@camstack/system 1.2.454 → 1.2.456

package/dist/{dist-7ZciHCIp.mjs → dist-BSF_C8W2.mjs}

@@ -745,7 +745,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-BxjU_fJM.mjs
+//#region ../types/dist/sleep-yKL5gfrH.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -3257,6 +3257,12 @@ function normalizeAddonInitResult(result) {
 * core proxy and the kernel listener) to keep both off a kernel↔core import.
 */
 var DATAPLANE_SECRET_HEADER = "x-camstack-dataplane-secret";
+/**
+* The share-view scope kinds a share-link token can carry. The hub mints
+* and validates them (`ShareViewGrantSchema` builds its
+* enum from this list); a data plane names the kinds it ACCEPTS in `share`.
+*/
+var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
 /** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
 var PeerBytesTicketSchema = z.object({
 	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
@@ -10392,6 +10398,328 @@ function scopesAllowDeviceCap(scopes, access) {
 function scopesAllowAddon(scopes, addonId, access) {
 	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
 }
+/**
+* Zod schemas for persisted record types.
+*
+* These schemas serve as the single source of truth for types that are
+* stored in the settings-store backend and retrieved via tRPC. They
+* replace the manual TypeScript interfaces with schema-derived types,
+* enabling runtime validation when reading from the backend.
+*
+* Convention: each schema is named `<Type>Schema`, the inferred TS type
+* keeps the original name for backward compatibility.
+*/
+/**
+* Auth model (v2 — 2026-05-12 caps-only):
+*
+* Two principals:
+*   - `isAdmin: true`  — full bypass. Admin scope set is ignored.
+*   - `isAdmin: false` — every call gated by `scopes` (see TokenScope).
+*
+* No role enum. There used to be `viewer / agent / scoped` and earlier
+* `super_admin` — collapsed onto the single boolean because every
+* non-admin caller is governed by the same scope-check rules; the
+* distinction was only ever used to route role-specific procedures
+* which we no longer have. CLI / webhook integrations are tokens (`auth.mintToken`)
+* with `isAdmin: false` + an explicit scope list.
+*/
+/** Per-method access flavour. Materialised on every cap method via codegen. */
+var MethodAccessSchema = z.enum([
+	"view",
+	"create",
+	"delete"
+]);
+/**
+* A single scope grant. Three forms — checked in matcher with OR
+* semantics; the first match decides whether the call passes:
+*
+*   - `category` — broadest. `target: 'device' | 'system'` selects every
+*     cap with the matching `scope` declaration. New caps inherit grants
+*     automatically — adding a device cap to the codebase makes it
+*     reachable to every user with `category:device [...]` without a
+*     re-grant. Use this for "family viewer" / "operator" tiers.
+*
+*   - `addon` — every cap that ships inside a given addon id. Niche;
+*     useful when an integration needs to interact with one specific
+*     addon's surface regardless of how many caps it exports.
+*
+*   - `capability` — the most precise form. Single cap name. Use for
+*     integration tokens where you want to grant `addons.installPackage`
+*     and nothing else.
+*
+* `access` is REQUIRED with min 1 element. `admin` bypass is the
+* "give me everything" escape; there is no wildcard scope.
+*/
+var AllowedProviderSchema = z.union([z.literal("*"), z.array(z.string())]);
+var AllowedDevicesSchema = z.record(z.string(), z.union([z.literal("*"), z.array(z.string())]));
+var CapScopeSchema = z.enum(["device", "system"]);
+/**
+* DeviceSelector (scope model v3 — 2026-08-12).
+*
+* A `device` grant no longer carries a frozen list of deviceIds. It carries
+* a SELECTOR the matcher resolves against the live fleet, so the grant can be
+* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
+* AFTER the grant was minted — no re-grant, no re-login.
+*
+*   - `all`       — every device in the deployment. The broad viewer/operator
+*     lever without a `category` grant (a `category` grant also covers device
+*     caps that carry no deviceId; `all` is specifically the device set).
+*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
+*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
+*     is NOT covered until the grant is edited.
+*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
+*     DYNAMIC. A device that changes type, or a new device of the type,
+*     re-resolves on the next request.
+*   - `locations` — every device whose operator-assigned `location` label is
+*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
+*     null/unset location matches NO `locations` selector.
+*/
+var DeviceSelectorSchema = z.discriminatedUnion("kind", [
+	z.object({ kind: z.literal("all") }),
+	z.object({
+		kind: z.literal("ids"),
+		ids: z.array(z.number().int()).min(1)
+	}),
+	z.object({
+		kind: z.literal("types"),
+		types: z.array(z.enum(DeviceType)).min(1)
+	}),
+	z.object({
+		kind: z.literal("locations"),
+		locations: z.array(z.string().min(1)).min(1)
+	})
+]);
+var DeviceTokenScopeSchema = z.object({
+	type: z.literal("device"),
+	/** The device SET this grant covers — resolved against the live fleet. */
+	selector: DeviceSelectorSchema,
+	access: z.array(MethodAccessSchema).min(1),
+	/**
+	* Whether a grant on a PARENT device transparently covers its accessory
+	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
+	* Direction is parent → children ONLY.
+	*
+	* Absent → the matcher DERIVES it from the access flavour: `view`
+	* inherits (a camera viewer sees the camera's accessories), `create` /
+	* `delete` do NOT (actuating/removing a child is an explicit act the
+	* operator must grant on the child, not inherit from the parent). Set it
+	* explicitly to override that default per grant.
+	*/
+	includeLinked: z.boolean().optional()
+});
+/**
+* v2 → v3 lazy migration. A pre-v3 `device` grant carried
+* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
+* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
+* EVERY parse path — stored records AND the JWT-carried scope arrays
+* normalised at the request boundary ({@link normalizeTokenScopes} in
+* `device-selector.ts`). Chosen over a one-time DB migration because a
+* migration cannot reach a JWT already in a client's hands; parse-time
+* migration covers both without a flag day. No cast — the raw object is read
+* through `Reflect.get` (its static type is `unknown`).
+*/
+function migrateLegacyTokenScope(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
+	if (Reflect.get(raw, "type") !== "device") return raw;
+	if (Reflect.get(raw, "selector") !== void 0) return raw;
+	const targets = Reflect.get(raw, "targets");
+	if (!Array.isArray(targets)) return raw;
+	return {
+		type: "device",
+		selector: {
+			kind: "ids",
+			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
+		},
+		access: Reflect.get(raw, "access")
+	};
+}
+var TokenScopeSchema = z.preprocess(migrateLegacyTokenScope, z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("category"),
+		target: CapScopeSchema,
+		access: z.array(MethodAccessSchema).min(1)
+	}),
+	z.object({
+		type: z.literal("capability"),
+		target: z.string(),
+		access: z.array(MethodAccessSchema).min(1)
+	}),
+	z.object({
+		type: z.literal("addon"),
+		target: z.string(),
+		access: z.array(MethodAccessSchema).min(1)
+	}),
+	DeviceTokenScopeSchema
+]));
+var UserRecordSchema = z.object({
+	id: z.string(),
+	username: z.string(),
+	passwordHash: z.string(),
+	/**
+	* Admin bypass. When true, the middleware skips the scope-access
+	* check entirely. There is no other axis of privilege; the legacy
+	* role enum collapsed onto this boolean in v2.
+	*/
+	isAdmin: z.boolean().default(false),
+	allowedProviders: AllowedProviderSchema,
+	allowedDevices: AllowedDevicesSchema,
+	/**
+	* Scopes granted to this user. Admins bypass; their `scopes` is
+	* ignored. Non-admins without scopes are locked out of every
+	* protected call.
+	*/
+	scopes: z.array(TokenScopeSchema).default([]),
+	createdAt: z.number(),
+	updatedAt: z.number()
+});
+var ApiKeyRecordSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	isAdmin: z.boolean().default(false),
+	allowedProviders: AllowedProviderSchema,
+	allowedDevices: AllowedDevicesSchema,
+	tokenHash: z.string(),
+	tokenPrefix: z.string(),
+	createdAt: z.number(),
+	lastUsedAt: z.number().optional()
+});
+var ScopedTokenSchema = z.object({
+	id: z.string(),
+	userId: z.string(),
+	name: z.string(),
+	tokenHash: z.string(),
+	tokenPrefix: z.string(),
+	scopes: z.array(TokenScopeSchema),
+	expiresAt: z.number().nullish(),
+	lastUsedAt: z.number().nullish(),
+	createdAt: z.number()
+});
+/** What a share-view grant lets its holder see. */
+var ShareViewGrantSchema = z.object({
+	kind: z.enum(SHARE_VIEW_KINDS),
+	deviceIds: z.array(z.number().int().nonnegative()).min(1).max(64),
+	/** Talk-back, opt-in at mint time; absent means off. */
+	talk: z.boolean().optional()
+});
+var ShareViewScopeSchema = z.object({
+	type: z.literal("share-view"),
+	grant: ShareViewGrantSchema
+});
+var AddonRoutesScopeSchema = z.object({
+	type: z.literal("addon-routes"),
+	access: z.array(MethodAccessSchema).min(1)
+});
+var PreferencesSelfScopeSchema = z.object({ type: z.literal("preferences-self") });
+var CredentialScopeSchema = z.union([
+	z.literal("*"),
+	ShareViewScopeSchema,
+	AddonRoutesScopeSchema,
+	PreferencesSelfScopeSchema,
+	TokenScopeSchema
+]);
+/**
+* The `kind` claim of a unified token. It names the TOKEN FAMILY (so every
+* older gate that classifies a hub JWT refuses it — `classifyBearerPrincipal`
+* treats any `kind` it does not know as not-a-credential), never what the
+* token may do: that is its `scopes`, and only its `scopes`.
+*/
+var CREDENTIAL_TOKEN_KIND = "credential";
+/**
+* The `aud` claim every minted token is signed with (D895). The hub's raw JWT
+* verify (`AuthManager.verifyToken`, used by every surface that wants a LOGIN
+* session — the OAuth consent page, the session cookie, health, backups)
+* refuses a token carrying it, so a minted token — a share link above all —
+* can never be replayed as a person's session. Only the credential verifier's
+* own door (`verifyCredentialToken`) accepts it.
+*/
+var CREDENTIAL_TOKEN_AUDIENCE = "camstack:credential";
+/** Does a verified JWT payload belong to the minted-token family? */
+function isCredentialTokenPayload(payload) {
+	if (payload === null || typeof payload !== "object") return false;
+	const kind = Reflect.get(payload, "kind");
+	const aud = Reflect.get(payload, "aud");
+	return kind === "credential" || aud === "camstack:credential" || Array.isArray(aud) && aud.includes("camstack:credential");
+}
+/**
+* The claims of a unified token (`auth.mintToken`). It carries no `exp`: its
+* row (looked up by `jti` on every verify, for revocation) holds the ONE
+* expiry, so a share link can be extended and a JWT clock can never disagree
+* with the row.
+*/
+var CredentialTokenClaimsSchema = z.object({
+	kind: z.literal(CREDENTIAL_TOKEN_KIND),
+	sub: z.string().min(1),
+	jti: z.string().min(16),
+	scopes: z.array(CredentialScopeSchema).min(1)
+});
+/**
+* Per-user ACCOUNT preferences (D894): the hub-side half of the viewer's two
+* settings levels.
+*
+*   - DEVICE settings never leave the phone.
+*   - ACCOUNT settings live here: one row per `(user, namespace)`, private to
+*     that user, synced across every device signed in as them, last write wins
+*     unless the writer sends the revision it based its edit on.
+*
+* A setting lives in exactly ONE level; there are no overrides. The caller
+* never names a user: the hub stamps the principal's own id, admin included.
+*
+* The contract the client codes against is the `preferences.*` tRPC router
+* (`server/backend/src/api/core/preferences.router.ts`).
+*/
+/** `viewer.app`, `viewer.cameras`, `viewer.grids` … — lowercase, dot/dash separated. */
+var PREFERENCES_NAMESPACE_PATTERN = /^[a-z][a-z0-9.-]{0,63}$/;
+/** One row's value, measured as UTF-8 JSON. */
+var PREFERENCES_MAX_VALUE_BYTES = 256 * 1024;
+var PreferenceNamespaceSchema = z.string().regex(PREFERENCES_NAMESPACE_PATTERN);
+/** A namespace's value: a JSON object, opaque to the hub. */
+var PreferenceValueSchema = z.record(z.string(), z.unknown());
+var PreferenceDeviceIdSchema = z.string().min(1).max(64);
+/** A stored row, as the owner reads it. */
+var PreferenceRowSchema = z.object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/** Starts at 1, +1 on every write of this namespace. A delete ends the row and its count. */
+	revision: z.number().int().positive(),
+	updatedAt: z.number().int(),
+	/** The client id the last writer sent; `null` when it sent none. */
+	updatedByDevice: PreferenceDeviceIdSchema.nullable()
+});
+z.object({ 
+/** Absent: every namespace the caller holds. */
+namespaces: z.array(PreferenceNamespaceSchema).max(32).optional() });
+z.object({ rows: z.array(PreferenceRowSchema) });
+z.object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/**
+	* The revision the edit was based on. Absent: last write wins. `0`: the
+	* namespace must not exist yet. Any other value that is not the current
+	* revision answers `conflict` and writes nothing.
+	*/
+	baseRevision: z.number().int().nonnegative().optional(),
+	deviceId: PreferenceDeviceIdSchema.optional()
+});
+z.discriminatedUnion("status", [z.object({
+	status: z.literal("saved"),
+	row: PreferenceRowSchema
+}), z.object({
+	status: z.literal("conflict"),
+	current: PreferenceRowSchema.nullable()
+})]);
+z.object({ namespace: PreferenceNamespaceSchema });
+z.object({ 
+/** `false` when the namespace did not exist. */
+deleted: z.boolean() });
+z.object({ 
+/** The revision the client holds per namespace; a namespace it does not list is new to it. */
+revisionByNamespace: z.record(PreferenceNamespaceSchema, z.number().int().nonnegative()).refine((map) => Object.keys(map).length <= 32, { message: `at most 32 namespaces` }) });
+z.object({
+	/** Every row whose revision differs from the client's, and every row it did not list. */
+	rows: z.array(PreferenceRowSchema),
+	/** Namespaces the client listed that no longer exist. */
+	deleted: z.array(PreferenceNamespaceSchema)
+});
 z.enum(["new-session", "step-up"]);
 /** The languages the hub's app landing pages are written in (D858). */
 var AppPageLangSchema = z.enum(["en", "it"]);
@@ -41988,38 +42316,37 @@ var llmRuntimeCapability = {
 		})
 	}
 };
+var LlmProfileKindSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "a kind id is lower-case letters, digits and dashes");
+/** What a model (or, by default, every model of a kind) can do. */
+var LlmModelFeaturesSchema = z.object({
+	vision: z.boolean(),
+	tools: z.boolean(),
+	streaming: z.boolean()
+});
+/** One model a provider offers. `features` overrides the kind's defaults, per field. */
+var LlmModelInfoSchema = z.object({
+	id: z.string(),
+	label: z.string().optional(),
+	contextLength: z.number().int().positive().optional(),
+	features: LlmModelFeaturesSchema.partial().optional()
+});
 /**
-* `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
-* methods concat-fan across providers; single-row methods route to ONE
-* provider by the `addonId` in the call input (the notification-output
-* posture, notification-output.cap.ts:215-250). Provided by `addon-ai`
-* (hub-placed); the cap stays open for future providers.
-*
-* Profiles are ROWS (data), not addons: one row = one usable model endpoint.
-* `apiKey` is a password field — providers REDACT it on read and merge on
-* write; a stored key NEVER round-trips to a client.
-*/
-var LlmProfileKindSchema = z.enum([
-	"openai-compatible",
-	"openai",
-	"anthropic",
-	"google",
-	"managed-local",
-	"apple-foundation"
-]);
+* The provider-specific part of a profile, validated by the provider that owns
+* the kind (`upsertProfile` refuses what it does not accept). A field its
+* `connectionSchema` declares `type: 'password'` is a secret: it is held in the
+* keychain, never in the row, and reads back as the redaction marker.
+*/
+var LlmProviderConfigSchema = z.record(z.string(), z.unknown());
 var LlmProfileSchema = z.object({
 	id: z.string(),
 	name: z.string(),
+	/** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
 	kind: LlmProfileKindSchema,
 	/** Stamped by the provider — keeps the fanned catalog routable. */
 	addonId: z.string(),
 	enabled: z.boolean(),
 	/** Vendor model id, or the managed runtime's loaded model. */
 	model: z.string(),
-	/** Required for openai-compatible; override for cloud kinds. */
-	baseUrl: z.string().optional(),
-	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
-	apiKey: z.string().optional(),
 	/** Vision on/off. A vision call against a `false` profile is REFUSED, never
 	*  degraded to text — that shipped once and produced a confident answer to a
 	*  question about a picture nobody sent. */
@@ -42027,15 +42354,11 @@ var LlmProfileSchema = z.object({
 	temperature: z.number().min(0).max(2).optional(),
 	/** Nucleus sampling. Every wire we speak has it. */
 	topP: z.number().min(0).max(1).optional(),
-	/** Top-k sampling. Carried only by the wires that have it — NEITHER OpenAI
-	*  wire does, and the client drops it there (measured: the request body gets
-	*  `top_p` and no `top_k`). The profile editor hides the field wherever it
-	*  would change nothing; `KINDS_WITH_TOP_K` is the single owner of that list. */
+	/** Top-k sampling. Carried only by the wires that have it — a kind offers the
+	*  field in its editor only when its descriptor lists it in `profileFields`. */
 	topK: z.number().int().positive().optional(),
 	maxTokens: z.number().int().positive().optional(),
-	/** Prompt context window. Advisory for cloud kinds (they enforce their own);
-	*  for `managed-local` it is the llama.cpp `--ctx-size` the runtime starts
-	*  the model with, so it is the one field that changes a PROCESS. */
+	/** Prompt context window. Advisory for cloud kinds (they enforce their own). */
 	contextLength: z.number().int().positive().optional(),
 	/** Default system prompt. A caller's `system` REPLACES it (never appends —
 	*  two system prompts fighting is worse than either alone). */
@@ -42061,16 +42384,37 @@ var LlmProfileSchema = z.object({
 	*  library; the REGISTRY of callable tools is ours and is empty in v1, so a
 	*  `true` here buys the wiring, not behaviour, until tools are registered. */
 	toolsEnabled: z.boolean().default(false),
-	extraHeaders: z.record(z.string(), z.string()).optional(),
-	/** kind === 'managed-local' only (spec §4). */
-	runtime: ManagedRuntimeConfigSchema.optional(),
-	/**
-	* kind === 'apple-foundation' only: WHERE it runs — the only thing there is
-	* to configure (no key, no URL, no download; `model` is `apple-system`).
-	* `supportsVision` on such a row is stamped by the provider from the node's
-	* reported `imageInput`, never taken from the operator (D62).
-	*/
-	appleFoundation: z.object({ nodeId: z.string() }).optional()
+	/** Everything the kind's provider owns (endpoint, key, node, runtime…). */
+	providerConfig: LlmProviderConfigSchema.default({})
+});
+/**
+* The common profile fields a kind's editor offers. The editor owns how each
+* one is drawn; the provider says which of them mean something on its wire.
+*/
+var LlmProfileFieldSchema = z.enum([
+	"temperature",
+	"topP",
+	"topK",
+	"maxTokens",
+	"contextLength",
+	"systemPrompt",
+	"timeoutMs",
+	"connectTimeoutMs",
+	"firstTokenTimeoutMs",
+	"idleTimeoutMs",
+	"retry",
+	"toolsEnabled"
+]);
+/**
+* A provider-drawn part of the editor, by a generic widget id the admin UI
+* registers (`ai/apple-node`). `placement: 'model'` replaces the generic model
+* picker: that widget owns the model choice.
+*/
+var LlmProviderWidgetSchema = z.object({
+	id: z.string(),
+	placement: z.enum(["connection", "model"]),
+	/** `providerConfig` keys this widget must fill before the profile can be saved. */
+	requires: z.array(z.string()).optional()
 });
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
@@ -42079,11 +42423,56 @@ var ConfigSchemaPassthrough$3 = z.unknown();
 var LlmProfileKindDescriptorSchema = z.object({
 	kind: LlmProfileKindSchema,
 	label: z.string(),
+	/** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
 	icon: z.string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: z.string(),
-	configSchema: ConfigSchemaPassthrough$3
+	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
+	connectionSchema: ConfigSchemaPassthrough$3,
+	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
+	advancedSchema: ConfigSchemaPassthrough$3.optional(),
+	/** The kind's defaults; a model from `listModels` may override any of them. */
+	features: LlmModelFeaturesSchema,
+	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
+	visionEditable: z.boolean(),
+	/** Where the model list comes from: `listModels`, `staticModels`, or nowhere. */
+	modelCatalog: z.enum([
+		"fetch",
+		"static",
+		"none"
+	]),
+	staticModels: z.array(LlmModelInfoSchema).optional(),
+	/** The common fields that mean something on this kind's wire. */
+	profileFields: z.array(LlmProfileFieldSchema),
+	providerWidgets: z.array(LlmProviderWidgetSchema).optional()
+});
+/**
+* `listModels` input. `connection` is an UNSAVED draft of `providerConfig`
+* (the editor's form); with `profileId` too, a secret the draft leaves
+* untouched (absent or the redaction marker) is resolved server-side from the
+* stored profile — the browser never receives it.
+*/
+var LlmListModelsInputSchema = z.object({
+	addonId: z.string(),
+	kind: LlmProfileKindSchema,
+	profileId: z.string().optional(),
+	connection: LlmProviderConfigSchema.optional()
 });
+var LlmListModelsErrorCodeSchema = z.enum([
+	"auth",
+	"network",
+	"unsupported",
+	"invalid"
+]);
+/** A RESULT, never a throw: "wrong key" is an answer the editor renders inline. */
+var LlmListModelsResultSchema = z.discriminatedUnion("ok", [z.object({
+	ok: z.literal(true),
+	models: z.array(LlmModelInfoSchema)
+}), z.object({
+	ok: z.literal(false),
+	code: LlmListModelsErrorCodeSchema,
+	message: z.string()
+})]);
 var LlmDefaultSelectorSchema = z.union([z.object({ consumer: z.string() }), z.object({ purpose: z.enum(["text", "vision"]) })]);
 var LlmDefaultSchema = z.object({
 	selector: LlmDefaultSelectorSchema,
@@ -42214,8 +42603,17 @@ var llmCapability = {
 			auth: "admin",
 			timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
 		}),
-		/** Live vendor enumeration (GET /models etc.). */
-		listModels: method(ProfileRefInputSchema, z.array(z.string())),
+		/**
+		* The models a kind offers, for a SAVED profile or an unsaved draft
+		* (`connection`). A mutation, not a query: a draft may carry a key, and a
+		* query's input travels in the URL. Admin: it dials whatever endpoint the
+		* draft names and may resolve a stored key to do it. The answer never
+		* carries a secret — failures are a typed result, never a throw.
+		*/
+		listModels: method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		getDefaults: method(z.object({}), z.array(LlmDefaultSchema)),
 		setDefault: method(z.object({
 			selector: LlmDefaultSelectorSchema,
@@ -46812,202 +47210,6 @@ var notificationRulesCapability = {
 	}
 };
 /**
-* Zod schemas for persisted record types.
-*
-* These schemas serve as the single source of truth for types that are
-* stored in the settings-store backend and retrieved via tRPC. They
-* replace the manual TypeScript interfaces with schema-derived types,
-* enabling runtime validation when reading from the backend.
-*
-* Convention: each schema is named `<Type>Schema`, the inferred TS type
-* keeps the original name for backward compatibility.
-*/
-/**
-* Auth model (v2 — 2026-05-12 caps-only):
-*
-* Two principals:
-*   - `isAdmin: true`  — full bypass. Admin scope set is ignored.
-*   - `isAdmin: false` — every call gated by `scopes` (see TokenScope).
-*
-* No role enum. There used to be `viewer / agent / scoped` and earlier
-* `super_admin` — collapsed onto the single boolean because every
-* non-admin caller is governed by the same scope-check rules; the
-* distinction was only ever used to route role-specific procedures
-* which we no longer have. CLI / webhook integrations are `cst_*` tokens
-* with `isAdmin: false` + an explicit scope list.
-*/
-/** Per-method access flavour. Materialised on every cap method via codegen. */
-var MethodAccessSchema = z.enum([
-	"view",
-	"create",
-	"delete"
-]);
-/**
-* A single scope grant. Three forms — checked in matcher with OR
-* semantics; the first match decides whether the call passes:
-*
-*   - `category` — broadest. `target: 'device' | 'system'` selects every
-*     cap with the matching `scope` declaration. New caps inherit grants
-*     automatically — adding a device cap to the codebase makes it
-*     reachable to every user with `category:device [...]` without a
-*     re-grant. Use this for "family viewer" / "operator" tiers.
-*
-*   - `addon` — every cap that ships inside a given addon id. Niche;
-*     useful when an integration needs to interact with one specific
-*     addon's surface regardless of how many caps it exports.
-*
-*   - `capability` — the most precise form. Single cap name. Use for
-*     integration tokens where you want to grant `addons.installPackage`
-*     and nothing else.
-*
-* `access` is REQUIRED with min 1 element. `admin` bypass is the
-* "give me everything" escape; there is no wildcard scope.
-*/
-var AllowedProviderSchema = z.union([z.literal("*"), z.array(z.string())]);
-var AllowedDevicesSchema = z.record(z.string(), z.union([z.literal("*"), z.array(z.string())]));
-var CapScopeSchema = z.enum(["device", "system"]);
-/**
-* DeviceSelector (scope model v3 — 2026-08-12).
-*
-* A `device` grant no longer carries a frozen list of deviceIds. It carries
-* a SELECTOR the matcher resolves against the live fleet, so the grant can be
-* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
-* AFTER the grant was minted — no re-grant, no re-login.
-*
-*   - `all`       — every device in the deployment. The broad viewer/operator
-*     lever without a `category` grant (a `category` grant also covers device
-*     caps that carry no deviceId; `all` is specifically the device set).
-*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
-*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
-*     is NOT covered until the grant is edited.
-*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
-*     DYNAMIC. A device that changes type, or a new device of the type,
-*     re-resolves on the next request.
-*   - `locations` — every device whose operator-assigned `location` label is
-*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
-*     null/unset location matches NO `locations` selector.
-*/
-var DeviceSelectorSchema = z.discriminatedUnion("kind", [
-	z.object({ kind: z.literal("all") }),
-	z.object({
-		kind: z.literal("ids"),
-		ids: z.array(z.number().int()).min(1)
-	}),
-	z.object({
-		kind: z.literal("types"),
-		types: z.array(z.enum(DeviceType)).min(1)
-	}),
-	z.object({
-		kind: z.literal("locations"),
-		locations: z.array(z.string().min(1)).min(1)
-	})
-]);
-var DeviceTokenScopeSchema = z.object({
-	type: z.literal("device"),
-	/** The device SET this grant covers — resolved against the live fleet. */
-	selector: DeviceSelectorSchema,
-	access: z.array(MethodAccessSchema).min(1),
-	/**
-	* Whether a grant on a PARENT device transparently covers its accessory
-	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
-	* Direction is parent → children ONLY.
-	*
-	* Absent → the matcher DERIVES it from the access flavour: `view`
-	* inherits (a camera viewer sees the camera's accessories), `create` /
-	* `delete` do NOT (actuating/removing a child is an explicit act the
-	* operator must grant on the child, not inherit from the parent). Set it
-	* explicitly to override that default per grant.
-	*/
-	includeLinked: z.boolean().optional()
-});
-/**
-* v2 → v3 lazy migration. A pre-v3 `device` grant carried
-* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
-* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
-* EVERY parse path — stored records AND the JWT-carried scope arrays
-* normalised at the request boundary ({@link normalizeTokenScopes} in
-* `device-selector.ts`). Chosen over a one-time DB migration because a
-* migration cannot reach a JWT already in a client's hands; parse-time
-* migration covers both without a flag day. No cast — the raw object is read
-* through `Reflect.get` (its static type is `unknown`).
-*/
-function migrateLegacyTokenScope(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
-	if (Reflect.get(raw, "type") !== "device") return raw;
-	if (Reflect.get(raw, "selector") !== void 0) return raw;
-	const targets = Reflect.get(raw, "targets");
-	if (!Array.isArray(targets)) return raw;
-	return {
-		type: "device",
-		selector: {
-			kind: "ids",
-			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
-		},
-		access: Reflect.get(raw, "access")
-	};
-}
-var TokenScopeSchema = z.preprocess(migrateLegacyTokenScope, z.discriminatedUnion("type", [
-	z.object({
-		type: z.literal("category"),
-		target: CapScopeSchema,
-		access: z.array(MethodAccessSchema).min(1)
-	}),
-	z.object({
-		type: z.literal("capability"),
-		target: z.string(),
-		access: z.array(MethodAccessSchema).min(1)
-	}),
-	z.object({
-		type: z.literal("addon"),
-		target: z.string(),
-		access: z.array(MethodAccessSchema).min(1)
-	}),
-	DeviceTokenScopeSchema
-]));
-var UserRecordSchema = z.object({
-	id: z.string(),
-	username: z.string(),
-	passwordHash: z.string(),
-	/**
-	* Admin bypass. When true, the middleware skips the scope-access
-	* check entirely. There is no other axis of privilege; the legacy
-	* role enum collapsed onto this boolean in v2.
-	*/
-	isAdmin: z.boolean().default(false),
-	allowedProviders: AllowedProviderSchema,
-	allowedDevices: AllowedDevicesSchema,
-	/**
-	* Scopes granted to this user. Admins bypass; their `scopes` is
-	* ignored. Non-admins without scopes are locked out of every
-	* protected call.
-	*/
-	scopes: z.array(TokenScopeSchema).default([]),
-	createdAt: z.number(),
-	updatedAt: z.number()
-});
-var ApiKeyRecordSchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	isAdmin: z.boolean().default(false),
-	allowedProviders: AllowedProviderSchema,
-	allowedDevices: AllowedDevicesSchema,
-	tokenHash: z.string(),
-	tokenPrefix: z.string(),
-	createdAt: z.number(),
-	lastUsedAt: z.number().optional()
-});
-var ScopedTokenSchema = z.object({
-	id: z.string(),
-	userId: z.string(),
-	name: z.string(),
-	tokenHash: z.string(),
-	tokenPrefix: z.string(),
-	scopes: z.array(TokenScopeSchema),
-	expiresAt: z.number().nullish(),
-	lastUsedAt: z.number().nullish(),
-	createdAt: z.number()
-});
-/**
 * `oauth-integration` — a collection cap by which an addon declares
 * itself a linkable OAuth client of the hub's core `/oauth2/*` server.
 * Each provider returns a static descriptor; the core enumerates them
@@ -71304,26 +71506,6 @@ var ApiKeySummarySchema = z.object({
 	createdAt: z.number(),
 	lastUsedAt: z.number().optional()
 });
-var ScopedTokenSummarySchema = z.object({
-	id: z.string(),
-	userId: z.string(),
-	name: z.string(),
-	tokenPrefix: z.string(),
-	scopes: z.array(TokenScopeSchema),
-	expiresAt: z.number().nullish(),
-	lastUsedAt: z.number().nullish(),
-	createdAt: z.number()
-});
-var CreateScopedTokenInputSchema = z.object({
-	userId: z.string(),
-	name: z.string(),
-	scopes: z.array(TokenScopeSchema),
-	expiresAt: z.number().optional()
-});
-var CreateScopedTokenResultSchema = z.object({
-	token: z.string(),
-	record: ScopedTokenSummarySchema
-});
 var OauthSessionSummarySchema = z.object({
 	id: z.string(),
 	userId: z.string(),
@@ -71345,11 +71527,11 @@ var TotpStatusSchema = z.object({
 	confirmedAt: z.number().nullable()
 });
 /**
-* user-management — singleton capability for user accounts, API keys,
-* and scoped tokens.
+* user-management — singleton capability for user accounts and the
+* legacy API-key rows.
 *
 * v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
-* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* — the subset check on `setUserScopes` is moot
 * because non-admins never reach these. If/when we open non-admin
 * delegation, structural caller-scope subset check goes inside the
 * provider.
@@ -71420,18 +71602,6 @@ var userManagementCapability = {
 			auth: "admin",
 			access: "delete"
 		}),
-		createScopedToken: method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
-		revokeScopedToken: method(z.object({ id: z.string() }), z.object({ success: z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin",
-			access: "delete"
-		}),
-		validateScopedToken: method(z.object({ token: z.string() }), ScopedTokenSummarySchema.nullable(), { access: "view" }),
-		listScopedTokens: method(z.object({ userId: z.string() }), z.array(ScopedTokenSummarySchema), { auth: "admin" }),
 		setupTotp: method(z.object({ userId: z.string() }), TotpSetupResultSchema, {
 			kind: "mutation",
 			auth: "admin",
@@ -77920,7 +78090,7 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		capName: "llm",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
 	"llm.listNodeModels": {
 		capName: "llm",
@@ -82584,12 +82754,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.createScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.createUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -82638,12 +82802,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.listScopedTokens": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.listUsers": {
 		capName: "user-management",
 		capScope: "system",
@@ -82698,12 +82856,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
-	"userManagement.revokeScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"userManagement.setupTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -82734,12 +82886,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.validateScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.verifyTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -88324,4 +88470,4 @@ function armRemovalReconcile(opts) {
 	return () => clearInterval(timer);
 }
 //#endregion
-export { STORAGE_ADMIN_SCOPED_BASES as $, normalizeSecretOwner as $i, resolveBucketMs as $n, FilterRequiredError as $r, enumerateItemArrayFields as $t, DataStoreDatabaseSchema as A, collectSecretMarkerRefs as Ai, logLevelAtMost as An, COMPOSER_ADDON_ID as Ar, compositionFieldKey as At, KEYCHAIN_RESET_TRIGGER_ACTOR as B, formatSecretScope as Bi, objectInputDeclaresAddonId as Bn, disarmRoseMemory as Br, declarationOwnerNodeId as Bt, DAY_NAMES as C, asJsonObject as Ci, keychainCapability as Cn, userManagementCapability as Cr, buildDeviceSignatureMessage as Ct, DEVICE_SAN_CREDENTIAL_PREFIX as D, buildSecretRef as Di, localNetworkCapability as Dn, vectorIndexDimConflictError as Dr, canonicalIconKey as Dt, DEVICE_NONCE_TTL_MS as E, assertValidDeclaration as Ei, lifecycleJobSchema as En, vectorDimFromBase64 as Er, cameraGridLayoutCapability as Et, FieldClaimModeSchema as F, defineCustomActions as Fi, metricsProviderCapability as Fn, compositionFeatureEnabled as Fr, coreBlockSourceKind as Ft, METHOD_ACCESS_MAP as G, isSecretClear as Gi, platformProbeCapability as Gn, errMsg as Gr, deviceCredentialsCapability as Gt, KeychainResetRecordSchema as H, isDeviceConfigCap as Hi, parseStreamParamsFormPatch as Hn, DeviceFeature as Hr, defineExtensionSlotProvider as Ht, FieldClaimSchema as I, defineRecordKinds as Ii, modeMayWrite as In, compositionItemFieldPath as Ir, coreBlocksCapability as It, NetworkTunnelStartedDataSchema as J, isSecretRefOwnedBy as Ji, recordEntriesCapability as Jn, CALLER_STAMPED_CAPABILITIES as Jr, deviceManagerCapability as Jt, MINUTES_PER_DAY as K, isSecretMarker as Ki, procedureAuthKey as Kn, BaseAddon as Kr, deviceExtensionCapability as Kt, HISTORY_CATALOG as L, emitDownForOwnedCaps as Li, motionCapability as Ln, compositionSliceKey as Lr, createDeviceExtensionProvider as Lt, DeviceStatusSchema as M, createEvent as Mi, mayReadLocation as Mn, cloneStatefulExpressionMemory as Mr, coreBlockAddonId as Mt, DeviceTombstoneSchema as N, customAction as Ni, mayWriteToLocation as Nn, composedDeviceRef as Nr, coreBlockComposition as Nt, DEVICE_SAN_USER_PREFIX as O, collectSecretConfigKeys as Oi, locationIconKey as On, vectorStoreCapability as Or, checkRoleAddress as Ot, FIRST_LEVEL_MACRO_CLASSES as P, declarationsOf as Pi, memoizePinnedFfmpeg as Pn, composedDeviceStableId as Pr, coreBlockIdFromAddonId as Pt, STORAGE_ADMIN_MOVED_COLLECTIONS as Q, normalizeNodeId as Qi, resolveAppConnections as Qn, DeclarationRefusedError as Qr, enumerateInferenceDevices as Qt, HUB_MDNS_SERVICE_TYPE as R, emitReadiness as Ri, normalizeCoreBlockWrite as Rn, compositionSourceKey as Rr, dataStoreProviderCapability as Rt, DATA_STORE_DATABASES as S, WELL_KNOWN_TAB_MAP as Si, keychainAdminCapability as Sn, supportedRuntimes as Sr, buildDeviceEnrollmentLink as St, DEVICE_ENROLLMENT_TTL_MS as T, asString$1 as Ti, legacyModeOf as Tn, validateCustomAddress as Tr, calendarsCapability as Tt, LOG_LEVEL_RANK as U, isEvent as Ui, pickAppLinkHub as Un, DeviceRole as Ur, deriveBatteryPresence as Ut, KeychainAuditEntrySchema as V, hydrateSchema as Vi, objectInputDeclaresRequiredDeviceId as Vn, toExpressionValue as Vr, decodeVectorBase64 as Vt, LegacyStorageLocationDefaultSchema as W, isKeychainStoredField as Wi, planComposition as Wn, DeviceType as Wr, describeComposableCaps as Wt, RecordingStatusSchema as X, mapSecretLeaves as Xi, reducePoints as Xn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Xr, deviceStateCapability as Xt, RECORDING_SOURCE_CAMSTACK_ADDON as Y, makeSecretMarker as Yi, recordsCapability as Yn, DATAPLANE_SECRET_HEADER as Yr, deviceRemovalHookCapability as Yt, STORAGE_ACCESS_FALLBACK as Z, nodePin as Zi, replacedFieldKeys as Zn, DEVICE_STATUS_METHOD as Zr, deviceStatusCapability as Zt, CatalogFileSchema as _, withoutCallerStamp as _a, RecordUniqueViolationError as _i, isDefaultAppConnectionEndpoint as _n, storageMigrationCapability as _r, authProviderCapability as _t, ApiKeyRecordSchema as a, readinessKey as aa, RECORD_BATCH_MAX as ai, extractNestedAddonId as an, resolveNotificationTapAddress as ar, StorageLocationModeSchema as at, DATABASE_SNAPSHOT_SUFFIX as b, UnindexedFilterError as bi, isVoidInput as bn, streamCatalogCapability as br, batteryCapability as bt, CAMERA_SWITCH_ORDER as c, resolveSecretMarkers as ca, RECORD_SWEEP_INTERVAL_MS as ci, formatDeviceRevoker as cn, scopesAllowDeviceCap as cr, TokenScopeSchema as ct, CATALOG_LANGS as d, secretTreeFromSchema as da, RUNTIME_DEFAULTS as di, interpolate as dn, shortHostname as dr, addonSettingsCapability as dt, parseJsonObject as ea, ForeignSecretMarkerError as ei, enumerateSchemaFields as en, resolveCoreBlockEntry as er, STREAM_PROFILE_META as et, COMPOSED_ITEM_FIXED_FIELDS as f, sleep as fa, ReadinessRegistry as fi, isAlertEpisodeOpen as fn, siteZoneKey as fr, addonWidgetsCapability as ft, CalendarPreferencesSchema as g, userError as ga, RecordTooLargeError as gi, isCollectionArrayMethod as gn, storageCapability as gr, armRemovalReconcile as gt, CORE_BLOCK_ADDON_PREFIX as h, transformSecretWrite as ha, RecordNotFoundError as hi, isArrayOutputSchema as hn, storageAdminCapability as hr, alertsCapability as ht, AlertSchema as i, parseSettingsBrokersAdoptsFrom as ia, PlaintextSecretError as ii, expressionContainsBuiltinCall as in, resolveMethodAuth as ir, StorageCleanupJobSchema as it, DeclaredDevices as j, collectZodSecretPaths as ji, looseSchema as jn, buildFfmpegArgs as jr, compositionSourceRefs as jt, DEVICE_TOMBSTONE_RETENTION_MS as k, collectSecretLeaves as ki, logDestinationCapability as kn, withLocationMode as kr, composerCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, scopeKey as la, REDACTED_SECRET as li, formatMinutes as ln, scoreRuntimes as lr, UserRecordSchema as lt, CORE_BLOCKS_ADDON_ID as m, toSecretFieldView as ma, RecordKindDeclarationSchema as mi, isAppLinkBase as mn, splitTranslationRef as mr, alertEpisodePayload as mt, AGENT_MDNS_TXT_KEYS as n, parseSecretRef as na, InvalidRecordError as ni, evictionPolicyOfLocation as nn, resolveHubAddressRoles as nr, ServerNameSchema as nt, BaseDevice as o, recordSecretRef as oa, RECORD_BATCH_MAX_BYTES as oi, filesystemBrowseCapability as on, runtimeStatePolicyFor as or, StorageLocationTypeSchema as ot, COMPOSER_RUNNER_ID as p, toNodeId as pa, ReadinessTimeoutError as pi, isAlertEpisodeSeverity as pn, snapshotCapability as pr, alertEpisodeId as pt, MOTION_CLOSE_AFTER_MS as q, isSecretMarkerLike as qi, ptzAutotrackCapability as qn, BatchTooLargeError as qr, deviceHistoryCapability as qt, ALL_CAPABILITY_DEFINITIONS as r, parseSettingsArrayAdoptsFrom as ra, NoCallerError as ri, expandContainer as rn, resolveLocationMode as rr, SsoBridgeClaimsSchema as rt, BatteryStatusSchema as s, resolveCapMount as sa, RECORD_DELETE_BATCH as si, foldSnapshotByFunction as sn, scopesAllowAddon as sr, StorageMigrationJobSchema as st, AGENT_MDNS_SERVICE_TYPE as t, parseJsonUnknown as ta, HISTORY_DEFAULT_MIN_INTERVAL_MS as ti, evaluateCompositionField as tn, resolveCoreBlockFiles as tr, ScopedTokenSchema as tt, CAP_NAMES_WITH_STATUS as u, secretTreeFromPaths as ua, REMOVE_LEAF as ui, gbToBytes as un, settingsStoreCapability as ur, addonPagesCapability as ut, CoreBlockSchema as v, EventCategory as va, RevConflictError as vi, isLocationEnabled as vn, storageOccupancyCapability as vr, backupCapability as vt, DERIVED_CAMERA_SILENCED_CAP_NAMES as w, asNumber as wi, legacyAutoLinkIds as wn, validateComposition as wr, buildStreamParamsConfigSchema as wt, DATABASE_SNAPSHOT_TIMEOUT_MS as x, UnknownRecordKindError as xi, kebabToCamel as xn, streamQualityLabel as xr, buildCapabilityLookup as xt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as y, SECRET_CLEAR as yi, isObjectInput as yn, storageProviderCapability as yr, bareAddonId as yt, HUB_MDNS_TXT_KEYS as z, expandCapMethods as zi, normalizeUnit as zn, createStatefulExpressionMemory as zr, databaseSnapshotCapability as zt };
+export { PreferenceNamespaceSchema as $, isSecretMarker as $i, procedureAuthKey as $n, BaseAddon as $r, deviceHistoryCapability as $t, DEVICE_SAN_USER_PREFIX as A, asJsonObject as Ai, keychainCapability as An, userManagementCapability as Ar, buildStreamParamsConfigSchema as At, HUB_MDNS_SERVICE_TYPE as B, customAction as Bi, mayWriteToLocation as Bn, composedDeviceRef as Br, coreBlockIdFromAddonId as Bt, DATABASE_SNAPSHOT_TIMEOUT_MS as C, userError as Ca, RecordTooLargeError as Ci, isCredentialTokenPayload as Cn, storageCapability as Cr, authProviderCapability as Ct, DEVICE_ENROLLMENT_TTL_MS as D, UnindexedFilterError as Di, isVoidInput as Dn, streamCatalogCapability as Dr, buildCapabilityLookup as Dt, DERIVED_CAMERA_SILENCED_CAP_NAMES as E, SECRET_CLEAR as Ei, isObjectInput as En, storageProviderCapability as Er, batteryCapability as Et, DeviceTombstoneSchema as F, collectSecretConfigKeys as Fi, locationIconKey as Fn, vectorStoreCapability as Fr, composerCapability as Ft, LOG_LEVEL_RANK as G, emitReadiness as Gi, normalizeCoreBlockWrite as Gn, compositionSourceKey as Gr, databaseSnapshotCapability as Gt, KEYCHAIN_RESET_TRIGGER_ACTOR as H, defineCustomActions as Hi, metricsProviderCapability as Hn, compositionFeatureEnabled as Hr, coreBlocksCapability as Ht, FIRST_LEVEL_MACRO_CLASSES as I, collectSecretLeaves as Ii, logDestinationCapability as In, withLocationMode as Ir, compositionFieldKey as It, MINUTES_PER_DAY as J, hydrateSchema as Ji, objectInputDeclaresRequiredDeviceId as Jn, toExpressionValue as Jr, defineExtensionSlotProvider as Jt, LegacyStorageLocationDefaultSchema as K, expandCapMethods as Ki, normalizeUnit as Kn, createStatefulExpressionMemory as Kr, declarationOwnerNodeId as Kt, FieldClaimModeSchema as L, collectSecretMarkerRefs as Li, logLevelAtMost as Ln, COMPOSER_ADDON_ID as Lr, compositionSourceRefs as Lt, DataStoreDatabaseSchema as M, asString$1 as Mi, legacyModeOf as Mn, validateCustomAddress as Mr, cameraGridLayoutCapability as Mt, DeclaredDevices as N, assertValidDeclaration as Ni, lifecycleJobSchema as Nn, vectorDimFromBase64 as Nr, canonicalIconKey as Nt, DEVICE_NONCE_TTL_MS as O, UnknownRecordKindError as Oi, kebabToCamel as On, streamQualityLabel as Or, buildDeviceEnrollmentLink as Ot, DeviceStatusSchema as P, buildSecretRef as Pi, localNetworkCapability as Pn, vectorIndexDimConflictError as Pr, checkRoleAddress as Pt, PreferenceDeviceIdSchema as Q, isSecretClear as Qi, platformProbeCapability as Qn, errMsg as Qr, deviceExtensionCapability as Qt, FieldClaimSchema as R, collectZodSecretPaths as Ri, looseSchema as Rn, buildFfmpegArgs as Rr, coreBlockAddonId as Rt, DATABASE_SNAPSHOT_SUFFIX as S, transformSecretWrite as Sa, RecordNotFoundError as Si, isCollectionArrayMethod as Sn, storageAdminCapability as Sr, armRemovalReconcile as St, DAY_NAMES as T, EventCategory as Ta, RevConflictError as Ti, isLocationEnabled as Tn, storageOccupancyCapability as Tr, bareAddonId as Tt, KeychainAuditEntrySchema as U, defineRecordKinds as Ui, modeMayWrite as Un, compositionItemFieldPath as Ur, createDeviceExtensionProvider as Ut, HUB_MDNS_TXT_KEYS as V, declarationsOf as Vi, memoizePinnedFfmpeg as Vn, composedDeviceStableId as Vr, coreBlockSourceKind as Vt, KeychainResetRecordSchema as W, emitDownForOwnedCaps as Wi, motionCapability as Wn, compositionSliceKey as Wr, dataStoreProviderCapability as Wt, NetworkTunnelStartedDataSchema as X, isEvent as Xi, pickAppLinkHub as Xn, DeviceRole as Xr, describeComposableCaps as Xt, MOTION_CLOSE_AFTER_MS as Y, isDeviceConfigCap as Yi, parseStreamParamsFormPatch as Yn, DeviceFeature as Yr, deriveBatteryPresence as Yt, PREFERENCES_MAX_VALUE_BYTES as Z, isKeychainStoredField as Zi, planComposition as Zn, DeviceType as Zr, deviceCredentialsCapability as Zt, CalendarPreferencesSchema as _, secretTreeFromPaths as _a, REMOVE_LEAF as _i, interpolate as _n, settingsStoreCapability as _r, addonSettingsCapability as _t, ApiKeyRecordSchema as a, normalizeNodeId as aa, DeclarationRefusedError as ai, enumerateItemArrayFields as an, resolveAppConnections as ar, STORAGE_ADMIN_SCOPED_BASES as at, CredentialTokenClaimsSchema as b, toNodeId as ba, ReadinessTimeoutError as bi, isAppLinkBase as bn, snapshotCapability as br, alertEpisodePayload as bt, CAMERA_SWITCH_ORDER as c, parseJsonUnknown as ca, HISTORY_DEFAULT_MIN_INTERVAL_MS as ci, evictionPolicyOfLocation as cn, resolveCoreBlockFiles as cr, ServerNameSchema as ct, CATALOG_LANGS as d, parseSettingsBrokersAdoptsFrom as da, PlaintextSecretError as di, extractNestedAddonId as dn, resolveMethodAuth as dr, StorageLocationModeSchema as dt, isSecretMarkerLike as ea, BatchTooLargeError as ei, deviceManagerCapability as en, ptzAutotrackCapability as er, PreferenceValueSchema as et, COMPOSED_ITEM_FIXED_FIELDS as f, readinessKey as fa, RECORD_BATCH_MAX as fi, filesystemBrowseCapability as fn, resolveNotificationTapAddress as fr, StorageLocationTypeSchema as ft, CREDENTIAL_TOKEN_AUDIENCE as g, scopeKey as ga, REDACTED_SECRET as gi, gbToBytes as gn, scoreRuntimes as gr, addonPagesCapability as gt, CORE_BLOCK_ADDON_PREFIX as h, resolveSecretMarkers as ha, RECORD_SWEEP_INTERVAL_MS as hi, formatMinutes as hn, scopesAllowDeviceCap as hr, UserRecordSchema as ht, AlertSchema as i, nodePin as ia, DEVICE_STATUS_METHOD as ii, enumerateInferenceDevices as in, replacedFieldKeys as ir, STORAGE_ADMIN_MOVED_COLLECTIONS as it, DEVICE_TOMBSTONE_RETENTION_MS as j, asNumber as ji, legacyAutoLinkIds as jn, validateComposition as jr, calendarsCapability as jt, DEVICE_SAN_CREDENTIAL_PREFIX as k, WELL_KNOWN_TAB_MAP as ki, keychainAdminCapability as kn, supportedRuntimes as kr, buildDeviceSignatureMessage as kt, CAMSTACK_APP_LINK_ORIGIN as l, parseSecretRef as la, InvalidRecordError as li, expandContainer as ln, resolveHubAddressRoles as lr, SsoBridgeClaimsSchema as lt, CORE_BLOCKS_ADDON_ID as m, resolveCapMount as ma, RECORD_DELETE_BATCH as mi, formatDeviceRevoker as mn, scopesAllowAddon as mr, TokenScopeSchema as mt, AGENT_MDNS_TXT_KEYS as n, makeSecretMarker as na, DATAPLANE_SECRET_HEADER as ni, deviceStateCapability as nn, recordsCapability as nr, RecordingStatusSchema as nt, BaseDevice as o, normalizeSecretOwner as oa, FilterRequiredError as oi, enumerateSchemaFields as on, resolveBucketMs as or, STREAM_PROFILE_META as ot, COMPOSER_RUNNER_ID as p, recordSecretRef as pa, RECORD_BATCH_MAX_BYTES as pi, foldSnapshotByFunction as pn, runtimeStatePolicyFor as pr, StorageMigrationJobSchema as pt, METHOD_ACCESS_MAP as q, formatSecretScope as qi, objectInputDeclaresAddonId as qn, disarmRoseMemory as qr, decodeVectorBase64 as qt, ALL_CAPABILITY_DEFINITIONS as r, mapSecretLeaves as ra, DEVICE_SETTINGS_CONTRIBUTION_METHODS as ri, deviceStatusCapability as rn, reducePoints as rr, STORAGE_ACCESS_FALLBACK as rt, BatteryStatusSchema as s, parseJsonObject as sa, ForeignSecretMarkerError as si, evaluateCompositionField as sn, resolveCoreBlockEntry as sr, ScopedTokenSchema as st, AGENT_MDNS_SERVICE_TYPE as t, isSecretRefOwnedBy as ta, CALLER_STAMPED_CAPABILITIES as ti, deviceRemovalHookCapability as tn, recordEntriesCapability as tr, RECORDING_SOURCE_CAMSTACK_ADDON as tt, CAP_NAMES_WITH_STATUS as u, parseSettingsArrayAdoptsFrom as ua, NoCallerError as ui, expressionContainsBuiltinCall as un, resolveLocationMode as ur, StorageCleanupJobSchema as ut, CatalogFileSchema as v, secretTreeFromSchema as va, RUNTIME_DEFAULTS as vi, isAlertEpisodeOpen as vn, shortHostname as vr, addonWidgetsCapability as vt, DATA_STORE_DATABASES as w, withoutCallerStamp as wa, RecordUniqueViolationError as wi, isDefaultAppConnectionEndpoint as wn, storageMigrationCapability as wr, backupCapability as wt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as x, toSecretFieldView as xa, RecordKindDeclarationSchema as xi, isArrayOutputSchema as xn, splitTranslationRef as xr, alertsCapability as xt, CoreBlockSchema as y, sleep as ya, ReadinessRegistry as yi, isAlertEpisodeSeverity as yn, siteZoneKey as yr, alertEpisodeId as yt, HISTORY_CATALOG as z, createEvent as zi, mayReadLocation as zn, cloneStatefulExpressionMemory as zr, coreBlockComposition as zt };