@camstack/addon-post-analysis 1.2.610 → 1.2.612

package/dist/{clip-model-registry-B1BMbjlk.js → clip-model-registry-C7WMvftu.js}

@@ -5643,7 +5643,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BxjU_fJM.mjs
+//#region ../types/dist/sleep-BSuCCFjf.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8026,9 +8026,9 @@ function normalizeAddonInitResult(result) {
 	return result;
 }
 /**
-* The share-view scope kinds a `csv_*` share token can carry. The hub mints
-* and validates them (`share-token.service.ts` builds its enum from this
-* list); a data plane names the kinds it ACCEPTS in `share`.
+* The share-view scope kinds a share-link token can carry. The hub mints
+* and validates them (`ShareViewGrantSchema` builds its
+* enum from this list); a data plane names the kinds it ACCEPTS in `share`.
 */
 var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
 /** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
@@ -14006,7 +14006,7 @@ var ConvertResultSchema = object({
 * `super_admin` — collapsed onto the single boolean because every
 * non-admin caller is governed by the same scope-check rules; the
 * distinction was only ever used to route role-specific procedures
-* which we no longer have. CLI / webhook integrations are `cst_*` tokens
+* which we no longer have. CLI / webhook integrations are tokens (`auth.mintToken`)
 * with `isAdmin: false` + an explicit scope list.
 */
 /** Per-method access flavour. Materialised on every cap method via codegen. */
@@ -14195,10 +14195,12 @@ var AddonRoutesScopeSchema = object({
 	type: literal("addon-routes"),
 	access: array(MethodAccessSchema).min(1)
 });
+var PreferencesSelfScopeSchema = object({ type: literal("preferences-self") });
 var CredentialScopeSchema = union([
 	literal("*"),
 	ShareViewScopeSchema,
 	AddonRoutesScopeSchema,
+	PreferencesSelfScopeSchema,
 	TokenScopeSchema
 ]);
 object({
@@ -14207,6 +14209,55 @@ object({
 	jti: string().min(16),
 	scopes: array(CredentialScopeSchema).min(1)
 });
+var PreferenceNamespaceSchema = string().regex(/^[a-z][a-z0-9.-]{0,63}$/);
+/** A namespace's value: a JSON object, opaque to the hub. */
+var PreferenceValueSchema = record(string(), unknown());
+var PreferenceDeviceIdSchema = string().min(1).max(64);
+/** A stored row, as the owner reads it. */
+var PreferenceRowSchema = object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/** Starts at 1, +1 on every write of this namespace. A delete ends the row and its count. */
+	revision: number().int().positive(),
+	updatedAt: number().int(),
+	/** The client id the last writer sent; `null` when it sent none. */
+	updatedByDevice: PreferenceDeviceIdSchema.nullable()
+});
+object({ 
+/** Absent: every namespace the caller holds. */
+namespaces: array(PreferenceNamespaceSchema).max(32).optional() });
+object({ rows: array(PreferenceRowSchema) });
+object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/**
+	* The revision the edit was based on. Absent: last write wins. `0`: the
+	* namespace must not exist yet. Any other value that is not the current
+	* revision answers `conflict` and writes nothing.
+	*/
+	baseRevision: number().int().nonnegative().optional(),
+	deviceId: PreferenceDeviceIdSchema.optional()
+});
+discriminatedUnion("status", [object({
+	status: literal("saved"),
+	row: PreferenceRowSchema
+}), object({
+	status: literal("conflict"),
+	current: PreferenceRowSchema.nullable()
+})]);
+object({ namespace: PreferenceNamespaceSchema });
+object({ 
+/** `false` when the namespace did not exist. */
+deleted: boolean() });
+object({ 
+/** The revision the client holds per namespace; a namespace it does not list is new to it. */
+revisionByNamespace: record(PreferenceNamespaceSchema, number().int().nonnegative()).refine((map) => Object.keys(map).length <= 32, { message: `at most 32 namespaces` }) });
+object({
+	/** Every row whose revision differs from the client's, and every row it did not list. */
+	rows: array(PreferenceRowSchema),
+	/** Namespaces the client listed that no longer exist. */
+	deleted: array(PreferenceNamespaceSchema)
+});
 _enum(["new-session", "step-up"]);
 /** The languages the hub's app landing pages are written in (D858). */
 var AppPageLangSchema = _enum(["en", "it"]);
@@ -18490,7 +18541,19 @@ var DeviceHistorySubjectSchema = discriminatedUnion("kind", [object({
 	kind: literal("node"),
 	nodeId: string().min(1)
 })]);
+/**
+* `enum` stores a STATE as the ordinal of its value in the series' value list
+* (`DeviceHistorySeriesInfo.values`, append-only, so an ordinal never changes
+* meaning); a rollup keeps the time spent in each state (`states`).
+*/
 var DeviceHistoryKindSchema = _enum([
+	"gauge",
+	"counter",
+	"boolean",
+	"enum"
+]);
+/** What a PRODUCER may declare. `enum` is cap-only: its value list is the cap field's. */
+var DeviceHistoryProducerKindSchema = _enum([
 	"gauge",
 	"counter",
 	"boolean"
@@ -18527,7 +18590,13 @@ var SeriesInfoSchema = object({
 	/** `null` is unknown (a `unitFrom` series whose device does not state a unit right now), never a guess. */
 	unit: string().nullable(),
 	displayName: string(),
-	source: _enum(["cap", "addon"]),
+	source: _enum([
+		"cap",
+		"addon",
+		"derived"
+	]),
+	/** `enum`: the value of each ordinal (index = ordinal); `null` for every other kind. */
+	values: array(string()).readonly().nullable(),
 	firstTs: number(),
 	lastTs: number()
 });
@@ -18541,17 +18610,31 @@ var QueryPointSchema = object({
 	twMean: number().nullable(),
 	min: number(),
 	max: number(),
-	/** `null` is unknown, never zero (D393). */
-	last: number().nullable()
+	/** `null` is unknown, never zero (D393). For an `enum` series: the ordinal of {@link state}. */
+	last: number().nullable(),
+	/**
+	* The increase over the point: a `counter`'s growth since the previous point
+	* or bucket (a drop is a reset, counted from zero), and for
+	* {@link DEVICE_HISTORY_ENERGY_KEY} the kWh used in the bucket. `null` for
+	* every other kind, and when it cannot be known.
+	*/
+	delta: number().nullable(),
+	/** `enum`: the state in force at the end of the point (the name of `last`); `null` otherwise. */
+	state: string().nullable(),
+	/** `enum` rollup: milliseconds spent in each state inside the bucket; `null` for raw points and other kinds. */
+	states: record(string(), number()).nullable()
 });
 var QuerySeriesSchema = object({
 	scope: string(),
 	/** The last point STRICTLY BEFORE `from` in the chosen tier, so a step chart can start at the held value. */
 	before: object({
 		t: number(),
-		value: number().nullable()
+		value: number().nullable(),
+		state: string().nullable()
 	}).nullable(),
-	points: array(QueryPointSchema).readonly()
+	points: array(QueryPointSchema).readonly(),
+	/** A derived key: the stored key its points were computed from; `null` for a stored series. */
+	derivedFrom: string().nullable()
 });
 /** The window part of a query, shared by the device and node forms. */
 var QueryWindowShape = {
@@ -18567,6 +18650,23 @@ var QueryResultSchema = object({
 	series: array(QuerySeriesSchema).readonly(),
 	truncated: boolean()
 });
+/** One read of a batch: a device's key or a node's key (exactly one subject). */
+var QueryManyItemSchema = union([object({
+	deviceId: number().int(),
+	key: string(),
+	scope: string().optional()
+}), object({
+	forNodeId: string().min(1),
+	key: string(),
+	scope: string().optional()
+})]);
+var QueryManyEntrySchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	result: QueryResultSchema
+}), object({
+	ok: literal(false),
+	error: string()
+})]);
 var TierStatusSchema = object({
 	tier: DeviceHistoryResolutionSchema,
 	/** `null` until the first background count answered. */
@@ -18622,16 +18722,22 @@ var DeviceHistoryStatusSchema = object({
 		lastRefreshAt: number().nullable()
 	})
 });
-method(object({ deviceId: number().int() }), array(SeriesInfoSchema).readonly()), method(object({ nodeId: string().min(1) }), array(SeriesInfoSchema).readonly(), { auth: "admin" }), method(object({
+method(object({ deviceId: number().int() }), array(SeriesInfoSchema).readonly()), method(object({ forNodeId: string().min(1) }), array(SeriesInfoSchema).readonly(), { auth: "admin" }), method(object({
 	deviceId: number().int(),
 	...QueryWindowShape
 }), QueryResultSchema), method(object({
-	nodeId: string().min(1),
+	forNodeId: string().min(1),
 	...QueryWindowShape
 }), QueryResultSchema, { auth: "admin" }), method(object({
+	items: array(QueryManyItemSchema).min(1).max(24),
+	from: QueryWindowShape.from,
+	to: QueryWindowShape.to,
+	resolution: QueryWindowShape.resolution,
+	maxPoints: QueryWindowShape.maxPoints
+}), object({ results: array(QueryManyEntrySchema).readonly() }), { auth: "admin" }), method(object({
 	name: string().regex(/^[a-z0-9-]+$/),
 	subjectKind: _enum(["device", "node"]),
-	kind: DeviceHistoryKindSchema,
+	kind: DeviceHistoryProducerKindSchema,
 	unit: string().optional(),
 	displayName: string().min(1),
 	ingest: _enum(["points", "buckets"])
@@ -41529,38 +41635,37 @@ method(LlmRuntimeCompleteInputSchema, LlmGenerateResultSchema, {
 	auth: "admin",
 	timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
 });
+var LlmProfileKindSchema = string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "a kind id is lower-case letters, digits and dashes");
+/** What a model (or, by default, every model of a kind) can do. */
+var LlmModelFeaturesSchema = object({
+	vision: boolean(),
+	tools: boolean(),
+	streaming: boolean()
+});
+/** One model a provider offers. `features` overrides the kind's defaults, per field. */
+var LlmModelInfoSchema = object({
+	id: string(),
+	label: string().optional(),
+	contextLength: number().int().positive().optional(),
+	features: LlmModelFeaturesSchema.partial().optional()
+});
 /**
-* `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
-* methods concat-fan across providers; single-row methods route to ONE
-* provider by the `addonId` in the call input (the notification-output
-* posture, notification-output.cap.ts:215-250). Provided by `addon-ai`
-* (hub-placed); the cap stays open for future providers.
-*
-* Profiles are ROWS (data), not addons: one row = one usable model endpoint.
-* `apiKey` is a password field — providers REDACT it on read and merge on
-* write; a stored key NEVER round-trips to a client.
+* The provider-specific part of a profile, validated by the provider that owns
+* the kind (`upsertProfile` refuses what it does not accept). A field its
+* `connectionSchema` declares `type: 'password'` is a secret: it is held in the
+* keychain, never in the row, and reads back as the redaction marker.
 */
-var LlmProfileKindSchema = _enum([
-	"openai-compatible",
-	"openai",
-	"anthropic",
-	"google",
-	"managed-local",
-	"apple-foundation"
-]);
+var LlmProviderConfigSchema = record(string(), unknown());
 var LlmProfileSchema = object({
 	id: string(),
 	name: string(),
+	/** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
 	kind: LlmProfileKindSchema,
 	/** Stamped by the provider — keeps the fanned catalog routable. */
 	addonId: string(),
 	enabled: boolean(),
 	/** Vendor model id, or the managed runtime's loaded model. */
 	model: string(),
-	/** Required for openai-compatible; override for cloud kinds. */
-	baseUrl: string().optional(),
-	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
-	apiKey: string().optional(),
 	/** Vision on/off. A vision call against a `false` profile is REFUSED, never
 	*  degraded to text — that shipped once and produced a confident answer to a
 	*  question about a picture nobody sent. */
@@ -41568,15 +41673,11 @@ var LlmProfileSchema = object({
 	temperature: number().min(0).max(2).optional(),
 	/** Nucleus sampling. Every wire we speak has it. */
 	topP: number().min(0).max(1).optional(),
-	/** Top-k sampling. Carried only by the wires that have it — NEITHER OpenAI
-	*  wire does, and the client drops it there (measured: the request body gets
-	*  `top_p` and no `top_k`). The profile editor hides the field wherever it
-	*  would change nothing; `KINDS_WITH_TOP_K` is the single owner of that list. */
+	/** Top-k sampling. Carried only by the wires that have it — a kind offers the
+	*  field in its editor only when its descriptor lists it in `profileFields`. */
 	topK: number().int().positive().optional(),
 	maxTokens: number().int().positive().optional(),
-	/** Prompt context window. Advisory for cloud kinds (they enforce their own);
-	*  for `managed-local` it is the llama.cpp `--ctx-size` the runtime starts
-	*  the model with, so it is the one field that changes a PROCESS. */
+	/** Prompt context window. Advisory for cloud kinds (they enforce their own). */
 	contextLength: number().int().positive().optional(),
 	/** Default system prompt. A caller's `system` REPLACES it (never appends —
 	*  two system prompts fighting is worse than either alone). */
@@ -41602,16 +41703,37 @@ var LlmProfileSchema = object({
 	*  library; the REGISTRY of callable tools is ours and is empty in v1, so a
 	*  `true` here buys the wiring, not behaviour, until tools are registered. */
 	toolsEnabled: boolean().default(false),
-	extraHeaders: record(string(), string()).optional(),
-	/** kind === 'managed-local' only (spec §4). */
-	runtime: ManagedRuntimeConfigSchema.optional(),
-	/**
-	* kind === 'apple-foundation' only: WHERE it runs — the only thing there is
-	* to configure (no key, no URL, no download; `model` is `apple-system`).
-	* `supportsVision` on such a row is stamped by the provider from the node's
-	* reported `imageInput`, never taken from the operator (D62).
-	*/
-	appleFoundation: object({ nodeId: string() }).optional()
+	/** Everything the kind's provider owns (endpoint, key, node, runtime…). */
+	providerConfig: LlmProviderConfigSchema.default({})
+});
+/**
+* The common profile fields a kind's editor offers. The editor owns how each
+* one is drawn; the provider says which of them mean something on its wire.
+*/
+var LlmProfileFieldSchema = _enum([
+	"temperature",
+	"topP",
+	"topK",
+	"maxTokens",
+	"contextLength",
+	"systemPrompt",
+	"timeoutMs",
+	"connectTimeoutMs",
+	"firstTokenTimeoutMs",
+	"idleTimeoutMs",
+	"retry",
+	"toolsEnabled"
+]);
+/**
+* A provider-drawn part of the editor, by a generic widget id the admin UI
+* registers (`ai/apple-node`). `placement: 'model'` replaces the generic model
+* picker: that widget owns the model choice.
+*/
+var LlmProviderWidgetSchema = object({
+	id: string(),
+	placement: _enum(["connection", "model"]),
+	/** `providerConfig` keys this widget must fill before the profile can be saved. */
+	requires: array(string()).optional()
 });
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
@@ -41620,11 +41742,56 @@ var ConfigSchemaPassthrough$3 = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
+	/** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$3
+	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
+	connectionSchema: ConfigSchemaPassthrough$3,
+	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
+	advancedSchema: ConfigSchemaPassthrough$3.optional(),
+	/** The kind's defaults; a model from `listModels` may override any of them. */
+	features: LlmModelFeaturesSchema,
+	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
+	visionEditable: boolean(),
+	/** Where the model list comes from: `listModels`, `staticModels`, or nowhere. */
+	modelCatalog: _enum([
+		"fetch",
+		"static",
+		"none"
+	]),
+	staticModels: array(LlmModelInfoSchema).optional(),
+	/** The common fields that mean something on this kind's wire. */
+	profileFields: array(LlmProfileFieldSchema),
+	providerWidgets: array(LlmProviderWidgetSchema).optional()
 });
+/**
+* `listModels` input. `connection` is an UNSAVED draft of `providerConfig`
+* (the editor's form); with `profileId` too, a secret the draft leaves
+* untouched (absent or the redaction marker) is resolved server-side from the
+* stored profile — the browser never receives it.
+*/
+var LlmListModelsInputSchema = object({
+	addonId: string(),
+	kind: LlmProfileKindSchema,
+	profileId: string().optional(),
+	connection: LlmProviderConfigSchema.optional()
+});
+var LlmListModelsErrorCodeSchema = _enum([
+	"auth",
+	"network",
+	"unsupported",
+	"invalid"
+]);
+/** A RESULT, never a throw: "wrong key" is an answer the editor renders inline. */
+var LlmListModelsResultSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	models: array(LlmModelInfoSchema)
+}), object({
+	ok: literal(false),
+	code: LlmListModelsErrorCodeSchema,
+	message: string()
+})]);
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
 	selector: LlmDefaultSelectorSchema,
@@ -41724,7 +41891,10 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, {
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
-}), method(ProfileRefInputSchema, array(string())), method(object({}), array(LlmDefaultSchema)), method(object({
+}), method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(LlmDefaultSchema)), method(object({
 	selector: LlmDefaultSelectorSchema,
 	profileId: string().nullable()
 }), _void(), {
@@ -41892,14 +42062,106 @@ var LogEntrySchema = object({
 	meta: record(string(), unknown()).optional(),
 	tags: record(string(), string()).optional()
 });
-method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
-	scope: array(string()).optional(),
+/**
+* A history READ against one destination (D898).
+*
+* Every filter is applied by the PROVIDER, before the limit — a filter the
+* browser applied after the limit is what made a rare device's lines
+* unreachable behind a busy one's. `before` / `after` are cursors the provider
+* minted (opaque to everyone else): a file position for the rotated files, a
+* nanosecond timestamp for Loki.
+*
+* A read is BOUNDED by `budgetMs`: a filter that matches nothing on a 30-day
+* store answers `done: false` with the cursor it reached and the bytes it
+* scanned, and the caller decides whether to go on. That is what makes a long
+* scan show progress and stop when asked — `cancelRead` ends the slice in
+* flight, and not asking for the next slice ends the scan.
+*/
+var LogReadQuerySchema = object({
+	/** Correlates `cancelRead`. Caller-chosen, unique per in-flight read. */
+	requestId: string().min(1).max(64).optional(),
+	/** The device the line is about (`tags.deviceId`, numeric). */
+	deviceId: number().int().optional(),
+	/**
+	* The emitting addon — bare manifest id; `@<version>` / `::<sub>` suffixes
+	* match. Not `addonId`: a cap router reads that name as "which provider".
+	*/
+	fromAddonId: string().min(1).max(200).optional(),
+	/**
+	* The emitting node: matches the agent that emitted the line, the node
+	* itself, or a worker under it (`<agent>/<runner>`) — the `agentId`
+	* semantics of `matchesLogTags`. Not `nodeId`: a cap router reads that
+	* name as "which node's provider".
+	*/
+	fromNodeId: string().min(1).max(200).optional(),
+	/** Any other tag, exact match (AND). */
+	tags: record(string(), union([string(), number()])).optional(),
+	/** Severity FLOOR: this level and above. */
 	level: LogLevelSchema.optional(),
-	since: date().optional(),
-	until: date().optional(),
-	limit: number().optional(),
-	tags: record(string(), string()).optional()
-}), array(LogEntrySchema).readonly());
+	/** Case-insensitive substring over message, scope, tag values and meta values. */
+	text: string().min(1).max(200).optional(),
+	/** Epoch ms, inclusive. */
+	since: number().optional(),
+	/** Epoch ms, inclusive. */
+	until: number().optional(),
+	/** Older than this cursor (exclusive). Absent with `after` absent ⇒ from the newest. */
+	before: string().min(1).max(1024).optional(),
+	/** Newer than this cursor (exclusive). */
+	after: string().min(1).max(1024).optional(),
+	limit: number().int().min(1).max(1e3).optional(),
+	/** Wall-clock bound of this slice. The provider caps it. */
+	budgetMs: number().int().min(50).max(1e4).optional()
+});
+var LogReadResultSchema = object({
+	/** Newest first. */
+	entries: array(object({
+		/** `<bootId>.<seq>` minted by the emitting LogManager — the dedupe key. */
+		id: string().optional(),
+		/** Epoch ms. */
+		timestamp: number(),
+		level: LogLevelSchema,
+		scope: string().optional(),
+		message: string(),
+		tags: record(string(), union([string(), number()])).optional(),
+		meta: record(string(), unknown()).optional()
+	})),
+	/** Pass as `before` for the next older page; null when nothing older exists. */
+	nextBefore: string().nullable(),
+	/** Pass as `after` to read what arrived since; null when unknown. */
+	nextAfter: string().nullable(),
+	/** Bytes this slice read (files) or received (remote). Progress, not a promise. */
+	scannedBytes: number().int().nonnegative(),
+	/**
+	* True when the scan in this direction reached the end of the store.
+	* False with fewer than `limit` entries means the budget ran out first —
+	* call again with `nextBefore` to go on.
+	*/
+	done: boolean(),
+	/** True when `cancelRead` ended this slice early. */
+	cancelled: boolean().optional()
+});
+var LogReadCapabilitiesSchema = object({
+	/** False ⇒ this destination only ships lines (console, forwarder, an unconfigured Loki). */
+	readable: boolean(),
+	/** Why not, when `readable` is false — rendered next to the source. */
+	reason: string().nullable(),
+	/** Filters the provider applies itself. A false one is applied by nobody. */
+	filters: object({
+		deviceId: boolean(),
+		addonId: boolean(),
+		nodeId: boolean(),
+		tags: boolean(),
+		level: boolean(),
+		text: boolean(),
+		timeRange: boolean()
+	}),
+	/** How far back the store reaches, when the provider knows (days). */
+	retentionDays: number().nullable()
+});
+method(LogEntrySchema, _void(), { kind: "mutation" }), optionalMethod(_void(), LogReadCapabilitiesSchema, { auth: "admin" }), optionalMethod(LogReadQuerySchema, LogReadResultSchema, { auth: "admin" }), optionalMethod(object({ requestId: string().min(1).max(64) }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * `login-method` — collection cap through which auth addons contribute
 * their pre-auth login surfaces to the login page. This is the SINGLE,
@@ -43648,9 +43910,11 @@ var alarmPanelCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — enum state; arm/disarm history belongs in the events ledger.
+	* History (D850): the panel's lifecycle state as an `enum` series —
+	* change-only, no floor, so an `arming -> pending -> triggered` sequence of a
+	* few seconds keeps every step. Who armed it stays in the events ledger.
 	*/
-	history: "none",
+	history: { fields: { state: { kind: "enum" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -44572,6 +44836,33 @@ var NcRuleTargetSchema = object({
 	params: record(string(), unknown()).optional()
 });
 /**
+* WHAT THE NOTIFICATION'S PICTURE IS (D897) — the ONE media choice of a rule.
+*
+* Every mode starts from the same CLEAN source frame of the trigger moment
+* (keyFrame → sceneFrame → lastSceneFrame, narrowed to the trigger instant and
+* to the zone that fired the rule) and renders it once at send time:
+*  - `scene-boxes` — the whole scene, the subject outlined thick in the accent
+*    colour and every OTHER track visible at that instant outlined thin, each
+*    labelled with class and confidence ("dog 87%").
+*  - `crop`  — the subject cut out of that frame around its box at that instant.
+*  - `clean` — the whole scene with nothing drawn on it.
+*  - `none`  — no picture.
+*
+* A mode that cannot be honoured (no box at that instant, a photograph with no
+* tracked subject) ships `clean` and names the reason in the log, per camera.
+* It replaces the `attach` × `frame` × `zoneCrop` triple, which let one rule
+* ship a crop on one event and a boxed scene on the next depending on which
+* stored kind had landed.
+*/
+var NcMediaImageSchema = _enum([
+	"scene-boxes",
+	"crop",
+	"clean",
+	"none"
+]);
+/**
+* @deprecated Read only by `normalizeNcMediaPolicy` (D897) — see {@link NcMediaImageSchema}.
+*
 * Media attachment policy (P1 still-image subset).
 *  - `best` — the best AVAILABLE subject image at dispatch time (D-3).
 *  - `best-matching` — the media that explains WHY the rule fired: a rule
@@ -44585,6 +44876,8 @@ var NcRuleTargetSchema = object({
 *  - `none` — no attachment.
 */
 /**
+* @deprecated Read only by `normalizeNcMediaPolicy` (D897) — see {@link NcMediaImageSchema}.
+*
 * WHAT THE PICTURE SHOWS — chosen explicitly, because the implicit ladders
 * conflate it with the selection strategy and betray the request: asking for
 * the clean scene frame on an object-event owner used to start at
@@ -44631,16 +44924,29 @@ var NcLinkedCameraModeSchema = _enum(["mosaic", "each"]);
 var NC_CLIP_PRE_ROLL_DEFAULT_SEC = 4;
 var NC_CLIP_POST_ROLL_DEFAULT_SEC = 6;
 var NcMediaPolicySchema = object({
+	/**
+	* The picture — see {@link NcMediaImageSchema}. Absent on a rule nobody has
+	* saved since D897: `normalizeNcMediaPolicy` derives it from the legacy
+	* triple below, at load and at every write, and the store keeps only this.
+	*/
+	image: NcMediaImageSchema.optional(),
+	/**
+	* Draw the zone that FIRED the rule on the picture (`scene-boxes` / `clean`;
+	* a `crop` never shows it). Valid only on a rule whose trigger is a zone —
+	* `conditions.zones` or an occupancy zone — and refused on save otherwise.
+	* Replaces `zoneCrop`.
+	*/
+	showTriggerZone: boolean().optional(),
+	/** @deprecated D897 — accepted from an editor that predates `image`, folded into it on save. */
 	attach: _enum([
 		"best",
 		"best-matching",
 		"keyFrame",
 		"none"
-	]).default("best"),
-	/** What the still shows. Absent = `cropped` (the historical `best` shape). */
+	]).optional(),
+	/** @deprecated D897 — accepted from an editor that predates `image`, folded into it on save. */
 	frame: NcMediaFrameSchema.optional(),
-	/** Crop the attached still to the rule's condition-zone bbox (padded) —
-	*  "show me the ZONE", not the whole scene or the subject crop. */
+	/** @deprecated D897 — folded into `image: 'clean'` + `showTriggerZone` on save. */
 	zoneCrop: boolean().optional(),
 	/**
 	* Also attach a short GIF cut from the stream broker's clip ring around the
@@ -44826,7 +45132,9 @@ var NcRuleInputSchema = object({
 	* targets.
 	*/
 	targetUsers: array(string()).optional(),
-	media: NcMediaPolicySchema.default({ attach: "best" }),
+	/** Absent = the kind's default picture (`resolveNcMediaImage`): the subject crop for a
+	*  detection, the clean scene for a sensor or a sound. Set explicitly on save (D897). */
+	media: NcMediaPolicySchema.default({}),
 	throttle: NcThrottleSchema.default({
 		cooldownSec: 60,
 		scope: "rule-device"
@@ -46361,13 +46669,37 @@ var NcAlarmModeOpeningsSchema = object({
 	/** Covered devices whose state could not be read (D49): neither open nor closed. */
 	unknown: array(number().int())
 });
+/**
+* One alarm INPUT — a (rule, device) pair — the operator bypassed until the
+* next disarm ("Bypass this input until disarm" on a trigger notification, or
+* `nc.bypassAlarmInput`). Reported so an armed alarm with a silenced input
+* never looks fully armed (D62: off must never look like broken).
+*/
+var NcAlarmInputBypassViewSchema = object({
+	ruleId: string(),
+	/** The rule's current name (its frozen name when the rule is gone). */
+	ruleName: string(),
+	/** The input: the sensor of the match, else its camera. */
+	deviceId: number().int(),
+	/** The input's current name. */
+	name: string(),
+	/** When it was bypassed (ms epoch). */
+	since: number(),
+	/** Triggers from this input dropped since. */
+	dropped: number().int().min(0)
+});
 var NcAlarmLiveSchema = object({
 	state: AlarmStateSchema,
 	/** The mode being armed into (exit delay) or held; null when disarmed. */
 	targetMode: AlarmArmModeSchema.nullable(),
 	availableModes: array(AlarmArmModeSchema),
 	openings: array(NcAlarmModeOpeningsSchema),
-	exclusions: array(NcAlarmExclusionViewSchema)
+	exclusions: array(NcAlarmExclusionViewSchema),
+	/**
+	* Inputs bypassed for the rest of this arm session; cleared on disarm.
+	* Defaulted so an older hub answer still parses (as "none known").
+	*/
+	bypassedInputs: array(NcAlarmInputBypassViewSchema).default([])
 });
 var NcAlarmConfigSchema = object({
 	/**
@@ -58277,9 +58609,11 @@ var connectivityCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — duplicates device-status.online (one authority for availability).
+	* History (D850): `connected` as a boolean series — change-only, no floor. It
+	* is the upstream entity's own link (a HA connectivity sensor), not the
+	* device's reachability, which stays `device-status.online`.
 	*/
-	history: "none",
+	history: { fields: { connected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -59125,11 +59459,22 @@ var dishwasherCapability = {
 	},
 	runtimeState: DishwasherStatusSchema,
 	durability: "session",
-	history: { fields: { progressPercent: {
-		kind: "gauge",
-		unit: "%",
-		deadband: 2
-	} } }
+	history: { fields: {
+		progressPercent: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		state: { kind: "enum" },
+		operationState: { kind: "enum" },
+		remainingSeconds: {
+			kind: "gauge",
+			unit: "s",
+			minIntervalMs: 6e4
+		},
+		doorOpen: { kind: "boolean" },
+		powerOn: { kind: "boolean" }
+	} }
 };
 var DoorbellStatusSchema = object({
 	/** Ms epoch of the last press. null = never observed since this provider started. */
@@ -59246,9 +59591,15 @@ var enumSensorCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — text/enum state has no history (non-goal).
+	* History (D850): the value as an `enum` series (an appliance's program or
+	* operation state, an HVAC action). The option set is per device, so the
+	* value list is LEARNED as values are first seen (bounded). A sensor with a
+	* `format` carries a timestamp, not a state, and is not recorded.
 	*/
-	history: "none",
+	history: { fields: { value: {
+		kind: "enum",
+		skipWhenSet: "format"
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -61282,9 +61633,10 @@ var lockControlCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — enum state; lock events belong in the events ledger.
+	* History (D850): the lock's state as an `enum` series — change-only, no
+	* floor: a jam or an unlock lasting seconds is the edge an operator looks for.
 	*/
-	history: "none",
+	history: { fields: { state: { kind: "enum" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -61458,9 +61810,18 @@ var mediaPlayerCapability = {
 	*/
 	durability: "session",
 	/**
-	* History (D850): none — `positionMs` moves continuously while playing; volume is transient.
+	* History (D850): volume (a level an operator or an automation sets; the
+	* default 10 s floor folds a slider drag into its end value) and mute.
+	* `positionMs` is not recorded: it moves continuously while playing.
 	*/
-	history: "none"
+	history: { fields: {
+		volumeLevel: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		isMuted: { kind: "boolean" }
+	} }
 };
 /**
 * mesh-network — collection cap for mesh-VPN providers.
@@ -66862,9 +67223,29 @@ var streamParamsCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — encoder configuration.
+	* History (D850): the configured bitrate and frame rate of the main and sub
+	* profiles. Configuration, so change-only on the default floor: a point is an
+	* operator's (or a tuner's) edit, which is exactly what a chart of a stream's
+	* quality over time must show.
 	*/
-	history: "none",
+	history: { fields: {
+		"main.bitrate": {
+			kind: "gauge",
+			unit: "kbps"
+		},
+		"main.framerate": {
+			kind: "gauge",
+			unit: "fps"
+		},
+		"sub.bitrate": {
+			kind: "gauge",
+			unit: "kbps"
+		},
+		"sub.framerate": {
+			kind: "gauge",
+			unit: "fps"
+		}
+	} },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -67699,26 +68080,6 @@ var ApiKeySummarySchema = object({
 	createdAt: number(),
 	lastUsedAt: number().optional()
 });
-var ScopedTokenSummarySchema = object({
-	id: string(),
-	userId: string(),
-	name: string(),
-	tokenPrefix: string(),
-	scopes: array(TokenScopeSchema),
-	expiresAt: number().nullish(),
-	lastUsedAt: number().nullish(),
-	createdAt: number()
-});
-var CreateScopedTokenInputSchema = object({
-	userId: string(),
-	name: string(),
-	scopes: array(TokenScopeSchema),
-	expiresAt: number().optional()
-});
-var CreateScopedTokenResultSchema = object({
-	token: string(),
-	record: ScopedTokenSummarySchema
-});
 var OauthSessionSummarySchema = object({
 	id: string(),
 	userId: string(),
@@ -67740,11 +68101,11 @@ var TotpStatusSchema = object({
 	confirmedAt: number().nullable()
 });
 /**
-* user-management — singleton capability for user accounts, API keys,
-* and scoped tokens.
+* user-management — singleton capability for user accounts and the
+* legacy API-key rows.
 *
 * v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
-* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* — the subset check on `setUserScopes` is moot
 * because non-admins never reach these. If/when we open non-admin
 * delegation, structural caller-scope subset check goes inside the
 * provider.
@@ -67801,15 +68162,7 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
-}), method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	access: "create"
-}), method(object({ id: string() }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin",
-	access: "delete"
-}), method(object({ token: string() }), ScopedTokenSummarySchema.nullable(), { access: "view" }), method(object({ userId: string() }), array(ScopedTokenSummarySchema), { auth: "admin" }), method(object({ userId: string() }), TotpSetupResultSchema, {
+}), method(object({ userId: string() }), TotpSetupResultSchema, {
 	kind: "mutation",
 	auth: "admin",
 	access: "create"
@@ -70123,6 +70476,15 @@ var BaseDevice = class {
 	* Drivers can use the `getProbeFlags()` helper to read the flag bag
 	* with a typed cast.
 	*
+	* Answer what you KNOW. A plain array is read as the complete list only
+	* while this device is `online` and probed; return
+	* `accessoryChildrenUnknown(reason)` whenever you cannot know the list right
+	* now (no credentials, parent not connected, a failed or partial read) —
+	* the kernel then deletes nothing. Return `accessoryChildrenComplete(list)`
+	* to say "connected, and this is the complete list" explicitly. A shrink is
+	* deleted only after a second agreeing complete read on a later probe (D49;
+	* `packages/system/src/kernel/moleculer/accessory-prune-gate.ts`).
+	*
 	* Default: no children.
 	*/
 	getAccessoryChildren() {
@@ -73469,7 +73831,7 @@ Object.freeze({
 		capName: "llm",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
 	"llm.listNodeModels": {
 		capName: "llm",
@@ -73771,7 +74133,19 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"logDestination.query": {
+	"logDestination.cancelRead": {
+		capName: "log-destination",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"logDestination.describeRead": {
+		capName: "log-destination",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"logDestination.read": {
 		capName: "log-destination",
 		capScope: "system",
 		addonId: null,
@@ -78133,12 +78507,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.createScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.createUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -78187,12 +78555,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.listScopedTokens": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.listUsers": {
 		capName: "user-management",
 		capScope: "system",
@@ -78247,12 +78609,6 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
-	"userManagement.revokeScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"userManagement.setupTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -78283,12 +78639,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.validateScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.verifyTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -79802,6 +80152,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"logDestination.read": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"mediaPlayer.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -82051,6 +82406,123 @@ function isSystemRuleKind(kind) {
 function systemFamilyOfKind(kind) {
 	return isSystemEventFamily(kind) ? kind : void 0;
 }
+/**
+* Reasons, written once. Each names the SUBJECT FIELD the engine reads and
+* finds absent — that is what makes the exclusion checkable against the engine
+* rather than an opinion about tidiness.
+*/
+var NO_SENSOR_KIND = "An occupancy edge is not a sensor event: it carries no sensor kind, so this condition can never match one.";
+var NO_EVENT_TOKEN = "An occupancy edge carries no device event-type token — that comes from an event-emitter slice, which a count crossing has none of.";
+var NO_SENSOR_EDGE = "An occupancy edge is a count crossing, not a sensor reading: it has no raise or clear, so this choice could never narrow it.";
+var OCCUPANCY_SOURCE = "An occupancy edge is always produced by the pipeline, so any other source can never match and “pipeline” narrows nothing.";
+var AUDIO_SOURCE = "A confirmed sound window is always stamped as an audio subject, so any other source can never match.";
+var SOUND_NOT_A_PICTURE = "A sound rule fires on what the camera HEARD. Its subject carries no detection, so this condition can never match one — name the sounds in the Sound condition instead.";
+var SOUND_NO_CONFIDENCE = "A sound window’s evidence is a percentage of samples, not a detector score, so a confidence threshold can never be satisfied.";
+var SOUND_NO_GEOMETRY = "A sound has no position in the frame, so a zone or a drawn polygon can never match it.";
+var NC_RULE_KIND_SPECS = [
+	{
+		kind: "detection",
+		label: "Conditions",
+		excluded: { audio: "A detection rule fires on what the camera SAW. Sounds are a Sound rule of their own — adding one here turned the rule into a sound rule and dropped every detection condition." },
+		editable: true,
+		carriesMedia: true,
+		carriesSubjectCrop: true
+	},
+	{
+		kind: "sensor",
+		label: "Conditions",
+		/** `occupancy` is still offered here: authoring it converts a sensor rule into an occupancy rule. */
+		excluded: {},
+		editable: true,
+		carriesMedia: true,
+		carriesSubjectCrop: true,
+		blurb: "A doorbell press or a linked sensor changing state. The picture comes from the camera the sensor is attributed to."
+	},
+	{
+		kind: "occupancy",
+		label: "Occupancy",
+		discriminator: "occupancy",
+		excluded: {
+			sensorKinds: NO_SENSOR_KIND,
+			eventTypeTokens: NO_EVENT_TOKEN,
+			sensorTransition: NO_SENSOR_EDGE,
+			source: OCCUPANCY_SOURCE
+		},
+		editable: true,
+		carriesMedia: true,
+		carriesSubjectCrop: true,
+		blurb: "Fires when the count in a camera frame or a zone crosses your threshold and holds. Pick the camera first — the zone list is that camera’s."
+	},
+	{
+		kind: "sound",
+		label: "Sound",
+		discriminator: "audio",
+		excluded: {
+			classes: SOUND_NOT_A_PICTURE,
+			classesExclude: SOUND_NOT_A_PICTURE,
+			minConfidence: SOUND_NO_CONFIDENCE,
+			zones: SOUND_NO_GEOMETRY,
+			zonesExclude: SOUND_NO_GEOMETRY,
+			customZones: SOUND_NO_GEOMETRY,
+			crossing: SOUND_NO_GEOMETRY,
+			labelEquals: SOUND_NOT_A_PICTURE,
+			identities: SOUND_NOT_A_PICTURE,
+			identitiesExclude: SOUND_NOT_A_PICTURE,
+			plates: SOUND_NOT_A_PICTURE,
+			source: AUDIO_SOURCE
+		},
+		editable: true,
+		carriesMedia: true,
+		carriesSubjectCrop: false,
+		blurb: "Fires on a confirmed sampling window of audio, never on a picture. Name the sounds and/or keep a level threshold — with neither it can never match.",
+		mediaBlurb: "A sound owns no frame, so the picture is a photograph of the camera taken at the moment of the match — the whole scene, never a crop. The GIF and the clip are cut around the same instant, from the camera."
+	},
+	{
+		kind: "device-events",
+		label: "Device events",
+		discriminator: "systemEvent",
+		excluded: {},
+		editable: true,
+		carriesMedia: false,
+		carriesSubjectCrop: false,
+		blurb: "A device or its stream going away or coming back, switched off or on, a battery or consumable running low, a camera detecting nothing. There is no frame to attach."
+	},
+	{
+		kind: "system",
+		label: "System events",
+		discriminator: "systemEvent",
+		excluded: {},
+		editable: true,
+		carriesMedia: false,
+		carriesSubjectCrop: false,
+		blurb: "The installation itself: a node leaving, an addon crash-looping, an update available or installed, a backup or an export finishing."
+	},
+	{
+		kind: "alarm",
+		label: "Alarm",
+		discriminator: "systemEvent",
+		excluded: {},
+		editable: true,
+		carriesMedia: false,
+		carriesSubjectCrop: false,
+		blurb: "The alarm panel: refused, arming, armed, entry delay, triggered, re-armed, sensor bypass, disarmed.",
+		mediaBlurb: "An alarm set off by a rule arrives with THAT rule's pictures, combined into one notification. This rule adds none of its own."
+	},
+	{
+		kind: "mixed",
+		label: "To recreate",
+		discriminator: "systemEvent",
+		excluded: {},
+		editable: false,
+		carriesMedia: false,
+		carriesSubjectCrop: false,
+		blurb: "This rule mixes events from more than one family (device events, system, alarm). It keeps firing as it is, but it can no longer be edited: create one rule per family, then delete this one."
+	}
+];
+/** The spec for a kind. Total by construction — every member has an entry. */
+function ruleKindSpec(kind) {
+	return NC_RULE_KIND_SPECS.find((s) => s.kind === kind) ?? NC_RULE_KIND_SPECS[0];
+}
 /** The delivery a system rule rides — named once, compared everywhere. */
 var NC_SYSTEM_DELIVERY = "system-event";
 /**
@@ -82168,6 +82640,98 @@ function systemRuleKindOf(condition) {
 	return verdict.kind === "family" ? verdict.family : "mixed";
 }
 NC_AUDIO_DEFAULTS.hitPercent, NC_AUDIO_DEFAULTS.samplingSeconds;
+/** Every mode, in the order an editor offers them. */
+var NC_MEDIA_IMAGE_MODES = [
+	"scene-boxes",
+	"crop",
+	"clean",
+	"none"
+];
+/**
+* The modes a rule of this kind can honour. A kind that carries no media gets
+* none (its row ships text, or — an alarm — its SOURCE rule's picture); a kind
+* whose subject has no region of the frame (a sound) is never offered `crop`.
+*/
+function imageModesForKind(kind) {
+	const spec = ruleKindSpec(kind);
+	if (!spec.carriesMedia) return [];
+	return spec.carriesSubjectCrop ? NC_MEDIA_IMAGE_MODES : NC_MEDIA_IMAGE_MODES.filter((mode) => mode !== "crop");
+}
+/**
+* The zone ids that FIRE a rule: its `zones` condition, or an occupancy rule's
+* own scoped zone. Empty when the trigger is not a zone — and then
+* `showTriggerZone` has nothing to draw and is refused on save.
+*/
+function ruleTriggerZoneIds(conditions) {
+	if (conditions.zones !== void 0) return conditions.zones.ids;
+	const zoneId = conditions.occupancy?.zoneId;
+	return zoneId !== void 0 ? [zoneId] : [];
+}
+/**
+* What the legacy triple MEANT, as a mode. `zoneCrop` forced the clean
+* keyFrame ladder and dropped `frame`, so it is `clean` whatever else was set;
+* `frame` decided over `attach` when present; `keyFrame` was the clean scene;
+* every other still (`best`, `best-matching`, the default) was the subject.
+*/
+function legacyImageMode(media) {
+	if (media.attach === "none") return "none";
+	if (media.zoneCrop === true) return "clean";
+	if (media.frame === "full") return "clean";
+	if (media.frame === "boxed") return "scene-boxes";
+	if (media.frame === "cropped") return "crop";
+	if (media.attach === "keyFrame") return "clean";
+	return "crop";
+}
+/** A mode the kind cannot honour, mapped to the nearest one it can. */
+function clampToKind(mode, kind) {
+	const offered = imageModesForKind(kind);
+	if (offered.length === 0 || offered.includes(mode)) return mode;
+	return mode === "crop" ? "clean" : mode;
+}
+/**
+* The mode a rule's picture is rendered in. `image` when stored; else what the
+* legacy triple meant — and, for a SENSOR rule written before D897, `clean`
+* whatever it stored (even `attach: 'none'`), because its stored triple was
+* ignored and one plain snapshot always shipped (operator ruling, 2026-10-01):
+* the migration keeps what the rule actually DID. Clamped to what the kind can
+* honour.
+*/
+function resolveNcMediaImage(media, kind) {
+	if (media.image !== void 0) return clampToKind(media.image, kind);
+	if (kind === "sensor") return "clean";
+	return clampToKind(legacyImageMode(media), kind);
+}
+/**
+* The stored shape of a media policy: `image` set, the legacy triple gone.
+* `showTriggerZone` survives only where it can be drawn — a zone trigger and a
+* mode other than `crop`/`none`; a legacy `zoneCrop` on a zone rule becomes it.
+* Every other field (gif, clip, rolls, speed, profile, linked cameras) is
+* carried through untouched. Pure; never throws.
+*/
+function normalizeNcMediaPolicy(media, rule) {
+	const image = resolveNcMediaImage(media, ruleKindOf(rule));
+	const { attach: _attach, frame: _frame, zoneCrop, showTriggerZone, image: _image, ...rest } = media;
+	const drawable = (showTriggerZone === true || media.image === void 0 && zoneCrop === true) && image !== "crop" && image !== "none" && ruleTriggerZoneIds(rule.conditions).length > 0;
+	return {
+		...rest,
+		image,
+		...drawable ? { showTriggerZone: true } : {}
+	};
+}
+/**
+* Why a media policy cannot be SAVED on this rule, or null. Server-side and
+* editor alike: `showTriggerZone` on a rule whose trigger is not a zone, and a
+* mode the rule's kind cannot honour.
+*/
+function ncMediaPolicyError(media, rule) {
+	const kind = ruleKindOf(rule);
+	if (media.image !== void 0) {
+		const offered = imageModesForKind(kind);
+		if (offered.length > 0 && !offered.includes(media.image)) return `media.image '${media.image}' is not available for a ${kind} rule (offered: ${offered.join(", ")})`;
+	}
+	if (media.showTriggerZone === true && ruleTriggerZoneIds(rule.conditions).length === 0) return "media.showTriggerZone needs a rule triggered by a zone (a zones condition or an occupancy zone)";
+	return null;
+}
 var WEEKDAY_TO_DAY = {
 	Sun: 0,
 	Mon: 1,
@@ -86537,6 +87101,12 @@ Object.defineProperty(exports, "RECORD_MAX_DATA_BYTES", {
 		return RECORD_MAX_DATA_BYTES;
 	}
 });
+Object.defineProperty(exports, "RECORD_QUERY_MAX", {
+	enumerable: true,
+	get: function() {
+		return RECORD_QUERY_MAX;
+	}
+});
 Object.defineProperty(exports, "RebuildObjectEmbeddingsRefusalSchema", {
 	enumerable: true,
 	get: function() {
@@ -87209,12 +87779,24 @@ Object.defineProperty(exports, "memoizePinnedFfmpeg", {
 		return memoizePinnedFfmpeg;
 	}
 });
+Object.defineProperty(exports, "ncMediaPolicyError", {
+	enumerable: true,
+	get: function() {
+		return ncMediaPolicyError;
+	}
+});
 Object.defineProperty(exports, "nodePin", {
 	enumerable: true,
 	get: function() {
 		return nodePin;
 	}
 });
+Object.defineProperty(exports, "normalizeNcMediaPolicy", {
+	enumerable: true,
+	get: function() {
+		return normalizeNcMediaPolicy;
+	}
+});
 Object.defineProperty(exports, "normalizeNodeId", {
 	enumerable: true,
 	get: function() {
@@ -87347,6 +87929,12 @@ Object.defineProperty(exports, "resolveModeNotifyPolicy", {
 		return resolveModeNotifyPolicy;
 	}
 });
+Object.defineProperty(exports, "resolveNcMediaImage", {
+	enumerable: true,
+	get: function() {
+		return resolveNcMediaImage;
+	}
+});
 Object.defineProperty(exports, "resolvePoolMemoryPolicy", {
 	enumerable: true,
 	get: function() {