@camstack/addon-provider-homeassistant 1.2.149 → 1.2.151

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,5 +1,5 @@
1
1
  require("node:crypto");
2
- //#region ../types/dist/event-category-C5xZWqz6.mjs
2
+ //#region ../types/dist/event-category-BGmz_oxW.mjs
3
3
  var EventCategory = /* @__PURE__ */ function(EventCategory) {
4
4
  EventCategory["SystemBoot"] = "system.boot";
5
5
  EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -532,6 +532,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
532
532
  */
533
533
  EventCategory["PipelineAudioInferenceResult"] = "pipeline.audio-inference-result";
534
534
  EventCategory["DetectionPhaseTransition"] = "detection.phase-transition";
535
+ /**
536
+ * A camera provider's RAW onboard motion push (D673): the `MotionOnMotionChanged`
537
+ * data shape without `triggeredBy`, built by `providerMotionEvent`. Its one
538
+ * consumer is the orchestrator's camera-sensors bridge, which re-emits the
539
+ * camera's EFFECTIVE onboard motion as `MotionOnMotionChanged` (a pass-through
540
+ * for a camera with no attached sensor). Providers must not emit
541
+ * `MotionOnMotionChanged` themselves; `scripts/check-onboard-motion-emitters.ts`
542
+ * keeps it so (camera-grid is a named, deferred exception).
543
+ */
535
544
  EventCategory["ProviderMotion"] = "provider.motion";
536
545
  EventCategory["ProviderDetection"] = "provider.detection";
537
546
  EventCategory["EnrichmentEmbeddingStored"] = "enrichment.embedding.stored";
@@ -5370,7 +5379,7 @@ var ZodIssueCode = {
5370
5379
  var ZodFirstPartyTypeKind;
5371
5380
  ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
5372
5381
  //#endregion
5373
- //#region ../types/dist/sleep-gU6hqv4_.mjs
5382
+ //#region ../types/dist/sleep-CDCONfkt.mjs
5374
5383
  /**
5375
5384
  * The audio chunk plane's byte format, and the ONE expansion from a coded
5376
5385
  * window to float samples (D455).
@@ -7472,7 +7481,7 @@ function errMsg(err) {
7472
7481
  return String(err);
7473
7482
  }
7474
7483
  //#endregion
7475
- //#region ../types/dist/composition-Dq42XWp0.mjs
7484
+ //#region ../types/dist/composition-43aqsZQj.mjs
7476
7485
  /**
7477
7486
  * The ffmpeg build every CamStack node downloads, per platform and arch.
7478
7487
  *
@@ -7529,13 +7538,12 @@ portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac
7529
7538
  * LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
7530
7539
  * valutatore puro del suo FRONTE.
7531
7540
  *
7532
- * Viveva dentro il builtin virtual-doorbell
7533
- * (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
7534
- * predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
7535
- * `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
7536
- * tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
7537
- * fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
7538
- * SPOSTA qui e il doorbell la ri-esporta.
7541
+ * UNA tabella per tutti quelli che chiedono "questo device è ALTO?": il
7542
+ * trigger `RecordingTriggers.sensorDeviceIds` del recorder, i marker dei
7543
+ * sensori della post-analysis, il bridge camera-sensors dell'orchestratore e
7544
+ * le sorgenti di un campanello composto (`doorbellFeatureSources`, D671).
7545
+ * Una seconda copia divergerebbe alla prima cap aggiunta, e il sintomo — "il
7546
+ * sensore fa suonare il campanello ma non registra" — è esattamente D62.
7539
7547
  *
7540
7548
  * ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
7541
7549
  * due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
@@ -7561,8 +7569,6 @@ var SOURCE_CAP_ACTIVE_FIELD = {
7561
7569
  vibration: "detected",
7562
7570
  tamper: "tampered"
7563
7571
  };
7564
- /** Cap names whose presence in a device's bindings qualify it as a source. */
7565
- var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
7566
7572
  /**
7567
7573
  * Error types for the safe expression engine. Two distinct classes so callers
7568
7574
  * can tell a compile-time (grammar) failure from a runtime (evaluation)
@@ -9416,7 +9422,7 @@ var RecordingTriggersSchema = object({
9416
9422
  *
9417
9423
  * Cosa vuol dire "alto" dipende dal TIPO di device e non è deciso qui:
9418
9424
  * `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) è LA tabella,
9419
- * la stessa che il virtual-doorbell usa dal 2026-08-05. Ed è il FRONTE, non
9425
+ * la stessa del campanello composto (D671). Ed è il FRONTE, non
9420
9426
  * il livello: un contatto trovato già aperto al riavvio del runner non fa
9421
9427
  * registrare.
9422
9428
  */
@@ -11790,6 +11796,68 @@ method(object({
11790
11796
  password: string()
11791
11797
  }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
11792
11798
  /**
11799
+ * How long one snapshot may take end to end: the pinned copy of the whole
11800
+ * database plus `PRAGMA integrity_check` over the copy, on the hub's slowest
11801
+ * disk. ~800 MB at a pessimistic 10 MB/s is under 3 minutes; the bound is
11802
+ * generous because a timeout fails the whole backup run.
11803
+ */
11804
+ var DATABASE_SNAPSHOT_TIMEOUT_MS = 30 * 6e4;
11805
+ /**
11806
+ * The databases an owner snapshots — declared by the OWNER, so a caller never
11807
+ * guesses which file is live from what sits beside it (a cleanly closed
11808
+ * database has no sidecars and is just as owned). Paths are absolute on the
11809
+ * owner's host.
11810
+ */
11811
+ var DatabaseSnapshotTargetsSchema = object({ databases: array(object({ livePath: string() })) });
11812
+ /** One b-tree table of the snapshot and the rows it holds. */
11813
+ var DatabaseSnapshotTableSchema = object({
11814
+ name: string(),
11815
+ rows: number().int().nonnegative()
11816
+ });
11817
+ /**
11818
+ * What the owner wrote. Every path is ABSOLUTE on the owner's host — the
11819
+ * caller pins the call to its own node, so it can read the file; a caller
11820
+ * that finds the path outside its own data root refuses it rather than
11821
+ * archiving something it cannot place.
11822
+ */
11823
+ var DatabaseSnapshotResultSchema = object({
11824
+ /** The live database the snapshot copies. Never to be copied as a file. */
11825
+ livePath: string(),
11826
+ /** The verified copy: `<livePath>` + {@link DATABASE_SNAPSHOT_SUFFIX}. */
11827
+ snapshotPath: string(),
11828
+ sizeBytes: number().int().nonnegative(),
11829
+ pageCount: number().int().nonnegative(),
11830
+ pageSize: number().int().positive(),
11831
+ /**
11832
+ * Every b-tree table with its row count. Read inside the SAME read
11833
+ * transaction the copy was taken from, and found EQUAL on the copy — so
11834
+ * this is the content of the snapshot, not an estimate of the source.
11835
+ */
11836
+ tables: array(DatabaseSnapshotTableSchema),
11837
+ /** Wall time of the pinned copy (row counts included). */
11838
+ copyMs: number().nonnegative(),
11839
+ /** Wall time of the checks on the copy (`integrity_check`, row counts). */
11840
+ verifyMs: number().nonnegative(),
11841
+ /** When the pinned read transaction began (ms epoch) — the snapshot's instant. */
11842
+ takenAt: number()
11843
+ });
11844
+ /**
11845
+ * A snapshot as an ARCHIVE records it (`ArchiveManifest.sqliteSnapshots`):
11846
+ * the same facts, with both paths relative to the archive root (the node's
11847
+ * data dir), because an archive outlives the host that made it.
11848
+ */
11849
+ var ArchiveSqliteSnapshotSchema = DatabaseSnapshotResultSchema.extend({
11850
+ /** Archive-relative path of the live database the archive does NOT carry. */
11851
+ livePath: string(),
11852
+ /** Archive-relative path of the verified copy it carries in its place. */
11853
+ snapshotPath: string()
11854
+ });
11855
+ method(object({}), DatabaseSnapshotTargetsSchema, { auth: "admin" }), method(object({}), DatabaseSnapshotResultSchema, {
11856
+ kind: "mutation",
11857
+ auth: "admin",
11858
+ timeoutMs: DATABASE_SNAPSHOT_TIMEOUT_MS
11859
+ });
11860
+ /**
11793
11861
  * Orchestrator-side destination metadata. The orchestrator computes
11794
11862
  * `id = <addonId>:<subId>` from its provider lookup so consumers
11795
11863
  * (admin UI, restore flow) see one canonical key.
@@ -11900,7 +11968,12 @@ var ArchiveManifestSchema = object({
11900
11968
  locations: array(string()),
11901
11969
  entries: array(ArchiveEntrySchema),
11902
11970
  totalBytes: number(),
11903
- totalFiles: number()
11971
+ totalFiles: number(),
11972
+ /**
11973
+ * Live SQLite databases this archive carries as their OWNER's verified
11974
+ * snapshot instead of as files (D693). Absent on archives made before.
11975
+ */
11976
+ sqliteSnapshots: array(ArchiveSqliteSnapshotSchema).optional()
11904
11977
  });
11905
11978
  var LocationStatSchema = object({
11906
11979
  name: string(),
@@ -13475,6 +13548,52 @@ var CompositionBlockStateSchema = object({
13475
13548
  reason: string().optional(),
13476
13549
  fields: array(CompositionFieldStateSchema)
13477
13550
  });
13551
+ var ComposerBlockSchema = object({
13552
+ id: string().min(1),
13553
+ name: string().min(1).max(120),
13554
+ enabled: boolean(),
13555
+ updatedAt: number(),
13556
+ composition: CompositionSchema
13557
+ });
13558
+ /**
13559
+ * A stored composition row that no longer PARSES — a schema a release
13560
+ * tightened, a row written by a newer build. Sent by id so the composer keeps
13561
+ * its device as a placeholder and reports the block `failed` naming the parse
13562
+ * error. Leaving it out would read, twice, exactly like a delete (D49).
13563
+ */
13564
+ var ComposerUnreadableBlockSchema = object({
13565
+ id: string().min(1),
13566
+ /** The row's stored name column; null when even that is unreadable (the device keeps the name it has). */
13567
+ name: string().nullable(),
13568
+ /** The parse error, in the operator's words. */
13569
+ error: string()
13570
+ });
13571
+ method(object({
13572
+ /** The shared Blocks integration; null until `core-blocks` has reconciled it. */
13573
+ integrationId: string().nullable(),
13574
+ /** False when the `core_blocks` read failed: then nothing may be withdrawn (D49). */
13575
+ storeLoaded: boolean(),
13576
+ blocks: array(ComposerBlockSchema),
13577
+ /** Operator restarts: rebuild these runtimes and re-resolve their sources. Stores nothing (D62). */
13578
+ restartBlockIds: array(string()),
13579
+ /** Composition rows that exist but do not parse: held, never withdrawn, reported failed. */
13580
+ unreadableBlocks: array(ComposerUnreadableBlockSchema)
13581
+ }), object({
13582
+ blocks: array(object({
13583
+ blockId: string(),
13584
+ status: CompositionRunStatusSchema,
13585
+ reason: string().optional()
13586
+ })),
13587
+ /**
13588
+ * False when the composer declared and withdrew NOTHING (store not loaded,
13589
+ * integration unknown, its own rows unread or read empty once). An empty
13590
+ * apply the caller owes is paid off only by one the composer acted on (D49).
13591
+ */
13592
+ acted: boolean()
13593
+ }), {
13594
+ kind: "mutation",
13595
+ auth: "admin"
13596
+ }), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
13478
13597
  var NUMBER = {
13479
13598
  kind: "fixed",
13480
13599
  result: ["number"]
@@ -13711,52 +13830,6 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
13711
13830
  auth: "admin",
13712
13831
  access: "view"
13713
13832
  });
13714
- var ComposerBlockSchema = object({
13715
- id: string().min(1),
13716
- name: string().min(1).max(120),
13717
- enabled: boolean(),
13718
- updatedAt: number(),
13719
- composition: CompositionSchema
13720
- });
13721
- /**
13722
- * A stored composition row that no longer PARSES — a schema a release
13723
- * tightened, a row written by a newer build. Sent by id so the composer keeps
13724
- * its device as a placeholder and reports the block `failed` naming the parse
13725
- * error. Leaving it out would read, twice, exactly like a delete (D49).
13726
- */
13727
- var ComposerUnreadableBlockSchema = object({
13728
- id: string().min(1),
13729
- /** The row's stored name column; null when even that is unreadable (the device keeps the name it has). */
13730
- name: string().nullable(),
13731
- /** The parse error, in the operator's words. */
13732
- error: string()
13733
- });
13734
- method(object({
13735
- /** The shared Blocks integration; null until `core-blocks` has reconciled it. */
13736
- integrationId: string().nullable(),
13737
- /** False when the `core_blocks` read failed: then nothing may be withdrawn (D49). */
13738
- storeLoaded: boolean(),
13739
- blocks: array(ComposerBlockSchema),
13740
- /** Operator restarts: rebuild these runtimes and re-resolve their sources. Stores nothing (D62). */
13741
- restartBlockIds: array(string()),
13742
- /** Composition rows that exist but do not parse: held, never withdrawn, reported failed. */
13743
- unreadableBlocks: array(ComposerUnreadableBlockSchema)
13744
- }), object({
13745
- blocks: array(object({
13746
- blockId: string(),
13747
- status: CompositionRunStatusSchema,
13748
- reason: string().optional()
13749
- })),
13750
- /**
13751
- * False when the composer declared and withdrew NOTHING (store not loaded,
13752
- * integration unknown, its own rows unread or read empty once). An empty
13753
- * apply the caller owes is paid off only by one the composer acted on (D49).
13754
- */
13755
- acted: boolean()
13756
- }), {
13757
- kind: "mutation",
13758
- auth: "admin"
13759
- }), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
13760
13833
  /**
13761
13834
  * `custom-model-registry` — collection cap exposing operator-registered
13762
13835
  * custom detection models. Each provider (today: `addon-model-studio`)
@@ -16027,6 +16100,121 @@ method(object({
16027
16100
  deviceIds: array(number()).readonly(),
16028
16101
  caps: array(string()).readonly().optional()
16029
16102
  }), record(string(), record(string(), unknown().nullable())));
16103
+ var ExtensionSlotIdSchema = _enum(["linked-devices"]);
16104
+ DeviceType.Camera;
16105
+ /** A slot's editable value, discriminated on `slot`. */
16106
+ var ExtensionSlotValueSchema = discriminatedUnion("slot", [LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
16107
+ DeviceType.Camera;
16108
+ var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
16109
+ state: literal("unreachable"),
16110
+ reason: string()
16111
+ })]);
16112
+ /** One provider of slots — the D554 source-listing row. */
16113
+ var ExtensionSourceSchema = object({
16114
+ /** The routing prefix of every `slotRef` this provider serves. */
16115
+ source: string(),
16116
+ label: string(),
16117
+ /** Stamped by the dispatcher from the registry (D557). */
16118
+ addonId: string().optional(),
16119
+ availability: ExtensionSourceAvailabilitySchema
16120
+ });
16121
+ /**
16122
+ * How one picked source stands. `missing` — no such device (deleted, or an id
16123
+ * that never existed); `foreign` — a device the slot's owner cannot read from
16124
+ * (a source owned by another addon); `unavailable` — it exists but is not a
16125
+ * valid source now (a container, which is never a pick). A source in any of
16126
+ * these states is SHOWN, never silently dropped or re-pointed.
16127
+ */
16128
+ var ExtensionSourceHealthSchema = _enum([
16129
+ "ok",
16130
+ "missing",
16131
+ "foreign",
16132
+ "unavailable"
16133
+ ]);
16134
+ var ExtensionSlotSourceSchema = object({
16135
+ deviceId: number().int(),
16136
+ /** The device's name, or null when it could not be resolved (`missing`). */
16137
+ name: string().nullable(),
16138
+ health: ExtensionSourceHealthSchema,
16139
+ detail: string().optional()
16140
+ });
16141
+ /**
16142
+ * A DIFFERENT authority that gates whether the slot's sources do anything —
16143
+ * reported read-only, named, never written through this contract (D62) — e.g.
16144
+ * a slot whose sources act only while a wrapper is bound to the host, a
16145
+ * binding that belongs to `deviceManager.setWrapperActive`. No slot reports
16146
+ * one today (`linked-devices` answers `null`). `unknown` means the gate could
16147
+ * not be read; it is not "inactive" (D315).
16148
+ */
16149
+ var ExtensionSlotActivationSchema = object({
16150
+ state: _enum([
16151
+ "active",
16152
+ "inactive",
16153
+ "unknown"
16154
+ ]),
16155
+ authority: string(),
16156
+ detail: string().optional()
16157
+ });
16158
+ var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
16159
+ state: literal("ok"),
16160
+ /** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
16161
+ slotRef: string(),
16162
+ slot: ExtensionSlotIdSchema,
16163
+ /** Names the store written (D62), e.g. `device-manager:_linkedDeviceIds`. */
16164
+ authority: string(),
16165
+ activation: ExtensionSlotActivationSchema.nullable(),
16166
+ value: ExtensionSlotValueSchema,
16167
+ sources: array(ExtensionSlotSourceSchema),
16168
+ /**
16169
+ * Devices the owner links to the host ON ITS OWN, by structure, and that
16170
+ * are therefore not in `value` (D655): a camera's device-tree children, and
16171
+ * the child a picked container stands for (D356 — a container is never a
16172
+ * pick, its children are). Read-only; the editor shows them and may offer
16173
+ * per-device options on them (the linked-devices tracked-event opt-in).
16174
+ * Absent when the owner links nothing beyond the picks, and from an owner
16175
+ * older than D655.
16176
+ */
16177
+ impliedSources: array(ExtensionSlotSourceSchema).optional()
16178
+ }), object({
16179
+ state: literal("unreachable"),
16180
+ addonId: string(),
16181
+ reason: string()
16182
+ })]);
16183
+ var ExtensionCandidatesSchema = object({ candidates: array(object({
16184
+ deviceId: number().int(),
16185
+ name: string(),
16186
+ type: string(),
16187
+ location: string().nullable(),
16188
+ /** The container a child belongs to — "Spotlight 2" alone does not say which. */
16189
+ parentName: string().nullable(),
16190
+ /** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
16191
+ suggested: boolean(),
16192
+ /** Why it is suggested ("same location"), null when it is not. */
16193
+ reason: string().nullable()
16194
+ })) });
16195
+ /**
16196
+ * What a write did. `none` — applied in place. `host` / `parent` — the owner
16197
+ * reloaded the host (or, for an accessory child, its parent) because the
16198
+ * write changed what the host REGISTERS. A slot never adds a capability to its
16199
+ * host — that is a composition (D663) — so today's owners answer `none`.
16200
+ */
16201
+ var ExtensionSetResultSchema = object({
16202
+ applied: literal(true),
16203
+ reload: _enum([
16204
+ "none",
16205
+ "host",
16206
+ "parent"
16207
+ ])
16208
+ });
16209
+ var ExtensionSlotRefInputSchema = object({
16210
+ deviceId: number().int(),
16211
+ slotRef: string().min(1)
16212
+ });
16213
+ var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
16214
+ method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
16215
+ kind: "mutation",
16216
+ auth: "admin"
16217
+ });
16030
16218
  /**
16031
16219
  * Per-field ownership (D663). A composition may CLAIM fields of a native
16032
16220
  * cap's runtime-state slice on an existing device: `replace` overlays the
@@ -19051,17 +19239,25 @@ var NcScheduleSchema = object({
19051
19239
  */
19052
19240
  var NcSystemEventDeliveryModeSchema = _enum(["instant", "summary"]);
19053
19241
  /**
19242
+ * How a summary window is SENT (D698): `rule` (absent) = ONE notification with
19243
+ * every section; `section` = one notification per section with something to
19244
+ * say (an unavailable section included), each titled by its section.
19245
+ */
19246
+ var NcStateSummarySplitSchema = _enum(["rule", "section"]);
19247
+ /**
19054
19248
  * `summary`: the rule sends NOTHING per event. When a window of `schedule`
19055
19249
  * CLOSES, it sends one notification with the current state of its kinds
19056
19250
  * (low batteries, consumables to replace, devices offline, updates
19057
- * available, ...), after its own filters. Nothing to report sends nothing.
19251
+ * available, ...), after its own filters — or, with `split: 'section'`
19252
+ * (D698), one notification per section. Nothing to report sends nothing.
19058
19253
  * The schedule is the ordinary `NcSchedule` (weekly windows, IANA timezone,
19059
19254
  * midnight crossing); the send time is each window's END. Refused on the
19060
19255
  * `alarm` family, which stays instant (`systemEventDeliveryProblems`).
19061
19256
  */
19062
19257
  var NcSystemEventDeliverySchema = discriminatedUnion("mode", [object({ mode: literal("instant") }), object({
19063
19258
  mode: literal("summary"),
19064
- schedule: NcScheduleSchema
19259
+ schedule: NcScheduleSchema,
19260
+ split: NcStateSummarySplitSchema.optional()
19065
19261
  })]);
19066
19262
  /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
19067
19263
  var NcPlateMatcherSchema = object({
@@ -19712,10 +19908,12 @@ var NcMediaPolicySchema = object({
19712
19908
  /**
19713
19909
  * Cooldown GRANULARITY over the subject's class — how much a fired
19714
19910
  * notification suppresses.
19715
- * - `shared` (default, and the absent value) — one window for the whole
19716
- * rule/scope: a cat silences the next dog for `cooldownSec`.
19717
- * - `per-class` — an independent window per detected class, so cat→dog fires
19718
- * at once and cat→cat still waits.
19911
+ * - `per-class` (default, and the absent value since 2026-10-01 — D36) — an
19912
+ * independent window per detected class: cat→dog fires at once, cat→cat
19913
+ * still waits.
19914
+ * - `shared` — one window for the whole rule/scope: a cat silences the next
19915
+ * dog for `cooldownSec`. Only written when an operator picks it; it is no
19916
+ * longer what an unset rule means.
19719
19917
  *
19720
19918
  * AUDIO subjects are ALWAYS per-class regardless of this setting: a scream
19721
19919
  * must not be swallowed by a bark's window (the precedent this generalizes —
@@ -19730,8 +19928,11 @@ var NcThrottleSchema = object({
19730
19928
  /**
19731
19929
  * Class granularity of the cooldown key. Optional rather than defaulted:
19732
19930
  * a Zod default does NOT run on the addon→addon cap path, so a persisted
19733
- * rule authored before this field simply carries none — and the engine
19734
- * reads absent as `shared`, the pre-existing behaviour.
19931
+ * rule authored before this field simply carries none. The engine used to
19932
+ * read absent as `shared` (D36); since 2026-10-01 it reads absent as
19933
+ * `per-class` — the operator's default — and only an explicit `shared`
19934
+ * still means `shared`. See `cooldownKey` / `keysPerClass` in the rule
19935
+ * engine, and D36's dated note.
19735
19936
  */
19736
19937
  granularity: NcThrottleGranularitySchema.optional()
19737
19938
  });
@@ -20055,11 +20256,23 @@ var NcStateSummaryPreviewSectionSchema = object({
20055
20256
  reason: string().optional()
20056
20257
  });
20057
20258
  /**
20259
+ * One notification a previewed summary would send (D698): the whole summary on
20260
+ * a `rule` split (no `section`), one section's on a `section` split.
20261
+ */
20262
+ var NcStateSummaryPreviewRowSchema = object({
20263
+ section: string().optional(),
20264
+ /** The section's name on a per-section row; every reported section's, joined, on a combined one. */
20265
+ title: string(),
20266
+ text: string(),
20267
+ count: number().int().nonnegative()
20268
+ });
20269
+ /**
20058
20270
  * The summary a rule would send now. `empty` = nothing to report and every
20059
20271
  * section read: such a summary is NOT sent. `dropped` counts the open states
20060
20272
  * the rule's own filters (or a camera mute) left out, by reason.
20061
20273
  * `excludedGroups` names the kind groups selected that have no state to report
20062
- * (backups & exports).
20274
+ * (backups & exports). `split` and `rows` (D698) say how it would be sent —
20275
+ * optional, so an older hub's answer still parses.
20063
20276
  */
20064
20277
  var NcStateSummaryPreviewSchema = object({
20065
20278
  empty: boolean(),
@@ -20067,7 +20280,9 @@ var NcStateSummaryPreviewSchema = object({
20067
20280
  text: string(),
20068
20281
  sections: array(NcStateSummaryPreviewSectionSchema),
20069
20282
  dropped: record(string(), number().int().nonnegative()),
20070
- excludedGroups: array(string())
20283
+ excludedGroups: array(string()),
20284
+ split: NcStateSummarySplitSchema.optional(),
20285
+ rows: array(NcStateSummaryPreviewRowSchema).optional()
20071
20286
  });
20072
20287
  var NcTestResultSchema = object({
20073
20288
  recordId: string(),
@@ -21097,12 +21312,26 @@ var CameraSensorRefSchema = object({
21097
21312
  function cameraSensorRefKey(ref) {
21098
21313
  return `${ref.addonId}/${ref.stableId}`;
21099
21314
  }
21100
- /** CS-1 accepts exactly one mode; CS-2 (D673) widens it to confirm / replace. */
21101
- var CameraSensorsModeSchema = _enum(["in-addition"]);
21102
- var CameraSensorsConfigSchema = object({
21103
- mode: CameraSensorsModeSchema,
21104
- sensors: array(CameraSensorRefSchema).min(1).max(8)
21105
- }).superRefine((value, ctx) => {
21315
+ /**
21316
+ * A sensor's mode (D673). `in-addition`: its motion is the camera's motion too.
21317
+ * `replace`: its motion is the camera's, and while one is READY the camera's
21318
+ * own motion no longer counts on its own. `confirm`: while one is READY the
21319
+ * camera's own motion counts only while a confirm sensor is active — with or
21320
+ * without a replace sensor (spec C2, the controller's ruling on Q1).
21321
+ */
21322
+ var CameraSensorModeSchema = _enum([
21323
+ "in-addition",
21324
+ "confirm",
21325
+ "replace"
21326
+ ]);
21327
+ /** A stored sensor with no mode — every CS-1 row — is in addition. */
21328
+ var DEFAULT_CAMERA_SENSOR_MODE = "in-addition";
21329
+ /**
21330
+ * A camera's attached sensors. A CS-1 row carried an envelope
21331
+ * `mode: 'in-addition'`: `z.object` drops it on parse, and the PARSED value is
21332
+ * what the write stores (D672 rule 3), so it is never written again.
21333
+ */
21334
+ var CameraSensorsConfigSchema = object({ sensors: array(CameraSensorRefSchema.extend({ mode: CameraSensorModeSchema.default(DEFAULT_CAMERA_SENSOR_MODE) })).min(1).max(8) }).superRefine((value, ctx) => {
21106
21335
  const seen = /* @__PURE__ */ new Set();
21107
21336
  value.sensors.forEach((ref, index) => {
21108
21337
  const key = cameraSensorRefKey(ref);
@@ -21114,39 +21343,41 @@ var CameraSensorsConfigSchema = object({
21114
21343
  seen.add(key);
21115
21344
  });
21116
21345
  });
21117
- var RefFields = {
21346
+ /** Every attachment names its mode; an older orchestrator that does not is in addition. */
21347
+ var AttachmentFields = {
21118
21348
  addonId: string(),
21119
- stableId: string()
21349
+ stableId: string(),
21350
+ mode: CameraSensorModeSchema.default(DEFAULT_CAMERA_SENSOR_MODE)
21120
21351
  };
21121
21352
  var CameraSensorAttachmentSchema = discriminatedUnion("state", [
21122
21353
  object({
21123
- ...RefFields,
21354
+ ...AttachmentFields,
21124
21355
  state: literal("ready"),
21125
21356
  deviceId: number(),
21126
21357
  name: string(),
21127
21358
  caps: array(string()).readonly()
21128
21359
  }),
21129
21360
  object({
21130
- ...RefFields,
21361
+ ...AttachmentFields,
21131
21362
  state: literal("offline"),
21132
21363
  deviceId: number(),
21133
21364
  name: string(),
21134
21365
  reason: _enum(["offline", "disabled"])
21135
21366
  }),
21136
21367
  object({
21137
- ...RefFields,
21368
+ ...AttachmentFields,
21138
21369
  state: literal("missing"),
21139
21370
  reason: string()
21140
21371
  }),
21141
21372
  object({
21142
- ...RefFields,
21373
+ ...AttachmentFields,
21143
21374
  state: literal("unsupported"),
21144
21375
  deviceId: number(),
21145
21376
  name: string(),
21146
21377
  reason: string()
21147
21378
  }),
21148
21379
  object({
21149
- ...RefFields,
21380
+ ...AttachmentFields,
21150
21381
  state: literal("unreadable"),
21151
21382
  reason: string()
21152
21383
  })
@@ -21159,17 +21390,49 @@ var CameraSensorAttachmentSchema = discriminatedUnion("state", [
21159
21390
  * say.
21160
21391
  */
21161
21392
  var CameraSensorsNotForwardedSchema = _enum(["onboard-not-listed", "no-active-detection"]);
21393
+ /** Whether the camera's OWN motion counts on its own (D673 C2), from its READY sensors (C3). */
21394
+ var CameraOwnMotionSchema = _enum([
21395
+ "always",
21396
+ "when-confirmed",
21397
+ "never"
21398
+ ]);
21399
+ /** Confirm / Replace cannot suppress this camera's motion: its provider still emits it directly (D673 C13). */
21400
+ var CameraSensorsNotEnforcedSchema = _enum(["provider-not-split"]);
21401
+ /**
21402
+ * The camera's OWN onboard motion (D696): the raw input the bridge combines,
21403
+ * never the effective value. The camera's `motion` slice is the effective one,
21404
+ * so a view of the camera's own row reads this.
21405
+ * - `atMs`: when the bridge received the camera's last own edge.
21406
+ * - `detected`: evaluated WHEN THE STATUS IS ASKED — the last edge said `true`
21407
+ * AND it is younger than the window the bridge counts the camera's own motion
21408
+ * for (`motionCooldownMs`, floored at two sustain ticks). A camera that never
21409
+ * sends a clear (heartbeats only) therefore reads `false` once no push came
21410
+ * within the window; a status read is a snapshot, so a live view re-asks.
21411
+ * Absent = this orchestrator has not received the camera's own motion since it
21412
+ * started (unknown, never "quiet"), or an orchestrator older than D696.
21413
+ */
21414
+ var CameraRawLevelSchema = object({
21415
+ detected: boolean(),
21416
+ atMs: number()
21417
+ });
21162
21418
  var CameraSensorsStatusSchema = discriminatedUnion("state", [
21163
- object({ state: literal("not-configured") }),
21419
+ object({
21420
+ state: literal("not-configured"),
21421
+ cameraLevel: CameraRawLevelSchema.optional()
21422
+ }),
21164
21423
  object({
21165
21424
  state: literal("unreadable"),
21166
- reason: string()
21425
+ reason: string(),
21426
+ cameraLevel: CameraRawLevelSchema.optional()
21167
21427
  }),
21168
21428
  object({
21169
21429
  state: literal("configured"),
21170
- mode: CameraSensorsModeSchema,
21430
+ cameraLevel: CameraRawLevelSchema.optional(),
21171
21431
  sensors: array(CameraSensorAttachmentSchema).readonly(),
21172
- notForwarded: CameraSensorsNotForwardedSchema.optional()
21432
+ /** Absent = an orchestrator older than CS-2: it does not say (D315). */
21433
+ cameraMotion: CameraOwnMotionSchema.optional(),
21434
+ notForwarded: CameraSensorsNotForwardedSchema.optional(),
21435
+ notEnforced: CameraSensorsNotEnforcedSchema.optional()
21173
21436
  })
21174
21437
  ]);
21175
21438
  Object.freeze({
@@ -24400,8 +24663,10 @@ var RunnerCameraConfigSchema = object({
24400
24663
  * - `analyzer`: ML/frame-diff motion detection (motion-wasm or other
24401
24664
  * analyzer providers) running on decoded frames in this runner.
24402
24665
  * - `onboard`: camera-native motion pushes (Reolink Baichuan, ONVIF
24403
- * analytics). The provider emits ProviderMotion
24404
- * events; the orchestrator forwards to `reportMotion`.
24666
+ * analytics). The provider emits its raw push as `ProviderMotion`
24667
+ * (D673); the orchestrator's camera-sensors bridge re-emits the camera's
24668
+ * effective motion as `MotionOnMotionChanged`, which is what reaches
24669
+ * `reportMotion`.
24405
24670
  */
24406
24671
  motionSources: MotionSourcesSchema.default(["analyzer"]),
24407
24672
  /**
@@ -24578,7 +24843,15 @@ var RunnerLocalLoadSchema = object({
24578
24843
  hasGpu: boolean(),
24579
24844
  inferenceBackend: string().optional(),
24580
24845
  cpuCores: number().optional()
24581
- })
24846
+ }),
24847
+ /**
24848
+ * Who writes a camera's `motion` runtime slice (D696). `'orchestrator'`: this
24849
+ * runner never writes it. ABSENT = a runner older than D696, which still
24850
+ * writes the slice from its phase machine; the orchestrator does not write
24851
+ * while any runner node is absent-or-unanswered, so one slice never has two
24852
+ * writers.
24853
+ */
24854
+ motionSliceWriter: literal("orchestrator").optional()
24582
24855
  });
24583
24856
  /**
24584
24857
  * Aggregate runtime metrics for the runner's whole local pool. Mirrors the
@@ -27632,219 +27905,6 @@ DeviceType.Camera, method(object({
27632
27905
  auth: "protected"
27633
27906
  });
27634
27907
  /**
27635
- * Doorbell button cap. Two kinds of providers coexist behind this cap
27636
- * name (same pattern as `snapshot`):
27637
- *
27638
- * - **Native** providers: registered per-device by device-driver
27639
- * addons via `ctx.registerNativeCap` — either on a
27640
- * `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
27641
- * or directly on the camera (Reolink registers at camera level).
27642
- * Emits an `onPressed` event every time the firmware pushes a
27643
- * ring; status tracks the last press and a pressCount since start
27644
- * (diagnostic).
27645
- *
27646
- * - **Wrapper** provider: the `virtual-doorbell` system builtin
27647
- * (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
27648
- * device (contact / switch / event-emitter …) into a doorbell for
27649
- * a camera. `defaultActive: false` — the operator explicitly binds
27650
- * it per camera in the device-bindings UI, then picks the source
27651
- * device + trigger in the per-device settings.
27652
- *
27653
- * The DeviceEventPropagator re-emits `onPressed` on the camera parent
27654
- * — subscribers listening at the camera level receive ring events
27655
- * with `via[]` populated. No code on the parent needed.
27656
- */
27657
- var DoorbellStatusSchema = object({
27658
- /** Ms epoch of the last press. null = never observed since this provider started. */
27659
- lastPressedAt: number().nullable(),
27660
- /** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
27661
- pressCountSinceStart: number()
27662
- });
27663
- var DoorbellPressEventSchema = object({
27664
- deviceId: number(),
27665
- timestamp: number()
27666
- });
27667
- /**
27668
- * The `doorbell-source` extension slot's editable value (D648): the camera's
27669
- * virtual-doorbell trigger devices, exactly what the wrapper's
27670
- * `doorbellSources` persists (as `{ deviceId }` records).
27671
- */
27672
- var DoorbellSourceSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
27673
- /**
27674
- * The `doorbell-source` slot — which devices ring this camera's VIRTUAL
27675
- * doorbell, owned by the `virtual-doorbell` wrapper over its
27676
- * `doorbellSources` store (D648). A source rings when one of its
27677
- * `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
27678
- * different authority (`deviceManager.setWrapperActive`, D62) — the slot
27679
- * reports it, it never writes it.
27680
- */
27681
- var DOORBELL_SOURCE_SLOT = {
27682
- id: "doorbell-source",
27683
- label: "Doorbell trigger devices",
27684
- description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
27685
- shape: "association",
27686
- hostDeviceTypes: [DeviceType.Camera],
27687
- sourceCaps: SOURCE_CAPS,
27688
- cardinality: "many",
27689
- value: DoorbellSourceSlotValueSchema
27690
- };
27691
- var doorbellCapability = {
27692
- name: "doorbell",
27693
- scope: "device",
27694
- deviceNative: true,
27695
- mode: "singleton",
27696
- kind: "wrapper",
27697
- defaultActive: false,
27698
- deviceTypes: [DeviceType.Button, DeviceType.Camera],
27699
- extensionSlots: [DOORBELL_SOURCE_SLOT],
27700
- methods: {},
27701
- events: {
27702
- /**
27703
- * Fires once per physical press. Reolink delivers via Baichuan
27704
- * push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
27705
- * release/duration — it's a pulse.
27706
- */
27707
- onPressed: {
27708
- data: DoorbellPressEventSchema,
27709
- fromState: {
27710
- field: "lastPressedAt",
27711
- on: "advance"
27712
- }
27713
- } },
27714
- status: {
27715
- schema: DoorbellStatusSchema,
27716
- kind: "push"
27717
- },
27718
- /**
27719
- * Runtime-state slice — last press timestamp + lifetime press count.
27720
- * Mirrored by the kernel and readable via
27721
- * `device.state.doorbell.value`. UIs can show "last ring 5m ago"
27722
- * without subscribing.
27723
- */
27724
- runtimeState: DoorbellStatusSchema,
27725
- /**
27726
- * Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
27727
- *
27728
- * See `RuntimeStateDurability`. Enforced by
27729
- * `scripts/check-runtime-state-durability.ts`.
27730
- */
27731
- durability: "restored"
27732
- };
27733
- var ExtensionSlotIdSchema = _enum(["doorbell-source", "linked-devices"]);
27734
- DeviceType.Camera, DeviceType.Camera;
27735
- /** A slot's editable value, discriminated on `slot`. */
27736
- var ExtensionSlotValueSchema = discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
27737
- DeviceType.Camera;
27738
- var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
27739
- state: literal("unreachable"),
27740
- reason: string()
27741
- })]);
27742
- /** One provider of slots — the D554 source-listing row. */
27743
- var ExtensionSourceSchema = object({
27744
- /** The routing prefix of every `slotRef` this provider serves. */
27745
- source: string(),
27746
- label: string(),
27747
- /** Stamped by the dispatcher from the registry (D557). */
27748
- addonId: string().optional(),
27749
- availability: ExtensionSourceAvailabilitySchema
27750
- });
27751
- /**
27752
- * How one picked source stands. `missing` — no such device (deleted, or an id
27753
- * that never existed); `foreign` — a device the slot's owner cannot read from
27754
- * (a source owned by another addon); `unavailable` — it exists but is not a
27755
- * valid source now (a container, which is never a pick). A source in any of
27756
- * these states is SHOWN, never silently dropped or re-pointed.
27757
- */
27758
- var ExtensionSourceHealthSchema = _enum([
27759
- "ok",
27760
- "missing",
27761
- "foreign",
27762
- "unavailable"
27763
- ]);
27764
- var ExtensionSlotSourceSchema = object({
27765
- deviceId: number().int(),
27766
- /** The device's name, or null when it could not be resolved (`missing`). */
27767
- name: string().nullable(),
27768
- health: ExtensionSourceHealthSchema,
27769
- detail: string().optional()
27770
- });
27771
- /**
27772
- * A DIFFERENT authority that gates whether the slot's sources do anything —
27773
- * reported read-only, named, never written through this contract (D62). The
27774
- * virtual doorbell's sources ring only while the wrapper is bound to the
27775
- * camera, and that binding belongs to `deviceManager.setWrapperActive`.
27776
- * `unknown` means the gate could not be read; it is not "inactive" (D315).
27777
- */
27778
- var ExtensionSlotActivationSchema = object({
27779
- state: _enum([
27780
- "active",
27781
- "inactive",
27782
- "unknown"
27783
- ]),
27784
- authority: string(),
27785
- detail: string().optional()
27786
- });
27787
- var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
27788
- state: literal("ok"),
27789
- /** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
27790
- slotRef: string(),
27791
- slot: ExtensionSlotIdSchema,
27792
- /** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
27793
- authority: string(),
27794
- activation: ExtensionSlotActivationSchema.nullable(),
27795
- value: ExtensionSlotValueSchema,
27796
- sources: array(ExtensionSlotSourceSchema),
27797
- /**
27798
- * Devices the owner links to the host ON ITS OWN, by structure, and that
27799
- * are therefore not in `value` (D655): a camera's device-tree children, and
27800
- * the child a picked container stands for (D356 — a container is never a
27801
- * pick, its children are). Read-only; the editor shows them and may offer
27802
- * per-device options on them (the linked-devices tracked-event opt-in).
27803
- * Absent when the owner links nothing beyond the picks, and from an owner
27804
- * older than D655.
27805
- */
27806
- impliedSources: array(ExtensionSlotSourceSchema).optional()
27807
- }), object({
27808
- state: literal("unreachable"),
27809
- addonId: string(),
27810
- reason: string()
27811
- })]);
27812
- var ExtensionCandidatesSchema = object({ candidates: array(object({
27813
- deviceId: number().int(),
27814
- name: string(),
27815
- type: string(),
27816
- location: string().nullable(),
27817
- /** The container a child belongs to — "Spotlight 2" alone does not say which. */
27818
- parentName: string().nullable(),
27819
- /** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
27820
- suggested: boolean(),
27821
- /** Why it is suggested ("same location"), null when it is not. */
27822
- reason: string().nullable()
27823
- })) });
27824
- /**
27825
- * What a write did. `none` — applied in place. `host` / `parent` — the owner
27826
- * reloaded the host (or, for an accessory child, its parent) because the
27827
- * write changed what the host REGISTERS. A slot never adds a capability to its
27828
- * host — that is a composition (D663) — so today's owners answer `none`.
27829
- */
27830
- var ExtensionSetResultSchema = object({
27831
- applied: literal(true),
27832
- reload: _enum([
27833
- "none",
27834
- "host",
27835
- "parent"
27836
- ])
27837
- });
27838
- var ExtensionSlotRefInputSchema = object({
27839
- deviceId: number().int(),
27840
- slotRef: string().min(1)
27841
- });
27842
- var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
27843
- method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
27844
- kind: "mutation",
27845
- auth: "admin"
27846
- });
27847
- /**
27848
27908
  * Optional client-side hints sent at session creation to help the provider
27849
27909
  * pick the best native source. All fields optional — a viewer that knows
27850
27910
  * nothing still gets a sane default. (Relocated from the retired `webrtc`
@@ -30401,6 +30461,70 @@ onStatusChanged: { data: object({
30401
30461
  * whether persisting is worth a SQLite commit. */
30402
30462
  volatileStateFields: ["lastChangedAt"]
30403
30463
  };
30464
+ var DoorbellStatusSchema = object({
30465
+ /** Ms epoch of the last press. null = never observed since this provider started. */
30466
+ lastPressedAt: number().nullable(),
30467
+ /** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
30468
+ pressCountSinceStart: number()
30469
+ });
30470
+ var DoorbellPressEventSchema = object({
30471
+ deviceId: number(),
30472
+ timestamp: number()
30473
+ });
30474
+ /**
30475
+ * Doorbell button cap. Two kinds of provider serve it, and to every consumer
30476
+ * they are the same cap:
30477
+ *
30478
+ * - **Native** providers, registered per device by a driver addon through
30479
+ * `ctx.registerNativeCap` — a `DeviceType.Button` accessory with
30480
+ * `role: DeviceRole.Doorbell`, or the camera itself (Reolink registers at
30481
+ * camera level). They emit `onPressed` on every firmware ring.
30482
+ * - **A composed doorbell** (D670, D671): a camera's customization gives it
30483
+ * the cap, its `lastPressedAt` rising from the sources the operator
30484
+ * assigned in Customize → Doorbell, and the composer emits `onPressed`
30485
+ * from that field's advance (`fromState`).
30486
+ *
30487
+ * The DeviceEventPropagator re-emits `onPressed` on the camera parent.
30488
+ */
30489
+ var doorbellCapability = {
30490
+ name: "doorbell",
30491
+ scope: "device",
30492
+ deviceNative: true,
30493
+ mode: "singleton",
30494
+ deviceTypes: [DeviceType.Button, DeviceType.Camera],
30495
+ methods: {},
30496
+ events: {
30497
+ /**
30498
+ * Fires once per physical press. Reolink delivers via Baichuan
30499
+ * push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
30500
+ * release/duration — it's a pulse.
30501
+ */
30502
+ onPressed: {
30503
+ data: DoorbellPressEventSchema,
30504
+ fromState: {
30505
+ field: "lastPressedAt",
30506
+ on: "advance"
30507
+ }
30508
+ } },
30509
+ status: {
30510
+ schema: DoorbellStatusSchema,
30511
+ kind: "push"
30512
+ },
30513
+ /**
30514
+ * Runtime-state slice — last press timestamp + lifetime press count.
30515
+ * Mirrored by the kernel and readable via
30516
+ * `device.state.doorbell.value`. UIs can show "last ring 5m ago"
30517
+ * without subscribing.
30518
+ */
30519
+ runtimeState: DoorbellStatusSchema,
30520
+ /**
30521
+ * Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
30522
+ *
30523
+ * See `RuntimeStateDurability`. Enforced by
30524
+ * `scripts/check-runtime-state-durability.ts`.
30525
+ */
30526
+ durability: "restored"
30527
+ };
30404
30528
  /**
30405
30529
  * Enum-state sensor — a string value picked from a finite option set.
30406
30530
  * Drives HA `sensor` entries with `state_class: enum` (HVAC action
@@ -32545,9 +32669,9 @@ var MotionStatusSchema = object({
32545
32669
  /** Ms epoch of the last detected-true observation. Null if never detected. */
32546
32670
  lastDetectedAt: number().nullable(),
32547
32671
  /**
32548
- * `MOTION_CLOSE_AFTER_MS` while `detected: true` on a `Camera` device,
32549
- * `null` while false and on every `Sensor` device (D475) — see that
32550
- * constant's doc for the one-authority rule.
32672
+ * `MOTION_CLOSE_AFTER_MS` while `detected: true` on a `Camera` device (the
32673
+ * orchestrator writes it, D696), `null` while false and on every `Sensor`
32674
+ * device (D475) — see that constant's doc for the one-authority rule.
32551
32675
  *
32552
32676
  * ## Reading this field still arms nothing
32553
32677
  *
@@ -32565,34 +32689,31 @@ var MotionStatusSchema = object({
32565
32689
  * `addon-export-alexa/src/motion-clear-hold.ts` and
32566
32690
  * `addon-export-hap`'s `RESET_DEBOUNCE_MS` both do.
32567
32691
  *
32568
- * ## Who writes it
32569
- *
32570
- * - **Cameras** — the runner's phase machine, `active → watching` on
32571
- * `cooldown_expired`, which then writes this slice with
32572
- * `detected: false` (`handlePhaseChanged` in
32573
- * `pipeline-runner/index.ts`). It produces the FALLING edge, which
32574
- * matters most for the sources that only ever push a rising one:
32575
- * Reolink emits `MotionOnMotionChanged { detected: true }` and never
32576
- * a false.
32577
- * - **Sensors** (Home Assistant binary sensors, Homematic) — the
32578
- * provider pushes the false itself, from the upstream system's own
32579
- * state change. No phase machine is involved.
32580
- *
32581
- * ### The phase machine is CANONICAL, not sole — and that is a defect
32582
- *
32583
- * An earlier revision of this docblock (mine, 2026-09-12) claimed the
32584
- * phase machine is the sole writer for a camera. It is not.
32585
- * `hikvision-camera.ts:3464` and `amcrest-camera.ts:445` both call
32586
- * `setCapSlice(motionCapability, …)` on their own rising edge, and
32587
- * Hikvision's comment says why: it read THIS docblock, agreed the
32588
- * runner is canonical, and wrote anyway to avoid per-tick churn. So
32589
- * two authorities can disagree about one slice, which this repo
32590
- * forbids, and the doc said otherwise — which is worse than saying
32591
- * nothing, because it reads as verification.
32592
- *
32593
- * This predates D475 and is not fixed there: the fix touches every
32594
- * camera provider. Recorded in D475's Consequences. Do not restore the
32595
- * "sole writer" wording without also removing the other writers.
32692
+ * ## Who writes it (D696)
32693
+ *
32694
+ * - **Cameras** — the orchestrator, and nothing else. It writes the camera's
32695
+ * EFFECTIVE motion (`addon-pipeline-orchestrator`
32696
+ * `camera-sensors/motion-slice.ts`), alongside the effective
32697
+ * `MotionOnMotionChanged` it emits or receives: the camera-sensors bridge
32698
+ * for a split camera, an unsplit emitter's direct event, the analyzer and
32699
+ * device activity, as the camera's `motionSources` counts them. A source
32700
+ * that never sends a clear falls one window after its last `true`.
32701
+ * `lastDetectedAt` moves only on an effective rise. No camera provider
32702
+ * writes this slice (not even a boot seed), and neither does the runner's
32703
+ * phase machine: its phase is "a session is attached" for every on-motion
32704
+ * session, not motion, and it now has its own `DetectionPhaseTransition`.
32705
+ * A provider's `isDetected` answers from the hub's slice.
32706
+ * - **Sensors** (Home Assistant binary sensors, Homematic, Matter, Alexa
32707
+ * imports) — the provider pushes both edges itself, from the upstream
32708
+ * system's own state change. That is the sensor's own fact.
32709
+ *
32710
+ * `scripts/check-onboard-motion-emitters.ts` refuses any other writer of a
32711
+ * `motion` slice; each sensor writer is a named exemption.
32712
+ *
32713
+ * This replaces the D475 §4 rule ("the phase machine is the sole writer").
32714
+ * That rule was never true: Hikvision and Amcrest wrote the slice raw beside
32715
+ * it, every provider seeded it at boot, and every session left it
32716
+ * `detected: true` after its detach.
32596
32717
  */
32597
32718
  autoClearAfterMs: number().nullable()
32598
32719
  });
@@ -32664,11 +32785,12 @@ onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
32664
32785
  */
32665
32786
  runtimeState: MotionStatusSchema,
32666
32787
  /**
32667
- * Runtime-state durability: **session** — every writer of this slice
32788
+ * Runtime-state durability: **session** — the writer of this slice
32668
32789
  * writes only on an EDGE, so a restored `detected: true` would stay
32669
32790
  * frozen until the next one instead of being corrected. The next edge
32670
- * re-publishes the real state. (On who the writers are, and why there
32671
- * is more than one, see `autoClearAfterMs` above.)
32791
+ * re-publishes the real state, and the orchestrator re-publishes every
32792
+ * camera when it starts writing (D696; on who writes it, see
32793
+ * `autoClearAfterMs` above).
32672
32794
  *
32673
32795
  * See `RuntimeStateDurability`. Enforced by
32674
32796
  * `scripts/check-runtime-state-durability.ts`.
@@ -35051,8 +35173,7 @@ var ptzAutotrackCapability = {
35051
35173
  deviceNative: true,
35052
35174
  mode: "singleton",
35053
35175
  /**
35054
- * Two kinds of provider behind one name, the same shape `snapshot` and
35055
- * `doorbell` use:
35176
+ * Two kinds of provider behind one name, the same shape `snapshot` uses:
35056
35177
  *
35057
35178
  * - **Native**: the camera's own firmware autotrack, registered per device by
35058
35179
  * the driver when the probe says it exists (Reolink: yes; Hikvision:
@@ -35060,7 +35181,7 @@ var ptzAutotrackCapability = {
35060
35181
  * - **Wrapper**: the emulated implementation (`@camstack/system`'s `autotrack` builtin),
35061
35182
  * which follows a subject with `ptz.move` pulses driven by the detection
35062
35183
  * pipeline. `defaultActive: false` — the operator binds it per camera in
35063
- * the bindings UI, exactly as `virtual-doorbell` is bound.
35184
+ * the bindings UI.
35064
35185
  *
35065
35186
  * The binding chooses WHICH implementation answers; `setEnabled` stays the
35066
35187
  * one switch for the function either way. A camera never has both driving its
@@ -43128,6 +43249,18 @@ Object.freeze({
43128
43249
  addonId: null,
43129
43250
  access: "view"
43130
43251
  },
43252
+ "databaseSnapshot.listDatabases": {
43253
+ capName: "database-snapshot",
43254
+ capScope: "system",
43255
+ addonId: null,
43256
+ access: "view"
43257
+ },
43258
+ "databaseSnapshot.writeSnapshot": {
43259
+ capName: "database-snapshot",
43260
+ capScope: "system",
43261
+ addonId: null,
43262
+ access: "create"
43263
+ },
43131
43264
  "dataStoreProvider.aggregate": {
43132
43265
  capName: "data-store-provider",
43133
43266
  capScope: "system",
@@ -51863,6 +51996,18 @@ var STATE_SUMMARY_VARS = [
51863
51996
  systemEventKinds: [...SUMMARISABLE],
51864
51997
  systemEventDeliveries: ["summary"]
51865
51998
  },
51999
+ {
52000
+ name: "summarySection",
52001
+ label: "Summary: this section",
52002
+ description: "The section a per-section summary row is about (D698); on a summary sent as one message, every section it reports, comma-separated.",
52003
+ example: "Batterie scariche",
52004
+ group: "system",
52005
+ families: ["rule"],
52006
+ fields: [...RULE_TEXT],
52007
+ kinds: ["system"],
52008
+ systemEventKinds: [...SUMMARISABLE],
52009
+ systemEventDeliveries: ["summary"]
52010
+ },
51866
52011
  ...STATE_SUMMARY_SECTION_VARS.map((v) => ({
51867
52012
  name: v.name,
51868
52013
  label: v.label,
@@ -52201,6 +52346,7 @@ TimelapseRuleInputSchema.extend({
52201
52346
  createdAt: number(),
52202
52347
  updatedAt: number()
52203
52348
  });
52349
+ MotionOnMotionChangedDataSchema.omit({ triggeredBy: true });
52204
52350
  object({
52205
52351
  /**
52206
52352
  * Fraction of the box's own size added on EACH side before cutting.