@camstack/addon-provider-homeassistant 1.2.643 → 1.2.644

package/dist/{ha-broker-source-DxSvfCed.mjs → ha-broker-source-DmHRCdW2.mjs}

@@ -1,4 +1,4 @@
-//#region ../types/dist/event-category-DmZDPDf_.mjs
+//#region ../types/dist/event-category-CaURIwQA.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -714,6 +714,10 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["NotificationRuleBroken"] = "notification.rule-broken";
 	/** The clear of {@link NotificationRuleBroken}: the rule loads and names nothing deleted. */
 	EventCategory["NotificationRuleRepaired"] = "notification.rule-repaired";
+	/** A migration failed or was blocked; the Alert Center re-reads the ledger. */
+	EventCategory["MigrationFailed"] = "migration.failed";
+	/** A migration applied or a failure cleared; the Alert Center re-reads the ledger. */
+	EventCategory["MigrationApplied"] = "migration.applied";
 	EventCategory["DeviceUpdated"] = "device.updated";
 	/**
 	* Transport-level connectivity. Emitted by the device driver when
@@ -776,6 +780,378 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
+//#region ../types/dist/device-type-CEqjmUnR.mjs
+/**
+import { errMsg } from '@camstack/types'
+* Extract a human-readable message from an unknown error value.
+* Replaces the ubiquitous `errMsg(err)` pattern.
+*/
+function errMsg(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	return String(err);
+}
+var DeviceType = /* @__PURE__ */ function(DeviceType) {
+	DeviceType["Camera"] = "camera";
+	DeviceType["Hub"] = "hub";
+	DeviceType["Light"] = "light";
+	DeviceType["Siren"] = "siren";
+	DeviceType["Switch"] = "switch";
+	DeviceType["Sensor"] = "sensor";
+	DeviceType["Thermostat"] = "thermostat";
+	/** Air-conditioner / heat-pump climate device (HVAC) — shares the
+	*  `climate-control` cap surface with `Thermostat` but renders a
+	*  dedicated AC-appropriate control UI (mode chips, fan speed,
+	*  independent vertical/horizontal swing). Sources: native Gree, and
+	*  reusable by other AC integrations. */
+	DeviceType["Climate"] = "climate";
+	DeviceType["Button"] = "button";
+	/** Generic stateless event emitter — carries a device's EXACT declared
+	*  event vocabulary verbatim (no normalization). Installed with the
+	*  `event-emitter` cap. Sources: HA `event.*` entities (structured) and
+	*  HA bus events (e.g. `zha_event`, generic). */
+	DeviceType["EventEmitter"] = "event-emitter";
+	/** Firmware/software update entity — current vs available version,
+	*  updatable flag, update state, and an install action. Installed with
+	*  the `update` cap. Sources: Homematic firmware-update channels (and
+	*  reusable by other providers, e.g. HA `update.*` entities). */
+	DeviceType["Update"] = "update";
+	DeviceType["Generic"] = "generic";
+	/** Generic notification delivery target (HA `notify.<service>`, future
+	*  Telegram / Discord / ntfy / SMTP, …). One device per delivery
+	*  endpoint; the `notifier` cap defines the send surface. */
+	DeviceType["Notifier"] = "notifier";
+	/** Pre-recorded action sequence with optional parameters
+	*  (HA `script.*`). Runnable via `script-runner` cap. */
+	DeviceType["Script"] = "script";
+	/** Automation rule (HA `automation.*`) — enable/disable + manual
+	*  trigger surface exposed via `automation-control` cap. */
+	DeviceType["Automation"] = "automation";
+	/** Door / smart lock device (HA `lock.*`). `lock-control` cap. */
+	DeviceType["Lock"] = "lock";
+	/** Window covering, blinds, garage door, valve, etc. (HA `cover.*`,
+	*  `valve.*`). `cover` cap with sub-roles for variant. */
+	DeviceType["Cover"] = "cover";
+	/** Pipe / water / gas valve with open/close/stop and optional
+	*  position (HA `valve.*`). `valve` cap — a cover-sibling actuator
+	*  modelled on the same open/closed lifecycle. */
+	DeviceType["Valve"] = "valve";
+	/** Humidifier / dehumidifier with on/off + target humidity + mode
+	*  (HA `humidifier.*`). `humidifier` cap — a climate-family actuator
+	*  modelled on the same target / mode lifecycle. */
+	DeviceType["Humidifier"] = "humidifier";
+	/** Water heater / boiler with target temperature + operation mode +
+	*  away mode (HA `water_heater.*`). `water-heater` cap — a
+	*  climate-family actuator. */
+	DeviceType["WaterHeater"] = "water-heater";
+	/** Ceiling / standing / exhaust fan (HA `fan.*`). `fan-control` cap. */
+	DeviceType["Fan"] = "fan";
+	/** Audio / video playback endpoint (HA `media_player.*`). Disjoint from
+	*  the camera surface — those use `Camera`. `media-player` cap. */
+	DeviceType["MediaPlayer"] = "media-player";
+	/** Security panel / alarm system (HA `alarm_control_panel.*`).
+	*  `alarm-panel` cap. */
+	DeviceType["AlarmPanel"] = "alarm-panel";
+	/** Generic user-settable input (HA `number` / `input_number` / `select`
+	*  / `input_select` / `text` / `input_text` / `input_datetime`).
+	*  Sub-type via `DeviceRole`: NumericControl / SelectControl /
+	*  TextControl / DateTimeControl. */
+	DeviceType["Control"] = "control";
+	/** Person / device-tracker presence (HA `person.*`, `device_tracker.*`).
+	*  `presence` cap. */
+	DeviceType["Presence"] = "presence";
+	/** Weather provider (HA `weather.*`). Tier-3, low MVP priority.
+	*  `weather` cap. */
+	DeviceType["Weather"] = "weather";
+	/** Robot vacuum (HA `vacuum.*`). Tier-3. `vacuum-control` cap. */
+	DeviceType["Vacuum"] = "vacuum";
+	/** Robotic lawn mower (HA `lawn_mower.*`). Tier-3.
+	*  `lawn-mower-control` cap. */
+	DeviceType["LawnMower"] = "lawn-mower";
+	/** Physical HA device group — parent container for entity-children
+	*  adopted from a single HA device entry. Not renderable as a
+	*  standalone device; exists only to anchor child entities. */
+	DeviceType["Container"] = "container";
+	/** Single still-image entity (HA `image.*`). Read-only display of an
+	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
+	DeviceType["Image"] = "image";
+	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
+	*  level, battery, desiccant life, feeding state and manual-feed /
+	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
+	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
+	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
+	*  integrations sharing the same food/desiccant/hopper surface. */
+	DeviceType["PetFeeder"] = "pet-feeder";
+	/** Pet water fountain — tank level, water drunk, pump and its duty cycle.
+	*  Installed with the `pet-fountain` cap. Reaches CamStack as loose entities
+	*  of a container and is BUILT as a composed device (D967). */
+	DeviceType["PetFountain"] = "pet-fountain";
+	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
+	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
+	*  Sources: native Bosch Home Connect, reusable by similar integrations.
+	*  A plug-built dishwasher carries running-state and power instead. */
+	DeviceType["Dishwasher"] = "dishwasher";
+	/** Washing machine. A plug-built one is running while its power stays
+	*  above a threshold. No program cap — that surface is the dishwasher's. */
+	DeviceType["Washer"] = "washer";
+	/** Tumble dryer. Same plug-built running surface as {@link Washer}. */
+	DeviceType["Dryer"] = "dryer";
+	/** The physical bridge box of a vendor ecosystem (Velux KLF-200, and later
+	*  other radio-to-IP bridges). It carries the box's own facts (firmware,
+	*  address, connection state) and the actions the box really supports
+	*  (`reboot`, `device-admin-link`). Products are NOT its children — they are
+	*  adopted beside it — and its connection settings stay on the integration. */
+	DeviceType["Gateway"] = "gateway";
+	return DeviceType;
+}({});
+var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
+	DeviceFeature["BatteryOperated"] = "battery-operated";
+	DeviceFeature["Rebootable"] = "rebootable";
+	/**
+	* Device supports an on-demand re-sync of its derived spec with its
+	* upstream source — drives the generic Re-sync button. The owning
+	* provider implements the action via the `device-adoption.resync` cap.
+	*/
+	DeviceFeature["Resyncable"] = "resyncable";
+	DeviceFeature["NativeSnapshot"] = "native-snapshot";
+	DeviceFeature["DoorbellButton"] = "doorbell-button";
+	DeviceFeature["TwoWayAudio"] = "two-way-audio";
+	DeviceFeature["PanTiltZoom"] = "pan-tilt-zoom";
+	/**
+	* Camera supports the on-firmware autotrack subsystem (subject-
+	* following). Distinct from `PanTiltZoom` because not every PTZ
+	* camera ships autotrack — the admin UI uses this flag to gate
+	* the autotrack toggle / settings card without re-deriving from
+	* the cap registry. Mirrors `ptz-autotrack` cap registration:
+	* driver sets this feature when probe confirms the firmware
+	* surface, and registers the cap in the same code path.
+	*/
+	DeviceFeature["PtzAutotrack"] = "ptz-autotrack";
+	/**
+	* Accessory exposes a "trigger on motion" toggle — the parent camera's
+	* motion detection automatically activates this device. Mirrors
+	* `motion-trigger` cap registration: drivers set this feature in the
+	* same code path that calls `ctx.registerNativeCap(motionTriggerCapability, ...)`.
+	*
+	* Used by admin UI (gate the in-hero `MotionTriggerToggle` against a
+	* fast scalar without binding fetch), notifier rules, and `listAll`
+	* filters that want "all devices with on-motion behaviour".
+	*/
+	DeviceFeature["MotionTrigger"] = "motion-trigger";
+	/** Light supports rgb-triplet color via `color` cap. */
+	DeviceFeature["LightColorRgb"] = "light-color-rgb";
+	/** Light supports HSV color via `color` cap. */
+	DeviceFeature["LightColorHsv"] = "light-color-hsv";
+	/** Light supports color-temperature (mired) via `color` cap. */
+	DeviceFeature["LightColorMired"] = "light-color-mired";
+	/** Thermostat supports a `heat_cool` dual setpoint (targetLow +
+	*  targetHigh). Gates the range slider UI. */
+	DeviceFeature["ClimateDualSetpoint"] = "climate-dual-setpoint";
+	/** Thermostat exposes target humidity and/or current humidity
+	*  readings. Gates the humidity controls. */
+	DeviceFeature["ClimateHumidity"] = "climate-humidity";
+	/** Thermostat exposes a fan-mode selector. */
+	DeviceFeature["ClimateFanMode"] = "climate-fan-mode";
+	/** Thermostat exposes preset modes (eco / away / sleep / vendor). */
+	DeviceFeature["ClimatePreset"] = "climate-preset";
+	/** Thermostat exposes a vertical louver swing toggle. Gates the
+	*  vertical-swing switch in the climate UI. Independent of horizontal. */
+	DeviceFeature["ClimateSwingVertical"] = "climate-swing-vertical";
+	/** Thermostat exposes a horizontal louver swing toggle. Gates the
+	*  horizontal-swing switch in the climate UI. Independent of vertical. */
+	DeviceFeature["ClimateSwingHorizontal"] = "climate-swing-horizontal";
+	/** Cover exposes intermediate position control (0..100). Gates the
+	*  position slider UI. */
+	DeviceFeature["CoverPositionable"] = "cover-positionable";
+	/** Cover exposes slat-tilt control. Gates the tilt slider UI. */
+	DeviceFeature["CoverTilt"] = "cover-tilt";
+	/** Valve exposes intermediate position control (0..100). Gates the
+	*  position slider / drag surface UI. */
+	DeviceFeature["ValvePositionable"] = "valve-positionable";
+	/** Fan exposes a speed-percentage setter. Gates the speed slider UI. */
+	DeviceFeature["FanSpeed"] = "fan-speed";
+	/** Fan exposes a preset mode selector. */
+	DeviceFeature["FanPreset"] = "fan-preset";
+	/** Fan exposes blade direction (forward/reverse) — typical of
+	*  ceiling fans. */
+	DeviceFeature["FanDirection"] = "fan-direction";
+	/** Fan exposes an oscillation toggle. */
+	DeviceFeature["FanOscillating"] = "fan-oscillating";
+	/** Lock requires a PIN code on lock/unlock. Gates the code-entry
+	*  field on the UI lock-controls panel. */
+	DeviceFeature["LockPinRequired"] = "lock-pin-required";
+	/** Lock supports a latch-release ("open door") action distinct from
+	*  unlock. Mirrors HA `LockEntityFeature.OPEN` (bit 1) in
+	*  `supported_features`. Gates the Open Door button in the UI. */
+	DeviceFeature["LockOpen"] = "lock-open";
+	/** Media player exposes a seek-to-position surface. */
+	DeviceFeature["MediaPlayerSeek"] = "media-player-seek";
+	/** Media player exposes a volume-level setter. */
+	DeviceFeature["MediaPlayerVolume"] = "media-player-volume";
+	/** Media player exposes a mute toggle distinct from volume=0. */
+	DeviceFeature["MediaPlayerMute"] = "media-player-mute";
+	/** Media player exposes a shuffle toggle. */
+	DeviceFeature["MediaPlayerShuffle"] = "media-player-shuffle";
+	/** Media player exposes a repeat mode (off / all / one). */
+	DeviceFeature["MediaPlayerRepeat"] = "media-player-repeat";
+	/** Media player exposes a source / input selector. */
+	DeviceFeature["MediaPlayerSelectSource"] = "media-player-select-source";
+	/** Media player exposes a play-arbitrary-media surface (URL / id). */
+	DeviceFeature["MediaPlayerPlayMedia"] = "media-player-play-media";
+	/** Media player exposes next-track. */
+	DeviceFeature["MediaPlayerNext"] = "media-player-next";
+	/** Media player exposes previous-track. */
+	DeviceFeature["MediaPlayerPrevious"] = "media-player-previous";
+	/** Media player exposes stop distinct from pause. */
+	DeviceFeature["MediaPlayerStop"] = "media-player-stop";
+	/** Alarm panel requires a PIN code on arm/disarm. */
+	DeviceFeature["AlarmPinRequired"] = "alarm-pin-required";
+	/** Presence device carries GPS coordinates (lat/lng/accuracy) in
+	*  addition to a textual location. */
+	DeviceFeature["PresenceGps"] = "presence-gps";
+	/** Notifier accepts an inline / URL image attachment. */
+	DeviceFeature["NotifierImage"] = "notifier-image";
+	/** Notifier accepts a priority hint (high/normal/low). */
+	DeviceFeature["NotifierPriority"] = "notifier-priority";
+	/** Notifier accepts a free-form `data` payload for platform-specific
+	*  fields. */
+	DeviceFeature["NotifierData"] = "notifier-data";
+	/** Notifier supports interactive action buttons / callbacks. */
+	DeviceFeature["NotifierActions"] = "notifier-actions";
+	/** Notifier supports per-call recipient targeting (multi-user). */
+	DeviceFeature["NotifierRecipients"] = "notifier-recipients";
+	/** Script runner accepts a variables map on each run invocation. */
+	DeviceFeature["ScriptVariables"] = "script-variables";
+	/** Automation `trigger` accepts a skipCondition flag — fires the
+	*  automation's actions while bypassing its condition block. */
+	DeviceFeature["AutomationSkipCondition"] = "automation-skip-condition";
+	/** Robot vacuum exposes a live cleaning map (image child). Gates the
+	*  map tile in the vacuum UI. */
+	DeviceFeature["VacuumHasMap"] = "vacuum-has-map";
+	/** Robot vacuum exposes AI obstacle-detection toggles. Gates the AI
+	*  switches group. */
+	DeviceFeature["VacuumHasAi"] = "vacuum-has-ai";
+	/** Robot mower exposes a live mowing map (SVG image child). Gates the
+	*  mower map tile. */
+	DeviceFeature["MowerHasMap"] = "mower-has-map";
+	/** Robot mower exposes targeted mowing (all-area / zones / edges /
+	*  spots) — gates the Mow action + map selectors. */
+	DeviceFeature["MowerHasTargetedMowing"] = "mower-has-targeted-mowing";
+	return DeviceFeature;
+}({});
+/**
+* Semantic role a device plays within its parent. Populated by driver
+* addons when creating accessory devices (Reolink siren/floodlight/
+* PIR/chime/autotrack/doorbell, ONVIF relay outputs, …). Used by the
+* admin UI to pick icons, labels, and widgets — a `Switch` with
+* `role: Floodlight` renders as a bulb with a brightness slider,
+* whereas a `Switch` with `role: Siren` renders as a klaxon.
+*
+* Undefined for top-level devices (cameras, NVRs, hubs). Persisted in
+* sqlite as a nullable TEXT column — old rows keep working unchanged.
+*/
+var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
+	DeviceRole["Siren"] = "siren";
+	DeviceRole["Floodlight"] = "floodlight";
+	DeviceRole["Spotlight"] = "spotlight";
+	DeviceRole["PirSensor"] = "pir-sensor";
+	DeviceRole["Chime"] = "chime";
+	DeviceRole["Autotrack"] = "autotrack";
+	DeviceRole["Nightvision"] = "nightvision";
+	DeviceRole["PrivacyMask"] = "privacy-mask";
+	DeviceRole["Doorbell"] = "doorbell";
+	/** Interior blind / shade / roller blind. HA `device_class: blind|shade`. */
+	DeviceRole["CoverBlind"] = "cover-blind";
+	/** Exterior roller shutter. HA `device_class: shutter`; Homematic BROLL. */
+	DeviceRole["CoverShutter"] = "cover-shutter";
+	/** Exterior awning. HA `device_class: awning`. */
+	DeviceRole["CoverAwning"] = "cover-awning";
+	/** Curtain / drape. HA `device_class: curtain`. */
+	DeviceRole["CoverCurtain"] = "cover-curtain";
+	/** Garage door. HA `device_class: garage`. A security actuator: exports gate it. */
+	DeviceRole["CoverGarage"] = "cover-garage";
+	/** Gate. HA `device_class: gate`. A security actuator: exports gate it. */
+	DeviceRole["CoverGate"] = "cover-gate";
+	/** Door. HA `device_class: door`. A security actuator: exports gate it. */
+	DeviceRole["CoverDoor"] = "cover-door";
+	/** Window. HA `device_class: window`. */
+	DeviceRole["CoverWindow"] = "cover-window";
+	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
+	*  real Switch device for UI rendering / export adapters. */
+	DeviceRole["BinaryHelper"] = "binary-helper";
+	/** A smart plug: a `switch` whose source says it is an outlet (HA
+	*  `device_class: outlet`). The Alexa export shows it as a SMARTPLUG. */
+	DeviceRole["Outlet"] = "outlet";
+	/** Generic motion / occupancy / moving event source. Distinct from
+	*  the camera accessory PirSensor role: that one is a camera child;
+	*  this is a standalone HA / 3rd-party motion sensor. */
+	DeviceRole["MotionSensor"] = "motion-sensor";
+	DeviceRole["ContactSensor"] = "contact-sensor";
+	DeviceRole["LeakSensor"] = "leak-sensor";
+	DeviceRole["SmokeSensor"] = "smoke-sensor";
+	DeviceRole["COSensor"] = "co-sensor";
+	DeviceRole["GasSensor"] = "gas-sensor";
+	DeviceRole["TamperSensor"] = "tamper-sensor";
+	DeviceRole["VibrationSensor"] = "vibration-sensor";
+	DeviceRole["ConnectivitySensor"] = "connectivity-sensor";
+	DeviceRole["SoundSensor"] = "sound-sensor";
+	/** Fallback for `binary_sensor` without a known `device_class`. */
+	DeviceRole["BinarySensor"] = "binary-sensor";
+	DeviceRole["TemperatureSensor"] = "temperature-sensor";
+	DeviceRole["HumiditySensor"] = "humidity-sensor";
+	DeviceRole["AmbientLightSensor"] = "ambient-light-sensor";
+	DeviceRole["PressureSensor"] = "pressure-sensor";
+	/** Wind speed or direction (weather-station `wind-sensor` cap). */
+	DeviceRole["WindSensor"] = "wind-sensor";
+	/** Rain accumulation or rate (weather-station `rain-sensor` cap). */
+	DeviceRole["RainSensor"] = "rain-sensor";
+	/** UV index (weather-station `uv-sensor` cap). */
+	DeviceRole["UvSensor"] = "uv-sensor";
+	/** Solar irradiance W/m² (weather-station `solar-radiation-sensor` cap).
+	*  Distinct from AmbientLightSensor (lux). */
+	DeviceRole["SolarRadiationSensor"] = "solar-radiation-sensor";
+	/** Soil moisture % (garden/weather `soil-moisture-sensor` cap). */
+	DeviceRole["SoilMoistureSensor"] = "soil-moisture-sensor";
+	DeviceRole["PowerSensor"] = "power-sensor";
+	DeviceRole["EnergySensor"] = "energy-sensor";
+	DeviceRole["VoltageSensor"] = "voltage-sensor";
+	DeviceRole["CurrentSensor"] = "current-sensor";
+	DeviceRole["AirQualitySensor"] = "air-quality-sensor";
+	/** Battery level (numeric % via `sensor` OR low-bool via
+	*  `binary_sensor` — the cap distinguishes via the value type). */
+	DeviceRole["BatterySensor"] = "battery-sensor";
+	/** Fallback for `sensor` numeric without a known `device_class`. */
+	DeviceRole["NumericSensor"] = "numeric-sensor";
+	/** String / enum state (HA `sensor` with `state_class: enum` or
+	*  `attributes.options`). */
+	DeviceRole["EnumSensor"] = "enum-sensor";
+	/** Date / timestamp state (HA `sensor` with `device_class: timestamp`
+	*  or `date`). The slice carries the raw ISO string verbatim (hosted on
+	*  the `enum-sensor` cap); the UI renders it locale-formatted. */
+	DeviceRole["DateTimeSensor"] = "datetime-sensor";
+	/** Last-resort fallback when nothing else matches. */
+	DeviceRole["GenericSensor"] = "generic-sensor";
+	DeviceRole["NumericControl"] = "numeric-control";
+	DeviceRole["SelectControl"] = "select-control";
+	DeviceRole["TextControl"] = "text-control";
+	DeviceRole["DateTimeControl"] = "datetime-control";
+	/** Mobile push notifier (HA `notify.mobile_app_*`) — supports
+	*  rich features (image, priority, channel routing). */
+	DeviceRole["MobilePushNotifier"] = "mobile-push-notifier";
+	/** Chat / messaging service (HA `notify.telegram_*`,
+	*  `notify.discord_*`, etc.). */
+	DeviceRole["MessagingNotifier"] = "messaging-notifier";
+	/** Email-based delivery (HA `notify.smtp`, etc.). */
+	DeviceRole["EmailNotifier"] = "email-notifier";
+	/** Fallback when the notifier service name doesn't match a known
+	*  pattern. */
+	DeviceRole["GenericNotifier"] = "generic-notifier";
+	/** Emits a pulse train (infrared or RF) on request — the `ir-transmitter`
+	*  cap. A `DeviceType.Generic` device. */
+	DeviceRole["IrTransmitter"] = "ir-transmitter";
+	return DeviceRole;
+}({});
+//#endregion
 //#region ../../node_modules/zod/v4/core/core.js
 var _a$1;
 function $constructor(name, initializer, params) {
@@ -5587,7 +5963,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-dco0-jRo.mjs
+//#region ../types/dist/sleep-CSYuxssh.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6103,6 +6479,102 @@ function emitReadiness(bus, params) {
 		ts
 	}));
 }
+var NOT_RUN = {
+	declared: false,
+	snapshot: null,
+	applied: [],
+	failed: [],
+	blocked: [],
+	skipped: [],
+	blockOwner: []
+};
+/**
+* Offer `migrations` to the engine and run what it says to run, in its order. Never
+* throws: an unreachable or refusing engine is logged and reported `declared: false`,
+* because the hub (and this addon's boot) must not hang on a migration.
+*/
+async function runAddonMigrations(host, migrations, logger) {
+	const first = migrations[0];
+	if (first === void 0) return NOT_RUN;
+	const owner = first.meta.owner;
+	const log = logger.withTags({ migrationOwner: owner });
+	const byId = new Map(migrations.map((m) => [m.meta.id, m]));
+	let declaration;
+	try {
+		declaration = await host.declareOwner({
+			owner,
+			metas: migrations.map((m) => m.meta)
+		});
+	} catch (err) {
+		log.error("the migration engine refused or could not take this addon catalogue — none ran", { meta: { error: errMsg(err) } });
+		return {
+			...NOT_RUN,
+			blockOwner: migrations.filter((m) => m.meta.onFailure === "block-owner").map((m) => m.meta.id)
+		};
+	}
+	const applied = [];
+	const failed = [];
+	const blocked = [];
+	const skipped = [];
+	const settle = (id, status) => {
+		if (status === "applied") applied.push(id);
+		else if (status === "failed") failed.push(id);
+		else if (status === "blocked") blocked.push(id);
+		else skipped.push(id);
+	};
+	for (const step of declaration.steps) {
+		const bound = byId.get(step.id);
+		if (bound === void 0 || step.action === "skip") {
+			skipped.push(step.id);
+			continue;
+		}
+		const tags = { migrationId: step.id };
+		try {
+			const gate = await host.startMigration({ id: step.id });
+			if (!gate.proceed) {
+				log.warn("migration not run", {
+					tags,
+					meta: {
+						state: gate.state,
+						reason: gate.reason
+					}
+				});
+				settle(step.id, gate.state === "pending" ? "blocked" : gate.state);
+				continue;
+			}
+			const result = await bound.execute();
+			const outcome = await host.finishMigration({
+				id: step.id,
+				result
+			});
+			if (outcome.status === "applied") log.info("migration applied", {
+				tags,
+				meta: { rowsChanged: outcome.rowsChanged }
+			});
+			else log.error("migration failed", {
+				tags,
+				meta: { error: outcome.error }
+			});
+			settle(step.id, outcome.status);
+		} catch (err) {
+			log.error("migration could not be completed with the engine", {
+				tags,
+				meta: { error: errMsg(err) }
+			});
+			failed.push(step.id);
+		}
+	}
+	const blockOwner = [...failed, ...blocked].filter((id) => byId.get(id)?.meta.onFailure === "block-owner");
+	return {
+		declared: true,
+		snapshot: declaration.snapshot,
+		applied,
+		failed,
+		blocked,
+		skipped,
+		blockOwner
+	};
+}
 /**
 * Build a {@link DurableState} over a single store key. Transport-agnostic:
 * `read`/`write` are the addon-store or device-store accessors. The whole
@@ -7158,6 +7630,28 @@ var BaseAddon = class {
 		return normalized;
 	}
 	/**
+	* Run this addon's migration catalogue (D987 M3) through the hub's `migrations`
+	* engine. Call it at the point of the boot where the data must already have the new
+	* shape — `onInitialize`, or `onRestoreDevices` for a migration that needs the
+	* restored devices — with the catalogue bound to the addon's ports
+	* (`defineAddonMigrations(ADDON_MIGRATIONS, ports)`).
+	*
+	* An engine that cannot be reached or refuses the catalogue is logged and runs
+	* nothing; the boot continues. A migration that FAILED (or was blocked by one)
+	* and declares `onFailure: 'block-owner'` makes this throw, so the addon does not
+	* serve data whose shape it cannot trust; `tolerate` migrations never do.
+	*/
+	async runMigrations(migrations) {
+		const api = this.ctx.api.migrations;
+		const report = await runAddonMigrations({
+			declareOwner: (input) => api.declareOwner.mutate(input),
+			startMigration: (input) => api.startMigration.mutate(input),
+			finishMigration: (input) => api.finishMigration.mutate(input)
+		}, migrations, this.ctx.logger);
+		if (report.blockOwner.length > 0) throw new Error(`migration(s) ${report.blockOwner.join(", ")} did not apply and block this addon — fix or retry them (migrations.retry), then restart it`);
+		return report;
+	}
+	/**
 	* Called by the isolated-process runner AFTER `broker.start()`.
 	* In-process addons never need this because the hub broker is already
 	* running when `initialize()` fires. For forked children the broker
@@ -8455,6 +8949,98 @@ function defineEntryKind(name, spec) {
 	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
 	return defined;
 }
+object({
+	field: string().min(1),
+	on: literal("advance")
+});
+/**
+* Output schema shared by the contribution + live methods.
+*
+* Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
+* tabs[]) without importing from `../interfaces/config-ui.js` — a
+* concrete-but-lenient Zod object keeps tRPC output inference happy
+* (using `z.unknown()` here collapses unrelated router branches to
+* `unknown` when the generator re-inlines the huge AppRouter type).
+*
+* `.passthrough()` on sections/fields accepts whatever FormBuilder
+* extensions the caller adds (showWhen, displayScale, …) without
+* rebuilding every time a new field kind is introduced.
+*/
+var ContributionSectionSchema = object({
+	id: string(),
+	title: string(),
+	description: string().optional(),
+	style: _enum(["card", "accordion"]).optional(),
+	defaultCollapsed: boolean().optional(),
+	columns: union([
+		literal(1),
+		literal(2),
+		literal(3),
+		literal(4)
+	]).optional(),
+	tab: string().optional(),
+	location: _enum([
+		"settings",
+		"top-tab",
+		"hero"
+	]).optional(),
+	order: number().optional(),
+	fields: array(any())
+});
+object({
+	tabs: array(object({
+		id: string(),
+		label: string(),
+		icon: string(),
+		order: number().optional()
+	})).optional(),
+	sections: array(ContributionSectionSchema)
+}).nullable();
+object({ deviceId: number() }), object({ deviceId: number() }), object({
+	deviceId: number(),
+	patch: record(string(), unknown())
+}), object({ success: literal(true) });
+object({ deviceId: number() }), unknown().nullable();
+function method(input, output, options) {
+	return {
+		input,
+		output,
+		kind: options?.kind ?? "query",
+		...options?.auth !== void 0 ? { auth: options.auth } : {},
+		...options?.access !== void 0 ? { access: options.access } : {},
+		...options?.role !== void 0 ? { role: options.role } : {},
+		...options?.caller !== void 0 ? { caller: options.caller } : {},
+		timeoutMs: options?.timeoutMs
+	};
+}
+/**
+* A wrapper/system-only method: served exclusively by the cap's system-level
+* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
+* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
+* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
+*/
+function systemMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		systemOnly: true
+	};
+}
+/**
+* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
+* on `InferProvider`. The `providerOptional: true` literal is what
+* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
+* for when this is the honest answer and when it is a soft stub.
+*/
+function optionalMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		providerOptional: true
+	};
+}
+/** Shorthand to define an event schema */
+function event(data) {
+	return { data };
+}
 var READING_QUANTITIES = [
 	"temperature",
 	"pressure",
@@ -8847,7 +9433,7 @@ var ProfileRtspEntrySchema = object({
 /**
 * The model weight formats a catalog entry can ship. Schema-free on purpose:
 * `types/models.ts` builds Zod schemas from it, but a runner-closure consumer
-* (the model downloader in `@camstack/system`) needs only the list and must
+* (the model downloader in `@camstack/server/system`) needs only the list and must
 * reach it through `@camstack/types/addon` without building the cap schema
 * graph (D28).
 */
@@ -8859,98 +9445,6 @@ var MODEL_FORMATS = [
 	"pt",
 	"gguf"
 ];
-object({
-	field: string().min(1),
-	on: literal("advance")
-});
-/**
-* Output schema shared by the contribution + live methods.
-*
-* Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
-* tabs[]) without importing from `../interfaces/config-ui.js` — a
-* concrete-but-lenient Zod object keeps tRPC output inference happy
-* (using `z.unknown()` here collapses unrelated router branches to
-* `unknown` when the generator re-inlines the huge AppRouter type).
-*
-* `.passthrough()` on sections/fields accepts whatever FormBuilder
-* extensions the caller adds (showWhen, displayScale, …) without
-* rebuilding every time a new field kind is introduced.
-*/
-var ContributionSectionSchema = object({
-	id: string(),
-	title: string(),
-	description: string().optional(),
-	style: _enum(["card", "accordion"]).optional(),
-	defaultCollapsed: boolean().optional(),
-	columns: union([
-		literal(1),
-		literal(2),
-		literal(3),
-		literal(4)
-	]).optional(),
-	tab: string().optional(),
-	location: _enum([
-		"settings",
-		"top-tab",
-		"hero"
-	]).optional(),
-	order: number().optional(),
-	fields: array(any())
-});
-object({
-	tabs: array(object({
-		id: string(),
-		label: string(),
-		icon: string(),
-		order: number().optional()
-	})).optional(),
-	sections: array(ContributionSectionSchema)
-}).nullable();
-object({ deviceId: number() }), object({ deviceId: number() }), object({
-	deviceId: number(),
-	patch: record(string(), unknown())
-}), object({ success: literal(true) });
-object({ deviceId: number() }), unknown().nullable();
-function method(input, output, options) {
-	return {
-		input,
-		output,
-		kind: options?.kind ?? "query",
-		...options?.auth !== void 0 ? { auth: options.auth } : {},
-		...options?.access !== void 0 ? { access: options.access } : {},
-		...options?.role !== void 0 ? { role: options.role } : {},
-		...options?.caller !== void 0 ? { caller: options.caller } : {},
-		timeoutMs: options?.timeoutMs
-	};
-}
-/**
-* A wrapper/system-only method: served exclusively by the cap's system-level
-* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
-* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
-* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
-*/
-function systemMethod(input, output, options) {
-	return {
-		...method(input, output, options),
-		systemOnly: true
-	};
-}
-/**
-* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
-* on `InferProvider`. The `providerOptional: true` literal is what
-* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
-* for when this is the honest answer and when it is a soft stub.
-*/
-function optionalMethod(input, output, options) {
-	return {
-		...method(input, output, options),
-		providerOptional: true
-	};
-}
-/** Shorthand to define an event schema */
-function event(data) {
-	return { data };
-}
 /**
 * Per-call node pinning for `ctx.api` capability calls.
 *
@@ -9251,6 +9745,7 @@ var CAP_NAMES = Object.freeze([
 	"mesh-network",
 	"meter",
 	"metrics-provider",
+	"migrations",
 	"model-convert",
 	"model-distributor",
 	"motion",
@@ -11153,379 +11648,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/err-msg-BD5buxvT.mjs
-var DeviceType = /* @__PURE__ */ function(DeviceType) {
-	DeviceType["Camera"] = "camera";
-	DeviceType["Hub"] = "hub";
-	DeviceType["Light"] = "light";
-	DeviceType["Siren"] = "siren";
-	DeviceType["Switch"] = "switch";
-	DeviceType["Sensor"] = "sensor";
-	DeviceType["Thermostat"] = "thermostat";
-	/** Air-conditioner / heat-pump climate device (HVAC) — shares the
-	*  `climate-control` cap surface with `Thermostat` but renders a
-	*  dedicated AC-appropriate control UI (mode chips, fan speed,
-	*  independent vertical/horizontal swing). Sources: native Gree, and
-	*  reusable by other AC integrations. */
-	DeviceType["Climate"] = "climate";
-	DeviceType["Button"] = "button";
-	/** Generic stateless event emitter — carries a device's EXACT declared
-	*  event vocabulary verbatim (no normalization). Installed with the
-	*  `event-emitter` cap. Sources: HA `event.*` entities (structured) and
-	*  HA bus events (e.g. `zha_event`, generic). */
-	DeviceType["EventEmitter"] = "event-emitter";
-	/** Firmware/software update entity — current vs available version,
-	*  updatable flag, update state, and an install action. Installed with
-	*  the `update` cap. Sources: Homematic firmware-update channels (and
-	*  reusable by other providers, e.g. HA `update.*` entities). */
-	DeviceType["Update"] = "update";
-	DeviceType["Generic"] = "generic";
-	/** Generic notification delivery target (HA `notify.<service>`, future
-	*  Telegram / Discord / ntfy / SMTP, …). One device per delivery
-	*  endpoint; the `notifier` cap defines the send surface. */
-	DeviceType["Notifier"] = "notifier";
-	/** Pre-recorded action sequence with optional parameters
-	*  (HA `script.*`). Runnable via `script-runner` cap. */
-	DeviceType["Script"] = "script";
-	/** Automation rule (HA `automation.*`) — enable/disable + manual
-	*  trigger surface exposed via `automation-control` cap. */
-	DeviceType["Automation"] = "automation";
-	/** Door / smart lock device (HA `lock.*`). `lock-control` cap. */
-	DeviceType["Lock"] = "lock";
-	/** Window covering, blinds, garage door, valve, etc. (HA `cover.*`,
-	*  `valve.*`). `cover` cap with sub-roles for variant. */
-	DeviceType["Cover"] = "cover";
-	/** Pipe / water / gas valve with open/close/stop and optional
-	*  position (HA `valve.*`). `valve` cap — a cover-sibling actuator
-	*  modelled on the same open/closed lifecycle. */
-	DeviceType["Valve"] = "valve";
-	/** Humidifier / dehumidifier with on/off + target humidity + mode
-	*  (HA `humidifier.*`). `humidifier` cap — a climate-family actuator
-	*  modelled on the same target / mode lifecycle. */
-	DeviceType["Humidifier"] = "humidifier";
-	/** Water heater / boiler with target temperature + operation mode +
-	*  away mode (HA `water_heater.*`). `water-heater` cap — a
-	*  climate-family actuator. */
-	DeviceType["WaterHeater"] = "water-heater";
-	/** Ceiling / standing / exhaust fan (HA `fan.*`). `fan-control` cap. */
-	DeviceType["Fan"] = "fan";
-	/** Audio / video playback endpoint (HA `media_player.*`). Disjoint from
-	*  the camera surface — those use `Camera`. `media-player` cap. */
-	DeviceType["MediaPlayer"] = "media-player";
-	/** Security panel / alarm system (HA `alarm_control_panel.*`).
-	*  `alarm-panel` cap. */
-	DeviceType["AlarmPanel"] = "alarm-panel";
-	/** Generic user-settable input (HA `number` / `input_number` / `select`
-	*  / `input_select` / `text` / `input_text` / `input_datetime`).
-	*  Sub-type via `DeviceRole`: NumericControl / SelectControl /
-	*  TextControl / DateTimeControl. */
-	DeviceType["Control"] = "control";
-	/** Person / device-tracker presence (HA `person.*`, `device_tracker.*`).
-	*  `presence` cap. */
-	DeviceType["Presence"] = "presence";
-	/** Weather provider (HA `weather.*`). Tier-3, low MVP priority.
-	*  `weather` cap. */
-	DeviceType["Weather"] = "weather";
-	/** Robot vacuum (HA `vacuum.*`). Tier-3. `vacuum-control` cap. */
-	DeviceType["Vacuum"] = "vacuum";
-	/** Robotic lawn mower (HA `lawn_mower.*`). Tier-3.
-	*  `lawn-mower-control` cap. */
-	DeviceType["LawnMower"] = "lawn-mower";
-	/** Physical HA device group — parent container for entity-children
-	*  adopted from a single HA device entry. Not renderable as a
-	*  standalone device; exists only to anchor child entities. */
-	DeviceType["Container"] = "container";
-	/** Single still-image entity (HA `image.*`). Read-only display of an
-	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
-	DeviceType["Image"] = "image";
-	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
-	*  level, battery, desiccant life, feeding state and manual-feed /
-	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
-	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
-	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
-	*  integrations sharing the same food/desiccant/hopper surface. */
-	DeviceType["PetFeeder"] = "pet-feeder";
-	/** Pet water fountain — tank level, water drunk, pump and its duty cycle.
-	*  Installed with the `pet-fountain` cap. Reaches CamStack as loose entities
-	*  of a container and is BUILT as a composed device (D967). */
-	DeviceType["PetFountain"] = "pet-fountain";
-	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
-	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
-	*  Sources: native Bosch Home Connect, reusable by similar integrations.
-	*  A plug-built dishwasher carries running-state and power instead. */
-	DeviceType["Dishwasher"] = "dishwasher";
-	/** Washing machine. A plug-built one is running while its power stays
-	*  above a threshold. No program cap — that surface is the dishwasher's. */
-	DeviceType["Washer"] = "washer";
-	/** Tumble dryer. Same plug-built running surface as {@link Washer}. */
-	DeviceType["Dryer"] = "dryer";
-	/** The physical bridge box of a vendor ecosystem (Velux KLF-200, and later
-	*  other radio-to-IP bridges). It carries the box's own facts (firmware,
-	*  address, connection state) and the actions the box really supports
-	*  (`reboot`, `device-admin-link`). Products are NOT its children — they are
-	*  adopted beside it — and its connection settings stay on the integration. */
-	DeviceType["Gateway"] = "gateway";
-	return DeviceType;
-}({});
-var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
-	DeviceFeature["BatteryOperated"] = "battery-operated";
-	DeviceFeature["Rebootable"] = "rebootable";
-	/**
-	* Device supports an on-demand re-sync of its derived spec with its
-	* upstream source — drives the generic Re-sync button. The owning
-	* provider implements the action via the `device-adoption.resync` cap.
-	*/
-	DeviceFeature["Resyncable"] = "resyncable";
-	DeviceFeature["NativeSnapshot"] = "native-snapshot";
-	DeviceFeature["DoorbellButton"] = "doorbell-button";
-	DeviceFeature["TwoWayAudio"] = "two-way-audio";
-	DeviceFeature["PanTiltZoom"] = "pan-tilt-zoom";
-	/**
-	* Camera supports the on-firmware autotrack subsystem (subject-
-	* following). Distinct from `PanTiltZoom` because not every PTZ
-	* camera ships autotrack — the admin UI uses this flag to gate
-	* the autotrack toggle / settings card without re-deriving from
-	* the cap registry. Mirrors `ptz-autotrack` cap registration:
-	* driver sets this feature when probe confirms the firmware
-	* surface, and registers the cap in the same code path.
-	*/
-	DeviceFeature["PtzAutotrack"] = "ptz-autotrack";
-	/**
-	* Accessory exposes a "trigger on motion" toggle — the parent camera's
-	* motion detection automatically activates this device. Mirrors
-	* `motion-trigger` cap registration: drivers set this feature in the
-	* same code path that calls `ctx.registerNativeCap(motionTriggerCapability, ...)`.
-	*
-	* Used by admin UI (gate the in-hero `MotionTriggerToggle` against a
-	* fast scalar without binding fetch), notifier rules, and `listAll`
-	* filters that want "all devices with on-motion behaviour".
-	*/
-	DeviceFeature["MotionTrigger"] = "motion-trigger";
-	/** Light supports rgb-triplet color via `color` cap. */
-	DeviceFeature["LightColorRgb"] = "light-color-rgb";
-	/** Light supports HSV color via `color` cap. */
-	DeviceFeature["LightColorHsv"] = "light-color-hsv";
-	/** Light supports color-temperature (mired) via `color` cap. */
-	DeviceFeature["LightColorMired"] = "light-color-mired";
-	/** Thermostat supports a `heat_cool` dual setpoint (targetLow +
-	*  targetHigh). Gates the range slider UI. */
-	DeviceFeature["ClimateDualSetpoint"] = "climate-dual-setpoint";
-	/** Thermostat exposes target humidity and/or current humidity
-	*  readings. Gates the humidity controls. */
-	DeviceFeature["ClimateHumidity"] = "climate-humidity";
-	/** Thermostat exposes a fan-mode selector. */
-	DeviceFeature["ClimateFanMode"] = "climate-fan-mode";
-	/** Thermostat exposes preset modes (eco / away / sleep / vendor). */
-	DeviceFeature["ClimatePreset"] = "climate-preset";
-	/** Thermostat exposes a vertical louver swing toggle. Gates the
-	*  vertical-swing switch in the climate UI. Independent of horizontal. */
-	DeviceFeature["ClimateSwingVertical"] = "climate-swing-vertical";
-	/** Thermostat exposes a horizontal louver swing toggle. Gates the
-	*  horizontal-swing switch in the climate UI. Independent of vertical. */
-	DeviceFeature["ClimateSwingHorizontal"] = "climate-swing-horizontal";
-	/** Cover exposes intermediate position control (0..100). Gates the
-	*  position slider UI. */
-	DeviceFeature["CoverPositionable"] = "cover-positionable";
-	/** Cover exposes slat-tilt control. Gates the tilt slider UI. */
-	DeviceFeature["CoverTilt"] = "cover-tilt";
-	/** Valve exposes intermediate position control (0..100). Gates the
-	*  position slider / drag surface UI. */
-	DeviceFeature["ValvePositionable"] = "valve-positionable";
-	/** Fan exposes a speed-percentage setter. Gates the speed slider UI. */
-	DeviceFeature["FanSpeed"] = "fan-speed";
-	/** Fan exposes a preset mode selector. */
-	DeviceFeature["FanPreset"] = "fan-preset";
-	/** Fan exposes blade direction (forward/reverse) — typical of
-	*  ceiling fans. */
-	DeviceFeature["FanDirection"] = "fan-direction";
-	/** Fan exposes an oscillation toggle. */
-	DeviceFeature["FanOscillating"] = "fan-oscillating";
-	/** Lock requires a PIN code on lock/unlock. Gates the code-entry
-	*  field on the UI lock-controls panel. */
-	DeviceFeature["LockPinRequired"] = "lock-pin-required";
-	/** Lock supports a latch-release ("open door") action distinct from
-	*  unlock. Mirrors HA `LockEntityFeature.OPEN` (bit 1) in
-	*  `supported_features`. Gates the Open Door button in the UI. */
-	DeviceFeature["LockOpen"] = "lock-open";
-	/** Media player exposes a seek-to-position surface. */
-	DeviceFeature["MediaPlayerSeek"] = "media-player-seek";
-	/** Media player exposes a volume-level setter. */
-	DeviceFeature["MediaPlayerVolume"] = "media-player-volume";
-	/** Media player exposes a mute toggle distinct from volume=0. */
-	DeviceFeature["MediaPlayerMute"] = "media-player-mute";
-	/** Media player exposes a shuffle toggle. */
-	DeviceFeature["MediaPlayerShuffle"] = "media-player-shuffle";
-	/** Media player exposes a repeat mode (off / all / one). */
-	DeviceFeature["MediaPlayerRepeat"] = "media-player-repeat";
-	/** Media player exposes a source / input selector. */
-	DeviceFeature["MediaPlayerSelectSource"] = "media-player-select-source";
-	/** Media player exposes a play-arbitrary-media surface (URL / id). */
-	DeviceFeature["MediaPlayerPlayMedia"] = "media-player-play-media";
-	/** Media player exposes next-track. */
-	DeviceFeature["MediaPlayerNext"] = "media-player-next";
-	/** Media player exposes previous-track. */
-	DeviceFeature["MediaPlayerPrevious"] = "media-player-previous";
-	/** Media player exposes stop distinct from pause. */
-	DeviceFeature["MediaPlayerStop"] = "media-player-stop";
-	/** Alarm panel requires a PIN code on arm/disarm. */
-	DeviceFeature["AlarmPinRequired"] = "alarm-pin-required";
-	/** Presence device carries GPS coordinates (lat/lng/accuracy) in
-	*  addition to a textual location. */
-	DeviceFeature["PresenceGps"] = "presence-gps";
-	/** Notifier accepts an inline / URL image attachment. */
-	DeviceFeature["NotifierImage"] = "notifier-image";
-	/** Notifier accepts a priority hint (high/normal/low). */
-	DeviceFeature["NotifierPriority"] = "notifier-priority";
-	/** Notifier accepts a free-form `data` payload for platform-specific
-	*  fields. */
-	DeviceFeature["NotifierData"] = "notifier-data";
-	/** Notifier supports interactive action buttons / callbacks. */
-	DeviceFeature["NotifierActions"] = "notifier-actions";
-	/** Notifier supports per-call recipient targeting (multi-user). */
-	DeviceFeature["NotifierRecipients"] = "notifier-recipients";
-	/** Script runner accepts a variables map on each run invocation. */
-	DeviceFeature["ScriptVariables"] = "script-variables";
-	/** Automation `trigger` accepts a skipCondition flag — fires the
-	*  automation's actions while bypassing its condition block. */
-	DeviceFeature["AutomationSkipCondition"] = "automation-skip-condition";
-	/** Robot vacuum exposes a live cleaning map (image child). Gates the
-	*  map tile in the vacuum UI. */
-	DeviceFeature["VacuumHasMap"] = "vacuum-has-map";
-	/** Robot vacuum exposes AI obstacle-detection toggles. Gates the AI
-	*  switches group. */
-	DeviceFeature["VacuumHasAi"] = "vacuum-has-ai";
-	/** Robot mower exposes a live mowing map (SVG image child). Gates the
-	*  mower map tile. */
-	DeviceFeature["MowerHasMap"] = "mower-has-map";
-	/** Robot mower exposes targeted mowing (all-area / zones / edges /
-	*  spots) — gates the Mow action + map selectors. */
-	DeviceFeature["MowerHasTargetedMowing"] = "mower-has-targeted-mowing";
-	return DeviceFeature;
-}({});
-/**
-* Semantic role a device plays within its parent. Populated by driver
-* addons when creating accessory devices (Reolink siren/floodlight/
-* PIR/chime/autotrack/doorbell, ONVIF relay outputs, …). Used by the
-* admin UI to pick icons, labels, and widgets — a `Switch` with
-* `role: Floodlight` renders as a bulb with a brightness slider,
-* whereas a `Switch` with `role: Siren` renders as a klaxon.
-*
-* Undefined for top-level devices (cameras, NVRs, hubs). Persisted in
-* sqlite as a nullable TEXT column — old rows keep working unchanged.
-*/
-var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
-	DeviceRole["Siren"] = "siren";
-	DeviceRole["Floodlight"] = "floodlight";
-	DeviceRole["Spotlight"] = "spotlight";
-	DeviceRole["PirSensor"] = "pir-sensor";
-	DeviceRole["Chime"] = "chime";
-	DeviceRole["Autotrack"] = "autotrack";
-	DeviceRole["Nightvision"] = "nightvision";
-	DeviceRole["PrivacyMask"] = "privacy-mask";
-	DeviceRole["Doorbell"] = "doorbell";
-	/** Interior blind / shade / roller blind. HA `device_class: blind|shade`. */
-	DeviceRole["CoverBlind"] = "cover-blind";
-	/** Exterior roller shutter. HA `device_class: shutter`; Homematic BROLL. */
-	DeviceRole["CoverShutter"] = "cover-shutter";
-	/** Exterior awning. HA `device_class: awning`. */
-	DeviceRole["CoverAwning"] = "cover-awning";
-	/** Curtain / drape. HA `device_class: curtain`. */
-	DeviceRole["CoverCurtain"] = "cover-curtain";
-	/** Garage door. HA `device_class: garage`. A security actuator: exports gate it. */
-	DeviceRole["CoverGarage"] = "cover-garage";
-	/** Gate. HA `device_class: gate`. A security actuator: exports gate it. */
-	DeviceRole["CoverGate"] = "cover-gate";
-	/** Door. HA `device_class: door`. A security actuator: exports gate it. */
-	DeviceRole["CoverDoor"] = "cover-door";
-	/** Window. HA `device_class: window`. */
-	DeviceRole["CoverWindow"] = "cover-window";
-	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
-	*  real Switch device for UI rendering / export adapters. */
-	DeviceRole["BinaryHelper"] = "binary-helper";
-	/** A smart plug: a `switch` whose source says it is an outlet (HA
-	*  `device_class: outlet`). The Alexa export shows it as a SMARTPLUG. */
-	DeviceRole["Outlet"] = "outlet";
-	/** Generic motion / occupancy / moving event source. Distinct from
-	*  the camera accessory PirSensor role: that one is a camera child;
-	*  this is a standalone HA / 3rd-party motion sensor. */
-	DeviceRole["MotionSensor"] = "motion-sensor";
-	DeviceRole["ContactSensor"] = "contact-sensor";
-	DeviceRole["LeakSensor"] = "leak-sensor";
-	DeviceRole["SmokeSensor"] = "smoke-sensor";
-	DeviceRole["COSensor"] = "co-sensor";
-	DeviceRole["GasSensor"] = "gas-sensor";
-	DeviceRole["TamperSensor"] = "tamper-sensor";
-	DeviceRole["VibrationSensor"] = "vibration-sensor";
-	DeviceRole["ConnectivitySensor"] = "connectivity-sensor";
-	DeviceRole["SoundSensor"] = "sound-sensor";
-	/** Fallback for `binary_sensor` without a known `device_class`. */
-	DeviceRole["BinarySensor"] = "binary-sensor";
-	DeviceRole["TemperatureSensor"] = "temperature-sensor";
-	DeviceRole["HumiditySensor"] = "humidity-sensor";
-	DeviceRole["AmbientLightSensor"] = "ambient-light-sensor";
-	DeviceRole["PressureSensor"] = "pressure-sensor";
-	/** Wind speed or direction (weather-station `wind-sensor` cap). */
-	DeviceRole["WindSensor"] = "wind-sensor";
-	/** Rain accumulation or rate (weather-station `rain-sensor` cap). */
-	DeviceRole["RainSensor"] = "rain-sensor";
-	/** UV index (weather-station `uv-sensor` cap). */
-	DeviceRole["UvSensor"] = "uv-sensor";
-	/** Solar irradiance W/m² (weather-station `solar-radiation-sensor` cap).
-	*  Distinct from AmbientLightSensor (lux). */
-	DeviceRole["SolarRadiationSensor"] = "solar-radiation-sensor";
-	/** Soil moisture % (garden/weather `soil-moisture-sensor` cap). */
-	DeviceRole["SoilMoistureSensor"] = "soil-moisture-sensor";
-	DeviceRole["PowerSensor"] = "power-sensor";
-	DeviceRole["EnergySensor"] = "energy-sensor";
-	DeviceRole["VoltageSensor"] = "voltage-sensor";
-	DeviceRole["CurrentSensor"] = "current-sensor";
-	DeviceRole["AirQualitySensor"] = "air-quality-sensor";
-	/** Battery level (numeric % via `sensor` OR low-bool via
-	*  `binary_sensor` — the cap distinguishes via the value type). */
-	DeviceRole["BatterySensor"] = "battery-sensor";
-	/** Fallback for `sensor` numeric without a known `device_class`. */
-	DeviceRole["NumericSensor"] = "numeric-sensor";
-	/** String / enum state (HA `sensor` with `state_class: enum` or
-	*  `attributes.options`). */
-	DeviceRole["EnumSensor"] = "enum-sensor";
-	/** Date / timestamp state (HA `sensor` with `device_class: timestamp`
-	*  or `date`). The slice carries the raw ISO string verbatim (hosted on
-	*  the `enum-sensor` cap); the UI renders it locale-formatted. */
-	DeviceRole["DateTimeSensor"] = "datetime-sensor";
-	/** Last-resort fallback when nothing else matches. */
-	DeviceRole["GenericSensor"] = "generic-sensor";
-	DeviceRole["NumericControl"] = "numeric-control";
-	DeviceRole["SelectControl"] = "select-control";
-	DeviceRole["TextControl"] = "text-control";
-	DeviceRole["DateTimeControl"] = "datetime-control";
-	/** Mobile push notifier (HA `notify.mobile_app_*`) — supports
-	*  rich features (image, priority, channel routing). */
-	DeviceRole["MobilePushNotifier"] = "mobile-push-notifier";
-	/** Chat / messaging service (HA `notify.telegram_*`,
-	*  `notify.discord_*`, etc.). */
-	DeviceRole["MessagingNotifier"] = "messaging-notifier";
-	/** Email-based delivery (HA `notify.smtp`, etc.). */
-	DeviceRole["EmailNotifier"] = "email-notifier";
-	/** Fallback when the notifier service name doesn't match a known
-	*  pattern. */
-	DeviceRole["GenericNotifier"] = "generic-notifier";
-	/** Emits a pulse train (infrared or RF) on request — the `ir-transmitter`
-	*  cap. A `DeviceType.Generic` device. */
-	DeviceRole["IrTransmitter"] = "ir-transmitter";
-	return DeviceRole;
-}({});
-/**
-import { errMsg } from '@camstack/types'
-* Extract a human-readable message from an unknown error value.
-* Replaces the ubiquitous `errMsg(err)` pattern.
-*/
-function errMsg(err) {
-	if (err instanceof Error) return err.message;
-	if (typeof err === "string") return err;
-	return String(err);
-}
-//#endregion
-//#region ../types/dist/composition-C7WdThmP.mjs
+//#region ../types/dist/composition-BBzVf2xd.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -12744,6 +12867,71 @@ var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
 var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
 new Set(EVENT_OWNER_TYPES);
 /**
+* What a published package needs from the rest of the install (D989).
+*
+* One published framework package (`@camstack/server`) carries the kernel, the
+* builtins and the capability contracts, so "which addon runs on which
+* framework" is a question of version, and the answer is DECLARED by the
+* package that knows it:
+*
+*   - an addon says the oldest server it runs on (`requires.server: ">=X"`);
+*   - the server says the oldest addon it works with
+*     (`requires.addons: { "@camstack/addon-x": ">=Y" }`) and the oldest shell
+*     around it (`requires.wrapper: { desktop, image }`);
+*   - a wrapper (the desktop app, the container starter) says which server
+*     range it can host, and reports its own kind and version.
+*
+* The publish workflow STAMPS these after the version bump
+* (`scripts/ci/stamp-requires.mjs`); nobody types a number by hand.
+*
+* A requirement that cannot be checked is NOT met: a shell that reports no
+* version counts as below the minimum, and an unreadable running version is
+* named in the result (a failed read is never a pass).
+*/
+/** `>=MAJOR.MINOR.PATCH[-prerelease]` — the only range shape a requirement uses. */
+var MinVersionSchema = string().regex(/^>=\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, "a minimum is written \">=X.Y.Z\"");
+object({
+	/** The oldest `@camstack/server` this package runs on. */
+	server: MinVersionSchema.optional(),
+	/** The oldest installed version of each named addon package. */
+	addons: record(string(), MinVersionSchema).optional(),
+	/** The oldest shell around the server, per shell kind. */
+	wrapper: object({
+		desktop: MinVersionSchema.optional(),
+		image: MinVersionSchema.optional()
+	}).optional()
+});
+/** One unmet requirement; each names the versions on both sides. */
+var UnmetRequirementSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("server-too-old"),
+		required: string(),
+		/** `null` — the running server version could not be read. */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("addon-too-old"),
+		packageName: string(),
+		required: string(),
+		/** `null` — the addon is not installed (or its version is unreadable). */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("wrapper-too-old"),
+		wrapper: _enum(["desktop", "image"]),
+		required: string(),
+		/** `null` — the wrapper reported no version. */
+		running: string().nullable()
+	})
+]);
+var RequiredAddonUpdateSchema = object({
+	packageName: string(),
+	/** The minimum the target server declares. */
+	required: string(),
+	/** What this node has; `null` when the addon is not installed. */
+	installed: string().nullable()
+});
+/**
 * Which integration instance a settings form is for. An addon that serves several instances
 * (`instanceMode: multiple`) can show a different form per instance — an NVR integration
 * needs its connection, the default integration needs the addon's own sections.
@@ -13362,6 +13550,613 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* Query filter for settings-store collections.
+*/
+var QueryFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
+	whereNot: record(string(), unknown()).optional(),
+	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
+	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
+	whereNotIn: record(string(), array(unknown())).optional(),
+	orderBy: object({
+		field: string(),
+		direction: _enum(["asc", "desc"])
+	}).optional(),
+	limit: number().optional(),
+	offset: number().optional()
+});
+/**
+* The predicate half of a filter, for BULK MUTATIONS.
+*
+* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
+* meaning for a statement that rewrites a set, and accepting them would invite
+* a caller to believe `limit` bounds the damage. Every field is optional here
+* only so the shape stays composable — the implementation REJECTS a filter
+* that compiles to no predicate, because that is the whole collection.
+*/
+var MutationFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	whereNot: record(string(), unknown()).optional(),
+	whereNotIn: record(string(), array(unknown())).optional()
+});
+/**
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
+*/
+var AggregateFieldSchema = object({
+	/** Result key. */
+	as: string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: string().min(1),
+	op: _enum([
+		"sum",
+		"min",
+		"max"
+	])
+});
+/**
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+*/
+var AggregateResultSchema = object({
+	count: number().int(),
+	values: record(string(), number().nullable())
+});
+/** A single stored record: `{ id, data }`. */
+var SettingsRecordSchema = object({
+	id: string(),
+	data: record(string(), unknown())
+});
+/**
+* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
+* optional.
+*
+* A separate schema rather than loosening the shared one: every other method
+* on this cap addresses a row BY its id, and making that field optional
+* everywhere would turn a forgotten key into a silently generated one on
+* `update` and `delete` as well.
+*/
+var BulkRecordSchema = object({
+	id: string().optional(),
+	data: record(string(), unknown())
+});
+/**
+* The database FILES one `sqlite-settings` engine process owns (D851).
+* Closed on purpose: a file is a thing the engine opens, backs up and gives a
+* serving thread, so a new one is a code change, never a string a caller
+* invents. `settings` is `camstack.db` and the default for every collection
+* that names no file.
+*/
+var DataStoreDatabaseSchema = _enum([
+	"settings",
+	"events",
+	"history"
+]);
+DataStoreDatabaseSchema.options;
+/**
+* One write inside a {@link settingsStoreCapability.methods.transact} call.
+* The three that a "replace this set, bump that revision" write needs, plus
+* the batched upsert a rollup writer needs.
+*/
+var TransactOpSchema = discriminatedUnion("op", [
+	object({
+		op: literal("deleteWhere"),
+		collection: string(),
+		filter: MutationFilterSchema
+	}),
+	object({
+		op: literal("insertMany"),
+		collection: string(),
+		records: array(BulkRecordSchema).readonly()
+	}),
+	object({
+		op: literal("update"),
+		collection: string(),
+		id: string(),
+		data: record(string(), unknown())
+	}),
+	object({
+		op: literal("upsertMany"),
+		collection: string(),
+		conflict: array(string()).readonly(),
+		records: array(BulkRecordSchema).readonly()
+	})
+]);
+/**
+* The precondition of a transaction: the row `key` of `collection` must hold
+* `equals` in `column`, read INSIDE the transaction.
+*/
+var TransactGuardSchema = object({
+	collection: string(),
+	key: string(),
+	column: string(),
+	equals: unknown()
+});
+/**
+* Column declaration for a structured (SQL-backed) collection.
+*
+* Logical types — the backend translates each to the matching SQLite
+* storage class and handles per-type marshaling:
+*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
+*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
+*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
+*/
+var CollectionColumnSchema = object({
+	name: string(),
+	type: _enum([
+		"TEXT",
+		"INTEGER",
+		"REAL",
+		"JSON",
+		"BOOLEAN"
+	]),
+	primaryKey: boolean().optional(),
+	notNull: boolean().optional(),
+	unique: boolean().optional(),
+	/**
+	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
+	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
+	* collection surface simply cannot express their existing tables — which is
+	* why they were still on the uncapped `table*` API.
+	*/
+	defaultValue: union([
+		string(),
+		number(),
+		boolean()
+	]).optional()
+});
+var CollectionIndexSchema = object({
+	name: string(),
+	columns: array(string()).readonly(),
+	unique: boolean().optional()
+});
+/**
+* The input of `declareCollection` — ONE schema for the door and for the
+* engine behind it, so the two surfaces cannot drift (the dispatcher forwards
+* the payload untouched).
+*
+* - `database` — the file the collection lives in (D851). Absent means
+*   `settings`. A declaration naming a file other than the one the table is
+*   already in is REFUSED by the engine, never moved.
+* - `primaryKey` — a COMPOSITE key, as column names. A single name is the same
+*   as `primaryKey: true` on that column. A composite-keyed collection has no
+*   `id`: it is written with `insertMany` / `upsertMany` / `transact` and read
+*   with `query` / `count` / `aggregate` / `deleteWhere`; the calls that
+*   address one row by id are refused.
+* - `withoutRowid` — emit `WITHOUT ROWID`. Requires a primary key.
+*/
+var DeclareCollectionInputSchema = object({
+	namespace: string().optional(),
+	collection: string(),
+	columns: array(CollectionColumnSchema).readonly(),
+	indexes: array(CollectionIndexSchema).readonly().optional(),
+	database: DataStoreDatabaseSchema.optional(),
+	primaryKey: array(string()).readonly().optional(),
+	withoutRowid: boolean().optional()
+});
+method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), unknown(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string(),
+	value: unknown()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional(),
+	columns: array(string()).readonly().optional()
+}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	/** Declared columns identifying the slot; must be covered by a UNIQUE
+	*  index on the collection. Never empty. */
+	conflict: array(string()).readonly(),
+	record: BulkRecordSchema
+}), object({ 
+/** The id the row HAS: assigned by SQLite on an insert, or the existing
+*  row's own id on an update. */
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	conflict: array(string()).readonly(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ upserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	record: object({
+		id: string().optional(),
+		data: record(string(), unknown())
+	})
+}), object({ 
+/**
+* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
+* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
+* primary key — which is the only place an auto key is knowable.
+*/
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ inserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	guard: TransactGuardSchema.optional(),
+	ops: array(TransactOpSchema).readonly()
+}), object({
+	applied: boolean(),
+	current: unknown().optional()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	id: string(),
+	data: record(string(), unknown())
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema
+}), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema,
+	data: record(string(), unknown())
+}), object({ updated: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), number(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema, { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	field: string(),
+	bucketSize: number().int().positive(),
+	origin: number().int(),
+	filter: QueryFilterSchema.optional()
+}), array(object({
+	bucket: number().int(),
+	count: number().int()
+})).readonly(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string()
+}), boolean(), { auth: "admin" }), method(DeclareCollectionInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+var MigrationIdSchema = string().regex(/^[a-z0-9-]+\/\d{4}-\d{2}-\d{2}-[a-z0-9-]+$/, "a migration id is \"<owner>/<yyyy-mm-dd>-<slug>\"");
+var MigrationLevelSchema = _enum([
+	"hub-store",
+	"addon-state",
+	"node-config",
+	"viewer",
+	"addon-internal"
+]);
+var MigrationStoreSchema = _enum([
+	"settings",
+	"events",
+	"history",
+	"node-local",
+	"addon-files"
+]);
+var MigrationScopeSchema = _enum(["cluster", "per-node"]);
+/** What depends on a migration while it is pending: `block-owner` is the default. */
+var MigrationOnFailureSchema = _enum(["block-owner", "tolerate"]);
+/**
+* `sql` is a hub-only body over the owner's connection. `plan` returns edits the
+* engine applies inside the migration's own transaction (hub-owned: computed in
+* that transaction; addon-owned: computed by the owner and shipped to the engine).
+* `procedure` is addon-owned work that is not SQL (keychain, integration registry,
+* device tombstones); the ledger records its outcome and it must be idempotent.
+*/
+var MigrationBodyKindSchema = _enum([
+	"sql",
+	"plan",
+	"procedure"
+]);
+var MigrationMetaSchema = object({
+	id: MigrationIdSchema,
+	/** `hub`, an addon id, `node` or `viewer`. */
+	owner: string().regex(/^[a-z0-9-]+$/),
+	level: MigrationLevelSchema,
+	/** Strictly increasing per owner: the order within an owner. */
+	seq: number().int().positive(),
+	/** Ids of any owner: the order across owners. */
+	dependsOn: array(MigrationIdSchema),
+	store: MigrationStoreSchema,
+	scope: MigrationScopeSchema,
+	onFailure: MigrationOnFailureSchema,
+	bodyKind: MigrationBodyKindSchema,
+	description: string().min(1),
+	/** The marked field the migration's spec must assert survived. */
+	fixtureMark: string().min(1)
+}).refine((m) => m.id.startsWith(`${m.owner}/`), {
+	message: "the id must start with \"<owner>/\"",
+	path: ["id"]
+});
+/** A cycle in the dependency graph, named by the ids on it. */
+var MigrationCycleError = class extends Error {
+	ids;
+	constructor(ids) {
+		super(`migration dependsOn cycle: ${ids.join(" -> ")}`);
+		this.ids = ids;
+		this.name = "MigrationCycleError";
+	}
+};
+/**
+* Topological order over `dependsOn` plus the implicit edge "a lower `seq` of an
+* owner runs first". Ties are broken by `(owner, seq)`. Throws
+* {@link MigrationCycleError} on a cycle. A `dependsOn` id that is not in the list
+* is ignored here — the catalogue schema is what refuses it.
+*/
+function orderMigrations(items) {
+	const byId = new Map(items.map((item) => [item.id, item]));
+	const deps = /* @__PURE__ */ new Map();
+	const ownerSorted = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const list = ownerSorted.get(item.owner) ?? [];
+		list.push(item);
+		ownerSorted.set(item.owner, list);
+	}
+	for (const item of items) deps.set(item.id, new Set(item.dependsOn.filter((id) => byId.has(id))));
+	for (const list of ownerSorted.values()) {
+		list.sort((a, b) => a.seq - b.seq);
+		for (let i = 1; i < list.length; i++) {
+			const previous = list[i - 1];
+			const current = list[i];
+			if (previous !== void 0 && current !== void 0) deps.get(current.id)?.add(previous.id);
+		}
+	}
+	const tie = (a, b) => a.owner < b.owner ? -1 : a.owner > b.owner ? 1 : a.seq - b.seq;
+	const done = /* @__PURE__ */ new Set();
+	const ordered = [];
+	let remaining = [...items];
+	while (remaining.length > 0) {
+		const ready = remaining.filter((item) => [...deps.get(item.id) ?? []].every((dep) => done.has(dep)));
+		if (ready.length === 0) throw new MigrationCycleError(remaining.map((item) => item.id).sort());
+		ready.sort(tie);
+		const next = ready[0];
+		if (next === void 0) break;
+		ordered.push(next);
+		done.add(next.id);
+		remaining = remaining.filter((item) => item.id !== next.id);
+	}
+	return ordered;
+}
+/** Every way a list of migrations (in declaration order) is not a catalogue. */
+function catalogueIssues(items) {
+	const issues = [];
+	const seen = /* @__PURE__ */ new Set();
+	const known = new Set(items.map((item) => item.id));
+	const lastSeq = /* @__PURE__ */ new Map();
+	const seqUsed = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		if (seen.has(item.id)) issues.push({
+			code: "duplicate-id",
+			ids: [item.id],
+			message: `duplicate id ${item.id}`
+		});
+		seen.add(item.id);
+		const used = seqUsed.get(item.owner) ?? /* @__PURE__ */ new Set();
+		if (used.has(item.seq)) issues.push({
+			code: "duplicate-seq",
+			ids: [item.id],
+			message: `owner ${item.owner} has two migrations with seq ${item.seq}`
+		});
+		else if (item.seq < (lastSeq.get(item.owner) ?? 0)) issues.push({
+			code: "seq-order",
+			ids: [item.id],
+			message: `seq ${item.seq} of ${item.id} does not increase in declaration order (owner ${item.owner})`
+		});
+		used.add(item.seq);
+		seqUsed.set(item.owner, used);
+		lastSeq.set(item.owner, Math.max(item.seq, lastSeq.get(item.owner) ?? 0));
+		for (const dep of item.dependsOn) if (!known.has(dep)) issues.push({
+			code: "unknown-dependency",
+			ids: [item.id, dep],
+			message: `${item.id} dependsOn unknown id ${dep}`
+		});
+	}
+	try {
+		orderMigrations(items);
+	} catch (err) {
+		if (err instanceof MigrationCycleError) issues.push({
+			code: "cycle",
+			ids: err.ids,
+			message: err.message
+		});
+		else throw err;
+	}
+	return issues;
+}
+array(MigrationMetaSchema).superRefine((items, ctx) => {
+	for (const issue of catalogueIssues(items)) ctx.addIssue({
+		code: "custom",
+		message: `${issue.code}: ${issue.message}`
+	});
+});
+/**
+* The canonical JSON (`preconditionOf`) of the value a plan read; the apply step
+* re-reads, and a plan whose read no longer matches is refused (the migration is
+* `failed`, nothing it edited is kept).
+*/
+var PreconditionSchema = string().min(1).optional();
+var MigrationPlanSchema = object({ edits: array(discriminatedUnion("op", [
+	object({
+		op: literal("setKeys"),
+		scope: string().min(1),
+		values: record(string(), unknown()),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("deleteKeys"),
+		scope: string().min(1),
+		keys: array(string().min(1)).min(1),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("putRow"),
+		table: string().min(1),
+		key: record(string(), unknown()),
+		row: record(string(), unknown()),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("deleteRow"),
+		table: string().min(1),
+		key: record(string(), unknown()),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("upsertRecord"),
+		kind: string().min(1),
+		recordKey: string().min(1),
+		value: unknown(),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("deleteRecord"),
+		kind: string().min(1),
+		recordKey: string().min(1),
+		precondition: PreconditionSchema
+	})
+])) });
+/**
+* What a `procedure` body reports. `already-done` means the rerun observed the
+* work finished (a crash between the work and the ledger row, or a manual fix)
+* and did none of it again; the ledger records `applied` either way.
+*/
+var MigrationProcedureResultSchema = object({
+	outcome: _enum(["done", "already-done"]),
+	summary: record(string(), unknown())
+});
+/** What an owner hands the engine when one of its migrations ran. */
+var MigrationOwnerResultSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("plan"),
+		plan: MigrationPlanSchema
+	}),
+	object({
+		kind: literal("procedure"),
+		result: MigrationProcedureResultSchema
+	}),
+	object({
+		kind: literal("failed"),
+		error: string().min(1)
+	})
+]);
+/**
+* `held`: a restore of a pre-migration snapshot undid this id; it does not rerun
+* until the operator retries or a new code version ships.
+* `skipped-newer`: the database knows an id this code does not.
+*/
+var MigrationStatusSchema = _enum([
+	"applied",
+	"failed",
+	"blocked",
+	"running",
+	"held",
+	"skipped-newer"
+]);
+var MigrationLedgerEntrySchema = object({
+	id: string(),
+	database: DataStoreDatabaseSchema,
+	owner: string(),
+	level: MigrationLevelSchema,
+	seq: number().int().nonnegative(),
+	status: MigrationStatusSchema,
+	attempts: number().int().nonnegative(),
+	appliedAt: number().nullable(),
+	codeVersion: string().nullable(),
+	/** What the apply changed: rows per table, as the engine counted them. */
+	planSummary: record(string(), unknown()).nullable(),
+	progress: record(string(), unknown()).nullable(),
+	error: string().nullable(),
+	/** Why it is `blocked` or `held` (`dependency-failed`, `snapshot-refused`, …). */
+	reason: string().nullable(),
+	nodeId: string().nullable(),
+	bootId: string().nullable()
+});
+/** A catalogued migration that is not applied, with where it stands. */
+var MigrationPendingEntrySchema = object({
+	meta: MigrationMetaSchema,
+	database: DataStoreDatabaseSchema,
+	state: _enum([
+		"pending",
+		"failed",
+		"blocked",
+		"held"
+	]),
+	reason: string().nullable()
+});
+/** Rows per table before and after a dry run, and what it would have changed. */
+var MigrationDryRunResultSchema = object({
+	id: string(),
+	ok: boolean(),
+	error: string().nullable(),
+	rowsChanged: number().int().nonnegative(),
+	tables: array(object({
+		table: string(),
+		before: number().int().nonnegative(),
+		after: number().int().nonnegative()
+	}))
+});
+/** One of an owner's migrations, as the engine tells the owner to treat it this boot. */
+var MigrationOwnerStepSchema = object({
+	id: MigrationIdSchema,
+	action: _enum(["run", "skip"]),
+	/** The ledger state the engine found: `pending` has no row yet. */
+	state: union([literal("pending"), MigrationStatusSchema])
+});
+/**
 * The trainer contract — what the hub hands the cloud trainer and what it
 * gets back (cloud training, D805+).
 *
@@ -20352,6 +21147,7 @@ var SYSTEM_CAP_VOCABULARY = {
 	"login-method": system(IDENTITY),
 	"mesh-network": system(NETWORK),
 	"metrics-provider": system(CLUSTER),
+	migrations: system(INTERNAL),
 	"model-convert": system(ML),
 	"model-distributor": system(ML),
 	"mqtt-broker": system(NETWORK),
@@ -40554,7 +41350,8 @@ function normalizeUnit(raw) {
 	if (lower === "dbm") return "dBm";
 	if (lower === "dbfs") return "dBFS";
 	if (lower === "inhg") return "inHg";
-	if (lower === "mm/h") return "mm/h";
+	if (lower === "mm/h" || lower === "mm/hr") return "mm/h";
+	if (lower === "in/h" || lower === "in/hr") return "in/h";
 	if (lower === "w/m²" || lower === "w/m2") return "W/m²";
 	if (lower === "°" || lower === "deg" || lower === "degree" || lower === "degrees") return "°";
 	if (lower === "kbps") return "kbps";
@@ -42948,7 +43745,7 @@ function pruneDeletedEntities(selection, live, log, exporter) {
 * rebuilds without manual reload.
 *
 * The hub-local builtin `addon-pages-aggregator` (see
-* `@camstack/system/builtins/addon-pages-aggregator`) registers the
+* `@camstack/server/system/builtins/addon-pages-aggregator`) registers the
 * provider. Splitting the public aggregator from the raw collection
 * keeps both ends in codegen — there's no hand-written
 * `addon-pages.router.ts` wrapper anymore.
@@ -43038,7 +43835,7 @@ var addonRoutesCapability = {
 		*/
 		invoke: method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" })
 	},
-	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+	/** BIG PLAN 2: declarative mount hint — read by `@camstack/server/system` `buildCapRouters`. */
 	mount: { kind: "skip" }
 };
 var ConfigTabDeclarationSchema = object({
@@ -43267,7 +44064,7 @@ method(_void(), array(WidgetMetadataSchema).readonly(), { auth: "admin" });
 * manual reload — same scheme used by `addon-pages`.
 *
 * The hub-local builtin `addon-widgets-aggregator` (see
-* `@camstack/system/builtins/addon-widgets-aggregator`) registers the
+* `@camstack/server/system/builtins/addon-widgets-aggregator`) registers the
 * provider. Splitting the public aggregator from the raw collection
 * keeps both ends in codegen — there's no hand-written wrapper.
 */
@@ -43628,329 +44425,6 @@ method(object({
 	password: string()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
-* Query filter for settings-store collections.
-*/
-var QueryFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
-	whereNot: record(string(), unknown()).optional(),
-	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
-	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
-	whereNotIn: record(string(), array(unknown())).optional(),
-	orderBy: object({
-		field: string(),
-		direction: _enum(["asc", "desc"])
-	}).optional(),
-	limit: number().optional(),
-	offset: number().optional()
-});
-/**
-* The predicate half of a filter, for BULK MUTATIONS.
-*
-* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
-* meaning for a statement that rewrites a set, and accepting them would invite
-* a caller to believe `limit` bounds the damage. Every field is optional here
-* only so the shape stays composable — the implementation REJECTS a filter
-* that compiles to no predicate, because that is the whole collection.
-*/
-var MutationFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	whereNot: record(string(), unknown()).optional(),
-	whereNotIn: record(string(), array(unknown())).optional()
-});
-/**
-* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
-*
-* `as` names the slot in the result, so the SAME column may be asked twice with
-* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
-* a `Record<column, op>` shape could not express.
-*/
-var AggregateFieldSchema = object({
-	/** Result key. */
-	as: string().min(1),
-	/** Column to aggregate. Must be a real column of a declared collection. */
-	field: string().min(1),
-	op: _enum([
-		"sum",
-		"min",
-		"max"
-	])
-});
-/**
-* `COUNT(*)` plus one number per requested field.
-*
-* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
-* that really is 0 are different facts, and an accounting caller that renders
-* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
-*/
-var AggregateResultSchema = object({
-	count: number().int(),
-	values: record(string(), number().nullable())
-});
-/** A single stored record: `{ id, data }`. */
-var SettingsRecordSchema = object({
-	id: string(),
-	data: record(string(), unknown())
-});
-/**
-* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
-* optional.
-*
-* A separate schema rather than loosening the shared one: every other method
-* on this cap addresses a row BY its id, and making that field optional
-* everywhere would turn a forgotten key into a silently generated one on
-* `update` and `delete` as well.
-*/
-var BulkRecordSchema = object({
-	id: string().optional(),
-	data: record(string(), unknown())
-});
-/**
-* The database FILES one `sqlite-settings` engine process owns (D851).
-* Closed on purpose: a file is a thing the engine opens, backs up and gives a
-* serving thread, so a new one is a code change, never a string a caller
-* invents. `settings` is `camstack.db` and the default for every collection
-* that names no file.
-*/
-var DataStoreDatabaseSchema = _enum([
-	"settings",
-	"events",
-	"history"
-]);
-DataStoreDatabaseSchema.options;
-/**
-* One write inside a {@link settingsStoreCapability.methods.transact} call.
-* The three that a "replace this set, bump that revision" write needs, plus
-* the batched upsert a rollup writer needs.
-*/
-var TransactOpSchema = discriminatedUnion("op", [
-	object({
-		op: literal("deleteWhere"),
-		collection: string(),
-		filter: MutationFilterSchema
-	}),
-	object({
-		op: literal("insertMany"),
-		collection: string(),
-		records: array(BulkRecordSchema).readonly()
-	}),
-	object({
-		op: literal("update"),
-		collection: string(),
-		id: string(),
-		data: record(string(), unknown())
-	}),
-	object({
-		op: literal("upsertMany"),
-		collection: string(),
-		conflict: array(string()).readonly(),
-		records: array(BulkRecordSchema).readonly()
-	})
-]);
-/**
-* The precondition of a transaction: the row `key` of `collection` must hold
-* `equals` in `column`, read INSIDE the transaction.
-*/
-var TransactGuardSchema = object({
-	collection: string(),
-	key: string(),
-	column: string(),
-	equals: unknown()
-});
-/**
-* Column declaration for a structured (SQL-backed) collection.
-*
-* Logical types — the backend translates each to the matching SQLite
-* storage class and handles per-type marshaling:
-*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
-*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
-*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
-*/
-var CollectionColumnSchema = object({
-	name: string(),
-	type: _enum([
-		"TEXT",
-		"INTEGER",
-		"REAL",
-		"JSON",
-		"BOOLEAN"
-	]),
-	primaryKey: boolean().optional(),
-	notNull: boolean().optional(),
-	unique: boolean().optional(),
-	/**
-	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
-	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
-	* collection surface simply cannot express their existing tables — which is
-	* why they were still on the uncapped `table*` API.
-	*/
-	defaultValue: union([
-		string(),
-		number(),
-		boolean()
-	]).optional()
-});
-var CollectionIndexSchema = object({
-	name: string(),
-	columns: array(string()).readonly(),
-	unique: boolean().optional()
-});
-/**
-* The input of `declareCollection` — ONE schema for the door and for the
-* engine behind it, so the two surfaces cannot drift (the dispatcher forwards
-* the payload untouched).
-*
-* - `database` — the file the collection lives in (D851). Absent means
-*   `settings`. A declaration naming a file other than the one the table is
-*   already in is REFUSED by the engine, never moved.
-* - `primaryKey` — a COMPOSITE key, as column names. A single name is the same
-*   as `primaryKey: true` on that column. A composite-keyed collection has no
-*   `id`: it is written with `insertMany` / `upsertMany` / `transact` and read
-*   with `query` / `count` / `aggregate` / `deleteWhere`; the calls that
-*   address one row by id are refused.
-* - `withoutRowid` — emit `WITHOUT ROWID`. Requires a primary key.
-*/
-var DeclareCollectionInputSchema = object({
-	namespace: string().optional(),
-	collection: string(),
-	columns: array(CollectionColumnSchema).readonly(),
-	indexes: array(CollectionIndexSchema).readonly().optional(),
-	database: DataStoreDatabaseSchema.optional(),
-	primaryKey: array(string()).readonly().optional(),
-	withoutRowid: boolean().optional()
-});
-method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), unknown(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string(),
-	value: unknown()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional(),
-	columns: array(string()).readonly().optional()
-}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	/** Declared columns identifying the slot; must be covered by a UNIQUE
-	*  index on the collection. Never empty. */
-	conflict: array(string()).readonly(),
-	record: BulkRecordSchema
-}), object({ 
-/** The id the row HAS: assigned by SQLite on an insert, or the existing
-*  row's own id on an update. */
-id: union([string(), number()]) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	conflict: array(string()).readonly(),
-	records: array(BulkRecordSchema).readonly()
-}), object({ upserted: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	record: object({
-		id: string().optional(),
-		data: record(string(), unknown())
-	})
-}), object({ 
-/**
-* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
-* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
-* primary key — which is the only place an auto key is knowable.
-*/
-id: union([string(), number()]) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	records: array(BulkRecordSchema).readonly()
-}), object({ inserted: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	guard: TransactGuardSchema.optional(),
-	ops: array(TransactOpSchema).readonly()
-}), object({
-	applied: boolean(),
-	current: unknown().optional()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	id: string(),
-	data: record(string(), unknown())
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: MutationFilterSchema
-}), object({ deleted: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: MutationFilterSchema,
-	data: record(string(), unknown())
-}), object({ updated: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), number(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	fields: array(AggregateFieldSchema).readonly(),
-	filter: QueryFilterSchema.optional()
-}), AggregateResultSchema, { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	field: string(),
-	bucketSize: number().int().positive(),
-	origin: number().int(),
-	filter: QueryFilterSchema.optional()
-}), array(object({
-	bucket: number().int(),
-	count: number().int()
-})).readonly(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string()
-}), boolean(), { auth: "admin" }), method(DeclareCollectionInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * How long one snapshot may take end to end: the pinned copy of the whole
 * database plus `PRAGMA integrity_check` over the copy, on the hub's slowest
 * disk. ~800 MB at a pessimistic 10 MB/s is under 3 minutes; the bound is
@@ -45913,7 +46387,7 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Gateway, DeviceType.Camera, DeviceType.Lock, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Gateway, DeviceType.Hub, DeviceType.Camera, DeviceType.Sensor, DeviceType.MediaPlayer, DeviceType.Vacuum, DeviceType.Generic, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Gateway, DeviceType.Camera, DeviceType.Lock, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Gateway, DeviceType.Hub, DeviceType.Camera, DeviceType.Sensor, DeviceType.MediaPlayer, DeviceType.Vacuum, DeviceType.Generic, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.PetFountain, DeviceType.Fan, DeviceType.Humidifier, DeviceType.Climate, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
 var NUMBER = {
 	kind: "fixed",
 	result: ["number"]
@@ -46924,6 +47398,57 @@ id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
 });
+method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { auth: "admin" }), method(object({ owner: string().optional() }), object({ pending: array(MigrationPendingEntrySchema) }), { auth: "admin" }), method(object({ id: string().min(1) }), MigrationDryRunResultSchema, { auth: "admin" }), method(object({
+	id: string().min(1),
+	error: string().min(1)
+}), MigrationLedgerEntrySchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), object({ entries: array(MigrationLedgerEntrySchema) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	database: DataStoreDatabaseSchema,
+	snapshotId: string().min(1)
+}), object({
+	scheduled: boolean(),
+	held: array(string()),
+	restartRequired: boolean()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	owner: string().min(1),
+	metas: array(MigrationMetaSchema)
+}), object({
+	bootId: string(),
+	snapshot: _enum([
+		"none",
+		"written",
+		"refused"
+	]),
+	steps: array(MigrationOwnerStepSchema)
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), object({
+	proceed: boolean(),
+	state: union([literal("pending"), MigrationStatusSchema]),
+	reason: string().nullable()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	id: string().min(1),
+	result: MigrationOwnerResultSchema
+}), object({
+	status: MigrationStatusSchema,
+	error: string().nullable(),
+	rowsChanged: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * records - an addon's own facts and documents (D881): ledgers, audit rows,
 * config documents, mirrors. The third storage API next to `ctx.settings`
@@ -61867,7 +62392,18 @@ var ServerUpdateActionResultSchema = object({
 	* store (D877), present when the pre-flight refused the update
 	* (`reason: 'addon-would-refuse'`). Optional for version skew.
 	*/
-	blockers: array(UpdateBlockerSchema).optional()
+	blockers: array(UpdateBlockerSchema).optional(),
+	/**
+	* The minimums the target server declares and this node does not meet
+	* (D989), present when the update was refused with
+	* `reason: 'requirements-unmet'`. Each names the versions on both sides.
+	*/
+	unmet: array(UnmetRequirementSchema).optional(),
+	/**
+	* The addons this node has below the minimum the staged server declares —
+	* the ones to update WITH the server. Present on an accepted update.
+	*/
+	requiredAddonUpdates: array(RequiredAddonUpdateSchema).optional()
 });
 var LaunchOverridesSchema = object({ 
 /** The persisted heap ceiling in MB, or `null` when none is set. */
@@ -64483,7 +65019,9 @@ var PackageUpdateSchema = object({
 	latestVersion: string(),
 	category: _enum(["addon", "core"]),
 	requiresRestart: boolean(),
-	isSystem: boolean()
+	isSystem: boolean(),
+	/** Held: what the newer version needs and this node does not meet (D989). */
+	blockedBy: array(UnmetRequirementSchema).readonly().optional()
 });
 var PackageVersionInfoSchema = object({
 	version: string(),
@@ -69817,7 +70355,7 @@ var lawnMowerControlCapability = {
 * clients — they reverse-connect to the hub. Exposing their interfaces
 * via the same surface would leak internal topology with no upside.
 *
-* Implementation in `@camstack/system/builtins/local-network/`.
+* Implementation in `@camstack/server/system/builtins/local-network/`.
 */
 /** Coarse classification derived from the interface name + IP range. */
 var InterfaceKindEnum = _enum([
@@ -70353,7 +70891,15 @@ var POWER_SOURCE_DEVICE_TYPES = [
 	DeviceType.Sensor,
 	DeviceType.MediaPlayer,
 	DeviceType.Vacuum,
-	DeviceType.Generic
+	DeviceType.Generic,
+	DeviceType.Washer,
+	DeviceType.Dryer,
+	DeviceType.Dishwasher,
+	DeviceType.PetFountain,
+	DeviceType.Fan,
+	DeviceType.Humidifier,
+	DeviceType.Climate,
+	DeviceType.WaterHeater
 ];
 var powerSourceCustomize = {
 	version: 1,
@@ -71697,7 +72243,7 @@ onStatusChanged: { data: object({
 * jitter, and observed/peak bandwidth per device + per client.
 *
 * Implementation lives in the server's `NetworkQualityService` (thin
-* wrapper over the shared `NetworkQualityTracker` from `@camstack/system`).
+* wrapper over the shared `NetworkQualityTracker` from `@camstack/server/system`).
 * The provider is registered from `trpc.router.ts` against the existing
 * service instance — no addon owns this state.
 *
@@ -73848,7 +74394,7 @@ var ptzAutotrackCapability = {
 	*  - **Native**: the camera's own firmware autotrack, registered per device by
 	*    the driver when the probe says it exists (Reolink: yes; Hikvision:
 	*    model-dependent).
-	*  - **Wrapper**: the emulated implementation (`@camstack/system`'s `autotrack` builtin),
+	*  - **Wrapper**: the emulated implementation (`@camstack/server/system`'s `autotrack` builtin),
 	*    which follows a subject with `ptz.move` pulses driven by the detection
 	*    pipeline. `defaultActive: false` — the operator binds it per camera in
 	*    the bindings UI.
@@ -84967,6 +85513,69 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"migrations.declareOwner": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.dryRun": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"migrations.finishMigration": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.listLedger": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"migrations.listPending": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"migrations.markFailed": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.restorePreMigration": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.retry": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.startMigration": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"modelConvert.convert": {
 		capName: "model-convert",
 		capScope: "system",
@@ -95452,4 +96061,4 @@ async function listHomeAssistantBrokers(query) {
 	return (await query({})).filter((broker) => broker.kind === HA_BROKER_KIND);
 }
 //#endregion
-export { humiditySensorCapability as $, array as $t, brokerCapability as A, temperatureSensorCapability as At, consumableKindOf as B, DeviceRole as Bt, alarmPanelCapability as C, runningFromVacuumState as Ct, bestLocationMatch as D, smokeCapability as Dt, batteryCapability as E, sendToExportedTarget as Et, carbonMonoxideCapability as F, valveCapability as Ft, deviceAdoptionCapability as G, baseUnitOf as Gt, controlCapability as H, errMsg as Ht, climateControlCapability as I, vibrationCapability as It, eventEmitterCapability as J, defineRecordKinds as Jt, deviceExportCapability as K, createEvent as Kt, colorCapability as L, waterHeaterCapability as Lt, buildDeviceAdminUrl as M, tryConvertUnit as Mt, buttonCapability as N, updateCapability as Nt, binaryCapability as O, switchCapability as Ot, calendarSourceCapability as P, vacuumControlCapability as Pt, humidifierCapability as Q, _enum as Qt, connectivityCapability as R, weatherCapability as Rt, airQualitySensorCapability as S, runningFromMediaPlayer as St, automationControlCapability as T, scriptRunnerCapability as Tt, coverCapability as U, BaseAddon as Ut, contactCapability as V, DeviceType as Vt, deviceAdminLinkCapability as W, RecordSecretUnavailableError as Wt, floodCapability as X, isReadingQuantity as Xt, fanControlCapability as Y, entryBody as Yt, gasCapability as Z, nodePin as Zt, PLUG_APPLIANCE_TYPES as _, publicEndpointReaderFrom as _t, BaseDevice as a, record as an, motionCapability as at, accessoriesCapability as b, runExportedAction as bt, COCO_TO_MACRO as c, unknown as cn, notifierCapability as ct, ConsumableItemSchema as d, parseAdminBase as dt, boolean as en, imageCapability as et, ConsumableStatusSchema as f, powerMeterCapability as ft, MediaPlayerRepeatSchema as g, pruneDeletedEntities as gt, HvacModeSchema as h, pressureSensorCapability as ht, AlarmArmModeSchema as i, object as in, mediaPlayerCapability as it, buildAddonRouteProvider as j, tryConvertDelta as jt, brightnessCapability as k, tamperCapability as kt, CameraSwitchIdSchema as l, url as ln, numericSensorCapability as lt, FanDirectionSchema as m, presenceCapability as mt, HA_PROVIDER_ADDON_ID as n, literal as nn, lawnMowerControlCapability as nt, BaseDeviceProvider as o, string as on, normalizeUnit as ot, EnumSensorDateTimeFormatSchema as p, prepareNotification as pt, enumSensorCapability as q, defineEntryKind as qt, listHomeAssistantBrokers as r, number as rn, lockControlCapability as rt, CAMERA_SWITCH_ORDER as s, union as sn, notificationOutputCapability as st, HA_BROKER_KIND as t, discriminatedUnion as tn, ingestReading as tt, ConsumableFormSchema as u, EventCategory as un, oauthIntegrationCapability as ut, RUNNING_STATE_COLD as v, quantityFromUnit as vt, ambientLightSensorCapability as w, runningStateCapability as wt, addonRoutesCapability as x, runningFromLawnMower as xt, TargetSchema as y, resolveAttachmentUrls as yt, consumableFormOf as z, DeviceFeature as zt };
+export { humiditySensorCapability as $, number as $t, brokerCapability as A, temperatureSensorCapability as At, consumableKindOf as B, RecordSecretUnavailableError as Bt, alarmPanelCapability as C, runningFromVacuumState as Ct, bestLocationMatch as D, smokeCapability as Dt, batteryCapability as E, sendToExportedTarget as Et, carbonMonoxideCapability as F, valveCapability as Ft, deviceAdoptionCapability as G, entryBody as Gt, controlCapability as H, createEvent as Ht, climateControlCapability as I, vibrationCapability as It, eventEmitterCapability as J, _enum as Jt, deviceExportCapability as K, isReadingQuantity as Kt, colorCapability as L, waterHeaterCapability as Lt, buildDeviceAdminUrl as M, tryConvertUnit as Mt, buttonCapability as N, updateCapability as Nt, binaryCapability as O, switchCapability as Ot, calendarSourceCapability as P, vacuumControlCapability as Pt, humidifierCapability as Q, literal as Qt, connectivityCapability as R, weatherCapability as Rt, airQualitySensorCapability as S, runningFromMediaPlayer as St, automationControlCapability as T, scriptRunnerCapability as Tt, coverCapability as U, defineEntryKind as Ut, contactCapability as V, baseUnitOf as Vt, deviceAdminLinkCapability as W, defineRecordKinds as Wt, floodCapability as X, boolean as Xt, fanControlCapability as Y, array as Yt, gasCapability as Z, discriminatedUnion as Zt, PLUG_APPLIANCE_TYPES as _, publicEndpointReaderFrom as _t, BaseDevice as a, url as an, motionCapability as at, accessoriesCapability as b, runExportedAction as bt, COCO_TO_MACRO as c, DeviceType as cn, notifierCapability as ct, ConsumableItemSchema as d, parseAdminBase as dt, object as en, imageCapability as et, ConsumableStatusSchema as f, powerMeterCapability as ft, MediaPlayerRepeatSchema as g, pruneDeletedEntities as gt, HvacModeSchema as h, pressureSensorCapability as ht, AlarmArmModeSchema as i, unknown as in, mediaPlayerCapability as it, buildAddonRouteProvider as j, tryConvertDelta as jt, brightnessCapability as k, tamperCapability as kt, CameraSwitchIdSchema as l, errMsg as ln, numericSensorCapability as lt, FanDirectionSchema as m, presenceCapability as mt, HA_PROVIDER_ADDON_ID as n, string as nn, lawnMowerControlCapability as nt, BaseDeviceProvider as o, DeviceFeature as on, normalizeUnit as ot, EnumSensorDateTimeFormatSchema as p, prepareNotification as pt, enumSensorCapability as q, nodePin as qt, listHomeAssistantBrokers as r, union as rn, lockControlCapability as rt, CAMERA_SWITCH_ORDER as s, DeviceRole as sn, notificationOutputCapability as st, HA_BROKER_KIND as t, record as tn, ingestReading as tt, ConsumableFormSchema as u, EventCategory as un, oauthIntegrationCapability as ut, RUNNING_STATE_COLD as v, quantityFromUnit as vt, ambientLightSensorCapability as w, runningStateCapability as wt, addonRoutesCapability as x, runningFromLawnMower as xt, TargetSchema as y, resolveAttachmentUrls as yt, consumableFormOf as z, BaseAddon as zt };