@camstack/addon-provider-rademacher 0.2.113 → 0.2.115

package/dist/addon.mjs

@@ -6344,7 +6344,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-Bs3xPtSh.mjs
+//#region ../types/dist/sleep-i3eUVc-d.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7486,6 +7486,17 @@ var CamProfileSchema = _enum([
 	"mid",
 	"low"
 ]);
+/**
+* Which rung a per-camera consumer listens on: an explicit profile, or `auto`.
+*
+* `auto` is a REAL value, not an absent one — it means "resolve it by the rule
+* that consumer owns". It lives beside `CamProfile` because a rung is the only
+* operator-facing way to name a stream: a cam-stream id is broker-internal and
+* moves when a slot is reassigned, so a stored id silently stops meaning what
+* the operator picked. Today's one user is the audio analyser, whose rule is
+* "the lowest AVAILABLE native rung" (D537).
+*/
+var AudioStreamPickSchema = union([CamProfileSchema, literal("auto")]);
 var CamStreamKindSchema = _enum([
 	"pull-rtsp",
 	"pull-rtmp",
@@ -7904,6 +7915,18 @@ function systemMethod(input, output, options) {
 		systemOnly: true
 	};
 }
+/**
+* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
+* on `InferProvider`. The `providerOptional: true` literal is what
+* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
+* for when this is the honest answer and when it is a soft stub.
+*/
+function optionalMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		providerOptional: true
+	};
+}
 /** Shorthand to define an event schema */
 function event(data) {
 	return { data };
@@ -8334,6 +8357,8 @@ var EVENT_OWNER_TYPES = [
 * nothing failing until a caller asked.
 */
 var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
+/** The same list as a Zod enum, for the cap input that carries it. */
+var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
 new Set(EVENT_OWNER_TYPES);
 var EncodeProfileSchema = object({
 	video: object({
@@ -8706,6 +8731,7 @@ var CameraSwitchIdSchema = _enum([
 	"device-audio",
 	"broker-audio",
 	"audio-analysis",
+	"event-saving",
 	"recording",
 	"notifications"
 ]);
@@ -8741,10 +8767,20 @@ var CameraSwitchAuthoritySchema = discriminatedUnion("kind", [
 var CameraSwitchUnavailableReasonSchema = _enum([
 	"no-provider",
 	"source-unreachable",
-	"not-configured",
 	"device-disabled"
 ]);
 /**
+* Something true about a switch that is nonetheless OFFERED.
+*
+* The distinction from {@link CameraSwitchUnavailableReasonSchema} is the
+* whole point: a reason replaces the control, a warning travels WITH it. The
+* privacy mask taught us the difference — greying the one button that starts
+* the feature teaches the operator the feature is broken, while a live toggle
+* that flips nothing teaches them the switch is broken. Neither is true; the
+* honest surface is a working toggle that says what is missing.
+*/
+var CameraSwitchWarningSchema = _enum(["no-privacy-zones"]);
+/**
 * One switch, resolved for one camera.
 *
 * `label` and `costWhenOff` travel ON THE WIRE rather than being looked up
@@ -8763,6 +8799,11 @@ var CameraSwitchSchema = object({
 	/** False = do not render a control. `unavailableReason` says why. */
 	available: boolean(),
 	unavailableReason: CameraSwitchUnavailableReasonSchema.optional(),
+	/**
+	* Present on an AVAILABLE switch only. Rendered beside the live control;
+	* never a substitute for one.
+	*/
+	warning: CameraSwitchWarningSchema.optional(),
 	/** Current state. Meaningless when `available` is false — read it as `true`. */
 	enabled: boolean(),
 	authority: CameraSwitchAuthoritySchema
@@ -9180,11 +9221,31 @@ var RecordingBandTriggersSchema = RecordingTriggersSchema;
 * band engine's `applies` rule). `start`/`end` are `HH:MM`; an `end <= start`
 * span wraps past midnight (handled by the band engine).
 */
+/**
+* Whether a band's footage carries sound.
+*
+* The recorder has always attached with `audio: 'aac'`, so every band of every
+* camera recorded sound whether anyone wanted it or not. The broker already
+* serves the other answer — `audio: 'none'` takes the video-only `/muted`
+* restream — so this was a choice the product could always have offered.
+*
+* It belongs on the BAND rather than the camera because one camera can want
+* both: silent across the shop floor during opening hours, sound overnight.
+* And it applies to BOTH modes — an events band firing on motion has the same
+* question to answer as a continuous one.
+*/
+var RecordingBandAudioSchema = _enum(["on", "muted"]);
 var RecordingBandSchema = object({
 	days: array(RecordingWeekdaySchema),
 	start: string().regex(HHMM),
 	end: string().regex(HHMM),
 	mode: RecordingBandModeSchema,
+	/**
+	* Sound, or silence. OPTIONAL and absent-means-`on`: every recording
+	* written before this existed carried sound, and a band whose key is
+	* missing must keep meaning what it meant. See {@link RecordingBandAudioSchema}.
+	*/
+	audio: RecordingBandAudioSchema.optional(),
 	triggers: RecordingBandTriggersSchema.optional(),
 	/**
 	* RETIRED (D381). A band no longer carries a pre-buffer of its own.
@@ -14468,6 +14529,210 @@ method(object({ integrationId: string() }), object({ filters: array(AdoptionFilt
 	auth: "admin"
 });
 /**
+* device-admin-link — "this device has a management page of its own, and here
+* is its address".
+*
+* ## Why this is not a `deviceConfig` cap
+*
+* There is nothing to edit. A `deviceConfig` cap (D14) exists so the framework
+* can DERIVE a settings form from `getOptions` + `getStatus` and route a flat
+* patch back through a setter; it costs a `builderId` reducer in
+* `device-config-contribution.ts` and a `*-config-schema.ts` beside it, and it
+* renders a form section. This cap answers ONE question with ONE read and
+* renders a button. Nothing about it is a form, so it carries no `deviceConfig`
+* block, no `settings`, no `runtimeState` and no reducer — exactly like
+* `reboot`, the other pure-RPC device-native cap.
+*
+* ## Absent, and the difference between "no page" and "we cannot say"
+*
+* The two are answered at DIFFERENT layers, on purpose:
+*
+*  - **"We cannot say"** → the provider never registers the cap for that
+*    device. A VeSync humidifier, a Petkit feeder, a Dreame vacuum and a Dreo
+*    fan are reached only through a vendor cloud; there is no address to hand
+*    out and no page to open. A Tuya plug, a Wyze camera and a Gree air
+*    conditioner DO have a LAN IP, and still have no HTTP management page
+*    behind it. None of them register, so `deviceManager.getBindings` never
+*    lists the cap and no surface asks.
+*  - **"This device has no page, and I know that"** → the provider registers
+*    and `getAdminLink` returns `null`. This is the answer for a device whose
+*    sibling DOES have a page: a Reolink battery camera reached over UDP by
+*    `uid` with a blank `host`, an Ecowitt gateway configured in `listener`
+*    transport, a Home Assistant broker authenticated by supervisor token
+*    (which carries no `baseUrl` at all).
+*
+* Both draw NOTHING. A button that opens a browser error is worse than no
+* button, and D62 is the same rule from the other side: an off switch is
+* reported off, never made to look broken. There is no third state where the
+* UI renders a disabled button "because the device might have a page".
+*
+* ## The URL never carries credentials
+*
+* Not in userinfo, not in a query string. Every provider builds through
+* `buildDeviceAdminUrl` (`device-admin-link-url.ts`), which takes host, port,
+* scheme and path as separate arguments — there is no parameter a secret could
+* arrive in — and re-checks its own output for the `scheme://user:pass@` shape
+* that `scripts/check-no-credential-urls-in-fixtures.ts` bans from recorded
+* output. `scripts/check-admin-link-builder-is-the-only-url-source.ts` is what
+* keeps providers from hand-rolling one anyway.
+*
+* This matters here more than anywhere else in the repo, because every provider
+* that knows a device's host knows its PASSWORD too: `{ host, port, username,
+* password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
+* and `http://admin:hunter2@192.168.50.139/` is a URL a browser accepts. The
+* camera's own page will ask for its own login. That is correct, and pre-
+* filling it is the operator's business, not ours.
+*
+* ## It is a LAN fact
+*
+* The URL addresses the device where the NODE can see it. It is not proxied,
+* not made reachable from outside, and not sent anywhere. A surface renders it
+* as a link the operator's own browser follows, on the operator's own network,
+* or renders nothing.
+*/
+/**
+* Whose page is it. The distinction is for the OPERATOR, who needs to know
+* before clicking whether he is about to land on a camera's own web server or
+* inside Home Assistant.
+*/
+var AdminLinkTargetEnum = _enum(["device", "integration"]);
+var DeviceAdminLinkSchema = object({
+	/**
+	* Absolute `http(s)://` URL. Built by `buildDeviceAdminUrl` and therefore
+	* free of userinfo and of any credential-shaped query key.
+	*/
+	url: string(),
+	/**
+	* What the surface calls it — "Web UI", "Home Assistant", "UniFi controller".
+	* The PROVIDER names it, because only the provider knows what the page is;
+	* a UI that invented the label from the addon id would call the Home
+	* Assistant device page "Provider Homeassistant".
+	*/
+	label: string(),
+	target: AdminLinkTargetEnum,
+	/**
+	* Host the URL points at, without scheme, port or path — for the tooltip, so
+	* an operator can see WHERE the button goes before he follows it. Redundant
+	* with `url` by construction; carried separately so no surface has to parse
+	* a URL to show it.
+	*/
+	host: string()
+});
+var deviceAdminLinkCapability = {
+	name: "device-admin-link",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	methods: { 
+	/**
+	* The device's management page, or `null` when this device has none.
+	*
+	* `auth: 'admin'` deliberately. This is administration, not actuation —
+	* the same bucket as `reboot` and `camera-credentials`, and explicitly NOT
+	* the actuation set `scripts/check-actuation-not-admin.ts` protects (D403).
+	* The URL is also a statement about the LAN, which a household member with
+	* a `view` grant on a light has no reason to be handed.
+	*
+	* The surfaces gate on the QUERY, never on a role they guessed: a caller
+	* without the right loses the query and draws nothing, which is the same
+	* thing a device with no page draws. There is no path on which a button
+	* appears and then fails — the D403 failure mode, from the other end.
+	*/
+getAdminLink: method(object({ deviceId: number().int().nonnegative() }), DeviceAdminLinkSchema.nullable(), { auth: "admin" }) }
+};
+/**
+* Query keys that may never appear on an admin link. A credential smuggled as
+* `?password=` is the same leak as userinfo, in a form the userinfo check
+* cannot see: it survives copy-paste, referrer headers and proxy logs
+* identically.
+*/
+var CREDENTIAL_QUERY_KEYS = [
+	"password",
+	"passwd",
+	"pwd",
+	"pass",
+	"user",
+	"username",
+	"usr",
+	"login",
+	"token",
+	"access_token",
+	"auth",
+	"authorization",
+	"apikey",
+	"api_key",
+	"secret",
+	"credential",
+	"credentials",
+	"session",
+	"sessionid",
+	"key"
+];
+/**
+* The same userinfo shape `scripts/check-no-credential-urls-in-fixtures.ts`
+* scans recorded fixtures for, applied to what we are about to EMIT. Kept
+* structurally identical on purpose: a URL this function returns is a URL that
+* guard would pass.
+*/
+var CREDENTIAL_URL = /[a-z][a-z0-9+.-]*:\/\/[^/\s:@'"]+:[^/\s:@'"]+@/i;
+/** A host that is safe to place in an authority component verbatim. */
+var PLAIN_HOST = /^[a-zA-Z0-9._-]+$/;
+/** A bracketed IPv6 literal, the only other authority form we emit. */
+var IPV6_HOST = /^\[[0-9a-fA-F:.]+\]$/;
+function defaultPortFor(scheme) {
+	return scheme === "https" ? 443 : 80;
+}
+/**
+* Build the admin-page URL, or refuse by name.
+*
+* The refusal is never thrown: a provider answering "no page for this device"
+* is an ordinary answer (`getAdminLink` → `null`), and a throw here would turn
+* a missing host on one device into a failed query for the whole surface.
+*/
+function buildDeviceAdminUrl(parts) {
+	const host = parts.host.trim();
+	if (host.length === 0) return {
+		ok: false,
+		reason: "empty-host"
+	};
+	if (host.includes("@")) return {
+		ok: false,
+		reason: "host-carries-userinfo"
+	};
+	if (!PLAIN_HOST.test(host) && !IPV6_HOST.test(host)) return {
+		ok: false,
+		reason: "host-not-plain"
+	};
+	if (parts.port !== null) {
+		if (!Number.isInteger(parts.port) || parts.port < 1 || parts.port > 65535) return {
+			ok: false,
+			reason: "port-out-of-range"
+		};
+	}
+	if (!parts.path.startsWith("/")) return {
+		ok: false,
+		reason: "path-not-absolute"
+	};
+	const query = parts.query ?? {};
+	for (const key of Object.keys(query)) if (CREDENTIAL_QUERY_KEYS.includes(key.toLowerCase())) return {
+		ok: false,
+		reason: "credential-query-key"
+	};
+	const authority = parts.port === null || parts.port === defaultPortFor(parts.scheme) ? host : `${host}:${String(parts.port)}`;
+	const search = new URLSearchParams();
+	for (const [key, value] of Object.entries(query)) search.append(key, value);
+	const suffix = search.size > 0 ? `?${search.toString()}` : "";
+	const url = `${parts.scheme}://${authority}${parts.path}${suffix}`;
+	if (CREDENTIAL_URL.test(url)) return {
+		ok: false,
+		reason: "userinfo-in-result"
+	};
+	return {
+		ok: true,
+		url
+	};
+}
+/**
 * `device-export` — collection cap for addons that export camstack
 * devices to external ecosystems (HomeAssistant via MQTT discovery,
 * HomeKit/HAP, Alexa Smart Home, …).
@@ -21234,6 +21499,7 @@ var MediaFileKindEnum = _enum([
 	"keyFrameSmall",
 	"thumbnailSmall",
 	"confirmationCrop",
+	"debugCrop",
 	"sceneFrame"
 ]);
 /**
@@ -22313,7 +22579,11 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	ownerType: EventOwnerTypeSchema,
 	eventId: number().int(),
 	deviceId: number()
-}), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
+}), array(MediaFileInfoSchema).readonly()), method(object({
+	deviceId: number(),
+	ownerKind: MediaPresenceOwnerKindSchema,
+	ownerIds: array(string()).max(5e3)
+}), array(string()).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
@@ -22898,6 +23168,18 @@ var RunnerCameraConfigSchema = object({
 	motionStreamId: string(),
 	detectionStreamId: string(),
 	/**
+	* Which rung this camera's audio analysis listens on — `auto` (the lowest
+	* AVAILABLE native rung) or an explicit one.
+	*
+	* Not consumed by the runner: carried here so it travels with the camera's
+	* config the way `audioMotionWindowMs` does, and so the orchestrator's
+	* watchdog resolves the same stream the audio subscription did. OPTIONAL
+	* with no default — absent means `auto`, which is what every camera written
+	* before this field had, and an absent optional adds nothing to the
+	* generated cap-input defaults (D537).
+	*/
+	audioStreamPick: AudioStreamPickSchema.optional(),
+	/**
 	* Motion sources that can activate the pipeline. At least one must
 	* be present. Multiple sources OR-ed: any one firing arms the
 	* cooldown timer and transitions watching → active. The same
@@ -23968,10 +24250,9 @@ var ServerBootModeSchema = _enum([
 *  - `idle` / `checking` / `staging` — steady / in-flight registry work.
 *  - `pending-restart` — a version is staged and the node has NOT yet
 *    restarted onto it (still running the OLD version).
-*  - `awaiting-confirmation` — the node HAS restarted onto the staged version
-*    (it is the active probation boot) and is waiting to confirm boot-health.
-*    Apply/rollback are refused in this state and the node must NOT be
-*    manually restarted, or the probation boot auto-rolls-back.
+*  - `awaiting-confirmation` — RETIRED with the probation boot (single-copy
+*    collapse, 2026-07-18). Kept in the enum so an older client still parses;
+*    no provider emits it.
 */
 var ServerUpdateStateSchema = _enum([
 	"idle",
@@ -24060,12 +24341,35 @@ var ServerRollbackInfoSchema = object({
 var ServerPackageStatusSchema = object({
 	/** Root package name (`@camstack/server` on the hub). */
 	packageName: string(),
-	/** Version of the code the running process ACTUALLY loaded. */
+	/**
+	* Version of the code THIS PROCESS loaded — captured once, at boot, from the
+	* package.json of the copy the code was loaded from, and never re-read. A
+	* copy replaced on disk under a live process must not move this number;
+	* that divergence is what `installedVersion` is for. Before 2026-09-20 this
+	* was a lazy disk read that would have followed such a swap silently.
+	*/
 	runningVersion: string().nullable(),
 	/** Node.js runtime version the node's process runs on (`process.versions.node`). */
 	nodeRuntimeVersion: string().nullable(),
 	/** Active data-dir root version; null when booted from seed/workspace. */
 	activeVersion: string().nullable(),
+	/**
+	* Version of the root package in the data-root `current/` copy RIGHT NOW —
+	* what the next boot would load if nothing is staged. Normally equal to
+	* `runningVersion`; differs only when the copy on disk changed under the
+	* live process. `null` when there is no data-root copy (baked seed or
+	* workspace boot). Optional for version skew: an older provider omits it.
+	*/
+	installedVersion: string().nullable().optional(),
+	/**
+	* True when the code that would run after a restart is NOT the code running
+	* now: a version is staged (`pendingVersion`), or `installedVersion` differs
+	* from `runningVersion`. Derived on every read, never stored. This is the
+	* one field that lets an operator or a script say "1.2.353 is installed and
+	* will run after a restart" instead of reading it off a number that means
+	* "installed". Optional for version skew.
+	*/
+	restartRequired: boolean().optional(),
 	/** N-1 version kept for rollback; null when no previous version exists. */
 	previousVersion: string().nullable(),
 	/** Version of the immutable baked seed closure (image fallback). */
@@ -24100,19 +24404,71 @@ var ServerPackageStatusSchema = object({
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),
+	/** Same meaning as on the status payload: what THIS process loaded. */
 	runningVersion: string().nullable(),
 	latestVersion: string().nullable(),
+	/**
+	* `latestVersion` is newer than `runningVersion` AND is not the version
+	* already staged on this node. A staged-and-waiting version is not "an
+	* update available" — applying it again is refused (`already-staged`), and
+	* a button that announced "updating…" on this boolean then got refused
+	* would be lying. It is reported through `pendingVersion` instead.
+	*/
 	updateAvailable: boolean(),
 	checkedAtMs: number(),
 	/** Non-null when the registry lookup failed (offline, bad registry, …). */
-	error: string().nullable()
+	error: string().nullable(),
+	/**
+	* Version staged on this node and awaiting its restart, when one is. Before
+	* 2026-09-20 a check answered `{runningVersion, updateAvailable:false}` for a
+	* node whose staged closure had never booted, and the caller had no way to
+	* see the difference. Optional for version skew.
+	*/
+	pendingVersion: string().nullable().optional(),
+	/** See the status payload: staged, or installed-on-disk ≠ running. Optional for skew. */
+	restartRequired: boolean().optional()
 });
+/**
+* What an action DID — the discriminant `accepted` cannot carry. Before
+* 2026-09-20 `applyServerUpdate` answered `accepted:false` both for a refusal
+* where nothing was wrong (already current, already staged) and for a staging
+* install that died on `npm error code ECONNRESET`; the only difference was
+* prose in `message`, and an operator restarted a container on the strength of
+* it, booting the previous version.
+*
+*  - `staged`            — the closure is installed and validated; the node
+*                          restarts to apply it (`restarting:true`). NOTHING
+*                          runs the new code until that restart completes.
+*  - `restart-scheduled` — a plain, version-preserving restart was accepted.
+*  - `already-current`   — the target IS the running version; nothing done.
+*  - `refused`           — dropped by a gate; `reason` names which.
+*  - `failed`            — attempted and did not land; `error` says why.
+*/
+var ServerUpdateOutcomeSchema = _enum([
+	"staged",
+	"restart-scheduled",
+	"already-current",
+	"refused",
+	"failed"
+]);
 var ServerUpdateActionResultSchema = object({
 	accepted: boolean(),
 	targetVersion: string().nullable(),
 	/** True when a graceful restart was scheduled to apply the change. */
 	restarting: boolean(),
-	message: string()
+	message: string(),
+	/** See {@link ServerUpdateOutcomeSchema}. Optional for version skew. */
+	outcome: ServerUpdateOutcomeSchema.optional(),
+	/**
+	* Stable, greppable cause for `refused` / `failed` (the engine's
+	* `UpdateRefusalReason`, `staging-failed`, …). `null` on success.
+	*/
+	reason: string().nullable().optional(),
+	/**
+	* The failure itself, verbatim enough to act on (the npm output for a
+	* staging install). Non-null only for `failed`.
+	*/
+	error: string().nullable().optional()
 });
 method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), ServerUpdateCheckResultSchema, {
 	kind: "mutation",
@@ -25221,6 +25577,18 @@ method(VectorDeclareIndexInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(VectorStatsInputSchema, VectorStatsResultSchema, { auth: "admin" });
+_enum([
+	"queue-full",
+	"camera-backoff",
+	"sleeping",
+	"camera-refused",
+	"no-keyframe",
+	"no-catalog-row",
+	"unsupported",
+	"unknown-device",
+	"uid-missing"
+]);
+_enum(["deferred", "final"]);
 var ClipSchema = object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -25295,29 +25663,455 @@ var ClipSchema = object({
 	holes: array(object({
 		startMs: number(),
 		endMs: number()
-	})).optional()
+	})).optional(),
+	/**
+	* A URL that MAY produce this clip's still, asked only for rows actually on
+	* screen. The opposite of {@link ClipSchema.thumbnail}: that one is VOUCHED
+	* (a JPEG is already on disk), this one is an offer. The route answers 200
+	* with the image, or 204 with `x-camstack-reason` when it could not mint one
+	* — a surface latches that refusal to the instant rather than retrying.
+	*
+	* Never both: a clip with a vouched `thumbnail` needs no mint.
+	*/
+	thumbnailMint: string().optional(),
+	/**
+	* Why no still will be produced for this clip RIGHT NOW — set when the
+	* provider already knows, so the surface draws the glyph and the reason
+	* instead of firing a mint that cannot succeed.
+	*
+	* `sleeping` — a standalone battery camera; a read would be a wake (D549 4).
+	* `camera-refused` — the camera answered the CoverPreview with a refusal.
+	* `no-keyframe` — the window holds no decodable I-frame (an event that sits
+	*   inside no file is the measured case).
+	* `unsupported` — this source cannot mint stills at all.
+	*/
+	thumbnailUnavailable: object({ reason: _enum([
+		"sleeping",
+		"camera-refused",
+		"no-keyframe",
+		"unsupported"
+	]) }).optional(),
+	/**
+	* When the catalog this row came from was last CONFIRMED against the device.
+	* Absent means "this row was read live". A persisted catalog served while a
+	* camera sleeps carries the age it really has — a cached list is never drawn
+	* as current (D549 13).
+	*/
+	catalogAsOf: number().optional(),
+	/**
+	* The camera's OWN type strings for this clip, all of them, unmapped
+	* (`md`, `people`, `dog_cat`, `sched`, …). Kept beside {@link labels}
+	* because a firmware inventing a type must not vanish: the mapping into our
+	* filter vocabulary is lossy on purpose and this is the lossless copy
+	* (D549 20).
+	*/
+	nativeTypes: array(string()).optional(),
+	/**
+	* What the subject DID — `crossline`, `intrude`, `loitering`. A behaviour
+	* travels BESIDE a class, never instead of one, and the class filter ignores
+	* it: "a person crossed a line" is still a person (D549 20).
+	*/
+	behaviours: array(string()).optional(),
+	/**
+	* The same recording as two files — the sub twin (what the row and its
+	* thumbnail are) and its main twin, matched at listing time so a quality
+	* change never re-searches the camera (D549 15). `getClipPlayback`'s
+	* `profile` picks between them: `low | mid` → sub, `high` → main.
+	*/
+	streams: object({
+		sub: object({
+			id: string(),
+			bytes: number().optional()
+		}).optional(),
+		main: object({
+			id: string(),
+			bytes: number().optional()
+		}).optional()
+	}).optional(),
+	/** The camera says it holds a sub-stream copy of this recording. */
+	supportSub: boolean().optional(),
+	/**
+	* Whether this row has bytes behind it. ABSENT means yes — every clip that
+	* IS a file is playable, and only a source that lists EVENTS can produce a
+	* row with nothing to play (the measured case: 1 of 29 hub events on 3628
+	* fell inside no file). Such a row is shown, never dropped and never offered
+	* as playable-then-failing (D549 19).
+	*/
+	playable: boolean().optional(),
+	/** Why {@link playable} is false, verbatim (`no-file-for-window`). */
+	unplayableReason: string().optional(),
+	/**
+	* This clip is STILL BEING WRITTEN, so {@link ClipSchema.timeRange}`.endMs`
+	* is not its end.
+	*
+	* Absent — the common case — means the row is closed and its `endMs` is the
+	* end of the recording. Present and `true` means the source told us the file
+	* has no end yet, and the `endMs` we carry is whatever the camera's index
+	* entry happened to hold: on a Reolink E1 Outdoor PoE (592, measured
+	* 2026-09-20) the newest file `…_192927_000000_…_0.mp4` reported an `endTime`
+	* of 19:29:56 and STILL reported it eight minutes later, while the file went
+	* on growing. A surface that drew 29 s there was lying about a clip that
+	* plays for minutes, on the one row the operator looks at first.
+	*
+	* `endMs` is deliberately still a number: it is the best bound anything has
+	* for a mint window or a byte fetch, and every consumer already requires it.
+	* This flag says what it is WORTH, and a duration is not drawn from it.
+	*/
+	inProgress: boolean().optional()
 });
 var ClipPlaybackSchema = object({
-	/** HLS master URL through the hub data-plane (Range + token in path). */
+	/**
+	* A media URL through the hub data-plane. {@link ClipPlaybackSchema.format}
+	* says what kind — an HLS master playlist for a recording-derived clip, a
+	* progressive MP4 for a native file the vendor addon muxed and serves with
+	* `Range`. The URL is NOT a credential: both planes are registered
+	* `access: 'authenticated'` and the hub's `/addon/<id>/<prefix>` proxy takes
+	* the session cookie, so nothing is appended to it (D549 22).
+	*/
 	playbackUrl: string(),
+	/**
+	* How to play {@link playbackUrl}. Absent means `hls` — the shape every
+	* existing consumer already assumes. A player that branches on this is the
+	* one change a native clip needs; a player that ignores it will hand an MP4
+	* to hls.js and fail parsing it as a manifest.
+	*/
+	format: _enum(["hls", "mp4"]).optional(),
+	/**
+	* Which twin was actually served. A clip that holds only one stream answers
+	* with the one it has, and the surface SAYS so — a missing main twin is
+	* never served silently as if it were the asked-for quality (D549 15).
+	*/
+	served: CamProfileSchema.optional(),
 	/** Optional LAN/remote alternates for the same clip. */
 	playbackEndpoints: array(string()).optional(),
 	token: string().optional()
 });
+/**
+* Why a source cannot answer right now — per SOURCE, never fleet-wide.
+*
+* `ok` is the only state whose clip list may be read as complete. The other
+* three exist because an empty list from a sleeping camera reads as "this
+* camera has no recordings", which is the defect this whole line of work is
+* about: a battery camera nobody woke (`sleeping`), a camera that could not be
+* reached at all (`unreachable`, also what a provider that THREW reports), a
+* camera whose SD card is not mounted (`no-storage`, measured on 640 —
+* `HddInfo mount 0`, honestly nothing to list rather than "no clips"), and a
+* camera whose OWN index disagrees with its OWN calendar (`index-empty`,
+* measured on 618: the calendar marks 3–20 September, days 6–20 list zero
+* files on both streams and both filters, with 177 GB free). That last one is
+* a defect ON THE CAMERA, and the only honest thing a provider can do is say
+* which days it asked for and got nothing — "no clips" would be a lie about a
+* card that is full of them.
+*/
+/**
+* The operator's authorisation to WAKE a sleeping camera for one clip read.
+*
+* ONE value, absent by default, and it is a `force`-shaped operator signal in
+* exactly the sense `snapshot-wake-gate.ts` uses the word: *"`snapshot.getSnapshot`'s
+* `force` flag, and nothing else… a background caller must never set it…
+* Stale but honest beats woken"*. A scheduler, a retry, a reconcile and a
+* prefetch never set it; a surface sets it only behind the same confirm the
+* "Wake and refresh" gesture uses, and it is refused below 15 % battery
+* exactly as that gesture is.
+*
+* The gate is decided BEFORE `getApi()`, because on UDP the login IS the wake
+* (D549) — a read that opened a session and then checked would have woken the
+* camera to find out it was not allowed to.
+*
+* **One authorised yes is one wake.** `next-natural` — take the clip the next
+* time the camera is awake for its own reasons — is deliberately not a member:
+* it was proposed, it is free on the battery, and the operator declined it on
+* 2026-09-20 (*"Quando un export viene richiesto si sveglia la camera."*,
+* D558 "Considered and not taken").
+*/
+var ClipWakeSchema = _enum(["authorised"]);
+/**
+* A clip's finished bytes, inline — the twin of `recordingExport.readExportBytes`.
+*
+* `bytes` is the DECODED length, so nobody infers it from the base64 length,
+* and `served` says which twin the caller actually got.
+*/
+var ClipBytesSchema = object({
+	base64: string(),
+	contentType: string(),
+	/** Suggested filename, extension included. */
+	name: string(),
+	bytes: number().int().nonnegative(),
+	/**
+	* Which twin was actually served — the same contract
+	* {@link ClipPlaybackSchema.served} carries, and REQUIRED here because the
+	* export record persists it: a row read a week later must say the same thing
+	* the panel said at the moment of the tap. A missing main twin is never
+	* served silently as if it were the asked-for quality (D549 15).
+	*/
+	served: CamProfileSchema,
+	/**
+	* The DECODED duration of the delivered file, when the fetch measured one.
+	*
+	* A clip fetch verifies its own completion against the catalog row and
+	* retries a materially short pass (D568); this is that measurement, carried
+	* so a consumer can say the same thing rather than re-deriving it. Absent
+	* when the producer did not measure — never zero, which would say the file
+	* is empty.
+	*/
+	durationMs: number().positive().optional()
+});
+/**
+* Where a clip's STREAM can be dialled (D597) — the answer to
+* {@link videoclipsCapability.methods.dialClipStream}.
+*
+* `url` is plain `http://` on the provider's own token-gated listener, one
+* shot, short-lived. It is NOT the hub-proxied `/addon/<id>/clip-stream/…`
+* path: that plane takes only a user credential, which an addon does not
+* hold, and the framework offers no addon→addon byte transport — the one
+* precedent is the broker's own restream URLs (`getStreamWithCodec`), which
+* a consumer dials directly, and this is that precedent one addon over.
+*/
+/**
+* The audio a clip stream can be asked for, and the audio it carries.
+*
+* The camera stores AAC and no WebRTC session speaks it, so a stream that
+* carries sound carries it TRANSCODED, muxed as a second track beside the
+* video by the one ffmpeg the provider already runs (D600). `opus` is
+* 48 kHz mono, `pcmu` is 8 kHz µ-law — the two codecs a broker session
+* negotiates — and `none` is a stream asked for, or served, without sound.
+*/
+var ClipStreamAudioSchema = _enum([
+	"opus",
+	"pcmu",
+	"none"
+]);
+/**
+* Why a stream that was ASKED for sound is not carrying it (D600).
+*
+* Only ever set beside `servedAudio: 'none'` after a non-`none` ask. Absent
+* means the ask was honoured, or there was no ask.
+*
+* - `not-requested` — the caller asked for `none`.
+* - `unsupported-ask` — the provider cannot produce that codec.
+*
+* Whether the RECORDING has sound at all is not knowable here: the camera
+* declares no audio track before its first frame arrives. That answer is in
+* the stream itself — an fMP4 with no audio track — and the broker reads it
+* there. A dial that says `opus` promises the codec, never the content.
+*/
+var ClipStreamAudioReasonSchema = _enum(["not-requested", "unsupported-ask"]);
+var ClipStreamDialSchema = object({
+	url: string().min(1),
+	/** After this the token is gone and the URL answers 404 `dial-expired`. */
+	expiresAtMs: number(),
+	/** What the stream IS — a consumer that cannot honour it must not dial. */
+	transport: literal("forward-only"),
+	/**
+	* Which twin the stream ACTUALLY carries — not what was asked for.
+	*
+	* The stream serves every profile (D599), and a recording whose main twin
+	* does not exist is streamed as its sub copy, which this field reports as
+	* `low`. That is the whole reason the dial no longer refuses `high`:
+	* stating what was served is what makes accepting honest, where a silent
+	* substitution would be the 33x lie D576 forbids. Stated rather than
+	* assumed, the way {@link ClipPlaybackSchema.served} is (D549 15).
+	*/
+	served: CamProfileSchema,
+	/**
+	* Which audio the stream will ACTUALLY carry — `served`'s companion for
+	* sound, and the same reasoning (D599, D600).
+	*
+	* The broker asks for the codec its WebRTC session negotiated, and the
+	* provider either muxes that codec or carries none. Stating it is what
+	* lets the broker wire the matching sink before the first byte, and what
+	* keeps a session from being handed a codec it cannot send — the audio
+	* shape of the substitution `served` exists to prevent.
+	*
+	* It is a promise about the CODEC, not about the content: a recording with
+	* no microphone track answers `opus` here and then arrives with no audio
+	* track at all. That second answer is in the stream, and the broker reads
+	* it from the `moov`.
+	*/
+	servedAudio: ClipStreamAudioSchema,
+	/** Why `servedAudio` is `none` although sound was asked for. */
+	audioReason: ClipStreamAudioReasonSchema.optional()
+});
+var ClipSourceAvailabilitySchema = object({
+	state: _enum([
+		"ok",
+		"sleeping",
+		"unreachable",
+		"no-storage",
+		"index-empty"
+	]),
+	/** Free text, shown verbatim. Names the camera's own refusal when there is one. */
+	reason: string().optional(),
+	/** When this source's catalog was last CONFIRMED. A cached list is never
+	*  drawn as current: the surface shows the age whenever it is older than the
+	*  refresh interval. */
+	catalogAsOf: number().optional()
+});
+/**
+* One SOURCE of clips for a camera — a row of the picker, and the namespace
+* every clip id from it is prefixed with (`analytics`,
+* `native:reolink:onboard`, `hksv`, …).
+*
+* A provider lists the sources IT serves for that device, and answers for each
+* of them whether it can answer at all. A provider with nothing to offer on a
+* camera returns `[]` — it is not that camera's business.
+*/
+var ClipSourceSchema = object({
+	/** The value this source stamps on {@link ClipSchema.source}, and the prefix
+	*  of every clip id it mints. `getClipPlayback` routes on it. */
+	source: string(),
+	/** Operator-facing name of the source ("CamStack recordings", "SD card"). */
+	label: string(),
+	/**
+	* The addon that SERVES this row.
+	*
+	* A surface cannot otherwise resolve a source to who answers it, and the
+	* alternative — a `native:reolink:* → provider-reolink` table inside the
+	* widget — is a second authority on provider identity living in the one
+	* package with no business knowing it, wrong the day a third source appears
+	* (D557). One addon may serve SEVERAL sources, which is why the per-device
+	* switch is keyed by SOURCE and not by this (D555) — `addon-provider-reolink`
+	* served a hub child two of them until the two views were measured to be one
+	* store read twice (D555) and then read ONE way (D565).
+	*
+	* Optional for version skew only. The collection dispatcher stamps it from
+	* the registry, so a row that travelled through the fan-out carries the
+	* authoritative id whatever the provider filled in.
+	*/
+	addonId: string().optional(),
+	availability: ClipSourceAvailabilitySchema
+});
 DeviceType.Camera, method(object({
 	deviceId: number(),
 	since: number(),
 	until: number(),
-	limit: number().int().positive().optional()
+	limit: number().int().positive().optional(),
+	/**
+	* WHICH provider to ask — the `addonId` a {@link ClipSourceSchema} row
+	* carries, never a source id and never a list. **Required** (D554 amended).
+	*
+	* A provider the device is not bound to is refused by name rather than
+	* answered by another one (D552's `rejectUnresolvedAddonPin` rule).
+	*
+	* It was optional, documented as "absent means the device's BOUND
+	* provider, which is CamStack on every camera". No code implemented
+	* that. Measured on the live hub 2026-09-20 — device 592, bound to
+	* `recorder` AND `provider-reolink` — a bare call with `limit: 3`
+	* answered SIX rows, three from each source, merged newest-first:
+	* `device-collection-dispatch.ts` simply left the fan-out un-narrowed,
+	* so absence bought the union this method exists not to be, and
+	* `limit` meant `limit × sources`.
+	*
+	* There is nothing to restore the default to. `getBindings` answers a
+	* collection cap with a DERIVED, PLURAL set (D554 amended, step 0);
+	* `setWrapperActive` — the singleton authority that could name one —
+	* throws for a collection cap by design. Naming CamStack here instead
+	* would privilege one addon by id inside a surface whose premise is
+	* that sources are peers, and would be wrong on the first camera with
+	* no recorder binding. So absence is REFUSED, in the schema, where the
+	* generated types make it unomittable rather than merely discouraged.
+	*
+	* The default belongs to the SURFACE, which has the `listSources` rows
+	* and can say which one it picked (D569 § 1–3; the viewer already
+	* always sends this).
+	*
+	* It replaced `sources?: string[]`, a VIEW filter over source ids that
+	* assumed the answer was a fan-out over everything a camera has. The
+	* operator settled otherwise on 2026-09-20 — *"l'utilizzatore è uno
+	* solo"* — so the list is asked of one provider at a time and there is
+	* nothing to filter out of it.
+	*/
+	provider: string().min(1)
 }), array(ClipSchema).readonly(), {
 	kind: "query",
-	auth: "admin"
+	auth: "protected"
+}), method(object({ deviceId: number() }), array(ClipSourceSchema).readonly(), {
+	kind: "query",
+	auth: "protected"
 }), method(object({
 	deviceId: number(),
-	clipId: string()
+	clipId: string(),
+	/**
+	* Which twin to serve, on the ONE quality scale the system already has
+	* (`CamProfileSchema`). `low | mid` → the sub file, `high` → the main
+	* twin; both ids are already on the row so this never re-searches the
+	* camera. Absent means the provider's own default (the sub file, which
+	* every source is measured to hold).
+	*
+	* `auto` is deliberately NOT accepted here: a stored file has no
+	* broker session, so the adaptive tier cannot be resolved for it. The
+	* viewer resolves `auto` to a profile the same way live does, before
+	* it calls (D549 15).
+	*/
+	profile: CamProfileSchema.optional()
 }), ClipPlaybackSchema, {
 	kind: "query",
-	auth: "admin"
+	auth: "protected"
+}), optionalMethod(object({
+	deviceId: number(),
+	clipId: string().min(1),
+	/**
+	* WHICH provider holds the bytes — the `addonId` a
+	* {@link ClipSourceSchema} row carries. **Required**, for the reason
+	* `listClips` states one method above and for a second one this method
+	* learned the hard way.
+	*
+	* The caller is the stream broker, and the broker lives in
+	* `addon-pipeline` — the same addon that registers the RECORDER's
+	* videoclips provider. With no provider named, the in-process
+	* resolution handed it its own sibling, which implements this method
+	* solely to explain that an analytics visit has no file behind it. So
+	* every onboard clip answered with that sentence, a flash of video and
+	* nothing more, while the SAME call from outside the addon reached the
+	* right provider and returned the bytes (measured on 3628,
+	* 2026-09-21).
+	*/
+	provider: string().min(1),
+	/**
+	* Which twin to fetch, on the mapping D549 15 already fixed:
+	* `low | mid` → the sub file, `high` → the main twin. `auto` is not
+	* accepted here for the same reason it is not accepted by
+	* `getClipPlayback` — a stored file has no broker session, so the
+	* adaptive tier cannot be resolved for it.
+	*/
+	profile: CamProfileSchema.optional(),
+	/**
+	* The CALLER's byte bound, so an over-size clip is refused before it is
+	* read and encoded rather than after. Capped by
+	* {@link VIDEOCLIPS_MAX_READ_BYTES} whatever is passed; absent means
+	* that ceiling.
+	*/
+	maxBytes: number().int().positive().optional(),
+	/**
+	* The operator's authorisation to wake a sleeping camera for this
+	* read. Absent — the default — means a sleeping standalone battery
+	* camera is REFUSED by name, before any session is opened.
+	*/
+	wake: ClipWakeSchema.optional()
+}), ClipBytesSchema, {
+	kind: "query",
+	auth: "protected"
+}), optionalMethod(object({
+	deviceId: number(),
+	clipId: string().min(1),
+	/** WHICH provider holds the camera — see `readClipBytes.provider`. */
+	provider: string().min(1),
+	/** Which twin — `high` → the main file, everything else the sub (D599). */
+	profile: CamProfileSchema.optional(),
+	/**
+	* Which audio codec the caller's session negotiated, so the provider
+	* can mux it (D600). The ask travels on the DIAL because the mux is
+	* spawned once, before the first byte, and cannot gain a track later.
+	*
+	* ABSENT IS `none`, never a guess: a caller that does not state an
+	* ask is served the video-only stream that shipped first, so a broker
+	* older than this field keeps working unchanged (D382 — an unstated
+	* ask is zero).
+	*/
+	audio: ClipStreamAudioSchema.optional()
+}), ClipStreamDialSchema, {
+	kind: "query",
+	auth: "protected"
 });
 /**
 * Optional client-side hints sent at session creation to help the provider
@@ -25389,6 +26183,104 @@ var WebrtcStreamChoiceSchema = object({
 	/** Bitrate in kbps (null for adaptive). */
 	bitrateKbps: number().nullable()
 });
+/**
+* The last move the adaptive ladder made on this session, and the numbers it
+* rested on. Mirrors `LadderDecision` in the stream-broker's
+* `adaptive-controller.ts` — the log line's evidence, made readable.
+*
+* Nullability is load-bearing: `lossRatio: null` means the loss tracker had
+* no window to report, which is NOT a link with zero loss.
+*/
+var WebrtcLadderDecisionSchema = object({
+	/** `loss` — RTCP / client-reported packet loss; `stall` — the picture
+	*  stopped moving; `healthy` — a promotion. */
+	cause: _enum([
+		"loss",
+		"stall",
+		"healthy"
+	]),
+	/** The rung the ladder moved TO. Null for a move that changed no rung
+	*  (an MTU reduction, a forced transcode-down at the bottom). */
+	tier: CamProfileSchema.nullable(),
+	/** Whether that move forced the egress transcode-down rung. */
+	forcedTranscodeDown: boolean(),
+	/** Loss ratio over the tracker's window at the moment of the decision. */
+	lossRatio: number().nullable(),
+	/** The client's reported downlink at that moment, in kbps. */
+	clientKbps: number().nullable(),
+	/** How long the stall detector had been seeing nothing arrive. */
+	stalledForMs: number().nullable(),
+	/** Whether the broker WAS sending while that was measured — the half that
+	*  separates "the camera stopped" from "the link stopped". */
+	serverSending: boolean().nullable(),
+	/** Epoch ms. The overlay prints its age; a decision from 40 minutes ago
+	*  must not read like one from this second. */
+	at: number()
+});
+/** Per-tier count of MEASURED downgrades this viewer session has suffered. */
+var WebrtcTierFailureSchema = object({
+	tier: CamProfileSchema,
+	failures: number().int().nonnegative()
+});
+/**
+* What the SERVER decided for one WebRTC session — the half the client cannot
+* measure. See `getSessionDebug`.
+*/
+var WebrtcSessionDebugSchema = object({
+	sessionId: string(),
+	/** Whether the session still exists here. Everything below is null when
+	*  it does not — a dead session has no measurements, not zero ones. */
+	alive: boolean(),
+	/** Epoch ms this snapshot was taken, so the overlay can show its age. */
+	observedAt: number(),
+	/** The broker actually feeding this session (`<deviceId>/<camStreamId>`). */
+	brokerId: string().nullable(),
+	camStreamId: string().nullable(),
+	/** `derived` = this hub BUILT the rung being served (a transcode/scale of
+	*  another stream); `native` = the camera's own encode. */
+	sourceKind: _enum([
+		"native",
+		"derived",
+		"unknown"
+	]),
+	/** Whether the ladder is running at all (an `adaptive` target). */
+	adaptive: boolean(),
+	/** The rung `auto` ACTUALLY resolved to right now. Null when the broker
+	*  is bound to no profile slot (a manually-activated stream). */
+	servedTier: CamProfileSchema.nullable(),
+	/** Which node ingests the source. Null when unresolved. */
+	ingestNodeId: string().nullable(),
+	/** Whether that node is a remote one (the media crosses a node boundary
+	*  before it reaches this session). Null when unresolved. */
+	ingestIsRemote: boolean().nullable(),
+	/** Codec off the source, and the one negotiated with this client. */
+	sourceCodec: string().nullable(),
+	negotiatedCodec: string().nullable(),
+	/** Whether the EGRESS leg re-encodes for this client or forwards the
+	*  source bytes untouched. */
+	egressLeg: _enum([
+		"copy",
+		"transcode",
+		"unknown"
+	]),
+	/** What the broker itself reports about the rung it is serving. */
+	brokerStatus: string().nullable(),
+	brokerCodec: string().nullable(),
+	brokerBitrateKbps: number().nullable(),
+	brokerInputFps: number().nullable(),
+	brokerUptimeMs: number().nullable(),
+	/** RTP packets this session has sent — the server's own "am I sending?". */
+	rtpPacketsSent: number().nullable(),
+	/** D42: the track may be carrying the recorded feeder, not live. The ladder
+	*  is suspended there, so a frozen picture in `recorded` mode means
+	*  something entirely different. */
+	trackMode: _enum(["live", "recorded"]).nullable(),
+	lastDecision: WebrtcLadderDecisionSchema.nullable(),
+	tierFailures: array(WebrtcTierFailureSchema),
+	/** Successful promotions in this viewer session (drives the progressive
+	*  healthy timer). Null when no ladder is running. */
+	upgradeCount: number().nullable()
+});
 DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), array(WebrtcStreamChoiceSchema)), method(object({
 	deviceId: number().int().nonnegative(),
 	target: WebrtcStreamTargetSchema,
@@ -25553,7 +26445,10 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	* the same answer as "it ended": either way nothing is holding it up.
 	*/
 	alive: boolean()
-}));
+})), method(object({
+	deviceId: number().int().nonnegative(),
+	sessionId: string()
+}), WebrtcSessionDebugSchema, { kind: "query" });
 object({
 	/** All accessory children of the parent. */
 	childDeviceIds: array(number()).readonly(),
@@ -27379,6 +28274,346 @@ var dayNightCapability = {
 	volatileStateFields: ["lastFetchedAt"]
 };
 /**
+* Vendor-neutral **onboard** recording + storage cap — what the CAMERA
+* writes to the CAMERA's own card, on the camera's own schedule.
+*
+* This is NOT `recording.cap.ts`. That one is CamStack's recorder: our
+* footage ledger, our storage locations, our retention. This one has a
+* different authority — the camera's firmware — and per D62 it stores
+* nothing of its own. Every value here is read from the camera and every
+* write goes back to the camera; there is no CamStack-side mirror that
+* could disagree with the device.
+*
+* ## One shape, two firmwares
+*
+* Measured 2026-09-22 against the live fleet:
+*
+* | fact | Hikvision (ISAPI) | Reolink (Baichuan) |
+* | --- | --- | --- |
+* | storage | `ContentMgmt/Storage` `<hdd>` rows: status, capacity, freeSpace (MB) | `getHddInfoList` (cmd 102): `mount`, `format`, `capacity` GB + `capacityM` MB remainder |
+* | tracks | several (101 **and** 103 on both 1436 and 3833), each with its own schedule | one per channel |
+* | schedule | per track, 7 `ScheduleAction` blocks: DayOfWeek + TimeOfDay range + ONE `ActionRecordingMode` | per trigger type, a 168-char weekly HOUR mask |
+* | triggers | `CMR`, `MOTION` | `Normal`, `MD`, `people`, `vehicle`, `dog_cat`, `crossline`, `intrude`, `loitering` |
+* | pre-record | `PreRecordTimeSeconds` | `preRecordTime` |
+* | post-record | `PostRecordTimeSeconds` | `recordDelayTime` |
+* | overwrite | per track `LoopEnable` | `cycle`, with `cycleList` enumerating the accepted values |
+* | segment length | not exposed on V5.7.1 | `packageTime` (minutes) |
+*
+* The two schedule models look different and are the same thing in
+* different coordinates: both answer "for this trigger, during which
+* weekly windows does the camera record". {@link RecordWindow} is that
+* question in one shape — Hikvision's ranges map straight onto it,
+* Reolink's mask expands into hour-aligned windows.
+*
+* ## Union, not intersection
+*
+* **The same fields exist on every camera.** What differs per device is
+* which VALUES that device accepts, and that is what {@link
+* RecordingOnboardOptions} reports — a `{ readable, writable, reason }`
+* per field plus the schedule's own limits. A control a camera cannot
+* honour is rendered DISABLED WITH ITS REASON, never missing and never
+* dead: disabled must not look like broken.
+*
+* ## Refusal by name
+*
+* A write a camera cannot honour is refused with a sentence the operator
+* can read — never accepted and dropped. Both providers refuse through
+* {@link describeOnboardRefusal}, so the vocabulary is one function and
+* one test, not two hand-written vendor opinions.
+*
+* Follows the D14 `deviceConfig` archetype (see `stream-params.cap.ts`):
+* `getOptions` advertises per-camera availability, `getStatus` (auto-
+* injected from `status`) reports the live values, and a single
+* `setSettings` mutation applies a partial change. No hand-written
+* settings-contribution methods.
+*/
+/**
+* What makes the camera start recording during a window.
+*
+* The union of both vendors' vocabularies. `continuous` is Hikvision's
+* `CMR` and Reolink's `Normal`; `motion` is `MOTION` / `MD`. The
+* object-class triggers are Reolink-only today and the smart-event ones
+* (`lineCrossing`, `intrusion`, `loitering`) are Reolink-only on the
+* firmwares measured — a camera that cannot record on a trigger simply
+* does not list it in `options.schedule.triggers`, and a window naming
+* it is REFUSED, not dropped.
+*/
+var RecordTriggerSchema = _enum([
+	"continuous",
+	"motion",
+	"person",
+	"vehicle",
+	"animal",
+	"lineCrossing",
+	"intrusion",
+	"loitering",
+	"alarmInput"
+]);
+/**
+* One weekly recording window: "on `day`, from `startMinute` to
+* `endMinute`, record on `trigger`".
+*
+* `day` is 0 = Monday … 6 = Sunday (ISO order, which is also the order
+* both firmwares enumerate). Minutes are local camera time since
+* midnight; `endMinute` may be 1440, meaning end of day — that is
+* Hikvision's literal `24:00` and Reolink's 24th mask slot, and
+* collapsing it to 0 would turn a whole-day window into an empty one.
+*/
+var RecordWindowSchema = object({
+	trigger: RecordTriggerSchema,
+	day: number().int().min(0).max(6),
+	startMinute: number().int().min(0).max(1439),
+	endMinute: number().int().min(1).max(1440)
+});
+/** Status of one physical volume, as the camera itself describes it. */
+var OnboardStorageVolumeSchema = object({
+	/** The camera's own id for the volume (`hdd/id`, Reolink `HddInfo/number`). */
+	id: string(),
+	/** The camera's own name for it, when it gives one (`hddName`). */
+	label: string().optional(),
+	status: _enum([
+		"ok",
+		"unformatted",
+		"error",
+		"offline",
+		"unknown"
+	]),
+	/**
+	* Total size in MB, or **null when the camera did not say**.
+	*
+	* Never 0 for an unreadable value: a measurement that failed is not a
+	* measurement (D393), and a card whose size is unknown must not be
+	* rendered as a card of size zero.
+	*/
+	capacityMb: number().nullable(),
+	/**
+	* Free space in MB, or null when unknown.
+	*
+	* **Not a proxy for "has footage".** Measured 2026-09-22: 1436 and
+	* 1439 both report exactly 11776 MB free — the fixed reserve a looping
+	* card converges on once it has wrapped. At loop steady state the
+	* number is identical whether the camera recorded yesterday or stopped
+	* a month ago.
+	*/
+	freeMb: number().nullable(),
+	/** True when the camera reports the volume writable (`property` RW). */
+	writable: boolean().optional()
+});
+/**
+* What the camera is doing with its own storage, right now.
+*
+* Every scalar is nullable and **null means the camera did not answer**,
+* never a default. A form that seeds `0` from an unanswered read invites
+* the operator to save that 0 back onto the camera.
+*/
+var RecordingOnboardStatusSchema = object({
+	storage: discriminatedUnion("kind", [
+		object({
+			kind: literal("present"),
+			volumes: array(OnboardStorageVolumeSchema)
+		}),
+		object({
+			kind: literal("absent"),
+			reason: string()
+		}),
+		object({
+			kind: literal("unknown"),
+			reason: string()
+		})
+	]),
+	tracks: array(object({
+		id: string(),
+		enabled: boolean(),
+		isVideo: boolean(),
+		/** From the camera's own track description. Null when it does not say. */
+		codec: string().nullable(),
+		resolution: string().nullable(),
+		/** Per-track overwrite flag, where the firmware keeps it per track. */
+		overwriteWhenFull: boolean().nullable()
+	})),
+	/**
+	* The track the write path targets — the enabled VIDEO one. Null when
+	* no track could be identified, which is itself a refusal reason.
+	*/
+	primaryTrackId: string().nullable(),
+	/** Master "record to the card at all" switch. */
+	enabled: boolean().nullable(),
+	overwriteWhenFull: boolean().nullable(),
+	preRecordSec: number().nullable(),
+	postRecordSec: number().nullable(),
+	/** Length of one recorded file, in minutes. */
+	segmentMinutes: number().nullable(),
+	/** The primary track's weekly windows, flattened. */
+	windows: array(RecordWindowSchema),
+	/**
+	* How many windows the camera described that CamStack could NOT read —
+	* an unrecognised trigger, an unparseable clock, a weekday it does not
+	* name.
+	*
+	* A dropped window is work the reader threw away, and a schedule that
+	* silently shows fewer rows than the camera holds is how an operator
+	* saves back a schedule shorter than the one they were looking at
+	* (D391). Non-zero means the window list is INCOMPLETE and a write
+	* that replaces it would delete what was not shown — which is why a
+	* provider reporting a non-zero count also reports the schedule as not
+	* writable.
+	*/
+	unreadableWindows: number(),
+	/**
+	* The camera is scheduled to record and has NO usable storage.
+	*
+	* A first-class fact because it is the fleet's most common silent
+	* defect: measured 2026-09-22, 1441 and 3831 are both motion-recording
+	* to a card that is not there. Neither the schedule nor the storage
+	* read says anything wrong on its own; only the pair does.
+	*/
+	recordingToNowhere: boolean(),
+	lastFetchedAt: number()
+});
+/** Numeric range descriptor — `{ min, max, step }` per the getOptions convention. */
+var RangeSchema = object({
+	min: number(),
+	max: number(),
+	step: number()
+});
+/**
+* The values a camera actually takes for a numeric field, when they are a SET
+* rather than a range.
+*
+* `{min,max,step}` cannot say what these two firmwares do. Measured on 1436
+* (I91DN) on 2026-09-22 by writing each value and reading it back:
+*
+* - pre-record: `0, 5, 10, 15, 20, 25, 30` and `2147483647` (INT32_MAX, the
+*   camera's "no limit" — `-1` and `4294967295` both land on it);
+* - post-record: `5, 10, 30, 60, 120, 300, 600`.
+*
+* Neither is expressible as a step: the first has a sentinel two billion away
+* from its neighbours, the second doubles and then jumps. A range that tried
+* would forbid values the camera takes AND permit values it silently replaces
+* with 5 — wrong in both directions at once.
+*
+* `sentinel` names the member that is not a duration, so a surface can render
+* "no limit" instead of `2147483647` seconds.
+*/
+var AllowedValuesSchema = object({
+	values: array(number()).min(1),
+	sentinel: object({
+		value: number(),
+		meaning: _enum(["no-limit", "disabled"])
+	}).optional()
+});
+/**
+* Per-field availability on ONE camera.
+*
+* The field exists on every camera — this says whether this one can be
+* read and whether it can be written, and `reason` says why not when
+* either is false. The UI renders the control DISABLED with the reason
+* rather than hiding it, so a limitation is legible instead of looking
+* like a missing feature.
+*/
+var OnboardFieldSupportSchema = object({
+	readable: boolean(),
+	writable: boolean(),
+	/** Required whenever `readable` or `writable` is false. */
+	reason: string().optional()
+});
+/** What this camera's schedule model can express. */
+var OnboardScheduleSupportSchema = object({
+	support: OnboardFieldSupportSchema,
+	/**
+	* The smallest time step the camera can express, in minutes.
+	*
+	* Hikvision takes arbitrary minutes (`00:05:00`–`23:57:00` observed on
+	* 1436's track 103). Reolink's schedule is a 7×24 HOUR mask, so 60. A
+	* window whose edges are not a multiple of this is REFUSED rather than
+	* quietly rounded — rounding is how an operator's 06:30 becomes 06:00
+	* and nothing says so.
+	*/
+	granularityMinutes: number(),
+	/** Triggers this camera can record on. A window naming another is refused. */
+	triggers: array(RecordTriggerSchema),
+	/**
+	* False when the camera stores ONE trigger per time range, so two
+	* windows overlapping on the same day cannot carry different triggers.
+	* True on Reolink, whose mask is per-trigger and independent.
+	*/
+	supportsOverlappingTriggers: boolean()
+});
+var RecordingOnboardOptionsSchema = object({
+	enabled: OnboardFieldSupportSchema,
+	overwriteWhenFull: OnboardFieldSupportSchema,
+	preRecordSec: OnboardFieldSupportSchema,
+	preRecordSecRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	preRecordSecAllowed: AllowedValuesSchema.optional(),
+	postRecordSec: OnboardFieldSupportSchema,
+	postRecordSecRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	postRecordSecAllowed: AllowedValuesSchema.optional(),
+	segmentMinutes: OnboardFieldSupportSchema,
+	segmentMinutesRange: RangeSchema.optional(),
+	/** Preferred over the range when the camera takes a SET, not a span. */
+	segmentMinutesAllowed: AllowedValuesSchema.optional(),
+	schedule: OnboardScheduleSupportSchema
+});
+/**
+* A partial change. Every field optional.
+*
+* Unlike the other `deviceConfig` caps, a provider here does **NOT**
+* silently ignore a field it cannot support — it refuses, by name,
+* through {@link describeOnboardRefusal}. Silence on a recording setting
+* is the failure D62 exists to prevent: the operator believes the camera
+* is recording the way the form says, and it is not.
+*/
+var RecordingOnboardPatchSchema = object({
+	enabled: boolean().optional(),
+	overwriteWhenFull: boolean().optional(),
+	preRecordSec: number().optional(),
+	postRecordSec: number().optional(),
+	segmentMinutes: number().optional(),
+	/** The complete new window set for the primary track — not a delta. */
+	windows: array(RecordWindowSchema).optional()
+});
+var recordingOnboardCapability = {
+	name: "recording-onboard",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	deviceConfig: { ui: {
+		kind: "derived-form",
+		builderId: "recording-onboard",
+		tab: "recording"
+	} },
+	methods: {
+		getOptions: method(object({ deviceId: number() }), RecordingOnboardOptionsSchema),
+		setSettings: method(object({
+			deviceId: number(),
+			settings: RecordingOnboardPatchSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: RecordingOnboardStatusSchema,
+		kind: "poll"
+	},
+	runtimeState: RecordingOnboardStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set camera-side
+	* recording config; mutation-driven, and the storage half is the last
+	* thing the camera said about its own card.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
+};
+/**
 * Generic device-level status snapshot. Auto-registered by `BaseDevice`
 * for every device, regardless of provider — the kernel needs a uniform
 * cap-keyed slice for the basic device flags every consumer expects to
@@ -29888,11 +31123,15 @@ var motionTriggerCapability = {
 *
 * Adding a fifth name to that list would have been the wrong fix twice over:
 * that page is per-camera DETECTION tuning, and a grid's geometry belongs
-* beside PTZ and motion zones on the camera itself — which is exactly where the
-* framework already puts a widget, when the widget is declared on a CAPABILITY.
-* `deviceConfig.ui` is the mechanism (`motion-zones`, `ptz`, `ptz-autotrack`
-* all use it): the framework emits the structural section and the widget
-* self-persists through the cap's own mutations.
+* beside PTZ and motion zones on the camera itself. The device page is
+* BINDING-driven (D12), so the way in is a capability bound to the device —
+* and this cap carries its section the way `recording` does, by RETURNING it
+* from `getDeviceSettingsContribution`.
+*
+* Seven other widgets are still declared the other way, through a
+* `deviceConfig.ui` block the framework derives a section from. That route
+* gives the addon no say in where its own panel lands and no way to decline
+* for a device the panel does not suit, which is why this one does not use it.
 *
 * ## Why one addon may implement it
 *
@@ -29948,16 +31187,37 @@ var GridProfileOfferSchema = object({
 	]),
 	offered: boolean(),
 	/** Sources that cannot serve it. Empty when it is offered, or when there are no cells. */
-	missingSources: array(number().int().positive())
+	missingSources: array(number().int().positive()),
+	/**
+	* The canvas this profile composes onto, `WxH`, or empty when it is not
+	* offered. DERIVED from the cells and the sources' own size at this profile —
+	* it is reported because nothing else in the system would ever say what the
+	* grid came out as, and because it is the number an operator would otherwise
+	* expect to type.
+	*/
+	canvas: string(),
+	/**
+	* Whether this profile is PUBLISHED, of the ones the grid could serve.
+	*
+	* A grid's `high` is composed of its sources' `high`, so on a 4K fleet it is
+	* a 4K canvas built from 4K decodes — something to opt into, not something a
+	* viewer's adaptive should be handed by climbing to the top rung it can see.
+	* Default is `mid` + `low`.
+	*/
+	published: boolean()
 });
 var GridLayoutViewSchema = object({
 	/** The persisted grid row this camera was declared from. */
 	instanceId: string(),
 	deviceId: number().int().nonnegative(),
 	name: string(),
-	/** The canvas the operator laid out — this grid's `high`. mid/low are scaled from it. */
-	width: number().int(),
-	height: number().int(),
+	/**
+	* NO canvas size. A grid's resolution is not authored: each profile derives
+	* its own from the cells and its sources' dimensions. The two numbers that
+	* used to be here were a text field that silently decided both how much the
+	* composite cost and how sharp it was — see `profiles[].canvas` for what it
+	* came out as.
+	*/
 	fps: number().int(),
 	cells: array(GridLayoutCellSchema),
 	/** What the catalog will publish, and what it refuses to. Read-only. */
@@ -29966,9 +31226,13 @@ var GridLayoutViewSchema = object({
 var GridLayoutPatchSchema = object({
 	deviceId: number().int().nonnegative(),
 	name: string().min(1).max(160).optional(),
-	width: number().int().min(160).max(7680).optional(),
-	height: number().int().min(120).max(4320).optional(),
 	fps: number().int().min(1).max(60).optional(),
+	/** Which profiles to publish. See `GridProfileOffer.published`. */
+	publishedProfiles: array(_enum([
+		"high",
+		"mid",
+		"low"
+	])).max(3).optional(),
 	/**
 	* The whole cell list at once. A per-cell patch would need an ordering the
 	* editor does not have, and a half-applied layout is a picture nobody asked
@@ -32251,6 +33515,25 @@ var ptzAutotrackCapability = {
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
+	/**
+	* Two kinds of provider behind one name, the same shape `snapshot` and
+	* `doorbell` use:
+	*
+	*  - **Native**: the camera's own firmware autotrack, registered per device by
+	*    the driver when the probe says it exists (Reolink: yes; Hikvision:
+	*    model-dependent).
+	*  - **Wrapper**: the emulated implementation (`@camstack/system`'s `autotrack` builtin),
+	*    which follows a subject with `ptz.move` pulses driven by the detection
+	*    pipeline. `defaultActive: false` — the operator binds it per camera in
+	*    the bindings UI, exactly as `virtual-doorbell` is bound.
+	*
+	* The binding chooses WHICH implementation answers; `setEnabled` stays the
+	* one switch for the function either way. A camera never has both driving its
+	* head, which is the whole reason this is not a second cap with a second
+	* toggle (D62, D520).
+	*/
+	kind: "wrapper",
+	defaultActive: false,
 	deviceTypes: [DeviceType.Camera],
 	deviceConfig: { ui: {
 		kind: "widget",
@@ -32733,7 +34016,7 @@ method(object({
 	auth: "admin"
 }), method(object({ deviceId: number() }), RecordingConfigSchema, {
 	kind: "query",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number(),
 	profile: string(),
@@ -32963,13 +34246,101 @@ var ExportStateSchema = _enum([
 	"expired",
 	"deleted"
 ]);
-/** One export job / history row. */
+/**
+* WHAT an export is — the authority, as opposed to the four top-level fields
+* the Library sorts and labels on (D558 § 2.2).
+*
+* Read it through {@link exportSubjectOf}, never off the record directly: the
+* field is optional for the history rows written before it existed, and that
+* absence has exactly one interpreter.
+*/
+var ExportSubjectSchema = discriminatedUnion("kind", [object({
+	kind: literal("footage"),
+	deviceId: number(),
+	profiles: array(string()).min(1),
+	fromMs: number(),
+	toMs: number()
+}), object({
+	kind: literal("clip"),
+	deviceId: number(),
+	provider: string().min(1),
+	source: string().min(1),
+	sourceLabel: string().min(1),
+	clipId: string().min(1),
+	/**
+	* WHERE IN THE CATALOG to confirm this clip — the day window the surface was
+	* already listing when the operator picked the segment.
+	*
+	* It is **not** a time range control and it never becomes one: the record's
+	* `fromMs`/`toMs` come from the catalog ROW and from nothing a caller
+	* supplied (D558 § 5.4.3), and a window that does not contain the clip is a
+	* `catalog-miss`, not a silently wider search. It exists because
+	* `videoclips.listClips` takes `since`/`until` and has no by-handle twin:
+	* the catalog check D558 asks for is literally that call, and a call needs a
+	* window. The surface has one — `ClipsBrowser`'s `dayWindow`, one local
+	* wall-clock day, which is also the only width measured to be cheap (one
+	* day on 592 lists 171 clips in 712 ms, a busy day 546 in 2.0 s; twenty days
+	* of one child's events took 3.6–5.4 s).
+	*/
+	catalogWindow: object({
+		sinceMs: number(),
+		untilMs: number()
+	}),
+	profile: _enum([
+		"high",
+		"mid",
+		"low"
+	]),
+	/**
+	* The operator's authorisation to wake a sleeping camera for this export.
+	* ONE definition, in the cap that owns the clip read ({@link ClipWakeSchema}),
+	* because the gate that honours it is the clip provider's sleep gate — a
+	* second enum here would be a second contract. Absent by default; never
+	* settable by a scheduler or a retry.
+	*
+	* **One authorised yes is ONE wake.** A failed clip export is retried only by
+	* an operator act that asks again; a queued job that outlived its wake fails
+	* with a reason rather than waking on its turn; and this subject carries
+	* exactly one profile precisely so one tap is never two fetches (D558 § 5.2).
+	*/
+	wake: ClipWakeSchema.optional()
+})]);
+/**
+* One export job / history row.
+*
+* **`subject` is the AUTHORITY on what was exported. `deviceId`, `profile`,
+* `fromMs` and `toMs` are its PROJECTION** — kept top-level because the whole
+* Library sorts and labels on them (`library-items.ts` orders an export by
+* `fromMs`; `export-format.ts` draws `rangeLabel` from the pair), and a row
+* that did not fill them would sort under the epoch and render a blank range.
+* Write to the subject and read from the projection and the two will disagree;
+* the projection is derived at creation and never edited afterwards.
+*
+* And they mean DIFFERENT FACTS for the two kinds, which is the part a reader
+* who knows only the recording export will get wrong:
+*
+* | field | `kind:'footage'` | `kind:'clip'` |
+* | --- | --- | --- |
+* | `fromMs`/`toMs` | the stretch the operator ASKED for | the camera's own boundaries, always `clip.timeRange`, never anything a caller supplied |
+* | `profile` | the stream rendered | the twin actually SERVED (`subject.profile` is the one asked for) |
+*
+* Same type, different fact — the shape this repo keeps getting wrong (D385's
+* two authorities, D224's second copy).
+*/
 var ExportRecordSchema = object({
 	id: string(),
 	deviceId: number(),
 	profile: string(),
 	fromMs: number(),
 	toMs: number(),
+	/**
+	* What this export IS. Optional ONLY for the rows written before D558: the
+	* store parses every row through this schema on every read, so a required
+	* field would make the export AUDIT — which is the whole reason rows survive
+	* file deletion — unreadable in one release. Absence means `footage`, and
+	* {@link exportSubjectOf} is the one place that says so.
+	*/
+	subject: ExportSubjectSchema.optional(),
 	options: ExportOptionsSchema,
 	state: ExportStateSchema,
 	/** 0–100 while rendering; null otherwise. */
@@ -32986,6 +34357,18 @@ var ExportRecordSchema = object({
 	/** Failure reason when state is 'failed'; null otherwise. */
 	error: string().nullable()
 });
+_enum([
+	"catalog-miss",
+	"catalog-unreachable",
+	"no-file-for-window",
+	"clip-in-progress",
+	"unsupported-option",
+	"sleeping",
+	"camera-refused",
+	"fetch-failed",
+	"too-large-to-transfer",
+	"wake-expired"
+]);
 /** Candidate download URLs (LAN first, then operator extra hosts). */
 var ExportDownloadSchema = object({
 	url: string(),
@@ -33004,16 +34387,50 @@ var ExportBytesSchema = object({
 	name: string(),
 	bytes: number().int().nonnegative()
 });
+/** Canonical `profiles[]`, falling back to the legacy singular `profile`. */
+function resolveExportProfiles(input) {
+	if (input.profiles !== void 0 && input.profiles.length > 0) return [...input.profiles];
+	if (typeof input.profile === "string" && input.profile.length > 0) return [input.profile];
+	return [];
+}
 method(object({
 	deviceId: number(),
 	/** @deprecated Prefer `profiles`. Kept so timelapse/notifiers keep working. */
 	profile: string().optional(),
 	profiles: array(string()).min(1).optional(),
-	fromMs: number(),
-	toMs: number(),
+	/** Footage only — a clip's boundaries are the camera's. */
+	fromMs: number().optional(),
+	toMs: number().optional(),
+	/** What to export. Absent means the legacy flat footage request. */
+	subject: ExportSubjectSchema.optional(),
 	options: ExportOptionsSchema
 }).superRefine((v, ctx) => {
-	if ((v.profiles !== void 0 && v.profiles.length > 0 ? v.profiles : v.profile !== void 0 ? [v.profile] : []).length < 1) ctx.addIssue({
+	if (v.subject?.kind === "clip") {
+		if (v.subject.deviceId !== v.deviceId) ctx.addIssue({
+			code: ZodIssueCode.custom,
+			message: `subject.deviceId (${v.subject.deviceId}) must equal deviceId (${v.deviceId}) — the top-level field is what per-device scope enforcement reads`,
+			path: ["subject", "deviceId"]
+		});
+		if (v.fromMs !== void 0 || v.toMs !== void 0) ctx.addIssue({
+			code: ZodIssueCode.custom,
+			message: "a clip export asks for no time range: the camera chose the boundaries and they are read from the catalog row",
+			path: ["fromMs"]
+		});
+		return;
+	}
+	if (v.subject?.kind === "footage" && v.subject.deviceId !== v.deviceId) ctx.addIssue({
+		code: ZodIssueCode.custom,
+		message: `subject.deviceId (${v.subject.deviceId}) must equal deviceId (${v.deviceId})`,
+		path: ["subject", "deviceId"]
+	});
+	const fromMs = v.subject?.kind === "footage" ? v.subject.fromMs : v.fromMs;
+	const toMs = v.subject?.kind === "footage" ? v.subject.toMs : v.toMs;
+	if (typeof fromMs !== "number" || typeof toMs !== "number") ctx.addIssue({
+		code: ZodIssueCode.custom,
+		message: "a footage export needs fromMs and toMs",
+		path: ["fromMs"]
+	});
+	if ((v.subject?.kind === "footage" ? [...v.subject.profiles] : resolveExportProfiles(v)).length < 1) ctx.addIssue({
 		code: ZodIssueCode.custom,
 		message: "pass profiles[] (min 1) or legacy profile",
 		path: ["profiles"]
@@ -35825,6 +37242,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	pressureSensor: pressureSensorCapability,
 	privacyMask: privacyMaskCapability,
 	ptzAutotrack: ptzAutotrackCapability,
+	recordingOnboard: recordingOnboardCapability,
 	recordingSignal: recordingSignalCapability,
 	sceneMonitor: sceneMonitorCapability,
 	scriptRunner: scriptRunnerCapability,
@@ -36986,7 +38404,1336 @@ var BaseDeviceProvider = class extends BaseAddon {
 DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
 new Set(Object.values(DeviceType));
 DeviceFeature.BatteryOperated;
+/**
+* The vocabulary, in the order a picker offers it.
+*
+* Adding a key here is not enough to make it pickable: both glyph tables must
+* gain it too, and their tests fail until they do. That is the intended
+* friction — it is the only thing that keeps the two surfaces honest.
+*/
+var DISPLAY_ICON_VOCABULARY = [
+	{
+		key: "camera",
+		group: "device",
+		synonyms: [
+			"telecamera",
+			"videocamera",
+			"camera",
+			"cam"
+		]
+	},
+	{
+		key: "network",
+		group: "device",
+		synonyms: [
+			"rete",
+			"network",
+			"lan"
+		]
+	},
+	{
+		key: "toggle-left",
+		group: "device",
+		synonyms: [
+			"interruttore",
+			"switch",
+			"toggle"
+		]
+	},
+	{
+		key: "toggle-right",
+		group: "device",
+		synonyms: [
+			"interruttore",
+			"switch",
+			"toggle",
+			"acceso"
+		]
+	},
+	{
+		key: "circle-dot",
+		group: "device",
+		synonyms: [
+			"pulsante",
+			"bottone",
+			"button",
+			"dot"
+		]
+	},
+	{
+		key: "refresh-cw",
+		group: "device",
+		synonyms: [
+			"aggiorna",
+			"ricarica",
+			"refresh",
+			"reload",
+			"ciclo"
+		]
+	},
+	{
+		key: "box",
+		group: "device",
+		synonyms: [
+			"scatola",
+			"box",
+			"contenitore"
+		]
+	},
+	{
+		key: "scroll-text",
+		group: "device",
+		synonyms: [
+			"registro",
+			"log",
+			"testo"
+		]
+	},
+	{
+		key: "workflow",
+		group: "device",
+		synonyms: [
+			"automazione",
+			"flusso",
+			"workflow",
+			"scenario"
+		]
+	},
+	{
+		key: "lock",
+		group: "device",
+		synonyms: [
+			"serratura",
+			"chiave",
+			"lucchetto",
+			"chiuso",
+			"locked"
+		]
+	},
+	{
+		key: "lock-open",
+		group: "device",
+		synonyms: [
+			"serratura",
+			"aperta",
+			"sbloccato",
+			"unlocked"
+		]
+	},
+	{
+		key: "blinds",
+		group: "device",
+		synonyms: [
+			"tapparella",
+			"persiana",
+			"serranda",
+			"avvolgibile",
+			"shutter",
+			"blind",
+			"veneziana"
+		]
+	},
+	{
+		key: "air-vent",
+		group: "device",
+		synonyms: [
+			"bocchetta",
+			"aria",
+			"ventilazione",
+			"condizionatore",
+			"vent"
+		]
+	},
+	{
+		key: "monitor-play",
+		group: "device",
+		synonyms: [
+			"schermo",
+			"riproduzione",
+			"player",
+			"display"
+		]
+	},
+	{
+		key: "sliders-horizontal",
+		group: "device",
+		synonyms: [
+			"regolazione",
+			"cursori",
+			"impostazioni",
+			"slider"
+		]
+	},
+	{
+		key: "map-pin",
+		group: "device",
+		synonyms: [
+			"posizione",
+			"luogo",
+			"mappa",
+			"pin"
+		]
+	},
+	{
+		key: "bot",
+		group: "device",
+		synonyms: [
+			"robot",
+			"aspirapolvere",
+			"bot"
+		]
+	},
+	{
+		key: "tractor",
+		group: "device",
+		synonyms: [
+			"trattore",
+			"tosaerba",
+			"giardino"
+		]
+	},
+	{
+		key: "image",
+		group: "device",
+		synonyms: [
+			"immagine",
+			"foto",
+			"snapshot"
+		]
+	},
+	{
+		key: "bone",
+		group: "device",
+		synonyms: ["osso", "cane"]
+	},
+	{
+		key: "door-closed",
+		group: "device",
+		synonyms: [
+			"porta",
+			"chiusa",
+			"contatto"
+		]
+	},
+	{
+		key: "door-open",
+		group: "device",
+		synonyms: [
+			"porta",
+			"aperta",
+			"contatto",
+			"ingresso",
+			"uscita"
+		]
+	},
+	{
+		key: "crosshair",
+		group: "device",
+		synonyms: [
+			"mirino",
+			"puntamento",
+			"centro"
+		]
+	},
+	{
+		key: "eye",
+		group: "device",
+		synonyms: [
+			"occhio",
+			"visibile",
+			"visto"
+		]
+	},
+	{
+		key: "eye-off",
+		group: "device",
+		synonyms: [
+			"privacy",
+			"nascosto",
+			"oscurato",
+			"mascherato",
+			"invisibile"
+		]
+	},
+	{
+		key: "smartphone",
+		group: "device",
+		synonyms: [
+			"telefono",
+			"cellulare",
+			"smartphone"
+		]
+	},
+	{
+		key: "phone",
+		group: "device",
+		synonyms: ["telefono", "chiamata"]
+	},
+	{
+		key: "tablet",
+		group: "device",
+		synonyms: ["tablet", "ipad"]
+	},
+	{
+		key: "laptop",
+		group: "device",
+		synonyms: [
+			"portatile",
+			"laptop",
+			"notebook"
+		]
+	},
+	{
+		key: "monitor",
+		group: "device",
+		synonyms: ["monitor", "schermo"]
+	},
+	{
+		key: "tv",
+		group: "device",
+		synonyms: ["televisore", "tv"]
+	},
+	{
+		key: "speaker",
+		group: "device",
+		synonyms: [
+			"altoparlante",
+			"cassa",
+			"speaker"
+		]
+	},
+	{
+		key: "printer",
+		group: "device",
+		synonyms: ["stampante"]
+	},
+	{
+		key: "projector",
+		group: "device",
+		synonyms: ["proiettore"]
+	},
+	{
+		key: "gamepad-2",
+		group: "device",
+		synonyms: [
+			"console",
+			"gioco",
+			"joystick"
+		]
+	},
+	{
+		key: "radio",
+		group: "device",
+		synonyms: ["radio"]
+	},
+	{
+		key: "router",
+		group: "device",
+		synonyms: ["router", "modem"]
+	},
+	{
+		key: "bluetooth",
+		group: "device",
+		synonyms: ["bluetooth"]
+	},
+	{
+		key: "cpu",
+		group: "device",
+		synonyms: [
+			"processore",
+			"cpu",
+			"chip",
+			"dispositivo"
+		]
+	},
+	{
+		key: "hard-drive",
+		group: "device",
+		synonyms: [
+			"disco",
+			"hdd",
+			"archiviazione",
+			"storage"
+		]
+	},
+	{
+		key: "server",
+		group: "device",
+		synonyms: ["server", "nas"]
+	},
+	{
+		key: "mic",
+		group: "device",
+		synonyms: ["microfono", "audio"]
+	},
+	{
+		key: "mic-off",
+		group: "device",
+		synonyms: [
+			"microfono",
+			"spento",
+			"muto"
+		]
+	},
+	{
+		key: "video",
+		group: "device",
+		synonyms: ["video"]
+	},
+	{
+		key: "video-off",
+		group: "device",
+		synonyms: ["video", "spento"]
+	},
+	{
+		key: "music",
+		group: "device",
+		synonyms: ["musica"]
+	},
+	{
+		key: "plug",
+		group: "device",
+		synonyms: [
+			"presa",
+			"spina",
+			"plug"
+		]
+	},
+	{
+		key: "plug-zap",
+		group: "device",
+		synonyms: ["presa", "alimentata"]
+	},
+	{
+		key: "power",
+		group: "device",
+		synonyms: [
+			"accensione",
+			"alimentazione",
+			"power"
+		]
+	},
+	{
+		key: "power-off",
+		group: "device",
+		synonyms: ["spegnimento", "spento"]
+	},
+	{
+		key: "cable",
+		group: "device",
+		synonyms: ["cavo"]
+	},
+	{
+		key: "battery",
+		group: "device",
+		synonyms: ["batteria"]
+	},
+	{
+		key: "battery-charging",
+		group: "device",
+		synonyms: [
+			"batteria",
+			"carica",
+			"ricarica"
+		]
+	},
+	{
+		key: "battery-full",
+		group: "device",
+		synonyms: [
+			"batteria",
+			"carica",
+			"piena"
+		]
+	},
+	{
+		key: "battery-low",
+		group: "device",
+		synonyms: ["batteria", "scarica"]
+	},
+	{
+		key: "key",
+		group: "device",
+		synonyms: ["chiave"]
+	},
+	{
+		key: "key-round",
+		group: "device",
+		synonyms: ["chiave", "tonda"]
+	},
+	{
+		key: "mailbox",
+		group: "device",
+		synonyms: [
+			"cassetta",
+			"postale",
+			"posta"
+		]
+	},
+	{
+		key: "package",
+		group: "device",
+		synonyms: ["pacco", "consegna"]
+	},
+	{
+		key: "shield",
+		group: "device",
+		synonyms: [
+			"scudo",
+			"protezione",
+			"sicurezza",
+			"allarme"
+		]
+	},
+	{
+		key: "shield-check",
+		group: "device",
+		synonyms: [
+			"protetto",
+			"sicuro",
+			"armato"
+		]
+	},
+	{
+		key: "shield-off",
+		group: "device",
+		synonyms: [
+			"protezione",
+			"disattivata",
+			"disarmato"
+		]
+	},
+	{
+		key: "briefcase",
+		group: "device",
+		synonyms: [
+			"ufficio",
+			"lavoro",
+			"valigetta",
+			"studio"
+		]
+	},
+	{
+		key: "lightbulb",
+		group: "lighting",
+		synonyms: [
+			"luce",
+			"lampadina",
+			"lampada",
+			"light"
+		]
+	},
+	{
+		key: "lamp",
+		group: "lighting",
+		synonyms: ["lampada", "abatjour"]
+	},
+	{
+		key: "lamp-ceiling",
+		group: "lighting",
+		synonyms: [
+			"plafoniera",
+			"lampadario",
+			"luce",
+			"soffitto"
+		]
+	},
+	{
+		key: "lamp-desk",
+		group: "lighting",
+		synonyms: [
+			"lampada",
+			"scrivania",
+			"abatjour"
+		]
+	},
+	{
+		key: "lamp-floor",
+		group: "lighting",
+		synonyms: [
+			"piantana",
+			"lampada",
+			"terra"
+		]
+	},
+	{
+		key: "flashlight",
+		group: "lighting",
+		synonyms: [
+			"faretto",
+			"torcia",
+			"spot",
+			"faro"
+		]
+	},
+	{
+		key: "heater",
+		group: "lighting",
+		synonyms: [
+			"riscaldamento",
+			"termosifone",
+			"stufa",
+			"calore"
+		]
+	},
+	{
+		key: "snowflake",
+		group: "lighting",
+		synonyms: [
+			"freddo",
+			"raffrescamento",
+			"aria",
+			"condizionata",
+			"neve"
+		]
+	},
+	{
+		key: "thermometer-sun",
+		group: "lighting",
+		synonyms: [
+			"caldo",
+			"temperatura",
+			"alta"
+		]
+	},
+	{
+		key: "thermometer-snowflake",
+		group: "lighting",
+		synonyms: [
+			"freddo",
+			"temperatura",
+			"bassa"
+		]
+	},
+	{
+		key: "refrigerator",
+		group: "lighting",
+		synonyms: ["frigorifero", "frigo"]
+	},
+	{
+		key: "microwave",
+		group: "lighting",
+		synonyms: ["microonde", "forno"]
+	},
+	{
+		key: "washing-machine",
+		group: "lighting",
+		synonyms: [
+			"lavatrice",
+			"lavastoviglie",
+			"asciugatrice"
+		]
+	},
+	{
+		key: "cooking-pot",
+		group: "lighting",
+		synonyms: [
+			"pentola",
+			"cucina",
+			"fornello"
+		]
+	},
+	{
+		key: "utensils",
+		group: "lighting",
+		synonyms: [
+			"cucina",
+			"posate",
+			"sala",
+			"pranzo"
+		]
+	},
+	{
+		key: "thermometer",
+		group: "sensing",
+		synonyms: [
+			"temperatura",
+			"termometro",
+			"termostato"
+		]
+	},
+	{
+		key: "droplets",
+		group: "sensing",
+		synonyms: [
+			"umidita",
+			"acqua",
+			"allagamento",
+			"perdita"
+		]
+	},
+	{
+		key: "droplet",
+		group: "sensing",
+		synonyms: [
+			"goccia",
+			"acqua",
+			"perdita",
+			"allagamento"
+		]
+	},
+	{
+		key: "gauge",
+		group: "sensing",
+		synonyms: [
+			"misura",
+			"livello",
+			"pressione",
+			"indicatore"
+		]
+	},
+	{
+		key: "gauge2",
+		group: "sensing",
+		synonyms: [
+			"misura",
+			"livello",
+			"pressione",
+			"indicatore"
+		],
+		aliasOf: "gauge"
+	},
+	{
+		key: "sun",
+		group: "sensing",
+		synonyms: [
+			"sole",
+			"luminosita",
+			"giorno",
+			"esterno"
+		]
+	},
+	{
+		key: "sun-medium",
+		group: "sensing",
+		synonyms: ["sole", "luminosita"]
+	},
+	{
+		key: "sunrise",
+		group: "sensing",
+		synonyms: ["alba"]
+	},
+	{
+		key: "moon",
+		group: "sensing",
+		synonyms: [
+			"notte",
+			"luna",
+			"notturna",
+			"nightvision"
+		]
+	},
+	{
+		key: "wind",
+		group: "sensing",
+		synonyms: [
+			"vento",
+			"aria",
+			"gas",
+			"monossido",
+			"co"
+		]
+	},
+	{
+		key: "cloud",
+		group: "sensing",
+		synonyms: ["nuvola", "nuvoloso"]
+	},
+	{
+		key: "cloud-rain",
+		group: "sensing",
+		synonyms: ["pioggia"]
+	},
+	{
+		key: "cloud-sun",
+		group: "sensing",
+		synonyms: [
+			"variabile",
+			"sole",
+			"nuvole"
+		]
+	},
+	{
+		key: "waves",
+		group: "sensing",
+		synonyms: [
+			"onde",
+			"acqua",
+			"vibrazione"
+		]
+	},
+	{
+		key: "sprout",
+		group: "sensing",
+		synonyms: [
+			"irrigazione",
+			"pianta",
+			"germoglio",
+			"orto"
+		]
+	},
+	{
+		key: "leaf",
+		group: "sensing",
+		synonyms: [
+			"foglia",
+			"pianta",
+			"verde"
+		]
+	},
+	{
+		key: "flower",
+		group: "sensing",
+		synonyms: ["fiore", "pianta"]
+	},
+	{
+		key: "zap",
+		group: "sensing",
+		synonyms: [
+			"energia",
+			"corrente",
+			"consumo",
+			"watt",
+			"elettricita"
+		]
+	},
+	{
+		key: "flame",
+		group: "sensing",
+		synonyms: [
+			"fiamma",
+			"gas",
+			"fuoco",
+			"incendio"
+		]
+	},
+	{
+		key: "bell",
+		group: "sensing",
+		synonyms: [
+			"campanello",
+			"suoneria",
+			"notifica",
+			"bell",
+			"chime"
+		]
+	},
+	{
+		key: "bell-ring",
+		group: "sensing",
+		synonyms: [
+			"campanello",
+			"suona",
+			"doorbell",
+			"notifica"
+		]
+	},
+	{
+		key: "bell-off",
+		group: "sensing",
+		synonyms: [
+			"silenzioso",
+			"notifiche",
+			"disattivate",
+			"muto"
+		]
+	},
+	{
+		key: "siren",
+		group: "sensing",
+		synonyms: ["sirena", "allarme"]
+	},
+	{
+		key: "radar",
+		group: "sensing",
+		synonyms: [
+			"movimento",
+			"presenza",
+			"pir",
+			"rilevamento",
+			"radar"
+		]
+	},
+	{
+		key: "activity",
+		group: "sensing",
+		synonyms: [
+			"attivita",
+			"sensore",
+			"generico"
+		]
+	},
+	{
+		key: "hash",
+		group: "sensing",
+		synonyms: [
+			"numero",
+			"contatore",
+			"valore"
+		]
+	},
+	{
+		key: "clock",
+		group: "sensing",
+		synonyms: [
+			"orologio",
+			"ora",
+			"tempo"
+		]
+	},
+	{
+		key: "timer",
+		group: "sensing",
+		synonyms: [
+			"timer",
+			"conto",
+			"rovescia"
+		]
+	},
+	{
+		key: "calendar",
+		group: "sensing",
+		synonyms: [
+			"calendario",
+			"data",
+			"pianificazione"
+		]
+	},
+	{
+		key: "pipette",
+		group: "sensing",
+		synonyms: [
+			"qualita",
+			"aria",
+			"misura",
+			"campione"
+		]
+	},
+	{
+		key: "fan",
+		group: "sensing",
+		synonyms: [
+			"ventilatore",
+			"ventola",
+			"aria"
+		]
+	},
+	{
+		key: "bath",
+		group: "sensing",
+		synonyms: [
+			"bagno",
+			"vasca",
+			"doccia"
+		]
+	},
+	{
+		key: "footprints",
+		group: "sensing",
+		synonyms: [
+			"movimento",
+			"passi",
+			"presenza",
+			"motion"
+		]
+	},
+	{
+		key: "alarm-smoke",
+		group: "sensing",
+		synonyms: [
+			"fumo",
+			"antincendio",
+			"rilevatore"
+		]
+	},
+	{
+		key: "shield-alert",
+		group: "sensing",
+		synonyms: [
+			"manomissione",
+			"allarme",
+			"tamper",
+			"avviso"
+		]
+	},
+	{
+		key: "vibrate",
+		group: "sensing",
+		synonyms: [
+			"vibrazione",
+			"urto",
+			"tamper"
+		]
+	},
+	{
+		key: "wifi",
+		group: "sensing",
+		synonyms: [
+			"wifi",
+			"rete",
+			"segnale"
+		]
+	},
+	{
+		key: "wifi-off",
+		group: "sensing",
+		synonyms: [
+			"wifi",
+			"assente",
+			"offline",
+			"disconnesso"
+		]
+	},
+	{
+		key: "volume-2",
+		group: "sensing",
+		synonyms: [
+			"volume",
+			"audio",
+			"altoparlante",
+			"suono"
+		]
+	},
+	{
+		key: "volume-x",
+		group: "sensing",
+		synonyms: [
+			"muto",
+			"silenziato",
+			"volume",
+			"spento"
+		]
+	},
+	{
+		key: "heart",
+		group: "sensing",
+		synonyms: [
+			"cuore",
+			"preferito",
+			"salute"
+		]
+	},
+	{
+		key: "heart-pulse",
+		group: "sensing",
+		synonyms: [
+			"battito",
+			"salute",
+			"monitoraggio"
+		]
+	},
+	{
+		key: "star",
+		group: "sensing",
+		synonyms: [
+			"preferito",
+			"stella",
+			"importante"
+		]
+	},
+	{
+		key: "sparkles",
+		group: "sensing",
+		synonyms: [
+			"automatico",
+			"intelligente",
+			"ai",
+			"scena"
+		]
+	},
+	{
+		key: "house",
+		group: "place",
+		synonyms: [
+			"casa",
+			"abitazione",
+			"home"
+		]
+	},
+	{
+		key: "sofa",
+		group: "place",
+		synonyms: [
+			"salone",
+			"soggiorno",
+			"divano",
+			"living"
+		]
+	},
+	{
+		key: "bed-double",
+		group: "place",
+		synonyms: [
+			"camera",
+			"letto",
+			"matrimoniale"
+		]
+	},
+	{
+		key: "bed",
+		group: "place",
+		synonyms: [
+			"cameretta",
+			"letto",
+			"singolo"
+		]
+	},
+	{
+		key: "warehouse",
+		group: "place",
+		synonyms: [
+			"magazzino",
+			"capanno",
+			"deposito",
+			"cantina"
+		]
+	},
+	{
+		key: "trees",
+		group: "place",
+		synonyms: [
+			"giardino",
+			"alberi",
+			"esterno",
+			"parco"
+		]
+	},
+	{
+		key: "tree-pine",
+		group: "place",
+		synonyms: [
+			"albero",
+			"pino",
+			"giardino"
+		]
+	},
+	{
+		key: "fence",
+		group: "place",
+		synonyms: [
+			"recinto",
+			"cancello",
+			"staccionata",
+			"perimetro"
+		]
+	},
+	{
+		key: "store",
+		group: "place",
+		synonyms: [
+			"negozio",
+			"ingresso",
+			"vetrina"
+		]
+	},
+	{
+		key: "building",
+		group: "place",
+		synonyms: ["edificio", "palazzo"]
+	},
+	{
+		key: "building-2",
+		group: "place",
+		synonyms: [
+			"edificio",
+			"uffici",
+			"condominio"
+		]
+	},
+	{
+		key: "mountain",
+		group: "place",
+		synonyms: [
+			"montagna",
+			"esterno",
+			"panorama"
+		]
+	},
+	{
+		key: "umbrella",
+		group: "place",
+		synonyms: [
+			"tenda",
+			"markise",
+			"ombrellone",
+			"pergola",
+			"veranda"
+		]
+	},
+	{
+		key: "dumbbell",
+		group: "place",
+		synonyms: ["palestra", "attrezzi"]
+	},
+	{
+		key: "wrench",
+		group: "place",
+		synonyms: [
+			"officina",
+			"manutenzione",
+			"attrezzi",
+			"utenze"
+		]
+	},
+	{
+		key: "hammer",
+		group: "place",
+		synonyms: [
+			"officina",
+			"martello",
+			"lavori"
+		]
+	},
+	{
+		key: "drill",
+		group: "place",
+		synonyms: [
+			"officina",
+			"trapano",
+			"lavori"
+		]
+	},
+	{
+		key: "waves-ladder",
+		group: "place",
+		synonyms: ["piscina", "vasca"]
+	},
+	{
+		key: "circle-parking",
+		group: "place",
+		synonyms: [
+			"parcheggio",
+			"posto",
+			"auto",
+			"garage"
+		]
+	},
+	{
+		key: "route",
+		group: "place",
+		synonyms: [
+			"percorso",
+			"strada",
+			"vialetto",
+			"tragitto"
+		]
+	},
+	{
+		key: "car",
+		group: "life",
+		synonyms: [
+			"auto",
+			"macchina",
+			"veicolo",
+			"parcheggio"
+		]
+	},
+	{
+		key: "bike",
+		group: "life",
+		synonyms: [
+			"bicicletta",
+			"bici",
+			"moto"
+		]
+	},
+	{
+		key: "bus",
+		group: "life",
+		synonyms: ["autobus", "pullman"]
+	},
+	{
+		key: "truck",
+		group: "life",
+		synonyms: [
+			"camion",
+			"furgone",
+			"consegna"
+		]
+	},
+	{
+		key: "plane",
+		group: "life",
+		synonyms: ["aereo"]
+	},
+	{
+		key: "train-front",
+		group: "life",
+		synonyms: ["treno"]
+	},
+	{
+		key: "sailboat",
+		group: "life",
+		synonyms: ["barca", "imbarcazione"]
+	},
+	{
+		key: "dog",
+		group: "life",
+		synonyms: ["cane", "animale"]
+	},
+	{
+		key: "cat",
+		group: "life",
+		synonyms: ["gatto", "animale"]
+	},
+	{
+		key: "bird",
+		group: "life",
+		synonyms: ["uccello", "animale"]
+	},
+	{
+		key: "paw-print",
+		group: "life",
+		synonyms: [
+			"animale",
+			"zampa",
+			"pet"
+		]
+	},
+	{
+		key: "baby",
+		group: "life",
+		synonyms: [
+			"neonato",
+			"bimbo",
+			"cameretta",
+			"babymonitor"
+		]
+	},
+	{
+		key: "user",
+		group: "life",
+		synonyms: ["persona", "utente"]
+	},
+	{
+		key: "users",
+		group: "life",
+		synonyms: [
+			"persone",
+			"gruppo",
+			"famiglia"
+		]
+	},
+	{
+		key: "person-standing",
+		group: "life",
+		synonyms: [
+			"persona",
+			"piedi",
+			"presenza"
+		]
+	}
+];
+DISPLAY_ICON_VOCABULARY.map((e) => e.key);
+DISPLAY_ICON_VOCABULARY.filter((e) => e.aliasOf === void 0).map((e) => e.key);
+new Map(DISPLAY_ICON_VOCABULARY.map((e) => [e.key, e]));
 Object.freeze({
+	"accessories.getStatus": {
+		capName: "accessories",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"accessories.setChildHidden": {
 		capName: "accessories",
 		capScope: "device",
@@ -37269,6 +40016,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"airQualitySensor.getStatus": {
+		capName: "air-quality-sensor",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"alarmPanel.arm": {
 		capName: "alarm-panel",
 		capScope: "device",
@@ -37281,6 +40034,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"alarmPanel.getStatus": {
+		capName: "alarm-panel",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"alarmPanel.trigger": {
 		capName: "alarm-panel",
 		capScope: "device",
@@ -37329,6 +40088,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"ambientLightSensor.getStatus": {
+		capName: "ambient-light-sensor",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"audioAnalysis.applyDeviceSettingsPatch": {
+		capName: "audio-analysis",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"audioAnalysis.getDeviceLiveContribution": {
+		capName: "audio-analysis",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"audioAnalysis.getDeviceSettingsContribution": {
+		capName: "audio-analysis",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"audioAnalysis.resolveDeviceSettings": {
 		capName: "audio-analysis",
 		capScope: "device",
@@ -37491,6 +40274,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"automationControl.getStatus": {
+		capName: "automation-control",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"automationControl.trigger": {
 		capName: "automation-control",
 		capScope: "device",
@@ -37587,12 +40376,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"battery.getStatus": {
+		capName: "battery",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"battery.wakeForStream": {
 		capName: "battery",
 		capScope: "device",
 		addonId: null,
 		access: "create"
 	},
+	"binary.getStatus": {
+		capName: "binary",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"brightness.getStatus": {
+		capName: "brightness",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"brightness.setBrightness": {
 		capName: "brightness",
 		capScope: "device",
@@ -37707,6 +40514,30 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"cameraCredentials.getStatus": {
+		capName: "camera-credentials",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"cameraGridLayout.applyDeviceSettingsPatch": {
+		capName: "camera-grid-layout",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"cameraGridLayout.getDeviceLiveContribution": {
+		capName: "camera-grid-layout",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"cameraGridLayout.getDeviceSettingsContribution": {
+		capName: "camera-grid-layout",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"cameraGridLayout.getLayout": {
 		capName: "camera-grid-layout",
 		capScope: "device",
@@ -37719,6 +40550,24 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"cameraPipelineConfig.applyDeviceSettingsPatch": {
+		capName: "camera-pipeline-config",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"cameraPipelineConfig.getDeviceLiveContribution": {
+		capName: "camera-pipeline-config",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"cameraPipelineConfig.getDeviceSettingsContribution": {
+		capName: "camera-pipeline-config",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"cameraStreams.getBrokerStreams": {
 		capName: "camera-streams",
 		capScope: "device",
@@ -37749,6 +40598,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"carbonMonoxide.getStatus": {
+		capName: "carbon-monoxide",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"climateControl.getStatus": {
+		capName: "climate-control",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"climateControl.setFanMode": {
 		capName: "climate-control",
 		capScope: "device",
@@ -37797,6 +40658,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"color.getStatus": {
+		capName: "color",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"color.setColor": {
 		capName: "color",
 		capScope: "device",
@@ -37815,12 +40682,36 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"connectivity.getStatus": {
+		capName: "connectivity",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"consumables.getStatus": {
+		capName: "consumables",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"consumables.reset": {
 		capName: "consumables",
 		capScope: "device",
 		addonId: null,
 		access: "delete"
 	},
+	"contact.getStatus": {
+		capName: "contact",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"control.getStatus": {
+		capName: "control",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"control.setValue": {
 		capName: "control",
 		capScope: "device",
@@ -37887,6 +40778,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"cover.getStatus": {
+		capName: "cover",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"cover.open": {
 		capName: "cover",
 		capScope: "device",
@@ -38019,6 +40916,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dayNight.getStatus": {
+		capName: "day-night",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"dayNight.setSettings": {
 		capName: "day-night",
 		capScope: "device",
@@ -38109,6 +41012,30 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"detectionPipeline.applyDeviceSettingsPatch": {
+		capName: "detection-pipeline",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"detectionPipeline.getDeviceLiveContribution": {
+		capName: "detection-pipeline",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"detectionPipeline.getDeviceSettingsContribution": {
+		capName: "detection-pipeline",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceAdminLink.getAdminLink": {
+		capName: "device-admin-link",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"deviceAdoption.adopt": {
 		capName: "device-adoption",
 		capScope: "system",
@@ -38121,6 +41048,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceAdoption.getStatus": {
+		capName: "device-adoption",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceAdoption.listCandidateFilters": {
 		capName: "device-adoption",
 		capScope: "system",
@@ -38157,6 +41090,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceDiscovery.getStatus": {
+		capName: "device-discovery",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"deviceDiscovery.listDiscovered": {
 		capName: "device-discovery",
 		capScope: "device",
@@ -38175,12 +41114,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceExport.applyDeviceSettingsPatch": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceExport.exposeDevice": {
 		capName: "device-export",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"deviceExport.getDeviceLiveContribution": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExport.getDeviceSettingsContribution": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceExport.getStatus": {
 		capName: "device-export",
 		capScope: "system",
@@ -38277,6 +41234,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.applyDeviceSettingsPatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.applyInitialMeta": {
 		capName: "device-manager",
 		capScope: "system",
@@ -38379,6 +41342,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getDeviceLiveContribution": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getDeviceLiveInfoAggregate": {
 		capName: "device-manager",
 		capScope: "system",
@@ -38391,6 +41360,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getDeviceSettingsContribution": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getDeviceStatusAggregate": {
 		capName: "device-manager",
 		capScope: "system",
@@ -38883,6 +41858,36 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceStatus.getStatus": {
+		capName: "device-status",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"doorbell.applyDeviceSettingsPatch": {
+		capName: "doorbell",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"doorbell.getDeviceLiveContribution": {
+		capName: "doorbell",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"doorbell.getDeviceSettingsContribution": {
+		capName: "doorbell",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"doorbell.getStatus": {
+		capName: "doorbell",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"embeddingEncoder.encode": {
 		capName: "embedding-encoder",
 		capScope: "system",
@@ -38901,6 +41906,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"enumSensor.getStatus": {
+		capName: "enum-sensor",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"eventEmitter.getStatus": {
+		capName: "event-emitter",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"events.getEventClipUrl": {
 		capName: "events",
 		capScope: "device",
@@ -39021,6 +42038,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"fanControl.getStatus": {
+		capName: "fan-control",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"fanControl.setDirection": {
 		capName: "fan-control",
 		capScope: "device",
@@ -39045,6 +42068,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"featureProbe.getStatus": {
+		capName: "feature-probe",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"filesystemBrowse.browse": {
 		capName: "filesystem-browse",
 		capScope: "system",
@@ -39063,6 +42092,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"flood.getStatus": {
+		capName: "flood",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"gas.getStatus": {
+		capName: "gas",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"humidifier.getStatus": {
+		capName: "humidifier",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"humidifier.setMode": {
 		capName: "humidifier",
 		capScope: "device",
@@ -39081,12 +42128,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"humiditySensor.getStatus": {
+		capName: "humidity-sensor",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"image.getStatus": {
+		capName: "image",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"imageSettings.getOptions": {
 		capName: "image-settings",
 		capScope: "device",
 		addonId: null,
 		access: "view"
 	},
+	"imageSettings.getStatus": {
+		capName: "image-settings",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"imageSettings.setSettings": {
 		capName: "image-settings",
 		capScope: "device",
@@ -39159,6 +42224,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"intercom.getStatus": {
+		capName: "intercom",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"intercom.handleAnswer": {
 		capName: "intercom",
 		capScope: "device",
@@ -39195,6 +42266,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"lawnMowerControl.getStatus": {
+		capName: "lawn-mower-control",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"lawnMowerControl.pause": {
 		capName: "lawn-mower-control",
 		capScope: "device",
@@ -39477,6 +42554,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"lockControl.getStatus": {
+		capName: "lock-control",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -39525,6 +42608,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"mediaPlayer.getStatus": {
+		capName: "media-player",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"mediaPlayer.next": {
 		capName: "media-player",
 		capScope: "device",
@@ -39717,6 +42806,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"motion.getStatus": {
+		capName: "motion",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"motion.isDetected": {
 		capName: "motion",
 		capScope: "device",
@@ -39729,6 +42824,24 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"motionDetection.applyDeviceSettingsPatch": {
+		capName: "motion-detection",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"motionDetection.getDeviceLiveContribution": {
+		capName: "motion-detection",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"motionDetection.getDeviceSettingsContribution": {
+		capName: "motion-detection",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"motionDetection.removeCamera": {
 		capName: "motion-detection",
 		capScope: "device",
@@ -39741,6 +42854,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"motionTrigger.getStatus": {
+		capName: "motion-trigger",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"motionTrigger.setMotionTrigger": {
 		capName: "motion-trigger",
 		capScope: "device",
@@ -39753,6 +42872,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"motionZones.getStatus": {
+		capName: "motion-zones",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"motionZones.setZone": {
 		capName: "motion-zones",
 		capScope: "device",
@@ -39813,6 +42938,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"nativeObjectDetection.getStatus": {
+		capName: "native-object-detection",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"nativeObjectDetection.setEnabled": {
 		capName: "native-object-detection",
 		capScope: "device",
@@ -39831,6 +42962,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"navigation.getStatus": {
+		capName: "navigation",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"navigation.goToPoint": {
 		capName: "navigation",
 		capScope: "device",
@@ -39915,6 +43052,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"networkLink.getStatus": {
+		capName: "network-link",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"networkQuality.getAllStats": {
 		capName: "network-quality",
 		capScope: "system",
@@ -40173,18 +43316,36 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notifier.getStatus": {
+		capName: "notifier",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"notifier.send": {
 		capName: "notifier",
 		capScope: "device",
 		addonId: null,
 		access: "create"
 	},
+	"numericSensor.getStatus": {
+		capName: "numeric-sensor",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"oauthIntegration.getDescriptor": {
 		capName: "oauth-integration",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"osd.getStatus": {
+		capName: "osd",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"osd.setOverlay": {
 		capName: "osd",
 		capScope: "device",
@@ -40257,6 +43418,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"petFeeder.getStatus": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"petFeeder.markFoodReplenished": {
 		capName: "pet-feeder",
 		capScope: "device",
@@ -40299,6 +43466,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.applyDeviceSettingsPatch": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.cancelRelocateMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -40365,6 +43538,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getDeviceLiveContribution": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.getDeviceSettingsContribution": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getEventDensity": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -40575,6 +43760,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.ownersWithMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.pauseForStorageMigration": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -40929,6 +44120,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.applyDeviceSettingsPatch": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.assignAudio": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41019,6 +44216,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getDeviceLiveContribution": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.getDeviceSettingsContribution": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getGlobalMetrics": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41427,12 +44636,36 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"powerMeter.getStatus": {
+		capName: "power-meter",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"presence.getStatus": {
+		capName: "presence",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pressureSensor.getStatus": {
+		capName: "pressure-sensor",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"privacyMask.getOptions": {
 		capName: "privacy-mask",
 		capScope: "device",
 		addonId: null,
 		access: "view"
 	},
+	"privacyMask.getStatus": {
+		capName: "privacy-mask",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"privacyMask.setAudioEnabled": {
 		capName: "privacy-mask",
 		capScope: "device",
@@ -41493,6 +44726,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"ptz.getStatus": {
+		capName: "ptz",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"ptz.goHome": {
 		capName: "ptz",
 		capScope: "device",
@@ -41571,6 +44810,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.applyDeviceSettingsPatch": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.cancelRelocateJob": {
 		capName: "recording",
 		capScope: "system",
@@ -41619,6 +44864,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.getDeviceLiveContribution": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recording.getDeviceSettingsContribution": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.getPlacement": {
 		capName: "recording",
 		capScope: "system",
@@ -41637,6 +44894,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.getStatus": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.getStorageMigrationMoveStatus": {
 		capName: "recording",
 		capScope: "system",
@@ -41811,6 +45074,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recordingOnboard.getOptions": {
+		capName: "recording-onboard",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"recordingOnboard.getStatus": {
+		capName: "recording-onboard",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"recordingOnboard.setSettings": {
+		capName: "recording-onboard",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"recordingSignal.getStatus": {
 		capName: "recording-signal",
 		capScope: "device",
@@ -41841,6 +45122,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"sceneMonitor.getStatus": {
+		capName: "scene-monitor",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"sceneMonitor.listScenes": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -41871,6 +45158,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"scriptRunner.getStatus": {
+		capName: "script-runner",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"scriptRunner.run": {
 		capName: "script-runner",
 		capScope: "device",
@@ -42003,6 +45296,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"smoke.getStatus": {
+		capName: "smoke",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"smtpProvider.getStatus": {
 		capName: "smtp-provider",
 		capScope: "system",
@@ -42021,12 +45320,30 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"snapshot.applyDeviceSettingsPatch": {
+		capName: "snapshot",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"snapshot.getDebugState": {
 		capName: "snapshot",
 		capScope: "device",
 		addonId: null,
 		access: "view"
 	},
+	"snapshot.getDeviceLiveContribution": {
+		capName: "snapshot",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"snapshot.getDeviceSettingsContribution": {
+		capName: "snapshot",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"snapshot.getSnapshot": {
 		capName: "snapshot",
 		capScope: "device",
@@ -42045,6 +45362,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"snapshot.getStatus": {
+		capName: "snapshot",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"snapshot.invalidateCache": {
 		capName: "snapshot",
 		capScope: "device",
@@ -42381,6 +45704,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.applyDeviceSettingsPatch": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.assignProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -42417,6 +45746,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"streamBroker.getDeviceLiveContribution": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"streamBroker.getDeviceSettingsContribution": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"streamBroker.getPreBufferInfo": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -42615,6 +45956,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"streamParams.getStatus": {
+		capName: "stream-params",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"streamParams.setProfile": {
 		capName: "stream-params",
 		capScope: "device",
@@ -42627,6 +45974,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"switch.getStatus": {
+		capName: "switch",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"switch.setState": {
 		capName: "switch",
 		capScope: "device",
@@ -42723,6 +46076,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"tamper.getStatus": {
+		capName: "tamper",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"temperatureSensor.getStatus": {
+		capName: "temperature-sensor",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"terminalSession.adoptLegacyMonitor": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -42819,6 +46184,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"update.getStatus": {
+		capName: "update",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"update.installUpdate": {
 		capName: "update",
 		capScope: "device",
@@ -43041,6 +46412,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"vacuumControl.getStatus": {
+		capName: "vacuum-control",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",
@@ -43083,6 +46460,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"valve.getStatus": {
+		capName: "valve",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"valve.open": {
 		capName: "valve",
 		capScope: "device",
@@ -43155,6 +46538,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"vibration.getStatus": {
+		capName: "vibration",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"videoclips.dialClipStream": {
+		capName: "videoclips",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"videoclips.getClipPlayback": {
 		capName: "videoclips",
 		capScope: "device",
@@ -43167,6 +46562,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"videoclips.listSources": {
+		capName: "videoclips",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"videoclips.readClipBytes": {
+		capName: "videoclips",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"viewerUi.getStaticDir": {
 		capName: "viewer-ui",
 		capScope: "system",
@@ -43179,6 +46586,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"waterHeater.getStatus": {
+		capName: "water-heater",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"waterHeater.setAway": {
 		capName: "water-heater",
 		capScope: "device",
@@ -43197,6 +46610,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"weather.getStatus": {
+		capName: "weather",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"webrtcSession.addIceCandidate": {
 		capName: "webrtc-session",
 		capScope: "device",
@@ -43221,6 +46640,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"webrtcSession.getSessionDebug": {
+		capName: "webrtc-session",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"webrtcSession.getSessionState": {
 		capName: "webrtc-session",
 		capScope: "device",
@@ -43553,6 +46978,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"deviceAdminLink.getAdminLink": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceAdoption.release": [{
 		name: "camDeviceId",
 		form: "single",
@@ -44463,6 +47893,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.ownersWithMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.proposeRetrainAnnotations": [{
 		name: "deviceId",
 		form: "single",
@@ -44933,6 +48368,16 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"recordingOnboard.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recordingOnboard.setSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"recordingSignal.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -45159,6 +48604,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"videoclips.dialClipStream": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"videoclips.getClipPlayback": [{
 		name: "deviceId",
 		form: "single",
@@ -45169,6 +48619,16 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"videoclips.listSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"videoclips.readClipBytes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"waterHeater.setAway": [{
 		name: "deviceId",
 		form: "single",
@@ -45204,6 +48664,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"webrtcSession.getSessionDebug": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"webrtcSession.getSessionState": [{
 		name: "deviceId",
 		form: "single",
@@ -46377,11 +49842,49 @@ var RademacherHubDevice = class extends BaseDevice {
 		super(ctx, rademacherHubSchema, { type: DeviceType.Hub });
 		this.online = false;
 		this.registerDeviceDiscovery();
+		this.registerAdminLinkCap();
 		this.updateSourceInfo({
 			id: this.stableId,
 			system: "rademacher"
 		});
 	}
+	/**
+	* device-admin-link — the hub's own management page.
+	*
+	* The HomePilot serves its web UI on plain HTTP at the hub's own address.
+	* `basePath` is the operator's API base-path override ("" for v1, "/hp" for
+	* v2) and is carried through, because a hub reached under a prefix serves its
+	* page under the same prefix.
+	*
+	* Only the hub gets the cap. Its children are radio actuators with no web
+	* server anywhere, and the address they would borrow lives on the hub, which
+	* is where the operator edits it.
+	*/
+	registerAdminLinkCap() {
+		this.ctx.registerNativeCap(deviceAdminLinkCapability, { getAdminLink: async ({ deviceId }) => {
+			if (deviceId !== this.id) throw new Error(`RademacherHubDevice: deviceId mismatch, expected ${this.id}, got ${deviceId}`);
+			const connection = this.config.values.connection;
+			const built = buildDeviceAdminUrl({
+				host: connection.host,
+				port: null,
+				scheme: "http",
+				path: connection.basePath === "" ? "/" : `${connection.basePath}/`
+			});
+			if (!built.ok) {
+				this.ctx.logger.debug("rademacher admin link unavailable", {
+					tags: { deviceId: this.id },
+					meta: { reason: built.reason }
+				});
+				return null;
+			}
+			return {
+				url: built.url,
+				label: "HomePilot web UI",
+				target: "integration",
+				host: connection.host
+			};
+		} });
+	}
 	/** Adopt a pre-built manager (created by `onCreateDevice` so the live client
 	*  connects once). Published on the resolver so children pick it up. */
 	adoptManager(manager) {