@camstack/addon-provider-hikvision 1.2.22 → 1.2.24

package/dist/addon.js

@@ -5404,12 +5404,6 @@ Object.fromEntries([
 		icon: "shapes",
 		order: 38
 	},
-	{
-		id: "scenes",
-		label: "Scenes",
-		icon: "scan-eye",
-		order: 36
-	},
 	{
 		id: "analytics",
 		label: "Analytics",
@@ -11105,6 +11099,8 @@ var QueryFilterSchema = object({
 	where: record(string(), unknown()).optional(),
 	whereIn: record(string(), array(unknown())).optional(),
 	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
+	whereNot: record(string(), unknown()).optional(),
 	orderBy: object({
 		field: string(),
 		direction: _enum(["asc", "desc"])
@@ -11124,7 +11120,8 @@ var QueryFilterSchema = object({
 var MutationFilterSchema = object({
 	where: record(string(), unknown()).optional(),
 	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional()
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	whereNot: record(string(), unknown()).optional()
 });
 /** A single stored record: `{ id, data }`. */
 var SettingsRecordSchema = object({
@@ -12643,6 +12640,17 @@ var LlmImageSchema = object({
 	bytes: _instanceof(Uint8Array),
 	mimeType: string()
 });
+/**
+* Retry policy. `enabled: false` is NOT the same as `maxAttempts: 1` in intent —
+* the flag is what a consumer table flips, the count is what the operator tunes.
+* A retry doubles the wall time of a call, so the two gates that run inside a
+* notification's budget keep it off (see `CONSUMER_RETRY_POLICY` in addon-ai).
+*/
+var LlmRetryPolicySchema = object({
+	enabled: boolean().default(false),
+	/** Total attempts INCLUDING the first. 1 = no retry. */
+	maxAttempts: number().int().min(1).max(5).default(1)
+});
 var LlmGenerateBaseInputSchema = object({
 	/** Collection routing (the notification-output posture). */
 	addonId: string().optional(),
@@ -12657,7 +12665,28 @@ var LlmGenerateBaseInputSchema = object({
 	jsonSchema: record(string(), unknown()).optional(),
 	/** Per-call override of the profile default. */
 	maxTokens: number().int().positive().optional(),
-	temperature: number().optional()
+	temperature: number().optional(),
+	/** Per-call override of the profile default (nucleus sampling). */
+	topP: number().min(0).max(1).optional(),
+	/** Per-call override of the profile default (top-k sampling). */
+	topK: number().int().positive().optional(),
+	/** Per-call override of `profile.timeoutMs` — the total generation bound. */
+	timeoutMs: number().int().positive().optional(),
+	/** Per-call override; beats both the consumer table and the profile. */
+	retry: LlmRetryPolicySchema.optional(),
+	/**
+	* Caller-minted id that makes this generation CANCELLABLE.
+	*
+	* Without it a caller that stops waiting cannot stop the work: the gates race
+	* the call against 8 s and free their own slot when the timer wins, while the
+	* generation upstream keeps running to `profile.timeoutMs` — 60 s by default,
+	* on a single-threaded local model. The per-camera bound then counts WAITS,
+	* not generations, and the real load is unbounded.
+	*
+	* `AbortSignal` cannot cross a process boundary; an id can. Pass one here and
+	* `llm.cancel({ requestId })` tears the socket down.
+	*/
+	requestId: string().optional()
 });
 /**
 * `llm-runtime` — node-side managed llama.cpp executor (spec §4). Registered
@@ -12670,6 +12699,18 @@ var LlmGenerateBaseInputSchema = object({
 * Resource ceiling = llama-server flags + idleStopMinutes ONLY (no RSS
 * watchdog — operator decision #3).
 */
+/**
+* A companion artifact that MUST land beside the main GGUF: the `mmproj`
+* projector of a vision model, or shards 2..N of a split GGUF. Carried on the
+* REF rather than looked up at install time, so what the operator approved in
+* the preview is exactly what the node downloads.
+*/
+var ManagedModelExtraFileSchema = object({
+	url: string(),
+	filename: string(),
+	sizeBytes: number(),
+	sha256: string().optional()
+});
 var ManagedModelRefSchema = discriminatedUnion("kind", [
 	object({
 		kind: literal("catalog"),
@@ -12678,7 +12719,11 @@ var ManagedModelRefSchema = discriminatedUnion("kind", [
 	object({
 		kind: literal("url"),
 		url: string(),
-		sha256: string().optional()
+		sha256: string().optional(),
+		/** Picker/status label; the file basename when absent. */
+		label: string().optional(),
+		sizeBytes: number().optional(),
+		extraFiles: array(ManagedModelExtraFileSchema).optional()
 	}),
 	object({
 		kind: literal("path"),
@@ -12696,13 +12741,82 @@ var ManagedRuntimeConfigSchema = object({
 	gpuLayers: number().int().default(0),
 	/** Default: cpus-2, clamped ≥1 (resolved node-side). */
 	threads: number().int().optional(),
-	/** Concurrent slots. */
+	/** Concurrent slots (`--parallel`). */
 	parallel: number().int().default(1),
+	/** Logical batch size (`-b`). Larger = faster prompt ingest, more RAM. */
+	batchSize: number().int().positive().optional(),
+	/** Physical batch / micro-batch (`-ub`). */
+	ubatchSize: number().int().positive().optional(),
+	/**
+	* `--flash-attn`. Cuts KV-cache memory on the backends that implement it and
+	* is a no-op elsewhere, so it is offered rather than assumed.
+	*/
+	flashAttention: boolean().default(false),
+	/**
+	* `--mlock`. Pins the weights in RAM so the OS cannot page them out mid
+	* inference. Costs the full model size in resident memory — which is exactly
+	* what the RAM budget is counting.
+	*/
+	mlock: boolean().default(false),
+	/**
+	* `--no-mmap`. Reads the whole GGUF up front instead of mapping it. Slower to
+	* start, but avoids the page-fault stalls a network or spinning-disk model
+	* store produces on every first token.
+	*/
+	noMmap: boolean().default(false),
+	/** `--cache-type-k` / `--cache-type-v` — quantising the KV cache is the
+	*  cheapest way to fit a longer context in the same RAM. */
+	cacheTypeK: _enum([
+		"f32",
+		"f16",
+		"q8_0",
+		"q5_1",
+		"q5_0",
+		"q4_1",
+		"q4_0"
+	]).optional(),
+	cacheTypeV: _enum([
+		"f32",
+		"f16",
+		"q8_0",
+		"q5_1",
+		"q5_0",
+		"q4_1",
+		"q4_0"
+	]).optional(),
+	/**
+	* Escape hatch for llama-server flags this schema does NOT model — `--jinja`
+	* (which most vision chat templates need and some language-only models
+	* dislike), `--cont-batching`, `--rope-scaling`, …
+	*
+	* It is NOT a second place to set the flags above. A token that collides
+	* with a typed field is REJECTED at start, naming the field that owns it
+	* (`assertNoOwnedFlags`), because two knobs writing the same argv is exactly
+	* the "two switches that disagree" failure this repo has already shipped
+	* twice (D62).
+	*/
+	extraArgs: array(string()).default([]),
 	/** Else lazy: first generate boots it. */
 	autoStart: boolean().default(false),
 	/** 0 = never; frees RAM after quiet periods. */
 	idleStopMinutes: number().int().default(30)
 });
+/**
+* Where a multi-GB install currently is. A single 0..1 fraction cannot answer
+* "is it stuck?" for an install that is three files (shards + mmproj) followed
+* by a sha256 pass over 22 GB — during which the fraction sat at 1.0 and the
+* node looked hung. Phase + file + bytes is the smallest shape that does.
+*/
+var LlmDownloadProgressSchema = object({
+	phase: _enum(["downloading", "verifying"]),
+	/** The artifact currently moving, e.g. `mmproj-F16.gguf`. */
+	file: string(),
+	fileIndex: number().int(),
+	fileCount: number().int(),
+	/** Across the WHOLE install, not the current file. */
+	downloadedBytes: number(),
+	totalBytes: number().optional()
+});
 var LlmRuntimeStatusSchema = object({
 	/** Status is ALWAYS node-qualified. */
 	nodeId: string(),
@@ -12719,6 +12833,8 @@ var LlmRuntimeStatusSchema = object({
 	modelPath: string().optional(),
 	modelId: string().optional(),
 	downloadProgress: number().min(0).max(1).optional(),
+	/** Detail behind `downloadProgress`; present for the same lifetime. */
+	download: LlmDownloadProgressSchema.optional(),
 	lastError: string().optional(),
 	crashesInWindow: number(),
 	/** Child RSS (sampled best-effort). */
@@ -12729,7 +12845,14 @@ var LlmNodeModelSchema = object({
 	file: string(),
 	sizeBytes: number(),
 	catalogId: string().optional(),
-	installedAt: number().optional()
+	installedAt: number().optional(),
+	/**
+	* Absolute path on the node. Present so a file that is on disk but matches
+	* no catalog entry — a custom Hugging Face install, or a GGUF the operator
+	* copied in by hand — is still SELECTABLE, as a `{kind:'path'}` ref. Without
+	* it the picker could list such a file and do nothing with it.
+	*/
+	path: string().optional()
 });
 var LlmRuntimeDiskUsageSchema = object({
 	nodeId: string(),
@@ -12785,10 +12908,47 @@ var LlmProfileSchema = object({
 	baseUrl: string().optional(),
 	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
 	apiKey: string().optional(),
+	/** Vision on/off. A vision call against a `false` profile is REFUSED, never
+	*  degraded to text — that shipped once and produced a confident answer to a
+	*  question about a picture nobody sent. */
 	supportsVision: boolean(),
 	temperature: number().min(0).max(2).optional(),
+	/** Nucleus sampling. Every wire we speak has it. */
+	topP: number().min(0).max(1).optional(),
+	/** Top-k sampling. Carried only by the wires that have it — NEITHER OpenAI
+	*  wire does, and the client drops it there (measured: the request body gets
+	*  `top_p` and no `top_k`). The profile editor hides the field wherever it
+	*  would change nothing; `KINDS_WITH_TOP_K` is the single owner of that list. */
+	topK: number().int().positive().optional(),
 	maxTokens: number().int().positive().optional(),
+	/** Prompt context window. Advisory for cloud kinds (they enforce their own);
+	*  for `managed-local` it is the llama.cpp `--ctx-size` the runtime starts
+	*  the model with, so it is the one field that changes a PROCESS. */
+	contextLength: number().int().positive().optional(),
+	/** Default system prompt. A caller's `system` REPLACES it (never appends —
+	*  two system prompts fighting is worse than either alone). */
+	systemPrompt: string().optional(),
+	/** Total generation bound — the only one a unary call has. */
 	timeoutMs: number().int().positive().default(6e4),
+	/** The TCP handshake only — "is the port even open". NOT the wait for
+	*  response headers: on the LM Studio / llama-server wire those are written
+	*  once the model has finished loading, so they belong to the bound below. */
+	connectTimeoutMs: number().int().positive().default(1e4),
+	/** Accepted, but no output yet — response headers included, because a cold
+	*  GPU load is exactly what happens before them. */
+	firstTokenTimeoutMs: number().int().positive().default(12e4),
+	/** Output started then stopped. */
+	idleTimeoutMs: number().int().positive().default(6e4),
+	/** Profile-level default. The per-consumer table and a per-call override
+	*  both beat it — see `resolveRetryPolicy`. */
+	retry: LlmRetryPolicySchema.default({
+		enabled: false,
+		maxAttempts: 1
+	}),
+	/** Whether this profile may use tools. The tool-call plumbing rides the
+	*  library; the REGISTRY of callable tools is ours and is empty in v1, so a
+	*  `true` here buys the wiring, not behaviour, until tools are registered. */
+	toolsEnabled: boolean().default(false),
 	extraHeaders: record(string(), string()).optional(),
 	/** kind === 'managed-local' only (spec §4). */
 	runtime: ManagedRuntimeConfigSchema.optional()
@@ -12838,6 +12998,36 @@ var ManagedModelCatalogEntrySchema = object({
 	/** Vision models: companion projector file. */
 	mmprojUrl: string().optional()
 });
+/**
+* The outcome of turning one operator-typed Hugging Face reference into a
+* download plan. A RESULT, never a throw: "this repo has 24 quantizations and
+* I will not pick for you" is a normal answer the UI has to render, not an
+* exception.
+*
+* `candidates` is the whole reason the refusal is usable — every string in it
+* is a tag that resolves when pasted back as `<org>/<repo>:<TAG>`.
+*/
+var HfModelResolutionSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	/** Ready to hand to `installModel` unchanged. */
+	model: ManagedModelRefSchema,
+	label: string(),
+	repo: string(),
+	quantization: string(),
+	purpose: _enum(["text", "vision"]),
+	totalBytes: number(),
+	/** mmproj + shards, for the preview: an operator approving 23 GB should
+	*  see that 0.9 GB of it is a projector they did not name. */
+	extraFilenames: array(string())
+}), object({
+	ok: literal(false),
+	code: string(),
+	message: string(),
+	candidates: array(string()).optional(),
+	/** Set when the refusal was only the ceiling: re-calling with
+	*  `maxBytes: requiredBytes` is the operator's explicit override. */
+	requiredBytes: number().optional()
+})]);
 var LlmRuntimeNodeSchema = object({
 	nodeId: string(),
 	reachable: boolean(),
@@ -12850,7 +13040,10 @@ var ProfileRefInputSchema = object({
 	addonId: string(),
 	profileId: string()
 });
-method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(GenerateVisionInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
+method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(GenerateVisionInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(object({
+	addonId: string().optional(),
+	requestId: string()
+}), _void(), { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(ProfileRefInputSchema, _void(), {
@@ -12871,6 +13064,15 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }
 	consumer: string().optional(),
 	profileId: string().optional()
 }), array(LlmUsageRollupSchema)), method(object({}), array(ManagedModelCatalogEntrySchema)), method(object({}), array(LlmRuntimeNodeSchema)), method(object({ nodeId: string() }), array(LlmNodeModelSchema)), method(object({
+	/** `https://huggingface.co/<org>/<repo>/resolve/main/<f>.gguf`,
+	*  `<org>/<repo>/<f>.gguf`, `<org>/<repo>` or `<org>/<repo>:<QUANT>`. */
+	ref: string(),
+	/** Explicit ceiling override, in bytes. Absent = the built-in ceiling. */
+	maxBytes: number().positive().optional()
+}), HfModelResolutionSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	nodeId: string(),
 	model: ManagedModelRefSchema
 }), _void(), {
@@ -14624,28 +14826,36 @@ var NcOccupancyConditionSchema = object({
 /**
 * Audio condition (IMMEDIATE trigger) — a rule on SOUND, not on a picture.
 *
-* Operator-approved vocabulary (2026-08-12, option A — the same one the
-* reference notifier uses, so an operator moving between them re-uses what
-* they already know): a rule matches when, over a sampling window of
-* `samplingSeconds`, at least `hitPercent`% of the audio samples in that
-* window are HITS. A sample is a hit when it satisfies BOTH present filters:
-*
-*  - `dbThreshold` — its level is at or above this many dBFS (see
-*    {@link NC_AUDIO_DBFS_FLOOR}: negative-going, `0` = full scale);
-*  - `labels` — the classifier put at least one of these labels on it.
-*
-* Both are OPTIONAL and independent, which is the point of the shape: a
-* loudness rule ("something loud at 3am") needs no model to be right, and a
-* label rule ("a dog barked") needs no threshold. **Fail-closed when NEITHER
-* is given** — a window in which every sample is trivially a hit would fire on
-* silence, so the engine refuses such a condition rather than notifying on
-* nothing (the schema cannot express "at least one of" without becoming a
-* ZodEffects the cap path would have to special-case).
-*
-* `hitPercent` is over the samples the window actually HOLDS, and the window
-* must be FULL before it can match — a window that has been open for two
-* seconds of its ten is 100% of nothing, and firing on it would make
-* `samplingSeconds` decorative.
+* **TWO EXCLUSIVE MODES** (operator decision 2026-08-14, D157). Which one a
+* rule is in is not a stored field — it is WHICH FILTER the rule carries, so
+* there is no second switch that can disagree with the first and every rule
+* authored before the decision migrates for free (`audioModeOf`):
+*
+*  - **LABEL mode — `labels` present.** The rule fires on the FIRST frame the
+*    classifier labels with one of them. No window, no percentage:
+*    `hitPercent` and `samplingSeconds` are ignored, and the rule's own
+*    `throttle` cooldown is the only brake. The per-label confidence floor is
+*    the analyzer's (`classificationMinScore`, per device) — a label only
+*    reaches this condition if the classifier was already confident enough.
+*  - **LEVEL mode — `dbThreshold` present, no labels.** The sampling window IS
+*    the condition: at least `hitPercent`% of the samples over
+*    `samplingSeconds` must be at or above `dbThreshold` dBFS (see
+*    {@link NC_AUDIO_DBFS_FLOOR}: negative-going, `0` = full scale). The window
+*    must be FULL before it can match — a window open for two of its ten
+*    seconds is 100% of nothing.
+*
+* **Why label mode has no window.** It had one, and it never fired: the
+* analyzer emits ~1 audio frame per second but YAMNet only LABELS one to three
+* of them per episode, even through continuous crying. The measured maximum
+* `hitPercent` over the whole live history was 40 — under the shipped default
+* of 60, so a label rule could not fire at all, ever. A percentage of frames is
+* the wrong question to ask of a sparse classifier.
+*
+* **Fail-closed when NEITHER is given** — every sample would be a trivial hit
+* and the rule would fire on silence. The schema cannot express "exactly one
+* of" without becoming a ZodEffects the cap path would have to special-case, so
+* the exclusivity is enforced where every editor writes (`patchAudio`) and a
+* legacy rule carrying both resolves to LABEL (the mode that fires).
 *
 * Labels are the audio macro classes (`AUDIO_MACRO_LABELS` / the NC taxonomy's
 * `audio-*` ids). Both spellings are accepted — the matcher normalizes the
@@ -14653,13 +14863,13 @@ var NcOccupancyConditionSchema = object({
 * an operator who typed `dog` mean the same thing.
 */
 var NcAudioConditionSchema = object({
-	/** Audio macro labels; absent = any sound (level-only rule). */
+	/** LABEL MODE: audio macro labels. Present ⇒ fires on the first labelled frame. */
 	labels: array(string().min(1)).min(1).optional(),
-	/** Level floor in dBFS (negative-going, `0` = full scale); absent = any level. */
+	/** LEVEL MODE: floor in dBFS (negative-going, `0` = full scale). */
 	dbThreshold: number().min(-96).max(0).optional(),
-	/** Percentage of the window's samples that must be hits (1–100). */
+	/** LEVEL MODE ONLY: percentage of the window's samples that must be hits (1–100). */
 	hitPercent: number().int().min(1).max(100).default(60),
-	/** Length of the sampling window in seconds. */
+	/** LEVEL MODE ONLY: length of the sampling window in seconds. */
 	samplingSeconds: number().int().min(1).max(300).default(10)
 });
 /**
@@ -14797,13 +15007,81 @@ var NcRuleActionsSchema = object({
 	*/
 	buttons: array(NcRuleNotificationButtonSchema).max(8).optional()
 });
+/**
+* "This rule applies only while `deviceId` is in one of `states`."
+*
+* The states are the DEVICE's own vocabulary — `AlarmState` for a panel,
+* `on`/`off` for a switch — not a normalised set, because normalising would
+* make the condition lie about devices whose states have no equivalent.
+*
+* An unreadable state does NOT match: see the engine's fail-closed gate. A
+* condition that fired on "I could not read it" would be worse than no gate.
+*/
+var NcDeviceStateConditionSchema = object({
+	deviceId: number().int(),
+	/** Any of these matches. */
+	states: array(string().min(1)).min(1)
+});
+/**
+* "This rule applies only while scene `sceneId` is `matched` / `diverged`."
+*
+* A GATE, not a trigger. `occupancy` and `audio` each DISCRIMINATE their rule —
+* carrying one makes the rule fire on that subject and nothing else. Scene is
+* the other shape entirely, the `deviceState` shape: it narrows a rule that
+* already has a trigger ("tell me about a person at the front door, but only
+* while the bin is still out"). That is why it composes with every delivery
+* instead of owning one, and why no new `NcDelivery` member and no new subject
+* kind exist for it — see D159.
+*
+* ── Identity ───────────────────────────────────────────────────────────────
+* `sceneId` is `SceneMonitor.id`, a `randomUUID()` minted by `createScene` —
+* globally unique, so it needs no device to disambiguate it. `deviceId` is
+* carried as a HINT for the editor and for the log line, never as part of the
+* lookup key: a rule whose hint drifted must still gate correctly.
+*
+* ── Which boolean ──────────────────────────────────────────────────────────
+* `latched` ABSENT means "whatever the scene itself says" — `SceneMonitor.emit`
+* already declares which boolean drives notification rules, and a second knob
+* that could disagree with it is exactly the D62 failure. Set it only to
+* override one rule against the scene's own default.
+*
+*  - LIVE reading (`emit`/`latched` resolve to live): passes iff
+*    `verdict === requiredState`. `unknown` — no reference for this light, view
+*    shifted, no snapshot — passes NEITHER. A scene that cannot judge is not
+*    evidence, in either direction.
+*  - LATCHED reading: passes iff `latched === (requiredState === 'diverged')`.
+*    The latch is a durable fact about the past ("it has diverged since I armed
+*    it"), so a camera that has gone dark does not clear it — that is the whole
+*    reason the operator asked for a latch.
+*
+* The gate reads an in-memory mirror (`NcSceneStateCache`) refreshed OFF the
+* event path, never the cap: D49. A mirror that has never loaded, or a scene it
+* does not carry, reads absent and the rule does NOT fire — fail closed, and
+* said out loud in the log rather than dropped in silence.
+*/
+var NcSceneConditionSchema = object({
+	/** `SceneMonitor.id` — the uuid the cap mints. The whole lookup key. */
+	sceneId: string().min(1),
+	/** The camera the scene lives on. A hint for the editor and the log line. */
+	deviceId: number().int().optional(),
+	/** The state the scene must be in for the rule to fire. */
+	requiredState: _enum(["matched", "diverged"]),
+	/**
+	* Read the LATCH (`true`) or the LIVE verdict (`false`). Absent = follow the
+	* scene's own `emit` field, which is the only place that decision belongs.
+	*/
+	latched: boolean().optional()
+});
 var NcConditionsSchema = object({
 	/** Gate on ANOTHER device's current state (the alarm armed, a switch on). */
-	deviceState: object({
-		deviceId: number().int(),
-		/** Any of these matches. */
-		states: array(string().min(1)).min(1)
-	}).optional(),
+	deviceState: NcDeviceStateConditionSchema.optional(),
+	/**
+	* Gate on a SCENE's state — "only while the bin is still out". Composes with
+	* every trigger (detection, occupancy, audio, sensor, package, track-end);
+	* unlike `occupancy`/`audio` it discriminates nothing. See
+	* {@link NcSceneCondition} and D159.
+	*/
+	scene: NcSceneConditionSchema.optional(),
 	/** Device scope — absent = all devices. */
 	devices: array(number()).optional(),
 	/** Detector class names (any overlap with the record's class set). */
@@ -15441,6 +15719,7 @@ var NcConditionDescriptorSchema = object({
 		"occupancy",
 		"audio",
 		"deviceState",
+		"scene",
 		"systemEvent"
 	]),
 	operator: _enum([
@@ -16918,7 +17197,10 @@ var RecentTracksQueryInput = object({
 	*  Encodes the (lastSeen, trackId) sort position — treat as opaque. */
 	cursor: string().optional(),
 	/** See {@link TrackProjectionSchema}. Default `full`. */
-	projection: TrackProjectionSchema.optional()
+	projection: TrackProjectionSchema.optional(),
+	/** Include stationary-promoted rows (parked objects). Default false: the
+	*  feed lists passages; parking records live on the stationary registry. */
+	includeStationary: boolean().optional()
 });
 var RecentTracksPageSchema = object({
 	/** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
@@ -17136,7 +17418,11 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	zone: TrackZoneFilterSchema.optional(),
 	/** See {@link TrackProjectionSchema}. Default `full` (backward
 	*  compatible — omitting the field keeps today's exact behaviour). */
-	projection: TrackProjectionSchema.optional()
+	projection: TrackProjectionSchema.optional(),
+	/** Include stationary-promoted rows (parked objects handed to the
+	*  stationary registry). Default false: the timeline lists passages,
+	*  not parking records (operator decision, 2026-08-15). */
+	includeStationary: boolean().optional()
 }), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -17300,11 +17586,16 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	auth: "admin"
 }), method(object({
 	eventId: string(),
-	kind: MediaFileKindEnum.optional()
+	kind: MediaFileKindEnum.optional(),
+	deviceId: number()
 }), array(MediaFileSchema).readonly()), method(object({
 	trackId: string(),
-	kinds: array(MediaFileKindEnum).optional()
-}), array(MediaFileSchema).readonly()), method(object({ trackId: string() }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
+	kinds: array(MediaFileKindEnum).optional(),
+	deviceId: number()
+}), array(MediaFileSchema).readonly()), method(object({
+	trackId: string(),
+	deviceId: number()
+}), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
@@ -18004,6 +18295,17 @@ var maxSessionHoldMsField = {
 	default: 12e4,
 	step: 5e3
 };
+/**
+* Quiet period that closes an `audioMode: 'on-motion'` audio window. Floor of
+* 5s so a rearm can never degenerate into per-event stream churn; default 90s
+* comfortably outlives the gap between two PIR wakes on a battery camera.
+*/
+var audioMotionWindowMsField = {
+	min: 5e3,
+	max: 6e5,
+	default: 9e4,
+	step: 5e3
+};
 var motionFpsField = {
 	min: 1,
 	max: 30,
@@ -18180,6 +18482,27 @@ var RunnerCameraConfigSchema = object({
 	* resolved `CameraDetectionConfig`.
 	*/
 	maxSessionHoldMs: number().min(maxSessionHoldMsField.min).max(maxSessionHoldMsField.max).optional(),
+	/**
+	* Orchestrator-side quiet period (ms) that closes an `audioMode:
+	* 'on-motion'` audio window, measured from the LAST motion event.
+	*
+	* This exists because the falling edge cannot be relied on. Camera-native
+	* providers emit motion as a RISING EDGE ONLY (Reolink's Baichuan push and
+	* its email-push SMTP path both emit `detected: true` and never the
+	* counterpart); only the frame-diff analyzer emits falls. So on an
+	* onboard-only camera a window that closed only on `detected: false` never
+	* closed at all, and `on-motion` silently behaved as `always-on` — on a
+	* battery camera, the one failure mode the mode exists to prevent.
+	*
+	* Every motion event rearms this timer WITHOUT restarting the stream, so a
+	* burst of re-fires costs nothing. A falling edge, when one does arrive,
+	* still closes earlier via `motionCooldownMs` — whichever comes first wins.
+	*
+	* Not consumed by the runner: carried here so it shares the per-camera
+	* device-settings surface with `motionCooldownMs`, exactly like
+	* `maxSessionHoldMs`.
+	*/
+	audioMotionWindowMs: number().min(audioMotionWindowMsField.min).max(audioMotionWindowMsField.max).optional(),
 	motionFps: number().min(motionFpsField.min).max(motionFpsField.max).default(motionFpsField.default),
 	detectionFps: number().min(detectionFpsField.min).max(detectionFpsField.max).default(detectionFpsField.default),
 	motionStreamId: string(),
@@ -18275,7 +18598,7 @@ var RunnerCameraConfigSchema = object({
 	*/
 	inferenceDevices: array(RunnerInferenceDeviceSchema).readonly().optional()
 });
-motionFpsField.min, motionFpsField.max, motionFpsField.step, motionFpsField.default, detectionFpsField.min, detectionFpsField.max, detectionFpsField.step, detectionFpsField.default, motionCooldownMsField.min, motionCooldownMsField.max, motionCooldownMsField.step, motionCooldownMsField.default, maxSessionHoldMsField.min, maxSessionHoldMsField.max, maxSessionHoldMsField.step, maxSessionHoldMsField.default, occupancyRecheckSecField.min, occupancyRecheckSecField.max, occupancyRecheckSecField.step, occupancyRecheckSecField.default, occupancyRecheckFramesField.min, occupancyRecheckFramesField.max, occupancyRecheckFramesField.step, occupancyRecheckFramesField.default;
+motionFpsField.min, motionFpsField.max, motionFpsField.step, motionFpsField.default, detectionFpsField.min, detectionFpsField.max, detectionFpsField.step, detectionFpsField.default, motionCooldownMsField.min, motionCooldownMsField.max, motionCooldownMsField.step, motionCooldownMsField.default, maxSessionHoldMsField.min, maxSessionHoldMsField.max, maxSessionHoldMsField.step, maxSessionHoldMsField.default, audioMotionWindowMsField.min, audioMotionWindowMsField.max, audioMotionWindowMsField.step, audioMotionWindowMsField.default, occupancyRecheckSecField.min, occupancyRecheckSecField.max, occupancyRecheckSecField.step, occupancyRecheckSecField.default, occupancyRecheckFramesField.min, occupancyRecheckFramesField.max, occupancyRecheckFramesField.step, occupancyRecheckFramesField.default;
 /**
 * Runtime load summary returned by `getLocalLoad`. Used by the orchestrator's
 * load-balancing levels (L2 capacity-based, L3 hardware-aware) to decide
@@ -19308,6 +19631,39 @@ var snapshotCapability = {
 			etag: string().nullable()
 		}))),
 		/**
+		* The full decision chain for ONE device, for the viewer's debug readout —
+		* the answer to "why does this tile show what it shows" in a single poll:
+		* the battery slice the state was derived from, the resolved state + its
+		* reason, the cached frame's identity/age, whether a wake window is open,
+		* and whether a fresh capture is in flight. Cache-only and capture-free:
+		* a debug read must never wake a battery camera.
+		*/
+		getDebugState: systemMethod(object({ deviceId: number() }), object({
+			/** The battery slice as read, or null when the device has none. */
+			battery: object({
+				sleeping: boolean(),
+				lastUpdated: number(),
+				lastContactAt: number().optional()
+			}).nullable(),
+			/** The resolved snapshot state (what the overlay decision used). */
+			state: object({
+				isBattery: boolean(),
+				reason: _enum([
+					"disabled",
+					"sleeping",
+					"unreachable",
+					"waking"
+				]).nullable()
+			}),
+			/** The cached frame behind the next paint. */
+			frame: object({
+				capturedAt: number().nullable(),
+				ageMs: number().nullable()
+			}),
+			/** A wake window is currently open (the Waking overlay's source). */
+			waking: boolean()
+		})),
+		/**
 		* Signed, expiring links to a CLIENT-SIZED frame — and the demand signal
 		* that makes those frames current.
 		*
@@ -19380,7 +19736,16 @@ targets: array(object({
 			/** A sleeping battery camera: the frame is deliberately stale and will
 			*  NOT refresh in the background. A surface should say so rather than
 			*  present it as current. */
-			sleeping: boolean()
+			sleeping: boolean(),
+			/** Current device state rendered over the cached frame. State images
+			*  remain authoritative even when their photographic background is
+			*  old; null means the link must carry a current camera frame. */
+			stateReason: _enum([
+				"disabled",
+				"sleeping",
+				"unreachable",
+				"waking"
+			]).nullable()
 		})))
 	},
 	status: {
@@ -21040,6 +21405,25 @@ var BatteryStatusSchema = object({
 	/** Ms epoch of the last observation. Lets consumers reason about freshness. */
 	lastUpdated: number(),
 	/**
+	* Ms epoch of the last time the device PROVED it was reachable — a
+	* completed firmware round-trip, an observed wake, or an inbound push
+	* (firmware event, email). `0`/absent = never since this slice was born.
+	*
+	* This is the ONLY input that separates "asleep" from "gone", and it is
+	* fed exclusively by PASSIVE signals: nothing may write it by reaching
+	* for the radio, because a poll that confirms reachability is the same
+	* poll that drains the battery. See {@link deriveBatteryPresence} — the
+	* single derivation every consumer must use; no surface computes its own.
+	*
+	* It is deliberately NOT a clock in the
+	* `scripts/check-runtime-state-durability.ts` sense: it is the
+	* observation itself, and it is the only thing a 30-hour silence is
+	* visible in. Writers quantise it (see `CONTACT_WRITE_QUANTUM_MS` in the
+	* Reolink provider) so a value that means "recently" cannot cost a
+	* SQLite commit per round-trip.
+	*/
+	lastContactAt: number().optional(),
+	/**
 	* True when the source is a BINARY low-battery indicator (HA
 	* `binary_sensor` device_class=battery / `LOW_BAT`) that has no real
 	* charge level — `percentage` is then a coarse stand-in (100 = normal,
@@ -26571,10 +26955,22 @@ method(object({
 * thing except the comparator: `similarity` (CLIP cosine at the same ROI coords
 * vs condition-tagged references) and `llm` (vision-LLM judgment over the crop).
 *
-* D14 device-config archetype (`deviceConfig.ui.kind:'widget'`) — the framework
-* derives the device-detail contribution; the provider carries NO hand-written
-* settings-contribution methods. `status.kind:'push'` — the engine pushes on
-* every hysteresis flip / availability change; consumers never poll.
+* **No `deviceConfig`, deliberately.** This shipped as the D14 widget archetype,
+* which put a "Scenes" tab on one camera's detail page. That is the wrong shape
+* for the thing: a scene is a standing question about the property ("is the bin
+* still out"), and the operator's question is "which of my scenes have tripped",
+* across every camera at once — not "what does camera 617 think". Buried one
+* camera deep it also could not be found. The surface is now a top-level admin
+* page (`/scenes`, `pages/Scenes.tsx`) that lists every scene on every camera and
+* picks the camera inside the create flow, the same shape Events and Faces have.
+*
+* The consequence to keep in mind: `host/scene-monitor-editor` is gone from
+* `HOST_WIDGETS` too. `scripts/check-host-widget-resolves.ts` asserts BOTH
+* directions, so a registration nobody declares fails exactly as loudly as a
+* declaration nobody registers. The editor is imported directly by the page.
+*
+* `status.kind:'push'` — the engine pushes on every hysteresis flip /
+* availability change; consumers never poll.
 */
 /** Extensible condition tag. Seeded 'day' | 'ir' (the two variants the operator
 *  captures) plus 'night' | 'dawn' | 'dusk' from the resolver's sun-times band.
@@ -26585,6 +26981,33 @@ method(object({
 *  as `unknown`, never guessed. A day reference scored against an IR frame
 *  collapses the cosine and would latch a false alarm every single night. */
 var SceneConditionSchema = string();
+/**
+* What a scene does when the CURRENT light has no reference of its own.
+*
+* The lighting variants are not equally likely to exist. Almost every operator
+* captures daylight and then never stands outside at 22:00 to capture IR, and a
+* scene that is only ever going to be asked about a daytime question ("is the
+* bin still on the kerb at 08:00") does not need a night reference at all. The
+* night half must therefore be OPTIONAL, and optional means the scene keeps
+* working without it rather than degrading into a permanent complaint.
+*
+* - `skip` (default) — the check in that light is not made. Not a verdict, not
+*   an alarm, not even an `unknown`: the live state simply stays whatever the
+*   last covered light left it at, the latch is untouched, and the hysteresis
+*   run is neither spent nor cleared. The scene resumes by itself at first
+*   light. This is the only behaviour under which "I never captured IR" is a
+*   configuration choice instead of a nightly fault.
+* - `judge-anyway` — score against the OTHER conditions' references. Available
+*   for cameras whose IR frame is close enough to daylight (a floodlit
+*   driveway, an always-white-light doorbell), and wrong for everything else:
+*   cross-condition cosines are not comparable, so a day reference against a
+*   true IR frame collapses and the scene reports a theft at 21:40.
+*
+* Never applies when the scene has NO comparable reference at all — that is
+* "not armed yet", it is reported as `no-reference-for-condition`, and silence
+* there would hide a scene the operator never finished setting up.
+*/
+var SceneUncoveredPolicySchema = _enum(["skip", "judge-anyway"]);
 /** `matched` = the baseline is what we see; `diverged` = it demonstrably is not;
 *  `unknown` = we cannot judge (no reference for this condition, encoder model
 *  changed, view shifted, no snapshot). `unknown` is a real value, not a null,
@@ -26640,6 +27063,9 @@ var SceneCheckSchema = discriminatedUnion("mode", [object({
 	hysteresisCount: number().int().positive()
 })]);
 var SCENE_DEFAULT_ANCHOR_THRESHOLD = .85;
+/** Night is OPTIONAL. A scene with only a daylight reference sits the IR hours
+*  out in silence rather than reporting a fault every night. */
+var SCENE_DEFAULT_UNCOVERED_POLICY = "skip";
 /**
 * Vision-model adjudication of a candidate flip. Field names deliberately
 * mirror `NcConfirmSchema` so an operator meets one vocabulary, not two.
@@ -26706,6 +27132,21 @@ var SceneMonitorSchema = object({
 	*  automation can react to the bin coming back without the operator's own
 	*  alarm silently clearing itself. */
 	autoRestore: boolean().default(false),
+	/** What to do when the current light has no reference of its own. See
+	*  {@link SceneUncoveredPolicySchema} — the default makes night OPTIONAL. */
+	onUncoveredCondition: SceneUncoveredPolicySchema.default(SCENE_DEFAULT_UNCOVERED_POLICY),
+	/**
+	* The light whose checks are currently being SAT OUT under
+	* `onUncoveredCondition: 'skip'` — `null` when the scene is checking normally.
+	*
+	* Engine-reported and advisory only: it moves no verdict, no latch and no
+	* hysteresis. It exists so the card can say *"night (IR) — checks paused,
+	* nothing captured in this light"* in the same calm voice as the coverage
+	* line, because the alternative is a scene that silently stops answering
+	* after sunset with nothing anywhere saying why. A skipped check must never
+	* read as a broken one.
+	*/
+	suspendedCondition: SceneConditionSchema.nullable().default(null),
 	/** Named cause when `verdict === 'unknown'`. */
 	unavailable: SceneUnavailableSchema.nullable(),
 	/** Conditions that have at least one comparable reference — the coverage line
@@ -26723,12 +27164,6 @@ var sceneMonitorCapability = {
 	kind: "wrapper",
 	defaultActive: true,
 	deviceTypes: [DeviceType.Camera],
-	deviceConfig: { ui: {
-		kind: "widget",
-		widgetId: "host/scene-monitor-editor",
-		tab: "scenes",
-		label: "Scenes"
-	} },
 	methods: {
 		listScenes: method(object({ deviceId: number() }), SceneMonitorStatusSchema),
 		createScene: method(object({
@@ -26765,6 +27200,7 @@ var sceneMonitorCapability = {
 				minObservationSpacingSec: number().int().min(0).max(3600).optional(),
 				anchorThreshold: number().min(0).max(1).optional(),
 				autoRestore: boolean().optional(),
+				onUncoveredCondition: SceneUncoveredPolicySchema.optional(),
 				/** `null` clears the vision-model adjudicator. */
 				confirm: SceneConfirmSchema.nullable().optional()
 			})
@@ -27069,13 +27505,63 @@ var CamStreamDescriptorSchema = object({
 * set of stream descriptors it can offer for the device, synchronously, so the
 * broker can reconcile its registry against the authoritative provider state.
 */
+/**
+* The catalog as a DURABLE fact rather than a live answer.
+*
+* A battery camera's descriptors are profile-stable — they change when the
+* operator rewrites an encoder profile, not minute to minute — but building
+* them costs a Baichuan login, which on a sleeping Argus IS a wake. So the
+* provider is allowed to build them exactly once per profile and must serve
+* every later pull from a cache.
+*
+* Holding that cache only in RAM is what turned a restart into an outage. The
+* runner comes back with the camera asleep, `buildStreamCatalogUncached`
+* correctly refuses to wake it, the pull answers `[]`, the broker has no
+* cam-stream entry to build a broker from, and `webrtcSession.handleOffer`
+* fails with a flat "No broker for stream" — for as long as the camera sleeps,
+* which on a battery cam is most of the day. The camera was fine. The stream
+* was unreachable because the process had forgotten what the camera offers.
+*
+* Declaring it here puts it in `device-runtime-state`, the kernel's canonical
+* declared collection, with the same `restored` durability `battery` uses for
+* the same reason: the last known value is the only value there is while the
+* device is asleep. The broker's brokers are therefore always DEFINABLE — it
+* is the DIAL that wakes a camera, never the catalog (D173).
+*/
+var StreamCatalogStateSchema = object({
+	/** The descriptors as last built from a real camera response. Never a guess:
+	*  a failed or refused build writes NOTHING, so a restored catalog is always
+	*  one the camera itself once produced. */
+	descriptors: array(CamStreamDescriptorSchema),
+	/** Ms epoch of the build that produced {@link descriptors}. Lets the wake
+	*  path decide whether the camera's own awake window is worth spending on a
+	*  re-read. */
+	lastFetchedAt: number()
+});
 var streamCatalogCapability = {
 	name: "stream-catalog",
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [DeviceType.Camera],
-	methods: { getCatalog: method(object({ deviceId: number().int().nonnegative() }), array(CamStreamDescriptorSchema).readonly()) }
+	methods: { getCatalog: method(object({ deviceId: number().int().nonnegative() }), array(CamStreamDescriptorSchema).readonly()) },
+	runtimeState: StreamCatalogStateSchema,
+	/**
+	* Runtime-state durability: **restored** — see the schema doc. A cold
+	* catalog on a sleeping battery camera is not a slow first frame, it is a
+	* camera that cannot be watched at all until it happens to wake.
+	*
+	* Churn is nil by construction: the slice is written only by a SUCCESSFUL
+	* build, and a build only runs when there is no cached copy (or the copy is
+	* a day old and the camera is awake anyway).
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock field: written, but excluded from the compare that decides whether
+	*  persisting is worth a SQLite commit — the descriptors are the value. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /** One of the camera's stream profiles. */
 var StreamProfileSchema = _enum([
@@ -27528,12 +28014,64 @@ var NetworkAddressSchema = object({
 	family: string(),
 	internal: boolean()
 });
+/**
+* Provenance of the site coordinates, and the whole reason this is not just two
+* numbers.
+*
+*   - `operator-set` — a human typed it, or accepted a detection. Authoritative;
+*     nothing overwrites it.
+*   - `derived-from-ip` — the hub geolocated its own public IP once, because a
+*     default that is right to a few kilometres beats the coarse UTC clock split
+*     the sun-times consumers otherwise fall back to.
+*
+* The UI shows which one it is. An operator who cannot tell a guess from their
+* own input will eventually trust the guess.
+*/
+var SiteLocationSourceSchema = _enum(["operator-set", "derived-from-ip"]);
+/**
+* The read shape: the location plus the honest state of the one-shot derivation.
+*
+* `derivationAttemptedAt` is what makes the "one call, ever" contract
+* inspectable. When it is set and `location` is null, the geo-IP lookup ran and
+* failed; the hub will NOT try again on its own — the fallback is declared
+* (consumers degrade to their own last resort) and the operator either types the
+* coordinates or presses detect.
+*/
+var SiteLocationStatusSchema = object({
+	location: object({
+		/** WGS84 decimal degrees. */
+		latitude: number().min(-90).max(90),
+		longitude: number().min(-180).max(180),
+		source: SiteLocationSourceSchema,
+		/** Epoch ms the value was last written. */
+		updatedAt: number(),
+		/**
+		* Human-readable place the geo-IP service reported ("Napoli, IT"). Display
+		* only — never parsed, never matched on. Absent for an operator-typed value.
+		*/
+		label: string().optional()
+	}).nullable(),
+	derivationAttemptedAt: number().nullable(),
+	/** Why the last derivation failed, for the UI to show instead of a shrug. */
+	derivationError: string().nullable()
+});
+/** `null` clears the location and re-arms nothing — the derivation stays spent. */
+var SetSiteLocationInputSchema = object({
+	latitude: number().min(-90).max(90),
+	longitude: number().min(-180).max(180)
+}).nullable();
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(_void(), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(_void(), SiteLocationStatusSchema), method(SetSiteLocationInputSchema, SiteLocationStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), SiteLocationStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
 });
 /**
 * Tamper / case-open detection sensor. Drives Home Assistant
@@ -28887,6 +29425,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	sceneMonitor: sceneMonitorCapability,
 	scriptRunner: scriptRunnerCapability,
 	smoke: smokeCapability,
+	streamCatalog: streamCatalogCapability,
 	streamParams: streamParamsCapability,
 	switch: switchCapability,
 	tamper: tamperCapability,
@@ -29540,6 +30079,15 @@ var BaseDeviceProvider = class extends BaseAddon {
 			labels: ["probe not implemented"]
 		};
 	}
+	/**
+	* Top-level devices restored at once in {@link onRestoreDevices}.
+	*
+	* Four covers the fleets this ships to without turning a boot into a burst a
+	* camera NVR answers with a refusal. A provider whose upstream is a single
+	* session with a serial command channel (a Baichuan hub, an NVR that
+	* serialises ISAPI) should lower it; nothing needs to raise it.
+	*/
+	restoreConcurrency = 4;
 	async restoreDevices(savedDevices) {
 		await this.onRestoreDevices(savedDevices);
 		if (savedDevices.length > 0) this.ctx.logger.info(`Restored ${savedDevices.length} ${this.providerName} device(s)`);
@@ -29571,15 +30119,15 @@ var BaseDeviceProvider = class extends BaseAddon {
 	*/
 	async onRestoreDevices(savedDevices) {
 		const restored = /* @__PURE__ */ new Set();
-		for (const saved of savedDevices) {
-			if (saved.parentDeviceId !== null) continue;
+		const topLevel = savedDevices.filter((saved) => saved.parentDeviceId === null);
+		const restoreOne = async (saved) => {
 			const Class = this.deviceClasses[saved.type];
 			if (!Class) {
 				this.ctx.logger.warn("No device class registered for restored type — skipping", {
 					tags: { stableId: saved.stableId },
 					meta: { type: saved.type }
 				});
-				continue;
+				return;
 			}
 			try {
 				await this.ctx.kernel.devices.create(saved.stableId, Class, {});
@@ -29593,7 +30141,15 @@ var BaseDeviceProvider = class extends BaseAddon {
 					}
 				});
 			}
-		}
+		};
+		let nextTopLevel = 0;
+		await Promise.all(Array.from({ length: Math.min(Math.max(1, this.restoreConcurrency), topLevel.length) }, async () => {
+			for (;;) {
+				const saved = topLevel[nextTopLevel++];
+				if (saved === void 0) return;
+				await restoreOne(saved);
+			}
+		}));
 		const childRows = savedDevices.filter((s) => s.parentDeviceId !== null);
 		for (const saved of childRows) {
 			const Class = this.deviceClasses[saved.type];
@@ -31815,6 +32371,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"llm.cancel": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.deleteModel": {
 		capName: "llm",
 		capScope: "system",
@@ -31899,6 +32461,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"llm.resolveModelRef": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.setDefault": {
 		capName: "llm",
 		capScope: "system",
@@ -34209,6 +34777,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"snapshot.getDebugState": {
+		capName: "snapshot",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"snapshot.getSnapshot": {
 		capName: "snapshot",
 		capScope: "device",
@@ -34749,6 +35323,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.detectSiteLocation": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"system.featureFlags": {
 		capName: "system",
 		capScope: "system",
@@ -34767,6 +35347,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"system.getSiteLocation": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.health": {
 		capName: "system",
 		capScope: "system",
@@ -34791,6 +35377,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.setSiteLocation": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.adoptLegacyMonitor": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -36273,6 +36865,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.getEventMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.getKeyEvents": [{
 		name: "deviceId",
 		form: "single",
@@ -36303,6 +36900,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.getTrackMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.getTrainingExportSummary": [{
 		name: "deviceIds",
 		form: "array",
@@ -36338,6 +36940,11 @@ Object.freeze({
 		form: "array",
 		optional: true
 	}],
+	"pipelineAnalytics.listTrackMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.listTracks": [{
 		name: "deviceId",
 		form: "single",
@@ -36773,11 +37380,22 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"snapshot.getDebugState": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"snapshot.getSnapshot": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"snapshot.getSnapshotLinks": [{
+		name: "targets",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
 	"snapshot.getSnapshotOverview": [{
 		name: "deviceIds",
 		form: "array",