@camstack/addon-pipeline 1.2.369 → 1.2.371

package/dist/{dist-DKSwif2M.mjs → dist-8AEiKOFO.mjs}

@@ -5387,7 +5387,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep--g-h2_c_.mjs
+//#region ../types/dist/sleep-DRqxtc0C.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5536,7 +5536,7 @@ function isKeychainStoredField(field) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$2(value) {
+function isRecord$2$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -5547,12 +5547,12 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$2$1(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 function isSecretClear(value) {
-	return isRecord$2(value) && value["$secretClear"] === true;
+	return isRecord$2$1(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -6178,7 +6178,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$1$1(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -6191,7 +6191,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$1$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -6246,7 +6246,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1$1) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -6262,7 +6262,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$1$1(row)) {
+		if (!isRecord$1(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -6287,7 +6287,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$1$1(incoming)) {
+			if (!isRecord$1(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -6295,7 +6295,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$1$1(stored) ? stored : {};
+			const storedObj = isRecord$1(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -6418,7 +6418,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$1$1(v)) {
+		if (isRecord$1(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -8354,6 +8354,24 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
 var HF_REPO = "camstack/camstack-models";
 `${HF_REPO}`;
+object({
+	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
+	params: record(string(), union([string(), number()])).optional()
+});
+var CamstackError = class extends Error {
+	i18nCode;
+	i18nParams;
+	constructor(code, params, englishMessage) {
+		super(englishMessage);
+		this.name = "CamstackError";
+		this.i18nCode = code;
+		this.i18nParams = params;
+	}
+};
+/** `throw userError('device.not-found', { id }, 'Device 12 not found')` */
+function userError(code, params, englishFallback) {
+	return new CamstackError(code, params, englishFallback);
+}
 /**
 * The ONE retry schedule for work that can fail simply because the node was
 * still booting.
@@ -8421,6 +8439,8 @@ var CREDENTIAL_PARAM_PATTERNS = [
 	/^code$/i,
 	/^state$/i,
 	/^challenge$/i,
+	/^code[_-]?challenge$/i,
+	/^confirm$/i,
 	/^link$/i
 ];
 function isCredentialParam(name) {
@@ -8489,7 +8509,7 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/err-msg-DX6i_MY4.mjs
+//#region ../types/dist/err-msg-DLerKiVO.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -8739,6 +8759,22 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 	DeviceRole["Nightvision"] = "nightvision";
 	DeviceRole["PrivacyMask"] = "privacy-mask";
 	DeviceRole["Doorbell"] = "doorbell";
+	/** Interior blind / shade / roller blind. HA `device_class: blind|shade`. */
+	DeviceRole["CoverBlind"] = "cover-blind";
+	/** Exterior roller shutter. HA `device_class: shutter`; Homematic BROLL. */
+	DeviceRole["CoverShutter"] = "cover-shutter";
+	/** Exterior awning. HA `device_class: awning`. */
+	DeviceRole["CoverAwning"] = "cover-awning";
+	/** Curtain / drape. HA `device_class: curtain`. */
+	DeviceRole["CoverCurtain"] = "cover-curtain";
+	/** Garage door. HA `device_class: garage`. A security actuator: exports gate it. */
+	DeviceRole["CoverGarage"] = "cover-garage";
+	/** Gate. HA `device_class: gate`. A security actuator: exports gate it. */
+	DeviceRole["CoverGate"] = "cover-gate";
+	/** Door. HA `device_class: door`. A security actuator: exports gate it. */
+	DeviceRole["CoverDoor"] = "cover-door";
+	/** Window. HA `device_class: window`. */
+	DeviceRole["CoverWindow"] = "cover-window";
 	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
 	*  real Switch device for UI rendering / export adapters. */
 	DeviceRole["BinaryHelper"] = "binary-helper";
@@ -8819,7 +8855,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-C-WpVYTX.mjs
+//#region ../types/dist/composition-EQ9Ok0Ee.mjs
 var AUDIO_ENCODER_BY_CODEC = {
 	opus: "libopus",
 	aac: "aac",
@@ -12377,20 +12413,20 @@ var SURVIVING_TRIGGER_KEYS = [
 	"objectClasses",
 	"sensorDeviceIds"
 ];
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function listensToLegacySignal(band) {
-	return isRecord$1(band) && isRecord$1(band.triggers) && band.triggers.deviceSignal === true;
+	return isRecord$2(band) && isRecord$2(band.triggers) && band.triggers.deviceSignal === true;
 }
 function hasSurvivingTrigger(band) {
 	const triggers = band.triggers;
-	if (!isRecord$1(triggers)) return false;
+	if (!isRecord$2(triggers)) return false;
 	return SURVIVING_TRIGGER_KEYS.some((key) => triggers[key] !== void 0);
 }
 function withoutLegacySignal(band) {
 	const triggers = band.triggers;
-	if (!isRecord$1(triggers)) return band;
+	if (!isRecord$2(triggers)) return band;
 	const { deviceSignal: _retired, ...rest } = triggers;
 	return {
 		...band,
@@ -12420,11 +12456,11 @@ function migrateLegacyDeviceSignalConfig(raw) {
 		migrated: false,
 		strippedOnly: false
 	};
-	if (!isRecord$1(raw) || !Array.isArray(raw.bands)) return unchanged;
+	if (!isRecord$2(raw) || !Array.isArray(raw.bands)) return unchanged;
 	if (!raw.bands.some(listensToLegacySignal)) return unchanged;
 	const kept = [];
 	for (const band of raw.bands) {
-		if (!listensToLegacySignal(band) || !isRecord$1(band)) {
+		if (!listensToLegacySignal(band) || !isRecord$2(band)) {
 			kept.push(band);
 			continue;
 		}
@@ -14652,6 +14688,14 @@ var ConvertResultSchema = object({
 		files: array(string()).readonly()
 	})).readonly()
 });
+_enum(["new-session", "step-up"]);
+/** The languages the hub's app landing pages are written in (D858). */
+var AppPageLangSchema = _enum(["en", "it"]);
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = discriminatedUnion("kind", [object({ kind: literal("native") }), object({
+	kind: literal("browser"),
+	startPath: string().startsWith("/")
+})]);
 /**
 * Device certificates (D855) — the wire contract shared by the hub, the admin
 * UI and the native viewer.
@@ -14811,7 +14855,9 @@ object({
 	signature: literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: array(_enum(["native", "web"]))
+	clients: array(_enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 var ExpressionBindingSourceSchema = union([
 	object({
@@ -15141,7 +15187,9 @@ var ConfigTabDeclarationSchema = object({
 var ConfigSectionWithValuesSchema = object({
 	id: string(),
 	title: string(),
+	titleKey: string().optional(),
 	description: string().optional(),
+	descriptionKey: string().optional(),
 	style: _enum(["card", "accordion"]).optional(),
 	defaultCollapsed: boolean().optional(),
 	columns: union([
@@ -18839,6 +18887,9 @@ method(object({
 }), method(object({ refs: RefListSchema }), KeychainResolveResultSchema, { auth: "admin" }), method(object({ refs: RefListSchema }), object({ deleted: number().int() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ deviceId: number().int() }), object({ refs: array(string()).readonly() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
 /**
 * device-history — the ONE mechanism for numeric history (D850).
@@ -40273,6 +40324,42 @@ var DeviceRegisterPayloadSchema = object({
 	*  omits it and the keyword backstop applies. */
 	secretConfigPaths: array(string()).optional()
 });
+/** One deleted device, kept by device-manager so an addon that missed the
+*  deletion can still learn of it (D865). Written by the delete path ONLY. */
+var DeviceTombstoneSchema = object({
+	deviceId: number().int().positive(),
+	/** Epoch ms the device was deleted. */
+	deletedAt: number(),
+	/** The addon that owned the device when it was deleted. */
+	providerAddonId: string()
+});
+/** How long a tombstone stays readable. Past it, a device that was deleted
+*  and never cleaned is only reachable by the admin "clean data of deleted
+*  devices" action. */
+var DEVICE_TOMBSTONE_RETENTION_MS = 2160 * 60 * 60 * 1e3;
+/** Data held for one device that device-manager no longer knows. */
+var OrphanDeviceDataSchema = object({
+	deviceId: number().int().positive(),
+	/** Rows/files per store (`<addonId>:<store>`). */
+	stores: record(string(), number().int().nonnegative())
+});
+var CleanupDeletedDevicesResultSchema = object({
+	/**
+	* `skipped` — the absence check could not be trusted (a device-list read
+	* failed or the two reads disagreed); nothing was listed or deleted.
+	* `dry-run` — `devices` is what a confirmed run would delete.
+	* `cleaned` — `devices` is what was deleted.
+	*/
+	status: _enum([
+		"skipped",
+		"dry-run",
+		"cleaned"
+	]),
+	reason: string().nullable(),
+	devices: array(OrphanDeviceDataSchema),
+	/** Implementers that could not be asked (their stores are not in `devices`). */
+	unreachable: array(string())
+});
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
 	deviceId: number(),
@@ -40511,6 +40598,9 @@ method(object({
 }), method(object({ deviceId: number() }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ sinceMs: number() }), array(DeviceTombstoneSchema).readonly(), { auth: "admin" }), method(object({ confirm: boolean() }), CleanupDeletedDevicesResultSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ integrationId: string() }), object({ removed: number() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -40973,6 +41063,85 @@ method(object({
 	auth: "admin"
 });
 /**
+* `device-removal-hook` — the reliable way an addon learns a device was DELETED,
+* so it can delete what it keeps for that device (D865).
+*
+* ## Why an event was not enough
+*
+* `DeviceUnregistered` is telemetry and may be dropped (D8, D11). An addon that
+* hung its per-device clean-up on it left durable garbage whenever the event was
+* lost, the addon was down, or it was restarting at that moment — footage,
+* analytics rows and settings of device 4483 outlived the device. Loss of this
+* signal corrupts durable state, so it travels by RPC with a recorded fact
+* behind it (D8: "if loss would corrupt durable state, use RPC plus a reconcile").
+*
+* ## The three pieces
+*
+* 1. device-manager records a TOMBSTONE per deleted device
+*    (`deviceManager.listDeletedSince`). The tombstone is written by the delete
+*    path only — a device that is unregistered, offline or whose provider is
+*    restarting is NOT deleted and gets none.
+* 2. After a delete, device-manager calls `onDeviceRemoved` on EVERY provider of
+*    this collection, one by one, with bounded retries, logged.
+* 3. An implementer that was down asks `deviceManager.listDeletedSince` at start
+*    (and periodically) and runs its own `onDeviceRemoved` for each tombstone it
+*    may have missed. Reconcile is driven by tombstones, never by "the device is
+*    not in the current list": a failed or partial list read must not destroy data.
+*
+* ## Contract for an implementer
+*
+* - **Idempotent.** It is called again by a retry, by a reconcile and by the
+*   admin cleanup of data that predates tombstones. A device with nothing left
+*   answers zero counts.
+* - **One key per store** in `counts`, deleted rows/files per store, so the log
+*   line and the admin dry run can say where the data was.
+* - **Training datasets are NOT device data** and are never deleted by a hook.
+* - **Per-device SETTINGS are not hooked.** Configuration lives in the standard
+*   per-device store (`ctx.settings.*DeviceStore`), which device-manager clears
+*   for every addon centrally at delete time. This hook is for device DATA
+*   that is not settings: footage, event media, analytics rows, history.
+* - A provider that cannot tell is allowed to throw; the caller retries it.
+*
+* `listDeviceData` is the read side of the admin "Clean data of deleted devices"
+* action: which device ids this addon holds data for, and how much per store. It
+* never deletes. device-manager decides which of those ids are absent from the
+* fleet, from TWO consistent reads of the device list (D49).
+*/
+/** What a hook is told about the deletion. */
+var DeviceRemovedInputSchema = object({
+	deviceId: number().int().positive(),
+	/** Epoch ms the device was deleted (the tombstone's `deletedAt`). */
+	deletedAt: number(),
+	/** The addon that owned the device, as device-manager last knew it. */
+	providerAddonId: string()
+});
+/** Rows/files/refs deleted, per store this implementer owns. */
+var DeviceRemovedResultSchema = object({ counts: record(string(), number().int().nonnegative()) });
+/** One (store, device) pair an implementer holds data for. */
+var DeviceDataEntrySchema = object({
+	store: string(),
+	deviceId: number().int().positive(),
+	/** Rows (or files) held for the device in the store. */
+	count: number().int().nonnegative()
+});
+var deviceRemovalHookCapability = {
+	name: "device-removal-hook",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/** Delete everything this addon keeps for the deleted device. Idempotent. */
+		onDeviceRemoved: method(DeviceRemovedInputSchema, DeviceRemovedResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Which devices this addon holds data for, per store. Reads only. */
+		listDeviceData: method(_void(), array(DeviceDataEntrySchema).readonly(), { auth: "admin" })
+	},
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
+/**
 * `failure-contribution` — the capability an addon reports its OWN losses
 * through, per camera, with the denominator attached. It stores nothing.
 *
@@ -41994,7 +42163,13 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		* `beginExternalLink` offer exactly the redirect methods that set this,
 		* whatever their id. Absent / false — a login button only.
 		*/
-		linkable: boolean().optional()
+		linkable: boolean().optional(),
+		/**
+		* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+		* when the route understands the app flow query (`app=1&code_challenge=…`),
+		* `null`/absent when there is no app path - the app hides the method.
+		*/
+		app: AppLoginPathSchema.nullable().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -42006,7 +42181,9 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		bundle: string(),
 		/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 		remote: WidgetRemoteSchema,
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+		app: AppLoginPathSchema.nullable().optional()
 	}),
 	object({
 		kind: literal("passkey"),
@@ -42018,7 +42195,9 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 		rpId: string(),
 		/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-		origin: string().nullable()
+		origin: string().nullable(),
+		/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+		app: AppLoginPathSchema.nullable().optional()
 	})
 ]);
 method(_void(), array(LoginMethodContributionSchema).readonly());
@@ -42545,7 +42724,21 @@ var NetworkEndpointSchema = object({
 	url: string(),
 	hostname: string(),
 	port: number(),
-	protocol: _enum(["http", "https"])
+	protocol: _enum(["http", "https"]),
+	/**
+	* Whether this address survives a restart of its provider. `false` = it is
+	* re-issued every time (a Quick tunnel's random `*.trycloudflare.com`); the
+	* hub never selects such an address AUTOMATICALLY for a role (D860), though
+	* it stays visible and an operator may still flag it. Absent = stable: every
+	* provider except a Quick tunnel owns a name that does not change.
+	*/
+	stable: boolean().optional()
+});
+object({
+	url: string(),
+	/** Mirrors {@link NetworkEndpointSchema} `stable`; absent = stable. */
+	stable: boolean().optional(),
+	updated: boolean().optional()
 });
 var NetworkAccessStatusSchema = object({
 	connected: boolean(),
@@ -53349,7 +53542,22 @@ var SsoBridgeClaimsSchema = object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: string().optional()
+	browserBinding: string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: object({
+		codeChallenge: string(),
+		state: string(),
+		purpose: _enum(["new-session", "step-up"]),
+		redirect: string(),
+		/** The page language the app asked for (D858); the confirm page speaks it. */
+		lang: _enum(["en", "it"]).optional()
+	}).optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -55969,7 +56177,12 @@ var SearchResultSchema = object({
 	publishedAt: string(),
 	author: string(),
 	installed: boolean(),
-	installedVersion: string().optional()
+	installedVersion: string().optional(),
+	/**
+	* Capability names the package's addons declare (from its published
+	* manifest). `null` = the registry lookup failed — unknown, never `[]` (D393).
+	*/
+	capabilities: array(string()).readonly().nullable()
 });
 var AutoUpdateSettingsSchema = object({
 	channel: ChannelSchema,
@@ -56131,7 +56344,11 @@ method(object({ nodeId: string().optional() }).optional(), array(AddonListItemSc
 }), method(object({ packageName: string().optional() }), PackageInstallationsSchema, { auth: "admin" }), method(_void(), ReloadPackagesResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ query: string().optional() }), array(SearchResultSchema)), method(object({ nodeId: string().optional() }), array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(object({
+}), method(object({
+	query: string().optional(),
+	/** Only packages whose addons declare this capability (unknown ones excluded). */
+	capability: string().optional()
+}), array(SearchResultSchema)), method(object({ nodeId: string().optional() }), array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(object({
 	name: string().min(1),
 	version: string().optional(),
 	nodeId: string().optional()
@@ -58628,7 +58845,13 @@ var ConnectionEndpointSchema = object({
 	* calls so the client can sort even if the cap returns a new
 	* ordering between polls.
 	*/
-	priority: number()
+	priority: number(),
+	/**
+	* `false` = the address changes on its own (a Quick tunnel, re-issued on
+	* every respawn). Automatic role resolution skips it (D860); an explicit
+	* operator flag still honours it. Absent = stable.
+	*/
+	stable: boolean().optional()
 });
 /**
 * Where the advertised local port came from. Ordered most → least
@@ -63724,6 +63947,21 @@ DeviceType.Switch, DeviceType.Siren, DeviceType.Light, method(object({
 	on: boolean(),
 	lastChangedAt: number()
 });
+/** C0 controls, DEL and the C1 range: none of them belongs in a name. */
+function hasControlCharacter(value) {
+	for (const char of value) {
+		const code = char.codePointAt(0) ?? 0;
+		if (code <= 31 || code >= 127 && code <= 159) return true;
+	}
+	return false;
+}
+string().transform((value) => value.trim()).pipe(string().min(1, "The server name cannot be empty").max(48, `The server name is at most 48 characters`).refine((value) => !hasControlCharacter(value), { message: "The server name cannot contain control characters" }));
+/** What every reader gets: the name to show, and whether the hub chose it itself. */
+var ServerNameInfoSchema = object({
+	name: string(),
+	/** `true` when nobody named the hub: `name` is the machine hostname. */
+	isDefault: boolean()
+});
 /**
 * system — system-scoped singleton capability exposing hub-level
 * health, feature flags, network interface enumeration, and the
@@ -63753,6 +63991,12 @@ var FeatureManifestSchema = object({
 	backup: boolean(),
 	repl: boolean()
 });
+/**
+* `system.info`: the feature flags plus the hub's human name (D861). The name is
+* `{ name, isDefault }` — `isDefault: true` means nobody named the hub and `name`
+* is the machine hostname.
+*/
+var SystemInfoSchema = FeatureManifestSchema.extend({ serverName: ServerNameInfoSchema });
 var HealthStatusSchema = object({
 	status: literal("ok"),
 	uptime: number()
@@ -64225,7 +64469,7 @@ var LoggingSettingsStateSchema = object({
 	opsLogRetentionDays: number().int().min(0),
 	persisted: boolean()
 });
-method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
+method(_void(), SystemInfoSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(_void(), _void(), {
@@ -67294,6 +67538,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.cleanupDeletedDevicesData": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.createDevice": {
 		capName: "device-manager",
 		capScope: "system",
@@ -67474,6 +67724,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.listDeletedSince": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.listDeviceIdsByCaps": {
 		capName: "device-manager",
 		capScope: "system",
@@ -67882,6 +68138,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceRemovalHook.listDeviceData": {
+		capName: "device-removal-hook",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceRemovalHook.onDeviceRemoved": {
+		capName: "device-removal-hook",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceState.claimFields": {
 		capName: "device-state",
 		capScope: "system",
@@ -68314,6 +68582,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"keychain.deleteDeviceScope": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"keychain.getState": {
 		capName: "keychain",
 		capScope: "system",
@@ -74326,6 +74600,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceRemovalHook.onDeviceRemoved": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.claimFields": [{
 		name: "deviceId",
 		form: "single",
@@ -74515,6 +74794,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"keychain.deleteDeviceScope": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"lawnMowerControl.dock": [{
 		name: "deviceId",
 		form: "single",
@@ -76913,6 +77197,8 @@ new Set([
 	"audio-tools",
 	"audio-silence"
 ]);
+AppPageLangSchema.options;
+record(string().min(1), string());
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -78478,5 +78764,75 @@ function enumerateInferenceDevices(hw) {
 	}
 	return out;
 }
+/** How often an implementer re-asks for tombstones after its start-up pass. */
+var REMOVAL_RECONCILE_INTERVAL_MS = 360 * 60 * 1e3;
+/** One reconcile pass over every tombstone inside the retention window. */
+async function reconcileRemovedDevices(opts) {
+	const now = opts.now ?? (() => Date.now());
+	const api = opts.api;
+	if (api === void 0) {
+		opts.logger.warn("device removal reconcile skipped — no device-manager api");
+		return {
+			read: false,
+			applied: 0,
+			failed: 0
+		};
+	}
+	let tombstones;
+	try {
+		tombstones = await api.deviceManager.listDeletedSince.query({ sinceMs: now() - DEVICE_TOMBSTONE_RETENTION_MS });
+	} catch (err) {
+		opts.logger.warn("device removal reconcile skipped — tombstones unreadable, nothing deleted", { meta: { error: errMsg(err) } });
+		return {
+			read: false,
+			applied: 0,
+			failed: 0
+		};
+	}
+	let applied = 0;
+	let failed = 0;
+	for (const tombstone of tombstones) try {
+		const result = await opts.remove(tombstone);
+		applied += 1;
+		if (Object.values(result.counts).reduce((sum, n) => sum + n, 0) > 0) opts.logger.info("device removal reconcile cleaned a missed deletion", {
+			tags: { deviceId: tombstone.deviceId },
+			meta: {
+				counts: result.counts,
+				deletedAt: tombstone.deletedAt
+			}
+		});
+	} catch (err) {
+		failed += 1;
+		opts.logger.warn("device removal reconcile failed for a device — retried next pass", {
+			tags: { deviceId: tombstone.deviceId },
+			meta: { error: errMsg(err) }
+		});
+	}
+	return {
+		read: true,
+		applied,
+		failed
+	};
+}
+/**
+* Run the reconcile now and then periodically. Returns the disposer. The timer
+* is unref'd and a pass never overlaps the previous one.
+*/
+function armRemovalReconcile(opts) {
+	let running = false;
+	const pass = () => {
+		if (running) return;
+		running = true;
+		reconcileRemovedDevices(opts).catch((err) => {
+			opts.logger.warn("device removal reconcile pass crashed", { meta: { error: errMsg(err) } });
+		}).finally(() => {
+			running = false;
+		});
+	};
+	pass();
+	const timer = setInterval(pass, REMOVAL_RECONCILE_INTERVAL_MS);
+	timer.unref?.();
+	return () => clearInterval(timer);
+}
 //#endregion
-export { audioKindId as $, discriminatedUnion as $n, recordingExportCapability as $t, NativeLeaseAdmissionSchema as A, BaseAddon as An, isFirstLevelMacroClass as At, RECORDING_SOURCE_CAMSTACK_ADDON as B, hfModelUrl as Bn, modeMayWrite as Bt, EVENT_PAD_MS as C, evaluateSensorEdge as Cn, exportSubjectOf as Ct, G711_SCALE_CORRECTION_DB as D, DeviceType as Dn, gifDeriveSpeed as Dt, FailureCounters as E, DeviceFeature as En, gbToBytes as Et, PoolMemoryWatchdog as F, audioChunkBytesPerSample as Fn, mapAudioLabelToMacro as Ft, VIDEOCLIPS_MAX_OFFER_BYTES as G, maskUrlCredentials as Gn, pickClusterStepSettings as Gt, RecordingConfigSchema as H, isEvent as Hn, motionDetectionCapability as Ht, RATE_CONTROL_RELAXED as I, createEvent as In, mayReadLocation as It, addonWidgetsSourceCapability as J, selectAssignedProfileSlots as Jn, pipelineExecutorCapability as Jt, VISIT_MERGE_GAP_MS as K, nodePin as Kn, pickDetailCropConvention as Kt, RATE_CONTROL_TIGHT as L, customAction as Ln, mayWriteToLocation as Lt, NodeBenchRunnerInputSchema as M, CamProfileSchema as Mn, linkedStepOf as Mt, OpsLogEntrySchema as N, HF_REPO as Nn, loadContributionCapability as Nt, LABEL_SUPPLY_MACRO as O, errMsg as On, gifFromMp4Args as Ot, PIPELINE_RAMP as P, MODEL_FORMATS as Pn, logChannelsCapability as Pt, audioAnalyzerCapability as Q, boolean as Qn, recordingCapability as Qt, RECORDING_EXPORT_MAX_READ_BYTES as R, defineCustomActions as Rn, memoizePinnedFfmpeg as Rt, EVENT_OWNER_TYPES as S, buildFfmpegArgs as Sn, evictionPolicyOfLocation as St, ExportRecordSchema as T, isSoftwareDecode as Tn, ffmpegRate as Tt, RecordingSignalStatusSchema as U, makeProfileBrokerId as Un, overlayClusterStepSettings as Ut, ROOT_SUPPLIABLE_STEP_IDS as V, hydrateSchema as Vn, modelBindingKey as Vt, RingBuffer as W, makeSourceBrokerId as Wn, parseProcStatus as Wt, applyModelBoundSettings as X, _enum as Xn, rankStreams as Xt, allowedSuppliedEffect as Y, sleep as Yn, pipelineRunnerCapability as Yt, audioAnalysisCapability as Z, array as Zn, recordingArchiveCapability as Zt, DEFAULT_DETAIL_CROP_CONVENTION as _, videoclipsCapability as _n, egressTranscodeSharingKey as _t, BackgroundRunRegistry as a, resolveModelBoundSetting as an, record as ar, clipExportFailureOf as at, DEVICE_BACKEND_TO_FORMAT as b, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as bn, evaluateZoneRules as bt, CLIP_STILL_REASON_CODE_HEADER as c, resolveRootSupply as cn, EventCategory as cr, createHwAccelCache as ct, CLUSTER_MODEL_SCOPED_STEPS as d, stepModelRunsOnFormat as dn, defaultDeviceFor as dt, recordingSignalCapability as en, lazy as er, batteryCapability as et, COCO_80_LABELS as f, storageEvictableCapability as fn, deriveBatteryPresence as ft, DEFAULT_CLUSTER_STEP_SETTINGS as g, supportedRuntimes as gn, detectionPipelineCapability as gt, DEFAULT_AUDIO_ANALYZER_CONFIG as h, stripRetiredBandPreBufferSec as hn, deriveRootFaceRefineRect as ht, AUDIO_MACRO_LABELS as i, resolveLocationMode as in, preprocess as ir, clipExportFailure as it, NativeLeaseSettingsSchema as j, CAM_PROFILE_ORDER as jn, linkedLabelStepId as jt, LABEL_SUPPLY_VOCABULARIES as k, BOOT_RECOVERY_BACKOFF_MS as kn, inferModelProvider as kt, CLIP_STILL_REASON_HEADER as l, rootSuppliesOf as ln, createLogChannelsProvider as lt, CROP_SUPPLY_SOURCES as m, streamBrokerCapability as mn, deriveRecordingMode as mt, APPLE_SA_TO_MACRO as n, resolveCreateExportSubject as nn, number as nr, cameraOwnsMotionViaSensor as nt, BatteryStatusSchema as o, resolvePoolMemoryPolicy as on, string as or, collectModelBoundKeys as ot, COCO_TO_MACRO as p, storageOccupancyCapability as pn, deriveDetailCropRect as pt, YAMNET_TO_MACRO as q, parseProfileBrokerId as qn, pickNativeLeaseOverride as qt, AUDIO_BACKEND_CHOICES as r, resolveEgressDecodeHwAccel as rn, object as rr, cameraStreamsCapability as rt, CLIP_BROKER_PACED_RATES as s, resolveRecordingProfiles as sn, union as sr, containingParentIndex as st, APPEARANCE_BLOCKS as t, resolveClusterStepModelId as tn, literal as tr, buildBenchStepTree as tt, CLIP_STREAM_TRANSPORT_HEADER as u, runtimeDevices as un, declareLogChannel as ut, DEFAULT_EVENTS_BAND_BUFFER_SEC as v, webrtcSessionCapability as vn, egressTransportFromRequest as vt, EncodeProfileSchema as w, invocationFromEncodeProfile as wn, failureContributionCapability as wt, DEVICE_RAMP as x, Fmp4BoxSplitter as xn, evictionPolicyForMode as xt, DEFAULT_NATIVE_LEASE_SETTINGS as y, AUDIO_PRESETS as yn, enumerateInferenceDevices as yt, RECORDING_SOURCE_CAMSTACK as z, expandAudioChunkToF32le as zn, migrateLegacyDeviceSignalConfig as zt };
+export { audioAnalyzerCapability as $, _enum as $n, recordingArchiveCapability as $t, NativeLeaseAdmissionSchema as A, errMsg as An, gifFromMp4Args as At, RECORDING_SOURCE_CAMSTACK_ADDON as B, defineCustomActions as Bn, memoizePinnedFfmpeg as Bt, EVENT_PAD_MS as C, Fmp4BoxSplitter as Cn, evictionPolicyForMode as Ct, G711_SCALE_CORRECTION_DB as D, isSoftwareDecode as Dn, ffmpegRate as Dt, FailureCounters as E, invocationFromEncodeProfile as En, failureContributionCapability as Et, PoolMemoryWatchdog as F, HF_REPO as Fn, loadContributionCapability as Ft, VIDEOCLIPS_MAX_OFFER_BYTES as G, makeProfileBrokerId as Gn, overlayClusterStepSettings as Gt, RecordingConfigSchema as H, hfModelUrl as Hn, modeMayWrite as Ht, RATE_CONTROL_RELAXED as I, MODEL_FORMATS as In, logChannelsCapability as It, addonWidgetsSourceCapability as J, nodePin as Jn, pickDetailCropConvention as Jt, VISIT_MERGE_GAP_MS as K, makeSourceBrokerId as Kn, parseProcStatus as Kt, RATE_CONTROL_TIGHT as L, audioChunkBytesPerSample as Ln, mapAudioLabelToMacro as Lt, NodeBenchRunnerInputSchema as M, BaseAddon as Mn, isFirstLevelMacroClass as Mt, OpsLogEntrySchema as N, CAM_PROFILE_ORDER as Nn, linkedLabelStepId as Nt, LABEL_SUPPLY_MACRO as O, DeviceFeature as On, gbToBytes as Ot, PIPELINE_RAMP as P, CamProfileSchema as Pn, linkedStepOf as Pt, audioAnalysisCapability as Q, userError as Qn, rankStreams as Qt, RECORDING_EXPORT_MAX_READ_BYTES as R, createEvent as Rn, mayReadLocation as Rt, EVENT_OWNER_TYPES as S, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as Sn, evaluateZoneRules as St, ExportRecordSchema as T, evaluateSensorEdge as Tn, exportSubjectOf as Tt, RecordingSignalStatusSchema as U, hydrateSchema as Un, modelBindingKey as Ut, ROOT_SUPPLIABLE_STEP_IDS as V, expandAudioChunkToF32le as Vn, migrateLegacyDeviceSignalConfig as Vt, RingBuffer as W, isEvent as Wn, motionDetectionCapability as Wt, applyModelBoundSettings as X, selectAssignedProfileSlots as Xn, pipelineExecutorCapability as Xt, allowedSuppliedEffect as Y, parseProfileBrokerId as Yn, pickNativeLeaseOverride as Yt, armRemovalReconcile as Z, sleep as Zn, pipelineRunnerCapability as Zt, DEFAULT_DETAIL_CROP_CONVENTION as _, stripRetiredBandPreBufferSec as _n, detectionPipelineCapability as _t, BackgroundRunRegistry as a, resolveEgressDecodeHwAccel as an, number as ar, clipExportFailure as at, DEVICE_BACKEND_TO_FORMAT as b, webrtcSessionCapability as bn, egressTransportFromRequest as bt, CLIP_STILL_REASON_CODE_HEADER as c, resolvePoolMemoryPolicy as cn, record as cr, containingParentIndex as ct, CLUSTER_MODEL_SCOPED_STEPS as d, rootSuppliesOf as dn, EventCategory as dr, declareLogChannel as dt, recordingCapability as en, array as er, audioKindId as et, COCO_80_LABELS as f, runtimeDevices as fn, defaultDeviceFor as ft, DEFAULT_CLUSTER_STEP_SETTINGS as g, streamBrokerCapability as gn, deriveRootFaceRefineRect as gt, DEFAULT_AUDIO_ANALYZER_CONFIG as h, storageOccupancyCapability as hn, deriveRecordingMode as ht, AUDIO_MACRO_LABELS as i, resolveCreateExportSubject as in, literal as ir, cameraStreamsCapability as it, NativeLeaseSettingsSchema as j, BOOT_RECOVERY_BACKOFF_MS as jn, inferModelProvider as jt, LABEL_SUPPLY_VOCABULARIES as k, DeviceType as kn, gifDeriveSpeed as kt, CLIP_STILL_REASON_HEADER as l, resolveRecordingProfiles as ln, string as lr, createHwAccelCache as lt, CROP_SUPPLY_SOURCES as m, storageEvictableCapability as mn, deriveDetailCropRect as mt, APPLE_SA_TO_MACRO as n, recordingSignalCapability as nn, discriminatedUnion as nr, buildBenchStepTree as nt, BatteryStatusSchema as o, resolveLocationMode as on, object as or, clipExportFailureOf as ot, COCO_TO_MACRO as p, stepModelRunsOnFormat as pn, deriveBatteryPresence as pt, YAMNET_TO_MACRO as q, maskUrlCredentials as qn, pickClusterStepSettings as qt, AUDIO_BACKEND_CHOICES as r, resolveClusterStepModelId as rn, lazy as rr, cameraOwnsMotionViaSensor as rt, CLIP_BROKER_PACED_RATES as s, resolveModelBoundSetting as sn, preprocess as sr, collectModelBoundKeys as st, APPEARANCE_BLOCKS as t, recordingExportCapability as tn, boolean as tr, batteryCapability as tt, CLIP_STREAM_TRANSPORT_HEADER as u, resolveRootSupply as un, union as ur, createLogChannelsProvider as ut, DEFAULT_EVENTS_BAND_BUFFER_SEC as v, supportedRuntimes as vn, deviceRemovalHookCapability as vt, EncodeProfileSchema as w, buildFfmpegArgs as wn, evictionPolicyOfLocation as wt, DEVICE_RAMP as x, AUDIO_PRESETS as xn, enumerateInferenceDevices as xt, DEFAULT_NATIVE_LEASE_SETTINGS as y, videoclipsCapability as yn, egressTranscodeSharingKey as yt, RECORDING_SOURCE_CAMSTACK as z, customAction as zn, mayWriteToLocation as zt };