@camstack/addon-pipeline 1.2.369 → 1.2.371

package/dist/{dist-D3PtiAhd.js → dist-DmuX7IFJ.js}

@@ -5387,7 +5387,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep--g-h2_c_.mjs
+//#region ../types/dist/sleep-DRqxtc0C.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5536,7 +5536,7 @@ function isKeychainStoredField(field) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$2(value) {
+function isRecord$2$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -5547,12 +5547,12 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$2(value)) return false;
+	if (!isRecord$2$1(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 function isSecretClear(value) {
-	return isRecord$2(value) && value["$secretClear"] === true;
+	return isRecord$2$1(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -6178,7 +6178,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$1$1(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -6191,7 +6191,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$1$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -6246,7 +6246,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1$1) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -6262,7 +6262,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$1$1(row)) {
+		if (!isRecord$1(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -6287,7 +6287,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$1$1(incoming)) {
+			if (!isRecord$1(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -6295,7 +6295,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$1$1(stored) ? stored : {};
+			const storedObj = isRecord$1(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -6418,7 +6418,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$1$1(v)) {
+		if (isRecord$1(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -8354,6 +8354,24 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
 var HF_REPO = "camstack/camstack-models";
 `${HF_REPO}`;
+object({
+	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
+	params: record(string(), union([string(), number()])).optional()
+});
+var CamstackError = class extends Error {
+	i18nCode;
+	i18nParams;
+	constructor(code, params, englishMessage) {
+		super(englishMessage);
+		this.name = "CamstackError";
+		this.i18nCode = code;
+		this.i18nParams = params;
+	}
+};
+/** `throw userError('device.not-found', { id }, 'Device 12 not found')` */
+function userError(code, params, englishFallback) {
+	return new CamstackError(code, params, englishFallback);
+}
 /**
 * The ONE retry schedule for work that can fail simply because the node was
 * still booting.
@@ -8421,6 +8439,8 @@ var CREDENTIAL_PARAM_PATTERNS = [
 	/^code$/i,
 	/^state$/i,
 	/^challenge$/i,
+	/^code[_-]?challenge$/i,
+	/^confirm$/i,
 	/^link$/i
 ];
 function isCredentialParam(name) {
@@ -8489,7 +8509,7 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/err-msg-DX6i_MY4.mjs
+//#region ../types/dist/err-msg-DLerKiVO.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -8739,6 +8759,22 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 	DeviceRole["Nightvision"] = "nightvision";
 	DeviceRole["PrivacyMask"] = "privacy-mask";
 	DeviceRole["Doorbell"] = "doorbell";
+	/** Interior blind / shade / roller blind. HA `device_class: blind|shade`. */
+	DeviceRole["CoverBlind"] = "cover-blind";
+	/** Exterior roller shutter. HA `device_class: shutter`; Homematic BROLL. */
+	DeviceRole["CoverShutter"] = "cover-shutter";
+	/** Exterior awning. HA `device_class: awning`. */
+	DeviceRole["CoverAwning"] = "cover-awning";
+	/** Curtain / drape. HA `device_class: curtain`. */
+	DeviceRole["CoverCurtain"] = "cover-curtain";
+	/** Garage door. HA `device_class: garage`. A security actuator: exports gate it. */
+	DeviceRole["CoverGarage"] = "cover-garage";
+	/** Gate. HA `device_class: gate`. A security actuator: exports gate it. */
+	DeviceRole["CoverGate"] = "cover-gate";
+	/** Door. HA `device_class: door`. A security actuator: exports gate it. */
+	DeviceRole["CoverDoor"] = "cover-door";
+	/** Window. HA `device_class: window`. */
+	DeviceRole["CoverWindow"] = "cover-window";
 	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
 	*  real Switch device for UI rendering / export adapters. */
 	DeviceRole["BinaryHelper"] = "binary-helper";
@@ -8819,7 +8855,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-C-WpVYTX.mjs
+//#region ../types/dist/composition-EQ9Ok0Ee.mjs
 var AUDIO_ENCODER_BY_CODEC = {
 	opus: "libopus",
 	aac: "aac",
@@ -12377,20 +12413,20 @@ var SURVIVING_TRIGGER_KEYS = [
 	"objectClasses",
 	"sensorDeviceIds"
 ];
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function listensToLegacySignal(band) {
-	return isRecord$1(band) && isRecord$1(band.triggers) && band.triggers.deviceSignal === true;
+	return isRecord$2(band) && isRecord$2(band.triggers) && band.triggers.deviceSignal === true;
 }
 function hasSurvivingTrigger(band) {
 	const triggers = band.triggers;
-	if (!isRecord$1(triggers)) return false;
+	if (!isRecord$2(triggers)) return false;
 	return SURVIVING_TRIGGER_KEYS.some((key) => triggers[key] !== void 0);
 }
 function withoutLegacySignal(band) {
 	const triggers = band.triggers;
-	if (!isRecord$1(triggers)) return band;
+	if (!isRecord$2(triggers)) return band;
 	const { deviceSignal: _retired, ...rest } = triggers;
 	return {
 		...band,
@@ -12420,11 +12456,11 @@ function migrateLegacyDeviceSignalConfig(raw) {
 		migrated: false,
 		strippedOnly: false
 	};
-	if (!isRecord$1(raw) || !Array.isArray(raw.bands)) return unchanged;
+	if (!isRecord$2(raw) || !Array.isArray(raw.bands)) return unchanged;
 	if (!raw.bands.some(listensToLegacySignal)) return unchanged;
 	const kept = [];
 	for (const band of raw.bands) {
-		if (!listensToLegacySignal(band) || !isRecord$1(band)) {
+		if (!listensToLegacySignal(band) || !isRecord$2(band)) {
 			kept.push(band);
 			continue;
 		}
@@ -14652,6 +14688,14 @@ var ConvertResultSchema = object({
 		files: array(string()).readonly()
 	})).readonly()
 });
+_enum(["new-session", "step-up"]);
+/** The languages the hub's app landing pages are written in (D858). */
+var AppPageLangSchema = _enum(["en", "it"]);
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = discriminatedUnion("kind", [object({ kind: literal("native") }), object({
+	kind: literal("browser"),
+	startPath: string().startsWith("/")
+})]);
 /**
 * Device certificates (D855) — the wire contract shared by the hub, the admin
 * UI and the native viewer.
@@ -14811,7 +14855,9 @@ object({
 	signature: literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: array(_enum(["native", "web"]))
+	clients: array(_enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 var ExpressionBindingSourceSchema = union([
 	object({
@@ -15141,7 +15187,9 @@ var ConfigTabDeclarationSchema = object({
 var ConfigSectionWithValuesSchema = object({
 	id: string(),
 	title: string(),
+	titleKey: string().optional(),
 	description: string().optional(),
+	descriptionKey: string().optional(),
 	style: _enum(["card", "accordion"]).optional(),
 	defaultCollapsed: boolean().optional(),
 	columns: union([
@@ -18839,6 +18887,9 @@ method(object({
 }), method(object({ refs: RefListSchema }), KeychainResolveResultSchema, { auth: "admin" }), method(object({ refs: RefListSchema }), object({ deleted: number().int() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ deviceId: number().int() }), object({ refs: array(string()).readonly() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
 /**
 * device-history — the ONE mechanism for numeric history (D850).
@@ -40273,6 +40324,42 @@ var DeviceRegisterPayloadSchema = object({
 	*  omits it and the keyword backstop applies. */
 	secretConfigPaths: array(string()).optional()
 });
+/** One deleted device, kept by device-manager so an addon that missed the
+*  deletion can still learn of it (D865). Written by the delete path ONLY. */
+var DeviceTombstoneSchema = object({
+	deviceId: number().int().positive(),
+	/** Epoch ms the device was deleted. */
+	deletedAt: number(),
+	/** The addon that owned the device when it was deleted. */
+	providerAddonId: string()
+});
+/** How long a tombstone stays readable. Past it, a device that was deleted
+*  and never cleaned is only reachable by the admin "clean data of deleted
+*  devices" action. */
+var DEVICE_TOMBSTONE_RETENTION_MS = 2160 * 60 * 60 * 1e3;
+/** Data held for one device that device-manager no longer knows. */
+var OrphanDeviceDataSchema = object({
+	deviceId: number().int().positive(),
+	/** Rows/files per store (`<addonId>:<store>`). */
+	stores: record(string(), number().int().nonnegative())
+});
+var CleanupDeletedDevicesResultSchema = object({
+	/**
+	* `skipped` — the absence check could not be trusted (a device-list read
+	* failed or the two reads disagreed); nothing was listed or deleted.
+	* `dry-run` — `devices` is what a confirmed run would delete.
+	* `cleaned` — `devices` is what was deleted.
+	*/
+	status: _enum([
+		"skipped",
+		"dry-run",
+		"cleaned"
+	]),
+	reason: string().nullable(),
+	devices: array(OrphanDeviceDataSchema),
+	/** Implementers that could not be asked (their stores are not in `devices`). */
+	unreachable: array(string())
+});
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
 	deviceId: number(),
@@ -40511,6 +40598,9 @@ method(object({
 }), method(object({ deviceId: number() }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ sinceMs: number() }), array(DeviceTombstoneSchema).readonly(), { auth: "admin" }), method(object({ confirm: boolean() }), CleanupDeletedDevicesResultSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ integrationId: string() }), object({ removed: number() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -40973,6 +41063,85 @@ method(object({
 	auth: "admin"
 });
 /**
+* `device-removal-hook` — the reliable way an addon learns a device was DELETED,
+* so it can delete what it keeps for that device (D865).
+*
+* ## Why an event was not enough
+*
+* `DeviceUnregistered` is telemetry and may be dropped (D8, D11). An addon that
+* hung its per-device clean-up on it left durable garbage whenever the event was
+* lost, the addon was down, or it was restarting at that moment — footage,
+* analytics rows and settings of device 4483 outlived the device. Loss of this
+* signal corrupts durable state, so it travels by RPC with a recorded fact
+* behind it (D8: "if loss would corrupt durable state, use RPC plus a reconcile").
+*
+* ## The three pieces
+*
+* 1. device-manager records a TOMBSTONE per deleted device
+*    (`deviceManager.listDeletedSince`). The tombstone is written by the delete
+*    path only — a device that is unregistered, offline or whose provider is
+*    restarting is NOT deleted and gets none.
+* 2. After a delete, device-manager calls `onDeviceRemoved` on EVERY provider of
+*    this collection, one by one, with bounded retries, logged.
+* 3. An implementer that was down asks `deviceManager.listDeletedSince` at start
+*    (and periodically) and runs its own `onDeviceRemoved` for each tombstone it
+*    may have missed. Reconcile is driven by tombstones, never by "the device is
+*    not in the current list": a failed or partial list read must not destroy data.
+*
+* ## Contract for an implementer
+*
+* - **Idempotent.** It is called again by a retry, by a reconcile and by the
+*   admin cleanup of data that predates tombstones. A device with nothing left
+*   answers zero counts.
+* - **One key per store** in `counts`, deleted rows/files per store, so the log
+*   line and the admin dry run can say where the data was.
+* - **Training datasets are NOT device data** and are never deleted by a hook.
+* - **Per-device SETTINGS are not hooked.** Configuration lives in the standard
+*   per-device store (`ctx.settings.*DeviceStore`), which device-manager clears
+*   for every addon centrally at delete time. This hook is for device DATA
+*   that is not settings: footage, event media, analytics rows, history.
+* - A provider that cannot tell is allowed to throw; the caller retries it.
+*
+* `listDeviceData` is the read side of the admin "Clean data of deleted devices"
+* action: which device ids this addon holds data for, and how much per store. It
+* never deletes. device-manager decides which of those ids are absent from the
+* fleet, from TWO consistent reads of the device list (D49).
+*/
+/** What a hook is told about the deletion. */
+var DeviceRemovedInputSchema = object({
+	deviceId: number().int().positive(),
+	/** Epoch ms the device was deleted (the tombstone's `deletedAt`). */
+	deletedAt: number(),
+	/** The addon that owned the device, as device-manager last knew it. */
+	providerAddonId: string()
+});
+/** Rows/files/refs deleted, per store this implementer owns. */
+var DeviceRemovedResultSchema = object({ counts: record(string(), number().int().nonnegative()) });
+/** One (store, device) pair an implementer holds data for. */
+var DeviceDataEntrySchema = object({
+	store: string(),
+	deviceId: number().int().positive(),
+	/** Rows (or files) held for the device in the store. */
+	count: number().int().nonnegative()
+});
+var deviceRemovalHookCapability = {
+	name: "device-removal-hook",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/** Delete everything this addon keeps for the deleted device. Idempotent. */
+		onDeviceRemoved: method(DeviceRemovedInputSchema, DeviceRemovedResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Which devices this addon holds data for, per store. Reads only. */
+		listDeviceData: method(_void(), array(DeviceDataEntrySchema).readonly(), { auth: "admin" })
+	},
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
+/**
 * `failure-contribution` — the capability an addon reports its OWN losses
 * through, per camera, with the denominator attached. It stores nothing.
 *
@@ -41994,7 +42163,13 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		* `beginExternalLink` offer exactly the redirect methods that set this,
 		* whatever their id. Absent / false — a login button only.
 		*/
-		linkable: boolean().optional()
+		linkable: boolean().optional(),
+		/**
+		* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+		* when the route understands the app flow query (`app=1&code_challenge=…`),
+		* `null`/absent when there is no app path - the app hides the method.
+		*/
+		app: AppLoginPathSchema.nullable().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -42006,7 +42181,9 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		bundle: string(),
 		/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 		remote: WidgetRemoteSchema,
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+		app: AppLoginPathSchema.nullable().optional()
 	}),
 	object({
 		kind: literal("passkey"),
@@ -42018,7 +42195,9 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 		rpId: string(),
 		/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-		origin: string().nullable()
+		origin: string().nullable(),
+		/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+		app: AppLoginPathSchema.nullable().optional()
 	})
 ]);
 method(_void(), array(LoginMethodContributionSchema).readonly());
@@ -42545,7 +42724,21 @@ var NetworkEndpointSchema = object({
 	url: string(),
 	hostname: string(),
 	port: number(),
-	protocol: _enum(["http", "https"])
+	protocol: _enum(["http", "https"]),
+	/**
+	* Whether this address survives a restart of its provider. `false` = it is
+	* re-issued every time (a Quick tunnel's random `*.trycloudflare.com`); the
+	* hub never selects such an address AUTOMATICALLY for a role (D860), though
+	* it stays visible and an operator may still flag it. Absent = stable: every
+	* provider except a Quick tunnel owns a name that does not change.
+	*/
+	stable: boolean().optional()
+});
+object({
+	url: string(),
+	/** Mirrors {@link NetworkEndpointSchema} `stable`; absent = stable. */
+	stable: boolean().optional(),
+	updated: boolean().optional()
 });
 var NetworkAccessStatusSchema = object({
 	connected: boolean(),
@@ -53349,7 +53542,22 @@ var SsoBridgeClaimsSchema = object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: string().optional()
+	browserBinding: string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: object({
+		codeChallenge: string(),
+		state: string(),
+		purpose: _enum(["new-session", "step-up"]),
+		redirect: string(),
+		/** The page language the app asked for (D858); the confirm page speaks it. */
+		lang: _enum(["en", "it"]).optional()
+	}).optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -55969,7 +56177,12 @@ var SearchResultSchema = object({
 	publishedAt: string(),
 	author: string(),
 	installed: boolean(),
-	installedVersion: string().optional()
+	installedVersion: string().optional(),
+	/**
+	* Capability names the package's addons declare (from its published
+	* manifest). `null` = the registry lookup failed — unknown, never `[]` (D393).
+	*/
+	capabilities: array(string()).readonly().nullable()
 });
 var AutoUpdateSettingsSchema = object({
 	channel: ChannelSchema,
@@ -56131,7 +56344,11 @@ method(object({ nodeId: string().optional() }).optional(), array(AddonListItemSc
 }), method(object({ packageName: string().optional() }), PackageInstallationsSchema, { auth: "admin" }), method(_void(), ReloadPackagesResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ query: string().optional() }), array(SearchResultSchema)), method(object({ nodeId: string().optional() }), array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(object({
+}), method(object({
+	query: string().optional(),
+	/** Only packages whose addons declare this capability (unknown ones excluded). */
+	capability: string().optional()
+}), array(SearchResultSchema)), method(object({ nodeId: string().optional() }), array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(object({
 	name: string().min(1),
 	version: string().optional(),
 	nodeId: string().optional()
@@ -58628,7 +58845,13 @@ var ConnectionEndpointSchema = object({
 	* calls so the client can sort even if the cap returns a new
 	* ordering between polls.
 	*/
-	priority: number()
+	priority: number(),
+	/**
+	* `false` = the address changes on its own (a Quick tunnel, re-issued on
+	* every respawn). Automatic role resolution skips it (D860); an explicit
+	* operator flag still honours it. Absent = stable.
+	*/
+	stable: boolean().optional()
 });
 /**
 * Where the advertised local port came from. Ordered most → least
@@ -63724,6 +63947,21 @@ DeviceType.Switch, DeviceType.Siren, DeviceType.Light, method(object({
 	on: boolean(),
 	lastChangedAt: number()
 });
+/** C0 controls, DEL and the C1 range: none of them belongs in a name. */
+function hasControlCharacter(value) {
+	for (const char of value) {
+		const code = char.codePointAt(0) ?? 0;
+		if (code <= 31 || code >= 127 && code <= 159) return true;
+	}
+	return false;
+}
+string().transform((value) => value.trim()).pipe(string().min(1, "The server name cannot be empty").max(48, `The server name is at most 48 characters`).refine((value) => !hasControlCharacter(value), { message: "The server name cannot contain control characters" }));
+/** What every reader gets: the name to show, and whether the hub chose it itself. */
+var ServerNameInfoSchema = object({
+	name: string(),
+	/** `true` when nobody named the hub: `name` is the machine hostname. */
+	isDefault: boolean()
+});
 /**
 * system — system-scoped singleton capability exposing hub-level
 * health, feature flags, network interface enumeration, and the
@@ -63753,6 +63991,12 @@ var FeatureManifestSchema = object({
 	backup: boolean(),
 	repl: boolean()
 });
+/**
+* `system.info`: the feature flags plus the hub's human name (D861). The name is
+* `{ name, isDefault }` — `isDefault: true` means nobody named the hub and `name`
+* is the machine hostname.
+*/
+var SystemInfoSchema = FeatureManifestSchema.extend({ serverName: ServerNameInfoSchema });
 var HealthStatusSchema = object({
 	status: literal("ok"),
 	uptime: number()
@@ -64225,7 +64469,7 @@ var LoggingSettingsStateSchema = object({
 	opsLogRetentionDays: number().int().min(0),
 	persisted: boolean()
 });
-method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
+method(_void(), SystemInfoSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(_void(), _void(), {
@@ -67294,6 +67538,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.cleanupDeletedDevicesData": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.createDevice": {
 		capName: "device-manager",
 		capScope: "system",
@@ -67474,6 +67724,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.listDeletedSince": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.listDeviceIdsByCaps": {
 		capName: "device-manager",
 		capScope: "system",
@@ -67882,6 +68138,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceRemovalHook.listDeviceData": {
+		capName: "device-removal-hook",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceRemovalHook.onDeviceRemoved": {
+		capName: "device-removal-hook",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceState.claimFields": {
 		capName: "device-state",
 		capScope: "system",
@@ -68314,6 +68582,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"keychain.deleteDeviceScope": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"keychain.getState": {
 		capName: "keychain",
 		capScope: "system",
@@ -74326,6 +74600,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceRemovalHook.onDeviceRemoved": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.claimFields": [{
 		name: "deviceId",
 		form: "single",
@@ -74515,6 +74794,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"keychain.deleteDeviceScope": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"lawnMowerControl.dock": [{
 		name: "deviceId",
 		form: "single",
@@ -76913,6 +77197,8 @@ new Set([
 	"audio-tools",
 	"audio-silence"
 ]);
+AppPageLangSchema.options;
+record(string().min(1), string());
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -78478,6 +78764,76 @@ function enumerateInferenceDevices(hw) {
 	}
 	return out;
 }
+/** How often an implementer re-asks for tombstones after its start-up pass. */
+var REMOVAL_RECONCILE_INTERVAL_MS = 360 * 60 * 1e3;
+/** One reconcile pass over every tombstone inside the retention window. */
+async function reconcileRemovedDevices(opts) {
+	const now = opts.now ?? (() => Date.now());
+	const api = opts.api;
+	if (api === void 0) {
+		opts.logger.warn("device removal reconcile skipped — no device-manager api");
+		return {
+			read: false,
+			applied: 0,
+			failed: 0
+		};
+	}
+	let tombstones;
+	try {
+		tombstones = await api.deviceManager.listDeletedSince.query({ sinceMs: now() - DEVICE_TOMBSTONE_RETENTION_MS });
+	} catch (err) {
+		opts.logger.warn("device removal reconcile skipped — tombstones unreadable, nothing deleted", { meta: { error: errMsg(err) } });
+		return {
+			read: false,
+			applied: 0,
+			failed: 0
+		};
+	}
+	let applied = 0;
+	let failed = 0;
+	for (const tombstone of tombstones) try {
+		const result = await opts.remove(tombstone);
+		applied += 1;
+		if (Object.values(result.counts).reduce((sum, n) => sum + n, 0) > 0) opts.logger.info("device removal reconcile cleaned a missed deletion", {
+			tags: { deviceId: tombstone.deviceId },
+			meta: {
+				counts: result.counts,
+				deletedAt: tombstone.deletedAt
+			}
+		});
+	} catch (err) {
+		failed += 1;
+		opts.logger.warn("device removal reconcile failed for a device — retried next pass", {
+			tags: { deviceId: tombstone.deviceId },
+			meta: { error: errMsg(err) }
+		});
+	}
+	return {
+		read: true,
+		applied,
+		failed
+	};
+}
+/**
+* Run the reconcile now and then periodically. Returns the disposer. The timer
+* is unref'd and a pass never overlaps the previous one.
+*/
+function armRemovalReconcile(opts) {
+	let running = false;
+	const pass = () => {
+		if (running) return;
+		running = true;
+		reconcileRemovedDevices(opts).catch((err) => {
+			opts.logger.warn("device removal reconcile pass crashed", { meta: { error: errMsg(err) } });
+		}).finally(() => {
+			running = false;
+		});
+	};
+	pass();
+	const timer = setInterval(pass, REMOVAL_RECONCILE_INTERVAL_MS);
+	timer.unref?.();
+	return () => clearInterval(timer);
+}
 //#endregion
 Object.defineProperty(exports, "APPEARANCE_BLOCKS", {
 	enumerable: true,
@@ -78857,6 +79213,12 @@ Object.defineProperty(exports, "applyModelBoundSettings", {
 		return applyModelBoundSettings;
 	}
 });
+Object.defineProperty(exports, "armRemovalReconcile", {
+	enumerable: true,
+	get: function() {
+		return armRemovalReconcile;
+	}
+});
 Object.defineProperty(exports, "array", {
 	enumerable: true,
 	get: function() {
@@ -79019,6 +79381,12 @@ Object.defineProperty(exports, "detectionPipelineCapability", {
 		return detectionPipelineCapability;
 	}
 });
+Object.defineProperty(exports, "deviceRemovalHookCapability", {
+	enumerable: true,
+	get: function() {
+		return deviceRemovalHookCapability;
+	}
+});
 Object.defineProperty(exports, "discriminatedUnion", {
 	enumerable: true,
 	get: function() {
@@ -79487,6 +79855,12 @@ Object.defineProperty(exports, "union", {
 		return union;
 	}
 });
+Object.defineProperty(exports, "userError", {
+	enumerable: true,
+	get: function() {
+		return userError;
+	}
+});
 Object.defineProperty(exports, "videoclipsCapability", {
 	enumerable: true,
 	get: function() {