@camstack/addon-post-analysis 1.2.369 → 1.2.370

package/dist/{clip-model-registry-E4CGZ8NR.js → clip-model-registry-C3AUTkBR.js}

@@ -5490,7 +5490,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BBF1iXUi.mjs
+//#region ../types/dist/sleep-DRqxtc0C.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8517,6 +8517,10 @@ var DEVICE_SCOPED_CAPS = new Set([
 function isDeviceScopedCap(capName) {
 	return DEVICE_SCOPED_CAPS.has(capName);
 }
+object({
+	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
+	params: record(string(), union([string(), number()])).optional()
+});
 function hfModelUrl(repo, path) {
 	return `https://huggingface.co/${repo}/resolve/main/${path}`;
 }
@@ -8545,7 +8549,7 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/err-msg-DX6i_MY4.mjs
+//#region ../types/dist/err-msg-DLerKiVO.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -8795,6 +8799,22 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 	DeviceRole["Nightvision"] = "nightvision";
 	DeviceRole["PrivacyMask"] = "privacy-mask";
 	DeviceRole["Doorbell"] = "doorbell";
+	/** Interior blind / shade / roller blind. HA `device_class: blind|shade`. */
+	DeviceRole["CoverBlind"] = "cover-blind";
+	/** Exterior roller shutter. HA `device_class: shutter`; Homematic BROLL. */
+	DeviceRole["CoverShutter"] = "cover-shutter";
+	/** Exterior awning. HA `device_class: awning`. */
+	DeviceRole["CoverAwning"] = "cover-awning";
+	/** Curtain / drape. HA `device_class: curtain`. */
+	DeviceRole["CoverCurtain"] = "cover-curtain";
+	/** Garage door. HA `device_class: garage`. A security actuator: exports gate it. */
+	DeviceRole["CoverGarage"] = "cover-garage";
+	/** Gate. HA `device_class: gate`. A security actuator: exports gate it. */
+	DeviceRole["CoverGate"] = "cover-gate";
+	/** Door. HA `device_class: door`. A security actuator: exports gate it. */
+	DeviceRole["CoverDoor"] = "cover-door";
+	/** Window. HA `device_class: window`. */
+	DeviceRole["CoverWindow"] = "cover-window";
 	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
 	*  real Switch device for UI rendering / export adapters. */
 	DeviceRole["BinaryHelper"] = "binary-helper";
@@ -8875,7 +8895,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-C-WpVYTX.mjs
+//#region ../types/dist/composition-EQ9Ok0Ee.mjs
 /**
 * Deterministic SHA-256 hash of an arbitrary serialisable value. The
 * canonical form sorts object keys alphabetically at every depth so two
@@ -13436,6 +13456,177 @@ var ConvertResultSchema = object({
 		files: array(string()).readonly()
 	})).readonly()
 });
+_enum(["new-session", "step-up"]);
+/** The languages the hub's app landing pages are written in (D858). */
+var AppPageLangSchema = _enum(["en", "it"]);
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = discriminatedUnion("kind", [object({ kind: literal("native") }), object({
+	kind: literal("browser"),
+	startPath: string().startsWith("/")
+})]);
+/**
+* Device certificates (D855) — the wire contract shared by the hub, the admin
+* UI and the native viewer.
+*
+* A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+* Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+* key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+* dedicated device CA; the device later proves possession of the key by
+* signing a hub-issued nonce, and the hub answers with the same session a
+* password login opens.
+*
+* Everything on the wire is a small string (a PEM, a base64url signature):
+* D613 is about bulk bytes, and a certificate is ~600 bytes.
+*/
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+var DEVICE_CERT_SIGNATURE = "ecdsa-p256-sha256";
+/** First line of every signed message; a change of format bumps the version. */
+var DEVICE_SIGNATURE_MESSAGE_VERSION = "camstack-device-cert-v1";
+_enum([
+	"login",
+	"renew",
+	"revoke"
+]);
+var DevicePlatformSchema = _enum([
+	"ios",
+	"android",
+	"web",
+	"other"
+]);
+var Base64UrlSchema = string().min(1).max(4096).regex(/^[A-Za-z0-9_-]+$/);
+var PemSchema = string().min(1).max(16384);
+/**
+* Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+* failure: those carry no reason and mean "try again", never "the credential is
+* dead". The viewer switches on this exhaustively.
+*/
+var DeviceRefusalReasonSchema = _enum([
+	"revoked",
+	"unknown-credential",
+	"expired",
+	"bad-signature",
+	"nonce-invalid",
+	"rate-limited",
+	"invalid-certificate",
+	"superseded",
+	"user-gone",
+	"unavailable",
+	"code-invalid",
+	"self-enrollment-disabled",
+	"step-up-required",
+	"bad-public-key"
+]);
+var DeviceRefusalSchema = object({
+	ok: literal(false),
+	reason: DeviceRefusalReasonSchema,
+	definitive: boolean(),
+	retryAfterSeconds: number().optional()
+});
+object({
+	code: string().min(1).max(256),
+	/** SubjectPublicKeyInfo DER of the device's P-256 public key, base64url. */
+	publicKeySpki: Base64UrlSchema,
+	deviceName: string().min(1).max(80).optional(),
+	platform: DevicePlatformSchema
+});
+discriminatedUnion("ok", [object({
+	credentialId: string(),
+	certPem: PemSchema,
+	/** The device CA certificate the leaf chains to. */
+	chainPem: PemSchema,
+	notAfter: number(),
+	user: object({
+		id: string(),
+		username: string()
+	})
+}).extend({ ok: literal(true) }), DeviceRefusalSchema]);
+object({
+	/** The single-use step-up proof (`auth.deviceEnrollProofFrom…`). */
+	proof: string().min(1).max(512),
+	publicKeySpki: Base64UrlSchema,
+	deviceName: string().min(1).max(80),
+	platform: DevicePlatformSchema
+});
+object({
+	proof: string(),
+	expiresAt: number()
+});
+discriminatedUnion("ok", [object({
+	nonce: string(),
+	/** The origin to put in the signed message. The app compares it to the hub it dialled. */
+	origin: string(),
+	expiresAt: number(),
+	signature: literal(DEVICE_CERT_SIGNATURE)
+}).extend({ ok: literal(true) }), DeviceRefusalSchema]);
+object({
+	certPem: PemSchema,
+	nonce: string().min(1).max(256),
+	/** ECDSA P-256 SHA-256 over {@link buildDeviceSignatureMessage}; raw r||s or DER, base64url. */
+	signature: Base64UrlSchema
+});
+discriminatedUnion("ok", [object({
+	credentialId: string(),
+	certPem: PemSchema,
+	chainPem: PemSchema,
+	notAfter: number()
+}).extend({ ok: literal(true) }), DeviceRefusalSchema]);
+discriminatedUnion("ok", [object({
+	ok: literal(true),
+	credentialId: string(),
+	sessionsEnded: number().int()
+}), DeviceRefusalSchema]);
+var DeviceCredentialStatusSchema = _enum([
+	"active",
+	"expired",
+	"revoked"
+]);
+var DeviceCredentialSchema = object({
+	id: string(),
+	userId: string(),
+	username: string().nullable(),
+	deviceName: string(),
+	platform: DevicePlatformSchema,
+	enrolledVia: _enum(["qr", "self"]),
+	/** SHA-256 of the leaf certificate DER, colon-hex. */
+	fingerprint: string(),
+	issuedAt: number(),
+	expiresAt: number(),
+	lastUsedAt: number().nullable(),
+	lastUsedFrom: string().nullable(),
+	revokedAt: number().nullable(),
+	/** `admin:<userId>` | `user:<userId>` | `device` | `user-deleted`. */
+	revokedBy: string().nullable(),
+	status: DeviceCredentialStatusSchema
+});
+var StartEnrollmentOutputSchema = object({
+	/** Shown once; only its hash is kept. */
+	code: string(),
+	expiresAt: number(),
+	/** `camstack://enroll?hub=…&code=…` — what the QR encodes. */
+	enrollUrl: string(),
+	/** The hub origin in the link, or `null` when the hub could not name one (the link then has no `hub`). */
+	hubOrigin: string().nullable(),
+	/** Every origin the apps may try (role `appConnections`). */
+	hubOrigins: array(string())
+});
+object({
+	kind: literal("device-certificate"),
+	id: literal("device-certificate"),
+	label: string(),
+	stage: literal("primary"),
+	/** tRPC paths under the hub's `auth` router, so a client names no literal. */
+	challengePath: literal("auth.getDeviceChallenge"),
+	revokePath: literal("auth.revokeOwnDeviceCertificate"),
+	enrollSelfPath: literal("auth.enrollSelf"),
+	loginPath: literal("auth.loginWithDeviceCertificate"),
+	renewPath: literal("auth.renewDeviceCertificate"),
+	signature: literal(DEVICE_CERT_SIGNATURE),
+	messageVersion: literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
+	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
+	clients: array(_enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
+});
 var ExpressionBindingSourceSchema = union([
 	object({
 		kind: literal("field").optional(),
@@ -13764,7 +13955,9 @@ var ConfigTabDeclarationSchema = object({
 var ConfigSectionWithValuesSchema = object({
 	id: string(),
 	title: string(),
+	titleKey: string().optional(),
 	description: string().optional(),
+	descriptionKey: string().optional(),
 	style: _enum(["card", "accordion"]).optional(),
 	defaultCollapsed: boolean().optional(),
 	columns: union([
@@ -16279,7 +16472,11 @@ var cameraStreamsCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `online` duplicates device-status.online (one authority); slot data is nested enum/string.
+	*/
+	history: "none"
 };
 /** kebab-case cap name → camelCase router-map key. */
 function kebabToCamel(s) {
@@ -17122,7 +17319,345 @@ method(object({
 }), method(object({ refs: RefListSchema }), KeychainResolveResultSchema, { auth: "admin" }), method(object({ refs: RefListSchema }), object({ deleted: number().int() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ deviceId: number().int() }), object({ refs: array(string()).readonly() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
+/**
+* device-history — the ONE mechanism for numeric history (D850).
+*
+* A device value is recorded because its capability says so (the `history`
+* block of a `*.cap.ts`, captured hub-side from `DeviceStateChanged`); any
+* other series is DECLARED by the addon that produces it and fed with points
+* (`record`) or closed five-minute buckets (`recordBuckets`). Rollups 5m / 1h /
+* 1d are computed here and nowhere else. Storage is `history.db` (D851).
+*
+* Who the PRODUCER is: `declareSeries`, `record` and `recordBuckets` are owner
+* checked against the `callerAddonId` the transport stamps into a call that
+* crossed a process (never in an input schema, so a session cannot supply it).
+* A call with no stamp is refused `not-owner`. The methods are `admin` so a
+* non-admin session never reaches them; an addon's `ctx.api` call bypasses the
+* tier by design.
+*/
+/** Whose history: a real device, or a cluster node (load, memory). */
+var DeviceHistorySubjectSchema = discriminatedUnion("kind", [object({
+	kind: literal("device"),
+	deviceId: number().int()
+}), object({
+	kind: literal("node"),
+	nodeId: string().min(1)
+})]);
+var DeviceHistoryKindSchema = _enum([
+	"gauge",
+	"counter",
+	"boolean"
+]);
+var DeviceHistoryResolutionSchema = _enum([
+	"raw",
+	"5m",
+	"1h",
+	"1d"
+]);
+/** Why a producer's point or bucket was not stored. Counted, never silent (D391). */
+var DeviceHistoryRefusalReasonSchema = _enum([
+	"undeclared",
+	"not-owner",
+	"opted-out",
+	"not-a-real-device",
+	"rate",
+	"ingest-mismatch",
+	"out-of-range"
+]);
+var RefusalSchema = object({
+	key: string(),
+	reason: DeviceHistoryRefusalReasonSchema,
+	count: number().int()
+});
+var IngestResultSchema = object({
+	accepted: number().int(),
+	refused: array(RefusalSchema).readonly()
+});
+var SeriesInfoSchema = object({
+	key: string(),
+	scope: string(),
+	kind: DeviceHistoryKindSchema,
+	/** `null` is unknown (a `unitFrom` series whose device does not state a unit right now), never a guess. */
+	unit: string().nullable(),
+	displayName: string(),
+	source: _enum(["cap", "addon"]),
+	firstTs: number(),
+	lastTs: number()
+});
+var QueryPointSchema = object({
+	/** Raw: the point's time. Rollup: the bucket start. */
+	t: number(),
+	samples: number().int(),
+	/** `sum / samples`. */
+	mean: number().nullable(),
+	/** Time-weighted mean (`tw_sum / tw_ms`); `null` for bucket-ingested series. For a boolean: the fraction of time true. */
+	twMean: number().nullable(),
+	min: number(),
+	max: number(),
+	/** `null` is unknown, never zero (D393). */
+	last: number().nullable()
+});
+var QuerySeriesSchema = object({
+	scope: string(),
+	/** The last point STRICTLY BEFORE `from` in the chosen tier, so a step chart can start at the held value. */
+	before: object({
+		t: number(),
+		value: number().nullable()
+	}).nullable(),
+	points: array(QueryPointSchema).readonly()
+});
+/** The window part of a query, shared by the device and node forms. */
+var QueryWindowShape = {
+	key: string(),
+	scope: string().optional(),
+	from: number(),
+	to: number(),
+	resolution: union([DeviceHistoryResolutionSchema, literal("auto")]).default("auto"),
+	maxPoints: number().int().positive().max(5e3).default(1e3)
+};
+var QueryResultSchema = object({
+	resolution: DeviceHistoryResolutionSchema,
+	series: array(QuerySeriesSchema).readonly(),
+	truncated: boolean()
+});
+var TierStatusSchema = object({
+	tier: DeviceHistoryResolutionSchema,
+	/** `null` until the first background count answered. */
+	rows: number().int().nullable(),
+	/** `rows` times a fixed per-row estimate — approximate, labelled so. */
+	approxBytes: number().nullable(),
+	countedAt: number().nullable()
+});
+/** Operator/diagnostic view: rows per tier, last runs, refusals and drops since boot. */
+var DeviceHistoryStatusSchema = object({
+	startedAt: number(),
+	/** The store is declared, series loaded and the first reconcile has answered. */
+	ready: boolean(),
+	series: number().int(),
+	metrics: number().int(),
+	optedOutDevices: number().int(),
+	tiers: array(TierStatusSchema).readonly(),
+	capture: object({
+		eventsSeen: number().int(),
+		pointsEmitted: number().int(),
+		pointsWritten: number().int(),
+		pointsDropped: number().int(),
+		bufferDepth: number().int(),
+		trailingEmitted: number().int(),
+		reconciledPoints: number().int(),
+		reconcileRuns: number().int(),
+		reconcileFailures: number().int(),
+		lastReconcileAt: number().nullable(),
+		lastFlushAt: number().nullable(),
+		flushFailures: number().int(),
+		skipped: record(string(), number().int())
+	}),
+	ingest: object({
+		accepted: number().int(),
+		refused: record(string(), number().int())
+	}),
+	rollup: object({
+		last5mAt: number().nullable(),
+		last1hAt: number().nullable(),
+		last1dAt: number().nullable(),
+		errors: number().int(),
+		dirty5m: number().int(),
+		dirty1h: number().int(),
+		dirty1d: number().int()
+	}),
+	retention: object({
+		lastRunAt: number().nullable(),
+		deleted: record(string(), number().int()),
+		purgedSeries: number().int()
+	}),
+	directory: object({
+		devices: number().int(),
+		lastRefreshAt: number().nullable()
+	})
+});
+method(object({ deviceId: number().int() }), array(SeriesInfoSchema).readonly()), method(object({ nodeId: string().min(1) }), array(SeriesInfoSchema).readonly(), { auth: "admin" }), method(object({
+	deviceId: number().int(),
+	...QueryWindowShape
+}), QueryResultSchema), method(object({
+	nodeId: string().min(1),
+	...QueryWindowShape
+}), QueryResultSchema, { auth: "admin" }), method(object({
+	name: string().regex(/^[a-z0-9-]+$/),
+	subjectKind: _enum(["device", "node"]),
+	kind: DeviceHistoryKindSchema,
+	unit: string().optional(),
+	displayName: string().min(1),
+	ingest: _enum(["points", "buckets"])
+}), object({ key: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ points: array(object({
+	key: string(),
+	subject: DeviceHistorySubjectSchema,
+	scope: string().default(""),
+	ts: number(),
+	value: number()
+})).max(5e3) }), IngestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ buckets: array(object({
+	key: string(),
+	subject: DeviceHistorySubjectSchema,
+	scope: string().default(""),
+	bucketStart: number(),
+	samples: number().int().positive(),
+	sum: number(),
+	min: number(),
+	max: number(),
+	last: number().nullable(),
+	lastTs: number().nullable()
+})).max(5e3) }), IngestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int() }), object({ enabled: boolean() })), method(object({
+	deviceId: number().int(),
+	enabled: boolean()
+}), object({ enabled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), DeviceHistoryStatusSchema, { auth: "admin" });
+var DeviceCaStatusSchema = discriminatedUnion("state", [
+	object({ state: literal("absent") }),
+	object({
+		state: literal("ready"),
+		subject: string(),
+		fingerprintSha256: string(),
+		validTo: string()
+	}),
+	object({
+		state: literal("unavailable"),
+		reason: string()
+	})
+]);
+var DeviceCertificateSettingsSchema = object({ selfEnrollment: _enum(["allowed", "disabled"]) });
+method(object({
+	userId: string().min(1).optional(),
+	includeRevoked: boolean().default(false)
+}), array(DeviceCredentialSchema).readonly(), { auth: "admin" }), method(object({
+	userId: string().min(1),
+	deviceName: string().min(1).max(80)
+}), StartEnrollmentOutputSchema, {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ id: string().min(1) }), object({
+	revoked: boolean(),
+	sessionsEnded: number().int(),
+	status: DeviceCredentialStatusSchema
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), DeviceCertificateSettingsSchema, { auth: "admin" }), method(DeviceCertificateSettingsSchema, DeviceCertificateSettingsSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), object({ result: _enum([
+	"deleted",
+	"live",
+	"unknown"
+]) }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), DeviceCaStatusSchema, { auth: "admin" }), method(object({
+	id: string().min(1),
+	deviceName: string().min(1).max(80)
+}), object({ renamed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* `node-certificates` - what a node holds and the two renewals the hub drives
+* (D856): the node's MESH leaf (mutual TLS to the hub) and its HTTPS leaf (issued
+* from the hub's local CA so a device that trusts the hub root trusts the node).
+*
+* Provided by the AGENT RUNTIME (the synthetic `agent-runtime` addon id, like
+* `server-management`): the hub reaches it through the ordinary node-pinned
+* capability call - no new Moleculer action. The hub's own certificates are
+* handled in-process by the hub (`certificates` router), so this cap has no hub
+* provider.
+*
+* No private key ever crosses the mesh: the node generates its key pair, sends a
+* CSR, and the hub returns only the signed certificate.
+*/
+var MeshLeafInfoSchema = object({
+	cn: string(),
+	serial: string(),
+	fingerprintSha256: string(),
+	notBefore: number(),
+	notAfter: number()
+});
+var HttpsLeafInfoSchema = object({
+	fingerprintSha256: string(),
+	issuer: string(),
+	sans: array(string()),
+	notBefore: number(),
+	notAfter: number()
+});
+var NodeHttpsStateSchema = discriminatedUnion("state", [object({
+	state: literal("served"),
+	leaf: HttpsLeafInfoSchema
+}), object({
+	state: literal("not-issued"),
+	reason: string()
+})]);
+method(object({}), object({
+	nodeId: string(),
+	mesh: MeshLeafInfoSchema.nullable(),
+	https: NodeHttpsStateSchema
+}), { auth: "admin" }), method(object({}), object({ csrPem: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	caCertPem: string().min(1),
+	confirmWithinMs: number().int().min(1e4).max(6e5)
+}), object({
+	fingerprintSha256: string(),
+	serial: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ fingerprintSha256: string() }), object({ confirmed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ rolledBack: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({
+	csrPem: string(),
+	hostnames: array(string()),
+	addresses: array(string()),
+	/** SHA-256 of the hub local CA this node pinned at its first install; `null` before one. */
+	pinnedCaFingerprintSha256: string().nullable()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	caCertPem: string().min(1),
+	/**
+	* The hub signals that its local CA was rotated (D227) and this leaf chains to the NEW
+	* one. Only the hub, over the authenticated mesh, can say so; a leaf with a different CA
+	* and no signal is refused.
+	*/
+	caRotation: boolean().optional()
+}), HttpsLeafInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 var KeychainKeySourceSchema = object({
 	kind: _enum([
 		"config-file",
@@ -17597,6 +18132,10 @@ var deviceDiscoveryCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "session",
+	/**
+	* History (D850): none — inventory.
+	*/
+	history: "none",
 	methods: {
 		/**
 		* Snapshot of the current `discovered` list. Returns the
@@ -38297,6 +38836,42 @@ var DeviceRegisterPayloadSchema = object({
 	*  omits it and the keyword backstop applies. */
 	secretConfigPaths: array(string()).optional()
 });
+/** One deleted device, kept by device-manager so an addon that missed the
+*  deletion can still learn of it (D865). Written by the delete path ONLY. */
+var DeviceTombstoneSchema = object({
+	deviceId: number().int().positive(),
+	/** Epoch ms the device was deleted. */
+	deletedAt: number(),
+	/** The addon that owned the device when it was deleted. */
+	providerAddonId: string()
+});
+/** How long a tombstone stays readable. Past it, a device that was deleted
+*  and never cleaned is only reachable by the admin "clean data of deleted
+*  devices" action. */
+var DEVICE_TOMBSTONE_RETENTION_MS = 2160 * 60 * 60 * 1e3;
+/** Data held for one device that device-manager no longer knows. */
+var OrphanDeviceDataSchema = object({
+	deviceId: number().int().positive(),
+	/** Rows/files per store (`<addonId>:<store>`). */
+	stores: record(string(), number().int().nonnegative())
+});
+var CleanupDeletedDevicesResultSchema = object({
+	/**
+	* `skipped` — the absence check could not be trusted (a device-list read
+	* failed or the two reads disagreed); nothing was listed or deleted.
+	* `dry-run` — `devices` is what a confirmed run would delete.
+	* `cleaned` — `devices` is what was deleted.
+	*/
+	status: _enum([
+		"skipped",
+		"dry-run",
+		"cleaned"
+	]),
+	reason: string().nullable(),
+	devices: array(OrphanDeviceDataSchema),
+	/** Implementers that could not be asked (their stores are not in `devices`). */
+	unreachable: array(string())
+});
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
 	deviceId: number(),
@@ -38535,6 +39110,9 @@ method(object({
 }), method(object({ deviceId: number() }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ sinceMs: number() }), array(DeviceTombstoneSchema).readonly(), { auth: "admin" }), method(object({ confirm: boolean() }), CleanupDeletedDevicesResultSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ integrationId: string() }), object({ removed: number() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -39068,6 +39646,85 @@ var embeddingEncoderCapability = {
 	}
 };
 /**
+* `device-removal-hook` — the reliable way an addon learns a device was DELETED,
+* so it can delete what it keeps for that device (D865).
+*
+* ## Why an event was not enough
+*
+* `DeviceUnregistered` is telemetry and may be dropped (D8, D11). An addon that
+* hung its per-device clean-up on it left durable garbage whenever the event was
+* lost, the addon was down, or it was restarting at that moment — footage,
+* analytics rows and settings of device 4483 outlived the device. Loss of this
+* signal corrupts durable state, so it travels by RPC with a recorded fact
+* behind it (D8: "if loss would corrupt durable state, use RPC plus a reconcile").
+*
+* ## The three pieces
+*
+* 1. device-manager records a TOMBSTONE per deleted device
+*    (`deviceManager.listDeletedSince`). The tombstone is written by the delete
+*    path only — a device that is unregistered, offline or whose provider is
+*    restarting is NOT deleted and gets none.
+* 2. After a delete, device-manager calls `onDeviceRemoved` on EVERY provider of
+*    this collection, one by one, with bounded retries, logged.
+* 3. An implementer that was down asks `deviceManager.listDeletedSince` at start
+*    (and periodically) and runs its own `onDeviceRemoved` for each tombstone it
+*    may have missed. Reconcile is driven by tombstones, never by "the device is
+*    not in the current list": a failed or partial list read must not destroy data.
+*
+* ## Contract for an implementer
+*
+* - **Idempotent.** It is called again by a retry, by a reconcile and by the
+*   admin cleanup of data that predates tombstones. A device with nothing left
+*   answers zero counts.
+* - **One key per store** in `counts`, deleted rows/files per store, so the log
+*   line and the admin dry run can say where the data was.
+* - **Training datasets are NOT device data** and are never deleted by a hook.
+* - **Per-device SETTINGS are not hooked.** Configuration lives in the standard
+*   per-device store (`ctx.settings.*DeviceStore`), which device-manager clears
+*   for every addon centrally at delete time. This hook is for device DATA
+*   that is not settings: footage, event media, analytics rows, history.
+* - A provider that cannot tell is allowed to throw; the caller retries it.
+*
+* `listDeviceData` is the read side of the admin "Clean data of deleted devices"
+* action: which device ids this addon holds data for, and how much per store. It
+* never deletes. device-manager decides which of those ids are absent from the
+* fleet, from TWO consistent reads of the device list (D49).
+*/
+/** What a hook is told about the deletion. */
+var DeviceRemovedInputSchema = object({
+	deviceId: number().int().positive(),
+	/** Epoch ms the device was deleted (the tombstone's `deletedAt`). */
+	deletedAt: number(),
+	/** The addon that owned the device, as device-manager last knew it. */
+	providerAddonId: string()
+});
+/** Rows/files/refs deleted, per store this implementer owns. */
+var DeviceRemovedResultSchema = object({ counts: record(string(), number().int().nonnegative()) });
+/** One (store, device) pair an implementer holds data for. */
+var DeviceDataEntrySchema = object({
+	store: string(),
+	deviceId: number().int().positive(),
+	/** Rows (or files) held for the device in the store. */
+	count: number().int().nonnegative()
+});
+var deviceRemovalHookCapability = {
+	name: "device-removal-hook",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/** Delete everything this addon keeps for the deleted device. Idempotent. */
+		onDeviceRemoved: method(DeviceRemovedInputSchema, DeviceRemovedResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Which devices this addon holds data for, per store. Reads only. */
+		listDeviceData: method(_void(), array(DeviceDataEntrySchema).readonly(), { auth: "admin" })
+	},
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
+/**
 * `failure-contribution` — the capability an addon reports its OWN losses
 * through, per camera, with the denominator attached. It stores nothing.
 *
@@ -40144,7 +40801,13 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		* `beginExternalLink` offer exactly the redirect methods that set this,
 		* whatever their id. Absent / false — a login button only.
 		*/
-		linkable: boolean().optional()
+		linkable: boolean().optional(),
+		/**
+		* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+		* when the route understands the app flow query (`app=1&code_challenge=…`),
+		* `null`/absent when there is no app path - the app hides the method.
+		*/
+		app: AppLoginPathSchema.nullable().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -40156,7 +40819,9 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		bundle: string(),
 		/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 		remote: WidgetRemoteSchema,
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+		app: AppLoginPathSchema.nullable().optional()
 	}),
 	object({
 		kind: literal("passkey"),
@@ -40168,7 +40833,9 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 		rpId: string(),
 		/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-		origin: string().nullable()
+		origin: string().nullable(),
+		/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+		app: AppLoginPathSchema.nullable().optional()
 	})
 ]);
 method(_void(), array(LoginMethodContributionSchema).readonly());
@@ -40678,7 +41345,21 @@ var NetworkEndpointSchema = object({
 	url: string(),
 	hostname: string(),
 	port: number(),
-	protocol: _enum(["http", "https"])
+	protocol: _enum(["http", "https"]),
+	/**
+	* Whether this address survives a restart of its provider. `false` = it is
+	* re-issued every time (a Quick tunnel's random `*.trycloudflare.com`); the
+	* hub never selects such an address AUTOMATICALLY for a role (D860), though
+	* it stays visible and an operator may still flag it. Absent = stable: every
+	* provider except a Quick tunnel owns a name that does not change.
+	*/
+	stable: boolean().optional()
+});
+object({
+	url: string(),
+	/** Mirrors {@link NetworkEndpointSchema} `stable`; absent = stable. */
+	stable: boolean().optional(),
+	updated: boolean().optional()
 });
 var NetworkAccessStatusSchema = object({
 	connected: boolean(),
@@ -41806,6 +42487,10 @@ var alarmPanelCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — enum state; arm/disarm history belongs in the events ledger.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -50220,7 +50905,11 @@ var zonesCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "restored"
+	durability: "restored",
+	/**
+	* History (D850): none — configuration arrays.
+	*/
+	history: "none"
 };
 /**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
@@ -52601,7 +53290,22 @@ var SsoBridgeClaimsSchema = object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: string().optional()
+	browserBinding: string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: object({
+		codeChallenge: string(),
+		state: string(),
+		purpose: _enum(["new-session", "step-up"]),
+		redirect: string(),
+		/** The page language the app asked for (D858); the confirm page speaks it. */
+		lang: _enum(["en", "it"]).optional()
+	}).optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -53008,6 +53712,10 @@ var streamSignalsCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "session",
+	/**
+	* History (D850): none — array state.
+	*/
+	history: "none",
 	methods: { 
 	/**
 	* What this device can emit. Empty is a valid and common answer — most
@@ -54870,7 +55578,12 @@ var SearchResultSchema = object({
 	publishedAt: string(),
 	author: string(),
 	installed: boolean(),
-	installedVersion: string().optional()
+	installedVersion: string().optional(),
+	/**
+	* Capability names the package's addons declare (from its published
+	* manifest). `null` = the registry lookup failed — unknown, never `[]` (D393).
+	*/
+	capabilities: array(string()).readonly().nullable()
 });
 var AutoUpdateSettingsSchema = object({
 	channel: ChannelSchema,
@@ -55032,7 +55745,11 @@ method(object({ nodeId: string().optional() }).optional(), array(AddonListItemSc
 }), method(object({ packageName: string().optional() }), PackageInstallationsSchema, { auth: "admin" }), method(_void(), ReloadPackagesResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ query: string().optional() }), array(SearchResultSchema)), method(object({ nodeId: string().optional() }), array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(object({
+}), method(object({
+	query: string().optional(),
+	/** Only packages whose addons declare this capability (unknown ones excluded). */
+	capability: string().optional()
+}), array(SearchResultSchema)), method(object({ nodeId: string().optional() }), array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(object({
 	name: string().min(1),
 	version: string().optional(),
 	nodeId: string().optional()
@@ -55168,6 +55885,36 @@ var airQualitySensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: {
+		co2Ppm: {
+			kind: "gauge",
+			unit: "ppm",
+			deadband: 5
+		},
+		vocPpb: {
+			kind: "gauge",
+			unit: "ppb",
+			deadband: 5
+		},
+		pm25: {
+			kind: "gauge",
+			unit: "ug/m3",
+			deadband: 1
+		},
+		pm10: {
+			kind: "gauge",
+			unit: "ug/m3",
+			deadband: 1
+		},
+		aqi: {
+			kind: "gauge",
+			unit: "count",
+			deadband: 1
+		}
+	} },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -55210,6 +55957,15 @@ var ambientLightSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. Wide range, so a RELATIVE deadband (10 %).
+	*/
+	history: { fields: { lux: {
+		kind: "gauge",
+		unit: "lx",
+		deadbandPct: 10,
+		minIntervalMs: 6e4
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -55337,7 +56093,11 @@ var audioMetricsCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — the level is the addon series `pipeline-analytics/audio-level` (producer `record`); the other numbers move every inference window and duplicate it.
+	*/
+	history: "none"
 };
 /**
 * Automation-control cap. Models HA `automation.*` entities on
@@ -55406,7 +56166,11 @@ var automationControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — configuration and transient run state.
+	*/
+	history: "none"
 };
 /**
 * Battery status snapshot. Emitted by providers whose device is
@@ -55587,6 +56351,13 @@ onStatusChanged: { data: object({
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. The generic capture replaces the `battery` series of `pipeline-analytics:stats-5m`.
+	*/
+	history: { fields: { percentage: {
+		kind: "gauge",
+		unit: "%"
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastUpdated"]
@@ -55626,6 +56397,10 @@ var binaryCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { on: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -55688,7 +56463,15 @@ onBrightnessChanged: { data: object({
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Actuator tier: level keeps every change.
+	*/
+	history: { fields: { percentage: {
+		kind: "gauge",
+		unit: "%",
+		minIntervalMs: 0
+	} } }
 };
 DeviceType.Button, method(object({ deviceId: number().int().nonnegative() }), _void(), {
 	kind: "mutation",
@@ -56049,6 +56832,10 @@ var carbonMonoxideCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { detected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -56218,7 +57005,37 @@ var climateControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Celsius by contract; setpoints keep every change (`minIntervalMs: 0`).
+	*/
+	history: { fields: {
+		currentTemp: {
+			kind: "gauge",
+			unit: "°C",
+			deadband: .1
+		},
+		currentHumidity: {
+			kind: "gauge",
+			unit: "%",
+			deadband: .5
+		},
+		target: {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		},
+		targetHigh: {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		},
+		targetLow: {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		}
+	} }
 };
 /**
 * Color-light cap. Coexists with `switch` (on/off) and `brightness`
@@ -56335,7 +57152,11 @@ onColorChanged: { data: object({
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — nested and cosmetic.
+	*/
+	history: "none"
 };
 var ConnectionTestOutcomeSchema = discriminatedUnion("outcome", [
 	object({
@@ -56401,6 +57222,10 @@ var connectivityCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — duplicates device-status.online (one authority for availability).
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -56525,6 +57350,10 @@ reset: method(object({
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — `items` is an array keyed by runtime ids; a history path never enters it.
+	*/
+	history: "none",
 	/** Clocks, not content: a re-read that changed no item costs no commit. */
 	volatileStateFields: ["lastChangedAt", "lastFetchedAt"]
 };
@@ -56565,6 +57394,10 @@ var contactCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { entryOpen: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -56680,7 +57513,11 @@ var controlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `value` is a number/string union; configuration entity.
+	*/
+	history: "none"
 };
 /**
 * Window covering / blinds / garage door / valve cap. Models HA
@@ -56771,6 +57608,14 @@ var coverCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. Actuator tier: position keeps every tick of a movement.
+	*/
+	history: { fields: { position: {
+		kind: "gauge",
+		unit: "%",
+		minIntervalMs: 0
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -56875,6 +57720,10 @@ var dayNightCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — firmware configuration, not a measurement.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -56932,6 +57781,10 @@ onStatusChanged: { data: object({
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. The ONE availability series.
+	*/
+	history: { fields: { online: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -56998,7 +57851,11 @@ onPressed: {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "restored"
+	durability: "restored",
+	/**
+	* History (D850): none — `pressCountSinceStart` resets with the addon, so it is not a monotonic meter; presses live in the events ledger.
+	*/
+	history: "none"
 };
 /**
 * Enum-state sensor — a string value picked from a finite option set.
@@ -57046,6 +57903,10 @@ var enumSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — text/enum state has no history (non-goal).
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -57091,7 +57952,11 @@ var eventEmitterCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `eventCountSinceStart` resets with the addon; events live in ledgers.
+	*/
+	history: "none"
 };
 var IdentitySchema = object({
 	id: string(),
@@ -57587,7 +58452,18 @@ var fanControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Actuator tier: speed keeps every change.
+	*/
+	history: { fields: {
+		percentage: {
+			kind: "gauge",
+			unit: "%",
+			minIntervalMs: 0
+		},
+		oscillating: { kind: "boolean" }
+	} }
 };
 /**
 * Per-device feature/identity probe slice. Holds the runtime-resolved
@@ -57670,7 +58546,11 @@ onProbeChanged: { data: object({
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — static identity and capability probe.
+	*/
+	history: "none"
 };
 /**
 * Water leak / moisture sensor. Boolean "is liquid currently
@@ -57705,6 +58585,10 @@ var floodCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { flooded: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -57738,6 +58622,10 @@ var gasCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { detected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -57823,7 +58711,18 @@ var humidifierCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: {
+		currentHumidity: {
+			kind: "gauge",
+			unit: "%",
+			deadband: .5
+		},
+		on: { kind: "boolean" }
+	} }
 };
 /**
 * Single-metric humidity reading. Drives Home Assistant `sensor`
@@ -57867,6 +58766,14 @@ var humiditySensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { percent: {
+		kind: "gauge",
+		unit: "%",
+		deadband: .5
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -57914,7 +58821,11 @@ var imageCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — not numeric.
+	*/
+	history: "none"
 };
 /**
 * Vendor-neutral image / picture-adjustment cap — the per-camera config
@@ -58071,6 +58982,10 @@ var imageSettingsCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — camera image configuration (operator intent), not a trend.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -58456,7 +59371,11 @@ var intercomCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — talk sessions are a ledger concern, not a trend.
+	*/
+	history: "none"
 };
 /**
 * Robotic lawn-mower cap. Models HA `lawn_mower.*` entities — anything
@@ -58537,7 +59456,15 @@ var lawnMowerControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { batteryLevel: {
+		kind: "gauge",
+		unit: "%",
+		deadband: 2
+	} } }
 };
 /**
 * local-network — hub-only singleton.
@@ -58664,7 +59591,13 @@ var ConnectionEndpointSchema = object({
 	* calls so the client can sort even if the cap returns a new
 	* ordering between polls.
 	*/
-	priority: number()
+	priority: number(),
+	/**
+	* `false` = the address changes on its own (a Quick tunnel, re-issued on
+	* every respawn). Automatic role resolution skips it (D860); an explicit
+	* operator flag still honours it. Absent = stable.
+	*/
+	stable: boolean().optional()
 });
 /**
 * Where the advertised local port came from. Ordered most → least
@@ -58965,6 +59898,10 @@ var lockControlCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — enum state; lock events belong in the events ledger.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -59136,7 +60073,11 @@ var mediaPlayerCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `positionMs` moves continuously while playing; volume is transient.
+	*/
+	history: "none"
 };
 /**
 * mesh-network — collection cap for mesh-VPN providers.
@@ -59470,7 +60411,14 @@ onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. A PIR sensor is a series; a camera is not (its motion is an addon series and a ledger).
+	*/
+	history: { fields: { detected: {
+		kind: "boolean",
+		excludeDeviceTypes: [DeviceType.Camera]
+	} } }
 };
 /**
 * Motion-trigger toggle for accessory devices.
@@ -59542,7 +60490,11 @@ var motionTriggerCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — configuration switch.
+	*/
+	history: "none"
 };
 /**
 * Motion-zones share the same MaskShape vocabulary as privacy-mask — the
@@ -59617,6 +60569,10 @@ var motionZonesCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — configuration.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -59746,6 +60702,10 @@ var nativeObjectDetectionCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — event-like and nested per class; detections live in the objects ledger.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -60029,7 +60989,11 @@ var navigationCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — control state of a robotic camera, configuration-like.
+	*/
+	history: "none"
 };
 /**
 * Network-link snapshot. Same shape for every provider (a Reolink wifi
@@ -60109,6 +61073,23 @@ onStatusChanged: { data: object({
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: {
+		signalPercent: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 3,
+			minIntervalMs: 6e4
+		},
+		rssiDbm: {
+			kind: "gauge",
+			unit: "dBm",
+			deadband: 2,
+			minIntervalMs: 6e4
+		}
+	} },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastUpdated"]
@@ -60497,7 +61478,11 @@ onSent: { data: object({
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `queueDepth` is outbox operational state, not a device trend.
+	*/
+	history: "none"
 };
 /**
 * Generic numeric sensor — last-resort fallback when no typed numeric
@@ -60548,6 +61533,14 @@ var numericSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. The unit is per device, read from the sibling `unit` field.
+	*/
+	history: { fields: { value: {
+		kind: "gauge",
+		unitFrom: "unit",
+		minIntervalMs: 3e4
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -60978,7 +61971,24 @@ var petFeederCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: {
+		foodLevel: { kind: "gauge" },
+		food1: { kind: "gauge" },
+		food2: { kind: "gauge" },
+		batteryPower: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		desiccantLeftDays: {
+			kind: "gauge",
+			unit: "days"
+		}
+	} }
 };
 var VehicleSchema = object({
 	id: string(),
@@ -61390,6 +62400,47 @@ var powerMeterCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. Gauges are floored at 30 s; `kwhTotal` is the one monotonic meter (counter).
+	*/
+	history: { fields: {
+		watts: {
+			kind: "gauge",
+			unit: "W",
+			deadband: 1,
+			minIntervalMs: 3e4
+		},
+		kwhTotal: {
+			kind: "counter",
+			unit: "kWh",
+			deadband: .01,
+			minIntervalMs: 6e4
+		},
+		volts: {
+			kind: "gauge",
+			unit: "V",
+			deadband: 1,
+			minIntervalMs: 3e4
+		},
+		amps: {
+			kind: "gauge",
+			unit: "A",
+			deadband: .05,
+			minIntervalMs: 3e4
+		},
+		va: {
+			kind: "gauge",
+			unit: "VA",
+			deadband: 1,
+			minIntervalMs: 3e4
+		},
+		powerFactor: {
+			kind: "gauge",
+			unit: "ratio",
+			deadband: .01,
+			minIntervalMs: 6e4
+		}
+	} },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -61457,6 +62508,14 @@ var presenceCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { batteryPercent: {
+		kind: "gauge",
+		unit: "%",
+		deadband: 1
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -61503,6 +62562,14 @@ var pressureSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { hpa: {
+		kind: "gauge",
+		unit: "hPa",
+		deadband: .1
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -61662,6 +62729,10 @@ var privacyMaskCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — configuration.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -62023,7 +63094,11 @@ var ptzAutotrackCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — configuration and capability.
+	*/
+	history: "none"
 };
 DeviceType.Camera, DeviceType.Sensor, DeviceType.Switch, method(object({ deviceId: number().int().nonnegative() }), object({ success: literal(true) }), {
 	kind: "mutation",
@@ -63481,6 +64556,10 @@ var recordingOnboardCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — SD-card configuration and window inventory; arrays.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -63554,7 +64633,11 @@ getStatus: method(object({ deviceId: number() }), RecordingSignalStatusSchema) }
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — recording intent is already in the recordings ledger.
+	*/
+	history: "none"
 };
 /**
 * scene-monitor — device-scoped reference-region state cap. An operator marks
@@ -63945,7 +65028,11 @@ var sceneMonitorCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — nested configuration.
+	*/
+	history: "none"
 };
 /**
 * Per-stage gating mode applied to the zones a rule references.
@@ -64096,7 +65183,11 @@ var scriptRunnerCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — transient; run results belong in a ledger.
+	*/
+	history: "none"
 };
 /**
 * Smoke alarm sensor — boolean "is smoke currently detected" with
@@ -64131,6 +65222,10 @@ var smokeCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { detected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -64230,6 +65325,10 @@ var streamCatalogCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — stream inventory.
+	*/
+	history: "none",
 	/** Clock field: written, but excluded from the compare that decides whether
 	*  persisting is worth a SQLite commit — the descriptors are the value. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -64379,6 +65478,10 @@ var streamParamsCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — encoder configuration.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -64434,6 +65537,10 @@ var switchCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { on: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"],
@@ -64448,6 +65555,21 @@ var switchCapability = {
 		}
 	}] }
 };
+/** C0 controls, DEL and the C1 range: none of them belongs in a name. */
+function hasControlCharacter(value) {
+	for (const char of value) {
+		const code = char.codePointAt(0) ?? 0;
+		if (code <= 31 || code >= 127 && code <= 159) return true;
+	}
+	return false;
+}
+string().transform((value) => value.trim()).pipe(string().min(1, "The server name cannot be empty").max(48, `The server name is at most 48 characters`).refine((value) => !hasControlCharacter(value), { message: "The server name cannot contain control characters" }));
+/** What every reader gets: the name to show, and whether the hub chose it itself. */
+var ServerNameInfoSchema = object({
+	name: string(),
+	/** `true` when nobody named the hub: `name` is the machine hostname. */
+	isDefault: boolean()
+});
 /**
 * system — system-scoped singleton capability exposing hub-level
 * health, feature flags, network interface enumeration, and the
@@ -64477,6 +65599,12 @@ var FeatureManifestSchema = object({
 	backup: boolean(),
 	repl: boolean()
 });
+/**
+* `system.info`: the feature flags plus the hub's human name (D861). The name is
+* `{ name, isDefault }` — `isDefault: true` means nobody named the hub and `name`
+* is the machine hostname.
+*/
+var SystemInfoSchema = FeatureManifestSchema.extend({ serverName: ServerNameInfoSchema });
 var HealthStatusSchema = object({
 	status: literal("ok"),
 	uptime: number()
@@ -64949,7 +66077,7 @@ var LoggingSettingsStateSchema = object({
 	opsLogRetentionDays: number().int().min(0),
 	persisted: boolean()
 });
-method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
+method(_void(), SystemInfoSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(_void(), _void(), {
@@ -64995,6 +66123,10 @@ var tamperCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { tampered: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -65050,6 +66182,14 @@ var temperatureSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { celsius: {
+		kind: "gauge",
+		unit: "°C",
+		deadband: .1
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -65128,7 +66268,11 @@ var updateCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — text and state.
+	*/
+	history: "none"
 };
 var UserSummarySchema = object({
 	id: string(),
@@ -65485,7 +66629,37 @@ var vacuumControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Tank levels are fixed-object paths (`cleanWater.level`, ...).
+	*/
+	history: { fields: {
+		batteryLevel: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"cleanWater.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"dirtyWater.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"detergent.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"dustBin.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		}
+	} }
 };
 var ValveStatusSchema = object({
 	/** Lifecycle state of the valve. */
@@ -65544,7 +66718,15 @@ var valveCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Actuator tier: position keeps every change.
+	*/
+	history: { fields: { position: {
+		kind: "gauge",
+		unit: "%",
+		minIntervalMs: 0
+	} } }
 };
 /**
 * Vibration / shake / impact sensor. Drives Home Assistant
@@ -65574,6 +66756,10 @@ var vibrationCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { detected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -65657,7 +66843,22 @@ var waterHeaterCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. The schema carries no unit; providers publish Celsius. Setpoint keeps every change.
+	*/
+	history: { fields: {
+		currentTemp: {
+			kind: "gauge",
+			unit: "°C",
+			deadband: .5
+		},
+		targetTemp: {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		}
+	} }
 };
 /**
 * Weather provider cap. Models HA `weather.*` entities — a read-only
@@ -65723,7 +66924,32 @@ var weatherCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Units follow the sibling `*Unit` fields.
+	*/
+	history: { fields: {
+		temperature: {
+			kind: "gauge",
+			unitFrom: "temperatureUnit",
+			deadband: .2
+		},
+		humidity: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		pressure: {
+			kind: "gauge",
+			unitFrom: "pressureUnit",
+			deadband: .5
+		},
+		windSpeed: {
+			kind: "gauge",
+			unitFrom: "windSpeedUnit",
+			deadband: .5
+		}
+	} }
 };
 /**
 * Per-zone occupancy aggregation produced by the analytics frame
@@ -65965,7 +67191,11 @@ var zoneAnalyticsCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — occupancy is the addon series `pipeline-analytics/occupancy`; the rest is per-zone arrays keyed by runtime ids.
+	*/
+	history: "none"
 };
 /**
 * Stages a {@link ZoneRule} can apply to. Discriminator on the rules
@@ -66050,7 +67280,11 @@ var zoneRulesCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "restored"
+	durability: "restored",
+	/**
+	* History (D850): none — configuration arrays.
+	*/
+	history: "none"
 };
 /**
 * `training-provider` — ONE cloud that can run the CamStack trainer.
@@ -69215,6 +70449,54 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceCredentials.deleteDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.getDeviceCaStatus": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.getDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.listDeviceCredentials": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.renameDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.revokeDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.setDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.startEnrollment": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceDiscovery.adoptDevice": {
 		capName: "device-discovery",
 		capScope: "device",
@@ -69317,6 +70599,66 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceHistory.declareSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.getDeviceEnabled": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.getStatus": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.listNodeSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.listSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.query": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.queryNode": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.record": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.recordBuckets": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.setDeviceEnabled": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -69395,6 +70737,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.cleanupDeletedDevicesData": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.createDevice": {
 		capName: "device-manager",
 		capScope: "system",
@@ -69575,6 +70923,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.listDeletedSince": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.listDeviceIdsByCaps": {
 		capName: "device-manager",
 		capScope: "system",
@@ -69983,6 +71337,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceRemovalHook.listDeviceData": {
+		capName: "device-removal-hook",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceRemovalHook.onDeviceRemoved": {
+		capName: "device-removal-hook",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceState.claimFields": {
 		capName: "device-state",
 		capScope: "system",
@@ -70415,6 +71781,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"keychain.deleteDeviceScope": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"keychain.getState": {
 		capName: "keychain",
 		capScope: "system",
@@ -71375,6 +72747,54 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.confirmMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.forgetHub": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"nodeCertificates.getCertificates": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"nodeCertificates.installHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.installMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareMeshRenewal": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.rollbackMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"nodes.clusterAddonStatus": {
 		capName: "nodes",
 		capScope: "system",
@@ -76066,6 +77486,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceHistory.getDeviceEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.listSeries": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.query": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.setDeviceEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -76359,6 +77799,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceRemovalHook.onDeviceRemoved": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.claimFields": [{
 		name: "deviceId",
 		form: "single",
@@ -76548,6 +77993,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"keychain.deleteDeviceScope": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"lawnMowerControl.dock": [{
 		name: "deviceId",
 		form: "single",
@@ -78244,6 +79694,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+DeviceType.Camera;
 var G711_SCALE_CORRECTION_DB = {
 	PCMU: 20 * Math.log10(4),
 	PCMA: 20 * Math.log10(8)
@@ -81028,6 +82479,8 @@ function eventKindLabel(kind, locale) {
 	const key = kind.trim().toLowerCase();
 	return isEventKindLabelKey(key) ? EVENT_KIND_LABELS[key][locale] : kind;
 }
+AppPageLangSchema.options;
+record(string().min(1), string());
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -81456,6 +82909,32 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 		h
 	};
 }
+/** Slider bounds. `0` is "disabled"; anything in 1..9 is raised to `min`. */
+var FACE_RESCORE_INTERVAL_FIELD = {
+	min: 0,
+	max: 1440,
+	step: 5,
+	default: 60
+};
+/**
+* Narrow a stored value to minutes. `0` ⇒ disabled; a positive value under
+* {@link FACE_RESCORE_INTERVAL_MIN_RUNNING} is raised to it; junk or absent ⇒
+* the default (an unreadable setting must not switch the job off nor storm it).
+*/
+function readFaceRescoreIntervalMinutes(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return FACE_RESCORE_INTERVAL_FIELD.default;
+	if (value === 0) return 0;
+	return Math.min(FACE_RESCORE_INTERVAL_FIELD.max, Math.max(10, Math.floor(value)));
+}
+/** The interval out of a hydrated payload; a `null` view (mid-boot) is the default. */
+function pickFaceRescoreIntervalMinutes(view) {
+	if (view === null) return FACE_RESCORE_INTERVAL_FIELD.default;
+	for (const section of view.sections) for (const entry of section.fields) {
+		if (typeof entry !== "object" || entry === null || !("key" in entry)) continue;
+		if (entry.key === "faceRescoreIntervalMinutes") return readFaceRescoreIntervalMinutes("value" in entry ? entry.value : void 0);
+	}
+	return FACE_RESCORE_INTERVAL_FIELD.default;
+}
 /**
 * WHICH delivered frames the decode worker retains a native copy of.
 *
@@ -81940,6 +83419,76 @@ function encodeVectorBase64(vector) {
 function vectorDimFromBase64(encoded) {
 	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
 }
+/** How often an implementer re-asks for tombstones after its start-up pass. */
+var REMOVAL_RECONCILE_INTERVAL_MS = 360 * 60 * 1e3;
+/** One reconcile pass over every tombstone inside the retention window. */
+async function reconcileRemovedDevices(opts) {
+	const now = opts.now ?? (() => Date.now());
+	const api = opts.api;
+	if (api === void 0) {
+		opts.logger.warn("device removal reconcile skipped — no device-manager api");
+		return {
+			read: false,
+			applied: 0,
+			failed: 0
+		};
+	}
+	let tombstones;
+	try {
+		tombstones = await api.deviceManager.listDeletedSince.query({ sinceMs: now() - DEVICE_TOMBSTONE_RETENTION_MS });
+	} catch (err) {
+		opts.logger.warn("device removal reconcile skipped — tombstones unreadable, nothing deleted", { meta: { error: errMsg(err) } });
+		return {
+			read: false,
+			applied: 0,
+			failed: 0
+		};
+	}
+	let applied = 0;
+	let failed = 0;
+	for (const tombstone of tombstones) try {
+		const result = await opts.remove(tombstone);
+		applied += 1;
+		if (Object.values(result.counts).reduce((sum, n) => sum + n, 0) > 0) opts.logger.info("device removal reconcile cleaned a missed deletion", {
+			tags: { deviceId: tombstone.deviceId },
+			meta: {
+				counts: result.counts,
+				deletedAt: tombstone.deletedAt
+			}
+		});
+	} catch (err) {
+		failed += 1;
+		opts.logger.warn("device removal reconcile failed for a device — retried next pass", {
+			tags: { deviceId: tombstone.deviceId },
+			meta: { error: errMsg(err) }
+		});
+	}
+	return {
+		read: true,
+		applied,
+		failed
+	};
+}
+/**
+* Run the reconcile now and then periodically. Returns the disposer. The timer
+* is unref'd and a pass never overlaps the previous one.
+*/
+function armRemovalReconcile(opts) {
+	let running = false;
+	const pass = () => {
+		if (running) return;
+		running = true;
+		reconcileRemovedDevices(opts).catch((err) => {
+			opts.logger.warn("device removal reconcile pass crashed", { meta: { error: errMsg(err) } });
+		}).finally(() => {
+			running = false;
+		});
+	};
+	pass();
+	const timer = setInterval(pass, REMOVAL_RECONCILE_INTERVAL_MS);
+	timer.unref?.();
+	return () => clearInterval(timer);
+}
 //#endregion
 //#region src/pipeline-analytics/cluster-model-pin.ts
 /**
@@ -82326,6 +83875,12 @@ Object.defineProperty(exports, "CLIP_TEXT_MODELS", {
 		return CLIP_TEXT_MODELS;
 	}
 });
+Object.defineProperty(exports, "CLUSTER_MODEL_OWNER_ADDON_ID", {
+	enumerable: true,
+	get: function() {
+		return CLUSTER_MODEL_OWNER_ADDON_ID;
+	}
+});
 Object.defineProperty(exports, "COCO_TO_MACRO", {
 	enumerable: true,
 	get: function() {
@@ -83136,6 +84691,12 @@ Object.defineProperty(exports, "applySecureOnArmEdit", {
 		return applySecureOnArmEdit;
 	}
 });
+Object.defineProperty(exports, "armRemovalReconcile", {
+	enumerable: true,
+	get: function() {
+		return armRemovalReconcile;
+	}
+});
 Object.defineProperty(exports, "array", {
 	enumerable: true,
 	get: function() {
@@ -83280,6 +84841,12 @@ Object.defineProperty(exports, "describeSystemEventFamilyProblem", {
 		return describeSystemEventFamilyProblem;
 	}
 });
+Object.defineProperty(exports, "deviceRemovalHookCapability", {
+	enumerable: true,
+	get: function() {
+		return deviceRemovalHookCapability;
+	}
+});
 Object.defineProperty(exports, "discriminatedUnion", {
 	enumerable: true,
 	get: function() {
@@ -83574,6 +85141,12 @@ Object.defineProperty(exports, "partialRecord", {
 		return partialRecord;
 	}
 });
+Object.defineProperty(exports, "pickFaceRescoreIntervalMinutes", {
+	enumerable: true,
+	get: function() {
+		return pickFaceRescoreIntervalMinutes;
+	}
+});
 Object.defineProperty(exports, "pipelineAnalyticsCapability", {
 	enumerable: true,
 	get: function() {