@camstack/addon-provider-unifi 0.2.127 → 0.2.129

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-//#region ../types/dist/event-category-C4hVnRo8.mjs
+//#region ../types/dist/event-category-DOl51-Ij.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -63,6 +63,33 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	* consumes this category and maps it to the `addon-crash-loop` kind.
 	*/
 	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
+	/**
+	* A runner whose addon refused to start with a typed reason (D877) - parked
+	* in `refused`, never counted by the crash breaker, retried on operator
+	* action. One event per refusal.
+	*/
+	EventCategory["AddonRunnerRefused"] = "addon.runner-refused";
+	/**
+	* A runner settled on a state (D877): `running` (READY), `crashed`, `failed` or
+	* `refused`. In-process telemetry for the boot check (re-evaluate while any
+	* runner is still pending) and the alert centre (close a recovered runner).
+	*/
+	EventCategory["ProcessStateChanged"] = "process.state-changed";
+	/**
+	* The node's one-shot runner boot check (D877): planned runners against the
+	* process service, `degraded` when any is failed, refused or missing. The
+	* alert centre turns it into one critical alert.
+	*/
+	EventCategory["SystemRunnerCheck"] = "system.runner-check";
+	/**
+	* An alert EPISODE opened or closed, emitted by the alert centre for alerts
+	* of severity `critical` or `error` (`AlertEpisodePayload`). The alert
+	* centre sends no notification of its own: Notification Center turns this
+	* into the `alert-critical` / `alert-error` / `alert-critical-resolved`
+	* system-event kinds, and reconciles from the alerts store because a bus
+	* event may be dropped (D8, D11).
+	*/
+	EventCategory["AlertEpisode"] = "alert.episode";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -5387,7 +5414,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DRqxtc0C.mjs
+//#region ../types/dist/sleep-BxjU_fJM.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5504,7 +5531,7 @@ function isKeychainStoredField(field) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$2(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -5515,12 +5542,12 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$5(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 function isSecretClear(value) {
-	return isRecord$2(value) && value["$secretClear"] === true;
+	return isRecord$5(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -6130,7 +6157,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$1(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -6143,7 +6170,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$4(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -6198,7 +6225,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$4) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -6214,7 +6241,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$1(row)) {
+		if (!isRecord$4(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -6239,7 +6266,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$1(incoming)) {
+			if (!isRecord$4(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -6247,7 +6274,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$1(stored) ? stored : {};
+			const storedObj = isRecord$4(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -6370,7 +6397,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$1(v)) {
+		if (isRecord$4(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -6402,7 +6429,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -6431,7 +6458,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord(item) && isRecord(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$3(item) && isRecord$3(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -6442,7 +6469,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord(value) && isRecord(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$3(value) && isRecord$3(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -6450,7 +6477,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord(incoming) || !isRecord(stored)) return incoming;
+	if (!isRecord$3(incoming) || !isRecord$3(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -6481,7 +6508,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord(a) && isRecord(b)) {
+	if (isRecord$3(a) && isRecord$3(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -6505,7 +6532,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -6638,7 +6665,6 @@ function createHandle(raw, opts) {
 	const writeAddon = (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p));
 	const readAddonStoreResult = raw.readAddonStoreResult;
 	const readAddonStoreKeyResult = raw.readAddonStoreKeyResult;
-	const readDeviceStoreBatch = raw.readDeviceStoreBatch;
 	const overrides = {
 		readAddonStore: async () => resolveRead("addon", await raw.readAddonStore()),
 		...readAddonStoreResult !== void 0 ? { readAddonStoreResult: async () => {
@@ -6662,12 +6688,12 @@ function createHandle(raw, opts) {
 			};
 		} } : {},
 		readDeviceStore: async (deviceId) => resolveRead(`device:${deviceId}`, await raw.readDeviceStore(deviceId)),
-		...readDeviceStoreBatch !== void 0 ? { readDeviceStoreBatch: async (deviceIds) => {
-			const rows = await readDeviceStoreBatch.call(raw, deviceIds);
+		readDeviceStoreBatch: async (deviceIds) => {
+			const rows = await raw.readDeviceStoreBatch(deviceIds);
 			const out = /* @__PURE__ */ new Map();
 			for (const [deviceId, blob] of rows) out.set(deviceId, await resolveRead(`device:${deviceId}`, blob));
 			return out;
-		} } : {},
+		},
 		writeAddonStore: async (patch) => {
 			await writeAddon(patch);
 		},
@@ -7294,7 +7320,7 @@ var BaseAddon = class {
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
-			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
+			ctx.api.addons.restartAddon.mutate({ addonId }).then(() => {
 				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
@@ -7494,7 +7520,7 @@ var BaseAddon = class {
 		return this._addonSecretTree;
 	}
 	deviceSecretTree() {
-		this._deviceSecretTree ??= secretTreeFromSchema(this.deviceSettingsSchema());
+		this._deviceSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.deviceSettingsSchema()), this.secretStatePaths);
 		return this._deviceSecretTree;
 	}
 	/**
@@ -7570,42 +7596,135 @@ var BaseAddon = class {
 		this[timerOf] = timer;
 	}
 	/**
-	* Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
-	* transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
-	* swap, or any race where the SqliteSettingsBackend is between shutdown and
-	* re-initialize) doesn't propagate up into `initialize()` and leave the
+	* Wrap `ctx.settings.readAddonStore()` with a retry budget so a transient
+	* settings-store outage doesn't propagate up into `initialize()` and leave the
 	* addon permanently broken.
 	*
-	* Retry only the two known infra fingerprints. Anything else propagates so
-	* real bugs surface immediately. After the budget expires we fall back to
-	* `{}` (defaults) — the addon's first successful patch will rehydrate.
+	* Two kinds of outage, two budgets:
+	*  - the store's own restart fingerprints (`SqliteSettingsBackend not
+	*    initialized`, `provider not available`): a short budget, then the addon
+	*    falls back to `{}` (defaults) - its first successful patch rehydrates;
+	*  - a TRANSPORT failure (the hub is restarting while this runner boots:
+	*    `discovery deadline exceeded`, `parent could not route`, a refused or
+	*    timed-out connection). Since D870 a runner's settings read THROWS instead
+	*    of answering `{}`, so without a budget a hub restart ends in a respawn
+	*    loop. A long, bounded budget; only after it the error propagates - the
+	*    addon never runs on defaults for a store it could not ask.
+	* Anything else propagates immediately so real bugs surface.
 	*/
 	async readAddonStoreWithRetry() {
 		const settings = this.rawSettings();
 		if (!settings) return {};
-		const delaysMs = [
-			150,
-			350,
-			600,
-			900
-		];
 		let lastErr;
-		for (let attempt = 0; attempt <= delaysMs.length; attempt++) try {
+		for (let attempt = 0;; attempt++) try {
 			const stored = await settings.readAddonStore() ?? {};
 			this.settingsStoreReady = true;
 			return stored;
 		} catch (err) {
 			lastErr = err;
-			const msg = err instanceof Error ? err.message : String(err);
-			if (!(msg.includes("SqliteSettingsBackend not initialized") || msg.includes("provider not available"))) throw err;
-			if (attempt === delaysMs.length) break;
-			await new Promise((r) => setTimeout(r, delaysMs[attempt]));
+			const kind = classifyStoreError(err);
+			if (kind === "permanent") throw err;
+			const delay = (kind === "transport" ? TRANSPORT_RETRY_DELAYS_MS : RESTART_RETRY_DELAYS_MS)[attempt];
+			if (delay === void 0) {
+				if (kind === "transport") throw err;
+				break;
+			}
+			await new Promise((r) => setTimeout(r, delay));
 		}
 		this.settingsStoreReady = false;
 		this._ctx?.logger?.warn?.("readAddonStore: settings-store unavailable after retries — using defaults", { meta: { error: lastErr instanceof Error ? lastErr.message : String(lastErr) } });
 		return {};
 	}
 };
+/** The settings store's own restart fingerprints. */
+var RESTART_RETRY_DELAYS_MS = [
+	150,
+	350,
+	600,
+	900
+];
+/** A hub restarting under a booting runner: ~100 s in total. */
+var TRANSPORT_RETRY_DELAYS_MS = [
+	150,
+	350,
+	600,
+	900,
+	2e3,
+	5e3,
+	1e4,
+	2e4,
+	3e4,
+	3e4
+];
+var RESTART_FINGERPRINTS = ["SqliteSettingsBackend not initialized", "provider not available"];
+/** Node / socket error codes of a connection that did not happen or broke. */
+var TRANSPORT_CODES = new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ETIMEDOUT",
+	"EPIPE",
+	"EHOSTUNREACH",
+	"ENETUNREACH"
+]);
+/** tRPC error codes that mean "the other side is not answering now", not "your call is wrong". */
+var UNAVAILABLE_TRPC_CODES = new Set([
+	"TIMEOUT",
+	"SERVICE_UNAVAILABLE",
+	"BAD_GATEWAY",
+	"GATEWAY_TIMEOUT"
+]);
+/** The exact phrases OUR transport raises when it cannot reach the hub. */
+var TRANSPORT_PHRASES = [
+	"discovery deadline exceeded",
+	"parent could not route child unowned cap call",
+	"UDS request timed out after",
+	"channel closed"
+];
+/** Moleculer error `type`s of a call that could not be served right now. */
+var MOLECULER_TRANSIENT_TYPES = new Set([
+	"REQUEST_TIMEOUT",
+	"SERVICE_NOT_FOUND",
+	"SERVICE_NOT_AVAILABLE",
+	"REQUEST_REJECTED",
+	"BROKER_DISCONNECTED"
+]);
+function stringProp(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const found = Reflect.get(value, key);
+	return typeof found === "string" ? found : void 0;
+}
+/** The code an error carries: its own, its cause's, or a tRPC `data.code`. */
+function errorCode(err) {
+	const out = {};
+	const cause = typeof err === "object" && err !== null ? Reflect.get(err, "cause") : void 0;
+	const data = typeof err === "object" && err !== null ? Reflect.get(err, "data") : void 0;
+	const node = stringProp(err, "code") ?? stringProp(cause, "code");
+	if (node !== void 0) out.node = node;
+	const trpc = stringProp(data, "code");
+	if (trpc !== void 0) out.trpc = trpc;
+	return out;
+}
+/**
+* Is a settings read failure worth retrying, and with which budget? Only
+* EXPLICIT signals count: a socket error code, a tRPC "unavailable" code, or
+* one of the exact phrases our own transport raises. A message that merely
+* contains "timed out" or "unreachable" is not evidence of anything, and
+* `settings store not wired` is a wiring bug that retrying cannot fix.
+*/
+function classifyStoreError(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	if (RESTART_FINGERPRINTS.some((f) => message.includes(f))) return "restart";
+	const code = errorCode(err);
+	if (code.node !== void 0 && TRANSPORT_CODES.has(code.node)) return "transport";
+	if (code.trpc !== void 0 && UNAVAILABLE_TRPC_CODES.has(code.trpc)) return "transport";
+	if (typeof err === "object" && err !== null) {
+		if (Reflect.get(err, "retryable") === true) return "transport";
+		const type = stringProp(err, "type");
+		if (type !== void 0 && MOLECULER_TRANSIENT_TYPES.has(type)) return "transport";
+	}
+	if (TRANSPORT_PHRASES.some((f) => message.includes(f))) return "transport";
+	return "permanent";
+}
 /**
 * Collect the keys of every field marked `perNode: true`, recursing into
 * layout containers (`group` fields and `sub-tabs` tabs) the same way
@@ -7695,6 +7814,156 @@ var PeerBytesTicketSchema = object({
 	*/
 	declaredBytes: number().int().nonnegative().nullable()
 });
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_QUERY_MAX = 1e3;
+function defOf(schema) {
+	const zodBag = Reflect.get(schema, "_zod");
+	if (typeof zodBag !== "object" || zodBag === null) return {};
+	const def = Reflect.get(zodBag, "def");
+	if (typeof def !== "object" || def === null) return {};
+	return def;
+}
+function declaredHere(schema) {
+	return globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
+/**
+* Record kinds (D881): the declaration an addon makes of one kind of fact, the
+* Zod row schema that describes it, and the helper that turns the two into the
+* JSON the engine stores.
+*
+* A kind is declared ONCE, next to the code that owns it, and the engine's
+* reconciler creates its indexes - nothing creates DDL at runtime from a write.
+* Everything the generic machinery needs (secret fields, the entry descriptor)
+* is DERIVED from the Zod schema: `.meta({ secret: true })` marks a credential,
+* never a field name (D879).
+*/
+/** A JSON field path: `trackId`, `auth.accessToken`. Charset-restricted: it is rendered into DDL. */
+var RecordFieldPathSchema = string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}(\.[A-Za-z_][A-Za-z0-9_]{0,63}){0,3}$/);
+var RecordIndexSchema = object({
+	name: string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+	fields: array(RecordFieldPathSchema).min(1).max(4),
+	unique: boolean().optional()
+}).strict();
+var RecordRetentionSchema = union([
+	object({
+		ttlMs: number().int().positive(),
+		from: _enum(["at", "write"])
+	}).strict(),
+	object({
+		maxRows: number().int().positive().optional(),
+		maxRowsPerDevice: number().int().positive().optional()
+	}).strict().refine((r) => r.maxRows !== void 0 || r.maxRowsPerDevice !== void 0, { message: "name maxRows, maxRowsPerDevice or both" }),
+	object({
+		owner: string().min(1),
+		reason: string().min(1)
+	}).strict(),
+	object({ none: string().min(1) }).strict()
+]);
+/** The descriptor a generic entries UI reads (D881 "generic entries"). */
+var EntryDescriptorSchema = object({
+	title: string().min(1),
+	/** The record body field shown as the entry's name. */
+	nameField: string().min(1),
+	/** JSON Schema of the entry body; `secret: true` marks a password field. */
+	fields: record(string(), unknown())
+}).strict();
+/** What crosses the wire and sits in the engine's catalog: JSON only, no Zod. */
+var RecordKindDeclarationSchema = object({
+	database: _enum(RECORD_DATABASES).default("settings"),
+	class: _enum(RECORD_CLASSES),
+	writeTrigger: string().min(1),
+	device: _enum([
+		"required",
+		"optional",
+		"none"
+	]).default("none"),
+	at: _enum(["required", "none"]).default("none"),
+	indexes: array(RecordIndexSchema).max(8).default([]),
+	retention: RecordRetentionSchema,
+	deviceRemoval: _enum(["delete", "none"]).default("none"),
+	maxDataBytes: number().int().positive().max(RECORD_MAX_DATA_BYTES).default(RECORD_DEFAULT_MAX_DATA_BYTES),
+	/** Derived from the Zod schema; never written by hand. */
+	secretPaths: array(string().min(1)).default([]),
+	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
+	secretArrayKeys: record(string(), string()).default({}),
+	/** The legacy table this kind adopts from; the boot guard reads it (D853: no migration code). */
+	adoptsFrom: string().min(1).optional(),
+	/** Kinds that must agree through `transact` sit in one file under one family name. */
+	transactFamily: string().min(1).optional(),
+	entry: EntryDescriptorSchema.optional()
+}).strict();
+/** The kind names: lower-case, dash separated, short enough for an index name. */
+var RecordKindNameSchema = string().regex(/^[a-z][a-z0-9-]{0,47}$/);
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = _enum([
 	"high",
@@ -8159,69 +8428,6 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
-function defOf(schema) {
-	return schema._zod?.def ?? {};
-}
-function declaredHere(schema) {
-	return globalRegistry.get(schema)?.secret === true;
-}
-/** Wrapper kinds whose `innerType` is the field itself. */
-var WRAPPERS = new Set([
-	"optional",
-	"nullable",
-	"default",
-	"prefault",
-	"catch",
-	"readonly",
-	"nonoptional"
-]);
-/**
-* The schema layers that make up ONE field: the schema itself and every
-* wrapper below it (optional / default / nullable / readonly / catch), plus
-* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
-* `.transform` on `in`).
-*/
-function layersOf(schema) {
-	const out = [];
-	const queue = [schema];
-	while (queue.length > 0) {
-		const s = queue.shift();
-		if (!s || out.includes(s)) continue;
-		out.push(s);
-		const def = defOf(s);
-		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
-		if (def.type === "pipe") {
-			if (def.in) queue.push(def.in);
-			if (def.out) queue.push(def.out);
-		}
-	}
-	return out;
-}
-/** True when any layer of this field declares `.meta({ secret: true })`. */
-function isZodSecret(schema) {
-	return layersOf(schema).some(declaredHere);
-}
-/**
-* Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
-* object or array is reported as one path and not descended into — everything
-* under it is secret.
-*/
-function collectZodSecretPaths(schema, prefix = "") {
-	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
-	const paths = [];
-	for (const layer of layersOf(schema)) {
-		const def = defOf(layer);
-		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
-		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
-		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
-		else if (def.type === "intersection") {
-			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
-			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
-		}
-	}
-	return [...new Set(paths)];
-}
 object({
 	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
 	params: record(string(), union([string(), number()])).optional()
@@ -8241,7 +8447,7 @@ function userError(code, params, englishFallback) {
 	return new CamstackError(code, params, englishFallback);
 }
 //#endregion
-//#region ../types/dist/err-msg-DLerKiVO.mjs
+//#region ../types/dist/err-msg-BXKzRBwg.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -8333,6 +8539,10 @@ var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
 	*  integrations sharing the same food/desiccant/hopper surface. */
 	DeviceType["PetFeeder"] = "pet-feeder";
+	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
+	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
+	*  Sources: native Bosch Home Connect, reusable by similar integrations. */
+	DeviceType["Dishwasher"] = "dishwasher";
 	return DeviceType;
 }({});
 var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
@@ -8510,6 +8720,9 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
 	*  real Switch device for UI rendering / export adapters. */
 	DeviceRole["BinaryHelper"] = "binary-helper";
+	/** A smart plug: a `switch` whose source says it is an outlet (HA
+	*  `device_class: outlet`). The Alexa export shows it as a SMARTPLUG. */
+	DeviceRole["Outlet"] = "outlet";
 	/** Generic motion / occupancy / moving event source. Distinct from
 	*  the camera accessory PirSensor role: that one is a camera child;
 	*  this is a standalone HA / 3rd-party motion sensor. */
@@ -8587,7 +8800,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-EQ9Ok0Ee.mjs
+//#region ../types/dist/composition-CB6PMT9p.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -11791,11 +12004,10 @@ var ClipModelMetaSchema = object({
 	/**
 	* The `vector-store` index this model's vectors live in. ONE feature space
 	* per index: two models share an index only when their vectors are ranked
-	* against each other, which for CLIP means never across families. MobileCLIP
-	* S1 and S2 share `object-clip` for history (separated by the row's
-	* `modelId`); any other model gets its own.
+	* against each other, which for CLIP means never across families. Every
+	* model gets its own.
 	*/
-	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	vectorIndex: string().regex(/^object-clip-[a-z0-9][a-z0-9-]*$/),
 	/**
 	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
 	* must be unique per tokenizer: every model's siblings land in ONE flat
@@ -12974,8 +13186,20 @@ var AlertSeveritySchema = _enum([
 	"info",
 	"success",
 	"warning",
-	"error"
+	"error",
+	"critical"
 ]);
+var AlertActionSchema = object({
+	label: string(),
+	href: string().optional(),
+	/**
+	* How `href` is followed. Absent / `app`: an admin-ui route (client-side).
+	* `server`: a route the HUB serves (an addon HTTP route such as an OAuth
+	* start) — the browser must leave the SPA with a full navigation, because
+	* the SPA has no such route and would bounce to the home page.
+	*/
+	navigation: _enum(["app", "server"]).optional()
+});
 var AlertStatusSchema = _enum([
 	"active",
 	"in-progress",
@@ -12993,6 +13217,7 @@ var AlertSchema = object({
 	severity: AlertSeveritySchema,
 	title: string(),
 	message: string(),
+	action: AlertActionSchema.optional(),
 	status: AlertStatusSchema,
 	progress: number().optional(),
 	read: boolean(),
@@ -15528,6 +15753,41 @@ var ComposableCapabilitiesSchema = object({ caps: array(object({
 		keyField: string()
 	}).optional()
 })) });
+/**
+* The report of a one-shot "move this owner's plaintext secrets into the
+* keychain" run (D878). COUNTS only - never a value, never a ref.
+*
+* The owner runs it on its own rows, through its own write path; an operator
+* script (`scripts/hub/migrate-raw-secrets.ts`) calls the owner's cap method.
+* Dry run (`apply: false`) reports what WOULD move and changes nothing.
+*/
+var RawSecretMigrationInputSchema = object({ 
+/** `false` (the default of the script) = report only. */
+apply: boolean() });
+var RawSecretMigrationReportSchema = object({
+	apply: boolean(),
+	/** Rows that can carry a secret (a profile, an enrolment). */
+	rows: number().int(),
+	/** Rows whose secret was plaintext when the run started. */
+	raw: number().int(),
+	/** Rows that already held a keychain marker when the run started. */
+	markers: number().int(),
+	/** Plaintext rows moved by THIS run (always 0 on a dry run). */
+	migrated: number().int(),
+	/** Plaintext rows left in place because the move or its read-back failed. */
+	failed: number().int(),
+	/** After the run: rows still holding plaintext. */
+	remainingRaw: number().int(),
+	/** After the run: markers the keychain could not resolve right now. */
+	unresolvedMarkers: number().int(),
+	/**
+	* A second, redundant copy of the secrets' rows that the run found (and, on
+	* `apply`, deleted after verifying the first). Owners with a single copy omit it.
+	*/
+	redundantCopies: number().int().optional(),
+	/** True when nothing is raw and every marker resolves. */
+	verified: boolean()
+});
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
@@ -15754,6 +16014,9 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), SettingsUpdateResultSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({}), object({ libs: array(object({
 	filePath: string(),
 	content: string()
@@ -16017,6 +16280,347 @@ id: union([string(), number()]) }), {
 	auth: "admin"
 });
 /**
+* records - an addon's own facts and documents (D881): ledgers, audit rows,
+* config documents, mirrors. The third storage API next to `ctx.settings`
+* (operator intent, D870) and device-history (numbers over time, D850).
+*
+* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
+* crossed a process and stated by a hub in-process caller (`ctx.records` does
+* that with the addon id closed over). It is deliberately NOT in any input
+* schema, so a session can never supply it, and a call with no stamp is refused
+* `records/no-caller`. A kind is readable and writable only by its owner; other
+* addons go through the owner's capability.
+*
+* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
+* never `[]`. Secret fields are never on the wire: a read shows the
+* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
+* resolves itself, and a write may carry only a keychain marker bound to the
+* row's own ref.
+*
+* Internal: addons reach it through `ctx.records`, never directly.
+*/
+var RecordIdSchema = string().min(1).max(256);
+/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
+var RecordBodySchema = record(string(), unknown());
+var RecordInputSchema = object({
+	id: RecordIdSchema,
+	/** The device this row belongs to (D865 removal, per-device reads). */
+	deviceId: number().int().optional(),
+	/** The domain clock, ms: observed / created / opened. */
+	at: number().int().optional(),
+	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
+	expiresAt: number().int().optional(),
+	data: RecordBodySchema
+});
+var RecordViewSchema = object({
+	id: string(),
+	deviceId: number().int().nullable(),
+	at: number().nullable(),
+	expiresAt: number().nullable(),
+	rev: number().int(),
+	updatedAt: number(),
+	data: RecordBodySchema
+});
+/** Declared index fields only. Anything else does not compile, by design. */
+var RecordWhereSchema = record(RecordFieldPathSchema, union([
+	string(),
+	number(),
+	boolean(),
+	object({ in: array(union([
+		string(),
+		number(),
+		boolean()
+	])).min(1).max(RECORD_BATCH_MAX) }),
+	object({
+		gt: union([string(), number()]).optional(),
+		gte: union([string(), number()]).optional(),
+		lt: union([string(), number()]).optional(),
+		lte: union([string(), number()]).optional()
+	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
+]));
+var KindShape = { kind: RecordKindNameSchema };
+var TimeWindowShape = {
+	deviceId: number().int().optional(),
+	atFrom: number().optional(),
+	atTo: number().optional()
+};
+var RecordQueryInputSchema = object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional(),
+	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
+	order: _enum(["at", "id"]).optional(),
+	desc: boolean().optional(),
+	limit: number().int().min(1).max(RECORD_QUERY_MAX).default(100),
+	/** Opaque keyset cursor from a previous answer. There is no offset. */
+	cursor: string().min(1).optional()
+});
+var RecordQueryResultSchema = object({
+	records: array(RecordViewSchema),
+	nextCursor: string().nullable()
+});
+var RecordKindStateSchema = _enum([
+	"created",
+	"unchanged",
+	"updated"
+]);
+var DeclareKindResultSchema = object({
+	kindId: number().int(),
+	state: RecordKindStateSchema,
+	createdIndexes: array(string()),
+	/** The boot guard: the kind is empty while its legacy table still holds rows. */
+	adoptionPending: object({
+		legacyTable: string(),
+		legacyRows: number().int()
+	}).nullable()
+});
+/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
+var SecretRefsList = array(string());
+var RecordSecretRefsSchema = record(string(), record(string(), string()));
+method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string(), DeclareKindResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), array(RecordViewSchema), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	record: RecordInputSchema,
+	/** Compare-and-set. `0` means "the row must not exist". */
+	ifRev: number().int().min(0).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	count: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema,
+	data: RecordBodySchema,
+	at: number().int().nullable().optional(),
+	expiresAt: number().int().nullable().optional(),
+	ifRev: number().int().min(1).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), object({
+	deleted: boolean(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional()
+}), object({ count: number().int() }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	from: number(),
+	to: number(),
+	bucketMs: number().int().positive()
+}), object({ buckets: array(object({
+	bucketStart: number(),
+	count: number().int()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	op: _enum([
+		"sum",
+		"min",
+		"max",
+		"count"
+	]),
+	field: RecordFieldPathSchema.optional(),
+	groupBy: RecordFieldPathSchema.optional(),
+	where: RecordWhereSchema.optional()
+}), object({ rows: array(object({
+	group: union([
+		string(),
+		number(),
+		_null()
+	]),
+	value: number().nullable()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	atBefore: number().optional(),
+	where: RecordWhereSchema.optional()
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	kinds: array(RecordKindNameSchema).optional()
+}), object({
+	deleted: record(string(), number().int()),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object(KindShape), object({ id: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/** One table of the settings database. */
+var StorageTableSchema = object({
+	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
+	name: string(),
+	/** The owner prefix of a scoped name (`recorder` for `recorder:addon-settings`), else null. */
+	owner: string().nullable(),
+	rows: number().int().nonnegative(),
+	/** Bytes the table's pages occupy (`dbstat`); null when the engine cannot measure. */
+	bytes: number().int().nonnegative().nullable(),
+	/** Declared by an addon since this engine process started (a running addon claims it). */
+	declaredThisBoot: boolean()
+});
+/** One declared record kind (D881) as System -> Data shows it. */
+var StorageKindSchema = object({
+	owner: string(),
+	kind: string(),
+	database: _enum(["settings", "events"]),
+	class: string(),
+	state: _enum([
+		"declared",
+		"orphaned",
+		"dropped"
+	]),
+	/** `null` when the caller asked for no counts (`counts: false`). */
+	rows: number().int().nonnegative().nullable(),
+	/** Rows x the average size of a sample; null for an empty kind. */
+	bytesEstimate: number().int().nonnegative().nullable(),
+	writeTrigger: string(),
+	retention: RecordRetentionSchema,
+	/** `true` when the kind is an entry kind (the generic entries UI lists it). */
+	entry: boolean(),
+	/** The whole declaration, secret paths and entry descriptor included (the entries service builds its handle from it). */
+	declaration: RecordKindDeclarationSchema
+});
+method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: array(StorageTableSchema) }), { auth: "admin" }), method(object({
+	collection: string().min(1),
+	expectRows: number().int().nonnegative()
+}), object({
+	dropped: literal(true),
+	rows: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	owner: string().min(1).optional(),
+	/** `false` skips the per-kind row count (a catalog read only). Default true. */
+	counts: boolean().optional()
+}), object({ kinds: array(StorageKindSchema) }), { auth: "admin" }), method(RecordQueryInputSchema.extend({
+	owner: string().min(1),
+	kind: RecordKindNameSchema
+}), RecordQueryResultSchema, { auth: "admin" }), method(object({
+	owner: string().min(1),
+	kind: RecordKindNameSchema,
+	records: array(RecordInputSchema).max(RECORD_BATCH_MAX),
+	/** The LAST batch: the copy is complete, the boot guard stops asking. */
+	complete: boolean().optional()
+}).refine((input) => input.records.length > 0 || input.complete === true, { message: "records must be non-empty unless complete is true" }), object({ adopted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	collection: string().min(1),
+	cursor: string().optional(),
+	limit: number().int().min(1).max(1e3).optional()
+}), object({
+	rows: array(object({
+		id: string(),
+		data: record(string(), unknown())
+	})),
+	nextCursor: string().nullable()
+}), { auth: "admin" }), method(object({ collection: string().min(1) }), object({ adopted: boolean() }), { auth: "admin" });
+/**
+* record-entries - the ONE admin surface for every list of user-created entries
+* (D881): notification targets, brokers, LLM profiles, anything an addon
+* declares as an ENTRY kind (`entry: { title }` in `defineRecordKinds`).
+*
+* The UI is generic. `listEntryKinds` hands it, per kind, the JSON Schema of
+* the entry body with `secret: true` on every credential field, so a password
+* field is derived from the schema and never from a name. `putEntry` takes the
+* redaction token for an untouched secret (the stored value is kept), a string
+* for a new one, and the clear instruction to remove one. A read never carries
+* a secret value, and a locked keychain refuses the write with
+* `records/secret-unavailable` instead of storing plaintext.
+*
+* Hub-only, served in-process (it acts for each entry's owner on the keychain).
+*/
+var EntryKindInfoSchema = object({
+	owner: string(),
+	kind: RecordKindNameSchema,
+	title: string(),
+	nameField: string(),
+	/** JSON Schema of the body; `secret: true` marks a password field. */
+	fields: record(string(), unknown()),
+	secretPaths: array(string()),
+	rows: number().int().nonnegative()
+});
+var EntryViewSchema = object({
+	id: RecordIdSchema,
+	name: string(),
+	rev: number().int(),
+	updatedAt: number(),
+	/** Secret fields hold the redaction token. */
+	data: RecordBodySchema
+});
+var EntryAddress = {
+	owner: string().min(1),
+	kind: RecordKindNameSchema
+};
+method(object({}), object({ kinds: array(EntryKindInfoSchema) }), { auth: "admin" }), method(object({ ...EntryAddress }), object({ entries: array(EntryViewSchema) }), { auth: "admin" }), method(object({
+	...EntryAddress,
+	id: RecordIdSchema.optional(),
+	data: RecordBodySchema,
+	ifRev: number().int().min(1).optional()
+}), object({
+	id: string(),
+	rev: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...EntryAddress,
+	id: RecordIdSchema
+}), object({ deleted: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * `keychain` — the hub's encrypted store of secret values (D787).
 *
 * Settings blobs never hold a secret: they hold a marker
@@ -16557,6 +17161,16 @@ method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}),
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
+}), method(object({
+	ref: string().min(1),
+	value: string().min(1)
+}), object({
+	ref: string(),
+	version: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
 }), method(object({ refs: array(string().min(1)).max(1e3) }), object({
 	deleted: array(string()).readonly(),
 	kept: array(object({
@@ -17078,7 +17692,11 @@ var deviceDiscoveryCapability = {
 };
 /**
 * `device-adoption` — generic discovery + adoption surface,
-* system-scoped singleton. The de-HA-ified successor to `ha-discovery`:
+* system-scoped collection (one provider per integration addon), routed
+* by explicit `{ addonId }` on direct `deviceAdoption.*` calls — the same
+* pin model as `connection-test`. The admin UI keeps using
+* `deviceManager.adoption*` (which already threads `addonId`). The de-HA-ified
+* successor to `ha-discovery`:
 * keyed by `integrationId` (the addon resolves integrationId → broker
 * internally) rather than a connection-specific `brokerId`, and it
 * REUSES the shared `DiscoveredChildDevice` candidate type from
@@ -39331,6 +39949,9 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, {
 }), _void(), { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(ProfileRefInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -41406,6 +42027,9 @@ var NcSystemEventKindSchema = _enum([
 	"server-updated",
 	"export-completed",
 	"backup-completed",
+	"alert-critical",
+	"alert-error",
+	"alert-critical-resolved",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -49840,6 +50464,41 @@ var ServerRollbackInfoSchema = object({
 	atMs: number(),
 	reason: string()
 });
+/**
+* The runner boot check (D877): the runners this node PLANNED (hub: one per
+* `resolveRunnerId` over its forked addons; agent: the runners its process
+* service holds, because only the hub plans) against the states the process
+* service reports. Kept in memory, recomputed by the same one-shot check after
+* every boot, served on `getServerPackageStatus`.
+*
+* `failed` is the D6 breaker's terminal state, `refused` a deterministic Init
+* refusal (an addon that said "I will not start, and here is why"), `missing` a
+* planned runner the process service has no entry for.
+*/
+var RunnerRefusalSchema = object({
+	runnerId: string(),
+	addonIds: array(string()),
+	reason: string()
+});
+var RunnerBootCheckSchema = object({
+	checkedAtMs: number(),
+	/** Runners planned for this node. */
+	expected: number(),
+	/** Planned runners whose process is `running`. */
+	running: number(),
+	failed: array(string()),
+	refused: array(RunnerRefusalSchema),
+	missing: array(string()),
+	/**
+	* Runners still on their way: `starting`, or `crashed` waiting on a backoff
+	* respawn. The check is FINAL only when this is empty; until then nothing is
+	* pushed and the verdict is re-evaluated on the next runner state change.
+	* Optional for version skew (absent = settled).
+	*/
+	pending: array(string()).optional(),
+	/** True when the plan is the hub's (`missing` is then meaningful); false on an agent. */
+	planKnown: boolean()
+});
 var ServerPackageStatusSchema = object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: string(),
@@ -49902,7 +50561,14 @@ var ServerPackageStatusSchema = object({
 	* for version skew: an older provider's payload simply omits it, and an
 	* absent wrapper is unknown — never `native`.
 	*/
-	wrapper: WrapperIdentitySchema.optional()
+	wrapper: WrapperIdentitySchema.optional(),
+	/**
+	* What this node PLANNED to run against what its process service reports
+	* (D877). Absent until the one-shot boot check has run (~60 s after boot) and
+	* on a provider that predates it. Absent is "not checked yet", never "all
+	* well": a consumer that needs the answer treats it as pending.
+	*/
+	runners: RunnerBootCheckSchema.optional()
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),
@@ -49953,6 +50619,13 @@ var ServerUpdateOutcomeSchema = _enum([
 	"refused",
 	"failed"
 ]);
+/** One addon the pre-flight found the target version would refuse (D877). */
+var UpdateBlockerSchema = object({
+	addonId: string(),
+	reason: string(),
+	/** What the operator does about it. */
+	remedy: string()
+});
 var ServerUpdateActionResultSchema = object({
 	accepted: boolean(),
 	targetVersion: string().nullable(),
@@ -49970,14 +50643,27 @@ var ServerUpdateActionResultSchema = object({
 	* The failure itself, verbatim enough to act on (the npm output for a
 	* staging install). Non-null only for `failed`.
 	*/
-	error: string().nullable().optional()
+	error: string().nullable().optional(),
+	/**
+	* The addons the target version would refuse to start on this node's live
+	* store (D877), present when the pre-flight refused the update
+	* (`reason: 'addon-would-refuse'`). Optional for version skew.
+	*/
+	blockers: array(UpdateBlockerSchema).optional()
 });
 method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), ServerUpdateCheckResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ 
-/** Explicit target version; omitted = latest from the registry. */
-version: string().optional() }), ServerUpdateActionResultSchema, {
+}), method(object({
+	/** Explicit target version; omitted = latest from the registry. */
+	version: string().optional(),
+	/**
+	* Apply even though the pre-flight (D877) found addons the target would
+	* refuse to start. Off by default: those addons stay down until the
+	* remedy is run, which is the incident this gate exists to prevent.
+	*/
+	acknowledgeRefusals: boolean().optional()
+}), ServerUpdateActionResultSchema, {
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 16 * 6e4
@@ -50420,7 +51106,10 @@ method(StorageMigrationInputSchema, StorageMigrationPlanSchema, { auth: "admin"
 }), method(object({ jobId: string().optional() }), StorageMigrationJobSchema.nullable(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), array(StorageMigrationMoverSchema).readonly(), { auth: "admin" }), method(object({}), array(StorageMigrationResidueSchema).readonly(), { auth: "admin" }), method(StorageMigrationDrainInputSchema, object({ jobId: string() }), {
+}), method(object({}), array(StorageMigrationMoverSchema).readonly(), { auth: "admin" }), method(object({ locationIds: array(string()).readonly() }), object({
+	clear: boolean(),
+	repointLocationId: string().optional()
+}), { auth: "admin" }), method(object({}), array(StorageMigrationResidueSchema).readonly(), { auth: "admin" }), method(StorageMigrationDrainInputSchema, object({ jobId: string() }), {
 	kind: "mutation",
 	auth: "admin"
 }), method(StorageCleanupInputSchema, object({ jobId: string() }), {
@@ -52423,7 +53112,9 @@ var ManifestShapeSchema = object({
 var AddonProcessSchema = object({
 	pid: number().optional(),
 	mode: string(),
-	state: string()
+	state: string(),
+	/** Why the runner is `refused` (an addon's own words), when it is (D877). */
+	reason: string().optional()
 });
 /**
 * Per-addon health snapshot from the kernel's AddonHealthMonitor.
@@ -53191,7 +53882,8 @@ var batteryCapability = {
 		DeviceType.Button,
 		DeviceType.Switch,
 		DeviceType.PetFeeder,
-		DeviceType.Container
+		DeviceType.Container,
+		DeviceType.Thermostat
 	],
 	methods: { 
 	/**
@@ -53829,6 +54521,12 @@ var ClimateControlStatusSchema = object({
 	/** Horizontal louver swing on/off. Null when the device has no
 	*  horizontal swing surface (gate with `DeviceFeature.ClimateSwingHorizontal`). */
 	swingHorizontal: boolean().nullable(),
+	/** Lowest setpoint the device accepts, Celsius. Absent / null = not reported. */
+	minTemp: number().nullable().optional(),
+	/** Highest setpoint the device accepts, Celsius. Absent / null = not reported. */
+	maxTemp: number().nullable().optional(),
+	/** Setpoint granularity, Celsius (0.5, 1). Absent / null = not reported. */
+	tempStep: number().positive().nullable().optional(),
 	/** Ms epoch when the slice was last updated (push or command). */
 	lastFetchedAt: number()
 });
@@ -54675,6 +55373,294 @@ onStatusChanged: { data: object({
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
 };
+/**
+* Smart-dishwasher cap — program lifecycle, door / remote-start gates,
+* consumable levels (salt, rinse aid) and common program options.
+*
+* Sources: native Bosch Home Connect (`dishwasher` device type). Reusable
+* by any integration that exposes the same program / option surface.
+*
+* `kind: 'poll'` — cloud REST APIs typically have no push channel; the
+* provider refreshes the slice on an interval and eagerly after commands.
+*
+* UNKNOWN IS NOT OFF. Every field the appliance reports separately is
+* nullable: `null` means "not known right now" (the appliance has not said,
+* the link is down, or the description does not carry it) and is never
+* rendered or exported as `false` / `0`. `availability` says why.
+*/
+var DishwasherStateSchema = _enum([
+	"idle",
+	"running",
+	"paused",
+	"finished",
+	"error",
+	"unavailable"
+]);
+/**
+* The appliance's own operation state, uncollapsed. `state` above is the coarse
+* view for compact surfaces; this is what the appliance said.
+*/
+var DishwasherOperationStateSchema = _enum([
+	"Inactive",
+	"Ready",
+	"DelayedStart",
+	"Run",
+	"Pause",
+	"ActionRequired",
+	"Finished",
+	"Error",
+	"Aborting"
+]);
+/**
+* Why fields may be `null`:
+*  - `available`           — the link is up and the description is loaded;
+*  - `offline`             — the local link is down (values are unknown, not last-known);
+*  - `description-missing` — the link is up but the appliance's description could not
+*                            be loaded, so its values cannot be decoded.
+*/
+var DishwasherAvailabilitySchema = _enum([
+	"available",
+	"offline",
+	"description-missing"
+]);
+var DishwasherConsumableLevelSchema = _enum([
+	"ok",
+	"low",
+	"empty"
+]);
+var DishwasherStatusSchema = object({
+	availability: DishwasherAvailabilitySchema,
+	/** Coarse state for compact surfaces; `unavailable` whenever the appliance state is not known. */
+	state: DishwasherStateSchema,
+	/** The appliance's operation state as reported; null when not known. */
+	operationState: DishwasherOperationStateSchema.nullable(),
+	/** Feature key of the ACTIVE (running) program, or null when none runs / not known. */
+	program: string().nullable(),
+	/** Feature key of the SELECTED program (what Start would run), or null when none / not known. */
+	selectedProgram: string().nullable(),
+	/** Feature keys of the programs the appliance currently offers — drives the UI selector. */
+	availablePrograms: array(string()),
+	/** Seconds remaining on the active cycle, or null when not running / not known. */
+	remainingSeconds: number().int().nonnegative().nullable(),
+	/** Seconds the delayed start is set to (time until the cycle starts), or null. */
+	delayedStartSeconds: number().int().nonnegative().nullable(),
+	/** Cycle completion 0..100, or null when not applicable. */
+	progressPercent: number().min(0).max(100).nullable(),
+	/** True when the door is reported open; null when the door state is not known. */
+	doorOpen: boolean().nullable(),
+	/** True when the door is latched (locked) during a cycle; null when not reported. */
+	doorLocked: boolean().nullable(),
+	/** True when remote start is allowed (door closed, power on, etc.); null when not known. */
+	remoteStartAllowed: boolean().nullable(),
+	/** True when the appliance accepts remote control now; null when not known. */
+	remoteControlActive: boolean().nullable(),
+	/** True while somebody operates the appliance at its panel; null when not reported. */
+	localControlActive: boolean().nullable(),
+	/** Main power / switched-on state; null when not known. */
+	powerOn: boolean().nullable(),
+	/** The raw power state (`On`, `Off`, `Standby`, …); null when not known. */
+	powerState: string().nullable(),
+	saltLevel: DishwasherConsumableLevelSchema.nullable(),
+	rinseAidLevel: DishwasherConsumableLevelSchema.nullable(),
+	/** Option states: null when the appliance does not expose the option or has not said. */
+	halfLoad: boolean().nullable(),
+	hygienePlus: boolean().nullable(),
+	/** Extra dry option when the appliance exposes it. */
+	extraDry: boolean().nullable(),
+	/** Intensive zone (lower basket) when the appliance exposes it. */
+	intensiveZone: boolean().nullable(),
+	/** VarioSpeed / VarioSpeed+ when the appliance exposes it. */
+	varioSpeedPlus: boolean().nullable(),
+	/** Child lock (controls disabled on the appliance); null when not known. */
+	childLock: boolean().nullable(),
+	/** Feature keys of the events currently raised (salt low, rinse aid low, program finished, …). */
+	activeEvents: array(string()),
+	/** Numeric error code when the appliance reports one; null otherwise. */
+	errorCode: number().nullable(),
+	/** Name of the raised alert-level event while the appliance is in error; null otherwise. */
+	errorLabel: string().nullable(),
+	/** Ms epoch of the last value received from the appliance; 0 = never. */
+	lastFetchedAt: number()
+});
+var DeviceIdSchema = number().int().nonnegative();
+/** A value a program option or setting can take. */
+var DishwasherValueSchema = union([
+	boolean(),
+	string(),
+	number()
+]);
+var DishwasherAccessSchema = _enum([
+	"none",
+	"read",
+	"readWrite",
+	"writeOnly",
+	"readStatic"
+]);
+/**
+* One option or setting the appliance declares, with the constraints its description
+* gives. A `readWrite` descriptor that is `available` is what `setOption` accepts.
+*/
+var DishwasherOptionDescriptorSchema = object({
+	/** Feature key (`Dishcare.Dishwasher.Option.ExtraDry`). */
+	key: string(),
+	/** Last segment of the key, for display. */
+	name: string(),
+	type: _enum([
+		"boolean",
+		"number",
+		"enum",
+		"string"
+	]),
+	access: DishwasherAccessSchema,
+	/** The appliance reports this entity as currently available. */
+	available: boolean(),
+	/** Unit the description declares for a number; null when it declares none. */
+	unit: string().nullable(),
+	min: number().nullable(),
+	max: number().nullable(),
+	step: number().nullable(),
+	/** Allowed members of an enum; null for other types. */
+	enumValues: array(string()).nullable(),
+	defaultValue: DishwasherValueSchema.nullable()
+});
+var DishwasherProgramSchema = object({
+	/** Feature key (`Dishcare.Dishwasher.Program.Eco50`) — what `setProgram` / `start` take. */
+	key: string(),
+	name: string(),
+	/** The appliance currently offers this program. */
+	available: boolean(),
+	/** The options this program lists, with the program-level access / availability / default. */
+	options: array(DishwasherOptionDescriptorSchema)
+});
+var DishwasherOptionsSchema = object({
+	availability: DishwasherAvailabilitySchema,
+	/** What the appliance can be told to do, from the commands its description declares. */
+	supportsStart: boolean(),
+	supportsPause: boolean(),
+	supportsResume: boolean(),
+	supportsStop: boolean(),
+	supportsPower: boolean(),
+	/** Every program the description lists, with its options. */
+	programs: array(DishwasherProgramSchema),
+	/** Every option and setting entity the description lists (programs reference these by key). */
+	options: array(DishwasherOptionDescriptorSchema)
+});
+var dishwasherCapability = {
+	name: "dishwasher",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Dishwasher],
+	methods: {
+		/**
+		* Start a program. Without `program` the selected one starts. `options` are
+		* option feature keys; each is checked against the program's constraints.
+		*/
+		start: method(object({
+			deviceId: DeviceIdSchema,
+			program: string().min(1).optional(),
+			options: record(string(), DishwasherValueSchema).optional()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		pause: method(object({ deviceId: DeviceIdSchema }), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		resume: method(object({ deviceId: DeviceIdSchema }), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		stop: method(object({ deviceId: DeviceIdSchema }), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Select (not start) a program; refused when the appliance does not offer it. */
+		setProgram: method(object({
+			deviceId: DeviceIdSchema,
+			program: string().min(1)
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		setPower: method(object({
+			deviceId: DeviceIdSchema,
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		setHalfLoad: method(object({
+			deviceId: DeviceIdSchema,
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		setHygienePlus: method(object({
+			deviceId: DeviceIdSchema,
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		setExtraDry: method(object({
+			deviceId: DeviceIdSchema,
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		setIntensiveZone: method(object({
+			deviceId: DeviceIdSchema,
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		setVarioSpeedPlus: method(object({
+			deviceId: DeviceIdSchema,
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		setChildLock: method(object({
+			deviceId: DeviceIdSchema,
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/**
+		* Write any option or setting by feature key. Refused when the description does
+		* not list it, it is not writable or not available now, or the value is outside
+		* its declared range / members.
+		*/
+		setOption: method(object({
+			deviceId: DeviceIdSchema,
+			key: string().min(1),
+			value: DishwasherValueSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** What this appliance can do, from its own description — the UI is derived from it. */
+		getOptions: method(object({ deviceId: DeviceIdSchema }), DishwasherOptionsSchema, { auth: "protected" })
+	},
+	status: {
+		schema: DishwasherStatusSchema,
+		kind: "poll"
+	},
+	runtimeState: DishwasherStatusSchema,
+	durability: "session",
+	history: { fields: { progressPercent: {
+		kind: "gauge",
+		unit: "%",
+		deadband: 2
+	} } }
+};
 var DoorbellStatusSchema = object({
 	/** Ms epoch of the last press. null = never observed since this provider started. */
 	lastPressedAt: number().nullable(),
@@ -55477,6 +56463,32 @@ var gasCapability = {
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
 };
+var HeatingValveStatusSchema = object({
+	/** Radiator valve opening 0 (closed) .. 100 (open). Null = not yet known. */
+	position: number().min(0).max(100).nullable(),
+	/** Ms epoch when the slice was last updated (push or poll). */
+	lastFetchedAt: number()
+});
+var heatingValveCapability = {
+	name: "heating-valve",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Thermostat],
+	methods: {},
+	status: {
+		schema: HeatingValveStatusSchema,
+		kind: "push"
+	},
+	runtimeState: HeatingValveStatusSchema,
+	durability: "session",
+	history: { fields: { position: {
+		kind: "gauge",
+		unit: "%",
+		deadband: 1
+	} } },
+	volatileStateFields: ["lastFetchedAt"]
+};
 /**
 * Humidifier / dehumidifier cap. Models HA `humidifier.*` entities —
 * an on/off actuator with an optional target-humidity setpoint and an
@@ -56609,7 +57621,19 @@ var TlsStatusSchema = object({
 	sans: array(string()),
 	caCertPem: string().nullable(),
 	reissueError: string().nullable(),
-	restartRequired: boolean()
+	restartRequired: boolean(),
+	/** An uploaded certificate is served but no CA is kept for it and it is not publicly signed (D873). */
+	caMissing: boolean(),
+	/** Does the hub's own generated CA carry a critical name constraint? `null` while it has none. */
+	localCaConstrained: boolean().nullable(),
+	/** ISO time the generated CA was replaced by a constrained one; devices must re-download it. */
+	caReplacedAt: string().nullable(),
+	/** The uploaded certificate kept on disk, selectable again after "Revert to generated". */
+	storedUpload: object({
+		leafFingerprintSha256: string(),
+		validTo: string(),
+		hasCa: boolean()
+	}).nullable()
 });
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
@@ -56665,6 +57689,9 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 }), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(_void(), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
 });
 var LockControlStatusSchema = object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
@@ -63158,7 +64185,11 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
-}), method(object({ userId: string() }), TotpStatusSchema, { auth: "admin" }), method(object({
+}), method(object({ userId: string() }), TotpStatusSchema, { auth: "admin" }), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
+}), method(object({
 	userId: string(),
 	code: string()
 }), object({ valid: boolean() }), {
@@ -64878,6 +65909,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	dayNight: dayNightCapability,
 	deviceDiscovery: deviceDiscoveryCapability,
 	deviceStatus: deviceStatusCapability,
+	dishwasher: dishwasherCapability,
 	doorbell: doorbellCapability,
 	enumSensor: enumSensorCapability,
 	eventEmitter: eventEmitterCapability,
@@ -64885,6 +65917,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	featureProbe: featureProbeCapability,
 	flood: floodCapability,
 	gas: gasCapability,
+	heatingValve: heatingValveCapability,
 	humidifier: humidifierCapability,
 	humiditySensor: humiditySensorCapability,
 	image: imageCapability,
@@ -64970,13 +66003,14 @@ var BaseDevice = class {
 	get state() {
 		if (!this._stateProxyCache) {
 			const cache = {};
-			const handler = { get: (_target, key) => {
+			const handler = { get: (target, key) => {
 				const k = key;
-				if (k in cache) return cache[k];
+				const existing = Reflect.get(target, k);
+				if (existing !== void 0) return existing;
 				const cap = DEVICE_LOCAL_STATE_CAPS[k];
 				if (!cap) return void 0;
 				const proxy = this.sliceProxy(cap);
-				cache[k] = proxy;
+				Reflect.set(target, k, proxy);
 				return proxy;
 			} };
 			this._stateProxyCache = new Proxy(cache, handler);
@@ -65175,7 +66209,7 @@ var BaseDevice = class {
 	async updateSourceInfo(patch) {
 		const next = mergeSourceInfo(this.sourceInfo, patch);
 		this._sourceInfoCache = Object.freeze({ ...next });
-		const action = this.ctx.api?.deviceManager?.setMetadata;
+		const action = this.ctx.api.deviceManager?.setMetadata;
 		if (action) try {
 			await action.mutate({
 				deviceId: this.id,
@@ -65210,7 +66244,7 @@ var BaseDevice = class {
 	* device boot on a meta refresh.
 	*/
 	async refreshFeatures() {
-		const action = this.ctx.api?.deviceManager?.registerDevice;
+		const action = this.ctx.api.deviceManager?.registerDevice;
 		if (!action) return;
 		try {
 			await action.mutate({
@@ -65609,6 +66643,12 @@ var BaseDeviceProvider = class extends BaseAddon {
 			provider: this
 		}];
 	}
+	/** Flatten `super.onInitialize()` whether it returned an array or an envelope. */
+	providerRegistrationsFromSuper(result) {
+		if (Array.isArray(result)) return result;
+		if (result !== void 0 && result.providers !== void 0) return [...result.providers];
+		return [];
+	}
 	async onShutdown() {
 		this._restoreShuttingDown = true;
 		this.cancelRestoreRetries();
@@ -66135,7 +67175,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 		return toDeviceSummary(device, this.addonId);
 	}
 };
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher;
 new Set(Object.values(DeviceType));
 Object.freeze({
 	"accessories.getStatus": {
@@ -67284,6 +68324,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.migrateRawSecrets": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -68550,6 +69596,96 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dishwasher.getOptions": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"dishwasher.getStatus": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"dishwasher.pause": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"dishwasher.resume": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"dishwasher.setChildLock": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"dishwasher.setExtraDry": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"dishwasher.setHalfLoad": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"dishwasher.setHygienePlus": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"dishwasher.setIntensiveZone": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"dishwasher.setOption": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"dishwasher.setPower": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"dishwasher.setProgram": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"dishwasher.setVarioSpeedPlus": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"dishwasher.start": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"dishwasher.stop": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"doorbell.getStatus": {
 		capName: "doorbell",
 		capScope: "device",
@@ -68760,6 +69896,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"heatingValve.getStatus": {
+		capName: "heating-valve",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"humidifier.getStatus": {
 		capName: "humidifier",
 		capScope: "device",
@@ -68970,6 +70112,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychainAdmin.importSecret": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.listAudit": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -69138,6 +70286,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"llm.migrateRawSecrets": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -69366,6 +70520,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.useStoredUploadedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.getStatus": {
 		capName: "lock-control",
 		capScope: "device",
@@ -72018,6 +73178,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recordEntries.deleteEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"recordEntries.listEntries": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.listEntryKinds": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordEntries.putEntry": {
+		capName: "record-entries",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.getAvailability": {
 		capName: "recording",
 		capScope: "device",
@@ -72318,6 +73502,102 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"records.aggregate": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.allocateId": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.count": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.declareKinds": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.delete": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteDevice": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.deleteWhere": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"records.get": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.getMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.histogram": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.patch": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.put": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.putMany": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"records.query": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"records.secretRefs": {
+		capName: "records",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.captureReference": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -72750,6 +74030,48 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"storageAdmin.adoptRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"storageAdmin.dropCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"storageAdmin.isAdoptedLegacyTable": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.listKinds": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.listTables": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.readLegacyCollection": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"storageAdmin.readRecords": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -72798,6 +74120,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"storageMigration.moverClearance": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageMigration.movers": {
 		capName: "storage-migration",
 		capScope: "system",
@@ -73662,6 +74990,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.migrateRawSecrets": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.oauthExchangeCode": {
 		capName: "user-management",
 		capScope: "system",
@@ -74161,7 +75495,7 @@ Object.freeze({
 		access: "create"
 	}
 });
-DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher;
 DeviceFeature.BatteryOperated;
 Object.freeze({
 	"accessories.getStatus": [{
@@ -74985,6 +76319,81 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"dishwasher.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.pause": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.resume": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.setChildLock": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.setExtraDry": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.setHalfLoad": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.setHygienePlus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.setIntensiveZone": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.setOption": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.setPower": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.setProgram": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.setVarioSpeedPlus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.start": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dishwasher.stop": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"doorbell.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -75054,6 +76463,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"heatingValve.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"humidifier.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -76338,6 +77752,37 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"records.count": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.deleteDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"records.deleteWhere": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.histogram": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"records.putMany": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"records.query": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"sceneMonitor.captureReference": [{
 		name: "deviceId",
 		form: "single",
@@ -76454,6 +77899,17 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"storageAdmin.adoptRecords": [{
+		name: "records",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"storageAdmin.readRecords": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"streamBroker.acquireEgressTranscode": [{
 		name: "deviceId",
 		form: "single",
@@ -76969,6 +78425,9 @@ new Map(Object.entries({
 	"wrapper-update-available": "system",
 	"backup-completed": "system",
 	"export-completed": "system",
+	"alert-critical": "system",
+	"alert-error": "system",
+	"alert-critical-resolved": "system",
 	"storage-location-low": "system",
 	"storage-location-critical": "system",
 	"storage-location-ok": "system",
@@ -77093,6 +78552,16 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 			"storage-location-ok"
 		]
 	},
+	{
+		id: "alerts",
+		family: "system",
+		label: "Alerts",
+		kinds: [
+			"alert-critical",
+			"alert-error",
+			"alert-critical-resolved"
+		]
+	},
 	{
 		id: "alarm",
 		family: "alarm",
@@ -77137,6 +78606,21 @@ var NC_SENSOR_RAISED_FIELD_BY_KIND = Object.freeze(Object.fromEntries(Object.ent
 	return [[descriptor.kind, field]];
 })));
 Object.freeze(Object.keys(NC_SENSOR_RAISED_FIELD_BY_KIND));
+object({
+	phase: _enum(["raised", "resolved"]),
+	episodeId: string().min(1),
+	alertId: string().min(1),
+	severity: AlertSeveritySchema,
+	category: string(),
+	title: string(),
+	message: string(),
+	sourceType: string().optional(),
+	sourceId: string().optional(),
+	nodeId: string().optional(),
+	/** The alert's own action link (where the operator acts on it), when it has one. */
+	actionUrl: string().optional(),
+	at: number()
+});
 var RULE_BODY_ONLY = ["body"];
 var RULE_TEXT = ["title", "body"];
 var BATTERY = ["device-battery-low", "device-battery-normal"];
@@ -77146,6 +78630,11 @@ var TANK = [
 	"device-tank-full",
 	"device-tank-normal"
 ];
+var ALERT_EPISODE = [
+	"alert-critical",
+	"alert-error",
+	"alert-critical-resolved"
+];
 var UPDATES = [
 	"addon-update-available",
 	"server-update-available",
@@ -77338,14 +78827,14 @@ var STATE_SUMMARY_VARS = [
 	([...RULE_TEXT], [...CONSUMABLE]),
 	([...RULE_TEXT], [...TANK]),
 	[...RULE_TEXT],
-	([...RULE_TEXT], [...UPDATES]),
-	([...RULE_TEXT], [...UPDATES]),
-	[...RULE_TEXT],
+	([...RULE_TEXT], [...UPDATES, ...ALERT_EPISODE]),
+	([...RULE_TEXT], [...UPDATES, ...ALERT_EPISODE]),
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	([...RULE_TEXT], [...ALERT_EPISODE]),
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
@@ -77363,7 +78852,11 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
-	[...RULE_TEXT],
+	([...RULE_TEXT], [...ALERT_EPISODE]),
+	([...RULE_TEXT], [...ALERT_EPISODE]),
+	([...RULE_TEXT], [...ALERT_EPISODE]),
+	([...RULE_TEXT], [...ALERT_EPISODE]),
+	([...RULE_TEXT], [...ALERT_EPISODE]),
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],