@camstack/addon-provider-homeassistant 1.2.643 → 1.2.645

package/dist/{ha-broker-source-DxSvfCed.mjs → ha-broker-source-DLhSaXYb.mjs}

@@ -1,4 +1,4 @@
-//#region ../types/dist/event-category-DmZDPDf_.mjs
+//#region ../types/dist/event-category-BmPm98n0.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -482,6 +482,10 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["RunningStarted"] = "running.started";
 	/** Mirrors `runningStateCapability.events.onFinished`. */
 	EventCategory["RunningFinished"] = "running.finished";
+	/** Mirrors `deviceRunsCapability.events.onRunOpened` - a durable run record opened. */
+	EventCategory["DeviceRunOpened"] = "device-run.opened";
+	/** Mirrors `deviceRunsCapability.events.onRunClosed` - a durable run record closed. */
+	EventCategory["DeviceRunClosed"] = "device-run.closed";
 	/**
 	* Cap event fired by every device that registers the `event-emitter`
 	* capability. Mirrors `eventEmitterCapability.events.onEvent`. Carries
@@ -714,6 +718,10 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["NotificationRuleBroken"] = "notification.rule-broken";
 	/** The clear of {@link NotificationRuleBroken}: the rule loads and names nothing deleted. */
 	EventCategory["NotificationRuleRepaired"] = "notification.rule-repaired";
+	/** A migration failed or was blocked; the Alert Center re-reads the ledger. */
+	EventCategory["MigrationFailed"] = "migration.failed";
+	/** A migration applied or a failure cleared; the Alert Center re-reads the ledger. */
+	EventCategory["MigrationApplied"] = "migration.applied";
 	EventCategory["DeviceUpdated"] = "device.updated";
 	/**
 	* Transport-level connectivity. Emitted by the device driver when
@@ -776,6 +784,378 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
+//#region ../types/dist/device-type-CEqjmUnR.mjs
+/**
+import { errMsg } from '@camstack/types'
+* Extract a human-readable message from an unknown error value.
+* Replaces the ubiquitous `errMsg(err)` pattern.
+*/
+function errMsg(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	return String(err);
+}
+var DeviceType = /* @__PURE__ */ function(DeviceType) {
+	DeviceType["Camera"] = "camera";
+	DeviceType["Hub"] = "hub";
+	DeviceType["Light"] = "light";
+	DeviceType["Siren"] = "siren";
+	DeviceType["Switch"] = "switch";
+	DeviceType["Sensor"] = "sensor";
+	DeviceType["Thermostat"] = "thermostat";
+	/** Air-conditioner / heat-pump climate device (HVAC) — shares the
+	*  `climate-control` cap surface with `Thermostat` but renders a
+	*  dedicated AC-appropriate control UI (mode chips, fan speed,
+	*  independent vertical/horizontal swing). Sources: native Gree, and
+	*  reusable by other AC integrations. */
+	DeviceType["Climate"] = "climate";
+	DeviceType["Button"] = "button";
+	/** Generic stateless event emitter — carries a device's EXACT declared
+	*  event vocabulary verbatim (no normalization). Installed with the
+	*  `event-emitter` cap. Sources: HA `event.*` entities (structured) and
+	*  HA bus events (e.g. `zha_event`, generic). */
+	DeviceType["EventEmitter"] = "event-emitter";
+	/** Firmware/software update entity — current vs available version,
+	*  updatable flag, update state, and an install action. Installed with
+	*  the `update` cap. Sources: Homematic firmware-update channels (and
+	*  reusable by other providers, e.g. HA `update.*` entities). */
+	DeviceType["Update"] = "update";
+	DeviceType["Generic"] = "generic";
+	/** Generic notification delivery target (HA `notify.<service>`, future
+	*  Telegram / Discord / ntfy / SMTP, …). One device per delivery
+	*  endpoint; the `notifier` cap defines the send surface. */
+	DeviceType["Notifier"] = "notifier";
+	/** Pre-recorded action sequence with optional parameters
+	*  (HA `script.*`). Runnable via `script-runner` cap. */
+	DeviceType["Script"] = "script";
+	/** Automation rule (HA `automation.*`) — enable/disable + manual
+	*  trigger surface exposed via `automation-control` cap. */
+	DeviceType["Automation"] = "automation";
+	/** Door / smart lock device (HA `lock.*`). `lock-control` cap. */
+	DeviceType["Lock"] = "lock";
+	/** Window covering, blinds, garage door, valve, etc. (HA `cover.*`,
+	*  `valve.*`). `cover` cap with sub-roles for variant. */
+	DeviceType["Cover"] = "cover";
+	/** Pipe / water / gas valve with open/close/stop and optional
+	*  position (HA `valve.*`). `valve` cap — a cover-sibling actuator
+	*  modelled on the same open/closed lifecycle. */
+	DeviceType["Valve"] = "valve";
+	/** Humidifier / dehumidifier with on/off + target humidity + mode
+	*  (HA `humidifier.*`). `humidifier` cap — a climate-family actuator
+	*  modelled on the same target / mode lifecycle. */
+	DeviceType["Humidifier"] = "humidifier";
+	/** Water heater / boiler with target temperature + operation mode +
+	*  away mode (HA `water_heater.*`). `water-heater` cap — a
+	*  climate-family actuator. */
+	DeviceType["WaterHeater"] = "water-heater";
+	/** Ceiling / standing / exhaust fan (HA `fan.*`). `fan-control` cap. */
+	DeviceType["Fan"] = "fan";
+	/** Audio / video playback endpoint (HA `media_player.*`). Disjoint from
+	*  the camera surface — those use `Camera`. `media-player` cap. */
+	DeviceType["MediaPlayer"] = "media-player";
+	/** Security panel / alarm system (HA `alarm_control_panel.*`).
+	*  `alarm-panel` cap. */
+	DeviceType["AlarmPanel"] = "alarm-panel";
+	/** Generic user-settable input (HA `number` / `input_number` / `select`
+	*  / `input_select` / `text` / `input_text` / `input_datetime`).
+	*  Sub-type via `DeviceRole`: NumericControl / SelectControl /
+	*  TextControl / DateTimeControl. */
+	DeviceType["Control"] = "control";
+	/** Person / device-tracker presence (HA `person.*`, `device_tracker.*`).
+	*  `presence` cap. */
+	DeviceType["Presence"] = "presence";
+	/** Weather provider (HA `weather.*`). Tier-3, low MVP priority.
+	*  `weather` cap. */
+	DeviceType["Weather"] = "weather";
+	/** Robot vacuum (HA `vacuum.*`). Tier-3. `vacuum-control` cap. */
+	DeviceType["Vacuum"] = "vacuum";
+	/** Robotic lawn mower (HA `lawn_mower.*`). Tier-3.
+	*  `lawn-mower-control` cap. */
+	DeviceType["LawnMower"] = "lawn-mower";
+	/** Physical HA device group — parent container for entity-children
+	*  adopted from a single HA device entry. Not renderable as a
+	*  standalone device; exists only to anchor child entities. */
+	DeviceType["Container"] = "container";
+	/** Single still-image entity (HA `image.*`). Read-only display of an
+	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
+	DeviceType["Image"] = "image";
+	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
+	*  level, battery, desiccant life, feeding state and manual-feed /
+	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
+	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
+	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
+	*  integrations sharing the same food/desiccant/hopper surface. */
+	DeviceType["PetFeeder"] = "pet-feeder";
+	/** Pet water fountain — tank level, water drunk, pump and its duty cycle.
+	*  Installed with the `pet-fountain` cap. Reaches CamStack as loose entities
+	*  of a container and is BUILT as a composed device (D967). */
+	DeviceType["PetFountain"] = "pet-fountain";
+	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
+	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
+	*  Sources: native Bosch Home Connect, reusable by similar integrations.
+	*  A plug-built dishwasher carries running-state and power instead. */
+	DeviceType["Dishwasher"] = "dishwasher";
+	/** Washing machine. A plug-built one is running while its power stays
+	*  above a threshold. No program cap — that surface is the dishwasher's. */
+	DeviceType["Washer"] = "washer";
+	/** Tumble dryer. Same plug-built running surface as {@link Washer}. */
+	DeviceType["Dryer"] = "dryer";
+	/** The physical bridge box of a vendor ecosystem (Velux KLF-200, and later
+	*  other radio-to-IP bridges). It carries the box's own facts (firmware,
+	*  address, connection state) and the actions the box really supports
+	*  (`reboot`, `device-admin-link`). Products are NOT its children — they are
+	*  adopted beside it — and its connection settings stay on the integration. */
+	DeviceType["Gateway"] = "gateway";
+	return DeviceType;
+}({});
+var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
+	DeviceFeature["BatteryOperated"] = "battery-operated";
+	DeviceFeature["Rebootable"] = "rebootable";
+	/**
+	* Device supports an on-demand re-sync of its derived spec with its
+	* upstream source — drives the generic Re-sync button. The owning
+	* provider implements the action via the `device-adoption.resync` cap.
+	*/
+	DeviceFeature["Resyncable"] = "resyncable";
+	DeviceFeature["NativeSnapshot"] = "native-snapshot";
+	DeviceFeature["DoorbellButton"] = "doorbell-button";
+	DeviceFeature["TwoWayAudio"] = "two-way-audio";
+	DeviceFeature["PanTiltZoom"] = "pan-tilt-zoom";
+	/**
+	* Camera supports the on-firmware autotrack subsystem (subject-
+	* following). Distinct from `PanTiltZoom` because not every PTZ
+	* camera ships autotrack — the admin UI uses this flag to gate
+	* the autotrack toggle / settings card without re-deriving from
+	* the cap registry. Mirrors `ptz-autotrack` cap registration:
+	* driver sets this feature when probe confirms the firmware
+	* surface, and registers the cap in the same code path.
+	*/
+	DeviceFeature["PtzAutotrack"] = "ptz-autotrack";
+	/**
+	* Accessory exposes a "trigger on motion" toggle — the parent camera's
+	* motion detection automatically activates this device. Mirrors
+	* `motion-trigger` cap registration: drivers set this feature in the
+	* same code path that calls `ctx.registerNativeCap(motionTriggerCapability, ...)`.
+	*
+	* Used by admin UI (gate the in-hero `MotionTriggerToggle` against a
+	* fast scalar without binding fetch), notifier rules, and `listAll`
+	* filters that want "all devices with on-motion behaviour".
+	*/
+	DeviceFeature["MotionTrigger"] = "motion-trigger";
+	/** Light supports rgb-triplet color via `color` cap. */
+	DeviceFeature["LightColorRgb"] = "light-color-rgb";
+	/** Light supports HSV color via `color` cap. */
+	DeviceFeature["LightColorHsv"] = "light-color-hsv";
+	/** Light supports color-temperature (mired) via `color` cap. */
+	DeviceFeature["LightColorMired"] = "light-color-mired";
+	/** Thermostat supports a `heat_cool` dual setpoint (targetLow +
+	*  targetHigh). Gates the range slider UI. */
+	DeviceFeature["ClimateDualSetpoint"] = "climate-dual-setpoint";
+	/** Thermostat exposes target humidity and/or current humidity
+	*  readings. Gates the humidity controls. */
+	DeviceFeature["ClimateHumidity"] = "climate-humidity";
+	/** Thermostat exposes a fan-mode selector. */
+	DeviceFeature["ClimateFanMode"] = "climate-fan-mode";
+	/** Thermostat exposes preset modes (eco / away / sleep / vendor). */
+	DeviceFeature["ClimatePreset"] = "climate-preset";
+	/** Thermostat exposes a vertical louver swing toggle. Gates the
+	*  vertical-swing switch in the climate UI. Independent of horizontal. */
+	DeviceFeature["ClimateSwingVertical"] = "climate-swing-vertical";
+	/** Thermostat exposes a horizontal louver swing toggle. Gates the
+	*  horizontal-swing switch in the climate UI. Independent of vertical. */
+	DeviceFeature["ClimateSwingHorizontal"] = "climate-swing-horizontal";
+	/** Cover exposes intermediate position control (0..100). Gates the
+	*  position slider UI. */
+	DeviceFeature["CoverPositionable"] = "cover-positionable";
+	/** Cover exposes slat-tilt control. Gates the tilt slider UI. */
+	DeviceFeature["CoverTilt"] = "cover-tilt";
+	/** Valve exposes intermediate position control (0..100). Gates the
+	*  position slider / drag surface UI. */
+	DeviceFeature["ValvePositionable"] = "valve-positionable";
+	/** Fan exposes a speed-percentage setter. Gates the speed slider UI. */
+	DeviceFeature["FanSpeed"] = "fan-speed";
+	/** Fan exposes a preset mode selector. */
+	DeviceFeature["FanPreset"] = "fan-preset";
+	/** Fan exposes blade direction (forward/reverse) — typical of
+	*  ceiling fans. */
+	DeviceFeature["FanDirection"] = "fan-direction";
+	/** Fan exposes an oscillation toggle. */
+	DeviceFeature["FanOscillating"] = "fan-oscillating";
+	/** Lock requires a PIN code on lock/unlock. Gates the code-entry
+	*  field on the UI lock-controls panel. */
+	DeviceFeature["LockPinRequired"] = "lock-pin-required";
+	/** Lock supports a latch-release ("open door") action distinct from
+	*  unlock. Mirrors HA `LockEntityFeature.OPEN` (bit 1) in
+	*  `supported_features`. Gates the Open Door button in the UI. */
+	DeviceFeature["LockOpen"] = "lock-open";
+	/** Media player exposes a seek-to-position surface. */
+	DeviceFeature["MediaPlayerSeek"] = "media-player-seek";
+	/** Media player exposes a volume-level setter. */
+	DeviceFeature["MediaPlayerVolume"] = "media-player-volume";
+	/** Media player exposes a mute toggle distinct from volume=0. */
+	DeviceFeature["MediaPlayerMute"] = "media-player-mute";
+	/** Media player exposes a shuffle toggle. */
+	DeviceFeature["MediaPlayerShuffle"] = "media-player-shuffle";
+	/** Media player exposes a repeat mode (off / all / one). */
+	DeviceFeature["MediaPlayerRepeat"] = "media-player-repeat";
+	/** Media player exposes a source / input selector. */
+	DeviceFeature["MediaPlayerSelectSource"] = "media-player-select-source";
+	/** Media player exposes a play-arbitrary-media surface (URL / id). */
+	DeviceFeature["MediaPlayerPlayMedia"] = "media-player-play-media";
+	/** Media player exposes next-track. */
+	DeviceFeature["MediaPlayerNext"] = "media-player-next";
+	/** Media player exposes previous-track. */
+	DeviceFeature["MediaPlayerPrevious"] = "media-player-previous";
+	/** Media player exposes stop distinct from pause. */
+	DeviceFeature["MediaPlayerStop"] = "media-player-stop";
+	/** Alarm panel requires a PIN code on arm/disarm. */
+	DeviceFeature["AlarmPinRequired"] = "alarm-pin-required";
+	/** Presence device carries GPS coordinates (lat/lng/accuracy) in
+	*  addition to a textual location. */
+	DeviceFeature["PresenceGps"] = "presence-gps";
+	/** Notifier accepts an inline / URL image attachment. */
+	DeviceFeature["NotifierImage"] = "notifier-image";
+	/** Notifier accepts a priority hint (high/normal/low). */
+	DeviceFeature["NotifierPriority"] = "notifier-priority";
+	/** Notifier accepts a free-form `data` payload for platform-specific
+	*  fields. */
+	DeviceFeature["NotifierData"] = "notifier-data";
+	/** Notifier supports interactive action buttons / callbacks. */
+	DeviceFeature["NotifierActions"] = "notifier-actions";
+	/** Notifier supports per-call recipient targeting (multi-user). */
+	DeviceFeature["NotifierRecipients"] = "notifier-recipients";
+	/** Script runner accepts a variables map on each run invocation. */
+	DeviceFeature["ScriptVariables"] = "script-variables";
+	/** Automation `trigger` accepts a skipCondition flag — fires the
+	*  automation's actions while bypassing its condition block. */
+	DeviceFeature["AutomationSkipCondition"] = "automation-skip-condition";
+	/** Robot vacuum exposes a live cleaning map (image child). Gates the
+	*  map tile in the vacuum UI. */
+	DeviceFeature["VacuumHasMap"] = "vacuum-has-map";
+	/** Robot vacuum exposes AI obstacle-detection toggles. Gates the AI
+	*  switches group. */
+	DeviceFeature["VacuumHasAi"] = "vacuum-has-ai";
+	/** Robot mower exposes a live mowing map (SVG image child). Gates the
+	*  mower map tile. */
+	DeviceFeature["MowerHasMap"] = "mower-has-map";
+	/** Robot mower exposes targeted mowing (all-area / zones / edges /
+	*  spots) — gates the Mow action + map selectors. */
+	DeviceFeature["MowerHasTargetedMowing"] = "mower-has-targeted-mowing";
+	return DeviceFeature;
+}({});
+/**
+* Semantic role a device plays within its parent. Populated by driver
+* addons when creating accessory devices (Reolink siren/floodlight/
+* PIR/chime/autotrack/doorbell, ONVIF relay outputs, …). Used by the
+* admin UI to pick icons, labels, and widgets — a `Switch` with
+* `role: Floodlight` renders as a bulb with a brightness slider,
+* whereas a `Switch` with `role: Siren` renders as a klaxon.
+*
+* Undefined for top-level devices (cameras, NVRs, hubs). Persisted in
+* sqlite as a nullable TEXT column — old rows keep working unchanged.
+*/
+var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
+	DeviceRole["Siren"] = "siren";
+	DeviceRole["Floodlight"] = "floodlight";
+	DeviceRole["Spotlight"] = "spotlight";
+	DeviceRole["PirSensor"] = "pir-sensor";
+	DeviceRole["Chime"] = "chime";
+	DeviceRole["Autotrack"] = "autotrack";
+	DeviceRole["Nightvision"] = "nightvision";
+	DeviceRole["PrivacyMask"] = "privacy-mask";
+	DeviceRole["Doorbell"] = "doorbell";
+	/** Interior blind / shade / roller blind. HA `device_class: blind|shade`. */
+	DeviceRole["CoverBlind"] = "cover-blind";
+	/** Exterior roller shutter. HA `device_class: shutter`; Homematic BROLL. */
+	DeviceRole["CoverShutter"] = "cover-shutter";
+	/** Exterior awning. HA `device_class: awning`. */
+	DeviceRole["CoverAwning"] = "cover-awning";
+	/** Curtain / drape. HA `device_class: curtain`. */
+	DeviceRole["CoverCurtain"] = "cover-curtain";
+	/** Garage door. HA `device_class: garage`. A security actuator: exports gate it. */
+	DeviceRole["CoverGarage"] = "cover-garage";
+	/** Gate. HA `device_class: gate`. A security actuator: exports gate it. */
+	DeviceRole["CoverGate"] = "cover-gate";
+	/** Door. HA `device_class: door`. A security actuator: exports gate it. */
+	DeviceRole["CoverDoor"] = "cover-door";
+	/** Window. HA `device_class: window`. */
+	DeviceRole["CoverWindow"] = "cover-window";
+	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
+	*  real Switch device for UI rendering / export adapters. */
+	DeviceRole["BinaryHelper"] = "binary-helper";
+	/** A smart plug: a `switch` whose source says it is an outlet (HA
+	*  `device_class: outlet`). The Alexa export shows it as a SMARTPLUG. */
+	DeviceRole["Outlet"] = "outlet";
+	/** Generic motion / occupancy / moving event source. Distinct from
+	*  the camera accessory PirSensor role: that one is a camera child;
+	*  this is a standalone HA / 3rd-party motion sensor. */
+	DeviceRole["MotionSensor"] = "motion-sensor";
+	DeviceRole["ContactSensor"] = "contact-sensor";
+	DeviceRole["LeakSensor"] = "leak-sensor";
+	DeviceRole["SmokeSensor"] = "smoke-sensor";
+	DeviceRole["COSensor"] = "co-sensor";
+	DeviceRole["GasSensor"] = "gas-sensor";
+	DeviceRole["TamperSensor"] = "tamper-sensor";
+	DeviceRole["VibrationSensor"] = "vibration-sensor";
+	DeviceRole["ConnectivitySensor"] = "connectivity-sensor";
+	DeviceRole["SoundSensor"] = "sound-sensor";
+	/** Fallback for `binary_sensor` without a known `device_class`. */
+	DeviceRole["BinarySensor"] = "binary-sensor";
+	DeviceRole["TemperatureSensor"] = "temperature-sensor";
+	DeviceRole["HumiditySensor"] = "humidity-sensor";
+	DeviceRole["AmbientLightSensor"] = "ambient-light-sensor";
+	DeviceRole["PressureSensor"] = "pressure-sensor";
+	/** Wind speed or direction (weather-station `wind-sensor` cap). */
+	DeviceRole["WindSensor"] = "wind-sensor";
+	/** Rain accumulation or rate (weather-station `rain-sensor` cap). */
+	DeviceRole["RainSensor"] = "rain-sensor";
+	/** UV index (weather-station `uv-sensor` cap). */
+	DeviceRole["UvSensor"] = "uv-sensor";
+	/** Solar irradiance W/m² (weather-station `solar-radiation-sensor` cap).
+	*  Distinct from AmbientLightSensor (lux). */
+	DeviceRole["SolarRadiationSensor"] = "solar-radiation-sensor";
+	/** Soil moisture % (garden/weather `soil-moisture-sensor` cap). */
+	DeviceRole["SoilMoistureSensor"] = "soil-moisture-sensor";
+	DeviceRole["PowerSensor"] = "power-sensor";
+	DeviceRole["EnergySensor"] = "energy-sensor";
+	DeviceRole["VoltageSensor"] = "voltage-sensor";
+	DeviceRole["CurrentSensor"] = "current-sensor";
+	DeviceRole["AirQualitySensor"] = "air-quality-sensor";
+	/** Battery level (numeric % via `sensor` OR low-bool via
+	*  `binary_sensor` — the cap distinguishes via the value type). */
+	DeviceRole["BatterySensor"] = "battery-sensor";
+	/** Fallback for `sensor` numeric without a known `device_class`. */
+	DeviceRole["NumericSensor"] = "numeric-sensor";
+	/** String / enum state (HA `sensor` with `state_class: enum` or
+	*  `attributes.options`). */
+	DeviceRole["EnumSensor"] = "enum-sensor";
+	/** Date / timestamp state (HA `sensor` with `device_class: timestamp`
+	*  or `date`). The slice carries the raw ISO string verbatim (hosted on
+	*  the `enum-sensor` cap); the UI renders it locale-formatted. */
+	DeviceRole["DateTimeSensor"] = "datetime-sensor";
+	/** Last-resort fallback when nothing else matches. */
+	DeviceRole["GenericSensor"] = "generic-sensor";
+	DeviceRole["NumericControl"] = "numeric-control";
+	DeviceRole["SelectControl"] = "select-control";
+	DeviceRole["TextControl"] = "text-control";
+	DeviceRole["DateTimeControl"] = "datetime-control";
+	/** Mobile push notifier (HA `notify.mobile_app_*`) — supports
+	*  rich features (image, priority, channel routing). */
+	DeviceRole["MobilePushNotifier"] = "mobile-push-notifier";
+	/** Chat / messaging service (HA `notify.telegram_*`,
+	*  `notify.discord_*`, etc.). */
+	DeviceRole["MessagingNotifier"] = "messaging-notifier";
+	/** Email-based delivery (HA `notify.smtp`, etc.). */
+	DeviceRole["EmailNotifier"] = "email-notifier";
+	/** Fallback when the notifier service name doesn't match a known
+	*  pattern. */
+	DeviceRole["GenericNotifier"] = "generic-notifier";
+	/** Emits a pulse train (infrared or RF) on request — the `ir-transmitter`
+	*  cap. A `DeviceType.Generic` device. */
+	DeviceRole["IrTransmitter"] = "ir-transmitter";
+	return DeviceRole;
+}({});
+//#endregion
 //#region ../../node_modules/zod/v4/core/core.js
 var _a$1;
 function $constructor(name, initializer, params) {
@@ -5587,7 +5967,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-dco0-jRo.mjs
+//#region ../types/dist/sleep-BKzhQTSm.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6103,6 +6483,102 @@ function emitReadiness(bus, params) {
 		ts
 	}));
 }
+var NOT_RUN = {
+	declared: false,
+	snapshot: null,
+	applied: [],
+	failed: [],
+	blocked: [],
+	skipped: [],
+	blockOwner: []
+};
+/**
+* Offer `migrations` to the engine and run what it says to run, in its order. Never
+* throws: an unreachable or refusing engine is logged and reported `declared: false`,
+* because the hub (and this addon's boot) must not hang on a migration.
+*/
+async function runAddonMigrations(host, migrations, logger) {
+	const first = migrations[0];
+	if (first === void 0) return NOT_RUN;
+	const owner = first.meta.owner;
+	const log = logger.withTags({ migrationOwner: owner });
+	const byId = new Map(migrations.map((m) => [m.meta.id, m]));
+	let declaration;
+	try {
+		declaration = await host.declareOwner({
+			owner,
+			metas: migrations.map((m) => m.meta)
+		});
+	} catch (err) {
+		log.error("the migration engine refused or could not take this addon catalogue — none ran", { meta: { error: errMsg(err) } });
+		return {
+			...NOT_RUN,
+			blockOwner: migrations.filter((m) => m.meta.onFailure === "block-owner").map((m) => m.meta.id)
+		};
+	}
+	const applied = [];
+	const failed = [];
+	const blocked = [];
+	const skipped = [];
+	const settle = (id, status) => {
+		if (status === "applied") applied.push(id);
+		else if (status === "failed") failed.push(id);
+		else if (status === "blocked") blocked.push(id);
+		else skipped.push(id);
+	};
+	for (const step of declaration.steps) {
+		const bound = byId.get(step.id);
+		if (bound === void 0 || step.action === "skip") {
+			skipped.push(step.id);
+			continue;
+		}
+		const tags = { migrationId: step.id };
+		try {
+			const gate = await host.startMigration({ id: step.id });
+			if (!gate.proceed) {
+				log.warn("migration not run", {
+					tags,
+					meta: {
+						state: gate.state,
+						reason: gate.reason
+					}
+				});
+				settle(step.id, gate.state === "pending" ? "blocked" : gate.state);
+				continue;
+			}
+			const result = await bound.execute();
+			const outcome = await host.finishMigration({
+				id: step.id,
+				result
+			});
+			if (outcome.status === "applied") log.info("migration applied", {
+				tags,
+				meta: { rowsChanged: outcome.rowsChanged }
+			});
+			else log.error("migration failed", {
+				tags,
+				meta: { error: outcome.error }
+			});
+			settle(step.id, outcome.status);
+		} catch (err) {
+			log.error("migration could not be completed with the engine", {
+				tags,
+				meta: { error: errMsg(err) }
+			});
+			failed.push(step.id);
+		}
+	}
+	const blockOwner = [...failed, ...blocked].filter((id) => byId.get(id)?.meta.onFailure === "block-owner");
+	return {
+		declared: true,
+		snapshot: declaration.snapshot,
+		applied,
+		failed,
+		blocked,
+		skipped,
+		blockOwner
+	};
+}
 /**
 * Build a {@link DurableState} over a single store key. Transport-agnostic:
 * `read`/`write` are the addon-store or device-store accessors. The whole
@@ -7158,6 +7634,28 @@ var BaseAddon = class {
 		return normalized;
 	}
 	/**
+	* Run this addon's migration catalogue (D987 M3) through the hub's `migrations`
+	* engine. Call it at the point of the boot where the data must already have the new
+	* shape — `onInitialize`, or `onRestoreDevices` for a migration that needs the
+	* restored devices — with the catalogue bound to the addon's ports
+	* (`defineAddonMigrations(ADDON_MIGRATIONS, ports)`).
+	*
+	* An engine that cannot be reached or refuses the catalogue is logged and runs
+	* nothing; the boot continues. A migration that FAILED (or was blocked by one)
+	* and declares `onFailure: 'block-owner'` makes this throw, so the addon does not
+	* serve data whose shape it cannot trust; `tolerate` migrations never do.
+	*/
+	async runMigrations(migrations) {
+		const api = this.ctx.api.migrations;
+		const report = await runAddonMigrations({
+			declareOwner: (input) => api.declareOwner.mutate(input),
+			startMigration: (input) => api.startMigration.mutate(input),
+			finishMigration: (input) => api.finishMigration.mutate(input)
+		}, migrations, this.ctx.logger);
+		if (report.blockOwner.length > 0) throw new Error(`migration(s) ${report.blockOwner.join(", ")} did not apply and block this addon — fix or retry them (migrations.retry), then restart it`);
+		return report;
+	}
+	/**
 	* Called by the isolated-process runner AFTER `broker.start()`.
 	* In-process addons never need this because the hub broker is already
 	* running when `initialize()` fires. For forked children the broker
@@ -8455,410 +8953,6 @@ function defineEntryKind(name, spec) {
 	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
 	return defined;
 }
-var READING_QUANTITIES = [
-	"temperature",
-	"pressure",
-	"speed",
-	"precipitation",
-	"precipitation-rate",
-	"length",
-	"area",
-	"illuminance",
-	"irradiance",
-	"power",
-	"energy",
-	"voltage",
-	"current",
-	"apparent-power",
-	"humidity",
-	"percentage",
-	"concentration-volume",
-	"concentration-mass",
-	"concentration-ppb",
-	"volume",
-	"duration",
-	"duration-ms",
-	"information",
-	"sound-level",
-	"signal-level",
-	"colour-temperature",
-	"angle",
-	"bitrate",
-	"rate",
-	"mass",
-	"index",
-	"ratio",
-	"count",
-	"none",
-	"device"
-];
-var ReadingQuantitySchema = _enum(READING_QUANTITIES);
-var QUANTITY_SET = new Set(READING_QUANTITIES);
-function isReadingQuantity(value) {
-	return typeof value === "string" && QUANTITY_SET.has(value);
-}
-/**
-* Stored unit symbol for a quantity. `none` means the number is dimensionless
-* (or an index / ratio / count). `device` means the cap has no single unit.
-*/
-var QUANTITY_BASE = {
-	temperature: "°C",
-	pressure: "hPa",
-	speed: "m/s",
-	precipitation: "mm",
-	"precipitation-rate": "mm/h",
-	length: "m",
-	area: "m²",
-	illuminance: "lx",
-	irradiance: "W/m²",
-	power: "W",
-	energy: "kWh",
-	voltage: "V",
-	current: "A",
-	"apparent-power": "VA",
-	humidity: "%",
-	percentage: "%",
-	"concentration-volume": "ppm",
-	"concentration-mass": "µg/m³",
-	"concentration-ppb": "ppb",
-	volume: "L",
-	duration: "s",
-	"duration-ms": "ms",
-	information: "B",
-	"sound-level": "dBFS",
-	"signal-level": "dBm",
-	"colour-temperature": "mired",
-	angle: "°",
-	bitrate: "kbps",
-	rate: "fps",
-	mass: "kg",
-	index: "none",
-	ratio: "none",
-	count: "none",
-	none: "none",
-	device: "device"
-};
-/** The stored unit, or `undefined` when the quantity has no unit symbol. */
-function baseUnitOf(quantity) {
-	const symbol = QUANTITY_BASE[quantity];
-	if (symbol === "none" || symbol === "device") return void 0;
-	return symbol;
-}
-function readingMeta(quantity, extras) {
-	return {
-		quantity,
-		...extras?.precision !== void 0 ? { precision: extras.precision } : {},
-		...extras?.label !== void 0 ? { label: extras.label } : {}
-	};
-}
-/** Shared Zod schemas used across streaming capabilities. */
-var CamProfileSchema = _enum([
-	"high",
-	"mid",
-	"low"
-]);
-/**
-* Which rung a per-camera consumer listens on: an explicit profile, or `auto`.
-*
-* `auto` is a REAL value, not an absent one — it means "resolve it by the rule
-* that consumer owns". It lives beside `CamProfile` because a rung is the only
-* operator-facing way to name a stream: a cam-stream id is broker-internal and
-* moves when a slot is reassigned, so a stored id silently stops meaning what
-* the operator picked. Today's one user is the audio analyser, whose rule is
-* "the lowest AVAILABLE native rung" (D537).
-*/
-var AudioStreamPickSchema = union([CamProfileSchema, literal("auto")]);
-var CamStreamKindSchema = _enum([
-	"pull-rtsp",
-	"pull-rtmp",
-	"pull-http",
-	"pull-flv",
-	"pull-rfc4571",
-	"push-annexb",
-	"derived"
-]);
-var CamStreamResolutionSchema = object({
-	width: number().int().positive().meta(readingMeta("none")),
-	height: number().int().positive().meta(readingMeta("none"))
-});
-var CameraStreamSchema = object({
-	/** Stable, provider-assigned id unique within the (deviceId) scope. */
-	camStreamId: string().min(1),
-	deviceId: number().int().nonnegative(),
-	kind: CamStreamKindSchema,
-	/** Required for pull-* kinds. Ignored for push-annexb. */
-	url: string().optional(),
-	codec: string().optional(),
-	resolution: CamStreamResolutionSchema.optional(),
-	fps: number().positive().optional(),
-	/** Human label surfaced in the Admin UI "Camera Stream" dropdown. */
-	label: string().optional(),
-	/**
-	* Device-level features the publisher advertised (e.g. `battery-operated`).
-	* The broker, snapshot orchestrator, and prebuffer manager all consult
-	* this list to derive policy — relaxed stall watchdog for battery
-	* cams, prebuffer off by default, longer snapshot rate-limit, etc.
-	*
-	* Single source of truth replacing per-stream flags like the
-	* historical `allowStall`: if the publisher knows the camera is
-	* battery-powered, every downstream service derives the right policy
-	* from this list.
-	*/
-	deviceFeatures: array(string()).optional(),
-	/**
-	* Whether this stream participates in the broker's automatic profile
-	* assignment (`computeInitialAssignment`). Defaults to `true`. Publishers
-	* use `false` when they want a stream to be SELECTABLE in the UI but not
-	* picked by default — e.g. Reolink publishes its native Baichuan streams
-	* as `autoEligible: true` (the recommended path) and its RTSP / RTMP
-	* mirrors as `autoEligible: false` (still pickable per slot, just not
-	* the auto choice). Manual `assignProfile` calls remain valid for
-	* non-eligible streams.
-	*/
-	autoEligible: boolean().optional(),
-	/**
-	* The profile slot the PUBLISHER says this stream is: `low` for a stream
-	* whose only sensible role is the low-bandwidth one, `high` for a main
-	* stream. Consulted by the broker's automatic ranking
-	* (`rankInitialAssignment`) BEFORE the pixel-count heuristic, and only there:
-	* an operator's manual assignment still wins, and an absent hint is the
-	* pixel-ranked default every camera had before this field existed.
-	*
-	* Why it exists: a camera with ONE stream ranked to `mid` — the slot no
-	* storage class is written for on its own (`recordings` is high|mid,
-	* `recordingsLow` is low) and the one profile scrub does not read. The robot
-	* camera's single 720p relay is a `low` in every respect except the slot the
-	* heuristic put it in.
-	*/
-	profileHint: CamProfileSchema.optional(),
-	/**
-	* Transport-specific opaque metadata. The broker passes it through to
-	* the source reader without inspecting it. Currently used by
-	* `pull-rfc4571` streams to carry the upstream SDP (so the reader can
-	* route RTP packets to the right depacketizer without an in-band
-	* DESCRIBE phase). Other kinds typically leave it undefined.
-	*/
-	metadata: record(string(), unknown()).optional()
-});
-var ProfileSlotStatusSchema = _enum([
-	"unassigned",
-	"idle",
-	"connecting",
-	"streaming",
-	"error"
-]);
-var ProfileSlotSchema = object({
-	deviceId: number().int().nonnegative(),
-	profile: CamProfileSchema,
-	/** Broker id the rest of the system addresses: `${deviceId}/${profile}`. */
-	brokerId: string(),
-	/** `null` when the profile is unassigned. */
-	sourceCamStreamId: string().nullable(),
-	status: ProfileSlotStatusSchema,
-	resolution: CamStreamResolutionSchema.optional(),
-	codec: string().optional(),
-	preBufferSec: number().nonnegative().optional(),
-	errorMessage: string().optional()
-});
-/**
-* Zod schema for StreamSourceEntry — the canonical stream descriptor
-* exposed by ICameraDevice.getStreamSources() and consumed by the broker.
-*/
-var StreamSourceEntrySchema$1 = object({
-	id: string(),
-	label: string(),
-	protocol: _enum([
-		"rtsp",
-		"rtmp",
-		"annexb",
-		"http-mjpeg",
-		"webrtc",
-		"custom"
-	]),
-	url: string().optional(),
-	resolution: object({
-		width: number(),
-		height: number()
-	}).readonly().optional(),
-	fps: number().optional(),
-	bitrate: number().optional(),
-	codec: string().optional(),
-	profileHint: CamProfileSchema.optional()
-});
-object({
-	type: string(),
-	url: string(),
-	videoCodec: string().optional(),
-	audioCodec: string().optional(),
-	metadata: record(string(), unknown()).readonly().optional()
-});
-/**
-* Wire schema for `FrameHandle` — a zero-pixel, serialisable reference to a
-* frame in a shared-memory ring (Phase 5 / D9). Mirrors the `FrameHandle` TS
-* interface in `interfaces/frame-handle.ts` field-for-field so a cap method
-* (the runner's native-crop and pipeline-executor inputs) can carry handles
-* over tRPC / Moleculer.
-*
-* The `satisfies` assertion below pins this schema to the interface: if a
-* field is added to / removed from `FrameHandle` without a matching schema
-* edit, `z.infer<typeof FrameHandleSchema>` stops being assignable to
-* `FrameHandle` and the build fails — no silent drift.
-*/
-var FrameHandleSchema = object({
-	shmId: string(),
-	slot: number().int().nonnegative(),
-	seq: number().int().nonnegative(),
-	width: number().int().positive(),
-	height: number().int().positive(),
-	format: _enum([
-		"jpeg",
-		"rgb",
-		"bgr",
-		"yuv420",
-		"gray"
-	]),
-	pts: number(),
-	byteLength: number().int().nonnegative(),
-	nodeId: string(),
-	slotCount: number().int().positive()
-});
-/**
-* Wire schema for a decoded audio chunk (Phase 5 / D9). Mirrors the
-* `DecodedAudioChunk` TS interface in `interfaces/stream-broker.ts`: PCM
-* sample bytes plus the track parameters a consumer needs to interpret them.
-*
-* Audio chunks are tiny (a ~500ms AudioCodecSession window is a few KB of
-* Float32 PCM), so unlike video frames they ship their bytes INLINE over
-* tRPC / Moleculer — no shared-memory plane. `data` is typed `Uint8Array`
-* (the wire-serialisable supertype of `Buffer`); a `Buffer` is assignable to
-* it.
-*/
-var AudioChunkFormatSchema = _enum(AUDIO_CHUNK_FORMATS);
-var DecodedAudioChunkSchema = object({
-	data: _instanceof(Uint8Array),
-	sampleRate: number().int().positive(),
-	channels: number().int().positive(),
-	timestamp: number(),
-	/**
-	* Byte format of `data`. ABSENT MEANS `f32le` — today's bytes, byte for
-	* byte, for any peer that never heard of this field. A coded window
-	* (`pcmu` / `pcma`, one byte per sample) is only ever emitted to a
-	* subscription that DECLARED it accepts one, so absence can never mean
-	* "coded bytes a consumer will read as floats" (D455).
-	*/
-	format: AudioChunkFormatSchema.optional()
-});
-/**
-* Input for `stream-broker.subscribeAudioChunks` (Phase 5 / D9). Audio ships
-* its bytes inline: a consumer asks the broker for the decoded audio-chunk
-* stream of one broker; the broker keeps a per-subscription bounded FIFO queue
-* the consumer drains via `pullAudioChunks`.
-*/
-var SubscribeAudioChunksInputSchema = object({
-	brokerId: string(),
-	/** Short caller-identity tag (`audio-analyzer`, …) for `listClients`. */
-	tag: string().optional(),
-	/**
-	* Byte formats this subscriber can READ, best first. The broker serves the
-	* chunk's own format when it is in this list and expands to `f32le`
-	* otherwise, so a subscriber is never handed bytes it cannot interpret.
-	*
-	* Absent (or without the source format) means `f32le` — the behaviour every
-	* subscriber had before D455, unchanged. This is the negotiation half of
-	* the source-bytes lever: it is what lets the broker and its consumers
-	* deploy one at a time across three nodes.
-	*/
-	accept: array(AudioChunkFormatSchema).readonly().optional()
-});
-/** Result of `stream-broker.subscribeAudioChunks`. */
-var SubscribeAudioChunksResultSchema = object({ 
-/** Opaque id passed to `pullAudioChunks` / `unsubscribeAudioChunks`. */
-subscriptionId: string() });
-var BrokerStatsSchema = object({
-	status: _enum([
-		"idle",
-		"connecting",
-		"streaming",
-		"error",
-		"stopped"
-	]),
-	inputFps: number(),
-	encodedSubscribers: number(),
-	uptimeMs: number(),
-	bitrateKbps: number(),
-	idrIntervalMs: number(),
-	codec: string().optional(),
-	totalBytes: number(),
-	packetCount: number(),
-	rtspClients: number(),
-	pipeClients: number(),
-	preBufferSec: number(),
-	preBufferMs: number(),
-	preBufferPackets: number(),
-	/**
-	* Detected audio track parameters from the RTSP DESCRIBE / SDP. `null`
-	* when the stream has no audio track or the broker is in cold start.
-	* `supported = false` means the codec was detected but the local
-	* decoder pipeline cannot produce PCM chunks (e.g. AAC without the
-	* AAC pipeline wired). Surfaced in the UI device-overview so operators
-	* can pre-pick the audio-analysis model that matches the codec.
-	*/
-	audio: object({
-		codec: string(),
-		sampleRate: number(),
-		channels: number(),
-		supported: boolean()
-	}).nullable().optional(),
-	/**
-	* BROKER-SIDE AUDIO MUTE (D83). `true` = this broker is deliberately
-	* distributing none of the device's audio, on live or recording.
-	*
-	* Present so a silent camera can be told apart from a broken one on the
-	* stream panel itself, without cross-referencing the switch group: a
-	* broker holding an `audio` track descriptor while `audioMuted` is true is
-	* working exactly as asked. `audioMutedDropped` counts the audio units
-	* thrown away since the current dial — it is how you confirm from stats
-	* alone that the mute is on the packet path and not merely persisted.
-	*/
-	audioMuted: boolean().optional(),
-	audioMutedDropped: number().optional()
-});
-/**
-* Exporter-facing "profile restream" entry. Returned by
-* `cameraStreams.getProfileRtspEntries` — one per ASSIGNED profile slot
-* (high/mid/low). `brokerId` is the PROFILE-keyed broker id
-* (`${deviceId}/${profile}`, e.g. `15/high`); its `url` is a broker
-* RTSP restream that aliases the profile's assigned source broker, so
-* every consumer dialling a profile converges on the same single pull.
-* `codec`/`resolution` describe the assigned SOURCE camStream (for the
-* `auto` resolution-closest pick). Distinct from `RtspRestreamEntry`
-* (raw per-camStream, live-view only).
-*/
-var ProfileRtspEntrySchema = object({
-	profile: CamProfileSchema,
-	/** Profile-keyed broker id, format `${deviceId}/${profile}` (e.g. `"15/high"`). */
-	brokerId: string(),
-	url: string(),
-	mutedUrl: string(),
-	enabled: boolean(),
-	codec: string().optional(),
-	resolution: CamStreamResolutionSchema.optional()
-});
-/**
-* The model weight formats a catalog entry can ship. Schema-free on purpose:
-* `types/models.ts` builds Zod schemas from it, but a runner-closure consumer
-* (the model downloader in `@camstack/system`) needs only the list and must
-* reach it through `@camstack/types/addon` without building the cap schema
-* graph (D28).
-*/
-var MODEL_FORMATS = [
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt",
-	"gguf"
-];
 object({
 	field: string().min(1),
 	on: literal("advance")
@@ -8951,6 +9045,410 @@ function optionalMethod(input, output, options) {
 function event(data) {
 	return { data };
 }
+var READING_QUANTITIES = [
+	"temperature",
+	"pressure",
+	"speed",
+	"precipitation",
+	"precipitation-rate",
+	"length",
+	"area",
+	"illuminance",
+	"irradiance",
+	"power",
+	"energy",
+	"voltage",
+	"current",
+	"apparent-power",
+	"humidity",
+	"percentage",
+	"concentration-volume",
+	"concentration-mass",
+	"concentration-ppb",
+	"volume",
+	"duration",
+	"duration-ms",
+	"information",
+	"sound-level",
+	"signal-level",
+	"colour-temperature",
+	"angle",
+	"bitrate",
+	"rate",
+	"mass",
+	"index",
+	"ratio",
+	"count",
+	"none",
+	"device"
+];
+var ReadingQuantitySchema = _enum(READING_QUANTITIES);
+var QUANTITY_SET = new Set(READING_QUANTITIES);
+function isReadingQuantity(value) {
+	return typeof value === "string" && QUANTITY_SET.has(value);
+}
+/**
+* Stored unit symbol for a quantity. `none` means the number is dimensionless
+* (or an index / ratio / count). `device` means the cap has no single unit.
+*/
+var QUANTITY_BASE = {
+	temperature: "°C",
+	pressure: "hPa",
+	speed: "m/s",
+	precipitation: "mm",
+	"precipitation-rate": "mm/h",
+	length: "m",
+	area: "m²",
+	illuminance: "lx",
+	irradiance: "W/m²",
+	power: "W",
+	energy: "kWh",
+	voltage: "V",
+	current: "A",
+	"apparent-power": "VA",
+	humidity: "%",
+	percentage: "%",
+	"concentration-volume": "ppm",
+	"concentration-mass": "µg/m³",
+	"concentration-ppb": "ppb",
+	volume: "L",
+	duration: "s",
+	"duration-ms": "ms",
+	information: "B",
+	"sound-level": "dBFS",
+	"signal-level": "dBm",
+	"colour-temperature": "mired",
+	angle: "°",
+	bitrate: "kbps",
+	rate: "fps",
+	mass: "kg",
+	index: "none",
+	ratio: "none",
+	count: "none",
+	none: "none",
+	device: "device"
+};
+/** The stored unit, or `undefined` when the quantity has no unit symbol. */
+function baseUnitOf(quantity) {
+	const symbol = QUANTITY_BASE[quantity];
+	if (symbol === "none" || symbol === "device") return void 0;
+	return symbol;
+}
+function readingMeta(quantity, extras) {
+	return {
+		quantity,
+		...extras?.precision !== void 0 ? { precision: extras.precision } : {},
+		...extras?.label !== void 0 ? { label: extras.label } : {}
+	};
+}
+/** Shared Zod schemas used across streaming capabilities. */
+var CamProfileSchema = _enum([
+	"high",
+	"mid",
+	"low"
+]);
+/**
+* Which rung a per-camera consumer listens on: an explicit profile, or `auto`.
+*
+* `auto` is a REAL value, not an absent one — it means "resolve it by the rule
+* that consumer owns". It lives beside `CamProfile` because a rung is the only
+* operator-facing way to name a stream: a cam-stream id is broker-internal and
+* moves when a slot is reassigned, so a stored id silently stops meaning what
+* the operator picked. Today's one user is the audio analyser, whose rule is
+* "the lowest AVAILABLE native rung" (D537).
+*/
+var AudioStreamPickSchema = union([CamProfileSchema, literal("auto")]);
+var CamStreamKindSchema = _enum([
+	"pull-rtsp",
+	"pull-rtmp",
+	"pull-http",
+	"pull-flv",
+	"pull-rfc4571",
+	"push-annexb",
+	"derived"
+]);
+var CamStreamResolutionSchema = object({
+	width: number().int().positive().meta(readingMeta("none")),
+	height: number().int().positive().meta(readingMeta("none"))
+});
+var CameraStreamSchema = object({
+	/** Stable, provider-assigned id unique within the (deviceId) scope. */
+	camStreamId: string().min(1),
+	deviceId: number().int().nonnegative(),
+	kind: CamStreamKindSchema,
+	/** Required for pull-* kinds. Ignored for push-annexb. */
+	url: string().optional(),
+	codec: string().optional(),
+	resolution: CamStreamResolutionSchema.optional(),
+	fps: number().positive().optional(),
+	/** Human label surfaced in the Admin UI "Camera Stream" dropdown. */
+	label: string().optional(),
+	/**
+	* Device-level features the publisher advertised (e.g. `battery-operated`).
+	* The broker, snapshot orchestrator, and prebuffer manager all consult
+	* this list to derive policy — relaxed stall watchdog for battery
+	* cams, prebuffer off by default, longer snapshot rate-limit, etc.
+	*
+	* Single source of truth replacing per-stream flags like the
+	* historical `allowStall`: if the publisher knows the camera is
+	* battery-powered, every downstream service derives the right policy
+	* from this list.
+	*/
+	deviceFeatures: array(string()).optional(),
+	/**
+	* Whether this stream participates in the broker's automatic profile
+	* assignment (`computeInitialAssignment`). Defaults to `true`. Publishers
+	* use `false` when they want a stream to be SELECTABLE in the UI but not
+	* picked by default — e.g. Reolink publishes its native Baichuan streams
+	* as `autoEligible: true` (the recommended path) and its RTSP / RTMP
+	* mirrors as `autoEligible: false` (still pickable per slot, just not
+	* the auto choice). Manual `assignProfile` calls remain valid for
+	* non-eligible streams.
+	*/
+	autoEligible: boolean().optional(),
+	/**
+	* The profile slot the PUBLISHER says this stream is: `low` for a stream
+	* whose only sensible role is the low-bandwidth one, `high` for a main
+	* stream. Consulted by the broker's automatic ranking
+	* (`rankInitialAssignment`) BEFORE the pixel-count heuristic, and only there:
+	* an operator's manual assignment still wins, and an absent hint is the
+	* pixel-ranked default every camera had before this field existed.
+	*
+	* Why it exists: a camera with ONE stream ranked to `mid` — the slot no
+	* storage class is written for on its own (`recordings` is high|mid,
+	* `recordingsLow` is low) and the one profile scrub does not read. The robot
+	* camera's single 720p relay is a `low` in every respect except the slot the
+	* heuristic put it in.
+	*/
+	profileHint: CamProfileSchema.optional(),
+	/**
+	* Transport-specific opaque metadata. The broker passes it through to
+	* the source reader without inspecting it. Currently used by
+	* `pull-rfc4571` streams to carry the upstream SDP (so the reader can
+	* route RTP packets to the right depacketizer without an in-band
+	* DESCRIBE phase). Other kinds typically leave it undefined.
+	*/
+	metadata: record(string(), unknown()).optional()
+});
+var ProfileSlotStatusSchema = _enum([
+	"unassigned",
+	"idle",
+	"connecting",
+	"streaming",
+	"error"
+]);
+var ProfileSlotSchema = object({
+	deviceId: number().int().nonnegative(),
+	profile: CamProfileSchema,
+	/** Broker id the rest of the system addresses: `${deviceId}/${profile}`. */
+	brokerId: string(),
+	/** `null` when the profile is unassigned. */
+	sourceCamStreamId: string().nullable(),
+	status: ProfileSlotStatusSchema,
+	resolution: CamStreamResolutionSchema.optional(),
+	codec: string().optional(),
+	preBufferSec: number().nonnegative().optional(),
+	errorMessage: string().optional()
+});
+/**
+* Zod schema for StreamSourceEntry — the canonical stream descriptor
+* exposed by ICameraDevice.getStreamSources() and consumed by the broker.
+*/
+var StreamSourceEntrySchema$1 = object({
+	id: string(),
+	label: string(),
+	protocol: _enum([
+		"rtsp",
+		"rtmp",
+		"annexb",
+		"http-mjpeg",
+		"webrtc",
+		"custom"
+	]),
+	url: string().optional(),
+	resolution: object({
+		width: number(),
+		height: number()
+	}).readonly().optional(),
+	fps: number().optional(),
+	bitrate: number().optional(),
+	codec: string().optional(),
+	profileHint: CamProfileSchema.optional()
+});
+object({
+	type: string(),
+	url: string(),
+	videoCodec: string().optional(),
+	audioCodec: string().optional(),
+	metadata: record(string(), unknown()).readonly().optional()
+});
+/**
+* Wire schema for `FrameHandle` — a zero-pixel, serialisable reference to a
+* frame in a shared-memory ring (Phase 5 / D9). Mirrors the `FrameHandle` TS
+* interface in `interfaces/frame-handle.ts` field-for-field so a cap method
+* (the runner's native-crop and pipeline-executor inputs) can carry handles
+* over tRPC / Moleculer.
+*
+* The `satisfies` assertion below pins this schema to the interface: if a
+* field is added to / removed from `FrameHandle` without a matching schema
+* edit, `z.infer<typeof FrameHandleSchema>` stops being assignable to
+* `FrameHandle` and the build fails — no silent drift.
+*/
+var FrameHandleSchema = object({
+	shmId: string(),
+	slot: number().int().nonnegative(),
+	seq: number().int().nonnegative(),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum([
+		"jpeg",
+		"rgb",
+		"bgr",
+		"yuv420",
+		"gray"
+	]),
+	pts: number(),
+	byteLength: number().int().nonnegative(),
+	nodeId: string(),
+	slotCount: number().int().positive()
+});
+/**
+* Wire schema for a decoded audio chunk (Phase 5 / D9). Mirrors the
+* `DecodedAudioChunk` TS interface in `interfaces/stream-broker.ts`: PCM
+* sample bytes plus the track parameters a consumer needs to interpret them.
+*
+* Audio chunks are tiny (a ~500ms AudioCodecSession window is a few KB of
+* Float32 PCM), so unlike video frames they ship their bytes INLINE over
+* tRPC / Moleculer — no shared-memory plane. `data` is typed `Uint8Array`
+* (the wire-serialisable supertype of `Buffer`); a `Buffer` is assignable to
+* it.
+*/
+var AudioChunkFormatSchema = _enum(AUDIO_CHUNK_FORMATS);
+var DecodedAudioChunkSchema = object({
+	data: _instanceof(Uint8Array),
+	sampleRate: number().int().positive(),
+	channels: number().int().positive(),
+	timestamp: number(),
+	/**
+	* Byte format of `data`. ABSENT MEANS `f32le` — today's bytes, byte for
+	* byte, for any peer that never heard of this field. A coded window
+	* (`pcmu` / `pcma`, one byte per sample) is only ever emitted to a
+	* subscription that DECLARED it accepts one, so absence can never mean
+	* "coded bytes a consumer will read as floats" (D455).
+	*/
+	format: AudioChunkFormatSchema.optional()
+});
+/**
+* Input for `stream-broker.subscribeAudioChunks` (Phase 5 / D9). Audio ships
+* its bytes inline: a consumer asks the broker for the decoded audio-chunk
+* stream of one broker; the broker keeps a per-subscription bounded FIFO queue
+* the consumer drains via `pullAudioChunks`.
+*/
+var SubscribeAudioChunksInputSchema = object({
+	brokerId: string(),
+	/** Short caller-identity tag (`audio-analyzer`, …) for `listClients`. */
+	tag: string().optional(),
+	/**
+	* Byte formats this subscriber can READ, best first. The broker serves the
+	* chunk's own format when it is in this list and expands to `f32le`
+	* otherwise, so a subscriber is never handed bytes it cannot interpret.
+	*
+	* Absent (or without the source format) means `f32le` — the behaviour every
+	* subscriber had before D455, unchanged. This is the negotiation half of
+	* the source-bytes lever: it is what lets the broker and its consumers
+	* deploy one at a time across three nodes.
+	*/
+	accept: array(AudioChunkFormatSchema).readonly().optional()
+});
+/** Result of `stream-broker.subscribeAudioChunks`. */
+var SubscribeAudioChunksResultSchema = object({ 
+/** Opaque id passed to `pullAudioChunks` / `unsubscribeAudioChunks`. */
+subscriptionId: string() });
+var BrokerStatsSchema = object({
+	status: _enum([
+		"idle",
+		"connecting",
+		"streaming",
+		"error",
+		"stopped"
+	]),
+	inputFps: number(),
+	encodedSubscribers: number(),
+	uptimeMs: number(),
+	bitrateKbps: number(),
+	idrIntervalMs: number(),
+	codec: string().optional(),
+	totalBytes: number(),
+	packetCount: number(),
+	rtspClients: number(),
+	pipeClients: number(),
+	preBufferSec: number(),
+	preBufferMs: number(),
+	preBufferPackets: number(),
+	/**
+	* Detected audio track parameters from the RTSP DESCRIBE / SDP. `null`
+	* when the stream has no audio track or the broker is in cold start.
+	* `supported = false` means the codec was detected but the local
+	* decoder pipeline cannot produce PCM chunks (e.g. AAC without the
+	* AAC pipeline wired). Surfaced in the UI device-overview so operators
+	* can pre-pick the audio-analysis model that matches the codec.
+	*/
+	audio: object({
+		codec: string(),
+		sampleRate: number(),
+		channels: number(),
+		supported: boolean()
+	}).nullable().optional(),
+	/**
+	* BROKER-SIDE AUDIO MUTE (D83). `true` = this broker is deliberately
+	* distributing none of the device's audio, on live or recording.
+	*
+	* Present so a silent camera can be told apart from a broken one on the
+	* stream panel itself, without cross-referencing the switch group: a
+	* broker holding an `audio` track descriptor while `audioMuted` is true is
+	* working exactly as asked. `audioMutedDropped` counts the audio units
+	* thrown away since the current dial — it is how you confirm from stats
+	* alone that the mute is on the packet path and not merely persisted.
+	*/
+	audioMuted: boolean().optional(),
+	audioMutedDropped: number().optional()
+});
+/**
+* Exporter-facing "profile restream" entry. Returned by
+* `cameraStreams.getProfileRtspEntries` — one per ASSIGNED profile slot
+* (high/mid/low). `brokerId` is the PROFILE-keyed broker id
+* (`${deviceId}/${profile}`, e.g. `15/high`); its `url` is a broker
+* RTSP restream that aliases the profile's assigned source broker, so
+* every consumer dialling a profile converges on the same single pull.
+* `codec`/`resolution` describe the assigned SOURCE camStream (for the
+* `auto` resolution-closest pick). Distinct from `RtspRestreamEntry`
+* (raw per-camStream, live-view only).
+*/
+var ProfileRtspEntrySchema = object({
+	profile: CamProfileSchema,
+	/** Profile-keyed broker id, format `${deviceId}/${profile}` (e.g. `"15/high"`). */
+	brokerId: string(),
+	url: string(),
+	mutedUrl: string(),
+	enabled: boolean(),
+	codec: string().optional(),
+	resolution: CamStreamResolutionSchema.optional()
+});
+/**
+* The model weight formats a catalog entry can ship. Schema-free on purpose:
+* `types/models.ts` builds Zod schemas from it, but a runner-closure consumer
+* (the model downloader in `@camstack/server/system`) needs only the list and must
+* reach it through `@camstack/types/addon` without building the cap schema
+* graph (D28).
+*/
+var MODEL_FORMATS = [
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
+];
 /**
 * Per-call node pinning for `ctx.api` capability calls.
 *
@@ -9210,6 +9708,7 @@ var CAP_NAMES = Object.freeze([
 	"device-ops",
 	"device-provider",
 	"device-removal-hook",
+	"device-runs",
 	"device-state",
 	"device-status",
 	"dishwasher",
@@ -9251,6 +9750,7 @@ var CAP_NAMES = Object.freeze([
 	"mesh-network",
 	"meter",
 	"metrics-provider",
+	"migrations",
 	"model-convert",
 	"model-distributor",
 	"motion",
@@ -11153,379 +11653,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/err-msg-BD5buxvT.mjs
-var DeviceType = /* @__PURE__ */ function(DeviceType) {
-	DeviceType["Camera"] = "camera";
-	DeviceType["Hub"] = "hub";
-	DeviceType["Light"] = "light";
-	DeviceType["Siren"] = "siren";
-	DeviceType["Switch"] = "switch";
-	DeviceType["Sensor"] = "sensor";
-	DeviceType["Thermostat"] = "thermostat";
-	/** Air-conditioner / heat-pump climate device (HVAC) — shares the
-	*  `climate-control` cap surface with `Thermostat` but renders a
-	*  dedicated AC-appropriate control UI (mode chips, fan speed,
-	*  independent vertical/horizontal swing). Sources: native Gree, and
-	*  reusable by other AC integrations. */
-	DeviceType["Climate"] = "climate";
-	DeviceType["Button"] = "button";
-	/** Generic stateless event emitter — carries a device's EXACT declared
-	*  event vocabulary verbatim (no normalization). Installed with the
-	*  `event-emitter` cap. Sources: HA `event.*` entities (structured) and
-	*  HA bus events (e.g. `zha_event`, generic). */
-	DeviceType["EventEmitter"] = "event-emitter";
-	/** Firmware/software update entity — current vs available version,
-	*  updatable flag, update state, and an install action. Installed with
-	*  the `update` cap. Sources: Homematic firmware-update channels (and
-	*  reusable by other providers, e.g. HA `update.*` entities). */
-	DeviceType["Update"] = "update";
-	DeviceType["Generic"] = "generic";
-	/** Generic notification delivery target (HA `notify.<service>`, future
-	*  Telegram / Discord / ntfy / SMTP, …). One device per delivery
-	*  endpoint; the `notifier` cap defines the send surface. */
-	DeviceType["Notifier"] = "notifier";
-	/** Pre-recorded action sequence with optional parameters
-	*  (HA `script.*`). Runnable via `script-runner` cap. */
-	DeviceType["Script"] = "script";
-	/** Automation rule (HA `automation.*`) — enable/disable + manual
-	*  trigger surface exposed via `automation-control` cap. */
-	DeviceType["Automation"] = "automation";
-	/** Door / smart lock device (HA `lock.*`). `lock-control` cap. */
-	DeviceType["Lock"] = "lock";
-	/** Window covering, blinds, garage door, valve, etc. (HA `cover.*`,
-	*  `valve.*`). `cover` cap with sub-roles for variant. */
-	DeviceType["Cover"] = "cover";
-	/** Pipe / water / gas valve with open/close/stop and optional
-	*  position (HA `valve.*`). `valve` cap — a cover-sibling actuator
-	*  modelled on the same open/closed lifecycle. */
-	DeviceType["Valve"] = "valve";
-	/** Humidifier / dehumidifier with on/off + target humidity + mode
-	*  (HA `humidifier.*`). `humidifier` cap — a climate-family actuator
-	*  modelled on the same target / mode lifecycle. */
-	DeviceType["Humidifier"] = "humidifier";
-	/** Water heater / boiler with target temperature + operation mode +
-	*  away mode (HA `water_heater.*`). `water-heater` cap — a
-	*  climate-family actuator. */
-	DeviceType["WaterHeater"] = "water-heater";
-	/** Ceiling / standing / exhaust fan (HA `fan.*`). `fan-control` cap. */
-	DeviceType["Fan"] = "fan";
-	/** Audio / video playback endpoint (HA `media_player.*`). Disjoint from
-	*  the camera surface — those use `Camera`. `media-player` cap. */
-	DeviceType["MediaPlayer"] = "media-player";
-	/** Security panel / alarm system (HA `alarm_control_panel.*`).
-	*  `alarm-panel` cap. */
-	DeviceType["AlarmPanel"] = "alarm-panel";
-	/** Generic user-settable input (HA `number` / `input_number` / `select`
-	*  / `input_select` / `text` / `input_text` / `input_datetime`).
-	*  Sub-type via `DeviceRole`: NumericControl / SelectControl /
-	*  TextControl / DateTimeControl. */
-	DeviceType["Control"] = "control";
-	/** Person / device-tracker presence (HA `person.*`, `device_tracker.*`).
-	*  `presence` cap. */
-	DeviceType["Presence"] = "presence";
-	/** Weather provider (HA `weather.*`). Tier-3, low MVP priority.
-	*  `weather` cap. */
-	DeviceType["Weather"] = "weather";
-	/** Robot vacuum (HA `vacuum.*`). Tier-3. `vacuum-control` cap. */
-	DeviceType["Vacuum"] = "vacuum";
-	/** Robotic lawn mower (HA `lawn_mower.*`). Tier-3.
-	*  `lawn-mower-control` cap. */
-	DeviceType["LawnMower"] = "lawn-mower";
-	/** Physical HA device group — parent container for entity-children
-	*  adopted from a single HA device entry. Not renderable as a
-	*  standalone device; exists only to anchor child entities. */
-	DeviceType["Container"] = "container";
-	/** Single still-image entity (HA `image.*`). Read-only display of an
-	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
-	DeviceType["Image"] = "image";
-	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
-	*  level, battery, desiccant life, feeding state and manual-feed /
-	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
-	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
-	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
-	*  integrations sharing the same food/desiccant/hopper surface. */
-	DeviceType["PetFeeder"] = "pet-feeder";
-	/** Pet water fountain — tank level, water drunk, pump and its duty cycle.
-	*  Installed with the `pet-fountain` cap. Reaches CamStack as loose entities
-	*  of a container and is BUILT as a composed device (D967). */
-	DeviceType["PetFountain"] = "pet-fountain";
-	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
-	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
-	*  Sources: native Bosch Home Connect, reusable by similar integrations.
-	*  A plug-built dishwasher carries running-state and power instead. */
-	DeviceType["Dishwasher"] = "dishwasher";
-	/** Washing machine. A plug-built one is running while its power stays
-	*  above a threshold. No program cap — that surface is the dishwasher's. */
-	DeviceType["Washer"] = "washer";
-	/** Tumble dryer. Same plug-built running surface as {@link Washer}. */
-	DeviceType["Dryer"] = "dryer";
-	/** The physical bridge box of a vendor ecosystem (Velux KLF-200, and later
-	*  other radio-to-IP bridges). It carries the box's own facts (firmware,
-	*  address, connection state) and the actions the box really supports
-	*  (`reboot`, `device-admin-link`). Products are NOT its children — they are
-	*  adopted beside it — and its connection settings stay on the integration. */
-	DeviceType["Gateway"] = "gateway";
-	return DeviceType;
-}({});
-var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
-	DeviceFeature["BatteryOperated"] = "battery-operated";
-	DeviceFeature["Rebootable"] = "rebootable";
-	/**
-	* Device supports an on-demand re-sync of its derived spec with its
-	* upstream source — drives the generic Re-sync button. The owning
-	* provider implements the action via the `device-adoption.resync` cap.
-	*/
-	DeviceFeature["Resyncable"] = "resyncable";
-	DeviceFeature["NativeSnapshot"] = "native-snapshot";
-	DeviceFeature["DoorbellButton"] = "doorbell-button";
-	DeviceFeature["TwoWayAudio"] = "two-way-audio";
-	DeviceFeature["PanTiltZoom"] = "pan-tilt-zoom";
-	/**
-	* Camera supports the on-firmware autotrack subsystem (subject-
-	* following). Distinct from `PanTiltZoom` because not every PTZ
-	* camera ships autotrack — the admin UI uses this flag to gate
-	* the autotrack toggle / settings card without re-deriving from
-	* the cap registry. Mirrors `ptz-autotrack` cap registration:
-	* driver sets this feature when probe confirms the firmware
-	* surface, and registers the cap in the same code path.
-	*/
-	DeviceFeature["PtzAutotrack"] = "ptz-autotrack";
-	/**
-	* Accessory exposes a "trigger on motion" toggle — the parent camera's
-	* motion detection automatically activates this device. Mirrors
-	* `motion-trigger` cap registration: drivers set this feature in the
-	* same code path that calls `ctx.registerNativeCap(motionTriggerCapability, ...)`.
-	*
-	* Used by admin UI (gate the in-hero `MotionTriggerToggle` against a
-	* fast scalar without binding fetch), notifier rules, and `listAll`
-	* filters that want "all devices with on-motion behaviour".
-	*/
-	DeviceFeature["MotionTrigger"] = "motion-trigger";
-	/** Light supports rgb-triplet color via `color` cap. */
-	DeviceFeature["LightColorRgb"] = "light-color-rgb";
-	/** Light supports HSV color via `color` cap. */
-	DeviceFeature["LightColorHsv"] = "light-color-hsv";
-	/** Light supports color-temperature (mired) via `color` cap. */
-	DeviceFeature["LightColorMired"] = "light-color-mired";
-	/** Thermostat supports a `heat_cool` dual setpoint (targetLow +
-	*  targetHigh). Gates the range slider UI. */
-	DeviceFeature["ClimateDualSetpoint"] = "climate-dual-setpoint";
-	/** Thermostat exposes target humidity and/or current humidity
-	*  readings. Gates the humidity controls. */
-	DeviceFeature["ClimateHumidity"] = "climate-humidity";
-	/** Thermostat exposes a fan-mode selector. */
-	DeviceFeature["ClimateFanMode"] = "climate-fan-mode";
-	/** Thermostat exposes preset modes (eco / away / sleep / vendor). */
-	DeviceFeature["ClimatePreset"] = "climate-preset";
-	/** Thermostat exposes a vertical louver swing toggle. Gates the
-	*  vertical-swing switch in the climate UI. Independent of horizontal. */
-	DeviceFeature["ClimateSwingVertical"] = "climate-swing-vertical";
-	/** Thermostat exposes a horizontal louver swing toggle. Gates the
-	*  horizontal-swing switch in the climate UI. Independent of vertical. */
-	DeviceFeature["ClimateSwingHorizontal"] = "climate-swing-horizontal";
-	/** Cover exposes intermediate position control (0..100). Gates the
-	*  position slider UI. */
-	DeviceFeature["CoverPositionable"] = "cover-positionable";
-	/** Cover exposes slat-tilt control. Gates the tilt slider UI. */
-	DeviceFeature["CoverTilt"] = "cover-tilt";
-	/** Valve exposes intermediate position control (0..100). Gates the
-	*  position slider / drag surface UI. */
-	DeviceFeature["ValvePositionable"] = "valve-positionable";
-	/** Fan exposes a speed-percentage setter. Gates the speed slider UI. */
-	DeviceFeature["FanSpeed"] = "fan-speed";
-	/** Fan exposes a preset mode selector. */
-	DeviceFeature["FanPreset"] = "fan-preset";
-	/** Fan exposes blade direction (forward/reverse) — typical of
-	*  ceiling fans. */
-	DeviceFeature["FanDirection"] = "fan-direction";
-	/** Fan exposes an oscillation toggle. */
-	DeviceFeature["FanOscillating"] = "fan-oscillating";
-	/** Lock requires a PIN code on lock/unlock. Gates the code-entry
-	*  field on the UI lock-controls panel. */
-	DeviceFeature["LockPinRequired"] = "lock-pin-required";
-	/** Lock supports a latch-release ("open door") action distinct from
-	*  unlock. Mirrors HA `LockEntityFeature.OPEN` (bit 1) in
-	*  `supported_features`. Gates the Open Door button in the UI. */
-	DeviceFeature["LockOpen"] = "lock-open";
-	/** Media player exposes a seek-to-position surface. */
-	DeviceFeature["MediaPlayerSeek"] = "media-player-seek";
-	/** Media player exposes a volume-level setter. */
-	DeviceFeature["MediaPlayerVolume"] = "media-player-volume";
-	/** Media player exposes a mute toggle distinct from volume=0. */
-	DeviceFeature["MediaPlayerMute"] = "media-player-mute";
-	/** Media player exposes a shuffle toggle. */
-	DeviceFeature["MediaPlayerShuffle"] = "media-player-shuffle";
-	/** Media player exposes a repeat mode (off / all / one). */
-	DeviceFeature["MediaPlayerRepeat"] = "media-player-repeat";
-	/** Media player exposes a source / input selector. */
-	DeviceFeature["MediaPlayerSelectSource"] = "media-player-select-source";
-	/** Media player exposes a play-arbitrary-media surface (URL / id). */
-	DeviceFeature["MediaPlayerPlayMedia"] = "media-player-play-media";
-	/** Media player exposes next-track. */
-	DeviceFeature["MediaPlayerNext"] = "media-player-next";
-	/** Media player exposes previous-track. */
-	DeviceFeature["MediaPlayerPrevious"] = "media-player-previous";
-	/** Media player exposes stop distinct from pause. */
-	DeviceFeature["MediaPlayerStop"] = "media-player-stop";
-	/** Alarm panel requires a PIN code on arm/disarm. */
-	DeviceFeature["AlarmPinRequired"] = "alarm-pin-required";
-	/** Presence device carries GPS coordinates (lat/lng/accuracy) in
-	*  addition to a textual location. */
-	DeviceFeature["PresenceGps"] = "presence-gps";
-	/** Notifier accepts an inline / URL image attachment. */
-	DeviceFeature["NotifierImage"] = "notifier-image";
-	/** Notifier accepts a priority hint (high/normal/low). */
-	DeviceFeature["NotifierPriority"] = "notifier-priority";
-	/** Notifier accepts a free-form `data` payload for platform-specific
-	*  fields. */
-	DeviceFeature["NotifierData"] = "notifier-data";
-	/** Notifier supports interactive action buttons / callbacks. */
-	DeviceFeature["NotifierActions"] = "notifier-actions";
-	/** Notifier supports per-call recipient targeting (multi-user). */
-	DeviceFeature["NotifierRecipients"] = "notifier-recipients";
-	/** Script runner accepts a variables map on each run invocation. */
-	DeviceFeature["ScriptVariables"] = "script-variables";
-	/** Automation `trigger` accepts a skipCondition flag — fires the
-	*  automation's actions while bypassing its condition block. */
-	DeviceFeature["AutomationSkipCondition"] = "automation-skip-condition";
-	/** Robot vacuum exposes a live cleaning map (image child). Gates the
-	*  map tile in the vacuum UI. */
-	DeviceFeature["VacuumHasMap"] = "vacuum-has-map";
-	/** Robot vacuum exposes AI obstacle-detection toggles. Gates the AI
-	*  switches group. */
-	DeviceFeature["VacuumHasAi"] = "vacuum-has-ai";
-	/** Robot mower exposes a live mowing map (SVG image child). Gates the
-	*  mower map tile. */
-	DeviceFeature["MowerHasMap"] = "mower-has-map";
-	/** Robot mower exposes targeted mowing (all-area / zones / edges /
-	*  spots) — gates the Mow action + map selectors. */
-	DeviceFeature["MowerHasTargetedMowing"] = "mower-has-targeted-mowing";
-	return DeviceFeature;
-}({});
-/**
-* Semantic role a device plays within its parent. Populated by driver
-* addons when creating accessory devices (Reolink siren/floodlight/
-* PIR/chime/autotrack/doorbell, ONVIF relay outputs, …). Used by the
-* admin UI to pick icons, labels, and widgets — a `Switch` with
-* `role: Floodlight` renders as a bulb with a brightness slider,
-* whereas a `Switch` with `role: Siren` renders as a klaxon.
-*
-* Undefined for top-level devices (cameras, NVRs, hubs). Persisted in
-* sqlite as a nullable TEXT column — old rows keep working unchanged.
-*/
-var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
-	DeviceRole["Siren"] = "siren";
-	DeviceRole["Floodlight"] = "floodlight";
-	DeviceRole["Spotlight"] = "spotlight";
-	DeviceRole["PirSensor"] = "pir-sensor";
-	DeviceRole["Chime"] = "chime";
-	DeviceRole["Autotrack"] = "autotrack";
-	DeviceRole["Nightvision"] = "nightvision";
-	DeviceRole["PrivacyMask"] = "privacy-mask";
-	DeviceRole["Doorbell"] = "doorbell";
-	/** Interior blind / shade / roller blind. HA `device_class: blind|shade`. */
-	DeviceRole["CoverBlind"] = "cover-blind";
-	/** Exterior roller shutter. HA `device_class: shutter`; Homematic BROLL. */
-	DeviceRole["CoverShutter"] = "cover-shutter";
-	/** Exterior awning. HA `device_class: awning`. */
-	DeviceRole["CoverAwning"] = "cover-awning";
-	/** Curtain / drape. HA `device_class: curtain`. */
-	DeviceRole["CoverCurtain"] = "cover-curtain";
-	/** Garage door. HA `device_class: garage`. A security actuator: exports gate it. */
-	DeviceRole["CoverGarage"] = "cover-garage";
-	/** Gate. HA `device_class: gate`. A security actuator: exports gate it. */
-	DeviceRole["CoverGate"] = "cover-gate";
-	/** Door. HA `device_class: door`. A security actuator: exports gate it. */
-	DeviceRole["CoverDoor"] = "cover-door";
-	/** Window. HA `device_class: window`. */
-	DeviceRole["CoverWindow"] = "cover-window";
-	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
-	*  real Switch device for UI rendering / export adapters. */
-	DeviceRole["BinaryHelper"] = "binary-helper";
-	/** A smart plug: a `switch` whose source says it is an outlet (HA
-	*  `device_class: outlet`). The Alexa export shows it as a SMARTPLUG. */
-	DeviceRole["Outlet"] = "outlet";
-	/** Generic motion / occupancy / moving event source. Distinct from
-	*  the camera accessory PirSensor role: that one is a camera child;
-	*  this is a standalone HA / 3rd-party motion sensor. */
-	DeviceRole["MotionSensor"] = "motion-sensor";
-	DeviceRole["ContactSensor"] = "contact-sensor";
-	DeviceRole["LeakSensor"] = "leak-sensor";
-	DeviceRole["SmokeSensor"] = "smoke-sensor";
-	DeviceRole["COSensor"] = "co-sensor";
-	DeviceRole["GasSensor"] = "gas-sensor";
-	DeviceRole["TamperSensor"] = "tamper-sensor";
-	DeviceRole["VibrationSensor"] = "vibration-sensor";
-	DeviceRole["ConnectivitySensor"] = "connectivity-sensor";
-	DeviceRole["SoundSensor"] = "sound-sensor";
-	/** Fallback for `binary_sensor` without a known `device_class`. */
-	DeviceRole["BinarySensor"] = "binary-sensor";
-	DeviceRole["TemperatureSensor"] = "temperature-sensor";
-	DeviceRole["HumiditySensor"] = "humidity-sensor";
-	DeviceRole["AmbientLightSensor"] = "ambient-light-sensor";
-	DeviceRole["PressureSensor"] = "pressure-sensor";
-	/** Wind speed or direction (weather-station `wind-sensor` cap). */
-	DeviceRole["WindSensor"] = "wind-sensor";
-	/** Rain accumulation or rate (weather-station `rain-sensor` cap). */
-	DeviceRole["RainSensor"] = "rain-sensor";
-	/** UV index (weather-station `uv-sensor` cap). */
-	DeviceRole["UvSensor"] = "uv-sensor";
-	/** Solar irradiance W/m² (weather-station `solar-radiation-sensor` cap).
-	*  Distinct from AmbientLightSensor (lux). */
-	DeviceRole["SolarRadiationSensor"] = "solar-radiation-sensor";
-	/** Soil moisture % (garden/weather `soil-moisture-sensor` cap). */
-	DeviceRole["SoilMoistureSensor"] = "soil-moisture-sensor";
-	DeviceRole["PowerSensor"] = "power-sensor";
-	DeviceRole["EnergySensor"] = "energy-sensor";
-	DeviceRole["VoltageSensor"] = "voltage-sensor";
-	DeviceRole["CurrentSensor"] = "current-sensor";
-	DeviceRole["AirQualitySensor"] = "air-quality-sensor";
-	/** Battery level (numeric % via `sensor` OR low-bool via
-	*  `binary_sensor` — the cap distinguishes via the value type). */
-	DeviceRole["BatterySensor"] = "battery-sensor";
-	/** Fallback for `sensor` numeric without a known `device_class`. */
-	DeviceRole["NumericSensor"] = "numeric-sensor";
-	/** String / enum state (HA `sensor` with `state_class: enum` or
-	*  `attributes.options`). */
-	DeviceRole["EnumSensor"] = "enum-sensor";
-	/** Date / timestamp state (HA `sensor` with `device_class: timestamp`
-	*  or `date`). The slice carries the raw ISO string verbatim (hosted on
-	*  the `enum-sensor` cap); the UI renders it locale-formatted. */
-	DeviceRole["DateTimeSensor"] = "datetime-sensor";
-	/** Last-resort fallback when nothing else matches. */
-	DeviceRole["GenericSensor"] = "generic-sensor";
-	DeviceRole["NumericControl"] = "numeric-control";
-	DeviceRole["SelectControl"] = "select-control";
-	DeviceRole["TextControl"] = "text-control";
-	DeviceRole["DateTimeControl"] = "datetime-control";
-	/** Mobile push notifier (HA `notify.mobile_app_*`) — supports
-	*  rich features (image, priority, channel routing). */
-	DeviceRole["MobilePushNotifier"] = "mobile-push-notifier";
-	/** Chat / messaging service (HA `notify.telegram_*`,
-	*  `notify.discord_*`, etc.). */
-	DeviceRole["MessagingNotifier"] = "messaging-notifier";
-	/** Email-based delivery (HA `notify.smtp`, etc.). */
-	DeviceRole["EmailNotifier"] = "email-notifier";
-	/** Fallback when the notifier service name doesn't match a known
-	*  pattern. */
-	DeviceRole["GenericNotifier"] = "generic-notifier";
-	/** Emits a pulse train (infrared or RF) on request — the `ir-transmitter`
-	*  cap. A `DeviceType.Generic` device. */
-	DeviceRole["IrTransmitter"] = "ir-transmitter";
-	return DeviceRole;
-}({});
-/**
-import { errMsg } from '@camstack/types'
-* Extract a human-readable message from an unknown error value.
-* Replaces the ubiquitous `errMsg(err)` pattern.
-*/
-function errMsg(err) {
-	if (err instanceof Error) return err.message;
-	if (typeof err === "string") return err;
-	return String(err);
-}
-//#endregion
-//#region ../types/dist/composition-C7WdThmP.mjs
+//#region ../types/dist/composition-BiKWlUCc.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -12458,7 +12586,15 @@ var HelperSpecSchema = discriminatedUnion("kind", [
 		thresholdWatts: number().positive(),
 		startDwellMs: number().int().nonnegative(),
 		stopDwellMs: number().int().nonnegative(),
-		member: HelperMemberSchema
+		member: HelperMemberSchema,
+		/**
+		* The plug that powers the appliance (`switch.on`). Optional: when set, the
+		* composition carries a `power-source` feature, so the hub can cut and restore
+		* that plug (power-source link of a NEW-target composition).
+		*/
+		powerSwitch: HelperMemberSchema.optional(),
+		/** How long a forced restart keeps the plug off; the cap's default when unset. */
+		offSeconds: number().optional()
 	}),
 	object({
 		kind: literal("statistic"),
@@ -12744,6 +12880,71 @@ var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
 var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
 new Set(EVENT_OWNER_TYPES);
 /**
+* What a published package needs from the rest of the install (D989).
+*
+* One published framework package (`@camstack/server`) carries the kernel, the
+* builtins and the capability contracts, so "which addon runs on which
+* framework" is a question of version, and the answer is DECLARED by the
+* package that knows it:
+*
+*   - an addon says the oldest server it runs on (`requires.server: ">=X"`);
+*   - the server says the oldest addon it works with
+*     (`requires.addons: { "@camstack/addon-x": ">=Y" }`) and the oldest shell
+*     around it (`requires.wrapper: { desktop, image }`);
+*   - a wrapper (the desktop app, the container starter) says which server
+*     range it can host, and reports its own kind and version.
+*
+* The publish workflow STAMPS these after the version bump
+* (`scripts/ci/stamp-requires.mjs`); nobody types a number by hand.
+*
+* A requirement that cannot be checked is NOT met: a shell that reports no
+* version counts as below the minimum, and an unreadable running version is
+* named in the result (a failed read is never a pass).
+*/
+/** `>=MAJOR.MINOR.PATCH[-prerelease]` — the only range shape a requirement uses. */
+var MinVersionSchema = string().regex(/^>=\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, "a minimum is written \">=X.Y.Z\"");
+object({
+	/** The oldest `@camstack/server` this package runs on. */
+	server: MinVersionSchema.optional(),
+	/** The oldest installed version of each named addon package. */
+	addons: record(string(), MinVersionSchema).optional(),
+	/** The oldest shell around the server, per shell kind. */
+	wrapper: object({
+		desktop: MinVersionSchema.optional(),
+		image: MinVersionSchema.optional()
+	}).optional()
+});
+/** One unmet requirement; each names the versions on both sides. */
+var UnmetRequirementSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("server-too-old"),
+		required: string(),
+		/** `null` — the running server version could not be read. */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("addon-too-old"),
+		packageName: string(),
+		required: string(),
+		/** `null` — the addon is not installed (or its version is unreadable). */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("wrapper-too-old"),
+		wrapper: _enum(["desktop", "image"]),
+		required: string(),
+		/** `null` — the wrapper reported no version. */
+		running: string().nullable()
+	})
+]);
+var RequiredAddonUpdateSchema = object({
+	packageName: string(),
+	/** The minimum the target server declares. */
+	required: string(),
+	/** What this node has; `null` when the addon is not installed. */
+	installed: string().nullable()
+});
+/**
 * Which integration instance a settings form is for. An addon that serves several instances
 * (`instanceMode: multiple`) can show a different form per instance — an NVR integration
 * needs its connection, the default integration needs the addon's own sections.
@@ -13362,6 +13563,619 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* Query filter for settings-store collections.
+*/
+var QueryFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
+	whereNot: record(string(), unknown()).optional(),
+	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
+	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
+	whereNotIn: record(string(), array(unknown())).optional(),
+	orderBy: object({
+		field: string(),
+		direction: _enum(["asc", "desc"])
+	}).optional(),
+	limit: number().optional(),
+	offset: number().optional()
+});
+/**
+* The predicate half of a filter, for BULK MUTATIONS.
+*
+* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
+* meaning for a statement that rewrites a set, and accepting them would invite
+* a caller to believe `limit` bounds the damage. Every field is optional here
+* only so the shape stays composable — the implementation REJECTS a filter
+* that compiles to no predicate, because that is the whole collection.
+*/
+var MutationFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	whereNot: record(string(), unknown()).optional(),
+	whereNotIn: record(string(), array(unknown())).optional()
+});
+/**
+* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
+*
+* `as` names the slot in the result, so the SAME column may be asked twice with
+* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
+* a `Record<column, op>` shape could not express.
+*/
+var AggregateFieldSchema = object({
+	/** Result key. */
+	as: string().min(1),
+	/** Column to aggregate. Must be a real column of a declared collection. */
+	field: string().min(1),
+	op: _enum([
+		"sum",
+		"min",
+		"max"
+	])
+});
+/**
+* `COUNT(*)` plus one number per requested field.
+*
+* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
+* that really is 0 are different facts, and an accounting caller that renders
+* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
+*/
+var AggregateResultSchema = object({
+	count: number().int(),
+	values: record(string(), number().nullable())
+});
+/** A single stored record: `{ id, data }`. */
+var SettingsRecordSchema = object({
+	id: string(),
+	data: record(string(), unknown())
+});
+/**
+* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
+* optional.
+*
+* A separate schema rather than loosening the shared one: every other method
+* on this cap addresses a row BY its id, and making that field optional
+* everywhere would turn a forgotten key into a silently generated one on
+* `update` and `delete` as well.
+*/
+var BulkRecordSchema = object({
+	id: string().optional(),
+	data: record(string(), unknown())
+});
+/**
+* The database FILES one `sqlite-settings` engine process owns (D851).
+* Closed on purpose: a file is a thing the engine opens, backs up and gives a
+* serving thread, so a new one is a code change, never a string a caller
+* invents. `settings` is `camstack.db` and the default for every collection
+* that names no file.
+*/
+var DataStoreDatabaseSchema = _enum([
+	"settings",
+	"events",
+	"history"
+]);
+DataStoreDatabaseSchema.options;
+/**
+* One write inside a {@link settingsStoreCapability.methods.transact} call.
+* The three that a "replace this set, bump that revision" write needs, plus
+* the batched upsert a rollup writer needs.
+*/
+var TransactOpSchema = discriminatedUnion("op", [
+	object({
+		op: literal("deleteWhere"),
+		collection: string(),
+		filter: MutationFilterSchema
+	}),
+	object({
+		op: literal("insertMany"),
+		collection: string(),
+		records: array(BulkRecordSchema).readonly()
+	}),
+	object({
+		op: literal("update"),
+		collection: string(),
+		id: string(),
+		data: record(string(), unknown())
+	}),
+	object({
+		op: literal("upsertMany"),
+		collection: string(),
+		conflict: array(string()).readonly(),
+		records: array(BulkRecordSchema).readonly()
+	})
+]);
+/**
+* The precondition of a transaction: the row `key` of `collection` must hold
+* `equals` in `column`, read INSIDE the transaction.
+*/
+var TransactGuardSchema = object({
+	collection: string(),
+	key: string(),
+	column: string(),
+	equals: unknown()
+});
+/**
+* Column declaration for a structured (SQL-backed) collection.
+*
+* Logical types — the backend translates each to the matching SQLite
+* storage class and handles per-type marshaling:
+*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
+*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
+*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
+*/
+var CollectionColumnSchema = object({
+	name: string(),
+	type: _enum([
+		"TEXT",
+		"INTEGER",
+		"REAL",
+		"JSON",
+		"BOOLEAN"
+	]),
+	primaryKey: boolean().optional(),
+	notNull: boolean().optional(),
+	unique: boolean().optional(),
+	/**
+	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
+	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
+	* collection surface simply cannot express their existing tables — which is
+	* why they were still on the uncapped `table*` API.
+	*/
+	defaultValue: union([
+		string(),
+		number(),
+		boolean()
+	]).optional()
+});
+var CollectionIndexSchema = object({
+	name: string(),
+	columns: array(string()).readonly(),
+	unique: boolean().optional()
+});
+/**
+* The input of `declareCollection` — ONE schema for the door and for the
+* engine behind it, so the two surfaces cannot drift (the dispatcher forwards
+* the payload untouched).
+*
+* - `database` — the file the collection lives in (D851). Absent means
+*   `settings`. A declaration naming a file other than the one the table is
+*   already in is REFUSED by the engine, never moved.
+* - `primaryKey` — a COMPOSITE key, as column names. A single name is the same
+*   as `primaryKey: true` on that column. A composite-keyed collection has no
+*   `id`: it is written with `insertMany` / `upsertMany` / `transact` and read
+*   with `query` / `count` / `aggregate` / `deleteWhere`; the calls that
+*   address one row by id are refused.
+* - `withoutRowid` — emit `WITHOUT ROWID`. Requires a primary key.
+*/
+var DeclareCollectionInputSchema = object({
+	namespace: string().optional(),
+	collection: string(),
+	columns: array(CollectionColumnSchema).readonly(),
+	indexes: array(CollectionIndexSchema).readonly().optional(),
+	database: DataStoreDatabaseSchema.optional(),
+	primaryKey: array(string()).readonly().optional(),
+	withoutRowid: boolean().optional()
+});
+method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), unknown(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string(),
+	value: unknown()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional(),
+	columns: array(string()).readonly().optional()
+}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	/** Declared columns identifying the slot; must be covered by a UNIQUE
+	*  index on the collection. Never empty. */
+	conflict: array(string()).readonly(),
+	record: BulkRecordSchema
+}), object({ 
+/** The id the row HAS: assigned by SQLite on an insert, or the existing
+*  row's own id on an update. */
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	conflict: array(string()).readonly(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ upserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	record: object({
+		id: string().optional(),
+		data: record(string(), unknown())
+	})
+}), object({ 
+/**
+* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
+* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
+* primary key — which is the only place an auto key is knowable.
+*/
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ inserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	guard: TransactGuardSchema.optional(),
+	ops: array(TransactOpSchema).readonly()
+}), object({
+	applied: boolean(),
+	current: unknown().optional()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	id: string(),
+	data: record(string(), unknown())
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema
+}), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema,
+	data: record(string(), unknown())
+}), object({ updated: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), number(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	fields: array(AggregateFieldSchema).readonly(),
+	filter: QueryFilterSchema.optional()
+}), AggregateResultSchema, { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	field: string(),
+	bucketSize: number().int().positive(),
+	origin: number().int(),
+	filter: QueryFilterSchema.optional()
+}), array(object({
+	bucket: number().int(),
+	count: number().int()
+})).readonly(), { auth: "admin" }), method(object({
+	namespace: string().optional(),
+	collection: string()
+}), boolean(), { auth: "admin" }), method(DeclareCollectionInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+var MigrationIdSchema = string().regex(/^[a-z0-9-]+\/\d{4}-\d{2}-\d{2}-[a-z0-9-]+$/, "a migration id is \"<owner>/<yyyy-mm-dd>-<slug>\"");
+var MigrationLevelSchema = _enum([
+	"hub-store",
+	"addon-state",
+	"node-config",
+	"viewer",
+	"addon-internal"
+]);
+var MigrationStoreSchema = _enum([
+	"settings",
+	"events",
+	"history",
+	"node-local",
+	"addon-files"
+]);
+var MigrationScopeSchema = _enum(["cluster", "per-node"]);
+/** What depends on a migration while it is pending: `block-owner` is the default. */
+var MigrationOnFailureSchema = _enum(["block-owner", "tolerate"]);
+/**
+* `sql` is a hub-only body over the owner's connection. `plan` returns edits the
+* engine applies inside the migration's own transaction (hub-owned: computed in
+* that transaction; addon-owned: computed by the owner and shipped to the engine).
+* `procedure` is addon-owned work that is not SQL (keychain, integration registry,
+* device tombstones); the ledger records its outcome and it must be idempotent.
+*/
+var MigrationBodyKindSchema = _enum([
+	"sql",
+	"plan",
+	"procedure"
+]);
+var MigrationMetaSchema = object({
+	id: MigrationIdSchema,
+	/** `hub`, an addon id, `node` or `viewer`. */
+	owner: string().regex(/^[a-z0-9-]+$/),
+	level: MigrationLevelSchema,
+	/** Strictly increasing per owner: the order within an owner. */
+	seq: number().int().positive(),
+	/** Ids of any owner: the order across owners. */
+	dependsOn: array(MigrationIdSchema),
+	store: MigrationStoreSchema,
+	scope: MigrationScopeSchema,
+	onFailure: MigrationOnFailureSchema,
+	bodyKind: MigrationBodyKindSchema,
+	description: string().min(1),
+	/** The marked field the migration's spec must assert survived. */
+	fixtureMark: string().min(1)
+}).refine((m) => m.id.startsWith(`${m.owner}/`), {
+	message: "the id must start with \"<owner>/\"",
+	path: ["id"]
+});
+/** A cycle in the dependency graph, named by the ids on it. */
+var MigrationCycleError = class extends Error {
+	ids;
+	constructor(ids) {
+		super(`migration dependsOn cycle: ${ids.join(" -> ")}`);
+		this.ids = ids;
+		this.name = "MigrationCycleError";
+	}
+};
+/**
+* Topological order over `dependsOn` plus the implicit edge "a lower `seq` of an
+* owner runs first". Ties are broken by `(owner, seq)`. Throws
+* {@link MigrationCycleError} on a cycle. A `dependsOn` id that is not in the list
+* is ignored here — the catalogue schema is what refuses it.
+*/
+function orderMigrations(items) {
+	const byId = new Map(items.map((item) => [item.id, item]));
+	const deps = /* @__PURE__ */ new Map();
+	const ownerSorted = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const list = ownerSorted.get(item.owner) ?? [];
+		list.push(item);
+		ownerSorted.set(item.owner, list);
+	}
+	for (const item of items) deps.set(item.id, new Set(item.dependsOn.filter((id) => byId.has(id))));
+	for (const list of ownerSorted.values()) {
+		list.sort((a, b) => a.seq - b.seq);
+		for (let i = 1; i < list.length; i++) {
+			const previous = list[i - 1];
+			const current = list[i];
+			if (previous !== void 0 && current !== void 0) deps.get(current.id)?.add(previous.id);
+		}
+	}
+	const tie = (a, b) => a.owner < b.owner ? -1 : a.owner > b.owner ? 1 : a.seq - b.seq;
+	const done = /* @__PURE__ */ new Set();
+	const ordered = [];
+	let remaining = [...items];
+	while (remaining.length > 0) {
+		const ready = remaining.filter((item) => [...deps.get(item.id) ?? []].every((dep) => done.has(dep)));
+		if (ready.length === 0) throw new MigrationCycleError(remaining.map((item) => item.id).sort());
+		ready.sort(tie);
+		const next = ready[0];
+		if (next === void 0) break;
+		ordered.push(next);
+		done.add(next.id);
+		remaining = remaining.filter((item) => item.id !== next.id);
+	}
+	return ordered;
+}
+/** Every way a list of migrations (in declaration order) is not a catalogue. */
+function catalogueIssues(items) {
+	const issues = [];
+	const seen = /* @__PURE__ */ new Set();
+	const known = new Set(items.map((item) => item.id));
+	const lastSeq = /* @__PURE__ */ new Map();
+	const seqUsed = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		if (seen.has(item.id)) issues.push({
+			code: "duplicate-id",
+			ids: [item.id],
+			message: `duplicate id ${item.id}`
+		});
+		seen.add(item.id);
+		const used = seqUsed.get(item.owner) ?? /* @__PURE__ */ new Set();
+		if (used.has(item.seq)) issues.push({
+			code: "duplicate-seq",
+			ids: [item.id],
+			message: `owner ${item.owner} has two migrations with seq ${item.seq}`
+		});
+		else if (item.seq < (lastSeq.get(item.owner) ?? 0)) issues.push({
+			code: "seq-order",
+			ids: [item.id],
+			message: `seq ${item.seq} of ${item.id} does not increase in declaration order (owner ${item.owner})`
+		});
+		used.add(item.seq);
+		seqUsed.set(item.owner, used);
+		lastSeq.set(item.owner, Math.max(item.seq, lastSeq.get(item.owner) ?? 0));
+		for (const dep of item.dependsOn) if (!known.has(dep)) issues.push({
+			code: "unknown-dependency",
+			ids: [item.id, dep],
+			message: `${item.id} dependsOn unknown id ${dep}`
+		});
+	}
+	try {
+		orderMigrations(items);
+	} catch (err) {
+		if (err instanceof MigrationCycleError) issues.push({
+			code: "cycle",
+			ids: err.ids,
+			message: err.message
+		});
+		else throw err;
+	}
+	return issues;
+}
+array(MigrationMetaSchema).superRefine((items, ctx) => {
+	for (const issue of catalogueIssues(items)) ctx.addIssue({
+		code: "custom",
+		message: `${issue.code}: ${issue.message}`
+	});
+});
+/**
+* The canonical JSON (`preconditionOf`) of the value a plan read; the apply step
+* re-reads, and a plan whose read no longer matches is refused (the migration is
+* `failed`, nothing it edited is kept).
+*/
+var PreconditionSchema = string().min(1).optional();
+var MigrationPlanSchema = object({ edits: array(discriminatedUnion("op", [
+	object({
+		op: literal("setKeys"),
+		scope: string().min(1),
+		values: record(string(), unknown()),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("deleteKeys"),
+		scope: string().min(1),
+		keys: array(string().min(1)).min(1),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("putRow"),
+		table: string().min(1),
+		key: record(string(), unknown()),
+		row: record(string(), unknown()),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("deleteRow"),
+		table: string().min(1),
+		key: record(string(), unknown()),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("upsertRecord"),
+		kind: string().min(1),
+		recordKey: string().min(1),
+		value: unknown(),
+		precondition: PreconditionSchema
+	}),
+	object({
+		op: literal("deleteRecord"),
+		kind: string().min(1),
+		recordKey: string().min(1),
+		precondition: PreconditionSchema
+	})
+])) });
+/**
+* What a `procedure` body reports. `already-done` means the rerun observed the
+* work finished (a crash between the work and the ledger row, or a manual fix)
+* and did none of it again; the ledger records `applied` either way.
+*/
+var MigrationProcedureResultSchema = object({
+	outcome: _enum(["done", "already-done"]),
+	summary: record(string(), unknown())
+});
+/** What an owner hands the engine when one of its migrations ran. */
+var MigrationOwnerResultSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("plan"),
+		plan: MigrationPlanSchema
+	}),
+	object({
+		kind: literal("procedure"),
+		result: MigrationProcedureResultSchema
+	}),
+	object({
+		kind: literal("failed"),
+		error: string().min(1)
+	})
+]);
+/**
+* `held`: a restore of a pre-migration snapshot undid this id; it does not rerun
+* until the operator retries or a new code version ships.
+* `skipped-newer`: the database knows an id this code does not.
+*/
+var MigrationStatusSchema = _enum([
+	"applied",
+	"failed",
+	"blocked",
+	"running",
+	"held",
+	"skipped-newer"
+]);
+var MigrationLedgerEntrySchema = object({
+	id: string(),
+	database: DataStoreDatabaseSchema,
+	owner: string(),
+	level: MigrationLevelSchema,
+	seq: number().int().nonnegative(),
+	status: MigrationStatusSchema,
+	attempts: number().int().nonnegative(),
+	appliedAt: number().nullable(),
+	codeVersion: string().nullable(),
+	/** What the apply changed: rows per table, as the engine counted them. */
+	planSummary: record(string(), unknown()).nullable(),
+	progress: record(string(), unknown()).nullable(),
+	error: string().nullable(),
+	/** Why it is `blocked` or `held` (`dependency-failed`, `snapshot-refused`, …). */
+	reason: string().nullable(),
+	nodeId: string().nullable(),
+	bootId: string().nullable(),
+	/**
+	* The catalogued meta of this id (description, body kind, store, `dependsOn`…),
+	* joined by the engine from the catalogues it knows this boot. Absent when no
+	* catalogue lists the id (a newer database).
+	*/
+	meta: MigrationMetaSchema.optional()
+});
+/** A catalogued migration that is not applied, with where it stands. */
+var MigrationPendingEntrySchema = object({
+	meta: MigrationMetaSchema,
+	database: DataStoreDatabaseSchema,
+	state: _enum([
+		"pending",
+		"failed",
+		"blocked",
+		"held"
+	]),
+	reason: string().nullable()
+});
+/** Rows per table before and after a dry run, and what it would have changed. */
+var MigrationDryRunResultSchema = object({
+	id: string(),
+	ok: boolean(),
+	error: string().nullable(),
+	rowsChanged: number().int().nonnegative(),
+	tables: array(object({
+		table: string(),
+		before: number().int().nonnegative(),
+		after: number().int().nonnegative()
+	}))
+});
+/** One of an owner's migrations, as the engine tells the owner to treat it this boot. */
+var MigrationOwnerStepSchema = object({
+	id: MigrationIdSchema,
+	action: _enum(["run", "skip"]),
+	/** The ledger state the engine found: `pending` has no row yet. */
+	state: union([literal("pending"), MigrationStatusSchema])
+});
+/**
 * The trainer contract — what the hub hands the cloud trainer and what it
 * gets back (cloud training, D805+).
 *
@@ -19135,6 +19949,14 @@ var APPLIANCE_CAP_VOCABULARY = {
 			}
 		} }
 	},
+	"device-runs": {
+		scope: "device",
+		noun: t("Runs", "Esecuzioni"),
+		events: {
+			onRunOpened: { notOperatorFacing: "the durable record of a run that the running-state start flip already announces" },
+			onRunClosed: { notOperatorFacing: "the durable record of a run that the running-state finish flip already announces" }
+		}
+	},
 	update: {
 		scope: "device",
 		noun: t("Firmware update", "Aggiornamento firmware"),
@@ -20352,6 +21174,7 @@ var SYSTEM_CAP_VOCABULARY = {
 	"login-method": system(IDENTITY),
 	"mesh-network": system(NETWORK),
 	"metrics-provider": system(CLUSTER),
+	migrations: system(INTERNAL),
 	"model-convert": system(ML),
 	"model-distributor": system(ML),
 	"mqtt-broker": system(NETWORK),
@@ -40554,7 +41377,8 @@ function normalizeUnit(raw) {
 	if (lower === "dbm") return "dBm";
 	if (lower === "dbfs") return "dBFS";
 	if (lower === "inhg") return "inHg";
-	if (lower === "mm/h") return "mm/h";
+	if (lower === "mm/h" || lower === "mm/hr") return "mm/h";
+	if (lower === "in/h" || lower === "in/hr") return "in/h";
 	if (lower === "w/m²" || lower === "w/m2") return "W/m²";
 	if (lower === "°" || lower === "deg" || lower === "degree" || lower === "degrees") return "°";
 	if (lower === "kbps") return "kbps";
@@ -42948,7 +43772,7 @@ function pruneDeletedEntities(selection, live, log, exporter) {
 * rebuilds without manual reload.
 *
 * The hub-local builtin `addon-pages-aggregator` (see
-* `@camstack/system/builtins/addon-pages-aggregator`) registers the
+* `@camstack/server/system/builtins/addon-pages-aggregator`) registers the
 * provider. Splitting the public aggregator from the raw collection
 * keeps both ends in codegen — there's no hand-written
 * `addon-pages.router.ts` wrapper anymore.
@@ -43038,7 +43862,7 @@ var addonRoutesCapability = {
 		*/
 		invoke: method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" })
 	},
-	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+	/** BIG PLAN 2: declarative mount hint — read by `@camstack/server/system` `buildCapRouters`. */
 	mount: { kind: "skip" }
 };
 var ConfigTabDeclarationSchema = object({
@@ -43267,7 +44091,7 @@ method(_void(), array(WidgetMetadataSchema).readonly(), { auth: "admin" });
 * manual reload — same scheme used by `addon-pages`.
 *
 * The hub-local builtin `addon-widgets-aggregator` (see
-* `@camstack/system/builtins/addon-widgets-aggregator`) registers the
+* `@camstack/server/system/builtins/addon-widgets-aggregator`) registers the
 * provider. Splitting the public aggregator from the raw collection
 * keeps both ends in codegen — there's no hand-written wrapper.
 */
@@ -43628,329 +44452,6 @@ method(object({
 	password: string()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
-* Query filter for settings-store collections.
-*/
-var QueryFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
-	whereNot: record(string(), unknown()).optional(),
-	/** NULL-safe exclusion of a SET — `whereNot` for more than one value. An
-	*  empty list excludes nothing. See `QueryFilter.whereNotIn`. */
-	whereNotIn: record(string(), array(unknown())).optional(),
-	orderBy: object({
-		field: string(),
-		direction: _enum(["asc", "desc"])
-	}).optional(),
-	limit: number().optional(),
-	offset: number().optional()
-});
-/**
-* The predicate half of a filter, for BULK MUTATIONS.
-*
-* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
-* meaning for a statement that rewrites a set, and accepting them would invite
-* a caller to believe `limit` bounds the damage. Every field is optional here
-* only so the shape stays composable — the implementation REJECTS a filter
-* that compiles to no predicate, because that is the whole collection.
-*/
-var MutationFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	whereNot: record(string(), unknown()).optional(),
-	whereNotIn: record(string(), array(unknown())).optional()
-});
-/**
-* One scalar an {@link settingsStoreCapability.methods.aggregate} call asks for.
-*
-* `as` names the slot in the result, so the SAME column may be asked twice with
-* two operations (`MIN(startMs)` and `MAX(startMs)` in one round trip) — which
-* a `Record<column, op>` shape could not express.
-*/
-var AggregateFieldSchema = object({
-	/** Result key. */
-	as: string().min(1),
-	/** Column to aggregate. Must be a real column of a declared collection. */
-	field: string().min(1),
-	op: _enum([
-		"sum",
-		"min",
-		"max"
-	])
-});
-/**
-* `COUNT(*)` plus one number per requested field.
-*
-* `null` means NO ROW MATCHED, never zero: a `SUM` over an empty set and a sum
-* that really is 0 are different facts, and an accounting caller that renders
-* "0 bytes, oldest = 0" for "nothing here" reports a lie about a disk.
-*/
-var AggregateResultSchema = object({
-	count: number().int(),
-	values: record(string(), number().nullable())
-});
-/** A single stored record: `{ id, data }`. */
-var SettingsRecordSchema = object({
-	id: string(),
-	data: record(string(), unknown())
-});
-/**
-* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
-* optional.
-*
-* A separate schema rather than loosening the shared one: every other method
-* on this cap addresses a row BY its id, and making that field optional
-* everywhere would turn a forgotten key into a silently generated one on
-* `update` and `delete` as well.
-*/
-var BulkRecordSchema = object({
-	id: string().optional(),
-	data: record(string(), unknown())
-});
-/**
-* The database FILES one `sqlite-settings` engine process owns (D851).
-* Closed on purpose: a file is a thing the engine opens, backs up and gives a
-* serving thread, so a new one is a code change, never a string a caller
-* invents. `settings` is `camstack.db` and the default for every collection
-* that names no file.
-*/
-var DataStoreDatabaseSchema = _enum([
-	"settings",
-	"events",
-	"history"
-]);
-DataStoreDatabaseSchema.options;
-/**
-* One write inside a {@link settingsStoreCapability.methods.transact} call.
-* The three that a "replace this set, bump that revision" write needs, plus
-* the batched upsert a rollup writer needs.
-*/
-var TransactOpSchema = discriminatedUnion("op", [
-	object({
-		op: literal("deleteWhere"),
-		collection: string(),
-		filter: MutationFilterSchema
-	}),
-	object({
-		op: literal("insertMany"),
-		collection: string(),
-		records: array(BulkRecordSchema).readonly()
-	}),
-	object({
-		op: literal("update"),
-		collection: string(),
-		id: string(),
-		data: record(string(), unknown())
-	}),
-	object({
-		op: literal("upsertMany"),
-		collection: string(),
-		conflict: array(string()).readonly(),
-		records: array(BulkRecordSchema).readonly()
-	})
-]);
-/**
-* The precondition of a transaction: the row `key` of `collection` must hold
-* `equals` in `column`, read INSIDE the transaction.
-*/
-var TransactGuardSchema = object({
-	collection: string(),
-	key: string(),
-	column: string(),
-	equals: unknown()
-});
-/**
-* Column declaration for a structured (SQL-backed) collection.
-*
-* Logical types — the backend translates each to the matching SQLite
-* storage class and handles per-type marshaling:
-*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
-*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
-*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
-*/
-var CollectionColumnSchema = object({
-	name: string(),
-	type: _enum([
-		"TEXT",
-		"INTEGER",
-		"REAL",
-		"JSON",
-		"BOOLEAN"
-	]),
-	primaryKey: boolean().optional(),
-	notNull: boolean().optional(),
-	unique: boolean().optional(),
-	/**
-	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
-	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
-	* collection surface simply cannot express their existing tables — which is
-	* why they were still on the uncapped `table*` API.
-	*/
-	defaultValue: union([
-		string(),
-		number(),
-		boolean()
-	]).optional()
-});
-var CollectionIndexSchema = object({
-	name: string(),
-	columns: array(string()).readonly(),
-	unique: boolean().optional()
-});
-/**
-* The input of `declareCollection` — ONE schema for the door and for the
-* engine behind it, so the two surfaces cannot drift (the dispatcher forwards
-* the payload untouched).
-*
-* - `database` — the file the collection lives in (D851). Absent means
-*   `settings`. A declaration naming a file other than the one the table is
-*   already in is REFUSED by the engine, never moved.
-* - `primaryKey` — a COMPOSITE key, as column names. A single name is the same
-*   as `primaryKey: true` on that column. A composite-keyed collection has no
-*   `id`: it is written with `insertMany` / `upsertMany` / `transact` and read
-*   with `query` / `count` / `aggregate` / `deleteWhere`; the calls that
-*   address one row by id are refused.
-* - `withoutRowid` — emit `WITHOUT ROWID`. Requires a primary key.
-*/
-var DeclareCollectionInputSchema = object({
-	namespace: string().optional(),
-	collection: string(),
-	columns: array(CollectionColumnSchema).readonly(),
-	indexes: array(CollectionIndexSchema).readonly().optional(),
-	database: DataStoreDatabaseSchema.optional(),
-	primaryKey: array(string()).readonly().optional(),
-	withoutRowid: boolean().optional()
-});
-method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), unknown(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string(),
-	value: unknown()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional(),
-	columns: array(string()).readonly().optional()
-}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	/** Declared columns identifying the slot; must be covered by a UNIQUE
-	*  index on the collection. Never empty. */
-	conflict: array(string()).readonly(),
-	record: BulkRecordSchema
-}), object({ 
-/** The id the row HAS: assigned by SQLite on an insert, or the existing
-*  row's own id on an update. */
-id: union([string(), number()]) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	conflict: array(string()).readonly(),
-	records: array(BulkRecordSchema).readonly()
-}), object({ upserted: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	record: object({
-		id: string().optional(),
-		data: record(string(), unknown())
-	})
-}), object({ 
-/**
-* The id the row ACTUALLY got (D473): the one supplied, the UUID minted
-* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
-* primary key — which is the only place an auto key is knowable.
-*/
-id: union([string(), number()]) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	records: array(BulkRecordSchema).readonly()
-}), object({ inserted: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	guard: TransactGuardSchema.optional(),
-	ops: array(TransactOpSchema).readonly()
-}), object({
-	applied: boolean(),
-	current: unknown().optional()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	id: string(),
-	data: record(string(), unknown())
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: MutationFilterSchema
-}), object({ deleted: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: MutationFilterSchema,
-	data: record(string(), unknown())
-}), object({ updated: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), number(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	fields: array(AggregateFieldSchema).readonly(),
-	filter: QueryFilterSchema.optional()
-}), AggregateResultSchema, { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	field: string(),
-	bucketSize: number().int().positive(),
-	origin: number().int(),
-	filter: QueryFilterSchema.optional()
-}), array(object({
-	bucket: number().int(),
-	count: number().int()
-})).readonly(), { auth: "admin" }), method(object({
-	namespace: string().optional(),
-	collection: string()
-}), boolean(), { auth: "admin" }), method(DeclareCollectionInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * How long one snapshot may take end to end: the pinned copy of the whole
 * database plus `PRAGMA integrity_check` over the copy, on the hub's slowest
 * disk. ~800 MB at a pessimistic 10 MB/s is under 3 minutes; the bound is
@@ -45913,7 +46414,7 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Gateway, DeviceType.Camera, DeviceType.Lock, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Gateway, DeviceType.Hub, DeviceType.Camera, DeviceType.Sensor, DeviceType.MediaPlayer, DeviceType.Vacuum, DeviceType.Generic, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Gateway, DeviceType.Camera, DeviceType.Lock, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Gateway, DeviceType.Hub, DeviceType.Camera, DeviceType.Sensor, DeviceType.MediaPlayer, DeviceType.Vacuum, DeviceType.Generic, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.PetFountain, DeviceType.Fan, DeviceType.Humidifier, DeviceType.Climate, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
 var NUMBER = {
 	kind: "fixed",
 	result: ["number"]
@@ -46360,6 +46861,117 @@ function actuator(input) {
 	};
 }
 new Map(GROUP_TEMPLATES.map((template) => [template.id, template]));
+var PowerSourceRefusalReasonSchema = _enum([
+	"no-power-source",
+	"switch-missing",
+	"switch-offline",
+	"switch-unknown",
+	"restart-in-progress",
+	"switch-call-failed"
+]);
+var PowerSourceActionResultSchema = discriminatedUnion("accepted", [object({ accepted: literal(true) }), object({
+	accepted: literal(false),
+	reason: PowerSourceRefusalReasonSchema,
+	/** One line for the operator, naming the switch. */
+	message: string()
+})]);
+var PowerSourceInfoSchema = object({
+	/** False when the device has no power source linked; the rest is then empty. */
+	linked: boolean(),
+	switchDeviceId: number().nullable(),
+	switchName: string().nullable(),
+	/** The switch's on/off state, or null when it is unknown. Never false for unknown (D393). */
+	switchOn: boolean().nullable(),
+	switchOnline: boolean().nullable(),
+	restartInProgress: boolean(),
+	offSeconds: number().int()
+});
+/** The composed slice: the switch state the link mirrors, plus the stored off time. */
+var PowerSourceStateSchema = object({
+	/** Null while the switch has not reported: unknown is never `false` (D393). */
+	switchOn: boolean().nullable(),
+	offSeconds: number().int(),
+	lastFetchedAt: number()
+});
+var POWER_SOURCE_DEVICE_TYPES = [
+	DeviceType.Gateway,
+	DeviceType.Hub,
+	DeviceType.Camera,
+	DeviceType.Sensor,
+	DeviceType.MediaPlayer,
+	DeviceType.Vacuum,
+	DeviceType.Generic,
+	DeviceType.Washer,
+	DeviceType.Dryer,
+	DeviceType.Dishwasher,
+	DeviceType.PetFountain,
+	DeviceType.Fan,
+	DeviceType.Humidifier,
+	DeviceType.Climate,
+	DeviceType.WaterHeater
+];
+var powerSourceCustomize = {
+	version: 1,
+	targets: [{
+		id: "switch",
+		cardinality: "scalar",
+		vocabulary: {
+			cap: "power-source",
+			stateField: "switchOn"
+		},
+		deviceTypes: POWER_SOURCE_DEVICE_TYPES,
+		apply: "add",
+		path: "switchOn",
+		sources: [{
+			kind: "switch",
+			transforms: [{ kind: "identity" }]
+		}],
+		companions: [{
+			kind: "constant",
+			path: "offSeconds",
+			value: 10,
+			when: "add"
+		}, {
+			kind: "clock",
+			path: "lastFetchedAt",
+			when: "always"
+		}],
+		sourceReport: { status: "assignment-status" }
+	}]
+};
+var deviceInput$1 = object({ deviceId: number().int().nonnegative() });
+var powerSourceCapability = {
+	name: "power-source",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: POWER_SOURCE_DEVICE_TYPES,
+	methods: {
+		getStatus: systemMethod(deviceInput$1, PowerSourceInfoSchema, { auth: "admin" }),
+		powerOn: systemMethod(deviceInput$1, PowerSourceActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		powerOff: systemMethod(deviceInput$1, PowerSourceActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		forceRestart: systemMethod(deviceInput$1, PowerSourceActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	runtimeState: PowerSourceStateSchema,
+	customize: powerSourceCustomize,
+	/**
+	* Runtime-state durability: **session** — mirrored from the linked switch on
+	* its next report; a restored value would outlive the reading it names.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	history: "none"
+};
 DeviceFeature.LightColorRgb, DeviceFeature.LightColorHsv, DeviceFeature.LightColorMired;
 DeviceType.Camera;
 `${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
@@ -46924,6 +47536,57 @@ id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
 });
+method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { auth: "admin" }), method(object({ owner: string().optional() }), object({ pending: array(MigrationPendingEntrySchema) }), { auth: "admin" }), method(object({ id: string().min(1) }), MigrationDryRunResultSchema, { auth: "admin" }), method(object({
+	id: string().min(1),
+	error: string().min(1)
+}), MigrationLedgerEntrySchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), object({ entries: array(MigrationLedgerEntrySchema) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	database: DataStoreDatabaseSchema,
+	snapshotId: string().min(1)
+}), object({
+	scheduled: boolean(),
+	held: array(string()),
+	restartRequired: boolean()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	owner: string().min(1),
+	metas: array(MigrationMetaSchema)
+}), object({
+	bootId: string(),
+	snapshot: _enum([
+		"none",
+		"written",
+		"refused"
+	]),
+	steps: array(MigrationOwnerStepSchema)
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), object({
+	proceed: boolean(),
+	state: union([literal("pending"), MigrationStatusSchema]),
+	reason: string().nullable()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	id: string().min(1),
+	result: MigrationOwnerResultSchema
+}), object({
+	status: MigrationStatusSchema,
+	error: string().nullable(),
+	rowsChanged: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * records - an addon's own facts and documents (D881): ledgers, audit rows,
 * config documents, mirrors. The third storage API next to `ctx.settings`
@@ -47734,6 +48397,101 @@ method(object({ deviceId: number().int() }), array(SeriesInfoSchema).readonly())
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* device-runs - the durable record of ONE run of a device: a washing cycle, a
+* dishwasher cycle, later a mow or a clean (D992).
+*
+* A run is a DOCUMENT (opened at one instant, closed at another, carrying what
+* was measured over it), never a sample - device-history keeps the numbers over
+* time and its `device-runs` provider keeps these documents beside them, because
+* the energy of a run is a question about device-history's own series. The
+* record is written from the `running-state` flip on `DeviceStateChanged`; it
+* survives a restart (the open row is on disk) and a missed flip (boot compares
+* the open rows against the live snapshots).
+*
+* Every measurement is `number | null` and `null` means "could not be
+* measured", never `0` (D393). A run closed by the boot reconcile because the
+* device stopped while nobody was watching has `outcome: 'unknown'`.
+*/
+var DeviceRunKindSchema = _enum([
+	"appliance",
+	"mower",
+	"vacuum"
+]);
+var DeviceRunStateSchema = _enum(["open", "closed"]);
+var DeviceRunOutcomeSchema = _enum([
+	"completed",
+	"aborted",
+	"error",
+	"unknown"
+]);
+/** What opened or closed the run. `reconcile` is the boot comparison against live state. */
+var DeviceRunSourceSchema = _enum([
+	"running-state",
+	"activity",
+	"reconcile"
+]);
+/** How the energy of a run was obtained; `null` when it could not be. */
+var DeviceRunEnergyMethodSchema = _enum(["counter-delta", "history-integral"]);
+var DeviceRunPhaseSchema = object({
+	phase: string(),
+	at: number()
+});
+/** The kind-specific block; a later phase adds a branch, nothing else changes. */
+var DeviceRunDetailSchema = discriminatedUnion("kind", [object({
+	kind: literal("appliance"),
+	/** kWh used over the run. */
+	energyKwh: number().nullable().meta(readingMeta("energy")),
+	energyMethod: DeviceRunEnergyMethodSchema.nullable(),
+	/** Highest power seen while the run was open. */
+	peakW: number().nullable().meta(readingMeta("power")),
+	/** Time-weighted mean power while the run was open. */
+	avgW: number().nullable().meta(readingMeta("power")),
+	/** The program the appliance said it ran when the run opened. */
+	program: string().nullable(),
+	remainingAtStartSec: number().nullable().meta(readingMeta("duration")),
+	/** The last phase the device reported before the run closed. */
+	finalPhase: string().nullable(),
+	/**
+	* The meter's energy counter when the run opened; `null` when the meter had
+	* not said (or the run was opened late, by the boot reconcile). It lives in
+	* the row so a run that outlives a restart still ends with `end - start`.
+	*/
+	energyStartKwh: number().nullable().meta(readingMeta("energy")),
+	/** Milliseconds of power readings behind `avgW` - the weight a restart resumes the mean with. */
+	powerObservedMs: number()
+})]);
+var DeviceRunSchema = object({
+	/** `${deviceId}:${startedAt}`. */
+	runId: string(),
+	deviceId: number().int(),
+	kind: DeviceRunKindSchema,
+	state: DeviceRunStateSchema,
+	startedAt: number(),
+	endedAt: number().nullable(),
+	durationMs: number().nullable(),
+	outcome: DeviceRunOutcomeSchema.nullable(),
+	startSource: DeviceRunSourceSchema,
+	endSource: DeviceRunSourceSchema.nullable(),
+	/** Where the device's running bit came from (`running-state.source`); `null` when it did not say. */
+	runningSource: _enum(["native", "assigned"]).nullable(),
+	phases: array(DeviceRunPhaseSchema),
+	detail: DeviceRunDetailSchema
+});
+DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, method(object({
+	deviceId: number().int(),
+	outcome: DeviceRunOutcomeSchema.optional(),
+	atFrom: number().optional(),
+	atTo: number().optional(),
+	limit: number().int().positive().max(200).default(50),
+	cursor: string().optional()
+}), object({
+	runs: array(DeviceRunSchema).readonly(),
+	nextCursor: string().nullable()
+})), method(object({
+	deviceId: number().int(),
+	runId: string()
+}), DeviceRunSchema.nullable()), method(object({ deviceId: number().int() }), DeviceRunSchema.nullable());
 var DeviceCaStatusSchema = discriminatedUnion("state", [
 	object({ state: literal("absent") }),
 	object({
@@ -47869,8 +48627,8 @@ method(object({}), object({
 });
 var KeychainKeySourceSchema = object({
 	kind: _enum([
-		"config-file",
-		"previous-config-file",
+		"mounted-file",
+		"previous-mounted-file",
 		"platform",
 		"default-file"
 	]),
@@ -52429,7 +53187,8 @@ var PALETTE_ENTRY_IDS = [
 	"switch",
 	"siren",
 	"button",
-	"doorbell"
+	"doorbell",
+	"appliance-cycle"
 ];
 var AUDIO_ENTRY_ID = "audio";
 /** Six rungs, quiet → loud. The opaque end is the entry's hex. */
@@ -52500,7 +53259,8 @@ var CAMSTACK_HEX = {
 	switch: "#7a812a",
 	siren: "#ac5d7f",
 	button: "#b276cd",
-	doorbell: "#0087ab"
+	doorbell: "#0087ab",
+	"appliance-cycle": "#2a8c8c"
 };
 var CAMSTACK_FALLBACK = [
 	"#b34dc7",
@@ -52565,7 +53325,8 @@ var HIGH_CONTRAST_HEX = {
 	switch: "#d05259",
 	siren: "#cd67b3",
 	button: "#c9746a",
-	doorbell: "#338eeb"
+	doorbell: "#338eeb",
+	"appliance-cycle": "#00848a"
 };
 var HIGH_CONTRAST_FALLBACK = [
 	"#817f3b",
@@ -52630,7 +53391,8 @@ var OKABE_ITO_HEX = {
 	switch: "#ad2c4e",
 	siren: "#348e08",
 	button: "#d27303",
-	doorbell: "#55770f"
+	doorbell: "#55770f",
+	"appliance-cycle": "#00737d"
 };
 var OKABE_ITO_FALLBACK = [
 	"#9a3784",
@@ -52839,6 +53601,7 @@ sub("switch", "control", "control", "switch", "Switch");
 sub("siren", "control", "control", "siren", "Siren");
 sub("button", "control", "control", "button", "Button");
 sub("doorbell", "control", "control", "doorbell", "Doorbell");
+sub("appliance-cycle", "control", "control", "switch", "Appliance cycle");
 for (const l of AUDIO_MACRO_LABELS) {
 	const kind = `audio-${l.id}`;
 	if (entries.has(kind)) continue;
@@ -61486,7 +62249,8 @@ var CAP_TO_KIND = {
 	cover: "cover",
 	switch: "switch",
 	button: "button",
-	doorbell: "doorbell"
+	doorbell: "doorbell",
+	"running-state": "appliance-cycle"
 };
 function buildDescriptor(capName, kind) {
 	const t = EVENT_TAXONOMY[kind];
@@ -61867,7 +62631,18 @@ var ServerUpdateActionResultSchema = object({
 	* store (D877), present when the pre-flight refused the update
 	* (`reason: 'addon-would-refuse'`). Optional for version skew.
 	*/
-	blockers: array(UpdateBlockerSchema).optional()
+	blockers: array(UpdateBlockerSchema).optional(),
+	/**
+	* The minimums the target server declares and this node does not meet
+	* (D989), present when the update was refused with
+	* `reason: 'requirements-unmet'`. Each names the versions on both sides.
+	*/
+	unmet: array(UnmetRequirementSchema).optional(),
+	/**
+	* The addons this node has below the minimum the staged server declares —
+	* the ones to update WITH the server. Present on an accepted update.
+	*/
+	requiredAddonUpdates: array(RequiredAddonUpdateSchema).optional()
 });
 var LaunchOverridesSchema = object({ 
 /** The persisted heap ceiling in MB, or `null` when none is set. */
@@ -64483,7 +65258,9 @@ var PackageUpdateSchema = object({
 	latestVersion: string(),
 	category: _enum(["addon", "core"]),
 	requiresRestart: boolean(),
-	isSystem: boolean()
+	isSystem: boolean(),
+	/** Held: what the newer version needs and this node does not meet (D989). */
+	blockedBy: array(UnmetRequirementSchema).readonly().optional()
 });
 var PackageVersionInfoSchema = object({
 	version: string(),
@@ -64675,10 +65452,7 @@ method(object({ nodeId: string().optional() }).optional(), array(AddonListItemSc
 }), InstallPackageResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ packageName: string() }), InstallPackageResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), boolean()), method(_void(), array(unknown()).readonly()), method(object({
+}), method(object({
 	packageName: string().min(1),
 	nodeId: string().optional(),
 	everywhere: boolean().optional()
@@ -65939,19 +66713,19 @@ var RemoteSetConfigResultSchema = discriminatedUnion("status", [object({ status:
 	reason: _enum(["unknown-template", "not-a-media-player"]),
 	detail: string()
 })]);
-var deviceInput$1 = object({ deviceId: number().int().nonnegative() });
+var deviceInput = object({ deviceId: number().int().nonnegative() });
 DeviceType.MediaPlayer;
-method(deviceInput$1, RemoteConfigSchema, { auth: "admin" }), method(deviceInput$1.extend({ config: RemoteConfigSchema }), RemoteSetConfigResultSchema, {
+method(deviceInput, RemoteConfigSchema, { auth: "admin" }), method(deviceInput.extend({ config: RemoteConfigSchema }), RemoteSetConfigResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(deviceInput$1, RemoteCommandListSchema, { auth: "protected" }), method(deviceInput$1.extend({
+}), method(deviceInput, RemoteCommandListSchema, { auth: "protected" }), method(deviceInput.extend({
 	role: RemoteRoleSchema,
 	/** Sends in a row (volume steps). */
 	repeat: number().int().min(1).max(50).default(1)
 }), RemoteSendResultSchema, {
 	kind: "mutation",
 	auth: "protected"
-}), method(deviceInput$1.extend({
+}), method(deviceInput.extend({
 	command: RemoteMediaCommandSchema,
 	muted: boolean().optional(),
 	source: string().optional(),
@@ -69817,7 +70591,7 @@ var lawnMowerControlCapability = {
 * clients — they reverse-connect to the hub. Exposing their interfaces
 * via the same surface would leak internal topology with no upside.
 *
-* Implementation in `@camstack/system/builtins/local-network/`.
+* Implementation in `@camstack/server/system/builtins/local-network/`.
 */
 /** Coarse classification derived from the interface name + IP range. */
 var InterfaceKindEnum = _enum([
@@ -70314,109 +71088,6 @@ var lockControlCapability = {
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
 };
-var PowerSourceRefusalReasonSchema = _enum([
-	"no-power-source",
-	"switch-missing",
-	"switch-offline",
-	"switch-unknown",
-	"restart-in-progress",
-	"switch-call-failed"
-]);
-var PowerSourceActionResultSchema = discriminatedUnion("accepted", [object({ accepted: literal(true) }), object({
-	accepted: literal(false),
-	reason: PowerSourceRefusalReasonSchema,
-	/** One line for the operator, naming the switch. */
-	message: string()
-})]);
-var PowerSourceInfoSchema = object({
-	/** False when the device has no power source linked; the rest is then empty. */
-	linked: boolean(),
-	switchDeviceId: number().nullable(),
-	switchName: string().nullable(),
-	/** The switch's on/off state, or null when it is unknown. Never false for unknown (D393). */
-	switchOn: boolean().nullable(),
-	switchOnline: boolean().nullable(),
-	restartInProgress: boolean(),
-	offSeconds: number().int()
-});
-/** The composed slice: the switch state the link mirrors, plus the stored off time. */
-var PowerSourceStateSchema = object({
-	/** Null while the switch has not reported: unknown is never `false` (D393). */
-	switchOn: boolean().nullable(),
-	offSeconds: number().int(),
-	lastFetchedAt: number()
-});
-var POWER_SOURCE_DEVICE_TYPES = [
-	DeviceType.Gateway,
-	DeviceType.Hub,
-	DeviceType.Camera,
-	DeviceType.Sensor,
-	DeviceType.MediaPlayer,
-	DeviceType.Vacuum,
-	DeviceType.Generic
-];
-var powerSourceCustomize = {
-	version: 1,
-	targets: [{
-		id: "switch",
-		cardinality: "scalar",
-		vocabulary: {
-			cap: "power-source",
-			stateField: "switchOn"
-		},
-		deviceTypes: POWER_SOURCE_DEVICE_TYPES,
-		apply: "add",
-		path: "switchOn",
-		sources: [{
-			kind: "switch",
-			transforms: [{ kind: "identity" }]
-		}],
-		companions: [{
-			kind: "constant",
-			path: "offSeconds",
-			value: 10,
-			when: "add"
-		}, {
-			kind: "clock",
-			path: "lastFetchedAt",
-			when: "always"
-		}],
-		sourceReport: { status: "assignment-status" }
-	}]
-};
-var deviceInput = object({ deviceId: number().int().nonnegative() });
-var powerSourceCapability = {
-	name: "power-source",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: POWER_SOURCE_DEVICE_TYPES,
-	methods: {
-		getStatus: systemMethod(deviceInput, PowerSourceInfoSchema, { auth: "admin" }),
-		powerOn: systemMethod(deviceInput, PowerSourceActionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		powerOff: systemMethod(deviceInput, PowerSourceActionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		forceRestart: systemMethod(deviceInput, PowerSourceActionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
-	runtimeState: PowerSourceStateSchema,
-	customize: powerSourceCustomize,
-	/**
-	* Runtime-state durability: **session** — mirrored from the linked switch on
-	* its next report; a restored value would outlive the reading it names.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session",
-	history: "none"
-};
 /**
 * A monotonic total between resets (D944). Energy uses `power-meter.energy`
 * so dashboards keep one series; every other instantaneous reading lands here.
@@ -71697,7 +72368,7 @@ onStatusChanged: { data: object({
 * jitter, and observed/peak bandwidth per device + per client.
 *
 * Implementation lives in the server's `NetworkQualityService` (thin
-* wrapper over the shared `NetworkQualityTracker` from `@camstack/system`).
+* wrapper over the shared `NetworkQualityTracker` from `@camstack/server/system`).
 * The provider is registered from `trpc.router.ts` against the existing
 * service instance — no addon owns this state.
 *
@@ -73848,7 +74519,7 @@ var ptzAutotrackCapability = {
 	*  - **Native**: the camera's own firmware autotrack, registered per device by
 	*    the driver when the probe says it exists (Reolink: yes; Hikvision:
 	*    model-dependent).
-	*  - **Wrapper**: the emulated implementation (`@camstack/system`'s `autotrack` builtin),
+	*  - **Wrapper**: the emulated implementation (`@camstack/server/system`'s `autotrack` builtin),
 	*    which follows a subject with `ptz.move` pulses driven by the detection
 	*    pipeline. `defaultActive: false` — the operator binds it per camera in
 	*    the bindings UI.
@@ -73966,6 +74637,10 @@ var RUNNING_DEVICE_TYPES = Object.values(DeviceType);
 /** Generic Customize target for the running boolean (D936). */
 var runningCustomize = {
 	version: 1,
+	overridable: [{
+		path: "running",
+		by: "running"
+	}],
 	targets: [{
 		id: "running",
 		cardinality: "scalar",
@@ -74023,7 +74698,7 @@ var runningCustomize = {
 				kind: "constant",
 				path: "phase",
 				value: null,
-				when: "always"
+				when: "add"
 			},
 			{
 				kind: "clock",
@@ -77307,7 +77982,7 @@ var ExternalIdentityKeySchema = object({
 	provider: string().min(1),
 	subject: string().min(1)
 });
-method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserInputSchema, UserSummarySchema, {
+method(_void(), array(UserSummarySchema), { auth: "admin" }), method(_void(), object({ defaultPasswordInUse: boolean() }), { auth: "admin" }), method(CreateUserInputSchema, UserSummarySchema, {
 	kind: "mutation",
 	auth: "admin",
 	access: "create"
@@ -80683,13 +81358,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"addons.installFromWorkspace": {
-		capName: "addons",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"addons.installPackage": {
 		capName: "addons",
 		capScope: "system",
@@ -80697,13 +81365,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"addons.isWorkspaceAvailable": {
-		capName: "addons",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"addons.list": {
 		capName: "addons",
 		capScope: "system",
@@ -80753,13 +81414,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"addons.listWorkspacePackages": {
-		capName: "addons",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"addons.onAddonLogs": {
 		capName: "addons",
 		capScope: "system",
@@ -83427,6 +84081,27 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceRuns.getCurrentRun": {
+		capName: "device-runs",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"deviceRuns.getRun": {
+		capName: "device-runs",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"deviceRuns.listRuns": {
+		capName: "device-runs",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
 	"deviceState.claimFields": {
 		capName: "device-state",
 		capScope: "system",
@@ -84967,6 +85642,69 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"migrations.declareOwner": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.dryRun": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"migrations.finishMigration": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.listLedger": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"migrations.listPending": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"migrations.markFailed": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.restorePreMigration": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.retry": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.startMigration": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"modelConvert.convert": {
 		capName: "model-convert",
 		capScope: "system",
@@ -90077,6 +90815,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"userManagement.getAdminBootstrapStatus": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
@@ -91573,6 +92318,21 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceRuns.getCurrentRun": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceRuns.getRun": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceRuns.listRuns": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.claimFields": [{
 		name: "deviceId",
 		form: "single",
@@ -94319,13 +95079,114 @@ NC_AUDIO_DEFAULTS.hitPercent, NC_AUDIO_DEFAULTS.samplingSeconds;
 *
 * Pure, RN-safe: the viewer imports the support rule from here.
 */
+/**
+* Control caps that still have a raise and a clear an operator names: an
+* appliance cycle raises when it STARTS and clears when it FINISHES. Kept out
+* of `SOURCE_CAP_ACTIVE_FIELD` on purpose — that table also makes a device a
+* camera-sensor / recorder-trigger source, and a dishwasher is neither.
+*/
+var CYCLE_RAISED_FIELD_BY_CAP = { "running-state": "running" };
 /** Event kind → the boolean field of its cap slice that means "raised". */
 var NC_SENSOR_RAISED_FIELD_BY_KIND = Object.freeze(Object.fromEntries(Object.entries(EVENT_KIND_BY_CAP).flatMap(([capName, descriptor]) => {
+	const cycleField = CYCLE_RAISED_FIELD_BY_CAP[capName];
+	if (cycleField !== void 0) return [[descriptor.kind, cycleField]];
 	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
 	if (field === void 0 || descriptor.category !== "sensor") return [];
 	return [[descriptor.kind, field]];
 })));
 Object.freeze(Object.keys(NC_SENSOR_RAISED_FIELD_BY_KIND));
+Object.freeze({
+	contact: {
+		starts: {
+			en: "opened",
+			it: "si apre"
+		},
+		finishes: {
+			en: "closed",
+			it: "si chiude"
+		}
+	},
+	"motion-sensor": {
+		starts: {
+			en: "motion detected",
+			it: "movimento rilevato"
+		},
+		finishes: {
+			en: "motion stopped",
+			it: "movimento terminato"
+		}
+	},
+	smoke: {
+		starts: {
+			en: "smoke detected",
+			it: "fumo rilevato"
+		},
+		finishes: {
+			en: "smoke gone",
+			it: "fumo scomparso"
+		}
+	},
+	flood: {
+		starts: {
+			en: "water detected",
+			it: "acqua rilevata"
+		},
+		finishes: {
+			en: "dry again",
+			it: "di nuovo asciutto"
+		}
+	},
+	gas: {
+		starts: {
+			en: "gas detected",
+			it: "gas rilevato"
+		},
+		finishes: {
+			en: "gas gone",
+			it: "gas scomparso"
+		}
+	},
+	"carbon-monoxide": {
+		starts: {
+			en: "carbon monoxide detected",
+			it: "monossido rilevato"
+		},
+		finishes: {
+			en: "carbon monoxide gone",
+			it: "monossido scomparso"
+		}
+	},
+	vibration: {
+		starts: {
+			en: "vibration detected",
+			it: "vibrazione rilevata"
+		},
+		finishes: {
+			en: "vibration stopped",
+			it: "vibrazione terminata"
+		}
+	},
+	tamper: {
+		starts: {
+			en: "tampered with",
+			it: "manomesso"
+		},
+		finishes: {
+			en: "tamper cleared",
+			it: "manomissione rientrata"
+		}
+	},
+	"appliance-cycle": {
+		starts: {
+			en: "the cycle started",
+			it: "il ciclo parte"
+		},
+		finishes: {
+			en: "the cycle finished",
+			it: "il ciclo è terminato"
+		}
+	}
+});
 object({
 	phase: _enum(["raised", "resolved"]),
 	episodeId: string().min(1),
@@ -94532,6 +95393,10 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
 	[...RULE_BODY_ONLY],
 	[...RULE_TEXT],
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
@@ -94549,6 +95414,7 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	[...RULE_TEXT],
 	([...RULE_TEXT], [...DEVICE_ATTENTION, ...ALERT_EPISODE]),
 	[...RULE_TEXT],
 	[...RULE_TEXT],
@@ -94793,6 +95659,7 @@ new Set([
 	"siren",
 	"button",
 	"doorbell",
+	"appliance-cycle",
 	"audio-speech",
 	"audio-scream",
 	"audio-crying",
@@ -95452,4 +96319,4 @@ async function listHomeAssistantBrokers(query) {
 	return (await query({})).filter((broker) => broker.kind === HA_BROKER_KIND);
 }
 //#endregion
-export { humiditySensorCapability as $, array as $t, brokerCapability as A, temperatureSensorCapability as At, consumableKindOf as B, DeviceRole as Bt, alarmPanelCapability as C, runningFromVacuumState as Ct, bestLocationMatch as D, smokeCapability as Dt, batteryCapability as E, sendToExportedTarget as Et, carbonMonoxideCapability as F, valveCapability as Ft, deviceAdoptionCapability as G, baseUnitOf as Gt, controlCapability as H, errMsg as Ht, climateControlCapability as I, vibrationCapability as It, eventEmitterCapability as J, defineRecordKinds as Jt, deviceExportCapability as K, createEvent as Kt, colorCapability as L, waterHeaterCapability as Lt, buildDeviceAdminUrl as M, tryConvertUnit as Mt, buttonCapability as N, updateCapability as Nt, binaryCapability as O, switchCapability as Ot, calendarSourceCapability as P, vacuumControlCapability as Pt, humidifierCapability as Q, _enum as Qt, connectivityCapability as R, weatherCapability as Rt, airQualitySensorCapability as S, runningFromMediaPlayer as St, automationControlCapability as T, scriptRunnerCapability as Tt, coverCapability as U, BaseAddon as Ut, contactCapability as V, DeviceType as Vt, deviceAdminLinkCapability as W, RecordSecretUnavailableError as Wt, floodCapability as X, isReadingQuantity as Xt, fanControlCapability as Y, entryBody as Yt, gasCapability as Z, nodePin as Zt, PLUG_APPLIANCE_TYPES as _, publicEndpointReaderFrom as _t, BaseDevice as a, record as an, motionCapability as at, accessoriesCapability as b, runExportedAction as bt, COCO_TO_MACRO as c, unknown as cn, notifierCapability as ct, ConsumableItemSchema as d, parseAdminBase as dt, boolean as en, imageCapability as et, ConsumableStatusSchema as f, powerMeterCapability as ft, MediaPlayerRepeatSchema as g, pruneDeletedEntities as gt, HvacModeSchema as h, pressureSensorCapability as ht, AlarmArmModeSchema as i, object as in, mediaPlayerCapability as it, buildAddonRouteProvider as j, tryConvertDelta as jt, brightnessCapability as k, tamperCapability as kt, CameraSwitchIdSchema as l, url as ln, numericSensorCapability as lt, FanDirectionSchema as m, presenceCapability as mt, HA_PROVIDER_ADDON_ID as n, literal as nn, lawnMowerControlCapability as nt, BaseDeviceProvider as o, string as on, normalizeUnit as ot, EnumSensorDateTimeFormatSchema as p, prepareNotification as pt, enumSensorCapability as q, defineEntryKind as qt, listHomeAssistantBrokers as r, number as rn, lockControlCapability as rt, CAMERA_SWITCH_ORDER as s, union as sn, notificationOutputCapability as st, HA_BROKER_KIND as t, discriminatedUnion as tn, ingestReading as tt, ConsumableFormSchema as u, EventCategory as un, oauthIntegrationCapability as ut, RUNNING_STATE_COLD as v, quantityFromUnit as vt, ambientLightSensorCapability as w, runningStateCapability as wt, addonRoutesCapability as x, runningFromLawnMower as xt, TargetSchema as y, resolveAttachmentUrls as yt, consumableFormOf as z, DeviceFeature as zt };
+export { humiditySensorCapability as $, number as $t, brokerCapability as A, temperatureSensorCapability as At, consumableKindOf as B, RecordSecretUnavailableError as Bt, alarmPanelCapability as C, runningFromVacuumState as Ct, bestLocationMatch as D, smokeCapability as Dt, batteryCapability as E, sendToExportedTarget as Et, carbonMonoxideCapability as F, valveCapability as Ft, deviceAdoptionCapability as G, entryBody as Gt, controlCapability as H, createEvent as Ht, climateControlCapability as I, vibrationCapability as It, eventEmitterCapability as J, _enum as Jt, deviceExportCapability as K, isReadingQuantity as Kt, colorCapability as L, waterHeaterCapability as Lt, buildDeviceAdminUrl as M, tryConvertUnit as Mt, buttonCapability as N, updateCapability as Nt, binaryCapability as O, switchCapability as Ot, calendarSourceCapability as P, vacuumControlCapability as Pt, humidifierCapability as Q, literal as Qt, connectivityCapability as R, weatherCapability as Rt, airQualitySensorCapability as S, runningFromMediaPlayer as St, automationControlCapability as T, scriptRunnerCapability as Tt, coverCapability as U, defineEntryKind as Ut, contactCapability as V, baseUnitOf as Vt, deviceAdminLinkCapability as W, defineRecordKinds as Wt, floodCapability as X, boolean as Xt, fanControlCapability as Y, array as Yt, gasCapability as Z, discriminatedUnion as Zt, PLUG_APPLIANCE_TYPES as _, publicEndpointReaderFrom as _t, BaseDevice as a, url as an, motionCapability as at, accessoriesCapability as b, runExportedAction as bt, COCO_TO_MACRO as c, DeviceType as cn, notifierCapability as ct, ConsumableItemSchema as d, parseAdminBase as dt, object as en, imageCapability as et, ConsumableStatusSchema as f, powerMeterCapability as ft, MediaPlayerRepeatSchema as g, pruneDeletedEntities as gt, HvacModeSchema as h, pressureSensorCapability as ht, AlarmArmModeSchema as i, unknown as in, mediaPlayerCapability as it, buildAddonRouteProvider as j, tryConvertDelta as jt, brightnessCapability as k, tamperCapability as kt, CameraSwitchIdSchema as l, errMsg as ln, numericSensorCapability as lt, FanDirectionSchema as m, presenceCapability as mt, HA_PROVIDER_ADDON_ID as n, string as nn, lawnMowerControlCapability as nt, BaseDeviceProvider as o, DeviceFeature as on, normalizeUnit as ot, EnumSensorDateTimeFormatSchema as p, prepareNotification as pt, enumSensorCapability as q, nodePin as qt, listHomeAssistantBrokers as r, union as rn, lockControlCapability as rt, CAMERA_SWITCH_ORDER as s, DeviceRole as sn, notificationOutputCapability as st, HA_BROKER_KIND as t, record as tn, ingestReading as tt, ConsumableFormSchema as u, EventCategory as un, oauthIntegrationCapability as ut, RUNNING_STATE_COLD as v, quantityFromUnit as vt, ambientLightSensorCapability as w, runningStateCapability as wt, addonRoutesCapability as x, runningFromLawnMower as xt, TargetSchema as y, resolveAttachmentUrls as yt, consumableFormOf as z, BaseAddon as zt };