@camstack/system 1.2.201 → 1.2.202

package/dist/builtins/storage-orchestrator/storage-orchestrator.service.d.ts

@@ -184,23 +184,31 @@ export declare class StorageOrchestratorService {
      */
     attachStore(store: ILocationStore): Promise<void>;
     /**
-     * Shout about a persisted row that is BOTH the type default and disabled.
+     * ONE explicit migration onto the enabled write set (D383), run once per
+     * boot against the rows that came off disk. Idempotent: the second boot finds
+     * nothing to do.
      *
-     * `upsertLocation` can now produce this (enabled is the write set; `isDefault`
-     * is store residue). Hydrate also writes rows straight into the map, so a
-     * hand-edited store or a row written by another build can too. It matters
-     * because every bare-type ref still resolves through {@link getDefaultLocation}
-     * until Stage 5 of the enabled-write-set design: on such a row
-     * `storage.write({ location: 'eventMedia' })` and the migration coordinator's
-     * drain destination both point at a disk the operator turned off.
+     * Two steps, in order, and each one is a WRITE — the point is that "absent"
+     * stops existing rather than being re-interpreted on every read forever:
      *
-     * Reported, never repaired: flipping an operator's flag back on at boot would
-     * be the system overruling the switch instead of obeying it. The coordinator
-     * refuses the drain (`storage-migration-coordinator.drain`); the bare-ref read
-     * path is deliberately left working, because narrowing a READ is a worse bug
-     * than the one this line reports.
+     *   1. A flagless row (persisted before `enabled` existed) is stamped
+     *      `enabled: true`. Absence already meant active, so this preserves
+     *      behaviour exactly; it is the operator's "the initial locations are
+     *      enabled" spelled into the store.
+     *   2. A type left with NO enabled row — only reachable from a hand-edited
+     *      store or a row an older build wrote — gets one enabled back, chosen as
+     *      the row the RETIRED default flag named, else the `:default`-slugged
+     *      row, else the lexicographically first. Loudly: a class with no write
+     *      target records nowhere, and refusing to repair it here would leave the
+     *      hub silently unable to write with no operator action pending.
+     *
+     * An operator's explicit `enabled: false` is never reversed by step 1 — only
+     * step 2 touches it, and only when the alternative is a class that cannot
+     * write at all.
      */
-    private reportDisabledDefaults;
+    private migrateOntoTheWriteSet;
+    /** Apply one migrated row in memory and mirror it to the store. */
+    private persistMigrated;
     /**
      * Inject the declaration-driven cardinality source. Called once by the
      * addon after the kernel aggregates every addon's `storageLocations`
@@ -259,22 +267,36 @@ export declare class StorageOrchestratorService {
      */
     backfillNodeIds(hubNodeId: string): Promise<void>;
     listLocations(filter?: ListLocationsFilter): readonly StorageLocation[];
-    getDefaultLocation(type: string): StorageLocation | null;
     /**
-     * Repoint several logical defaults as one in-memory commit. The migration
-     * coordinator persists its `repointing` phase before calling this method, so
-     * a process crash during the backing-store writes is recovered by replaying
-     * the same idempotent target set before anyone resumes writers.
+     * The WRITE SET of a type: every enabled location of it, in stable id order.
+     * This replaced `getDefaultLocation` (D383) — a type does not have one write
+     * target any more, it has a pool, and every consumer that must pick one picks
+     * from here by its own rule (the recorder by headroom, a drain by an operator
+     * -named destination).
+     */
+    writeTargets(type: string): readonly StorageLocation[];
+    /**
+     * Change the WRITE SET as one compensated commit: each named location is
+     * enabled (it joins the pool) or disabled (it becomes read-only — still read,
+     * still played back, still age-swept, still drained).
+     *
+     * This is the cutover verb, and its only caller is the migration coordinator,
+     * which persists its `repointing` phase BEFORE calling so a crash mid-write
+     * is recovered by replaying the same idempotent set before writers resume.
+     *
+     * It moves ONLY the locations it is given: a cutover from A to C on a class
+     * that also writes to B leaves B in the pool, because the operator's pool is
+     * the authority and a migration is not a licence to shrink it. The commit is
+     * refused when it would leave a write-serving type with nothing enabled —
+     * the same refusal `upsertLocation` applies, judged on the RESULT so an
+     * enable and a disable in one commit are weighed together.
      */
-    setDefaultLocations(targetByType: ReadonlyMap<string, string>): Promise<void>;
+    setWriteTargets(enabledByLocationId: ReadonlyMap<string, boolean>): Promise<void>;
     /**
-     * Insert or update a location. If `isDefault: true`, atomically
-     * demotes any other default for the same type — operators always see
-     * exactly one default per type.
+     * Insert or update a location.
      *
-     * When a persistence store is wired (Task 6), the new record AND any
-     * implicitly-demoted siblings are persisted before the in-memory map
-     * mutation returns. Persistence errors propagate to the caller.
+     * When a persistence store is wired (Task 6), the record is mirrored to it;
+     * the mirror is fire-and-forget and its errors reach the logger.
      */
     /**
      * Refuse a `(location kind, provider)` pair the kind cannot use.
@@ -310,8 +332,7 @@ export declare class StorageOrchestratorService {
     /**
      * Remove a location. Refuses the last location of a type and the last
      * enabled location of a type. `isSystem` is informational — a frozen
-     * recordings `:default` is deletable once a sibling is live. Deleting
-     * the flagged default promotes an enabled sibling. Occupancy still
+     * recordings `:default` is deletable once a sibling is live. Occupancy still
      * refuses unless `force` is set; force never overrides uniqueness /
      * last-enabled.
      */
@@ -392,9 +413,11 @@ export declare class StorageOrchestratorService {
      * declarations on a populated map is a no-op (each declared `id`
      * already resolves to an existing `<id>:default`).
      *
-     * Convention: the bare-type ref `'recordings'` resolves via
-     * `getDefaultLocation('recordings')` (walks `isDefault === true`); the
-     * actual stored `id` is `'recordings:default'` so it satisfies the
+     * The seeded row is born ENABLED — a fresh install must be able to write the
+     * moment it boots, and `enabled` is the only write switch there is (D383).
+     * The `:default` suffix is a NAME kept for idempotency across existing
+     * installs, not a flag: the stored `id` is `'recordings:default'` so it
+     * satisfies the
      * `^[a-z][a-z0-9-]*:[a-z0-9-]+$` regex on `StorageLocationSchema.id`.
      *
      * `basePath` is the storage root (e.g. `<CAMSTACK_DATA>`). Each

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CcV3k-hD.js");
+const require_dist = require("../../dist-jZb-HKI5.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { $t as hydrateSchema, Ft as errMsg, It as BaseAddon } from "../../dist-BmJNnb_s.mjs";
+import { Lt as errMsg, Rt as BaseAddon, tn as hydrateSchema } from "../../dist-CiHYspij.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CcV3k-hD.js");
+const require_dist = require("../../dist-jZb-HKI5.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { It as BaseAddon, lt as logDestinationCapability } from "../../dist-BmJNnb_s.mjs";
+import { Rt as BaseAddon, dt as logDestinationCapability } from "../../dist-CiHYspij.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-BmJNnb_s.mjs → dist-CiHYspij.mjs}

@@ -3815,111 +3815,6 @@ function logLevelAtMost(level, threshold) {
 	return LOG_LEVEL_RANK[level] <= LOG_LEVEL_RANK[threshold];
 }
 /**
-* Per-component log CHANNELS — the gate a hot path consults, and the registry
-* an addon declares its channels in.
-*
-* ## Two axes, deliberately separated
-*
-* - **DECLARATION** — which channels exist. Only the addon knows:
-*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
-*   baichuan/handshake. A hand-wired central list rots at the first addition,
-*   and rots silently. So a channel is declared where it is consulted, and the
-*   `log-channels` capability enumerates the declarations.
-* - **VALUE** — at which level, for which scope, until when. That stays ONE
-*   thing: the logging settings document on the `system` cap. Two authorities
-*   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
-*   remove; re-introducing it from the cure side would be grotesque.
-*
-* Nothing in this file reads a clock, an env var or a store. The registry is
-* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
-* the hot path with a value somebody actually read, and by
-* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
-* never reaches here, so it can neither disarm an armed channel nor arm a
-* disarmed one (D49).
-*
-* ## The canonical call shape
-*
-* ```ts
-* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
-*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
-* }
-* ```
-*
-* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
-* read. Disarmed, a call site costs one load and one branch, and the `extras`
-* object literal is never constructed because it lives inside the branch. It
-* is the same shape already proven in production at `stream-broker.ts:1650`,
-* and the same discipline `LoggingGate.allowsDestination` uses for the
-* destination floor (measured at 1.93 ns/call when off).
-*
-* ## Why a channel emits at `info`
-*
-* `loki-logging.addon.ts` pins the destination default at `info` and
-* `loki-destination.ts` drops everything below it, so a line emitted at
-* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
-* minutes. A diagnostic that cannot be read an hour later is worse than no
-* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
-* emits at the channel's declared level, whose schema floor is `info`.
-*/
-/**
-* The level a channel writes at once armed.
-*
-* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
-* not leave the process for Loki, and the whole point of arming a channel is
-* to read it later.
-*/
-var LogChannelLevelSchema = z.enum([
-	"info",
-	"warn",
-	"error"
-]);
-/**
-* What an addon declares about one channel. No value, no state — a
-* declaration is inert.
-*/
-var LogChannelDescriptorSchema = z.object({
-	/**
-	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
-	* the addon's short name so an operator reading a channel list can tell who
-	* owns it without a second lookup.
-	*/
-	name: z.string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
-	/** One sentence: what the operator will SEE after arming it. */
-	description: z.string().min(1),
-	/** The level its lines are emitted at. Never below `info`. */
-	defaultLevel: LogChannelLevelSchema,
-	/**
-	* Whether this channel can be narrowed to a camera.
-	*
-	* `true` is a PROMISE with two halves, and both must hold: the gate is
-	* consulted with the numeric device id, AND every line the channel admits
-	* carries `tags: { deviceId }` with that same numeric id. The second half is
-	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
-	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
-	* the body is the only way to filter.
-	*
-	* A channel whose lines carry the device only in `meta` (or not at all) is
-	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
-	* the operator narrows to one camera, sees nothing, and concludes the code
-	* path was never taken.
-	*/
-	perDevice: z.boolean()
-});
-/**
-* An armed window over one channel, as the document hands it to a mirror.
-*
-* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
-* expires by itself, which is the one failure a boolean cannot avoid.
-*/
-var LogChannelWindowSchema = z.object({
-	channel: z.string().min(1),
-	/** Epoch ms the window closes at. */
-	armedUntilMs: z.number(),
-	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
-	deviceIds: z.array(z.number().int()).readonly().nullable()
-});
-/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -4897,8 +4792,11 @@ var StorageLocationTypeSchema = z.string().regex(/^[a-z][a-zA-Z0-9-]*$/);
 * `STORAGE_LOCATION_CARDINALITY` map has been removed.
 *
 * `id` is a stable namespaced string of the form `<type>:<slug>`.
-* The default location for a type uses `id === <type>:default` by
-* convention (the bare type ref like `'backups'` resolves to it).
+* The seed names its first instance `<type>:default` — a NAME, not a flag.
+* There is no default location any more (D383): `enabled` is the whole write
+* model, and a bare type ref resolves to the sole location of the type, or —
+* transitionally, only while legacy NULL-stamped rows exist — to the row whose
+* slug is `default`.
 *
 * `isSystem` is a legacy persisted flag. Seed still creates the initial
 * `<type>:default` locations; the flag is no longer a lock, a badge, or a
@@ -4919,21 +4817,20 @@ var StorageLocationSchema = z.object({
 	* flag at upsert time, not here (the schema is provider-agnostic).
 	*/
 	nodeId: z.string().optional(),
-	isDefault: z.boolean().default(false),
 	isSystem: z.boolean().default(false),
 	/**
-	* Operator opt-in: whether consumers that BALANCE across several locations
-	* of a type may write here. Recordings reads it today; event media and
-	* backups are the next consumers, which is why the flag lives on the
-	* location rather than in any one addon's store — nothing has to be
-	* extended to add the next consumer.
+	* THE write switch, and the only one (D383). `enabled: true` means every
+	* consumer that chooses a write target for this type may write here, and all
+	* enabled locations of a type are used TOGETHER; `false` means read-only —
+	* still read, still played back, still age-swept, still drained, never
+	* written.
 	*
-	* OPTIONAL, and ABSENT MEANS ACTIVE. Every location persisted before the
-	* flag existed reads back with no flag and keeps working exactly as before;
-	* that is the whole compat story, and it is why no migration ships with it.
-	* A newly CREATED sibling is stamped `false` by the orchestrator (creating a
-	* disk must not silently start writing to it); the default of a type is
-	* always stamped `true`.
+	* OPTIONAL only for the wire: an upsert that omits it means "leave what is
+	* stored" on an update and "born inert unless it is the first location of its
+	* type" on a create. On a PERSISTED row absence is legacy and it means
+	* enabled — {@link isLocationEnabled} is the one place that says so, and the
+	* orchestrator stamps every flagless row `true` once at hydrate so absence
+	* stops existing rather than being re-derived on every read.
 	*/
 	enabled: z.boolean().optional(),
 	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
@@ -4947,9 +4844,31 @@ var StorageLocationSchema = z.object({
 	updatedAt: z.number()
 });
 /**
+* The retired `isDefault` key, DECLARED rather than dropped.
+*
+* A key removed from a non-strict `z.object` is stripped in silence (D380,
+* D381): a reader that still needs the old value gets `undefined` and cannot
+* tell "absent" from "never sent". The one reader that legitimately needs it —
+* the location store's boot migration, which turns the old default flag into
+* the `enabled` write set — parses THIS schema against the raw row instead, so
+* the migration is explicit and the live schema stays clean. Nothing else in
+* the repo may read it; `scripts/check-no-storage-default.ts` enforces that.
+*/
+var LegacyStorageLocationDefaultSchema = z.object({ isDefault: z.boolean().optional() });
+/**
+* Is this location a write target? THE one place that decides what an absent
+* `enabled` means on a persisted row — legacy rows predate the flag and were
+* active, so absence is enabled. Every consumer asks here rather than spelling
+* `enabled !== false` again, so the tri-state has exactly one interpretation.
+*/
+function isLocationEnabled(location) {
+	return location.enabled !== false;
+}
+/**
 * Reference accepted by consumer-facing `api.storage.*` calls.
 * Either:
-*  - a `StorageLocationType` (e.g. `'backups'`) → orchestrator resolves to the default of that type
+*  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
+*    (transitionally, the `<type>:default`-slugged row when several exist)
 *  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
 *
 * The orchestrator's `resolveRef(ref)` handles both cases.
@@ -5131,6 +5050,111 @@ var DecoderSessionConfigSchema = z.object({
 	*/
 	debug: z.boolean().optional()
 });
+/**
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = z.enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = z.object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: z.string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: z.string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: z.boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = z.object({
+	channel: z.string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: z.number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: z.array(z.number().int()).readonly().nullable()
+});
 /** Bucket key for rows no addon owns. Stable, so its series is continuous. */
 var UNATTRIBUTED_BUCKET_KEY = "__unattributed__";
 var ROOT_BUCKET_KEY = "__root__";
@@ -22090,7 +22114,6 @@ var storageCapability = {
 		}), z.instanceof(Uint8Array)),
 		endDownload: method(z.object({ downloadId: z.string() }), z.void(), { kind: "mutation" }),
 		listLocations: method(z.object({ type: StorageLocationTypeSchema.optional() }), z.array(StorageLocationSchema).readonly()),
-		getDefaultLocation: method(z.object({ type: StorageLocationTypeSchema }), StorageLocationSchema.nullable()),
 		listLocationDeclarations: method(z.void(), z.array(StorageLocationDeclarationSchema).readonly()),
 		upsertLocation: method(StorageLocationSchema.omit({
 			createdAt: true,
@@ -34609,6 +34632,63 @@ var RUNTIME_DEFAULTS = {
 	"auth.tokenExpiry": "30d"
 };
 /**
+* Accessory device helpers — shared across drivers.
+*
+* Many vendor-specific drivers register accessory child devices on
+* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
+* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
+* driver picks the right `DeviceType` + `DeviceRole` explicitly when
+* spawning, builds a name derived from the parent, and produces a
+* stableId tied to the parent so boot-restore can reconstruct the
+* relationship.
+*
+* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
+* drivers may reasonably disagree on the right type for an accessory
+* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
+* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
+* one canonical mapping was over-prescriptive and added a layer of
+* indirection without saving meaningful code at call sites — the
+* driver knows its own hardware best.
+*/
+/**
+* Subset of `DeviceRole` values that drivers register as child
+* accessories of a parent device. Sourced verbatim from `DeviceRole`
+* — `AccessoryKind` is the alias drivers use when building accessory
+* children, so the call site reads as
+* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
+* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
+* any role works, including non-accessory ones like Doorbell).
+*/
+var AccessoryKind = {
+	Siren: DeviceRole.Siren,
+	Floodlight: DeviceRole.Floodlight,
+	Spotlight: DeviceRole.Spotlight,
+	PirSensor: DeviceRole.PirSensor,
+	Chime: DeviceRole.Chime,
+	Autotrack: DeviceRole.Autotrack,
+	Nightvision: DeviceRole.Nightvision,
+	PrivacyMask: DeviceRole.PrivacyMask
+};
+AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
+/**
+* THE derivation. One crop rectangle, one presence verdict — see D52 for why
+* this repo insists a derived value has exactly one implementation.
+*
+* `undefined` status ⇒ `sleeping`. A device with no slice has made no claim,
+* and the caller decides separately whether it is even battery-operated
+* (`DeviceFeature.BatteryOperated`); this function never answers that
+* question, only what a battery device is doing.
+*/
+function deriveBatteryPresence(input) {
+	const status = input.status;
+	if (!status) return "sleeping";
+	if (status.sleeping !== true) return "awake";
+	const lastContactAt = status.lastContactAt;
+	if (typeof lastContactAt !== "number" || lastContactAt <= 0) return "sleeping";
+	const budget = input.unreachableAfterMs ?? 216e5;
+	return input.nowMs - lastContactAt > budget ? "unreachable" : "sleeping";
+}
+/**
 * WHICH child a container stands for — one definition, for every consumer.
 *
 * A CONTAINER device has no controllable surface of its own: it groups entity
@@ -34734,63 +34814,6 @@ function resolveContainerPrimaryChild(children, overrideEntityId, containerName)
 	const namesake = (c) => containerName !== void 0 && containerName.length > 0 && c.name !== void 0 && c.name.toLowerCase() === containerName.toLowerCase() ? 0 : 1;
 	return [...children].toSorted((a, b) => roleRank(a.role) - roleRank(b.role) || namesake(a) - namesake(b) || rank(a.type) - rank(b.type))[0] ?? null;
 }
-/**
-* Accessory device helpers — shared across drivers.
-*
-* Many vendor-specific drivers register accessory child devices on
-* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
-* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
-* driver picks the right `DeviceType` + `DeviceRole` explicitly when
-* spawning, builds a name derived from the parent, and produces a
-* stableId tied to the parent so boot-restore can reconstruct the
-* relationship.
-*
-* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
-* drivers may reasonably disagree on the right type for an accessory
-* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
-* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
-* one canonical mapping was over-prescriptive and added a layer of
-* indirection without saving meaningful code at call sites — the
-* driver knows its own hardware best.
-*/
-/**
-* Subset of `DeviceRole` values that drivers register as child
-* accessories of a parent device. Sourced verbatim from `DeviceRole`
-* — `AccessoryKind` is the alias drivers use when building accessory
-* children, so the call site reads as
-* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
-* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
-* any role works, including non-accessory ones like Doorbell).
-*/
-var AccessoryKind = {
-	Siren: DeviceRole.Siren,
-	Floodlight: DeviceRole.Floodlight,
-	Spotlight: DeviceRole.Spotlight,
-	PirSensor: DeviceRole.PirSensor,
-	Chime: DeviceRole.Chime,
-	Autotrack: DeviceRole.Autotrack,
-	Nightvision: DeviceRole.Nightvision,
-	PrivacyMask: DeviceRole.PrivacyMask
-};
-AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
-/**
-* THE derivation. One crop rectangle, one presence verdict — see D52 for why
-* this repo insists a derived value has exactly one implementation.
-*
-* `undefined` status ⇒ `sleeping`. A device with no slice has made no claim,
-* and the caller decides separately whether it is even battery-operated
-* (`DeviceFeature.BatteryOperated`); this function never answers that
-* question, only what a battery device is doing.
-*/
-function deriveBatteryPresence(input) {
-	const status = input.status;
-	if (!status) return "sleeping";
-	if (status.sleeping !== true) return "awake";
-	const lastContactAt = status.lastContactAt;
-	if (typeof lastContactAt !== "number" || lastContactAt <= 0) return "sleeping";
-	const budget = input.unreachableAfterMs ?? 216e5;
-	return input.nowMs - lastContactAt > budget ? "unreachable" : "sleeping";
-}
 /** Marker written to a declared integration's `info`. */
 var DECLARED_INTEGRATION_FIXED_KEY = "fixed";
 /**
@@ -40269,12 +40292,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"storage.getDefaultLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"storage.list": {
 		capName: "storage",
 		capScope: "system",
@@ -44265,4 +44282,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { foldSnapshotByFunction as $, hydrateSchema as $t, alertsCapability as A, storageProviderCapability as At, dataStoreProviderCapability as B, DeviceFeature as Bt, StorageCleanupJobSchema as C, scopesAllowAddon as Ct, addonPagesCapability as D, snapshotCapability as Dt, UserRecordSchema as E, settingsStoreCapability as Et, buildStreamParamsConfigSchema as F, errMsg as Ft, deviceStatusCapability as G, WELL_KNOWN_TAB_MAP as Gt, deriveBatteryPresence as H, DeviceType as Ht, collectSecretConfigKeys as I, BaseAddon as It, enumerateItemArrayFields as J, asString as Jt, doorbellCapability as K, asJsonObject as Kt, coreBlockAddonId as L, DATAPLANE_SECRET_HEADER as Lt, backupCapability as M, userManagementCapability as Mt, bareAddonId as N, vectorDimFromBase64 as Nt, addonSettingsCapability as O, storageCapability as Ot, batteryCapability as P, vectorStoreCapability as Pt, filesystemBrowseCapability as Q, expandCapMethods as Qt, coreBlockIdFromAddonId as R, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Rt, ScopedTokenSchema as S, runtimeStatePolicyFor as St, StorageMigrationJobSchema as T, scoreRuntimes as Tt, deviceManagerCapability as U, ReadinessRegistry as Ut, decodeVectorBase64 as V, DeviceRole as Vt, deviceStateCapability as W, ReadinessTimeoutError as Wt, evaluateSensorEdge as X, emitDownForOwnedCaps as Xt, enumerateSchemaFields as Y, createEvent as Yt, extractNestedAddonId as Z, emitReadiness as Zt, RecordingStatusSchema as _, procedureAuthKey as _t, CAMERA_SWITCH_ORDER as a, resolveCapMount as an, isVoidInput as at, STORAGE_ACCESS_FALLBACK as b, resolveContainerPrimaryChild as bt, CORE_BLOCK_ADDON_PREFIX as c, EventCategory as cn, localNetworkCapability as ct, DeclaredDevices as d, looseSchema as dt, isDeviceConfigCap as en, isArrayOutputSchema as et, DeviceStatusSchema as f, metricsProviderCapability as ft, RUNTIME_DEFAULTS as g, platformProbeCapability as gt, REDACTED_SECRET as h, parseStreamParamsFormPatch as ht, BatteryStatusSchema as i, readinessKey as in, isSourceCap as it, authProviderCapability as j, streamQualityLabel as jt, addonWidgetsCapability as k, storageMigrationCapability as kt, CoreBlockSchema as l, logDestinationCapability as lt, METHOD_ACCESS_MAP as m, objectInputDeclaresAddonId as mt, AlertSchema as n, parseJsonObject as nn, isObjectInput as nt, CAP_NAMES_WITH_STATUS as o, scopeKey as on, kebabToCamel as ot, LOG_LEVEL_RANK as p, normalizeUnit as pt, enumerateInferenceDevices as q, asNumber as qt, ApiKeyRecordSchema as r, parseJsonUnknown as rn, isSameAddonId as rt, CORE_BLOCKS_ADDON_ID as s, sleep as sn, lifecycleJobSchema as st, ALL_CAPABILITY_DEFINITIONS as t, nodePin as tn, isCollectionArrayMethod as tt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as u, logLevelAtMost as ut, SOURCE_CAPS as v, reducePoints as vt, StorageLocationTypeSchema as w, scopesAllowDeviceCap as wt, STREAM_PROFILE_META as x, resolveMethodAuth as xt, SOURCE_DEVICE_TYPES as y, resolveBucketMs as yt, coreBlocksCapability as z, DEVICE_STATUS_METHOD as zt };
+export { filesystemBrowseCapability as $, emitReadiness as $t, addonWidgetsCapability as A, storageCapability as At, coreBlocksCapability as B, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Bt, ScopedTokenSchema as C, resolveMethodAuth as Ct, UserRecordSchema as D, scoreRuntimes as Dt, StorageMigrationJobSchema as E, scopesAllowDeviceCap as Et, batteryCapability as F, vectorDimFromBase64 as Ft, deviceStateCapability as G, ReadinessRegistry as Gt, decodeVectorBase64 as H, DeviceFeature as Ht, buildStreamParamsConfigSchema as I, vectorStoreCapability as It, enumerateInferenceDevices as J, asJsonObject as Jt, deviceStatusCapability as K, ReadinessTimeoutError as Kt, collectSecretConfigKeys as L, errMsg as Lt, authProviderCapability as M, storageProviderCapability as Mt, backupCapability as N, streamQualityLabel as Nt, addonPagesCapability as O, settingsStoreCapability as Ot, bareAddonId as P, userManagementCapability as Pt, extractNestedAddonId as Q, emitDownForOwnedCaps as Qt, coreBlockAddonId as R, BaseAddon as Rt, STREAM_PROFILE_META as S, resolveContainerPrimaryChild as St, StorageLocationTypeSchema as T, scopesAllowAddon as Tt, deriveBatteryPresence as U, DeviceRole as Ut, dataStoreProviderCapability as V, DEVICE_STATUS_METHOD as Vt, deviceManagerCapability as W, DeviceType as Wt, enumerateSchemaFields as X, asString as Xt, enumerateItemArrayFields as Y, asNumber as Yt, evaluateSensorEdge as Z, createEvent as Zt, RUNTIME_DEFAULTS as _, parseStreamParamsFormPatch as _t, CAMERA_SWITCH_ORDER as a, parseJsonUnknown as an, isSameAddonId as at, SOURCE_DEVICE_TYPES as b, reducePoints as bt, CORE_BLOCK_ADDON_PREFIX as c, scopeKey as cn, kebabToCamel as ct, DeclaredDevices as d, logDestinationCapability as dt, expandCapMethods as en, foldSnapshotByFunction as et, DeviceStatusSchema as f, logLevelAtMost as ft, REDACTED_SECRET as g, objectInputDeclaresAddonId as gt, METHOD_ACCESS_MAP as h, normalizeUnit as ht, BatteryStatusSchema as i, parseJsonObject as in, isObjectInput as it, alertsCapability as j, storageMigrationCapability as jt, addonSettingsCapability as k, snapshotCapability as kt, CoreBlockSchema as l, sleep as ln, lifecycleJobSchema as lt, LegacyStorageLocationDefaultSchema as m, metricsProviderCapability as mt, AlertSchema as n, isDeviceConfigCap as nn, isCollectionArrayMethod as nt, CAP_NAMES_WITH_STATUS as o, readinessKey as on, isSourceCap as ot, LOG_LEVEL_RANK as p, looseSchema as pt, doorbellCapability as q, WELL_KNOWN_TAB_MAP as qt, ApiKeyRecordSchema as r, nodePin as rn, isLocationEnabled as rt, CORE_BLOCKS_ADDON_ID as s, resolveCapMount as sn, isVoidInput as st, ALL_CAPABILITY_DEFINITIONS as t, hydrateSchema as tn, isArrayOutputSchema as tt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as u, EventCategory as un, localNetworkCapability as ut, RecordingStatusSchema as v, platformProbeCapability as vt, StorageCleanupJobSchema as w, runtimeStatePolicyFor as wt, STORAGE_ACCESS_FALLBACK as x, resolveBucketMs as xt, SOURCE_CAPS as y, procedureAuthKey as yt, coreBlockIdFromAddonId as z, DATAPLANE_SECRET_HEADER as zt };