviceType.Camera, DeviceType.Lock, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Gateway, DeviceType.Camera, DeviceType.Lock, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Gateway, DeviceType.Hub, DeviceType.Camera, DeviceType.Sensor, DeviceType.MediaPlayer, DeviceType.Vacuum, DeviceType.Generic, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.PetFountain, DeviceType.Fan, DeviceType.Humidifier, DeviceType.Climate, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
 var NUMBER = {
 	kind: "fixed",
 	result: ["number"]
@@ -46116,6 +46633,57 @@ id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
 });
+method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { auth: "admin" }), method(object({ owner: string().optional() }), object({ pending: array(MigrationPendingEntrySchema) }), { auth: "admin" }), method(object({ id: string().min(1) }), MigrationDryRunResultSchema, { auth: "admin" }), method(object({
+	id: string().min(1),
+	error: string().min(1)
+}), MigrationLedgerEntrySchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), object({ entries: array(MigrationLedgerEntrySchema) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	database: DataStoreDatabaseSchema,
+	snapshotId: string().min(1)
+}), object({
+	scheduled: boolean(),
+	held: array(string()),
+	restartRequired: boolean()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	owner: string().min(1),
+	metas: array(MigrationMetaSchema)
+}), object({
+	bootId: string(),
+	snapshot: _enum([
+		"none",
+		"written",
+		"refused"
+	]),
+	steps: array(MigrationOwnerStepSchema)
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), object({
+	proceed: boolean(),
+	state: union([literal("pending"), MigrationStatusSchema]),
+	reason: string().nullable()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	id: string().min(1),
+	result: MigrationOwnerResultSchema
+}), object({
+	status: MigrationStatusSchema,
+	error: string().nullable(),
+	rowsChanged: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * records - an addon's own facts and documents (D881): ledgers, audit rows,
 * config documents, mirrors. The third storage API next to `ctx.settings`
@@ -60980,7 +61548,18 @@ var ServerUpdateActionResultSchema = object({
 	* store (D877), present when the pre-flight refused the update
 	* (`reason: 'addon-would-refuse'`). Optional for version skew.
 	*/
-	blockers: array(UpdateBlockerSchema).optional()
+	blockers: array(UpdateBlockerSchema).optional(),
+	/**
+	* The minimums the target server declares and this node does not meet
+	* (D989), present when the update was refused with
+	* `reason: 'requirements-unmet'`. Each names the versions on both sides.
+	*/
+	unmet: array(UnmetRequirementSchema).optional(),
+	/**
+	* The addons this node has below the minimum the staged server declares —
+	* the ones to update WITH the server. Present on an accepted update.
+	*/
+	requiredAddonUpdates: array(RequiredAddonUpdateSchema).optional()
 });
 var LaunchOverridesSchema = object({ 
 /** The persisted heap ceiling in MB, or `null` when none is set. */
@@ -63524,7 +64103,9 @@ var PackageUpdateSchema = object({
 	latestVersion: string(),
 	category: _enum(["addon", "core"]),
 	requiresRestart: boolean(),
-	isSystem: boolean()
+	isSystem: boolean(),
+	/** Held: what the newer version needs and this node does not meet (D989). */
+	blockedBy: array(UnmetRequirementSchema).readonly().optional()
 });
 var PackageVersionInfoSchema = object({
 	version: string(),
@@ -64980,19 +65561,19 @@ var RemoteSetConfigResultSchema = discriminatedUnion("status", [object({ status:
 	reason: _enum(["unknown-template", "not-a-media-player"]),
 	detail: string()
 })]);
-var deviceInput = object({ deviceId: number().int().nonnegative() });
+var deviceInput$1 = object({ deviceId: number().int().nonnegative() });
 DeviceType.MediaPlayer;
-method(deviceInput, RemoteConfigSchema, { auth: "admin" }), method(deviceInput.extend({ config: RemoteConfigSchema }), RemoteSetConfigResultSchema, {
+method(deviceInput$1, RemoteConfigSchema, { auth: "admin" }), method(deviceInput$1.extend({ config: RemoteConfigSchema }), RemoteSetConfigResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(deviceInput, RemoteCommandListSchema, { auth: "protected" }), method(deviceInput.extend({
+}), method(deviceInput$1, RemoteCommandListSchema, { auth: "protected" }), method(deviceInput$1.extend({
 	role: RemoteRoleSchema,
 	/** Sends in a row (volume steps). */
 	repeat: number().int().min(1).max(50).default(1)
 }), RemoteSendResultSchema, {
 	kind: "mutation",
 	auth: "protected"
-}), method(deviceInput.extend({
+}), method(deviceInput$1.extend({
 	command: RemoteMediaCommandSchema,
 	muted: boolean().optional(),
 	source: string().optional(),
@@ -68807,7 +69388,7 @@ var lawnMowerControlCapability = {
 * clients — they reverse-connect to the hub. Exposing their interfaces
 * via the same surface would leak internal topology with no upside.
 *
-* Implementation in `@camstack/system/builtins/local-network/`.
+* Implementation in `@camstack/server/system/builtins/local-network/`.
 */
 /** Coarse classification derived from the interface name + IP range. */
 var InterfaceKindEnum = _enum([
@@ -69304,6 +69885,117 @@ var lockControlCapability = {
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
 };
+var PowerSourceRefusalReasonSchema = _enum([
+	"no-power-source",
+	"switch-missing",
+	"switch-offline",
+	"switch-unknown",
+	"restart-in-progress",
+	"switch-call-failed"
+]);
+var PowerSourceActionResultSchema = discriminatedUnion("accepted", [object({ accepted: literal(true) }), object({
+	accepted: literal(false),
+	reason: PowerSourceRefusalReasonSchema,
+	/** One line for the operator, naming the switch. */
+	message: string()
+})]);
+var PowerSourceInfoSchema = object({
+	/** False when the device has no power source linked; the rest is then empty. */
+	linked: boolean(),
+	switchDeviceId: number().nullable(),
+	switchName: string().nullable(),
+	/** The switch's on/off state, or null when it is unknown. Never false for unknown (D393). */
+	switchOn: boolean().nullable(),
+	switchOnline: boolean().nullable(),
+	restartInProgress: boolean(),
+	offSeconds: number().int()
+});
+/** The composed slice: the switch state the link mirrors, plus the stored off time. */
+var PowerSourceStateSchema = object({
+	/** Null while the switch has not reported: unknown is never `false` (D393). */
+	switchOn: boolean().nullable(),
+	offSeconds: number().int(),
+	lastFetchedAt: number()
+});
+var POWER_SOURCE_DEVICE_TYPES = [
+	DeviceType.Gateway,
+	DeviceType.Hub,
+	DeviceType.Camera,
+	DeviceType.Sensor,
+	DeviceType.MediaPlayer,
+	DeviceType.Vacuum,
+	DeviceType.Generic,
+	DeviceType.Washer,
+	DeviceType.Dryer,
+	DeviceType.Dishwasher,
+	DeviceType.PetFountain,
+	DeviceType.Fan,
+	DeviceType.Humidifier,
+	DeviceType.Climate,
+	DeviceType.WaterHeater
+];
+var powerSourceCustomize = {
+	version: 1,
+	targets: [{
+		id: "switch",
+		cardinality: "scalar",
+		vocabulary: {
+			cap: "power-source",
+			stateField: "switchOn"
+		},
+		deviceTypes: POWER_SOURCE_DEVICE_TYPES,
+		apply: "add",
+		path: "switchOn",
+		sources: [{
+			kind: "switch",
+			transforms: [{ kind: "identity" }]
+		}],
+		companions: [{
+			kind: "constant",
+			path: "offSeconds",
+			value: 10,
+			when: "add"
+		}, {
+			kind: "clock",
+			path: "lastFetchedAt",
+			when: "always"
+		}],
+		sourceReport: { status: "assignment-status" }
+	}]
+};
+var deviceInput = object({ deviceId: number().int().nonnegative() });
+var powerSourceCapability = {
+	name: "power-source",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: POWER_SOURCE_DEVICE_TYPES,
+	methods: {
+		getStatus: systemMethod(deviceInput, PowerSourceInfoSchema, { auth: "admin" }),
+		powerOn: systemMethod(deviceInput, PowerSourceActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		powerOff: systemMethod(deviceInput, PowerSourceActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		forceRestart: systemMethod(deviceInput, PowerSourceActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	runtimeState: PowerSourceStateSchema,
+	customize: powerSourceCustomize,
+	/**
+	* Runtime-state durability: **session** — mirrored from the linked switch on
+	* its next report; a restored value would outlive the reading it names.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	history: "none"
+};
 /**
 * A monotonic total between resets (D944). Energy uses `power-meter.energy`
 * so dashboards keep one series; every other instantaneous reading lands here.
@@ -70584,7 +71276,7 @@ onStatusChanged: { data: object({
 * jitter, and observed/peak bandwidth per device + per client.
 *
 * Implementation lives in the server's `NetworkQualityService` (thin
-* wrapper over the shared `NetworkQualityTracker` from `@camstack/system`).
+* wrapper over the shared `NetworkQualityTracker` from `@camstack/server/system`).
 * The provider is registered from `trpc.router.ts` against the existing
 * service instance — no addon owns this state.
 *
@@ -72735,7 +73427,7 @@ var ptzAutotrackCapability = {
 	*  - **Native**: the camera's own firmware autotrack, registered per device by
 	*    the driver when the probe says it exists (Reolink: yes; Hikvision:
 	*    model-dependent).
-	*  - **Wrapper**: the emulated implementation (`@camstack/system`'s `autotrack` builtin),
+	*  - **Wrapper**: the emulated implementation (`@camstack/server/system`'s `autotrack` builtin),
 	*    which follows a subject with `ptz.move` pulses driven by the detection
 	*    pipeline. `defaultActive: false` — the operator binds it per camera in
 	*    the bindings UI.
@@ -78044,6 +78736,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	petFeeder: petFeederCapability,
 	petFountain: petFountainCapability,
 	powerMeter: powerMeterCapability,
+	powerSource: powerSourceCapability,
 	presence: presenceCapability,
 	pressureSensor: pressureSensorCapability,
 	privacyMask: privacyMaskCapability,
@@ -83808,6 +84501,69 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"migrations.declareOwner": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.dryRun": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"migrations.finishMigration": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.listLedger": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"migrations.listPending": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"migrations.markFailed": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.restorePreMigration": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.retry": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.startMigration": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"modelConvert.convert": {
 		capName: "model-convert",
 		capScope: "system",
@@ -86440,6 +87196,34 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
+	"powerSource.forceRestart": {
+		capName: "power-source",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"powerSource.getStatus": {
+		capName: "power-source",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"powerSource.powerOff": {
+		capName: "power-source",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"powerSource.powerOn": {
+		capName: "power-source",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"presence.getStatus": {
 		capName: "presence",
 		capScope: "device",
@@ -91588,6 +92372,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"powerSource.forceRestart": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"powerSource.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"powerSource.powerOff": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"powerSource.powerOn": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"presence.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -95304,6 +96108,60 @@ var EnpalClientRegistry = class {
 	}
 };
 //#endregion
+//#region src/enpal-reconciler.ts
+/**
+* Keeps one live client per enabled integration. Devices are removed ONLY on an explicit
+* lifecycle event naming the integration (D49): a list that failed, an empty list or an
+* unreadable connection changes nothing about devices and is logged, never read as "gone".
+*/
+var EnpalReconciler = class {
+	#deps;
+	constructor(deps) {
+		this.#deps = deps;
+	}
+	/** Upsert a client per usable enabled integration; drop the CLIENT (never devices) of one the list answered is gone. */
+	async reconcile() {
+		const { logger, clients } = this.#deps;
+		let all;
+		try {
+			all = await this.#deps.listIntegrations();
+		} catch (err) {
+			logger.warn("Enpal integration reconcile skipped — the integration list did not answer", { meta: { error: errMsg(err) } });
+			return;
+		}
+		const enabled = all.filter((i) => i.addonId === this.#deps.addonId && i.enabled);
+		for (const integration of enabled) try {
+			if (!await this.#deps.applySettings(integration)) logger.warn("Enpal integration has no usable connection — left as it is", { meta: { integrationId: integration.id } });
+		} catch (err) {
+			logger.warn("Enpal reconcile failed for integration — left as it is", { meta: {
+				integrationId: integration.id,
+				error: errMsg(err)
+			} });
+		}
+		const enabledIds = new Set(enabled.map((i) => i.id));
+		for (const id of clients.list()) if (!enabledIds.has(id)) await clients.remove(id);
+	}
+	/** An explicit lifecycle event: only `deleted` / `disabled` of a named integration remove devices. */
+	async onLifecycle(kind, integrationId) {
+		await this.reconcile();
+		if (kind === "enabled" || integrationId === null) return;
+		try {
+			const removed = await this.#deps.removeDevices(integrationId);
+			this.#deps.logger.info("Enpal integration devices removed", { meta: {
+				integrationId,
+				kind,
+				removed
+			} });
+		} catch (err) {
+			this.#deps.logger.warn("Enpal integration device removal failed", { meta: {
+				integrationId,
+				kind,
+				error: errMsg(err)
+			} });
+		}
+	}
+};
+//#endregion
 //#region src/enpal-integration-device-cascade.ts
 /**
 * Remove every equipment Container of an integration that was deleted or disabled; the
@@ -95427,6 +96285,7 @@ var EnpalProviderAddon = class extends BaseDeviceProvider {
 		[DeviceType.Container]: EnpalEquipmentDevice,
 		[DeviceType.Gateway]: EnpalGatewayDevice
 	};
+	integrationReconciler = null;
 	clients = null;
 	constructor() {
 		super({});
@@ -95451,6 +96310,7 @@ var EnpalProviderAddon = class extends BaseDeviceProvider {
 			this.ctx.logger.warn("Enpal shutdown error", { meta: { error: errMsg(err) } });
 		}
 		this.clients = null;
+		this.integrationReconciler = null;
 		enpalConnections.clear();
 		await super.onShutdown();
 	}
@@ -95467,51 +96327,47 @@ var EnpalProviderAddon = class extends BaseDeviceProvider {
 		return `enpal:${integrationId}:${equipment}`;
 	}
 	/**
-	* Rebuild the pollers from the live integration list: upsert one per enabled integration
-	* with a host, drop the ones that vanished and cascade-remove their devices. Idempotent;
-	* runs at boot and on every integration lifecycle event.
+	* Upsert one client per enabled integration and drop the client of one the list ANSWERED is
+	* gone. Never removes a device (D49): that follows only an explicit lifecycle event.
+	* Idempotent; runs at boot and on every integration lifecycle event.
 	*/
-	async reconcileIntegrations() {
-		const reg = this.requireClients();
-		try {
-			const mine = (await this.ctx.api.integrations.list.query()).filter((i) => i.addonId === this.ctx.id && i.enabled);
-			const surviving = /* @__PURE__ */ new Set();
-			for (const integration of mine) try {
+	reconciler() {
+		this.integrationReconciler ??= new EnpalReconciler({
+			addonId: this.ctx.id,
+			logger: this.ctx.logger,
+			clients: this.requireClients(),
+			listIntegrations: () => this.ctx.api.integrations.list.query(),
+			applySettings: async (integration) => {
+				const reg = this.requireClients();
 				const read = connectionFromSettings(await this.ctx.api.integrations.getSettings.query({ id: integration.id }));
-				if (read === null) {
-					this.ctx.logger.warn("Enpal integration has no box host — skipping", { meta: { integrationId: integration.id } });
-					continue;
-				}
+				if (read === null) return false;
 				await reg.upsert(integration.id, integration.name, read.connection, read.tokenLocked);
-				surviving.add(integration.id);
-			} catch (err) {
-				this.ctx.logger.warn("Enpal reconcile failed for integration", { meta: {
-					integrationId: integration.id,
-					error: errMsg(err)
-				} });
-			}
-			const vanished = reg.list().filter((id) => !surviving.has(id));
-			await reg.retain(surviving);
-			for (const integrationId of vanished) await this.cascadeRemoveDevicesForIntegration(integrationId);
-		} catch (err) {
-			this.ctx.logger.warn("Enpal integration reconcile failed", { meta: { error: errMsg(err) } });
-		}
+				return true;
+			},
+			removeDevices: (integrationId) => this.cascadeRemoveDevicesForIntegration(integrationId)
+		});
+		return this.integrationReconciler;
+	}
+	async reconcileIntegrations() {
+		await this.reconciler().reconcile();
 	}
+	/** Lifecycle events: only an explicit Deleted/Disabled naming an integration removes devices. */
 	subscribeIntegrationLifecycle() {
-		const handler = (event) => {
+		const on = (kind) => (event) => {
 			const addonId = event.data["addonId"];
 			if (typeof addonId === "string" && addonId !== this.ctx.id) return;
-			this.reconcileIntegrations();
+			const integrationId = event.data["integrationId"];
+			this.reconciler().onLifecycle(kind, typeof integrationId === "string" ? integrationId : null);
 		};
-		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationEnabled }, handler);
-		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDisabled }, handler);
-		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDeleted }, handler);
+		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationEnabled }, on("enabled"));
+		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDisabled }, on("disabled"));
+		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDeleted }, on("deleted"));
 	}
 	async cascadeRemoveDevicesForIntegration(integrationId) {
 		const reg = this.ctx.kernel.deviceRegistry;
 		const devices = this.ctx.kernel.devices;
-		if (!reg || !devices) return;
-		await cascadeRemoveDevicesForIntegration({
+		if (!reg || !devices) return 0;
+		return await cascadeRemoveDevicesForIntegration({
 			reg,
 			devices,
 			addonId: this.addonId,