@camstack/system 1.2.172 → 1.2.174

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_system_deps = require("./manifest-system-deps-ir_XTNpe.js");
+const require_manifest_system_deps = require("./manifest-system-deps-B0mzJPmb.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { $t as emitHeapDiagnosticReport, A as createUdsLoggerWithControl, Ft as RUNNER_RSS_BUDGET_ENV, Jt as startRunnerHeapWatch, a as createUdsAddonContext, bt as resolveAddonClass, it as setWorkerNativeCapsChangeListener, j as LocalChildClient, n as installManifestPythonDeps, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestSystemDeps, tt as getWorkerNativeCapProvider, yt as installManifestNativeDeps } from "./manifest-system-deps-Da6sme9C.mjs";
+import { $t as emitHeapDiagnosticReport, A as createUdsLoggerWithControl, Ft as RUNNER_RSS_BUDGET_ENV, Jt as startRunnerHeapWatch, a as createUdsAddonContext, bt as resolveAddonClass, it as setWorkerNativeCapsChangeListener, j as LocalChildClient, n as installManifestPythonDeps, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestSystemDeps, tt as getWorkerNativeCapProvider, yt as installManifestNativeDeps } from "./manifest-system-deps-Pw8iaY5X.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DsoVfJSR.js");
+const require_dist = require("../../dist-BzPNEPHo.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as errMsg, Nt as BaseAddon, T as addonPagesCapability, an as EventCategory } from "../../dist-1DEQFmTq.mjs";
+import { E as addonPagesCapability, Nt as errMsg, Pt as BaseAddon, on as EventCategory } from "../../dist-B25PDvaS.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DsoVfJSR.js");
+const require_dist = require("../../dist-BzPNEPHo.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { D as addonWidgetsCapability, Mt as errMsg, Nt as BaseAddon, an as EventCategory } from "../../dist-1DEQFmTq.mjs";
+import { Nt as errMsg, O as addonWidgetsCapability, Pt as BaseAddon, on as EventCategory } from "../../dist-B25PDvaS.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DsoVfJSR.js");
+const require_dist = require("../../dist-BzPNEPHo.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Kt as createEvent, Mt as errMsg, Nt as BaseAddon, O as alertsCapability, an as EventCategory, n as AlertSchema } from "../../dist-1DEQFmTq.mjs";
+import { Nt as errMsg, Pt as BaseAddon, k as alertsCapability, n as AlertSchema, on as EventCategory, qt as createEvent } from "../../dist-B25PDvaS.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DsoVfJSR.js");
+const require_dist = require("../../dist-BzPNEPHo.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { A as backupCapability, Nt as BaseAddon, an as EventCategory } from "../../dist-1DEQFmTq.mjs";
+import { Pt as BaseAddon, j as backupCapability, on as EventCategory } from "../../dist-B25PDvaS.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DsoVfJSR.js");
+const require_dist = require("../../dist-BzPNEPHo.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Nt as BaseAddon, st as logDestinationCapability } from "../../dist-1DEQFmTq.mjs";
+import { Pt as BaseAddon, ct as logDestinationCapability } from "../../dist-B25PDvaS.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DsoVfJSR.js");
+const require_dist = require("../../dist-BzPNEPHo.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { F as coreBlockAddonId, I as coreBlockIdFromAddonId, L as coreBlocksCapability, Mt as errMsg, Nt as BaseAddon, c as CoreBlockSchema, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, u as DeclaredDevices } from "../../dist-1DEQFmTq.mjs";
+import { I as coreBlockAddonId, L as coreBlockIdFromAddonId, Nt as errMsg, Pt as BaseAddon, R as coreBlocksCapability, c as CORE_BLOCK_ADDON_PREFIX, d as DeclaredDevices, l as CoreBlockSchema, s as CORE_BLOCKS_ADDON_ID } from "../../dist-B25PDvaS.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DsoVfJSR.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-DTE5k4lU.js");
+const require_dist = require("../../dist-BzPNEPHo.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-DZmeJ8ja.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -3271,6 +3271,75 @@ var DeviceEventPropagator = class {
 	}
 };
 //#endregion
+//#region src/builtins/device-manager/migrate-device.ts
+/** A refusal that names a switch the camera does not offer, rather than one it
+*  could not be asked about. The cap documents rejecting the former; anything
+*  else is treated as the camera being out of reach, which is the safe reading:
+*  it keeps the switch in `sourceStillLive` instead of quietly clearing it. */
+function classify(err) {
+	const detail = err instanceof Error ? err.message : String(err);
+	return {
+		outcome: /does not offer|not available|unsupported/i.test(detail) ? "not-offered" : "unreachable",
+		detail
+	};
+}
+async function applyAll(deps, deviceId, enabled) {
+	const out = [];
+	for (const switchId of require_dist.CAMERA_SWITCH_ORDER) try {
+		await deps.setSwitch(deviceId, switchId, enabled);
+		out.push({
+			deviceId,
+			switchId,
+			outcome: enabled ? "on" : "off"
+		});
+	} catch (err) {
+		const { outcome, detail } = classify(err);
+		out.push({
+			deviceId,
+			switchId,
+			outcome,
+			detail
+		});
+		deps.log("camera switch refused", {
+			deviceId,
+			switchId,
+			enabled,
+			outcome,
+			detail
+		});
+	}
+	return out;
+}
+/**
+* Put both cameras to sleep, exchange their identities, wake the target.
+*
+* Throws only if the swap itself fails — a switch that could not be written is
+* reported, not raised, because refusing to migrate a camera whose old hardware
+* is unreachable would refuse the exact case this exists for.
+*/
+async function migrateDevice$1(deps, input) {
+	const { sourceId, targetId } = input;
+	if (sourceId === targetId) throw new Error(`[device-manager] migrateDevice: ${sourceId} is both source and target`);
+	const down = [...await applyAll(deps, sourceId, false), ...await applyAll(deps, targetId, false)];
+	const sourceStillLive = down.filter((r) => r.deviceId === sourceId && r.outcome === "unreachable").map((r) => r.switchId);
+	await deps.swapIds(sourceId, targetId);
+	const up = await applyAll(deps, sourceId, true);
+	await deps.respawnRunners([sourceId, targetId]);
+	deps.log("camera migrated", {
+		sourceId,
+		targetId,
+		sourceStillLive,
+		refusals: [...down, ...up].filter((r) => r.outcome === "unreachable").length
+	});
+	return {
+		sourceId,
+		targetId,
+		switches: [...down, ...up],
+		sourceStillLive,
+		swapped: true
+	};
+}
+//#endregion
 //#region src/builtins/device-manager/device-meta-actions.ts
 /**
 * Device meta-mutation + persistence actions for the device-manager addon —
@@ -3344,6 +3413,54 @@ async function allocateDeviceId(pctx, input) {
 		return { id };
 	});
 }
+/**
+* Replace a camera: the new hardware inherits the number the system knows.
+*
+* The composition lives in `migrate-device.ts`, deliberately free of this
+* file's context so the decisions it carries — above all "never report a switch
+* as off when it could not be written" — are testable without a hub. This is
+* the wiring: the four real dependencies, and the write lock.
+*
+* The temp id comes from `allocateNextDeviceId`, the monotonic counter, so the
+* value a crash could park a row on was never used and will never be reused.
+* `swapIds` therefore runs INSIDE the same lock the id was allocated under.
+*/
+async function migrateDevice(pctx, input) {
+	const { sourceId, targetId } = input;
+	const ctx = pctx.host.ctx;
+	return await pctx.metaStore.withMetaWriteLock(async () => {
+		const tempId = await pctx.metaStore.allocateNextDeviceId();
+		return await migrateDevice$1({
+			setSwitch: async (deviceId, switchId, enabled) => {
+				await ctx.api.pipelineOrchestrator.setCameraSwitch.mutate({
+					deviceId,
+					switchId,
+					enabled
+				});
+			},
+			swapIds: async (a, b) => {
+				await pctx.metaStore.rows.swapIds(a, b, tempId);
+			},
+			respawnRunners: async (deviceIds) => {
+				const owners = /* @__PURE__ */ new Set();
+				for (const deviceId of deviceIds) {
+					const addonId = pctx.metaStore.idToAddonId.get(deviceId);
+					if (addonId !== void 0) owners.add(addonId);
+				}
+				for (const addonId of owners) await ctx.api.addons.restartAddon.mutate({ addonId });
+			},
+			log: (message, meta) => {
+				ctx.logger.info(message, {
+					tags: { deviceId: sourceId },
+					meta
+				});
+			}
+		}, {
+			sourceId,
+			targetId
+		});
+	});
+}
 async function registerDevice(pctx, input) {
 	const { addonId, stableId, id, type, name, parentDeviceId, features, config } = input;
 	const featuresArr = Array.isArray(features) ? [...features] : [];
@@ -5151,6 +5268,86 @@ var DeviceRowStore = class {
 		});
 	}
 	/** Drop the device's row. Idempotent. */
+	/**
+	* Exchange the ids of two devices, carrying their children with them.
+	*
+	* ## Why this exists as a primitive
+	*
+	* Replacing a camera means the new hardware has to become the device the rest
+	* of the system already knows. Everything general about a camera is keyed on
+	* the NUMERIC id and on nothing else — the recording path on disk is
+	* `<deviceId>/profile/…`, the hour ledger, the media store and zone ownership
+	* carry `deviceId` and not one `stableId` between them, and all four
+	* ecosystem exports (Home Assistant, Alexa, HomeKit, Google) key on it too.
+	* Moving that work is the expensive, lossy operation. Moving the NUMBER is
+	* two rows.
+	*
+	* ## Children are re-pointed, not renumbered
+	*
+	* A child keeps its own id and follows its parent: every row whose
+	* `parentDeviceId` was `a` now names `b`, and the reverse. Renumbering the
+	* children as well would move THEIR general work for no reason — the
+	* accessory's own recordings and rules are keyed on the child id, which is
+	* not the id being inherited.
+	*
+	* ## There are no transactions here, so the ORDER is the safety
+	*
+	* The backing store is a collection API (`set` / `delete` / `updateWhere`);
+	* there is no rollback to lean on. So the sequence is chosen to make every
+	* crash point LOUD rather than plausible: `a` first moves to a freshly
+	* allocated id, which the monotonic counter guarantees was never used and
+	* will never be reused. A crash before the end therefore leaves a device
+	* missing from its number and a stray at an unfamiliar one — visible in the
+	* device list at a glance. What it can never leave is two rows on one number,
+	* or a row that looks correct while its children point elsewhere.
+	*
+	* The caller holds {@link DeviceMetaStore.withMetaWriteLock}. This method does
+	* not take it: taking it here would deadlock the migration that has to disable
+	* functions on both devices in the same critical section.
+	*/
+	async swapIds(a, b, tempId) {
+		if (a === b) throw new Error(`[device-manager] swapIds: ${a} and ${b} are the same device`);
+		await this.declare();
+		const rowA = await this.get(a);
+		const rowB = await this.get(b);
+		if (rowA === null) throw new Error(`[device-manager] swapIds: device ${a} does not exist`);
+		if (rowB === null) throw new Error(`[device-manager] swapIds: device ${b} does not exist`);
+		if (await this.get(tempId) !== null) throw new Error(`[device-manager] swapIds: temp id ${tempId} is taken`);
+		const childrenOfA = (await this.listByParent(a)).map((r) => r.meta.id);
+		const childrenOfB = (await this.listByParent(b)).map((r) => r.meta.id);
+		await this.moveRow(rowA, tempId);
+		await this.moveRow(rowB, a);
+		await this.moveRow({
+			...rowA,
+			meta: {
+				...rowA.meta,
+				id: tempId
+			}
+		}, b);
+		for (const childId of childrenOfA) await this.patch(childId, { parentDeviceId: b });
+		for (const childId of childrenOfB) await this.patch(childId, { parentDeviceId: a });
+		this.logger.info("device ids swapped", {
+			tags: { deviceId: a },
+			meta: {
+				a,
+				b,
+				childrenOfA,
+				childrenOfB
+			}
+		});
+	}
+	/** Rewrite a row under a new id and drop the old key. Not exported: the only
+	*  legitimate reason to move a row is {@link swapIds}. */
+	async moveRow(row, toId) {
+		await this.upsert({
+			...row.meta,
+			id: toId
+		}, {
+			registered: row.registered,
+			metadata: row.metadata
+		});
+		await this.remove(row.meta.id);
+	}
 	async remove(deviceId) {
 		await this.declare();
 		await this.backend.delete({
@@ -5871,6 +6068,7 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 			resolveDeviceOwnerSync: (deviceId) => resolveDeviceOwnerSync(pctx, deviceId),
 			resolveNativeCapOwnerSync: (capName, deviceId) => resolveNativeCapOwnerSync(pctx, capName, deviceId),
 			allocateDeviceId: (input) => allocateDeviceId(pctx, input),
+			migrateDevice: (input) => migrateDevice(pctx, input),
 			registerDevice: (input) => registerDevice(pctx, input),
 			removeDevice: (input) => removeDevice(pctx, input),
 			persistConfig: (input) => persistConfig(pctx, input),

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { H as deviceStateCapability, Ht as WELL_KNOWN_TAB_MAP, K as enumerateItemArrayFields, Lt as DeviceFeature, Mt as errMsg, N as buildStreamParamsConfigSchema, Nt as BaseAddon, Rt as DeviceRole, U as deviceStatusCapability, V as deviceManagerCapability, Zt as isDeviceConfigCap, a as CAP_NAMES_WITH_STATUS, an as EventCategory, d as DeviceStatusSchema, dt as normalizeUnit, in as sleep, pt as parseStreamParamsFormPatch, q as enumerateSchemaFields, t as ALL_CAPABILITY_DEFINITIONS, y as STREAM_PROFILE_META, yt as runtimeStatePolicyFor, zt as DeviceType } from "../../dist-1DEQFmTq.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-ChS1Q2Kv.mjs";
+import { Bt as DeviceType, H as deviceManagerCapability, J as enumerateSchemaFields, Nt as errMsg, P as buildStreamParamsConfigSchema, Pt as BaseAddon, Qt as isDeviceConfigCap, Rt as DeviceFeature, U as deviceStateCapability, Ut as WELL_KNOWN_TAB_MAP, W as deviceStatusCapability, a as CAMERA_SWITCH_ORDER, an as sleep, b as STREAM_PROFILE_META, bt as runtimeStatePolicyFor, f as DeviceStatusSchema, ft as normalizeUnit, mt as parseStreamParamsFormPatch, o as CAP_NAMES_WITH_STATUS, on as EventCategory, q as enumerateItemArrayFields, t as ALL_CAPABILITY_DEFINITIONS, zt as DeviceRole } from "../../dist-B25PDvaS.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-tWdiQpwa.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -3266,6 +3266,75 @@ var DeviceEventPropagator = class {
 	}
 };
 //#endregion
+//#region src/builtins/device-manager/migrate-device.ts
+/** A refusal that names a switch the camera does not offer, rather than one it
+*  could not be asked about. The cap documents rejecting the former; anything
+*  else is treated as the camera being out of reach, which is the safe reading:
+*  it keeps the switch in `sourceStillLive` instead of quietly clearing it. */
+function classify(err) {
+	const detail = err instanceof Error ? err.message : String(err);
+	return {
+		outcome: /does not offer|not available|unsupported/i.test(detail) ? "not-offered" : "unreachable",
+		detail
+	};
+}
+async function applyAll(deps, deviceId, enabled) {
+	const out = [];
+	for (const switchId of CAMERA_SWITCH_ORDER) try {
+		await deps.setSwitch(deviceId, switchId, enabled);
+		out.push({
+			deviceId,
+			switchId,
+			outcome: enabled ? "on" : "off"
+		});
+	} catch (err) {
+		const { outcome, detail } = classify(err);
+		out.push({
+			deviceId,
+			switchId,
+			outcome,
+			detail
+		});
+		deps.log("camera switch refused", {
+			deviceId,
+			switchId,
+			enabled,
+			outcome,
+			detail
+		});
+	}
+	return out;
+}
+/**
+* Put both cameras to sleep, exchange their identities, wake the target.
+*
+* Throws only if the swap itself fails — a switch that could not be written is
+* reported, not raised, because refusing to migrate a camera whose old hardware
+* is unreachable would refuse the exact case this exists for.
+*/
+async function migrateDevice$1(deps, input) {
+	const { sourceId, targetId } = input;
+	if (sourceId === targetId) throw new Error(`[device-manager] migrateDevice: ${sourceId} is both source and target`);
+	const down = [...await applyAll(deps, sourceId, false), ...await applyAll(deps, targetId, false)];
+	const sourceStillLive = down.filter((r) => r.deviceId === sourceId && r.outcome === "unreachable").map((r) => r.switchId);
+	await deps.swapIds(sourceId, targetId);
+	const up = await applyAll(deps, sourceId, true);
+	await deps.respawnRunners([sourceId, targetId]);
+	deps.log("camera migrated", {
+		sourceId,
+		targetId,
+		sourceStillLive,
+		refusals: [...down, ...up].filter((r) => r.outcome === "unreachable").length
+	});
+	return {
+		sourceId,
+		targetId,
+		switches: [...down, ...up],
+		sourceStillLive,
+		swapped: true
+	};
+}
+//#endregion
 //#region src/builtins/device-manager/device-meta-actions.ts
 /**
 * Device meta-mutation + persistence actions for the device-manager addon —
@@ -3339,6 +3408,54 @@ async function allocateDeviceId(pctx, input) {
 		return { id };
 	});
 }
+/**
+* Replace a camera: the new hardware inherits the number the system knows.
+*
+* The composition lives in `migrate-device.ts`, deliberately free of this
+* file's context so the decisions it carries — above all "never report a switch
+* as off when it could not be written" — are testable without a hub. This is
+* the wiring: the four real dependencies, and the write lock.
+*
+* The temp id comes from `allocateNextDeviceId`, the monotonic counter, so the
+* value a crash could park a row on was never used and will never be reused.
+* `swapIds` therefore runs INSIDE the same lock the id was allocated under.
+*/
+async function migrateDevice(pctx, input) {
+	const { sourceId, targetId } = input;
+	const ctx = pctx.host.ctx;
+	return await pctx.metaStore.withMetaWriteLock(async () => {
+		const tempId = await pctx.metaStore.allocateNextDeviceId();
+		return await migrateDevice$1({
+			setSwitch: async (deviceId, switchId, enabled) => {
+				await ctx.api.pipelineOrchestrator.setCameraSwitch.mutate({
+					deviceId,
+					switchId,
+					enabled
+				});
+			},
+			swapIds: async (a, b) => {
+				await pctx.metaStore.rows.swapIds(a, b, tempId);
+			},
+			respawnRunners: async (deviceIds) => {
+				const owners = /* @__PURE__ */ new Set();
+				for (const deviceId of deviceIds) {
+					const addonId = pctx.metaStore.idToAddonId.get(deviceId);
+					if (addonId !== void 0) owners.add(addonId);
+				}
+				for (const addonId of owners) await ctx.api.addons.restartAddon.mutate({ addonId });
+			},
+			log: (message, meta) => {
+				ctx.logger.info(message, {
+					tags: { deviceId: sourceId },
+					meta
+				});
+			}
+		}, {
+			sourceId,
+			targetId
+		});
+	});
+}
 async function registerDevice(pctx, input) {
 	const { addonId, stableId, id, type, name, parentDeviceId, features, config } = input;
 	const featuresArr = Array.isArray(features) ? [...features] : [];
@@ -5146,6 +5263,86 @@ var DeviceRowStore = class {
 		});
 	}
 	/** Drop the device's row. Idempotent. */
+	/**
+	* Exchange the ids of two devices, carrying their children with them.
+	*
+	* ## Why this exists as a primitive
+	*
+	* Replacing a camera means the new hardware has to become the device the rest
+	* of the system already knows. Everything general about a camera is keyed on
+	* the NUMERIC id and on nothing else — the recording path on disk is
+	* `<deviceId>/profile/…`, the hour ledger, the media store and zone ownership
+	* carry `deviceId` and not one `stableId` between them, and all four
+	* ecosystem exports (Home Assistant, Alexa, HomeKit, Google) key on it too.
+	* Moving that work is the expensive, lossy operation. Moving the NUMBER is
+	* two rows.
+	*
+	* ## Children are re-pointed, not renumbered
+	*
+	* A child keeps its own id and follows its parent: every row whose
+	* `parentDeviceId` was `a` now names `b`, and the reverse. Renumbering the
+	* children as well would move THEIR general work for no reason — the
+	* accessory's own recordings and rules are keyed on the child id, which is
+	* not the id being inherited.
+	*
+	* ## There are no transactions here, so the ORDER is the safety
+	*
+	* The backing store is a collection API (`set` / `delete` / `updateWhere`);
+	* there is no rollback to lean on. So the sequence is chosen to make every
+	* crash point LOUD rather than plausible: `a` first moves to a freshly
+	* allocated id, which the monotonic counter guarantees was never used and
+	* will never be reused. A crash before the end therefore leaves a device
+	* missing from its number and a stray at an unfamiliar one — visible in the
+	* device list at a glance. What it can never leave is two rows on one number,
+	* or a row that looks correct while its children point elsewhere.
+	*
+	* The caller holds {@link DeviceMetaStore.withMetaWriteLock}. This method does
+	* not take it: taking it here would deadlock the migration that has to disable
+	* functions on both devices in the same critical section.
+	*/
+	async swapIds(a, b, tempId) {
+		if (a === b) throw new Error(`[device-manager] swapIds: ${a} and ${b} are the same device`);
+		await this.declare();
+		const rowA = await this.get(a);
+		const rowB = await this.get(b);
+		if (rowA === null) throw new Error(`[device-manager] swapIds: device ${a} does not exist`);
+		if (rowB === null) throw new Error(`[device-manager] swapIds: device ${b} does not exist`);
+		if (await this.get(tempId) !== null) throw new Error(`[device-manager] swapIds: temp id ${tempId} is taken`);
+		const childrenOfA = (await this.listByParent(a)).map((r) => r.meta.id);
+		const childrenOfB = (await this.listByParent(b)).map((r) => r.meta.id);
+		await this.moveRow(rowA, tempId);
+		await this.moveRow(rowB, a);
+		await this.moveRow({
+			...rowA,
+			meta: {
+				...rowA.meta,
+				id: tempId
+			}
+		}, b);
+		for (const childId of childrenOfA) await this.patch(childId, { parentDeviceId: b });
+		for (const childId of childrenOfB) await this.patch(childId, { parentDeviceId: a });
+		this.logger.info("device ids swapped", {
+			tags: { deviceId: a },
+			meta: {
+				a,
+				b,
+				childrenOfA,
+				childrenOfB
+			}
+		});
+	}
+	/** Rewrite a row under a new id and drop the old key. Not exported: the only
+	*  legitimate reason to move a row is {@link swapIds}. */
+	async moveRow(row, toId) {
+		await this.upsert({
+			...row.meta,
+			id: toId
+		}, {
+			registered: row.registered,
+			metadata: row.metadata
+		});
+		await this.remove(row.meta.id);
+	}
 	async remove(deviceId) {
 		await this.declare();
 		await this.backend.delete({
@@ -5866,6 +6063,7 @@ var DeviceManagerAddon = class extends BaseAddon {
 			resolveDeviceOwnerSync: (deviceId) => resolveDeviceOwnerSync(pctx, deviceId),
 			resolveNativeCapOwnerSync: (capName, deviceId) => resolveNativeCapOwnerSync(pctx, capName, deviceId),
 			allocateDeviceId: (input) => allocateDeviceId(pctx, input),
+			migrateDevice: (input) => migrateDevice(pctx, input),
 			registerDevice: (input) => registerDevice(pctx, input),
 			removeDevice: (input) => removeDevice(pctx, input),
 			persistConfig: (input) => persistConfig(pctx, input),

package/dist/builtins/device-manager/device-meta-actions.d.ts

@@ -13,6 +13,19 @@ type IDeviceManagerProvider = InferProvider<typeof deviceManagerCapability>;
  */
 export declare function stampIntegrationId(metaStore: DeviceMetaStore, ctx: AddonContext, deviceId: number, integrationId: string): Promise<void>;
 export declare function allocateDeviceId(pctx: ProviderContext, input: Parameters<IDeviceManagerProvider['allocateDeviceId']>[0]): ReturnType<IDeviceManagerProvider['allocateDeviceId']>;
+/**
+ * Replace a camera: the new hardware inherits the number the system knows.
+ *
+ * The composition lives in `migrate-device.ts`, deliberately free of this
+ * file's context so the decisions it carries — above all "never report a switch
+ * as off when it could not be written" — are testable without a hub. This is
+ * the wiring: the four real dependencies, and the write lock.
+ *
+ * The temp id comes from `allocateNextDeviceId`, the monotonic counter, so the
+ * value a crash could park a row on was never used and will never be reused.
+ * `swapIds` therefore runs INSIDE the same lock the id was allocated under.
+ */
+export declare function migrateDevice(pctx: ProviderContext, input: Parameters<IDeviceManagerProvider['migrateDevice']>[0]): ReturnType<IDeviceManagerProvider['migrateDevice']>;
 export declare function registerDevice(pctx: ProviderContext, input: Parameters<IDeviceManagerProvider['registerDevice']>[0]): ReturnType<IDeviceManagerProvider['registerDevice']>;
 export declare function removeDevice(pctx: ProviderContext, input: Parameters<IDeviceManagerProvider['removeDevice']>[0]): ReturnType<IDeviceManagerProvider['removeDevice']>;
 export declare function persistConfig(pctx: ProviderContext, input: Parameters<IDeviceManagerProvider['persistConfig']>[0]): ReturnType<IDeviceManagerProvider['persistConfig']>;

package/dist/builtins/device-manager/device-row-store.d.ts

@@ -340,6 +340,47 @@ export declare class DeviceRowStore {
      */
     upsertRegistration(row: DeviceRegistrationRow): Promise<void>;
     /** Drop the device's row. Idempotent. */
+    /**
+     * Exchange the ids of two devices, carrying their children with them.
+     *
+     * ## Why this exists as a primitive
+     *
+     * Replacing a camera means the new hardware has to become the device the rest
+     * of the system already knows. Everything general about a camera is keyed on
+     * the NUMERIC id and on nothing else — the recording path on disk is
+     * `<deviceId>/profile/…`, the hour ledger, the media store and zone ownership
+     * carry `deviceId` and not one `stableId` between them, and all four
+     * ecosystem exports (Home Assistant, Alexa, HomeKit, Google) key on it too.
+     * Moving that work is the expensive, lossy operation. Moving the NUMBER is
+     * two rows.
+     *
+     * ## Children are re-pointed, not renumbered
+     *
+     * A child keeps its own id and follows its parent: every row whose
+     * `parentDeviceId` was `a` now names `b`, and the reverse. Renumbering the
+     * children as well would move THEIR general work for no reason — the
+     * accessory's own recordings and rules are keyed on the child id, which is
+     * not the id being inherited.
+     *
+     * ## There are no transactions here, so the ORDER is the safety
+     *
+     * The backing store is a collection API (`set` / `delete` / `updateWhere`);
+     * there is no rollback to lean on. So the sequence is chosen to make every
+     * crash point LOUD rather than plausible: `a` first moves to a freshly
+     * allocated id, which the monotonic counter guarantees was never used and
+     * will never be reused. A crash before the end therefore leaves a device
+     * missing from its number and a stray at an unfamiliar one — visible in the
+     * device list at a glance. What it can never leave is two rows on one number,
+     * or a row that looks correct while its children point elsewhere.
+     *
+     * The caller holds {@link DeviceMetaStore.withMetaWriteLock}. This method does
+     * not take it: taking it here would deadlock the migration that has to disable
+     * functions on both devices in the same critical section.
+     */
+    swapIds(a: number, b: number, tempId: number): Promise<void>;
+    /** Rewrite a row under a new id and drop the old key. Not exported: the only
+     *  legitimate reason to move a row is {@link swapIds}. */
+    private moveRow;
     remove(deviceId: number): Promise<void>;
     /**
      * The retirement door for the three blobs this collection replaced.