@camstack/system 1.2.428 → 1.2.430

package/dist/{dist-BQG3QFg7.js → dist-DxJdci75.js}

@@ -718,7 +718,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-BBF1iXUi.mjs
+//#region ../types/dist/sleep-DxJdzHni.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -9769,6 +9769,206 @@ function scopesAllowAddon(scopes, addonId, access) {
 	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
 }
 /**
+* Device certificates (D855) — the wire contract shared by the hub, the admin
+* UI and the native viewer.
+*
+* A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+* Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+* key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+* dedicated device CA; the device later proves possession of the key by
+* signing a hub-issued nonce, and the hub answers with the same session a
+* password login opens.
+*
+* Everything on the wire is a small string (a PEM, a base64url signature):
+* D613 is about bulk bytes, and a certificate is ~600 bytes.
+*/
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+var DEVICE_CERT_SIGNATURE = "ecdsa-p256-sha256";
+/** First line of every signed message; a change of format bumps the version. */
+var DEVICE_SIGNATURE_MESSAGE_VERSION = "camstack-device-cert-v1";
+zod.z.enum([
+	"login",
+	"renew",
+	"revoke"
+]);
+/** One-shot enrollment code and login nonce lifetimes. */
+var DEVICE_ENROLLMENT_TTL_MS = 10 * 6e4;
+var DEVICE_NONCE_TTL_MS = 6e4;
+/** SAN URI prefixes of a device leaf. */
+var DEVICE_SAN_CREDENTIAL_PREFIX = "camstack:credential:";
+var DEVICE_SAN_USER_PREFIX = "camstack:user:";
+/**
+* The exact bytes a device signs (UTF-8, `\n` separators, no trailing newline):
+*
+*   camstack-device-cert-v1
+*   <login|renew>
+*   <origin>            the hub origin returned by `getDeviceChallenge`
+*   <nonce>
+*
+* The origin is part of the message so a signature collected by a look-alike
+* hub is worthless on the real one; the hub additionally binds the nonce to
+* the origin it issued it for and refuses any other.
+*/
+function buildDeviceSignatureMessage(input) {
+	return [
+		DEVICE_SIGNATURE_MESSAGE_VERSION,
+		input.purpose,
+		input.origin,
+		input.nonce
+	].join("\n");
+}
+/** The deep link a QR carries: `camstack://enroll?hub=<origin>&code=<code>`. */
+function buildDeviceEnrollmentLink(input) {
+	const query = new URLSearchParams();
+	if (input.hub !== void 0) query.set("hub", input.hub);
+	query.set("code", input.code);
+	return `${input.scheme ?? "camstack"}://enroll?${query.toString()}`;
+}
+var DevicePlatformSchema = zod.z.enum([
+	"ios",
+	"android",
+	"web",
+	"other"
+]);
+var Base64UrlSchema = zod.z.string().min(1).max(4096).regex(/^[A-Za-z0-9_-]+$/);
+var PemSchema = zod.z.string().min(1).max(16384);
+/**
+* Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+* failure: those carry no reason and mean "try again", never "the credential is
+* dead". The viewer switches on this exhaustively.
+*/
+var DeviceRefusalReasonSchema = zod.z.enum([
+	"revoked",
+	"unknown-credential",
+	"expired",
+	"bad-signature",
+	"nonce-invalid",
+	"rate-limited",
+	"invalid-certificate",
+	"superseded",
+	"user-gone",
+	"unavailable",
+	"code-invalid",
+	"self-enrollment-disabled",
+	"step-up-required",
+	"bad-public-key"
+]);
+var DeviceRefusalSchema = zod.z.object({
+	ok: zod.z.literal(false),
+	reason: DeviceRefusalReasonSchema,
+	definitive: zod.z.boolean(),
+	retryAfterSeconds: zod.z.number().optional()
+});
+zod.z.object({
+	code: zod.z.string().min(1).max(256),
+	/** SubjectPublicKeyInfo DER of the device's P-256 public key, base64url. */
+	publicKeySpki: Base64UrlSchema,
+	deviceName: zod.z.string().min(1).max(80).optional(),
+	platform: DevicePlatformSchema
+});
+var CompleteEnrollmentOutputSchema = zod.z.object({
+	credentialId: zod.z.string(),
+	certPem: PemSchema,
+	/** The device CA certificate the leaf chains to. */
+	chainPem: PemSchema,
+	notAfter: zod.z.number(),
+	user: zod.z.object({
+		id: zod.z.string(),
+		username: zod.z.string()
+	})
+});
+zod.z.discriminatedUnion("ok", [CompleteEnrollmentOutputSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+zod.z.object({
+	/** The single-use step-up proof (`auth.deviceEnrollProofFrom…`). */
+	proof: zod.z.string().min(1).max(512),
+	publicKeySpki: Base64UrlSchema,
+	deviceName: zod.z.string().min(1).max(80),
+	platform: DevicePlatformSchema
+});
+zod.z.object({
+	proof: zod.z.string(),
+	expiresAt: zod.z.number()
+});
+var DeviceChallengeSchema = zod.z.object({
+	nonce: zod.z.string(),
+	/** The origin to put in the signed message. The app compares it to the hub it dialled. */
+	origin: zod.z.string(),
+	expiresAt: zod.z.number(),
+	signature: zod.z.literal(DEVICE_CERT_SIGNATURE)
+});
+zod.z.discriminatedUnion("ok", [DeviceChallengeSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+zod.z.object({
+	certPem: PemSchema,
+	nonce: zod.z.string().min(1).max(256),
+	/** ECDSA P-256 SHA-256 over {@link buildDeviceSignatureMessage}; raw r||s or DER, base64url. */
+	signature: Base64UrlSchema
+});
+var RenewDeviceCertificateOutputSchema = zod.z.object({
+	credentialId: zod.z.string(),
+	certPem: PemSchema,
+	chainPem: PemSchema,
+	notAfter: zod.z.number()
+});
+zod.z.discriminatedUnion("ok", [RenewDeviceCertificateOutputSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+zod.z.discriminatedUnion("ok", [zod.z.object({
+	ok: zod.z.literal(true),
+	credentialId: zod.z.string(),
+	sessionsEnded: zod.z.number().int()
+}), DeviceRefusalSchema]);
+function formatDeviceRevoker(revoker) {
+	return revoker.kind === "device" ? "device" : `${revoker.kind}:${revoker.userId}`;
+}
+var DeviceCredentialStatusSchema = zod.z.enum([
+	"active",
+	"expired",
+	"revoked"
+]);
+var DeviceCredentialSchema = zod.z.object({
+	id: zod.z.string(),
+	userId: zod.z.string(),
+	username: zod.z.string().nullable(),
+	deviceName: zod.z.string(),
+	platform: DevicePlatformSchema,
+	enrolledVia: zod.z.enum(["qr", "self"]),
+	/** SHA-256 of the leaf certificate DER, colon-hex. */
+	fingerprint: zod.z.string(),
+	issuedAt: zod.z.number(),
+	expiresAt: zod.z.number(),
+	lastUsedAt: zod.z.number().nullable(),
+	lastUsedFrom: zod.z.string().nullable(),
+	revokedAt: zod.z.number().nullable(),
+	/** `admin:<userId>` | `user:<userId>` | `device` | `user-deleted`. */
+	revokedBy: zod.z.string().nullable(),
+	status: DeviceCredentialStatusSchema
+});
+var StartEnrollmentOutputSchema = zod.z.object({
+	/** Shown once; only its hash is kept. */
+	code: zod.z.string(),
+	expiresAt: zod.z.number(),
+	/** `camstack://enroll?hub=…&code=…` — what the QR encodes. */
+	enrollUrl: zod.z.string(),
+	/** The hub origin in the link, or `null` when the hub could not name one (the link then has no `hub`). */
+	hubOrigin: zod.z.string().nullable(),
+	/** Every origin the apps may try (role `appConnections`). */
+	hubOrigins: zod.z.array(zod.z.string())
+});
+zod.z.object({
+	kind: zod.z.literal("device-certificate"),
+	id: zod.z.literal("device-certificate"),
+	label: zod.z.string(),
+	stage: zod.z.literal("primary"),
+	/** tRPC paths under the hub's `auth` router, so a client names no literal. */
+	challengePath: zod.z.literal("auth.getDeviceChallenge"),
+	revokePath: zod.z.literal("auth.revokeOwnDeviceCertificate"),
+	enrollSelfPath: zod.z.literal("auth.enrollSelf"),
+	loginPath: zod.z.literal("auth.loginWithDeviceCertificate"),
+	renewPath: zod.z.literal("auth.renewDeviceCertificate"),
+	signature: zod.z.literal(DEVICE_CERT_SIGNATURE),
+	messageVersion: zod.z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
+	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
+	clients: zod.z.array(zod.z.enum(["native", "web"]))
+});
+/**
 * What an expression's named bindings READ from.
 *
 * Salvaged verbatim from the deleted device-link mechanism. Wiring's source
@@ -13612,7 +13812,11 @@ var cameraStreamsCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `online` duplicates device-status.online (one authority); slot data is nested enum/string.
+	*/
+	history: "none"
 };
 /** `z.void()` — input carries no data. */
 function isVoidInput(schema) {
@@ -16009,6 +16213,220 @@ var keychainCapability = {
 		getState: method(zod.z.object({}), KeychainStateSchema, { auth: "admin" })
 	}
 };
+var DeviceCaStatusSchema = zod.z.discriminatedUnion("state", [
+	zod.z.object({ state: zod.z.literal("absent") }),
+	zod.z.object({
+		state: zod.z.literal("ready"),
+		subject: zod.z.string(),
+		fingerprintSha256: zod.z.string(),
+		validTo: zod.z.string()
+	}),
+	zod.z.object({
+		state: zod.z.literal("unavailable"),
+		reason: zod.z.string()
+	})
+]);
+var DeviceCertificateSettingsSchema = zod.z.object({ selfEnrollment: zod.z.enum(["allowed", "disabled"]) });
+/**
+* `device-credentials` — the admin surface of device certificates (D855).
+*
+* Everything a device does ITSELF — completing an enrollment, getting a
+* challenge, signing in, renewing — is a PUBLIC procedure of the hub's `auth`
+* router (`auth.completeEnrollment`, `getDeviceChallenge`,
+* `loginWithDeviceCertificate`, `renewDeviceCertificate`): those legs are
+* proofs of possession, not capability calls, and must not be reachable as
+* cap methods. This cap holds only what an operator does about them.
+*
+* Provider: `local-auth`, which also owns the device CA and the registry.
+* The hub is the only node that persists device credentials.
+*/
+var deviceCredentialsCapability = {
+	name: "device-credentials",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/**
+		* Every enrolled device, newest first; `userId` narrows to one user.
+		* `status` is derived: revoked wins over expired.
+		*/
+		listDeviceCredentials: method(zod.z.object({
+			userId: zod.z.string().min(1).optional(),
+			includeRevoked: zod.z.boolean().default(false)
+		}), zod.z.array(DeviceCredentialSchema).readonly(), { auth: "admin" }),
+		/**
+		* Mint a one-shot enrollment code for `userId` and a device name: 128-bit
+		* random, single use, 10 minutes, kept only as a hash. Returns the code
+		* once, with the `camstack://enroll?hub=…&code=…` link a QR carries.
+		* `caller` (the admin) is recorded in the audit trail.
+		*/
+		startEnrollment: method(zod.z.object({
+			userId: zod.z.string().min(1),
+			deviceName: zod.z.string().min(1).max(80)
+		}), StartEnrollmentOutputSchema, {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Revoke a credential: its certificate stops logging in at once, and every
+		* session it opened ends (an open session also dies at its next refresh
+		* even if this call raced it). Idempotent.
+		*/
+		revokeDeviceCredential: method(zod.z.object({ id: zod.z.string().min(1) }), zod.z.object({
+			revoked: zod.z.boolean(),
+			sessionsEnded: zod.z.number().int(),
+			status: DeviceCredentialStatusSchema
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Hub-wide device-certificate settings. `selfEnrollment`: `allowed`
+		* (default) lets a signed-in user enroll their own device after a step-up
+		* sign-in; `disabled` makes `auth.enrollSelf` refuse. The admin QR path is
+		* unaffected. Hub-wide only (no per-role switch).
+		*/
+		getDeviceCertificateSettings: method(zod.z.object({}), DeviceCertificateSettingsSchema, { auth: "admin" }),
+		setDeviceCertificateSettings: method(DeviceCertificateSettingsSchema, DeviceCertificateSettingsSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Delete the registry row of a REVOKED credential (clean-up; the audit trail
+		* keeps the revocation). Refuses a live credential: revoke it first. After
+		* the row is gone the device's next call answers `unknown-credential`.
+		*/
+		deleteDeviceCredential: method(zod.z.object({ id: zod.z.string().min(1) }), zod.z.object({ result: zod.z.enum([
+			"deleted",
+			"live",
+			"unknown"
+		]) }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* The device CA: `absent` until the first enrollment creates it (lazily,
+		* never rotated on boot), `unavailable` while the keychain cannot answer.
+		*/
+		getDeviceCaStatus: method(zod.z.object({}), DeviceCaStatusSchema, { auth: "admin" }),
+		/** Rename a credential (the label only; the certificate is unchanged). */
+		renameDeviceCredential: method(zod.z.object({
+			id: zod.z.string().min(1),
+			deviceName: zod.z.string().min(1).max(80)
+		}), zod.z.object({ renamed: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
+* `node-certificates` - what a node holds and the two renewals the hub drives
+* (D856): the node's MESH leaf (mutual TLS to the hub) and its HTTPS leaf (issued
+* from the hub's local CA so a device that trusts the hub root trusts the node).
+*
+* Provided by the AGENT RUNTIME (the synthetic `agent-runtime` addon id, like
+* `server-management`): the hub reaches it through the ordinary node-pinned
+* capability call - no new Moleculer action. The hub's own certificates are
+* handled in-process by the hub (`certificates` router), so this cap has no hub
+* provider.
+*
+* No private key ever crosses the mesh: the node generates its key pair, sends a
+* CSR, and the hub returns only the signed certificate.
+*/
+var MeshLeafInfoSchema = zod.z.object({
+	cn: zod.z.string(),
+	serial: zod.z.string(),
+	fingerprintSha256: zod.z.string(),
+	notBefore: zod.z.number(),
+	notAfter: zod.z.number()
+});
+var HttpsLeafInfoSchema = zod.z.object({
+	fingerprintSha256: zod.z.string(),
+	issuer: zod.z.string(),
+	sans: zod.z.array(zod.z.string()),
+	notBefore: zod.z.number(),
+	notAfter: zod.z.number()
+});
+var NodeHttpsStateSchema = zod.z.discriminatedUnion("state", [zod.z.object({
+	state: zod.z.literal("served"),
+	leaf: HttpsLeafInfoSchema
+}), zod.z.object({
+	state: zod.z.literal("not-issued"),
+	reason: zod.z.string()
+})]);
+var nodeCertificatesCapability = {
+	name: "node-certificates",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/** The node's current mesh leaf (`null` when it is not enrolled on mTLS) and HTTPS state. */
+		getCertificates: method(zod.z.object({}), zod.z.object({
+			nodeId: zod.z.string(),
+			mesh: MeshLeafInfoSchema.nullable(),
+			https: NodeHttpsStateSchema
+		}), { auth: "admin" }),
+		/** Generate a NEW mesh key pair on the node; return the CSR (CN = node id). The key stays here. */
+		prepareMeshRenewal: method(zod.z.object({}), zod.z.object({ csrPem: zod.z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Install the hub-signed leaf for the key made by `prepareMeshRenewal`: persist it
+		* (keeping the previous one), then reconnect to the hub with it. The node reverts to
+		* the previous leaf by itself unless `confirmMeshLeaf` arrives within `confirmWithinMs`.
+		*/
+		installMeshLeaf: method(zod.z.object({
+			certPem: zod.z.string().min(1),
+			caCertPem: zod.z.string().min(1),
+			confirmWithinMs: zod.z.number().int().min(1e4).max(6e5)
+		}), zod.z.object({
+			fingerprintSha256: zod.z.string(),
+			serial: zod.z.string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The hub saw the node reconnect with the new leaf: keep it, forget the previous one. */
+		confirmMeshLeaf: method(zod.z.object({ fingerprintSha256: zod.z.string() }), zod.z.object({ confirmed: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Go back to the previous leaf now. `false` when there is none to go back to. */
+		rollbackMeshLeaf: method(zod.z.object({}), zod.z.object({ rolledBack: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** A key pair + CSR for the node's HTTPS leaf, and the names the node reports for itself. */
+		prepareHttpsCertificate: method(zod.z.object({}), zod.z.object({
+			csrPem: zod.z.string(),
+			hostnames: zod.z.array(zod.z.string()),
+			addresses: zod.z.array(zod.z.string()),
+			/** SHA-256 of the hub local CA this node pinned at its first install; `null` before one. */
+			pinnedCaFingerprintSha256: zod.z.string().nullable()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Install the hub-signed HTTPS leaf and hot-swap the serving context (no restart). */
+		installHttpsCertificate: method(zod.z.object({
+			certPem: zod.z.string().min(1),
+			caCertPem: zod.z.string().min(1),
+			/**
+			* The hub signals that its local CA was rotated (D227) and this leaf chains to the NEW
+			* one. Only the hub, over the authenticated mesh, can say so; a leaf with a different CA
+			* and no signal is refused.
+			*/
+			caRotation: zod.z.boolean().optional()
+		}), HttpsLeafInfoSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	mount: { kind: "skip" }
+};
 /**
 * `keychain-admin` — the operator's view of the keychain (System → Secrets).
 *
@@ -16678,6 +17096,10 @@ var deviceDiscoveryCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "session",
+	/**
+	* History (D850): none — inventory.
+	*/
+	history: "none",
 	methods: {
 		/**
 		* Snapshot of the current `discovered` list. Returns the
@@ -42298,6 +42720,10 @@ var alarmPanelCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — enum state; arm/disarm history belongs in the events ledger.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -50208,7 +50634,11 @@ var zonesCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "restored"
+	durability: "restored",
+	/**
+	* History (D850): none — configuration arrays.
+	*/
+	history: "none"
 };
 /**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
@@ -54078,6 +54508,10 @@ var streamSignalsCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "session",
+	/**
+	* History (D850): none — array state.
+	*/
+	history: "none",
 	methods: { 
 	/**
 	* What this device can emit. Empty is a valid and common answer — most
@@ -56922,6 +57356,36 @@ var airQualitySensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: {
+		co2Ppm: {
+			kind: "gauge",
+			unit: "ppm",
+			deadband: 5
+		},
+		vocPpb: {
+			kind: "gauge",
+			unit: "ppb",
+			deadband: 5
+		},
+		pm25: {
+			kind: "gauge",
+			unit: "ug/m3",
+			deadband: 1
+		},
+		pm10: {
+			kind: "gauge",
+			unit: "ug/m3",
+			deadband: 1
+		},
+		aqi: {
+			kind: "gauge",
+			unit: "count",
+			deadband: 1
+		}
+	} },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -56964,6 +57428,15 @@ var ambientLightSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. Wide range, so a RELATIVE deadband (10 %).
+	*/
+	history: { fields: { lux: {
+		kind: "gauge",
+		unit: "lx",
+		deadbandPct: 10,
+		minIntervalMs: 6e4
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -57100,7 +57573,11 @@ var audioMetricsCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — the level is the addon series `pipeline-analytics/audio-level` (producer `record`); the other numbers move every inference window and duplicate it.
+	*/
+	history: "none"
 };
 /**
 * Automation-control cap. Models HA `automation.*` entities on
@@ -57169,7 +57646,11 @@ var automationControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — configuration and transient run state.
+	*/
+	history: "none"
 };
 /**
 * Battery status snapshot. Emitted by providers whose device is
@@ -57350,6 +57831,13 @@ onStatusChanged: { data: zod.z.object({
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. The generic capture replaces the `battery` series of `pipeline-analytics:stats-5m`.
+	*/
+	history: { fields: { percentage: {
+		kind: "gauge",
+		unit: "%"
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastUpdated"]
@@ -57389,6 +57877,10 @@ var binaryCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { on: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -57451,7 +57943,15 @@ onBrightnessChanged: { data: zod.z.object({
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Actuator tier: level keeps every change.
+	*/
+	history: { fields: { percentage: {
+		kind: "gauge",
+		unit: "%",
+		minIntervalMs: 0
+	} } }
 };
 /**
 * button — device-scoped capability for HA `button.*` / `input_button.*`
@@ -57882,6 +58382,10 @@ var carbonMonoxideCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { detected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -58051,7 +58555,37 @@ var climateControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Celsius by contract; setpoints keep every change (`minIntervalMs: 0`).
+	*/
+	history: { fields: {
+		currentTemp: {
+			kind: "gauge",
+			unit: "°C",
+			deadband: .1
+		},
+		currentHumidity: {
+			kind: "gauge",
+			unit: "%",
+			deadband: .5
+		},
+		target: {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		},
+		targetHigh: {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		},
+		targetLow: {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		}
+	} }
 };
 /**
 * Color-light cap. Coexists with `switch` (on/off) and `brightness`
@@ -58168,7 +58702,11 @@ onColorChanged: { data: zod.z.object({
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — nested and cosmetic.
+	*/
+	history: "none"
 };
 var ConnectionTestOutcomeSchema = zod.z.discriminatedUnion("outcome", [
 	zod.z.object({
@@ -58242,6 +58780,10 @@ var connectivityCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — duplicates device-status.online (one authority for availability).
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -58366,6 +58908,10 @@ reset: method(zod.z.object({
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — `items` is an array keyed by runtime ids; a history path never enters it.
+	*/
+	history: "none",
 	/** Clocks, not content: a re-read that changed no item costs no commit. */
 	volatileStateFields: ["lastChangedAt", "lastFetchedAt"]
 };
@@ -58406,6 +58952,10 @@ var contactCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { entryOpen: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -58545,7 +59095,11 @@ var controlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `value` is a number/string union; configuration entity.
+	*/
+	history: "none"
 };
 /**
 * Window covering / blinds / garage door / valve cap. Models HA
@@ -58636,6 +59190,14 @@ var coverCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. Actuator tier: position keeps every tick of a movement.
+	*/
+	history: { fields: { position: {
+		kind: "gauge",
+		unit: "%",
+		minIntervalMs: 0
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -58740,6 +59302,10 @@ var dayNightCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — firmware configuration, not a measurement.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -58797,6 +59363,10 @@ onStatusChanged: { data: zod.z.object({
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. The ONE availability series.
+	*/
+	history: { fields: { online: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -58863,7 +59433,11 @@ onPressed: {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "restored"
+	durability: "restored",
+	/**
+	* History (D850): none — `pressCountSinceStart` resets with the addon, so it is not a monotonic meter; presses live in the events ledger.
+	*/
+	history: "none"
 };
 /**
 * Enum-state sensor — a string value picked from a finite option set.
@@ -58911,6 +59485,10 @@ var enumSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — text/enum state has no history (non-goal).
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -58956,7 +59534,11 @@ var eventEmitterCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `eventCountSinceStart` resets with the addon; events live in ledgers.
+	*/
+	history: "none"
 };
 var IdentitySchema = zod.z.object({
 	id: zod.z.string(),
@@ -59452,7 +60034,18 @@ var fanControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Actuator tier: speed keeps every change.
+	*/
+	history: { fields: {
+		percentage: {
+			kind: "gauge",
+			unit: "%",
+			minIntervalMs: 0
+		},
+		oscillating: { kind: "boolean" }
+	} }
 };
 /**
 * Per-device feature/identity probe slice. Holds the runtime-resolved
@@ -59535,7 +60128,11 @@ onProbeChanged: { data: zod.z.object({
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — static identity and capability probe.
+	*/
+	history: "none"
 };
 /**
 * Water leak / moisture sensor. Boolean "is liquid currently
@@ -59570,6 +60167,10 @@ var floodCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { flooded: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -59603,6 +60204,10 @@ var gasCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { detected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -59688,7 +60293,18 @@ var humidifierCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: {
+		currentHumidity: {
+			kind: "gauge",
+			unit: "%",
+			deadband: .5
+		},
+		on: { kind: "boolean" }
+	} }
 };
 /**
 * Single-metric humidity reading. Drives Home Assistant `sensor`
@@ -59732,6 +60348,14 @@ var humiditySensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { percent: {
+		kind: "gauge",
+		unit: "%",
+		deadband: .5
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -59779,7 +60403,11 @@ var imageCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — not numeric.
+	*/
+	history: "none"
 };
 /**
 * Vendor-neutral image / picture-adjustment cap — the per-camera config
@@ -59936,6 +60564,10 @@ var imageSettingsCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — camera image configuration (operator intent), not a trend.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -60339,7 +60971,11 @@ var intercomCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — talk sessions are a ledger concern, not a trend.
+	*/
+	history: "none"
 };
 /**
 * Robotic lawn-mower cap. Models HA `lawn_mower.*` entities — anything
@@ -60420,7 +61056,15 @@ var lawnMowerControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { batteryLevel: {
+		kind: "gauge",
+		unit: "%",
+		deadband: 2
+	} } }
 };
 /**
 * local-network — hub-only singleton.
@@ -61011,6 +61655,10 @@ var lockControlCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — enum state; lock events belong in the events ledger.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -61182,7 +61830,11 @@ var mediaPlayerCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `positionMs` moves continuously while playing; volume is transient.
+	*/
+	history: "none"
 };
 /**
 * mesh-network — collection cap for mesh-VPN providers.
@@ -61577,7 +62229,14 @@ onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. A PIR sensor is a series; a camera is not (its motion is an addon series and a ledger).
+	*/
+	history: { fields: { detected: {
+		kind: "boolean",
+		excludeDeviceTypes: [DeviceType.Camera]
+	} } }
 };
 /**
 * Motion-trigger toggle for accessory devices.
@@ -61649,7 +62308,11 @@ var motionTriggerCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — configuration switch.
+	*/
+	history: "none"
 };
 /**
 * Motion-zones share the same MaskShape vocabulary as privacy-mask — the
@@ -61724,6 +62387,10 @@ var motionZonesCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — configuration.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -61853,6 +62520,10 @@ var nativeObjectDetectionCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — event-like and nested per class; detections live in the objects ledger.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -62138,7 +62809,11 @@ var navigationCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — control state of a robotic camera, configuration-like.
+	*/
+	history: "none"
 };
 /**
 * Network-link snapshot. Same shape for every provider (a Reolink wifi
@@ -62218,6 +62893,23 @@ onStatusChanged: { data: zod.z.object({
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: {
+		signalPercent: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 3,
+			minIntervalMs: 6e4
+		},
+		rssiDbm: {
+			kind: "gauge",
+			unit: "dBm",
+			deadband: 2,
+			minIntervalMs: 6e4
+		}
+	} },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastUpdated"]
@@ -62671,7 +63363,11 @@ onSent: { data: zod.z.object({
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `queueDepth` is outbox operational state, not a device trend.
+	*/
+	history: "none"
 };
 /**
 * Generic numeric sensor — last-resort fallback when no typed numeric
@@ -62722,6 +63418,14 @@ var numericSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. The unit is per device, read from the sibling `unit` field.
+	*/
+	history: { fields: { value: {
+		kind: "gauge",
+		unitFrom: "unit",
+		minIntervalMs: 3e4
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -63261,7 +63965,24 @@ var petFeederCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: {
+		foodLevel: { kind: "gauge" },
+		food1: { kind: "gauge" },
+		food2: { kind: "gauge" },
+		batteryPower: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		desiccantLeftDays: {
+			kind: "gauge",
+			unit: "days"
+		}
+	} }
 };
 var VehicleSchema = zod.z.object({
 	id: zod.z.string(),
@@ -63684,6 +64405,47 @@ var powerMeterCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. Gauges are floored at 30 s; `kwhTotal` is the one monotonic meter (counter).
+	*/
+	history: { fields: {
+		watts: {
+			kind: "gauge",
+			unit: "W",
+			deadband: 1,
+			minIntervalMs: 3e4
+		},
+		kwhTotal: {
+			kind: "counter",
+			unit: "kWh",
+			deadband: .01,
+			minIntervalMs: 6e4
+		},
+		volts: {
+			kind: "gauge",
+			unit: "V",
+			deadband: 1,
+			minIntervalMs: 3e4
+		},
+		amps: {
+			kind: "gauge",
+			unit: "A",
+			deadband: .05,
+			minIntervalMs: 3e4
+		},
+		va: {
+			kind: "gauge",
+			unit: "VA",
+			deadband: 1,
+			minIntervalMs: 3e4
+		},
+		powerFactor: {
+			kind: "gauge",
+			unit: "ratio",
+			deadband: .01,
+			minIntervalMs: 6e4
+		}
+	} },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -63751,6 +64513,14 @@ var presenceCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { batteryPercent: {
+		kind: "gauge",
+		unit: "%",
+		deadband: 1
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -63797,6 +64567,14 @@ var pressureSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { hpa: {
+		kind: "gauge",
+		unit: "hPa",
+		deadband: .1
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -63956,6 +64734,10 @@ var privacyMaskCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — configuration.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -64444,7 +65226,11 @@ var ptzAutotrackCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — configuration and capability.
+	*/
+	history: "none"
 };
 /**
 * reboot — device-scoped capability for "soft" device reboots (firmware
@@ -66268,6 +67054,10 @@ var recordingOnboardCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — SD-card configuration and window inventory; arrays.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -66362,7 +67152,11 @@ getStatus: method(zod.z.object({ deviceId: zod.z.number() }), RecordingSignalSta
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — recording intent is already in the recordings ledger.
+	*/
+	history: "none"
 };
 /**
 * scene-monitor — device-scoped reference-region state cap. An operator marks
@@ -66735,7 +67529,11 @@ var sceneMonitorCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — nested configuration.
+	*/
+	history: "none"
 };
 /**
 * Per-stage gating mode applied to the zones a rule references.
@@ -66886,7 +67684,11 @@ var scriptRunnerCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — transient; run results belong in a ledger.
+	*/
+	history: "none"
 };
 /**
 * Smoke alarm sensor — boolean "is smoke currently detected" with
@@ -66921,6 +67723,10 @@ var smokeCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { detected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -67020,6 +67826,10 @@ var streamCatalogCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — stream inventory.
+	*/
+	history: "none",
 	/** Clock field: written, but excluded from the compare that decides whether
 	*  persisting is worth a SQLite commit — the descriptors are the value. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -67169,6 +67979,10 @@ var streamParamsCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — encoder configuration.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -67481,6 +68295,10 @@ var switchCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { on: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"],
@@ -68153,6 +68971,10 @@ var tamperCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { tampered: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -68208,6 +69030,14 @@ var temperatureSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { celsius: {
+		kind: "gauge",
+		unit: "°C",
+		deadband: .1
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -68293,7 +69123,11 @@ var updateCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — text and state.
+	*/
+	history: "none"
 };
 var UserSummarySchema = zod.z.object({
 	id: zod.z.string(),
@@ -68685,7 +69519,37 @@ var vacuumControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Tank levels are fixed-object paths (`cleanWater.level`, ...).
+	*/
+	history: { fields: {
+		batteryLevel: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"cleanWater.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"dirtyWater.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"detergent.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"dustBin.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		}
+	} }
 };
 /**
 * Pipe / water / gas valve cap. Models HA `valve.*` entities — anything
@@ -68762,7 +69626,15 @@ var valveCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Actuator tier: position keeps every change.
+	*/
+	history: { fields: { position: {
+		kind: "gauge",
+		unit: "%",
+		minIntervalMs: 0
+	} } }
 };
 /**
 * Vibration / shake / impact sensor. Drives Home Assistant
@@ -68792,6 +69664,10 @@ var vibrationCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { detected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -68875,7 +69751,22 @@ var waterHeaterCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. The schema carries no unit; providers publish Celsius. Setpoint keeps every change.
+	*/
+	history: { fields: {
+		currentTemp: {
+			kind: "gauge",
+			unit: "°C",
+			deadband: .5
+		},
+		targetTemp: {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		}
+	} }
 };
 /**
 * Weather provider cap. Models HA `weather.*` entities — a read-only
@@ -68941,7 +69832,32 @@ var weatherCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Units follow the sibling `*Unit` fields.
+	*/
+	history: { fields: {
+		temperature: {
+			kind: "gauge",
+			unitFrom: "temperatureUnit",
+			deadband: .2
+		},
+		humidity: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		pressure: {
+			kind: "gauge",
+			unitFrom: "pressureUnit",
+			deadband: .5
+		},
+		windSpeed: {
+			kind: "gauge",
+			unitFrom: "windSpeedUnit",
+			deadband: .5
+		}
+	} }
 };
 /**
 * Per-zone occupancy aggregation produced by the analytics frame
@@ -69183,7 +70099,11 @@ var zoneAnalyticsCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — occupancy is the addon series `pipeline-analytics/occupancy`; the rest is per-zone arrays keyed by runtime ids.
+	*/
+	history: "none"
 };
 /**
 * Stages a {@link ZoneRule} can apply to. Discriminator on the rules
@@ -69268,7 +70188,11 @@ var zoneRulesCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "restored"
+	durability: "restored",
+	/**
+	* History (D850): none — configuration arrays.
+	*/
+	history: "none"
 };
 /**
 * `training-provider` — ONE cloud that can run the CamStack trainer.
@@ -73219,6 +74143,54 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceCredentials.deleteDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.getDeviceCaStatus": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.getDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.listDeviceCredentials": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.renameDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.revokeDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.setDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.startEnrollment": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceDiscovery.adoptDevice": {
 		capName: "device-discovery",
 		capScope: "device",
@@ -75379,6 +76351,48 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.confirmMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.getCertificates": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"nodeCertificates.installHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.installMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareMeshRenewal": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.rollbackMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"nodes.clusterAddonStatus": {
 		capName: "nodes",
 		capScope: "system",
@@ -79745,6 +80759,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	detectionPipelineCapability,
 	deviceAdminLinkCapability,
 	deviceAdoptionCapability,
+	deviceCredentialsCapability,
 	deviceDiscoveryCapability,
 	deviceExportCapability,
 	deviceExtensionCapability,
@@ -79796,6 +80811,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	networkAccessCapability,
 	networkLinkCapability,
 	networkQualityCapability,
+	nodeCertificatesCapability,
 	nodesCapability,
 	notificationOutputCapability,
 	notificationRulesCapability,
@@ -82808,6 +83824,7 @@ var SESSION_ONLY_POLICY = {
 	durability: "session",
 	volatileFields: []
 };
+DeviceType.Camera;
 var G711_SCALE_CORRECTION_DB = {
 	PCMU: 20 * Math.log10(4),
 	PCMA: 20 * Math.log10(8)
@@ -84288,6 +85305,30 @@ Object.defineProperty(exports, "DERIVED_CAMERA_SILENCED_CAP_NAMES", {
 		return DERIVED_CAMERA_SILENCED_CAP_NAMES;
 	}
 });
+Object.defineProperty(exports, "DEVICE_ENROLLMENT_TTL_MS", {
+	enumerable: true,
+	get: function() {
+		return DEVICE_ENROLLMENT_TTL_MS;
+	}
+});
+Object.defineProperty(exports, "DEVICE_NONCE_TTL_MS", {
+	enumerable: true,
+	get: function() {
+		return DEVICE_NONCE_TTL_MS;
+	}
+});
+Object.defineProperty(exports, "DEVICE_SAN_CREDENTIAL_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return DEVICE_SAN_CREDENTIAL_PREFIX;
+	}
+});
+Object.defineProperty(exports, "DEVICE_SAN_USER_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return DEVICE_SAN_USER_PREFIX;
+	}
+});
 Object.defineProperty(exports, "DEVICE_SETTINGS_CONTRIBUTION_METHODS", {
 	enumerable: true,
 	get: function() {
@@ -84570,6 +85611,18 @@ Object.defineProperty(exports, "buildCapabilityLookup", {
 		return buildCapabilityLookup;
 	}
 });
+Object.defineProperty(exports, "buildDeviceEnrollmentLink", {
+	enumerable: true,
+	get: function() {
+		return buildDeviceEnrollmentLink;
+	}
+});
+Object.defineProperty(exports, "buildDeviceSignatureMessage", {
+	enumerable: true,
+	get: function() {
+		return buildDeviceSignatureMessage;
+	}
+});
 Object.defineProperty(exports, "buildFfmpegArgs", {
 	enumerable: true,
 	get: function() {
@@ -84786,6 +85839,12 @@ Object.defineProperty(exports, "describeComposableCaps", {
 		return describeComposableCaps;
 	}
 });
+Object.defineProperty(exports, "deviceCredentialsCapability", {
+	enumerable: true,
+	get: function() {
+		return deviceCredentialsCapability;
+	}
+});
 Object.defineProperty(exports, "deviceExtensionCapability", {
 	enumerable: true,
 	get: function() {
@@ -84900,6 +85959,12 @@ Object.defineProperty(exports, "foldSnapshotByFunction", {
 		return foldSnapshotByFunction;
 	}
 });
+Object.defineProperty(exports, "formatDeviceRevoker", {
+	enumerable: true,
+	get: function() {
+		return formatDeviceRevoker;
+	}
+});
 Object.defineProperty(exports, "formatMinutes", {
 	enumerable: true,
 	get: function() {