@camstack/addon-ai 0.4.87 → 0.4.89

package/dist/addon.js

@@ -16108,16 +16108,16 @@ DeviceType.AlarmPanel, method(object({
 	code: string().min(1).optional()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	code: string().min(1).optional()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * Shared geometry vocabulary for on-frame shape caps — privacy-mask,
@@ -23772,7 +23772,7 @@ DeviceType.Light, method(object({
 	percentage: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), object({
 	deviceId: number$1(),
 	percentage: number$1().min(0).max(100),
@@ -23780,7 +23780,7 @@ DeviceType.Light, method(object({
 });
 DeviceType.Button, method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * camera-credentials — device-scoped cap exposing the camera's network
@@ -23939,50 +23939,50 @@ DeviceType.Thermostat, DeviceType.Climate, method(object({
 	mode: HvacModeSchema
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	fanMode: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	preset: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	target: number$1()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	targetLow: number$1(),
 	targetHigh: number$1()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	targetHumidity: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * Color-light cap. Coexists with `switch` (on/off) and `brightness`
@@ -24057,7 +24057,7 @@ DeviceType.Light, method(object({
 	color: ColorInputSchema
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), object({
 	deviceId: number$1(),
 	mode: _enum([
@@ -24206,7 +24206,7 @@ DeviceType.Control, method(object({
 	control: ControlSetValueInputSchema
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 object({
 	/** Lifecycle state of the cover. */
@@ -24227,25 +24227,25 @@ object({
 });
 DeviceType.Cover, method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	position: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	tiltPosition: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * Vendor-neutral day/night (IR-cut) control — the per-camera config cap
@@ -24450,6 +24450,59 @@ var IdentitySampleInfoSchema = object({
 	deviceId: number$1().int().optional(),
 	base64: string().optional()
 });
+/**
+* One enrolled sample, judged against the gallery it lives in.
+*
+* The gallery is the one input to recognition nobody re-reads: a sample
+* enrolled from the wrong face keeps voting forever, and because the matches it
+* pulls then look confident, nobody goes back. The 2026-09-08 audit found
+* exactly one such pair on this cluster — a sample scoring 0.61 against three
+* samples of ANOTHER person, enrolled from the same camera in the same minute,
+* where every other cross-identity pair sits under 0.50.
+*/
+var IdentitySampleAuditRowSchema = object({
+	sampleId: string(),
+	enrolledAt: number$1().int(),
+	deviceId: number$1().int().optional(),
+	source: _enum(["detected", "photo"]),
+	/** The enrolled crop's media key, so the panel can show the evidence. */
+	mediaKey: string().optional(),
+	/**
+	* False = the sample is stamped with a DIFFERENT face model, and a cosine
+	* across feature spaces is a well-formed float with no meaning. Every number
+	* below then says nothing — it must read as "cannot say", never as an
+	* accusation and never as a clean bill: this list ends in a Remove button.
+	*/
+	comparable: boolean(),
+	/** Mean cosine against this person's other samples. Null when there are none
+	*  to compare with — never 0, which would read as "opposite". */
+	selfMean: number$1().nullable(),
+	/** The other person this sample looks most like, when it looks like one.
+	*  This is the half that convicts: not looking like yourself can be a hard
+	*  angle; looking like someone the gallery can NAME is a mis-enrolment. */
+	bestForeign: object({
+		identityId: string(),
+		name: string(),
+		score: number$1()
+	}).optional(),
+	/** 0 = nothing to say. Higher = look at this one sooner. */
+	suspicion: number$1()
+});
+var IdentitySampleAuditSchema = object({
+	identityId: string(),
+	name: string(),
+	/** The cluster face model every comparison was made in. */
+	modelId: string(),
+	totalSamples: number$1().int(),
+	comparableSamples: number$1().int(),
+	flagged: number$1().int(),
+	/** The bar `flagged` counts against, so the panel states the RULE and not
+	*  only its current result. */
+	flagThreshold: number$1(),
+	/** Worst first. A row with nothing to say still appears, at the bottom: the
+	*  operator asked to see the gallery, not only its accusations. */
+	rows: array(IdentitySampleAuditRowSchema).readonly()
+});
 var FaceInfoSchema = object({
 	faceId: string(),
 	deviceId: number$1().int(),
@@ -24601,7 +24654,7 @@ includeCrops: boolean().optional() }).optional(), array(IdentitySchema).readonly
 }), method(object({ id: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ identityId: string() }), array(IdentitySampleInfoSchema).readonly()), method(object({
+}), method(object({ identityId: string() }), array(IdentitySampleInfoSchema).readonly()), method(object({ identityId: string().min(1) }), IdentitySampleAuditSchema, { auth: "admin" }), method(object({
 	identityId: string(),
 	sampleId: string()
 }), _void(), {
@@ -24787,25 +24840,25 @@ DeviceType.Fan, method(object({
 	percentage: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	preset: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	direction: FanDirectionSchema
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	oscillating: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * Per-device feature/identity probe slice. Holds the runtime-resolved
@@ -24908,19 +24961,19 @@ DeviceType.Humidifier, method(object({
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	humidity: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	mode: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 object({
 	/** Current relative humidity, 0..100. */
@@ -25382,13 +25435,13 @@ object({
 });
 DeviceType.LawnMower, method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * local-network — hub-only singleton.
@@ -25648,16 +25701,16 @@ DeviceType.Lock, method(object({
 	code: string().min(1).optional()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	code: string().min(1).optional()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * Media-player cap. Models HA `media_player.*` (Sonos, Chromecast,
@@ -25731,55 +25784,55 @@ object({
 });
 DeviceType.MediaPlayer, method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	positionMs: number$1().int().nonnegative()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	volumeLevel: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	muted: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	shuffle: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	repeat: MediaPlayerRepeatSchema
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	source: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	/** Media identifier / URL. */
@@ -25789,7 +25842,7 @@ DeviceType.MediaPlayer, method(object({ deviceId: number$1().int().nonnegative()
 	mediaType: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * mesh-network — collection cap for mesh-VPN providers.
@@ -26955,49 +27008,49 @@ DeviceType.PetFeeder, method(object({
 	hopper2: gramsPortion.optional()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	soundId: number$1().int().nonnegative()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	level: number$1().int().nonnegative()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 var VehicleSchema = object({
 	id: string(),
@@ -28784,7 +28837,7 @@ DeviceType.Switch, DeviceType.Siren, DeviceType.Light, method(object({
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), object({
 	deviceId: number$1(),
 	on: boolean(),
@@ -29641,25 +29694,25 @@ object({
 });
 DeviceType.Vacuum, method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	speed: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 object({
 	/** Lifecycle state of the valve. */
@@ -29678,19 +29731,19 @@ object({
 });
 DeviceType.Valve, method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	position: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 object({
 	detected: boolean(),
@@ -29724,19 +29777,19 @@ DeviceType.WaterHeater, method(object({
 	temp: number$1().finite()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	mode: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 object({
 	/** Verbatim HA condition state (`sunny`, `cloudy`, `rainy`, …). Null
@@ -31828,6 +31881,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"faceGallery.auditIdentitySamples": {
+		capName: "face-gallery",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"faceGallery.createIdentity": {
 		capName: "face-gallery",
 		capScope: "system",

package/dist/addon.mjs

@@ -16135,16 +16135,16 @@ DeviceType.AlarmPanel, method(object({
 	code: string().min(1).optional()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	code: string().min(1).optional()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * Shared geometry vocabulary for on-frame shape caps — privacy-mask,
@@ -23799,7 +23799,7 @@ DeviceType.Light, method(object({
 	percentage: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), object({
 	deviceId: number$1(),
 	percentage: number$1().min(0).max(100),
@@ -23807,7 +23807,7 @@ DeviceType.Light, method(object({
 });
 DeviceType.Button, method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * camera-credentials — device-scoped cap exposing the camera's network
@@ -23966,50 +23966,50 @@ DeviceType.Thermostat, DeviceType.Climate, method(object({
 	mode: HvacModeSchema
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	fanMode: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	preset: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	target: number$1()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	targetLow: number$1(),
 	targetHigh: number$1()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	targetHumidity: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * Color-light cap. Coexists with `switch` (on/off) and `brightness`
@@ -24084,7 +24084,7 @@ DeviceType.Light, method(object({
 	color: ColorInputSchema
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), object({
 	deviceId: number$1(),
 	mode: _enum([
@@ -24233,7 +24233,7 @@ DeviceType.Control, method(object({
 	control: ControlSetValueInputSchema
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 object({
 	/** Lifecycle state of the cover. */
@@ -24254,25 +24254,25 @@ object({
 });
 DeviceType.Cover, method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	position: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	tiltPosition: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * Vendor-neutral day/night (IR-cut) control — the per-camera config cap
@@ -24477,6 +24477,59 @@ var IdentitySampleInfoSchema = object({
 	deviceId: number$1().int().optional(),
 	base64: string().optional()
 });
+/**
+* One enrolled sample, judged against the gallery it lives in.
+*
+* The gallery is the one input to recognition nobody re-reads: a sample
+* enrolled from the wrong face keeps voting forever, and because the matches it
+* pulls then look confident, nobody goes back. The 2026-09-08 audit found
+* exactly one such pair on this cluster — a sample scoring 0.61 against three
+* samples of ANOTHER person, enrolled from the same camera in the same minute,
+* where every other cross-identity pair sits under 0.50.
+*/
+var IdentitySampleAuditRowSchema = object({
+	sampleId: string(),
+	enrolledAt: number$1().int(),
+	deviceId: number$1().int().optional(),
+	source: _enum(["detected", "photo"]),
+	/** The enrolled crop's media key, so the panel can show the evidence. */
+	mediaKey: string().optional(),
+	/**
+	* False = the sample is stamped with a DIFFERENT face model, and a cosine
+	* across feature spaces is a well-formed float with no meaning. Every number
+	* below then says nothing — it must read as "cannot say", never as an
+	* accusation and never as a clean bill: this list ends in a Remove button.
+	*/
+	comparable: boolean(),
+	/** Mean cosine against this person's other samples. Null when there are none
+	*  to compare with — never 0, which would read as "opposite". */
+	selfMean: number$1().nullable(),
+	/** The other person this sample looks most like, when it looks like one.
+	*  This is the half that convicts: not looking like yourself can be a hard
+	*  angle; looking like someone the gallery can NAME is a mis-enrolment. */
+	bestForeign: object({
+		identityId: string(),
+		name: string(),
+		score: number$1()
+	}).optional(),
+	/** 0 = nothing to say. Higher = look at this one sooner. */
+	suspicion: number$1()
+});
+var IdentitySampleAuditSchema = object({
+	identityId: string(),
+	name: string(),
+	/** The cluster face model every comparison was made in. */
+	modelId: string(),
+	totalSamples: number$1().int(),
+	comparableSamples: number$1().int(),
+	flagged: number$1().int(),
+	/** The bar `flagged` counts against, so the panel states the RULE and not
+	*  only its current result. */
+	flagThreshold: number$1(),
+	/** Worst first. A row with nothing to say still appears, at the bottom: the
+	*  operator asked to see the gallery, not only its accusations. */
+	rows: array(IdentitySampleAuditRowSchema).readonly()
+});
 var FaceInfoSchema = object({
 	faceId: string(),
 	deviceId: number$1().int(),
@@ -24628,7 +24681,7 @@ includeCrops: boolean().optional() }).optional(), array(IdentitySchema).readonly
 }), method(object({ id: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ identityId: string() }), array(IdentitySampleInfoSchema).readonly()), method(object({
+}), method(object({ identityId: string() }), array(IdentitySampleInfoSchema).readonly()), method(object({ identityId: string().min(1) }), IdentitySampleAuditSchema, { auth: "admin" }), method(object({
 	identityId: string(),
 	sampleId: string()
 }), _void(), {
@@ -24814,25 +24867,25 @@ DeviceType.Fan, method(object({
 	percentage: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	preset: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	direction: FanDirectionSchema
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	oscillating: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * Per-device feature/identity probe slice. Holds the runtime-resolved
@@ -24935,19 +24988,19 @@ DeviceType.Humidifier, method(object({
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	humidity: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	mode: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 object({
 	/** Current relative humidity, 0..100. */
@@ -25409,13 +25462,13 @@ object({
 });
 DeviceType.LawnMower, method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * local-network — hub-only singleton.
@@ -25675,16 +25728,16 @@ DeviceType.Lock, method(object({
 	code: string().min(1).optional()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	code: string().min(1).optional()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * Media-player cap. Models HA `media_player.*` (Sonos, Chromecast,
@@ -25758,55 +25811,55 @@ object({
 });
 DeviceType.MediaPlayer, method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	positionMs: number$1().int().nonnegative()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	volumeLevel: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	muted: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	shuffle: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	repeat: MediaPlayerRepeatSchema
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	source: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	/** Media identifier / URL. */
@@ -25816,7 +25869,7 @@ DeviceType.MediaPlayer, method(object({ deviceId: number$1().int().nonnegative()
 	mediaType: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 /**
 * mesh-network — collection cap for mesh-VPN providers.
@@ -26982,49 +27035,49 @@ DeviceType.PetFeeder, method(object({
 	hopper2: gramsPortion.optional()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	soundId: number$1().int().nonnegative()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	level: number$1().int().nonnegative()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 var VehicleSchema = object({
 	id: string(),
@@ -28811,7 +28864,7 @@ DeviceType.Switch, DeviceType.Siren, DeviceType.Light, method(object({
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), object({
 	deviceId: number$1(),
 	on: boolean(),
@@ -29668,25 +29721,25 @@ object({
 });
 DeviceType.Vacuum, method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	speed: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 object({
 	/** Lifecycle state of the valve. */
@@ -29705,19 +29758,19 @@ object({
 });
 DeviceType.Valve, method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({ deviceId: number$1().int().nonnegative() }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	position: number$1().min(0).max(100)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 object({
 	detected: boolean(),
@@ -29751,19 +29804,19 @@ DeviceType.WaterHeater, method(object({
 	temp: number$1().finite()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	mode: string().min(1)
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number$1().int().nonnegative(),
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "protected"
 });
 object({
 	/** Verbatim HA condition state (`sunny`, `cloudy`, `rainy`, …). Null
@@ -31855,6 +31908,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"faceGallery.auditIdentitySamples": {
+		capName: "face-gallery",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"faceGallery.createIdentity": {
 		capName: "face-gallery",
 		capScope: "system",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-ai",
-  "version": "0.4.87",
+  "version": "0.4.89",
   "description": "AI addon for CamStack — the `llm` collection provider (cloud, LAN, and camstack-managed local llama.cpp profiles) plus the per-node `llm-runtime` managed executor.",
   "keywords": [
     "camstack",