@camstack/system 1.2.179 → 1.2.180

package/dist/builtins/backup-orchestrator/run-queue.d.ts

@@ -0,0 +1,103 @@
+export type BackupRunState = 'queued' | 'running' | 'succeeded' | 'failed' | 'cancelled';
+export type BackupRunPhase = 'queued' | 'building' | 'uploading' | 'done';
+/** What a trigger asks for — the queue keys joining on this. */
+export interface BackupRunRequest {
+    readonly destinations?: readonly string[];
+    readonly locations?: readonly string[];
+    readonly label?: string;
+    readonly retentionCount?: number;
+}
+/** Immutable snapshot of one run — the wire shape of `backup.listRuns`. */
+export interface BackupRunSnapshot {
+    readonly id: string;
+    readonly state: BackupRunState;
+    readonly phase: BackupRunPhase;
+    readonly destinationIds: readonly string[];
+    readonly label?: string;
+    readonly requestedAt: number;
+    readonly startedAt?: number;
+    readonly finishedAt?: number;
+    readonly stagedBytes: number;
+    readonly archiveSizeBytes?: number;
+    readonly uploadedBytes: number;
+    readonly completedDestinationIds: readonly string[];
+    readonly failedDestinationIds: readonly string[];
+    readonly error?: string;
+    /**
+     * 1-based place in the execution queue — 1 = runs next. Present only
+     * while `state === 'queued'`, and derived from the queue's OWN
+     * pending order at read time (never from timestamps), so a consumer
+     * can only ever show the order the executor will actually honour.
+     */
+    readonly queuePosition?: number;
+}
+/**
+ * Progress sink handed to the executor. Every update replaces the
+ * stored snapshot (no shared mutable state leaks out of the queue).
+ */
+export interface BackupRunProgress {
+    setPhase(phase: BackupRunPhase): void;
+    /** Resolved destination targets — known only once the run starts. */
+    setDestinations(ids: readonly string[]): void;
+    setStagedBytes(bytes: number): void;
+    setArchiveSize(bytes: number): void;
+    setUploadedBytes(bytes: number): void;
+    destinationCompleted(id: string): void;
+    destinationFailed(id: string): void;
+}
+export interface SubmitResult<T> {
+    readonly runId: string;
+    /** True when the run had to wait behind an in-flight run. */
+    readonly queued: boolean;
+    /** True when this submit was coalesced onto an identical queued run. */
+    readonly joined: boolean;
+    /** Settles when the run terminates. Rejects `BackupCancelledError` on cancel-before-any-result. */
+    readonly result: Promise<T>;
+}
+export type BackupRunExecutor<T> = (request: BackupRunRequest, signal: AbortSignal, progress: BackupRunProgress) => Promise<T>;
+export interface BackupRunQueueOptions {
+    readonly maxFinished?: number;
+    readonly now?: () => number;
+}
+/**
+ * FIFO queue with concurrency 1. `submit` never starts a second
+ * executor while one is in flight; an identical request already
+ * WAITING (same destinations/locations/label/retention) is joined
+ * instead of queued twice — two schedule ticks due on the same minute
+ * produce one run, not two.
+ */
+export declare class BackupRunQueue<T> {
+    private readonly executor;
+    private readonly runs;
+    private readonly pending;
+    private readonly finished;
+    private activeId;
+    private readonly maxFinished;
+    private readonly now;
+    constructor(executor: BackupRunExecutor<T>, opts?: BackupRunQueueOptions);
+    submit(request: BackupRunRequest): SubmitResult<T>;
+    /**
+     * Cancel a run. Queued: removed before it ever starts (its result
+     * rejects `BackupCancelledError`). Running: the abort signal fires —
+     * the executor's tar/upload streams stop and its cleanup runs.
+     * Unknown or already terminal: `false`.
+     */
+    cancel(runId: string): boolean;
+    /**
+     * EXECUTION order, not timestamp order: the running run first, then
+     * every queued run in the exact order the pump will start them (each
+     * stamped with `queuePosition`, 1 = next), then the bounded finished
+     * history newest-first. The queued section is read straight off
+     * `this.pending` — a consumer sorting by `requestedAt` descending
+     * would put the run that starts NEXT at the BOTTOM, which is
+     * backwards exactly when the queue matters (more than one waiter).
+     */
+    listRuns(): readonly BackupRunSnapshot[];
+    getRun(runId: string): BackupRunSnapshot | undefined;
+    private createRecord;
+    private pump;
+    private execute;
+    private progressFor;
+    private patch;
+    private finish;
+}

package/dist/builtins/backup-orchestrator/staging-paths.d.ts

@@ -0,0 +1,36 @@
+import { IScopedLogger } from '@camstack/types';
+/** Basename of the staging dir under the node data root. */
+export declare const STAGING_DIR_NAME = "backup-staging";
+/** Canonical staging dir for a node data root. */
+export declare function resolveStagingDir(nodeDataDir: string): string;
+export interface StagingSweepResult {
+    /** Top-level staging entries removed. */
+    readonly removedCount: number;
+    /** File bytes reclaimed (recursive for removed subdirectories). */
+    readonly freedBytes: number;
+    /** Entries spared because `keepPaths` named them. */
+    readonly keptCount: number;
+}
+export interface DirectoryFootprint {
+    readonly present: boolean;
+    readonly totalBytes: number;
+    readonly fileCount: number;
+}
+/**
+ * Delete every top-level entry of `stagingDir` except those whose
+ * resolved path appears in `keepPaths`. Per-entry failures are logged
+ * and skipped — a locked file must not abort the sweep. A missing
+ * staging dir is a clean no-op.
+ */
+export declare function sweepStagingDir(input: {
+    stagingDir: string;
+    keepPaths: readonly string[];
+    logger: IScopedLogger;
+}): Promise<StagingSweepResult>;
+/**
+ * Recursive size + file count of a path (file or directory). Absent
+ * path → `present: false` with zeros. Used by the sweep to report
+ * reclaimed bytes and by the orchestrator to surface the legacy
+ * staging dir's footprint without touching it.
+ */
+export declare function measureDirectoryFootprint(dir: string): Promise<DirectoryFootprint>;

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C7qWwrK1.js");
+const require_dist = require("../../dist-TEwQZL3g.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Ft as BaseAddon, ct as logDestinationCapability } from "../../dist-L_39vRmH.mjs";
+import { Ft as BaseAddon, ct as logDestinationCapability } from "../../dist-DqNTelT4.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C7qWwrK1.js");
+const require_dist = require("../../dist-TEwQZL3g.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { Ft as BaseAddon, I as coreBlockAddonId, L as coreBlockIdFromAddonId, Pt as errMsg, R as coreBlocksCapability, c as CORE_BLOCK_ADDON_PREFIX, d as DeclaredDevices, l as CoreBlockSchema, s as CORE_BLOCKS_ADDON_ID } from "../../dist-L_39vRmH.mjs";
+import { Ft as BaseAddon, I as coreBlockAddonId, L as coreBlockIdFromAddonId, Pt as errMsg, R as coreBlocksCapability, c as CORE_BLOCK_ADDON_PREFIX, d as DeclaredDevices, l as CoreBlockSchema, s as CORE_BLOCKS_ADDON_ID } from "../../dist-DqNTelT4.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C7qWwrK1.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-3soU9pfP.js");
+const require_dist = require("../../dist-TEwQZL3g.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-DauPtbFR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -2114,7 +2114,13 @@ function resolveLinkedDeviceIds(params) {
 	if (config.mode === "auto") {
 		if (selfLocation !== null && selfLocation.length > 0) for (const c of candidates) {
 			if (c.type === require_dist.DeviceType.Container) continue;
-			if (c.location === selfLocation) ids.add(c.id);
+			if (c.location !== selfLocation) continue;
+			const parent = c.parentDeviceId !== null ? byId.get(c.parentDeviceId) : void 0;
+			if (parent !== void 0 && parent.type === require_dist.DeviceType.Container) {
+				expand(parent.id);
+				continue;
+			}
+			ids.add(c.id);
 		}
 	} else for (const id of config.manualIds) if (byId.has(id)) expand(id);
 	ids.delete(selfId);
@@ -3327,6 +3333,16 @@ async function migrateDevice$1(deps, input) {
 	const down = [...await applyAll(deps, sourceId, false), ...await applyAll(deps, targetId, false)];
 	const sourceStillLive = down.filter((r) => r.deviceId === sourceId && r.outcome === "unreachable").map((r) => r.switchId);
 	await deps.swapIds(sourceId, targetId);
+	await deps.swapHardwareState(sourceId, targetId);
+	for (const deviceId of [sourceId, targetId]) try {
+		await deps.forgetStreamState(deviceId);
+	} catch (err) {
+		deps.log("migration: broker hardware state NOT forgotten — stale stream state survives", {
+			deviceId,
+			error: err instanceof Error ? err.message : String(err),
+			remedy: "delete the device's derived streams and reassign its stream profiles, or update the stream-broker addon and re-run streamBroker.forgetDeviceHardware"
+		});
+	}
 	const up = await applyAll(deps, sourceId, true);
 	await deps.respawnRunners([sourceId, targetId]);
 	deps.log("camera migrated", {
@@ -3344,6 +3360,102 @@ async function migrateDevice$1(deps, input) {
 	};
 }
 //#endregion
+//#region src/builtins/device-manager/migrate-hardware-state.ts
+/**
+* The per-device state half of a migration (`deviceManager.migrateDevice`).
+*
+* ## The rule
+*
+* **Role-scoped state follows the NUMBER. Hardware-scoped state follows the
+* DEVICE.** `swapIds` moves the device ROWS — `addonId` and `stableId` follow
+* the hardware — but the per-device CONFIG blob and the runtime-state blob are
+* keyed by the number in a separate store, and until 2026-09-01 they simply
+* stayed put. Measured on the live hub after replacing a Hikvision (id 618)
+* with a Reolink: device 618 — Reolink hardware — was dialled at
+* `192.168.1.245:80` with `deviceCache.model="DS-2DE2A404IW-DE3/W"`, the
+* Hikvision's address, credentials and cached model, and never came online.
+* Device 4362 wore the Reolink's config on Hikvision hardware. The two devices
+* were wearing each other's identity.
+*
+* The proof the config belongs to the hardware, not the number: writing the
+* Hikvision blob onto the Reolink was REJECTED by the Reolink driver's own
+* zod schema (`motionSensitivity: 60` vs max 50). A config that fails the
+* other provider's schema is a config for different hardware.
+*
+* ## What swaps, what stays
+*
+*  - The DRIVER config keys (host, port, credentials, `deviceCache`, every
+*    schema field) SWAP — they describe the box.
+*  - The device-manager-owned section keys ({@link DEVICE_STORE_SECTIONS}:
+*    linked-devices mode/ids) STAY with the number — a sensor is linked to
+*    "the driveway camera", not to a serial number.
+*  - `_profileMap` is DROPPED from both. It is the legacy spelling of the
+*    stream-profile assignment (the live authority is the stream broker's own
+*    map — see `StreamsTab.tsx`, which stopped writing it), and either copy
+*    names stream ids of the wrong hardware after a swap.
+*  - The runtime-state blobs (`__device-state:<id>` — battery snapshot, sleep
+*    flag, feature probe) SWAP wholesale: every slice mirrors the box.
+*
+* ## Crash points are loud, same as `swapIds`
+*
+* There is no transaction: each blob is cleared and rewritten. A crash between
+* clear and write leaves a device with NO config — a provider that fails to
+* construct and says so — never two devices wearing each other's, which is the
+* state that reads as plausible and costs a day.
+*/
+/** Legacy stream-profile assignment key (cf. `device-queries.ts`). */
+var PROFILE_MAP_CONFIG_KEY = "_profileMap";
+/** Config keys that belong to the camera's ROLE and stay with the number. */
+var ROLE_SCOPED_CONFIG_KEYS = new Set(DEVICE_STORE_SECTIONS.flatMap((section) => [...section.keys]));
+function splitConfig(config) {
+	const hardware = {};
+	const role = {};
+	for (const [key, value] of Object.entries(config)) {
+		if (key === PROFILE_MAP_CONFIG_KEY) continue;
+		if (ROLE_SCOPED_CONFIG_KEYS.has(key)) role[key] = value;
+		else hardware[key] = value;
+	}
+	return {
+		hardware,
+		role
+	};
+}
+/**
+* Swap the hardware-scoped halves of two devices' persisted state. Runs right
+* after `swapIds`, under the same meta write lock. THROWS on failure: a
+* migration whose rows swapped but whose configs did not is exactly the
+* incident this module exists to prevent, and it must never be reported as a
+* success.
+*/
+async function swapHardwareState(settings, sourceId, targetId) {
+	const sourceConfig = await settings.readDeviceStore(sourceId);
+	const targetConfig = await settings.readDeviceStore(targetId);
+	const source = splitConfig(sourceConfig);
+	const target = splitConfig(targetConfig);
+	await settings.clearDeviceStore(sourceId);
+	await settings.writeDeviceStore(sourceId, {
+		...target.hardware,
+		...source.role
+	});
+	await settings.clearDeviceStore(targetId);
+	await settings.writeDeviceStore(targetId, {
+		...source.hardware,
+		...target.role
+	});
+	const sourceRuntimeState = await settings.readDeviceRuntimeState(sourceId);
+	const targetRuntimeState = await settings.readDeviceRuntimeState(targetId);
+	await settings.writeDeviceRuntimeState(sourceId, targetRuntimeState);
+	await settings.writeDeviceRuntimeState(targetId, sourceRuntimeState);
+	return {
+		runtimeStateNowAtSource: targetRuntimeState,
+		runtimeStateNowAtTarget: sourceRuntimeState,
+		hardwareKeysToSource: Object.keys(target.hardware).toSorted(),
+		hardwareKeysToTarget: Object.keys(source.hardware).toSorted(),
+		roleKeysKeptAtSource: Object.keys(source.role).toSorted(),
+		roleKeysKeptAtTarget: Object.keys(target.role).toSorted()
+	};
+}
+//#endregion
 //#region src/builtins/device-manager/device-meta-actions.ts
 /**
 * Device meta-mutation + persistence actions for the device-manager addon —
@@ -3423,7 +3535,7 @@ async function allocateDeviceId(pctx, input) {
 * The composition lives in `migrate-device.ts`, deliberately free of this
 * file's context so the decisions it carries — above all "never report a switch
 * as off when it could not be written" — are testable without a hub. This is
-* the wiring: the four real dependencies, and the write lock.
+* the wiring: the real dependencies, and the write lock.
 *
 * The temp id comes from `allocateNextDeviceId`, the monotonic counter, so the
 * value a crash could park a row on was never used and will never be reused.
@@ -3446,13 +3558,42 @@ async function migrateDevice(pctx, input) {
 			swapIds: async (a, b) => {
 				await pctx.metaStore.rows.swapIds(a, b, tempId);
 			},
+			swapHardwareState: async (a, b) => {
+				const swapped = await swapHardwareState(pctx.settings, a, b);
+				pctx.host.seedMirror(a, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtSource));
+				pctx.host.seedMirror(b, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtTarget));
+				ctx.logger.info("migration: hardware-scoped device state swapped", {
+					tags: { deviceId: a },
+					meta: {
+						sourceId: a,
+						targetId: b,
+						hardwareKeysToSource: swapped.hardwareKeysToSource,
+						hardwareKeysToTarget: swapped.hardwareKeysToTarget,
+						roleKeysKeptAtSource: swapped.roleKeysKeptAtSource,
+						roleKeysKeptAtTarget: swapped.roleKeysKeptAtTarget
+					}
+				});
+			},
+			forgetStreamState: async (deviceId) => {
+				await ctx.api.streamBroker.forgetDeviceHardware.mutate({ deviceId });
+			},
 			respawnRunners: async (deviceIds) => {
 				const owners = /* @__PURE__ */ new Set();
 				for (const deviceId of deviceIds) {
 					const addonId = pctx.metaStore.idToAddonId.get(deviceId);
 					if (addonId !== void 0) owners.add(addonId);
 				}
-				for (const addonId of owners) await ctx.api.addons.restartAddon.mutate({ addonId });
+				for (const addonId of owners) {
+					const owned = [...pctx.metaStore.idToAddonId.entries()].filter(([, a]) => a === addonId).length;
+					ctx.logger.info("migration: restarting a whole provider to flush the id maps", {
+						tags: { deviceId: sourceId },
+						meta: {
+							addonId,
+							devicesTakenDown: owned
+						}
+					});
+					await ctx.api.addons.restartAddon.mutate({ addonId });
+				}
 			},
 			log: (message, meta) => {
 				ctx.logger.info(message, {

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { $t as isDeviceConfigCap, Bt as DeviceRole, Ft as BaseAddon, H as deviceManagerCapability, J as enumerateSchemaFields, P as buildStreamParamsConfigSchema, Pt as errMsg, U as deviceStateCapability, Vt as DeviceType, W as deviceStatusCapability, Wt as WELL_KNOWN_TAB_MAP, a as CAMERA_SWITCH_ORDER, b as STREAM_PROFILE_META, f as DeviceStatusSchema, ft as normalizeUnit, mt as parseStreamParamsFormPatch, o as CAP_NAMES_WITH_STATUS, on as sleep, q as enumerateItemArrayFields, sn as EventCategory, t as ALL_CAPABILITY_DEFINITIONS, xt as runtimeStatePolicyFor, yt as resolveContainerPrimaryChild, zt as DeviceFeature } from "../../dist-L_39vRmH.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CnbKAxmX.mjs";
+import { $t as isDeviceConfigCap, Bt as DeviceRole, Ft as BaseAddon, H as deviceManagerCapability, J as enumerateSchemaFields, P as buildStreamParamsConfigSchema, Pt as errMsg, U as deviceStateCapability, Vt as DeviceType, W as deviceStatusCapability, Wt as WELL_KNOWN_TAB_MAP, a as CAMERA_SWITCH_ORDER, b as STREAM_PROFILE_META, f as DeviceStatusSchema, ft as normalizeUnit, mt as parseStreamParamsFormPatch, o as CAP_NAMES_WITH_STATUS, on as sleep, q as enumerateItemArrayFields, sn as EventCategory, t as ALL_CAPABILITY_DEFINITIONS, xt as runtimeStatePolicyFor, yt as resolveContainerPrimaryChild, zt as DeviceFeature } from "../../dist-DqNTelT4.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CeSITpIX.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -2109,7 +2109,13 @@ function resolveLinkedDeviceIds(params) {
 	if (config.mode === "auto") {
 		if (selfLocation !== null && selfLocation.length > 0) for (const c of candidates) {
 			if (c.type === DeviceType.Container) continue;
-			if (c.location === selfLocation) ids.add(c.id);
+			if (c.location !== selfLocation) continue;
+			const parent = c.parentDeviceId !== null ? byId.get(c.parentDeviceId) : void 0;
+			if (parent !== void 0 && parent.type === DeviceType.Container) {
+				expand(parent.id);
+				continue;
+			}
+			ids.add(c.id);
 		}
 	} else for (const id of config.manualIds) if (byId.has(id)) expand(id);
 	ids.delete(selfId);
@@ -3322,6 +3328,16 @@ async function migrateDevice$1(deps, input) {
 	const down = [...await applyAll(deps, sourceId, false), ...await applyAll(deps, targetId, false)];
 	const sourceStillLive = down.filter((r) => r.deviceId === sourceId && r.outcome === "unreachable").map((r) => r.switchId);
 	await deps.swapIds(sourceId, targetId);
+	await deps.swapHardwareState(sourceId, targetId);
+	for (const deviceId of [sourceId, targetId]) try {
+		await deps.forgetStreamState(deviceId);
+	} catch (err) {
+		deps.log("migration: broker hardware state NOT forgotten — stale stream state survives", {
+			deviceId,
+			error: err instanceof Error ? err.message : String(err),
+			remedy: "delete the device's derived streams and reassign its stream profiles, or update the stream-broker addon and re-run streamBroker.forgetDeviceHardware"
+		});
+	}
 	const up = await applyAll(deps, sourceId, true);
 	await deps.respawnRunners([sourceId, targetId]);
 	deps.log("camera migrated", {
@@ -3339,6 +3355,102 @@ async function migrateDevice$1(deps, input) {
 	};
 }
 //#endregion
+//#region src/builtins/device-manager/migrate-hardware-state.ts
+/**
+* The per-device state half of a migration (`deviceManager.migrateDevice`).
+*
+* ## The rule
+*
+* **Role-scoped state follows the NUMBER. Hardware-scoped state follows the
+* DEVICE.** `swapIds` moves the device ROWS — `addonId` and `stableId` follow
+* the hardware — but the per-device CONFIG blob and the runtime-state blob are
+* keyed by the number in a separate store, and until 2026-09-01 they simply
+* stayed put. Measured on the live hub after replacing a Hikvision (id 618)
+* with a Reolink: device 618 — Reolink hardware — was dialled at
+* `192.168.1.245:80` with `deviceCache.model="DS-2DE2A404IW-DE3/W"`, the
+* Hikvision's address, credentials and cached model, and never came online.
+* Device 4362 wore the Reolink's config on Hikvision hardware. The two devices
+* were wearing each other's identity.
+*
+* The proof the config belongs to the hardware, not the number: writing the
+* Hikvision blob onto the Reolink was REJECTED by the Reolink driver's own
+* zod schema (`motionSensitivity: 60` vs max 50). A config that fails the
+* other provider's schema is a config for different hardware.
+*
+* ## What swaps, what stays
+*
+*  - The DRIVER config keys (host, port, credentials, `deviceCache`, every
+*    schema field) SWAP — they describe the box.
+*  - The device-manager-owned section keys ({@link DEVICE_STORE_SECTIONS}:
+*    linked-devices mode/ids) STAY with the number — a sensor is linked to
+*    "the driveway camera", not to a serial number.
+*  - `_profileMap` is DROPPED from both. It is the legacy spelling of the
+*    stream-profile assignment (the live authority is the stream broker's own
+*    map — see `StreamsTab.tsx`, which stopped writing it), and either copy
+*    names stream ids of the wrong hardware after a swap.
+*  - The runtime-state blobs (`__device-state:<id>` — battery snapshot, sleep
+*    flag, feature probe) SWAP wholesale: every slice mirrors the box.
+*
+* ## Crash points are loud, same as `swapIds`
+*
+* There is no transaction: each blob is cleared and rewritten. A crash between
+* clear and write leaves a device with NO config — a provider that fails to
+* construct and says so — never two devices wearing each other's, which is the
+* state that reads as plausible and costs a day.
+*/
+/** Legacy stream-profile assignment key (cf. `device-queries.ts`). */
+var PROFILE_MAP_CONFIG_KEY = "_profileMap";
+/** Config keys that belong to the camera's ROLE and stay with the number. */
+var ROLE_SCOPED_CONFIG_KEYS = new Set(DEVICE_STORE_SECTIONS.flatMap((section) => [...section.keys]));
+function splitConfig(config) {
+	const hardware = {};
+	const role = {};
+	for (const [key, value] of Object.entries(config)) {
+		if (key === PROFILE_MAP_CONFIG_KEY) continue;
+		if (ROLE_SCOPED_CONFIG_KEYS.has(key)) role[key] = value;
+		else hardware[key] = value;
+	}
+	return {
+		hardware,
+		role
+	};
+}
+/**
+* Swap the hardware-scoped halves of two devices' persisted state. Runs right
+* after `swapIds`, under the same meta write lock. THROWS on failure: a
+* migration whose rows swapped but whose configs did not is exactly the
+* incident this module exists to prevent, and it must never be reported as a
+* success.
+*/
+async function swapHardwareState(settings, sourceId, targetId) {
+	const sourceConfig = await settings.readDeviceStore(sourceId);
+	const targetConfig = await settings.readDeviceStore(targetId);
+	const source = splitConfig(sourceConfig);
+	const target = splitConfig(targetConfig);
+	await settings.clearDeviceStore(sourceId);
+	await settings.writeDeviceStore(sourceId, {
+		...target.hardware,
+		...source.role
+	});
+	await settings.clearDeviceStore(targetId);
+	await settings.writeDeviceStore(targetId, {
+		...source.hardware,
+		...target.role
+	});
+	const sourceRuntimeState = await settings.readDeviceRuntimeState(sourceId);
+	const targetRuntimeState = await settings.readDeviceRuntimeState(targetId);
+	await settings.writeDeviceRuntimeState(sourceId, targetRuntimeState);
+	await settings.writeDeviceRuntimeState(targetId, sourceRuntimeState);
+	return {
+		runtimeStateNowAtSource: targetRuntimeState,
+		runtimeStateNowAtTarget: sourceRuntimeState,
+		hardwareKeysToSource: Object.keys(target.hardware).toSorted(),
+		hardwareKeysToTarget: Object.keys(source.hardware).toSorted(),
+		roleKeysKeptAtSource: Object.keys(source.role).toSorted(),
+		roleKeysKeptAtTarget: Object.keys(target.role).toSorted()
+	};
+}
+//#endregion
 //#region src/builtins/device-manager/device-meta-actions.ts
 /**
 * Device meta-mutation + persistence actions for the device-manager addon —
@@ -3418,7 +3530,7 @@ async function allocateDeviceId(pctx, input) {
 * The composition lives in `migrate-device.ts`, deliberately free of this
 * file's context so the decisions it carries — above all "never report a switch
 * as off when it could not be written" — are testable without a hub. This is
-* the wiring: the four real dependencies, and the write lock.
+* the wiring: the real dependencies, and the write lock.
 *
 * The temp id comes from `allocateNextDeviceId`, the monotonic counter, so the
 * value a crash could park a row on was never used and will never be reused.
@@ -3441,13 +3553,42 @@ async function migrateDevice(pctx, input) {
 			swapIds: async (a, b) => {
 				await pctx.metaStore.rows.swapIds(a, b, tempId);
 			},
+			swapHardwareState: async (a, b) => {
+				const swapped = await swapHardwareState(pctx.settings, a, b);
+				pctx.host.seedMirror(a, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtSource));
+				pctx.host.seedMirror(b, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtTarget));
+				ctx.logger.info("migration: hardware-scoped device state swapped", {
+					tags: { deviceId: a },
+					meta: {
+						sourceId: a,
+						targetId: b,
+						hardwareKeysToSource: swapped.hardwareKeysToSource,
+						hardwareKeysToTarget: swapped.hardwareKeysToTarget,
+						roleKeysKeptAtSource: swapped.roleKeysKeptAtSource,
+						roleKeysKeptAtTarget: swapped.roleKeysKeptAtTarget
+					}
+				});
+			},
+			forgetStreamState: async (deviceId) => {
+				await ctx.api.streamBroker.forgetDeviceHardware.mutate({ deviceId });
+			},
 			respawnRunners: async (deviceIds) => {
 				const owners = /* @__PURE__ */ new Set();
 				for (const deviceId of deviceIds) {
 					const addonId = pctx.metaStore.idToAddonId.get(deviceId);
 					if (addonId !== void 0) owners.add(addonId);
 				}
-				for (const addonId of owners) await ctx.api.addons.restartAddon.mutate({ addonId });
+				for (const addonId of owners) {
+					const owned = [...pctx.metaStore.idToAddonId.entries()].filter(([, a]) => a === addonId).length;
+					ctx.logger.info("migration: restarting a whole provider to flush the id maps", {
+						tags: { deviceId: sourceId },
+						meta: {
+							addonId,
+							devicesTakenDown: owned
+						}
+					});
+					await ctx.api.addons.restartAddon.mutate({ addonId });
+				}
 			},
 			log: (message, meta) => {
 				ctx.logger.info(message, {

package/dist/builtins/device-manager/device-meta-actions.d.ts

@@ -19,7 +19,7 @@ export declare function allocateDeviceId(pctx: ProviderContext, input: Parameter
  * The composition lives in `migrate-device.ts`, deliberately free of this
  * file's context so the decisions it carries — above all "never report a switch
  * as off when it could not be written" — are testable without a hub. This is
- * the wiring: the four real dependencies, and the write lock.
+ * the wiring: the real dependencies, and the write lock.
  *
  * The temp id comes from `allocateNextDeviceId`, the monotonic counter, so the
  * value a crash could park a row on was never used and will never be reused.

package/dist/builtins/device-manager/migrate-device.d.ts

@@ -26,6 +26,39 @@ export interface MigrateDeviceDeps {
     readonly setSwitch: (deviceId: number, switchId: CameraSwitchId, enabled: boolean) => Promise<void>;
     /** `DeviceRowStore.swapIds`, already under the meta write lock. */
     readonly swapIds: (a: number, b: number) => Promise<void>;
+    /**
+     * Swap the HARDWARE-scoped per-device state along with the rows: the driver
+     * config blob (host/port/credentials/`deviceCache` — everything the
+     * provider's schema owns) and the runtime-state blob. Role-scoped keys stay
+     * with the number. See `migrate-hardware-state.ts` for the rule, and for
+     * the incident where the rows swapped and the configs did not — the two
+     * devices came out wearing each other's identity.
+     *
+     * A failure here THROWS, and the migration throws with it: rows swapped
+     * with configs unswapped is exactly that incident, and it must never be
+     * reported as a success.
+     */
+    readonly swapHardwareState: (sourceId: number, targetId: number) => Promise<void>;
+    /**
+     * Tell the stream broker the hardware behind this number is gone
+     * (`streamBroker.forgetDeviceHardware`): every DERIVED stream definition is
+     * DELETED, the profile-slot assignment entry is purged, and the probed
+     * snapshots and RTSP token rows of the old streams go with it.
+     *
+     * Measured on the live hub after replacing a Hikvision with a Reolink on id
+     * 618: the assignment still said `mid → native:slot-3`, a raw slot only the
+     * Hikvision had, and the `derived:Mid to low` feeder — defined against the
+     * old profile layout — respawned every ten seconds forever (observed at
+     * attempt 2732). The recorder reported `no profile attached for device
+     * 618`, live view answered `No broker for stream "618/adaptive"`, and no
+     * line named the stale assignment as the cause.
+     *
+     * Forgetting is deliberately what this does, rather than guessing a
+     * mapping: the catalog is the authority on which stream is which, and it
+     * belongs to the camera that is now there. An RPC, never an event — a
+     * dropped event (D8) would leave the feeder respawning forever.
+     */
+    readonly forgetStreamState: (deviceId: number) => Promise<void>;
     /** Respawn the runners that hold either number in memory. Disabling stops
      *  data PRODUCTION; it does not flush a cache that maps id → addon. */
     readonly respawnRunners: (deviceIds: readonly number[]) => Promise<void>;

package/dist/builtins/device-manager/migrate-hardware-state.d.ts

@@ -0,0 +1,24 @@
+import { DeviceManagerSettings } from './device-meta-store.js';
+/** The narrow settings slice the swap needs — the seam the spec fakes. */
+export type HardwareStateStore = Pick<DeviceManagerSettings, 'readDeviceStore' | 'writeDeviceStore' | 'clearDeviceStore' | 'readDeviceRuntimeState' | 'writeDeviceRuntimeState'>;
+export interface SwappedHardwareState {
+    /** Runtime-state blob now persisted at `sourceId` (was the target's). */
+    readonly runtimeStateNowAtSource: Record<string, unknown>;
+    /** Runtime-state blob now persisted at `targetId` (was the source's). */
+    readonly runtimeStateNowAtTarget: Record<string, unknown>;
+    /** Hardware config keys that moved target → source. */
+    readonly hardwareKeysToSource: readonly string[];
+    /** Hardware config keys that moved source → target. */
+    readonly hardwareKeysToTarget: readonly string[];
+    /** Role config keys that stayed on each number. */
+    readonly roleKeysKeptAtSource: readonly string[];
+    readonly roleKeysKeptAtTarget: readonly string[];
+}
+/**
+ * Swap the hardware-scoped halves of two devices' persisted state. Runs right
+ * after `swapIds`, under the same meta write lock. THROWS on failure: a
+ * migration whose rows swapped but whose configs did not is exactly the
+ * incident this module exists to prevent, and it must never be reported as a
+ * success.
+ */
+export declare function swapHardwareState(settings: HardwareStateStore, sourceId: number, targetId: number): Promise<SwappedHardwareState>;

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C7qWwrK1.js");
+const require_dist = require("../../dist-TEwQZL3g.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { Ft as BaseAddon, G as doorbellCapability, Jt as createEvent, M as bareAddonId, Pt as errMsg, Vt as DeviceType, Y as evaluateSensorEdge, _ as SOURCE_CAPS, nt as isSameAddonId, rt as isSourceCap, sn as EventCategory, v as SOURCE_DEVICE_TYPES } from "../../dist-L_39vRmH.mjs";
+import { Ft as BaseAddon, G as doorbellCapability, Jt as createEvent, M as bareAddonId, Pt as errMsg, Vt as DeviceType, Y as evaluateSensorEdge, _ as SOURCE_CAPS, nt as isSameAddonId, rt as isSourceCap, sn as EventCategory, v as SOURCE_DEVICE_TYPES } from "../../dist-DqNTelT4.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over