@camstack/types 1.2.161 → 1.2.162

package/dist/index.js

@@ -1432,378 +1432,6 @@ function logLevelAtMost(level, threshold) {
 	return LOG_LEVEL_RANK[level] <= LOG_LEVEL_RANK[threshold];
 }
 //#endregion
-//#region src/logging/log-channel.ts
-/**
-* Per-component log CHANNELS — the gate a hot path consults, and the registry
-* an addon declares its channels in.
-*
-* ## Two axes, deliberately separated
-*
-* - **DECLARATION** — which channels exist. Only the addon knows:
-*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
-*   baichuan/handshake. A hand-wired central list rots at the first addition,
-*   and rots silently. So a channel is declared where it is consulted, and the
-*   `log-channels` capability enumerates the declarations.
-* - **VALUE** — at which level, for which scope, until when. That stays ONE
-*   thing: the logging settings document on the `system` cap. Two authorities
-*   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
-*   remove; re-introducing it from the cure side would be grotesque.
-*
-* Nothing in this file reads a clock, an env var or a store. The registry is
-* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
-* the hot path with a value somebody actually read, and by
-* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
-* never reaches here, so it can neither disarm an armed channel nor arm a
-* disarmed one (D49).
-*
-* ## The canonical call shape
-*
-* ```ts
-* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
-*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
-* }
-* ```
-*
-* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
-* read. Disarmed, a call site costs one load and one branch, and the `extras`
-* object literal is never constructed because it lives inside the branch. It
-* is the same shape already proven in production at `stream-broker.ts:1650`,
-* and the same discipline `LoggingGate.allowsDestination` uses for the
-* destination floor (measured at 1.93 ns/call when off).
-*
-* ## Why a channel emits at `info`
-*
-* `loki-logging.addon.ts` pins the destination default at `info` and
-* `loki-destination.ts` drops everything below it, so a line emitted at
-* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
-* minutes. A diagnostic that cannot be read an hour later is worse than no
-* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
-* emits at the channel's declared level, whose schema floor is `info`.
-*/
-/**
-* The level a channel writes at once armed.
-*
-* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
-* not leave the process for Loki, and the whole point of arming a channel is
-* to read it later.
-*/
-var LogChannelLevelSchema = zod.z.enum([
-	"info",
-	"warn",
-	"error"
-]);
-/**
-* What an addon declares about one channel. No value, no state — a
-* declaration is inert.
-*/
-var LogChannelDescriptorSchema = zod.z.object({
-	/**
-	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
-	* the addon's short name so an operator reading a channel list can tell who
-	* owns it without a second lookup.
-	*/
-	name: zod.z.string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
-	/** One sentence: what the operator will SEE after arming it. */
-	description: zod.z.string().min(1),
-	/** The level its lines are emitted at. Never below `info`. */
-	defaultLevel: LogChannelLevelSchema,
-	/**
-	* Whether this channel can be narrowed to a camera.
-	*
-	* `true` is a PROMISE with two halves, and both must hold: the gate is
-	* consulted with the numeric device id, AND every line the channel admits
-	* carries `tags: { deviceId }` with that same numeric id. The second half is
-	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
-	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
-	* the body is the only way to filter.
-	*
-	* A channel whose lines carry the device only in `meta` (or not at all) is
-	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
-	* the operator narrows to one camera, sees nothing, and concludes the code
-	* path was never taken.
-	*/
-	perDevice: zod.z.boolean()
-});
-/**
-* An armed window over one channel, as the document hands it to a mirror.
-*
-* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
-* expires by itself, which is the one failure a boolean cannot avoid.
-*/
-var LogChannelWindowSchema = zod.z.object({
-	channel: zod.z.string().min(1),
-	/** Epoch ms the window closes at. */
-	armedUntilMs: zod.z.number(),
-	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
-	deviceIds: zod.z.array(zod.z.number().int()).readonly().nullable()
-});
-/**
-* The gate a hot path holds.
-*
-* Obtain it ONCE — at module scope or in a constructor — and keep the
-* reference. Looking a channel up by name per line would put a Map lookup on
-* the path this class exists to keep free.
-*/
-var LogChannelGate = class {
-	descriptor;
-	/**
-	* HOT PATH GUARD. A plain data FIELD, and it must stay one.
-	*
-	* `log-channel.spec.ts` asserts the property descriptor has no getter and
-	* booby-traps the device set, so turning this into an accessor — or reading
-	* anything before it — fails the spec instead of taxing every line the
-	* process emits.
-	*/
-	on = false;
-	/** `null` while armed for every camera. Never read while `on` is false. */
-	devices = null;
-	level;
-	closesAtMs = 0;
-	constructor(descriptor) {
-		this.descriptor = descriptor;
-		this.level = descriptor.defaultLevel;
-	}
-	/** Epoch ms this channel disarms itself at. 0 when disarmed. */
-	get armedUntilMs() {
-		return this.on ? this.closesAtMs : 0;
-	}
-	/**
-	* Does this channel want a line about `deviceId`?
-	*
-	* Call it only behind `gate.on &&`. On its own it is still correct — the
-	* guard is repeated inside — but the point of the prefix is that a disarmed
-	* channel must not pay the call at all.
-	*/
-	wants(deviceId) {
-		if (!this.on) return false;
-		return this.devices === null || this.devices.has(deviceId);
-	}
-	/**
-	* Emit one line on this channel, at the channel's declared level.
-	*
-	* The channel name is added as `tags.logChannel` so LogQL can select the
-	* channel without matching on the message text, and whatever `tags` the
-	* caller passed — `deviceId` above all — is preserved.
-	*/
-	log(logger, message, extras) {
-		if (!this.on) return;
-		const tags = {
-			...extras.tags,
-			logChannel: this.descriptor.name
-		};
-		const line = {
-			...extras,
-			tags
-		};
-		if (this.level === "error") logger.error(message, line);
-		else if (this.level === "warn") logger.warn(message, line);
-		else logger.info(message, line);
-	}
-	/**
-	* Arm (or RE-arm, restarting) this channel. Off the hot path only.
-	*
-	* An empty `deviceIds` list is treated as "every camera" rather than "no
-	* camera": a window that matches nothing is indistinguishable from a
-	* disarmed one, and the operator who asked for it would wait for lines that
-	* can never come.
-	*/
-	arm(window) {
-		const ids = window.deviceIds;
-		this.devices = ids === null || ids.length === 0 ? null : new Set(ids);
-		this.closesAtMs = window.armedUntilMs;
-		this.on = true;
-	}
-	/** Disarm. Off the hot path only. */
-	disarm() {
-		this.on = false;
-		this.devices = null;
-		this.closesAtMs = 0;
-	}
-};
-/**
-* Every channel this PROCESS declares, and the mirror of what is armed on it.
-*
-* One per process. A forked runner has its own, and it is refreshed through
-* the `log-channels` capability by the hub that owns the document — the
-* registry never reaches for a value itself.
-*/
-var LogChannelRegistry = class {
-	gates = /* @__PURE__ */ new Map();
-	/**
-	* Declare a channel and get its gate.
-	*
-	* A duplicate name throws. Two declarations of one name is a programming
-	* error, not a merge: the operator would arm one and the other would stay
-	* dark, which is the dead-knob shape (D62) with an extra step.
-	*/
-	declare(descriptor) {
-		const parsed = LogChannelDescriptorSchema.parse(descriptor);
-		if (this.gates.get(parsed.name) !== void 0) throw new Error(`log channel "${parsed.name}" is already declared in this process — two declarations of one name is a programming error, not a merge`);
-		const gate = new LogChannelGate(parsed);
-		this.gates.set(parsed.name, gate);
-		return gate;
-	}
-	/** The declarations, sorted by name so a list is stable to read and diff. */
-	list() {
-		return [...this.gates.values()].map((gate) => gate.descriptor).sort((a, b) => a.name.localeCompare(b.name));
-	}
-	/** The gate for a declared channel, or `undefined`. */
-	gate(name) {
-		return this.gates.get(name);
-	}
-	/**
-	* Apply the FULL set of armed windows. Off the hot path.
-	*
-	* Full, not incremental, and that is the whole design: the document is the
-	* authority, so a channel the document does not name is disarmed here. An
-	* incremental apply would let a disarm get lost in transit and leave a
-	* channel running that nobody can see is running.
-	*
-	* A window already past its deadline is ignored rather than armed — a
-	* restore that re-armed an expired window would make a forgotten diagnostic
-	* immortal across restarts.
-	*
-	* Returns the names it could not place, so the caller can log them: a
-	* channel named in the document that this process does not declare is
-	* either a typo or an addon that has not booted yet, and both deserve a
-	* line rather than silence.
-	*/
-	apply(windows, nowMs) {
-		const wanted = /* @__PURE__ */ new Map();
-		const unknown = [];
-		for (const window of windows) {
-			if (window.armedUntilMs <= nowMs) continue;
-			if (!this.gates.has(window.channel)) {
-				unknown.push(window.channel);
-				continue;
-			}
-			wanted.set(window.channel, window);
-		}
-		for (const [name, gate] of this.gates) {
-			const window = wanted.get(name);
-			if (window === void 0) gate.disarm();
-			else gate.arm(window);
-		}
-		return unknown;
-	}
-	/**
-	* Disarm whatever has run out. Called on a timer, NEVER from a log path — a
-	* diagnostic that adds a `Date.now()` to the path it is measuring measures
-	* itself.
-	*
-	* Returns the names it closed, so the caller can write the one line that
-	* says a window ended and stops "it went quiet" from reading as "the branch
-	* was not taken".
-	*/
-	tick(nowMs) {
-		const closed = [];
-		for (const [name, gate] of this.gates) if (gate.on && gate.armedUntilMs <= nowMs) {
-			gate.disarm();
-			closed.push(name);
-		}
-		return closed;
-	}
-	/** The channels armed right now, as the document would describe them. */
-	armed() {
-		const out = [];
-		for (const [name, gate] of this.gates) if (gate.on) out.push({
-			channel: name,
-			armedUntilMs: gate.armedUntilMs,
-			deviceIds: null
-		});
-		return out;
-	}
-};
-//#endregion
-//#region src/logging/log-channel.singleton.ts
-/**
-* Process-wide holder for the {@link LogChannelRegistry}.
-*
-* Three call sites that never meet need the SAME instance: the hot paths that
-* declare a gate at module scope, the `log-channels` provider that enumerates
-* the declarations for the hub, and the same provider applying the windows the
-* document hands down. A registry built inside any one of them would be
-* refreshed and collected — the shape of a knob that never does anything.
-*
-* Same idiom as `logging-gate.singleton.ts` and
-* `http-request-census.singleton.ts`.
-*/
-var instance = null;
-/** The process-wide log channel registry. Created empty on first use. */
-function getLogChannelRegistry() {
-	instance ??= new LogChannelRegistry();
-	return instance;
-}
-/**
-* Declare a channel on the process-wide registry and get its gate.
-*
-* The one call an addon makes. Keep the returned gate in a module-scope
-* `const`: looking a channel up by name per line would put a Map lookup on
-* exactly the path this mechanism exists to keep free.
-*
-* `scripts/check-log-channel-gated.ts` reads these call sites. It pairs the
-* declared name with the binding it is assigned to and refuses to let a
-* channel ship that no `<binding>.on` anywhere consults — a declared channel
-* nobody reads is a knob the operator turns with nothing happening, forever,
-* and without a line. That is D62, and this repo has now shipped it three
-* times (`audioThresholdDbfs`, the HA entities with no source, the second
-* per-camera switch that wrote a store nobody read).
-*/
-function declareLogChannel(descriptor) {
-	return getLogChannelRegistry().declare(descriptor);
-}
-/** Test-only: drop the instance so a spec starts from an empty registry. */
-function __resetLogChannelRegistryForTests() {
-	instance = null;
-}
-//#endregion
-//#region src/logging/log-channel-provider.ts
-/**
-* How often expiry is noticed. Coarse on purpose: the cost of a channel
-* running a few seconds past its deadline is a few extra lines, and the cost
-* of a tight timer in every addon process is paid forever.
-*/
-var LOG_CHANNEL_TICK_MS = 5e3;
-/**
-* Build the `log-channels` provider for this process.
-*
-* `logger` is used ONLY off the hot path — for the arm/expiry lines — so a
-* channel that is never armed costs this module nothing but a timer.
-*/
-function createLogChannelsProvider(logger, options = {}) {
-	const registry = getLogChannelRegistry();
-	const now = options.now ?? Date.now;
-	const tickMs = options.tickMs ?? 5e3;
-	const timer = setInterval(() => {
-		const closed = registry.tick(now());
-		for (const name of closed) logger.info("log channel window closed", {
-			tags: { logChannel: name },
-			meta: { channel: name }
-		});
-	}, tickMs);
-	timer.unref?.();
-	return {
-		list: () => registry.list(),
-		apply: (input) => {
-			const unknown = registry.apply(input.windows, now());
-			const armed = registry.armed();
-			logger.info("log channels applied", { meta: {
-				armed: armed.map((window) => window.channel),
-				unknown,
-				declared: registry.list().length
-			} });
-			return {
-				armed: armed.length,
-				unknown
-			};
-		},
-		stop: () => {
-			clearInterval(timer);
-		}
-	};
-}
-//#endregion
 //#region src/interfaces/ops-log.ts
 /**
 * Ops-log — the durable, append-only operations audit shared by the
@@ -3041,8 +2669,11 @@ var StorageLocationTypeSchema = zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*$/);
 * `STORAGE_LOCATION_CARDINALITY` map has been removed.
 *
 * `id` is a stable namespaced string of the form `<type>:<slug>`.
-* The default location for a type uses `id === <type>:default` by
-* convention (the bare type ref like `'backups'` resolves to it).
+* The seed names its first instance `<type>:default` — a NAME, not a flag.
+* There is no default location any more (D383): `enabled` is the whole write
+* model, and a bare type ref resolves to the sole location of the type, or —
+* transitionally, only while legacy NULL-stamped rows exist — to the row whose
+* slug is `default`.
 *
 * `isSystem` is a legacy persisted flag. Seed still creates the initial
 * `<type>:default` locations; the flag is no longer a lock, a badge, or a
@@ -3063,21 +2694,20 @@ var StorageLocationSchema = zod.z.object({
 	* flag at upsert time, not here (the schema is provider-agnostic).
 	*/
 	nodeId: zod.z.string().optional(),
-	isDefault: zod.z.boolean().default(false),
 	isSystem: zod.z.boolean().default(false),
 	/**
-	* Operator opt-in: whether consumers that BALANCE across several locations
-	* of a type may write here. Recordings reads it today; event media and
-	* backups are the next consumers, which is why the flag lives on the
-	* location rather than in any one addon's store — nothing has to be
-	* extended to add the next consumer.
+	* THE write switch, and the only one (D383). `enabled: true` means every
+	* consumer that chooses a write target for this type may write here, and all
+	* enabled locations of a type are used TOGETHER; `false` means read-only —
+	* still read, still played back, still age-swept, still drained, never
+	* written.
 	*
-	* OPTIONAL, and ABSENT MEANS ACTIVE. Every location persisted before the
-	* flag existed reads back with no flag and keeps working exactly as before;
-	* that is the whole compat story, and it is why no migration ships with it.
-	* A newly CREATED sibling is stamped `false` by the orchestrator (creating a
-	* disk must not silently start writing to it); the default of a type is
-	* always stamped `true`.
+	* OPTIONAL only for the wire: an upsert that omits it means "leave what is
+	* stored" on an update and "born inert unless it is the first location of its
+	* type" on a create. On a PERSISTED row absence is legacy and it means
+	* enabled — {@link isLocationEnabled} is the one place that says so, and the
+	* orchestrator stamps every flagless row `true` once at hydrate so absence
+	* stops existing rather than being re-derived on every read.
 	*/
 	enabled: zod.z.boolean().optional(),
 	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
@@ -3091,9 +2721,31 @@ var StorageLocationSchema = zod.z.object({
 	updatedAt: zod.z.number()
 });
 /**
+* The retired `isDefault` key, DECLARED rather than dropped.
+*
+* A key removed from a non-strict `z.object` is stripped in silence (D380,
+* D381): a reader that still needs the old value gets `undefined` and cannot
+* tell "absent" from "never sent". The one reader that legitimately needs it —
+* the location store's boot migration, which turns the old default flag into
+* the `enabled` write set — parses THIS schema against the raw row instead, so
+* the migration is explicit and the live schema stays clean. Nothing else in
+* the repo may read it; `scripts/check-no-storage-default.ts` enforces that.
+*/
+var LegacyStorageLocationDefaultSchema = zod.z.object({ isDefault: zod.z.boolean().optional() });
+/**
+* Is this location a write target? THE one place that decides what an absent
+* `enabled` means on a persisted row — legacy rows predate the flag and were
+* active, so absence is enabled. Every consumer asks here rather than spelling
+* `enabled !== false` again, so the tri-state has exactly one interpretation.
+*/
+function isLocationEnabled(location) {
+	return location.enabled !== false;
+}
+/**
 * Reference accepted by consumer-facing `api.storage.*` calls.
 * Either:
-*  - a `StorageLocationType` (e.g. `'backups'`) → orchestrator resolves to the default of that type
+*  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
+*    (transitionally, the `<type>:default`-slugged row when several exist)
 *  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
 *
 * The orchestrator's `resolveRef(ref)` handles both cases.
@@ -3457,199 +3109,376 @@ function findTimezone(id) {
 	return TIMEZONES.find((tz) => tz.id === id);
 }
 //#endregion
-//#region src/stream-selection.ts
-function pickPreferredRtspEntry(entries, pref, deviceId, options = {}) {
-	if (entries.length === 0) return null;
-	const prefix = `${deviceId}/`;
-	const toPicked = (e) => ({
-		brokerId: e.brokerId,
-		profileId: e.brokerId.startsWith(prefix) ? e.brokerId.slice(prefix.length) : e.brokerId,
-		url: e.url,
-		mutedUrl: e.mutedUrl,
-		enabled: e.enabled,
-		...e.codec !== void 0 ? { codec: e.codec } : {},
-		...e.resolution !== void 0 ? { resolution: e.resolution } : {}
-	});
-	if (pref !== "auto") {
-		const match = entries.find((e) => e.enabled && e.url.length > 0 && (e.profile === pref || e.brokerId === `${prefix}${pref}`));
-		if (match) return toPicked(match);
-	}
-	const eligible = entries.filter((e) => e.enabled && e.url.length > 0);
-	if (eligible.length === 0) return null;
-	const target = options.targetResolution;
-	if (target) {
-		const withRes = eligible.filter((e) => e.resolution !== void 0);
-		if (withRes.length > 0) {
-			const picked = pickClosestResolution(withRes, target);
-			if (picked) return toPicked(picked);
-		}
-	}
-	return toPicked(eligible[0]);
-}
+//#region src/logging/log-channel.ts
 /**
-* Pick the entry whose `resolution` is closest to `target`. Prefer
-* entries ≥ target (downscale is cheap at the consumer; upscale is
-* lossy). Among the rest pick the LARGEST still ≤ target so the
-* consumer gets the best feasible quality. "Closeness" is the
-* `width × height` pixel delta.
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
 */
-function pickClosestResolution(entries, target) {
-	const targetPixels = target.width * target.height;
-	let bestAbove;
-	let bestBelow;
-	for (const e of entries) {
-		if (e.resolution === void 0) continue;
-		const pixels = e.resolution.width * e.resolution.height;
-		if (pixels >= targetPixels) {
-			if (!bestAbove || pixels < bestAbove.pixels) bestAbove = {
-				entry: e,
-				pixels
-			};
-		} else if (!bestBelow || pixels > bestBelow.pixels) bestBelow = {
-			entry: e,
-			pixels
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = zod.z.enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = zod.z.object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: zod.z.string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: zod.z.string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: zod.z.boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = zod.z.object({
+	channel: zod.z.string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: zod.z.number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: zod.z.array(zod.z.number().int()).readonly().nullable()
+});
+/**
+* The gate a hot path holds.
+*
+* Obtain it ONCE — at module scope or in a constructor — and keep the
+* reference. Looking a channel up by name per line would put a Map lookup on
+* the path this class exists to keep free.
+*/
+var LogChannelGate = class {
+	descriptor;
+	/**
+	* HOT PATH GUARD. A plain data FIELD, and it must stay one.
+	*
+	* `log-channel.spec.ts` asserts the property descriptor has no getter and
+	* booby-traps the device set, so turning this into an accessor — or reading
+	* anything before it — fails the spec instead of taxing every line the
+	* process emits.
+	*/
+	on = false;
+	/** `null` while armed for every camera. Never read while `on` is false. */
+	devices = null;
+	level;
+	closesAtMs = 0;
+	constructor(descriptor) {
+		this.descriptor = descriptor;
+		this.level = descriptor.defaultLevel;
+	}
+	/** Epoch ms this channel disarms itself at. 0 when disarmed. */
+	get armedUntilMs() {
+		return this.on ? this.closesAtMs : 0;
+	}
+	/**
+	* Does this channel want a line about `deviceId`?
+	*
+	* Call it only behind `gate.on &&`. On its own it is still correct — the
+	* guard is repeated inside — but the point of the prefix is that a disarmed
+	* channel must not pay the call at all.
+	*/
+	wants(deviceId) {
+		if (!this.on) return false;
+		return this.devices === null || this.devices.has(deviceId);
+	}
+	/**
+	* Emit one line on this channel, at the channel's declared level.
+	*
+	* The channel name is added as `tags.logChannel` so LogQL can select the
+	* channel without matching on the message text, and whatever `tags` the
+	* caller passed — `deviceId` above all — is preserved.
+	*/
+	log(logger, message, extras) {
+		if (!this.on) return;
+		const tags = {
+			...extras.tags,
+			logChannel: this.descriptor.name
 		};
+		const line = {
+			...extras,
+			tags
+		};
+		if (this.level === "error") logger.error(message, line);
+		else if (this.level === "warn") logger.warn(message, line);
+		else logger.info(message, line);
 	}
-	return bestAbove?.entry ?? bestBelow?.entry;
-}
-//#endregion
-//#region src/metrics/load-series-fold.ts
-/** Bucket key for rows no addon owns. Stable, so its series is continuous. */
-var UNATTRIBUTED_BUCKET_KEY = "__unattributed__";
-var ROOT_BUCKET_KEY = "__root__";
-function bucketFor(row) {
-	if (row.addonId !== null) return {
-		key: row.addonId,
-		kind: "addon"
-	};
-	if (row.classification === "root") return {
-		key: ROOT_BUCKET_KEY,
-		kind: "root"
-	};
-	return {
-		key: UNATTRIBUTED_BUCKET_KEY,
-		kind: "unattributed"
-	};
-}
-/** Round to one decimal — the precision both producers already emit at. */
-function deci(value) {
-	return Math.round(value * 10) / 10;
-}
+	/**
+	* Arm (or RE-arm, restarting) this channel. Off the hot path only.
+	*
+	* An empty `deviceIds` list is treated as "every camera" rather than "no
+	* camera": a window that matches nothing is indistinguishable from a
+	* disarmed one, and the operator who asked for it would wait for lines that
+	* can never come.
+	*/
+	arm(window) {
+		const ids = window.deviceIds;
+		this.devices = ids === null || ids.length === 0 ? null : new Set(ids);
+		this.closesAtMs = window.armedUntilMs;
+		this.on = true;
+	}
+	/** Disarm. Off the hot path only. */
+	disarm() {
+		this.on = false;
+		this.devices = null;
+		this.closesAtMs = 0;
+	}
+};
 /**
-* Fold one snapshot into one point per function.
+* Every channel this PROCESS declares, and the mirror of what is armed on it.
 *
-* Produces a ONE-SAMPLE point: `min === max` on every field, `samples === 1`.
-* That is what lets a live event and a reduced server bucket sit in the same
-* series without the consumer knowing which is which.
+* One per process. A forked runner has its own, and it is refreshed through
+* the `log-channels` capability by the hub that owns the document — the
+* registry never reaches for a value itself.
 */
-function foldSnapshotByFunction(rows, atMs) {
-	const acc = /* @__PURE__ */ new Map();
-	for (const row of rows) {
-		const { key, kind } = bucketFor(row);
-		const cur = acc.get(key) ?? {
-			kind,
-			main: 0,
-			gc: 0,
-			lifetime: 0,
-			memory: 0,
-			count: 0,
-			splitKnown: true
-		};
-		const known = row.cpuMainPercent !== null && row.cpuGcPercent !== null;
-		acc.set(key, {
-			kind: cur.kind,
-			main: cur.main + (row.cpuMainPercent ?? 0),
-			gc: cur.gc + (row.cpuGcPercent ?? 0),
-			lifetime: cur.lifetime + row.cpuPercent,
-			memory: cur.memory + row.memoryRssBytes,
-			count: cur.count + 1,
-			splitKnown: cur.splitKnown && known
-		});
+var LogChannelRegistry = class {
+	gates = /* @__PURE__ */ new Map();
+	/**
+	* Declare a channel and get its gate.
+	*
+	* A duplicate name throws. Two declarations of one name is a programming
+	* error, not a merge: the operator would arm one and the other would stay
+	* dark, which is the dead-knob shape (D62) with an extra step.
+	*/
+	declare(descriptor) {
+		const parsed = LogChannelDescriptorSchema.parse(descriptor);
+		if (this.gates.get(parsed.name) !== void 0) throw new Error(`log channel "${parsed.name}" is already declared in this process — two declarations of one name is a programming error, not a merge`);
+		const gate = new LogChannelGate(parsed);
+		this.gates.set(parsed.name, gate);
+		return gate;
 	}
-	return [...acc.entries()].map(([key, a]) => {
-		const main = a.splitKnown ? deci(a.main) : null;
-		const gc = a.splitKnown ? deci(a.gc) : null;
-		const lifetime = deci(a.lifetime);
-		return {
-			key,
-			kind: a.kind,
-			point: {
-				atMs,
-				samples: 1,
-				cpuMainPercent: main,
-				cpuMainPercentMin: main,
-				cpuGcPercent: gc,
-				cpuGcPercentMin: gc,
-				cpuLifetimePercent: lifetime,
-				cpuLifetimePercentMin: lifetime,
-				memoryRssBytes: a.memory,
-				memoryRssBytesMin: a.memory,
-				processCount: a.count,
-				processCountMin: a.count
+	/** The declarations, sorted by name so a list is stable to read and diff. */
+	list() {
+		return [...this.gates.values()].map((gate) => gate.descriptor).sort((a, b) => a.name.localeCompare(b.name));
+	}
+	/** The gate for a declared channel, or `undefined`. */
+	gate(name) {
+		return this.gates.get(name);
+	}
+	/**
+	* Apply the FULL set of armed windows. Off the hot path.
+	*
+	* Full, not incremental, and that is the whole design: the document is the
+	* authority, so a channel the document does not name is disarmed here. An
+	* incremental apply would let a disarm get lost in transit and leave a
+	* channel running that nobody can see is running.
+	*
+	* A window already past its deadline is ignored rather than armed — a
+	* restore that re-armed an expired window would make a forgotten diagnostic
+	* immortal across restarts.
+	*
+	* Returns the names it could not place, so the caller can log them: a
+	* channel named in the document that this process does not declare is
+	* either a typo or an addon that has not booted yet, and both deserve a
+	* line rather than silence.
+	*/
+	apply(windows, nowMs) {
+		const wanted = /* @__PURE__ */ new Map();
+		const unknown = [];
+		for (const window of windows) {
+			if (window.armedUntilMs <= nowMs) continue;
+			if (!this.gates.has(window.channel)) {
+				unknown.push(window.channel);
+				continue;
 			}
-		};
-	});
-}
-/** The narrower of two bounds, treating `null` (UNKNOWN) as absorbing. */
-function minNullable(a, b) {
-	if (a === null || b === null) return null;
-	return a < b ? a : b;
-}
-function maxNullable(a, b) {
-	if (a === null || b === null) return null;
-	return a > b ? a : b;
-}
-/** Merge `next` into `held`, keeping the widest [min, max] of each field. */
-function mergePoints(held, next, atMs) {
-	return {
-		atMs,
-		samples: held.samples + next.samples,
-		cpuMainPercent: maxNullable(held.cpuMainPercent, next.cpuMainPercent),
-		cpuMainPercentMin: minNullable(held.cpuMainPercentMin, next.cpuMainPercentMin),
-		cpuGcPercent: maxNullable(held.cpuGcPercent, next.cpuGcPercent),
-		cpuGcPercentMin: minNullable(held.cpuGcPercentMin, next.cpuGcPercentMin),
-		cpuLifetimePercent: Math.max(held.cpuLifetimePercent, next.cpuLifetimePercent),
-		cpuLifetimePercentMin: Math.min(held.cpuLifetimePercentMin, next.cpuLifetimePercentMin),
-		memoryRssBytes: Math.max(held.memoryRssBytes, next.memoryRssBytes),
-		memoryRssBytesMin: Math.min(held.memoryRssBytesMin, next.memoryRssBytesMin),
-		processCount: Math.max(held.processCount, next.processCount),
-		processCountMin: Math.min(held.processCountMin, next.processCountMin)
-	};
+			wanted.set(window.channel, window);
+		}
+		for (const [name, gate] of this.gates) {
+			const window = wanted.get(name);
+			if (window === void 0) gate.disarm();
+			else gate.arm(window);
+		}
+		return unknown;
+	}
+	/**
+	* Disarm whatever has run out. Called on a timer, NEVER from a log path — a
+	* diagnostic that adds a `Date.now()` to the path it is measuring measures
+	* itself.
+	*
+	* Returns the names it closed, so the caller can write the one line that
+	* says a window ended and stops "it went quiet" from reading as "the branch
+	* was not taken".
+	*/
+	tick(nowMs) {
+		const closed = [];
+		for (const [name, gate] of this.gates) if (gate.on && gate.armedUntilMs <= nowMs) {
+			gate.disarm();
+			closed.push(name);
+		}
+		return closed;
+	}
+	/** The channels armed right now, as the document would describe them. */
+	armed() {
+		const out = [];
+		for (const [name, gate] of this.gates) if (gate.on) out.push({
+			channel: name,
+			armedUntilMs: gate.armedUntilMs,
+			deviceIds: null
+		});
+		return out;
+	}
+};
+//#endregion
+//#region src/logging/log-channel.singleton.ts
+/**
+* Process-wide holder for the {@link LogChannelRegistry}.
+*
+* Three call sites that never meet need the SAME instance: the hot paths that
+* declare a gate at module scope, the `log-channels` provider that enumerates
+* the declarations for the hub, and the same provider applying the windows the
+* document hands down. A registry built inside any one of them would be
+* refreshed and collected — the shape of a knob that never does anything.
+*
+* Same idiom as `logging-gate.singleton.ts` and
+* `http-request-census.singleton.ts`.
+*/
+var instance = null;
+/** The process-wide log channel registry. Created empty on first use. */
+function getLogChannelRegistry() {
+	instance ??= new LogChannelRegistry();
+	return instance;
 }
 /**
-* The bucket width that brings `spanMs` down to at most `maxPoints` points,
-* snapped up to a whole multiple of the sampling cadence.
+* Declare a channel on the process-wide registry and get its gate.
 *
-* Returns `cadenceMs` (no reduction) when the span already fits. A caller that
-* asks for a `maxPoints` of 0 or less gets no reduction rather than an
-* infinite bucket — a nonsensical request must not produce a plausible chart.
+* The one call an addon makes. Keep the returned gate in a module-scope
+* `const`: looking a channel up by name per line would put a Map lookup on
+* exactly the path this mechanism exists to keep free.
+*
+* `scripts/check-log-channel-gated.ts` reads these call sites. It pairs the
+* declared name with the binding it is assigned to and refuses to let a
+* channel ship that no `<binding>.on` anywhere consults — a declared channel
+* nobody reads is a knob the operator turns with nothing happening, forever,
+* and without a line. That is D62, and this repo has now shipped it three
+* times (`audioThresholdDbfs`, the HA entities with no source, the second
+* per-camera switch that wrote a store nobody read).
 */
-function resolveBucketMs(spanMs, cadenceMs, maxPoints) {
-	if (maxPoints <= 0 || cadenceMs <= 0 || spanMs <= 0) return Math.max(cadenceMs, 1);
-	const wanted = spanMs / maxPoints;
-	if (wanted <= cadenceMs) return cadenceMs;
-	return Math.ceil(wanted / cadenceMs) * cadenceMs;
+function declareLogChannel(descriptor) {
+	return getLogChannelRegistry().declare(descriptor);
 }
+/** Test-only: drop the instance so a spec starts from an empty registry. */
+function __resetLogChannelRegistryForTests() {
+	instance = null;
+}
+//#endregion
+//#region src/logging/log-channel-provider.ts
 /**
-* Reduce one function's points into buckets of `bucketMs`, preserving the
-* extremes.
+* How often expiry is noticed. Coarse on purpose: the cost of a channel
+* running a few seconds past its deadline is a few extra lines, and the cost
+* of a tight timer in every addon process is paid forever.
+*/
+var LOG_CHANNEL_TICK_MS = 5e3;
+/**
+* Build the `log-channels` provider for this process.
 *
-* Points are expected oldest-first and are returned oldest-first. A bucket
-* with no samples is ABSENT — not zero, not interpolated, not the previous
-* value held over.
+* `logger` is used ONLY off the hot path — for the arm/expiry lines — so a
+* channel that is never armed costs this module nothing but a timer.
 */
-function reducePoints(points, bucketMs, origin) {
-	if (bucketMs <= 0 || points.length === 0) return points;
-	const buckets = /* @__PURE__ */ new Map();
-	for (const point of points) {
-		const start = origin + Math.floor((point.atMs - origin) / bucketMs) * bucketMs;
-		const held = buckets.get(start);
-		buckets.set(start, held === void 0 ? {
-			...point,
-			atMs: start
-		} : mergePoints(held, point, start));
-	}
-	return [...buckets.values()].toSorted((a, b) => a.atMs - b.atMs);
+function createLogChannelsProvider(logger, options = {}) {
+	const registry = getLogChannelRegistry();
+	const now = options.now ?? Date.now;
+	const tickMs = options.tickMs ?? 5e3;
+	const timer = setInterval(() => {
+		const closed = registry.tick(now());
+		for (const name of closed) logger.info("log channel window closed", {
+			tags: { logChannel: name },
+			meta: { channel: name }
+		});
+	}, tickMs);
+	timer.unref?.();
+	return {
+		list: () => registry.list(),
+		apply: (input) => {
+			const unknown = registry.apply(input.windows, now());
+			const armed = registry.armed();
+			logger.info("log channels applied", { meta: {
+				armed: armed.map((window) => window.channel),
+				unknown,
+				declared: registry.list().length
+			} });
+			return {
+				armed: armed.length,
+				unknown
+			};
+		},
+		stop: () => {
+			clearInterval(timer);
+		}
+	};
 }
 //#endregion
 //#region src/metrics/failure-counters.ts
@@ -3836,6 +3665,201 @@ function failureRate(sample) {
 	return (sample.attempts - sample.succeeded) / sample.attempts;
 }
 //#endregion
+//#region src/metrics/load-series-fold.ts
+/** Bucket key for rows no addon owns. Stable, so its series is continuous. */
+var UNATTRIBUTED_BUCKET_KEY = "__unattributed__";
+var ROOT_BUCKET_KEY = "__root__";
+function bucketFor(row) {
+	if (row.addonId !== null) return {
+		key: row.addonId,
+		kind: "addon"
+	};
+	if (row.classification === "root") return {
+		key: ROOT_BUCKET_KEY,
+		kind: "root"
+	};
+	return {
+		key: UNATTRIBUTED_BUCKET_KEY,
+		kind: "unattributed"
+	};
+}
+/** Round to one decimal — the precision both producers already emit at. */
+function deci(value) {
+	return Math.round(value * 10) / 10;
+}
+/**
+* Fold one snapshot into one point per function.
+*
+* Produces a ONE-SAMPLE point: `min === max` on every field, `samples === 1`.
+* That is what lets a live event and a reduced server bucket sit in the same
+* series without the consumer knowing which is which.
+*/
+function foldSnapshotByFunction(rows, atMs) {
+	const acc = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const { key, kind } = bucketFor(row);
+		const cur = acc.get(key) ?? {
+			kind,
+			main: 0,
+			gc: 0,
+			lifetime: 0,
+			memory: 0,
+			count: 0,
+			splitKnown: true
+		};
+		const known = row.cpuMainPercent !== null && row.cpuGcPercent !== null;
+		acc.set(key, {
+			kind: cur.kind,
+			main: cur.main + (row.cpuMainPercent ?? 0),
+			gc: cur.gc + (row.cpuGcPercent ?? 0),
+			lifetime: cur.lifetime + row.cpuPercent,
+			memory: cur.memory + row.memoryRssBytes,
+			count: cur.count + 1,
+			splitKnown: cur.splitKnown && known
+		});
+	}
+	return [...acc.entries()].map(([key, a]) => {
+		const main = a.splitKnown ? deci(a.main) : null;
+		const gc = a.splitKnown ? deci(a.gc) : null;
+		const lifetime = deci(a.lifetime);
+		return {
+			key,
+			kind: a.kind,
+			point: {
+				atMs,
+				samples: 1,
+				cpuMainPercent: main,
+				cpuMainPercentMin: main,
+				cpuGcPercent: gc,
+				cpuGcPercentMin: gc,
+				cpuLifetimePercent: lifetime,
+				cpuLifetimePercentMin: lifetime,
+				memoryRssBytes: a.memory,
+				memoryRssBytesMin: a.memory,
+				processCount: a.count,
+				processCountMin: a.count
+			}
+		};
+	});
+}
+/** The narrower of two bounds, treating `null` (UNKNOWN) as absorbing. */
+function minNullable(a, b) {
+	if (a === null || b === null) return null;
+	return a < b ? a : b;
+}
+function maxNullable(a, b) {
+	if (a === null || b === null) return null;
+	return a > b ? a : b;
+}
+/** Merge `next` into `held`, keeping the widest [min, max] of each field. */
+function mergePoints(held, next, atMs) {
+	return {
+		atMs,
+		samples: held.samples + next.samples,
+		cpuMainPercent: maxNullable(held.cpuMainPercent, next.cpuMainPercent),
+		cpuMainPercentMin: minNullable(held.cpuMainPercentMin, next.cpuMainPercentMin),
+		cpuGcPercent: maxNullable(held.cpuGcPercent, next.cpuGcPercent),
+		cpuGcPercentMin: minNullable(held.cpuGcPercentMin, next.cpuGcPercentMin),
+		cpuLifetimePercent: Math.max(held.cpuLifetimePercent, next.cpuLifetimePercent),
+		cpuLifetimePercentMin: Math.min(held.cpuLifetimePercentMin, next.cpuLifetimePercentMin),
+		memoryRssBytes: Math.max(held.memoryRssBytes, next.memoryRssBytes),
+		memoryRssBytesMin: Math.min(held.memoryRssBytesMin, next.memoryRssBytesMin),
+		processCount: Math.max(held.processCount, next.processCount),
+		processCountMin: Math.min(held.processCountMin, next.processCountMin)
+	};
+}
+/**
+* The bucket width that brings `spanMs` down to at most `maxPoints` points,
+* snapped up to a whole multiple of the sampling cadence.
+*
+* Returns `cadenceMs` (no reduction) when the span already fits. A caller that
+* asks for a `maxPoints` of 0 or less gets no reduction rather than an
+* infinite bucket — a nonsensical request must not produce a plausible chart.
+*/
+function resolveBucketMs(spanMs, cadenceMs, maxPoints) {
+	if (maxPoints <= 0 || cadenceMs <= 0 || spanMs <= 0) return Math.max(cadenceMs, 1);
+	const wanted = spanMs / maxPoints;
+	if (wanted <= cadenceMs) return cadenceMs;
+	return Math.ceil(wanted / cadenceMs) * cadenceMs;
+}
+/**
+* Reduce one function's points into buckets of `bucketMs`, preserving the
+* extremes.
+*
+* Points are expected oldest-first and are returned oldest-first. A bucket
+* with no samples is ABSENT — not zero, not interpolated, not the previous
+* value held over.
+*/
+function reducePoints(points, bucketMs, origin) {
+	if (bucketMs <= 0 || points.length === 0) return points;
+	const buckets = /* @__PURE__ */ new Map();
+	for (const point of points) {
+		const start = origin + Math.floor((point.atMs - origin) / bucketMs) * bucketMs;
+		const held = buckets.get(start);
+		buckets.set(start, held === void 0 ? {
+			...point,
+			atMs: start
+		} : mergePoints(held, point, start));
+	}
+	return [...buckets.values()].toSorted((a, b) => a.atMs - b.atMs);
+}
+//#endregion
+//#region src/stream-selection.ts
+function pickPreferredRtspEntry(entries, pref, deviceId, options = {}) {
+	if (entries.length === 0) return null;
+	const prefix = `${deviceId}/`;
+	const toPicked = (e) => ({
+		brokerId: e.brokerId,
+		profileId: e.brokerId.startsWith(prefix) ? e.brokerId.slice(prefix.length) : e.brokerId,
+		url: e.url,
+		mutedUrl: e.mutedUrl,
+		enabled: e.enabled,
+		...e.codec !== void 0 ? { codec: e.codec } : {},
+		...e.resolution !== void 0 ? { resolution: e.resolution } : {}
+	});
+	if (pref !== "auto") {
+		const match = entries.find((e) => e.enabled && e.url.length > 0 && (e.profile === pref || e.brokerId === `${prefix}${pref}`));
+		if (match) return toPicked(match);
+	}
+	const eligible = entries.filter((e) => e.enabled && e.url.length > 0);
+	if (eligible.length === 0) return null;
+	const target = options.targetResolution;
+	if (target) {
+		const withRes = eligible.filter((e) => e.resolution !== void 0);
+		if (withRes.length > 0) {
+			const picked = pickClosestResolution(withRes, target);
+			if (picked) return toPicked(picked);
+		}
+	}
+	return toPicked(eligible[0]);
+}
+/**
+* Pick the entry whose `resolution` is closest to `target`. Prefer
+* entries ≥ target (downscale is cheap at the consumer; upscale is
+* lossy). Among the rest pick the LARGEST still ≤ target so the
+* consumer gets the best feasible quality. "Closeness" is the
+* `width × height` pixel delta.
+*/
+function pickClosestResolution(entries, target) {
+	const targetPixels = target.width * target.height;
+	let bestAbove;
+	let bestBelow;
+	for (const e of entries) {
+		if (e.resolution === void 0) continue;
+		const pixels = e.resolution.width * e.resolution.height;
+		if (pixels >= targetPixels) {
+			if (!bestAbove || pixels < bestAbove.pixels) bestAbove = {
+				entry: e,
+				pixels
+			};
+		} else if (!bestBelow || pixels > bestBelow.pixels) bestBelow = {
+			entry: e,
+			pixels
+		};
+	}
+	return bestAbove?.entry ?? bestBelow?.entry;
+}
+//#endregion
 //#region src/types/model-variant-groups.ts
 var FORMAT_KEYS = [
 	"onnx",
@@ -23148,7 +23172,6 @@ var storageCapability = {
 		}), zod.z.instanceof(Uint8Array)),
 		endDownload: require_sleep.method(zod.z.object({ downloadId: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
 		listLocations: require_sleep.method(zod.z.object({ type: StorageLocationTypeSchema.optional() }), zod.z.array(StorageLocationSchema).readonly()),
-		getDefaultLocation: require_sleep.method(zod.z.object({ type: StorageLocationTypeSchema }), StorageLocationSchema.nullable()),
 		listLocationDeclarations: require_sleep.method(zod.z.void(), zod.z.array(StorageLocationDeclarationSchema).readonly()),
 		upsertLocation: require_sleep.method(StorageLocationSchema.omit({
 			createdAt: true,
@@ -36369,134 +36392,6 @@ var RUNTIME_DEFAULTS = {
 	"auth.tokenExpiry": "30d"
 };
 //#endregion
-//#region src/device/container-primary-child.ts
-/**
-* WHICH child a container stands for — one definition, for every consumer.
-*
-* A CONTAINER device has no controllable surface of its own: it groups entity
-* children (a Gree air-conditioner grouping a climate child plus light, x-fan
-* and health switches). Everything that has to show or act on a container has
-* to answer the same question — which child IS the container — and until now
-* three places answered it separately:
-*
-*   - `ui-library/device-controls/primary-child.ts`   (admin-ui rendering)
-*   - `addon-provider-homeassistant` PARENT_TYPE_PRIORITY (adoption)
-*   - the viewer's own `container-primary.ts`         (linked-devices panel)
-*
-* Each carried the same list and a comment asking the others to stay in sync.
-* This is that list, in the one package all of them already depend on.
-*
-* `ui-library` and the server's linked-devices expansion IMPORT it. Two
-* consumers cannot, and keep a checked copy instead: the viewer resolves
-* `@camstack/types` from its own `node_modules` (an installed release, where a
-* newly added export simply is not there), and the Home Assistant provider
-* expresses the same precedence over the `DeviceType` enum because it answers
-* a different question from the same ordering. `scripts/check-container-
-* priority-in-sync.ts` fails the build when either drifts — the comment that
-* used to ask for this could not.
-*
-* The rule has two halves and the ORDER matters: an operator's explicit pick
-* wins outright, and only in its absence does type priority decide. The pick is
-* keyed on the child's re-sync-stable `entityId`, not its numeric id, so it
-* survives a re-sync that reallocates ids.
-*/
-/**
-* Type priority, most→least "primary". An actuator (climate / lock / cover / …)
-* outranks a bare `switch` so a container's defining child wins over its
-* auxiliary switches. Unknown or absent types sort after every entry.
-*
-* NB: `siren` deliberately sits BELOW `switch` — it is a switch-family
-* actuator, and a camera's siren must not out-rank the thing the container is.
-*
-* These strings are matched against a child's `DeviceType` VALUE, so they must
-* equal the enum's string values.
-*/
-var CONTAINER_CHILD_PRIORITY = [
-	"media-player",
-	"alarm-panel",
-	"thermostat",
-	"climate",
-	"humidifier",
-	"water-heater",
-	"lock",
-	"cover",
-	"valve",
-	"fan",
-	"vacuum",
-	"lawn-mower",
-	"light",
-	"switch",
-	"siren",
-	"button",
-	"control",
-	"notifier",
-	"script",
-	"automation",
-	"update",
-	"presence",
-	"weather",
-	"image",
-	"sensor"
-];
-/**
-* Roles that say what a container IS, most→least defining. Consulted BEFORE
-* type priority, because `DeviceType` cannot tell them apart: Home Assistant
-* maps a door contact, a battery level, a temperature reading and a "last seen"
-* timestamp all to `DeviceType.Sensor`. Measured on container 4127 — children
-* `battery-sensor`, `temperature-sensor`, `datetime-sensor`, `contact-sensor`
-* and a role-less `button` — the type list ranked `button` above `sensor` and
-* the container stood for its "Identifica" button instead of the door contact
-* it is named after.
-*
-* Only STATE-DEFINING roles belong here. A diagnostic reading (battery,
-* temperature, humidity, signal, last-seen) is never what a container is, so
-* they are deliberately absent and fall through to type priority.
-*/
-var CONTAINER_CHILD_ROLE_PRIORITY = [
-	"contact-sensor",
-	"motion-sensor",
-	"occupancy-sensor",
-	"smoke-sensor",
-	"co-sensor",
-	"gas-sensor",
-	"leak-sensor",
-	"vibration-sensor",
-	"tamper-sensor",
-	"sound-sensor"
-];
-/**
-* NOT in the list, deliberately: `binary-sensor` and `binary-helper`. They are
-* GENERIC — they say "this reports a boolean", not what the container is — and
-* ranking them above type priority is a live regression, not a hypothetical:
-* container 1837 holds a real `lock` (features `['lock-open']`) alongside a
-* child named "Actuator" whose only role is `binary-sensor`, and the generic
-* role beat the lock. A role earns a place here by naming a SUBJECT (a contact,
-* a leak, smoke), never by naming a datatype.
-*/
-function roleRank(role) {
-	if (role === void 0) return CONTAINER_CHILD_ROLE_PRIORITY.length;
-	const i = CONTAINER_CHILD_ROLE_PRIORITY.indexOf(role);
-	return i === -1 ? CONTAINER_CHILD_ROLE_PRIORITY.length : i;
-}
-function rank(type) {
-	const i = CONTAINER_CHILD_PRIORITY.indexOf(type);
-	return i === -1 ? CONTAINER_CHILD_PRIORITY.length : i;
-}
-/**
-* The child a container stands for: the operator's pick when it still exists,
-* else the highest-priority type. `null` for a childless container — a caller
-* must decide what an empty container means for it, rather than being handed a
-* child that is not there.
-*/
-function resolveContainerPrimaryChild(children, overrideEntityId, containerName) {
-	if (overrideEntityId !== void 0 && overrideEntityId !== null) {
-		const picked = children.find((c) => c.stableId === overrideEntityId) ?? children.find((c) => c.entityId !== void 0 && c.entityId === overrideEntityId);
-		if (picked !== void 0) return picked;
-	}
-	const namesake = (c) => containerName !== void 0 && containerName.length > 0 && c.name !== void 0 && c.name.toLowerCase() === containerName.toLowerCase() ? 0 : 1;
-	return [...children].toSorted((a, b) => roleRank(a.role) - roleRank(b.role) || namesake(a) - namesake(b) || rank(a.type) - rank(b.type))[0] ?? null;
-}
-//#endregion
 //#region src/device/accessory.ts
 /**
 * Accessory device helpers — shared across drivers.
@@ -38082,6 +37977,134 @@ function isBatteryPresenceFault(presence) {
 	return presence === "unreachable";
 }
 //#endregion
+//#region src/device/container-primary-child.ts
+/**
+* WHICH child a container stands for — one definition, for every consumer.
+*
+* A CONTAINER device has no controllable surface of its own: it groups entity
+* children (a Gree air-conditioner grouping a climate child plus light, x-fan
+* and health switches). Everything that has to show or act on a container has
+* to answer the same question — which child IS the container — and until now
+* three places answered it separately:
+*
+*   - `ui-library/device-controls/primary-child.ts`   (admin-ui rendering)
+*   - `addon-provider-homeassistant` PARENT_TYPE_PRIORITY (adoption)
+*   - the viewer's own `container-primary.ts`         (linked-devices panel)
+*
+* Each carried the same list and a comment asking the others to stay in sync.
+* This is that list, in the one package all of them already depend on.
+*
+* `ui-library` and the server's linked-devices expansion IMPORT it. Two
+* consumers cannot, and keep a checked copy instead: the viewer resolves
+* `@camstack/types` from its own `node_modules` (an installed release, where a
+* newly added export simply is not there), and the Home Assistant provider
+* expresses the same precedence over the `DeviceType` enum because it answers
+* a different question from the same ordering. `scripts/check-container-
+* priority-in-sync.ts` fails the build when either drifts — the comment that
+* used to ask for this could not.
+*
+* The rule has two halves and the ORDER matters: an operator's explicit pick
+* wins outright, and only in its absence does type priority decide. The pick is
+* keyed on the child's re-sync-stable `entityId`, not its numeric id, so it
+* survives a re-sync that reallocates ids.
+*/
+/**
+* Type priority, most→least "primary". An actuator (climate / lock / cover / …)
+* outranks a bare `switch` so a container's defining child wins over its
+* auxiliary switches. Unknown or absent types sort after every entry.
+*
+* NB: `siren` deliberately sits BELOW `switch` — it is a switch-family
+* actuator, and a camera's siren must not out-rank the thing the container is.
+*
+* These strings are matched against a child's `DeviceType` VALUE, so they must
+* equal the enum's string values.
+*/
+var CONTAINER_CHILD_PRIORITY = [
+	"media-player",
+	"alarm-panel",
+	"thermostat",
+	"climate",
+	"humidifier",
+	"water-heater",
+	"lock",
+	"cover",
+	"valve",
+	"fan",
+	"vacuum",
+	"lawn-mower",
+	"light",
+	"switch",
+	"siren",
+	"button",
+	"control",
+	"notifier",
+	"script",
+	"automation",
+	"update",
+	"presence",
+	"weather",
+	"image",
+	"sensor"
+];
+/**
+* Roles that say what a container IS, most→least defining. Consulted BEFORE
+* type priority, because `DeviceType` cannot tell them apart: Home Assistant
+* maps a door contact, a battery level, a temperature reading and a "last seen"
+* timestamp all to `DeviceType.Sensor`. Measured on container 4127 — children
+* `battery-sensor`, `temperature-sensor`, `datetime-sensor`, `contact-sensor`
+* and a role-less `button` — the type list ranked `button` above `sensor` and
+* the container stood for its "Identifica" button instead of the door contact
+* it is named after.
+*
+* Only STATE-DEFINING roles belong here. A diagnostic reading (battery,
+* temperature, humidity, signal, last-seen) is never what a container is, so
+* they are deliberately absent and fall through to type priority.
+*/
+var CONTAINER_CHILD_ROLE_PRIORITY = [
+	"contact-sensor",
+	"motion-sensor",
+	"occupancy-sensor",
+	"smoke-sensor",
+	"co-sensor",
+	"gas-sensor",
+	"leak-sensor",
+	"vibration-sensor",
+	"tamper-sensor",
+	"sound-sensor"
+];
+/**
+* NOT in the list, deliberately: `binary-sensor` and `binary-helper`. They are
+* GENERIC — they say "this reports a boolean", not what the container is — and
+* ranking them above type priority is a live regression, not a hypothetical:
+* container 1837 holds a real `lock` (features `['lock-open']`) alongside a
+* child named "Actuator" whose only role is `binary-sensor`, and the generic
+* role beat the lock. A role earns a place here by naming a SUBJECT (a contact,
+* a leak, smoke), never by naming a datatype.
+*/
+function roleRank(role) {
+	if (role === void 0) return CONTAINER_CHILD_ROLE_PRIORITY.length;
+	const i = CONTAINER_CHILD_ROLE_PRIORITY.indexOf(role);
+	return i === -1 ? CONTAINER_CHILD_ROLE_PRIORITY.length : i;
+}
+function rank(type) {
+	const i = CONTAINER_CHILD_PRIORITY.indexOf(type);
+	return i === -1 ? CONTAINER_CHILD_PRIORITY.length : i;
+}
+/**
+* The child a container stands for: the operator's pick when it still exists,
+* else the highest-priority type. `null` for a childless container — a caller
+* must decide what an empty container means for it, rather than being handed a
+* child that is not there.
+*/
+function resolveContainerPrimaryChild(children, overrideEntityId, containerName) {
+	if (overrideEntityId !== void 0 && overrideEntityId !== null) {
+		const picked = children.find((c) => c.stableId === overrideEntityId) ?? children.find((c) => c.entityId !== void 0 && c.entityId === overrideEntityId);
+		if (picked !== void 0) return picked;
+	}
+	const namesake = (c) => containerName !== void 0 && containerName.length > 0 && c.name !== void 0 && c.name.toLowerCase() === containerName.toLowerCase() ? 0 : 1;
+	return [...children].toSorted((a, b) => roleRank(a.role) - roleRank(b.role) || namesake(a) - namesake(b) || rank(a.type) - rank(b.type))[0] ?? null;
+}
+//#endregion
 //#region src/device/declared-device.ts
 /** Marker written to a declared integration's `info`. */
 var DECLARED_INTEGRATION_FIXED_KEY = "fixed";
@@ -45648,12 +45671,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"storage.getDefaultLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"storage.list": {
 		capName: "storage",
 		capScope: "system",
@@ -50081,7 +50098,6 @@ function createSystemProxy(api) {
 			readChunk: (input) => dispatch("storage", "readChunk", "query", input),
 			endDownload: (input) => dispatch("storage", "endDownload", "mutation", input),
 			listLocations: (input) => dispatch("storage", "listLocations", "query", input),
-			getDefaultLocation: (input) => dispatch("storage", "getDefaultLocation", "query", input),
 			listLocationDeclarations: (input) => dispatch("storage", "listLocationDeclarations", "query", input),
 			upsertLocation: (input) => dispatch("storage", "upsertLocation", "mutation", input),
 			deleteLocation: (input) => dispatch("storage", "deleteLocation", "mutation", input),
@@ -54549,6 +54565,7 @@ exports.LedgerWalkRefusalSchema = LedgerWalkRefusalSchema;
 exports.LedgerWalkReportSchema = LedgerWalkReportSchema;
 exports.LedgerWalkSkipCountsSchema = LedgerWalkSkipCountsSchema;
 exports.LedgerWalkSkipReasonSchema = LedgerWalkSkipReasonSchema;
+exports.LegacyStorageLocationDefaultSchema = LegacyStorageLocationDefaultSchema;
 exports.LinkedDeviceSchema = LinkedDeviceSchema;
 exports.LinkedDevicesModeSchema = LinkedDevicesModeSchema;
 exports.LlmDefaultSchema = LlmDefaultSchema;
@@ -55401,6 +55418,7 @@ exports.isDeviceScopedCap = require_sleep.isDeviceScopedCap;
 exports.isEvent = require_sleep.isEvent;
 exports.isFirstLevelMacroClass = isFirstLevelMacroClass;
 exports.isIsolatedBuiltin = isIsolatedBuiltin;
+exports.isLocationEnabled = isLocationEnabled;
 exports.isNode = isNode;
 exports.isObjectInput = isObjectInput;
 exports.isOccupancyRule = isOccupancyRule;