@camstack/system 1.2.455 → 1.2.457

package/dist/{dist-BpSENkRJ.mjs → dist-Dhux90yB.mjs}

@@ -745,7 +745,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-BxjU_fJM.mjs
+//#region ../types/dist/sleep-BSuCCFjf.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -3258,9 +3258,9 @@ function normalizeAddonInitResult(result) {
 */
 var DATAPLANE_SECRET_HEADER = "x-camstack-dataplane-secret";
 /**
-* The share-view scope kinds a `csv_*` share token can carry. The hub mints
-* and validates them (`share-token.service.ts` builds its enum from this
-* list); a data plane names the kinds it ACCEPTS in `share`.
+* The share-view scope kinds a share-link token can carry. The hub mints
+* and validates them (`ShareViewGrantSchema` builds its
+* enum from this list); a data plane names the kinds it ACCEPTS in `share`.
 */
 var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
 /** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
@@ -10420,7 +10420,7 @@ function scopesAllowAddon(scopes, addonId, access) {
 * `super_admin` — collapsed onto the single boolean because every
 * non-admin caller is governed by the same scope-check rules; the
 * distinction was only ever used to route role-specific procedures
-* which we no longer have. CLI / webhook integrations are `cst_*` tokens
+* which we no longer have. CLI / webhook integrations are tokens (`auth.mintToken`)
 * with `isAdmin: false` + an explicit scope list.
 */
 /** Per-method access flavour. Materialised on every cap method via codegen. */
@@ -10609,24 +10609,117 @@ var AddonRoutesScopeSchema = z.object({
 	type: z.literal("addon-routes"),
 	access: z.array(MethodAccessSchema).min(1)
 });
+var PreferencesSelfScopeSchema = z.object({ type: z.literal("preferences-self") });
 var CredentialScopeSchema = z.union([
 	z.literal("*"),
 	ShareViewScopeSchema,
 	AddonRoutesScopeSchema,
+	PreferencesSelfScopeSchema,
 	TokenScopeSchema
 ]);
 /**
+* The `kind` claim of a unified token. It names the TOKEN FAMILY (so every
+* older gate that classifies a hub JWT refuses it — `classifyBearerPrincipal`
+* treats any `kind` it does not know as not-a-credential), never what the
+* token may do: that is its `scopes`, and only its `scopes`.
+*/
+var CREDENTIAL_TOKEN_KIND = "credential";
+/**
+* The `aud` claim every minted token is signed with (D895). The hub's raw JWT
+* verify (`AuthManager.verifyToken`, used by every surface that wants a LOGIN
+* session — the OAuth consent page, the session cookie, health, backups)
+* refuses a token carrying it, so a minted token — a share link above all —
+* can never be replayed as a person's session. Only the credential verifier's
+* own door (`verifyCredentialToken`) accepts it.
+*/
+var CREDENTIAL_TOKEN_AUDIENCE = "camstack:credential";
+/** Does a verified JWT payload belong to the minted-token family? */
+function isCredentialTokenPayload(payload) {
+	if (payload === null || typeof payload !== "object") return false;
+	const kind = Reflect.get(payload, "kind");
+	const aud = Reflect.get(payload, "aud");
+	return kind === "credential" || aud === "camstack:credential" || Array.isArray(aud) && aud.includes("camstack:credential");
+}
+/**
 * The claims of a unified token (`auth.mintToken`). It carries no `exp`: its
 * row (looked up by `jti` on every verify, for revocation) holds the ONE
 * expiry, so a share link can be extended and a JWT clock can never disagree
 * with the row.
 */
 var CredentialTokenClaimsSchema = z.object({
-	kind: z.literal("credential"),
+	kind: z.literal(CREDENTIAL_TOKEN_KIND),
 	sub: z.string().min(1),
 	jti: z.string().min(16),
 	scopes: z.array(CredentialScopeSchema).min(1)
 });
+/**
+* Per-user ACCOUNT preferences (D894): the hub-side half of the viewer's two
+* settings levels.
+*
+*   - DEVICE settings never leave the phone.
+*   - ACCOUNT settings live here: one row per `(user, namespace)`, private to
+*     that user, synced across every device signed in as them, last write wins
+*     unless the writer sends the revision it based its edit on.
+*
+* A setting lives in exactly ONE level; there are no overrides. The caller
+* never names a user: the hub stamps the principal's own id, admin included.
+*
+* The contract the client codes against is the `preferences.*` tRPC router
+* (`server/backend/src/api/core/preferences.router.ts`).
+*/
+/** `viewer.app`, `viewer.cameras`, `viewer.grids` … — lowercase, dot/dash separated. */
+var PREFERENCES_NAMESPACE_PATTERN = /^[a-z][a-z0-9.-]{0,63}$/;
+/** One row's value, measured as UTF-8 JSON. */
+var PREFERENCES_MAX_VALUE_BYTES = 256 * 1024;
+var PreferenceNamespaceSchema = z.string().regex(PREFERENCES_NAMESPACE_PATTERN);
+/** A namespace's value: a JSON object, opaque to the hub. */
+var PreferenceValueSchema = z.record(z.string(), z.unknown());
+var PreferenceDeviceIdSchema = z.string().min(1).max(64);
+/** A stored row, as the owner reads it. */
+var PreferenceRowSchema = z.object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/** Starts at 1, +1 on every write of this namespace. A delete ends the row and its count. */
+	revision: z.number().int().positive(),
+	updatedAt: z.number().int(),
+	/** The client id the last writer sent; `null` when it sent none. */
+	updatedByDevice: PreferenceDeviceIdSchema.nullable()
+});
+z.object({ 
+/** Absent: every namespace the caller holds. */
+namespaces: z.array(PreferenceNamespaceSchema).max(32).optional() });
+z.object({ rows: z.array(PreferenceRowSchema) });
+z.object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/**
+	* The revision the edit was based on. Absent: last write wins. `0`: the
+	* namespace must not exist yet. Any other value that is not the current
+	* revision answers `conflict` and writes nothing.
+	*/
+	baseRevision: z.number().int().nonnegative().optional(),
+	deviceId: PreferenceDeviceIdSchema.optional()
+});
+z.discriminatedUnion("status", [z.object({
+	status: z.literal("saved"),
+	row: PreferenceRowSchema
+}), z.object({
+	status: z.literal("conflict"),
+	current: PreferenceRowSchema.nullable()
+})]);
+z.object({ namespace: PreferenceNamespaceSchema });
+z.object({ 
+/** `false` when the namespace did not exist. */
+deleted: z.boolean() });
+z.object({ 
+/** The revision the client holds per namespace; a namespace it does not list is new to it. */
+revisionByNamespace: z.record(PreferenceNamespaceSchema, z.number().int().nonnegative()).refine((map) => Object.keys(map).length <= 32, { message: `at most 32 namespaces` }) });
+z.object({
+	/** Every row whose revision differs from the client's, and every row it did not list. */
+	rows: z.array(PreferenceRowSchema),
+	/** Namespaces the client listed that no longer exist. */
+	deleted: z.array(PreferenceNamespaceSchema)
+});
 z.enum(["new-session", "step-up"]);
 /** The languages the hub's app landing pages are written in (D858). */
 var AppPageLangSchema = z.enum(["en", "it"]);
@@ -17655,11 +17748,30 @@ var DeviceHistorySubjectSchema = z.discriminatedUnion("kind", [z.object({
 	kind: z.literal("node"),
 	nodeId: z.string().min(1)
 })]);
+/**
+* `enum` stores a STATE as the ordinal of its value in the series' value list
+* (`DeviceHistorySeriesInfo.values`, append-only, so an ordinal never changes
+* meaning); a rollup keeps the time spent in each state (`states`).
+*/
 var DeviceHistoryKindSchema = z.enum([
+	"gauge",
+	"counter",
+	"boolean",
+	"enum"
+]);
+/** What a PRODUCER may declare. `enum` is cap-only: its value list is the cap field's. */
+var DeviceHistoryProducerKindSchema = z.enum([
 	"gauge",
 	"counter",
 	"boolean"
 ]);
+/**
+* A key computed at READ time from stored series of the same device, never
+* stored itself. Energy (kWh per bucket) comes from the power meter's
+* `kwhTotal` counter when the device has one, else from integrating its
+* `watts` gauge over time.
+*/
+var DEVICE_HISTORY_ENERGY_KEY = "derived:energy.kwh";
 var DeviceHistoryResolutionSchema = z.enum([
 	"raw",
 	"5m",
@@ -17692,7 +17804,13 @@ var SeriesInfoSchema = z.object({
 	/** `null` is unknown (a `unitFrom` series whose device does not state a unit right now), never a guess. */
 	unit: z.string().nullable(),
 	displayName: z.string(),
-	source: z.enum(["cap", "addon"]),
+	source: z.enum([
+		"cap",
+		"addon",
+		"derived"
+	]),
+	/** `enum`: the value of each ordinal (index = ordinal); `null` for every other kind. */
+	values: z.array(z.string()).readonly().nullable(),
 	firstTs: z.number(),
 	lastTs: z.number()
 });
@@ -17706,17 +17824,31 @@ var QueryPointSchema = z.object({
 	twMean: z.number().nullable(),
 	min: z.number(),
 	max: z.number(),
-	/** `null` is unknown, never zero (D393). */
-	last: z.number().nullable()
+	/** `null` is unknown, never zero (D393). For an `enum` series: the ordinal of {@link state}. */
+	last: z.number().nullable(),
+	/**
+	* The increase over the point: a `counter`'s growth since the previous point
+	* or bucket (a drop is a reset, counted from zero), and for
+	* {@link DEVICE_HISTORY_ENERGY_KEY} the kWh used in the bucket. `null` for
+	* every other kind, and when it cannot be known.
+	*/
+	delta: z.number().nullable(),
+	/** `enum`: the state in force at the end of the point (the name of `last`); `null` otherwise. */
+	state: z.string().nullable(),
+	/** `enum` rollup: milliseconds spent in each state inside the bucket; `null` for raw points and other kinds. */
+	states: z.record(z.string(), z.number()).nullable()
 });
 var QuerySeriesSchema = z.object({
 	scope: z.string(),
 	/** The last point STRICTLY BEFORE `from` in the chosen tier, so a step chart can start at the held value. */
 	before: z.object({
 		t: z.number(),
-		value: z.number().nullable()
+		value: z.number().nullable(),
+		state: z.string().nullable()
 	}).nullable(),
-	points: z.array(QueryPointSchema).readonly()
+	points: z.array(QueryPointSchema).readonly(),
+	/** A derived key: the stored key its points were computed from; `null` for a stored series. */
+	derivedFrom: z.string().nullable()
 });
 /** The window part of a query, shared by the device and node forms. */
 var QueryWindowShape = {
@@ -17732,6 +17864,23 @@ var QueryResultSchema = z.object({
 	series: z.array(QuerySeriesSchema).readonly(),
 	truncated: z.boolean()
 });
+/** One read of a batch: a device's key or a node's key (exactly one subject). */
+var QueryManyItemSchema = z.union([z.object({
+	deviceId: z.number().int(),
+	key: z.string(),
+	scope: z.string().optional()
+}), z.object({
+	forNodeId: z.string().min(1),
+	key: z.string(),
+	scope: z.string().optional()
+})]);
+var QueryManyEntrySchema = z.discriminatedUnion("ok", [z.object({
+	ok: z.literal(true),
+	result: QueryResultSchema
+}), z.object({
+	ok: z.literal(false),
+	error: z.string()
+})]);
 var TierStatusSchema = z.object({
 	tier: DeviceHistoryResolutionSchema,
 	/** `null` until the first background count answered. */
@@ -17800,26 +17949,45 @@ var deviceHistoryCapability = {
 		* `listNodeSeries` / `queryNode`.
 		*/
 		listSeries: method(z.object({ deviceId: z.number().int() }), z.array(SeriesInfoSchema).readonly()),
-		listNodeSeries: method(z.object({ nodeId: z.string().min(1) }), z.array(SeriesInfoSchema).readonly(), { auth: "admin" }),
+		/**
+		* A NODE's series. The subject is `forNodeId`, never `nodeId`: a top-level
+		* `nodeId` is the cap ROUTING key, and `nodeId: 'little-unraid'` sent the
+		* read to that agent, which hosts no device-history.
+		*/
+		listNodeSeries: method(z.object({ forNodeId: z.string().min(1) }), z.array(SeriesInfoSchema).readonly(), { auth: "admin" }),
 		/**
 		* One series (or every scope of it) at one resolution. `auto` picks the
 		* finest tier whose retention covers `from` and whose point count fits
 		* `maxPoints`; when even the coarsest tier does not fit, the newest
-		* `maxPoints` points are returned and `truncated` is true.
+		* `maxPoints` points are returned and `truncated` is true. A series fed by
+		* closed buckets has no raw rows, so `auto` never answers it from raw; nor
+		* {@link DEVICE_HISTORY_ENERGY_KEY}, which is computed from rollups.
 		*/
 		query: method(z.object({
 			deviceId: z.number().int(),
 			...QueryWindowShape
 		}), QueryResultSchema),
 		queryNode: method(z.object({
-			nodeId: z.string().min(1),
+			forNodeId: z.string().min(1),
 			...QueryWindowShape
 		}), QueryResultSchema, { auth: "admin" }),
+		/**
+		* Several reads over ONE window, answered in order (one entry per item).
+		* Admin-only: its subjects are nested in `items`, where the device scope
+		* gate cannot see them — a principal limited to one device uses `query`.
+		*/
+		queryMany: method(z.object({
+			items: z.array(QueryManyItemSchema).min(1).max(24),
+			from: QueryWindowShape.from,
+			to: QueryWindowShape.to,
+			resolution: QueryWindowShape.resolution,
+			maxPoints: QueryWindowShape.maxPoints
+		}), z.object({ results: z.array(QueryManyEntrySchema).readonly() }), { auth: "admin" }),
 		/** Producer: declare (idempotent) a series key this addon owns: `addon:<callerAddonId>/<name>`. */
 		declareSeries: method(z.object({
 			name: z.string().regex(/^[a-z0-9-]+$/),
 			subjectKind: z.enum(["device", "node"]),
-			kind: DeviceHistoryKindSchema,
+			kind: DeviceHistoryProducerKindSchema,
 			unit: z.string().optional(),
 			displayName: z.string().min(1),
 			ingest: z.enum(["points", "buckets"])
@@ -42223,38 +42391,37 @@ var llmRuntimeCapability = {
 		})
 	}
 };
+var LlmProfileKindSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "a kind id is lower-case letters, digits and dashes");
+/** What a model (or, by default, every model of a kind) can do. */
+var LlmModelFeaturesSchema = z.object({
+	vision: z.boolean(),
+	tools: z.boolean(),
+	streaming: z.boolean()
+});
+/** One model a provider offers. `features` overrides the kind's defaults, per field. */
+var LlmModelInfoSchema = z.object({
+	id: z.string(),
+	label: z.string().optional(),
+	contextLength: z.number().int().positive().optional(),
+	features: LlmModelFeaturesSchema.partial().optional()
+});
 /**
-* `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
-* methods concat-fan across providers; single-row methods route to ONE
-* provider by the `addonId` in the call input (the notification-output
-* posture, notification-output.cap.ts:215-250). Provided by `addon-ai`
-* (hub-placed); the cap stays open for future providers.
-*
-* Profiles are ROWS (data), not addons: one row = one usable model endpoint.
-* `apiKey` is a password field — providers REDACT it on read and merge on
-* write; a stored key NEVER round-trips to a client.
-*/
-var LlmProfileKindSchema = z.enum([
-	"openai-compatible",
-	"openai",
-	"anthropic",
-	"google",
-	"managed-local",
-	"apple-foundation"
-]);
+* The provider-specific part of a profile, validated by the provider that owns
+* the kind (`upsertProfile` refuses what it does not accept). A field its
+* `connectionSchema` declares `type: 'password'` is a secret: it is held in the
+* keychain, never in the row, and reads back as the redaction marker.
+*/
+var LlmProviderConfigSchema = z.record(z.string(), z.unknown());
 var LlmProfileSchema = z.object({
 	id: z.string(),
 	name: z.string(),
+	/** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
 	kind: LlmProfileKindSchema,
 	/** Stamped by the provider — keeps the fanned catalog routable. */
 	addonId: z.string(),
 	enabled: z.boolean(),
 	/** Vendor model id, or the managed runtime's loaded model. */
 	model: z.string(),
-	/** Required for openai-compatible; override for cloud kinds. */
-	baseUrl: z.string().optional(),
-	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
-	apiKey: z.string().optional(),
 	/** Vision on/off. A vision call against a `false` profile is REFUSED, never
 	*  degraded to text — that shipped once and produced a confident answer to a
 	*  question about a picture nobody sent. */
@@ -42262,15 +42429,11 @@ var LlmProfileSchema = z.object({
 	temperature: z.number().min(0).max(2).optional(),
 	/** Nucleus sampling. Every wire we speak has it. */
 	topP: z.number().min(0).max(1).optional(),
-	/** Top-k sampling. Carried only by the wires that have it — NEITHER OpenAI
-	*  wire does, and the client drops it there (measured: the request body gets
-	*  `top_p` and no `top_k`). The profile editor hides the field wherever it
-	*  would change nothing; `KINDS_WITH_TOP_K` is the single owner of that list. */
+	/** Top-k sampling. Carried only by the wires that have it — a kind offers the
+	*  field in its editor only when its descriptor lists it in `profileFields`. */
 	topK: z.number().int().positive().optional(),
 	maxTokens: z.number().int().positive().optional(),
-	/** Prompt context window. Advisory for cloud kinds (they enforce their own);
-	*  for `managed-local` it is the llama.cpp `--ctx-size` the runtime starts
-	*  the model with, so it is the one field that changes a PROCESS. */
+	/** Prompt context window. Advisory for cloud kinds (they enforce their own). */
 	contextLength: z.number().int().positive().optional(),
 	/** Default system prompt. A caller's `system` REPLACES it (never appends —
 	*  two system prompts fighting is worse than either alone). */
@@ -42296,16 +42459,37 @@ var LlmProfileSchema = z.object({
 	*  library; the REGISTRY of callable tools is ours and is empty in v1, so a
 	*  `true` here buys the wiring, not behaviour, until tools are registered. */
 	toolsEnabled: z.boolean().default(false),
-	extraHeaders: z.record(z.string(), z.string()).optional(),
-	/** kind === 'managed-local' only (spec §4). */
-	runtime: ManagedRuntimeConfigSchema.optional(),
-	/**
-	* kind === 'apple-foundation' only: WHERE it runs — the only thing there is
-	* to configure (no key, no URL, no download; `model` is `apple-system`).
-	* `supportsVision` on such a row is stamped by the provider from the node's
-	* reported `imageInput`, never taken from the operator (D62).
-	*/
-	appleFoundation: z.object({ nodeId: z.string() }).optional()
+	/** Everything the kind's provider owns (endpoint, key, node, runtime…). */
+	providerConfig: LlmProviderConfigSchema.default({})
+});
+/**
+* The common profile fields a kind's editor offers. The editor owns how each
+* one is drawn; the provider says which of them mean something on its wire.
+*/
+var LlmProfileFieldSchema = z.enum([
+	"temperature",
+	"topP",
+	"topK",
+	"maxTokens",
+	"contextLength",
+	"systemPrompt",
+	"timeoutMs",
+	"connectTimeoutMs",
+	"firstTokenTimeoutMs",
+	"idleTimeoutMs",
+	"retry",
+	"toolsEnabled"
+]);
+/**
+* A provider-drawn part of the editor, by a generic widget id the admin UI
+* registers (`ai/apple-node`). `placement: 'model'` replaces the generic model
+* picker: that widget owns the model choice.
+*/
+var LlmProviderWidgetSchema = z.object({
+	id: z.string(),
+	placement: z.enum(["connection", "model"]),
+	/** `providerConfig` keys this widget must fill before the profile can be saved. */
+	requires: z.array(z.string()).optional()
 });
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
@@ -42314,11 +42498,56 @@ var ConfigSchemaPassthrough$3 = z.unknown();
 var LlmProfileKindDescriptorSchema = z.object({
 	kind: LlmProfileKindSchema,
 	label: z.string(),
+	/** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
 	icon: z.string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: z.string(),
-	configSchema: ConfigSchemaPassthrough$3
+	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
+	connectionSchema: ConfigSchemaPassthrough$3,
+	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
+	advancedSchema: ConfigSchemaPassthrough$3.optional(),
+	/** The kind's defaults; a model from `listModels` may override any of them. */
+	features: LlmModelFeaturesSchema,
+	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
+	visionEditable: z.boolean(),
+	/** Where the model list comes from: `listModels`, `staticModels`, or nowhere. */
+	modelCatalog: z.enum([
+		"fetch",
+		"static",
+		"none"
+	]),
+	staticModels: z.array(LlmModelInfoSchema).optional(),
+	/** The common fields that mean something on this kind's wire. */
+	profileFields: z.array(LlmProfileFieldSchema),
+	providerWidgets: z.array(LlmProviderWidgetSchema).optional()
+});
+/**
+* `listModels` input. `connection` is an UNSAVED draft of `providerConfig`
+* (the editor's form); with `profileId` too, a secret the draft leaves
+* untouched (absent or the redaction marker) is resolved server-side from the
+* stored profile — the browser never receives it.
+*/
+var LlmListModelsInputSchema = z.object({
+	addonId: z.string(),
+	kind: LlmProfileKindSchema,
+	profileId: z.string().optional(),
+	connection: LlmProviderConfigSchema.optional()
 });
+var LlmListModelsErrorCodeSchema = z.enum([
+	"auth",
+	"network",
+	"unsupported",
+	"invalid"
+]);
+/** A RESULT, never a throw: "wrong key" is an answer the editor renders inline. */
+var LlmListModelsResultSchema = z.discriminatedUnion("ok", [z.object({
+	ok: z.literal(true),
+	models: z.array(LlmModelInfoSchema)
+}), z.object({
+	ok: z.literal(false),
+	code: LlmListModelsErrorCodeSchema,
+	message: z.string()
+})]);
 var LlmDefaultSelectorSchema = z.union([z.object({ consumer: z.string() }), z.object({ purpose: z.enum(["text", "vision"]) })]);
 var LlmDefaultSchema = z.object({
 	selector: LlmDefaultSelectorSchema,
@@ -42449,8 +42678,17 @@ var llmCapability = {
 			auth: "admin",
 			timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
 		}),
-		/** Live vendor enumeration (GET /models etc.). */
-		listModels: method(ProfileRefInputSchema, z.array(z.string())),
+		/**
+		* The models a kind offers, for a SAVED profile or an unsaved draft
+		* (`connection`). A mutation, not a query: a draft may carry a key, and a
+		* query's input travels in the URL. Admin: it dials whatever endpoint the
+		* draft names and may resolve a stored key to do it. The answer never
+		* carries a secret — failures are a typed result, never a throw.
+		*/
+		listModels: method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		getDefaults: method(z.object({}), z.array(LlmDefaultSchema)),
 		setDefault: method(z.object({
 			selector: LlmDefaultSelectorSchema,
@@ -42676,6 +42914,103 @@ var LogEntrySchema = z.object({
 	meta: z.record(z.string(), z.unknown()).optional(),
 	tags: z.record(z.string(), z.string()).optional()
 });
+/**
+* A history READ against one destination (D898).
+*
+* Every filter is applied by the PROVIDER, before the limit — a filter the
+* browser applied after the limit is what made a rare device's lines
+* unreachable behind a busy one's. `before` / `after` are cursors the provider
+* minted (opaque to everyone else): a file position for the rotated files, a
+* nanosecond timestamp for Loki.
+*
+* A read is BOUNDED by `budgetMs`: a filter that matches nothing on a 30-day
+* store answers `done: false` with the cursor it reached and the bytes it
+* scanned, and the caller decides whether to go on. That is what makes a long
+* scan show progress and stop when asked — `cancelRead` ends the slice in
+* flight, and not asking for the next slice ends the scan.
+*/
+var LogReadQuerySchema = z.object({
+	/** Correlates `cancelRead`. Caller-chosen, unique per in-flight read. */
+	requestId: z.string().min(1).max(64).optional(),
+	/** The device the line is about (`tags.deviceId`, numeric). */
+	deviceId: z.number().int().optional(),
+	/**
+	* The emitting addon — bare manifest id; `@<version>` / `::<sub>` suffixes
+	* match. Not `addonId`: a cap router reads that name as "which provider".
+	*/
+	fromAddonId: z.string().min(1).max(200).optional(),
+	/**
+	* The emitting node: matches the agent that emitted the line, the node
+	* itself, or a worker under it (`<agent>/<runner>`) — the `agentId`
+	* semantics of `matchesLogTags`. Not `nodeId`: a cap router reads that
+	* name as "which node's provider".
+	*/
+	fromNodeId: z.string().min(1).max(200).optional(),
+	/** Any other tag, exact match (AND). */
+	tags: z.record(z.string(), z.union([z.string(), z.number()])).optional(),
+	/** Severity FLOOR: this level and above. */
+	level: LogLevelSchema.optional(),
+	/** Case-insensitive substring over message, scope, tag values and meta values. */
+	text: z.string().min(1).max(200).optional(),
+	/** Epoch ms, inclusive. */
+	since: z.number().optional(),
+	/** Epoch ms, inclusive. */
+	until: z.number().optional(),
+	/** Older than this cursor (exclusive). Absent with `after` absent ⇒ from the newest. */
+	before: z.string().min(1).max(1024).optional(),
+	/** Newer than this cursor (exclusive). */
+	after: z.string().min(1).max(1024).optional(),
+	limit: z.number().int().min(1).max(1e3).optional(),
+	/** Wall-clock bound of this slice. The provider caps it. */
+	budgetMs: z.number().int().min(50).max(1e4).optional()
+});
+var LogReadEntrySchema = z.object({
+	/** `<bootId>.<seq>` minted by the emitting LogManager — the dedupe key. */
+	id: z.string().optional(),
+	/** Epoch ms. */
+	timestamp: z.number(),
+	level: LogLevelSchema,
+	scope: z.string().optional(),
+	message: z.string(),
+	tags: z.record(z.string(), z.union([z.string(), z.number()])).optional(),
+	meta: z.record(z.string(), z.unknown()).optional()
+});
+var LogReadResultSchema = z.object({
+	/** Newest first. */
+	entries: z.array(LogReadEntrySchema),
+	/** Pass as `before` for the next older page; null when nothing older exists. */
+	nextBefore: z.string().nullable(),
+	/** Pass as `after` to read what arrived since; null when unknown. */
+	nextAfter: z.string().nullable(),
+	/** Bytes this slice read (files) or received (remote). Progress, not a promise. */
+	scannedBytes: z.number().int().nonnegative(),
+	/**
+	* True when the scan in this direction reached the end of the store.
+	* False with fewer than `limit` entries means the budget ran out first —
+	* call again with `nextBefore` to go on.
+	*/
+	done: z.boolean(),
+	/** True when `cancelRead` ended this slice early. */
+	cancelled: z.boolean().optional()
+});
+var LogReadCapabilitiesSchema = z.object({
+	/** False ⇒ this destination only ships lines (console, forwarder, an unconfigured Loki). */
+	readable: z.boolean(),
+	/** Why not, when `readable` is false — rendered next to the source. */
+	reason: z.string().nullable(),
+	/** Filters the provider applies itself. A false one is applied by nobody. */
+	filters: z.object({
+		deviceId: z.boolean(),
+		addonId: z.boolean(),
+		nodeId: z.boolean(),
+		tags: z.boolean(),
+		level: z.boolean(),
+		text: z.boolean(),
+		timeRange: z.boolean()
+	}),
+	/** How far back the store reaches, when the provider knows (days). */
+	retentionDays: z.number().nullable()
+});
 var logDestinationCapability = {
 	name: "log-destination",
 	scope: "system",
@@ -42683,14 +43018,13 @@ var logDestinationCapability = {
 	internal: true,
 	methods: {
 		write: method(LogEntrySchema, z.void(), { kind: "mutation" }),
-		query: method(z.object({
-			scope: z.array(z.string()).optional(),
-			level: LogLevelSchema.optional(),
-			since: z.date().optional(),
-			until: z.date().optional(),
-			limit: z.number().optional(),
-			tags: z.record(z.string(), z.string()).optional()
-		}), z.array(LogEntrySchema).readonly())
+		/** Absent ⇒ the destination cannot read back (same as `readable: false`). */
+		describeRead: optionalMethod(z.void(), LogReadCapabilitiesSchema, { auth: "admin" }),
+		read: optionalMethod(LogReadQuerySchema, LogReadResultSchema, { auth: "admin" }),
+		cancelRead: optionalMethod(z.object({ requestId: z.string().min(1).max(64) }), z.object({ cancelled: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
 	mount: { kind: "skip" }
@@ -44600,9 +44934,11 @@ var alarmPanelCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — enum state; arm/disarm history belongs in the events ledger.
+	* History (D850): the panel's lifecycle state as an `enum` series —
+	* change-only, no floor, so an `arming -> pending -> triggered` sequence of a
+	* few seconds keeps every step. Who armed it stays in the events ledger.
 	*/
-	history: "none",
+	history: { fields: { state: { kind: "enum" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -45493,6 +45829,33 @@ var NcRuleTargetSchema = z.object({
 	params: z.record(z.string(), z.unknown()).optional()
 });
 /**
+* WHAT THE NOTIFICATION'S PICTURE IS (D897) — the ONE media choice of a rule.
+*
+* Every mode starts from the same CLEAN source frame of the trigger moment
+* (keyFrame → sceneFrame → lastSceneFrame, narrowed to the trigger instant and
+* to the zone that fired the rule) and renders it once at send time:
+*  - `scene-boxes` — the whole scene, the subject outlined thick in the accent
+*    colour and every OTHER track visible at that instant outlined thin, each
+*    labelled with class and confidence ("dog 87%").
+*  - `crop`  — the subject cut out of that frame around its box at that instant.
+*  - `clean` — the whole scene with nothing drawn on it.
+*  - `none`  — no picture.
+*
+* A mode that cannot be honoured (no box at that instant, a photograph with no
+* tracked subject) ships `clean` and names the reason in the log, per camera.
+* It replaces the `attach` × `frame` × `zoneCrop` triple, which let one rule
+* ship a crop on one event and a boxed scene on the next depending on which
+* stored kind had landed.
+*/
+var NcMediaImageSchema = z.enum([
+	"scene-boxes",
+	"crop",
+	"clean",
+	"none"
+]);
+/**
+* @deprecated Read only by `normalizeNcMediaPolicy` (D897) — see {@link NcMediaImageSchema}.
+*
 * Media attachment policy (P1 still-image subset).
 *  - `best` — the best AVAILABLE subject image at dispatch time (D-3).
 *  - `best-matching` — the media that explains WHY the rule fired: a rule
@@ -45506,6 +45869,8 @@ var NcRuleTargetSchema = z.object({
 *  - `none` — no attachment.
 */
 /**
+* @deprecated Read only by `normalizeNcMediaPolicy` (D897) — see {@link NcMediaImageSchema}.
+*
 * WHAT THE PICTURE SHOWS — chosen explicitly, because the implicit ladders
 * conflate it with the selection strategy and betray the request: asking for
 * the clean scene frame on an object-event owner used to start at
@@ -45534,16 +45899,29 @@ var NcMediaFrameSchema = z.enum([
 */
 var NcLinkedCameraModeSchema = z.enum(["mosaic", "each"]);
 var NcMediaPolicySchema = z.object({
+	/**
+	* The picture — see {@link NcMediaImageSchema}. Absent on a rule nobody has
+	* saved since D897: `normalizeNcMediaPolicy` derives it from the legacy
+	* triple below, at load and at every write, and the store keeps only this.
+	*/
+	image: NcMediaImageSchema.optional(),
+	/**
+	* Draw the zone that FIRED the rule on the picture (`scene-boxes` / `clean`;
+	* a `crop` never shows it). Valid only on a rule whose trigger is a zone —
+	* `conditions.zones` or an occupancy zone — and refused on save otherwise.
+	* Replaces `zoneCrop`.
+	*/
+	showTriggerZone: z.boolean().optional(),
+	/** @deprecated D897 — accepted from an editor that predates `image`, folded into it on save. */
 	attach: z.enum([
 		"best",
 		"best-matching",
 		"keyFrame",
 		"none"
-	]).default("best"),
-	/** What the still shows. Absent = `cropped` (the historical `best` shape). */
+	]).optional(),
+	/** @deprecated D897 — accepted from an editor that predates `image`, folded into it on save. */
 	frame: NcMediaFrameSchema.optional(),
-	/** Crop the attached still to the rule's condition-zone bbox (padded) —
-	*  "show me the ZONE", not the whole scene or the subject crop. */
+	/** @deprecated D897 — folded into `image: 'clean'` + `showTriggerZone` on save. */
 	zoneCrop: z.boolean().optional(),
 	/**
 	* Also attach a short GIF cut from the stream broker's clip ring around the
@@ -45715,7 +46093,9 @@ var NcRuleInputSchema = z.object({
 	* targets.
 	*/
 	targetUsers: z.array(z.string()).optional(),
-	media: NcMediaPolicySchema.default({ attach: "best" }),
+	/** Absent = the kind's default picture (`resolveNcMediaImage`): the subject crop for a
+	*  detection, the clean scene for a sensor or a sound. Set explicitly on save (D897). */
+	media: NcMediaPolicySchema.default({}),
 	throttle: NcThrottleSchema.default({
 		cooldownSec: 60,
 		scope: "rule-device"
@@ -46673,13 +47053,37 @@ var NcAlarmModeOpeningsSchema = z.object({
 	/** Covered devices whose state could not be read (D49): neither open nor closed. */
 	unknown: z.array(z.number().int())
 });
+/**
+* One alarm INPUT — a (rule, device) pair — the operator bypassed until the
+* next disarm ("Bypass this input until disarm" on a trigger notification, or
+* `nc.bypassAlarmInput`). Reported so an armed alarm with a silenced input
+* never looks fully armed (D62: off must never look like broken).
+*/
+var NcAlarmInputBypassViewSchema = z.object({
+	ruleId: z.string(),
+	/** The rule's current name (its frozen name when the rule is gone). */
+	ruleName: z.string(),
+	/** The input: the sensor of the match, else its camera. */
+	deviceId: z.number().int(),
+	/** The input's current name. */
+	name: z.string(),
+	/** When it was bypassed (ms epoch). */
+	since: z.number(),
+	/** Triggers from this input dropped since. */
+	dropped: z.number().int().min(0)
+});
 var NcAlarmLiveSchema = z.object({
 	state: AlarmStateSchema,
 	/** The mode being armed into (exit delay) or held; null when disarmed. */
 	targetMode: AlarmArmModeSchema.nullable(),
 	availableModes: z.array(AlarmArmModeSchema),
 	openings: z.array(NcAlarmModeOpeningsSchema),
-	exclusions: z.array(NcAlarmExclusionViewSchema)
+	exclusions: z.array(NcAlarmExclusionViewSchema),
+	/**
+	* Inputs bypassed for the rest of this arm session; cleared on disarm.
+	* Defaulted so an older hub answer still parses (as "none known").
+	*/
+	bypassedInputs: z.array(NcAlarmInputBypassViewSchema).default([])
 });
 var NcAlarmConfigSchema = z.object({
 	/**
@@ -60574,9 +60978,11 @@ var connectivityCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — duplicates device-status.online (one authority for availability).
+	* History (D850): `connected` as a boolean series — change-only, no floor. It
+	* is the upstream entity's own link (a HA connectivity sensor), not the
+	* device's reachability, which stays `device-status.online`.
 	*/
-	history: "none",
+	history: { fields: { connected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -61446,11 +61852,22 @@ var dishwasherCapability = {
 	},
 	runtimeState: DishwasherStatusSchema,
 	durability: "session",
-	history: { fields: { progressPercent: {
-		kind: "gauge",
-		unit: "%",
-		deadband: 2
-	} } }
+	history: { fields: {
+		progressPercent: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		state: { kind: "enum" },
+		operationState: { kind: "enum" },
+		remainingSeconds: {
+			kind: "gauge",
+			unit: "s",
+			minIntervalMs: 6e4
+		},
+		doorOpen: { kind: "boolean" },
+		powerOn: { kind: "boolean" }
+	} }
 };
 var DoorbellStatusSchema = z.object({
 	/** Ms epoch of the last press. null = never observed since this provider started. */
@@ -61567,9 +61984,15 @@ var enumSensorCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — text/enum state has no history (non-goal).
+	* History (D850): the value as an `enum` series (an appliance's program or
+	* operation state, an HVAC action). The option set is per device, so the
+	* value list is LEARNED as values are first seen (bounded). A sensor with a
+	* `format` carries a timestamp, not a state, and is not recorded.
 	*/
-	history: "none",
+	history: { fields: { value: {
+		kind: "enum",
+		skipWhenSet: "format"
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -63791,9 +64214,10 @@ var lockControlCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — enum state; lock events belong in the events ledger.
+	* History (D850): the lock's state as an `enum` series — change-only, no
+	* floor: a jam or an unlock lasting seconds is the edge an operator looks for.
 	*/
-	history: "none",
+	history: { fields: { state: { kind: "enum" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -63967,9 +64391,18 @@ var mediaPlayerCapability = {
 	*/
 	durability: "session",
 	/**
-	* History (D850): none — `positionMs` moves continuously while playing; volume is transient.
+	* History (D850): volume (a level an operator or an automation sets; the
+	* default 10 s floor folds a slider drag into its end value) and mute.
+	* `positionMs` is not recorded: it moves continuously while playing.
 	*/
-	history: "none"
+	history: { fields: {
+		volumeLevel: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		isMuted: { kind: "boolean" }
+	} }
 };
 /**
 * mesh-network — collection cap for mesh-VPN providers.
@@ -70115,9 +70548,29 @@ var streamParamsCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — encoder configuration.
+	* History (D850): the configured bitrate and frame rate of the main and sub
+	* profiles. Configuration, so change-only on the default floor: a point is an
+	* operator's (or a tuner's) edit, which is exactly what a chart of a stream's
+	* quality over time must show.
 	*/
-	history: "none",
+	history: { fields: {
+		"main.bitrate": {
+			kind: "gauge",
+			unit: "kbps"
+		},
+		"main.framerate": {
+			kind: "gauge",
+			unit: "fps"
+		},
+		"sub.bitrate": {
+			kind: "gauge",
+			unit: "kbps"
+		},
+		"sub.framerate": {
+			kind: "gauge",
+			unit: "fps"
+		}
+	} },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -71343,26 +71796,6 @@ var ApiKeySummarySchema = z.object({
 	createdAt: z.number(),
 	lastUsedAt: z.number().optional()
 });
-var ScopedTokenSummarySchema = z.object({
-	id: z.string(),
-	userId: z.string(),
-	name: z.string(),
-	tokenPrefix: z.string(),
-	scopes: z.array(TokenScopeSchema),
-	expiresAt: z.number().nullish(),
-	lastUsedAt: z.number().nullish(),
-	createdAt: z.number()
-});
-var CreateScopedTokenInputSchema = z.object({
-	userId: z.string(),
-	name: z.string(),
-	scopes: z.array(TokenScopeSchema),
-	expiresAt: z.number().optional()
-});
-var CreateScopedTokenResultSchema = z.object({
-	token: z.string(),
-	record: ScopedTokenSummarySchema
-});
 var OauthSessionSummarySchema = z.object({
 	id: z.string(),
 	userId: z.string(),
@@ -71384,11 +71817,11 @@ var TotpStatusSchema = z.object({
 	confirmedAt: z.number().nullable()
 });
 /**
-* user-management — singleton capability for user accounts, API keys,
-* and scoped tokens.
+* user-management — singleton capability for user accounts and the
+* legacy API-key rows.
 *
 * v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
-* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* — the subset check on `setUserScopes` is moot
 * because non-admins never reach these. If/when we open non-admin
 * delegation, structural caller-scope subset check goes inside the
 * provider.
@@ -71459,18 +71892,6 @@ var userManagementCapability = {
 			auth: "admin",
 			access: "delete"
 		}),
-		createScopedToken: method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
-		revokeScopedToken: method(z.object({ id: z.string() }), z.object({ success: z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin",
-			access: "delete"
-		}),
-		validateScopedToken: method(z.object({ token: z.string() }), ScopedTokenSummarySchema.nullable(), { access: "view" }),
-		listScopedTokens: method(z.object({ userId: z.string() }), z.array(ScopedTokenSummarySchema), { auth: "admin" }),
 		setupTotp: method(z.object({ userId: z.string() }), TotpSetupResultSchema, {
 			kind: "mutation",
 			auth: "admin",
@@ -74352,6 +74773,15 @@ var BaseDevice = class {
 	* Drivers can use the `getProbeFlags()` helper to read the flag bag
 	* with a typed cast.
 	*
+	* Answer what you KNOW. A plain array is read as the complete list only
+	* while this device is `online` and probed; return
+	* `accessoryChildrenUnknown(reason)` whenever you cannot know the list right
+	* now (no credentials, parent not connected, a failed or partial read) —
+	* the kernel then deletes nothing. Return `accessoryChildrenComplete(list)`
+	* to say "connected, and this is the complete list" explicitly. A shrink is
+	* deleted only after a second agreeing complete read on a later probe (D49;
+	* `packages/system/src/kernel/moleculer/accessory-prune-gate.ts`).
+	*
 	* Default: no children.
 	*/
 	getAccessoryChildren() {
@@ -77959,7 +78389,7 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		capName: "llm",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
 	"llm.listNodeModels": {
 		capName: "llm",
@@ -78261,7 +78691,19 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"logDestination.query": {
+	"logDestination.cancelRead": {
+		capName: "log-destination",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"logDestination.describeRead": {
+		capName: "log-destination",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"logDestination.read": {
 		capName: "log-destination",
 		capScope: "system",
 		addonId: null,
@@ -82623,12 +83065,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.createScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.createUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -82677,12 +83113,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.listScopedTokens": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.listUsers": {
 		capName: "user-management",
 		capScope: "system",
@@ -82737,12 +83167,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
-	"userManagement.revokeScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"userManagement.setupTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -82773,12 +83197,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.validateScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.verifyTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -84563,6 +84981,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"logDestination.read": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"mediaPlayer.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -86571,7 +86994,7 @@ var SESSION_ONLY_POLICY = {
 };
 /**
 * Cap history catalog, projected from every `*.cap.ts` `history` block.
-* 34 caps with series (62 series), 37 caps answered `'none'`.
+* 40 caps with series (77 series), 31 caps answered `'none'`.
 * Field keys are `runtimeState` paths (`a.b` into fixed objects only).
 */
 var HISTORY_CATALOG = {
@@ -86602,6 +87025,21 @@ var HISTORY_CATALOG = {
 			deadband: 1
 		}
 	},
+	"alarm-panel": { "state": {
+		kind: "enum",
+		values: [
+			"disarmed",
+			"armed_home",
+			"armed_away",
+			"armed_night",
+			"armed_vacation",
+			"armed_custom_bypass",
+			"arming",
+			"disarming",
+			"pending",
+			"triggered"
+		]
+	} },
 	"ambient-light-sensor": { "lux": {
 		kind: "gauge",
 		unit: "lx",
@@ -86646,6 +87084,7 @@ var HISTORY_CATALOG = {
 			minIntervalMs: 0
 		}
 	},
+	"connectivity": { "connected": { kind: "boolean" } },
 	"contact": { "entryOpen": { kind: "boolean" } },
 	"cover": { "position": {
 		kind: "gauge",
@@ -86653,10 +87092,48 @@ var HISTORY_CATALOG = {
 		minIntervalMs: 0
 	} },
 	"device-status": { "online": { kind: "boolean" } },
-	"dishwasher": { "progressPercent": {
-		kind: "gauge",
-		unit: "%",
-		deadband: 2
+	"dishwasher": {
+		"progressPercent": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"state": {
+			kind: "enum",
+			values: [
+				"idle",
+				"running",
+				"paused",
+				"finished",
+				"error",
+				"unavailable"
+			]
+		},
+		"operationState": {
+			kind: "enum",
+			values: [
+				"Inactive",
+				"Ready",
+				"DelayedStart",
+				"Run",
+				"Pause",
+				"ActionRequired",
+				"Finished",
+				"Error",
+				"Aborting"
+			]
+		},
+		"remainingSeconds": {
+			kind: "gauge",
+			unit: "s",
+			minIntervalMs: 6e4
+		},
+		"doorOpen": { kind: "boolean" },
+		"powerOn": { kind: "boolean" }
+	},
+	"enum-sensor": { "value": {
+		kind: "enum",
+		skipWhenSet: "format"
 	} },
 	"fan-control": {
 		"percentage": {
@@ -86691,6 +87168,24 @@ var HISTORY_CATALOG = {
 		unit: "%",
 		deadband: 2
 	} },
+	"lock-control": { "state": {
+		kind: "enum",
+		values: [
+			"locked",
+			"unlocked",
+			"locking",
+			"unlocking",
+			"jammed"
+		]
+	} },
+	"media-player": {
+		"volumeLevel": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		"isMuted": { kind: "boolean" }
+	},
 	"motion": { "detected": {
 		kind: "boolean",
 		excludeDeviceTypes: [DeviceType.Camera]
@@ -86777,6 +87272,24 @@ var HISTORY_CATALOG = {
 		deadband: .1
 	} },
 	"smoke": { "detected": { kind: "boolean" } },
+	"stream-params": {
+		"main.bitrate": {
+			kind: "gauge",
+			unit: "kbps"
+		},
+		"main.framerate": {
+			kind: "gauge",
+			unit: "fps"
+		},
+		"sub.bitrate": {
+			kind: "gauge",
+			unit: "kbps"
+		},
+		"sub.framerate": {
+			kind: "gauge",
+			unit: "fps"
+		}
+	},
 	"switch": { "on": { kind: "boolean" } },
 	"tamper": { "tampered": { kind: "boolean" } },
 	"temperature-sensor": { "celsius": {
@@ -88363,4 +88876,4 @@ function armRemovalReconcile(opts) {
 	return () => clearInterval(timer);
 }
 //#endregion
-export { STORAGE_ADMIN_MOVED_COLLECTIONS as $, normalizeNodeId as $i, resolveAppConnections as $n, DeclarationRefusedError as $r, enumerateInferenceDevices as $t, DEVICE_TOMBSTONE_RETENTION_MS as A, collectSecretLeaves as Ai, logDestinationCapability as An, withLocationMode as Ar, composerCapability as At, HUB_MDNS_TXT_KEYS as B, expandCapMethods as Bi, normalizeUnit as Bn, createStatefulExpressionMemory as Br, databaseSnapshotCapability as Bt, DATA_STORE_DATABASES as C, WELL_KNOWN_TAB_MAP as Ci, keychainAdminCapability as Cn, supportedRuntimes as Cr, buildDeviceEnrollmentLink as Ct, DEVICE_NONCE_TTL_MS as D, assertValidDeclaration as Di, lifecycleJobSchema as Dn, vectorDimFromBase64 as Dr, cameraGridLayoutCapability as Dt, DEVICE_ENROLLMENT_TTL_MS as E, asString$1 as Ei, legacyModeOf as En, validateCustomAddress as Er, calendarsCapability as Et, FIRST_LEVEL_MACRO_CLASSES as F, declarationsOf as Fi, memoizePinnedFfmpeg as Fn, composedDeviceStableId as Fr, coreBlockIdFromAddonId as Ft, LegacyStorageLocationDefaultSchema as G, isKeychainStoredField as Gi, planComposition as Gn, DeviceType as Gr, describeComposableCaps as Gt, KeychainAuditEntrySchema as H, hydrateSchema as Hi, objectInputDeclaresRequiredDeviceId as Hn, toExpressionValue as Hr, decodeVectorBase64 as Ht, FieldClaimModeSchema as I, defineCustomActions as Ii, metricsProviderCapability as In, compositionFeatureEnabled as Ir, coreBlockSourceKind as It, MOTION_CLOSE_AFTER_MS as J, isSecretMarkerLike as Ji, ptzAutotrackCapability as Jn, BatchTooLargeError as Jr, deviceHistoryCapability as Jt, METHOD_ACCESS_MAP as K, isSecretClear as Ki, platformProbeCapability as Kn, errMsg as Kr, deviceCredentialsCapability as Kt, FieldClaimSchema as L, defineRecordKinds as Li, modeMayWrite as Ln, compositionItemFieldPath as Lr, coreBlocksCapability as Lt, DeclaredDevices as M, collectZodSecretPaths as Mi, looseSchema as Mn, buildFfmpegArgs as Mr, compositionSourceRefs as Mt, DeviceStatusSchema as N, createEvent as Ni, mayReadLocation as Nn, cloneStatefulExpressionMemory as Nr, coreBlockAddonId as Nt, DEVICE_SAN_CREDENTIAL_PREFIX as O, buildSecretRef as Oi, localNetworkCapability as On, vectorIndexDimConflictError as Or, canonicalIconKey as Ot, DeviceTombstoneSchema as P, customAction as Pi, mayWriteToLocation as Pn, composedDeviceRef as Pr, coreBlockComposition as Pt, STORAGE_ACCESS_FALLBACK as Q, nodePin as Qi, replacedFieldKeys as Qn, DEVICE_STATUS_METHOD as Qr, deviceStatusCapability as Qt, HISTORY_CATALOG as R, emitDownForOwnedCaps as Ri, motionCapability as Rn, compositionSliceKey as Rr, createDeviceExtensionProvider as Rt, DATABASE_SNAPSHOT_TIMEOUT_MS as S, UnknownRecordKindError as Si, kebabToCamel as Sn, streamQualityLabel as Sr, buildCapabilityLookup as St, DERIVED_CAMERA_SILENCED_CAP_NAMES as T, asNumber as Ti, legacyAutoLinkIds as Tn, validateComposition as Tr, buildStreamParamsConfigSchema as Tt, KeychainResetRecordSchema as U, isDeviceConfigCap as Ui, parseStreamParamsFormPatch as Un, DeviceFeature as Ur, defineExtensionSlotProvider as Ut, KEYCHAIN_RESET_TRIGGER_ACTOR as V, formatSecretScope as Vi, objectInputDeclaresAddonId as Vn, disarmRoseMemory as Vr, declarationOwnerNodeId as Vt, LOG_LEVEL_RANK as W, isEvent as Wi, pickAppLinkHub as Wn, DeviceRole as Wr, deriveBatteryPresence as Wt, RECORDING_SOURCE_CAMSTACK_ADDON as X, makeSecretMarker as Xi, recordsCapability as Xn, DATAPLANE_SECRET_HEADER as Xr, deviceRemovalHookCapability as Xt, NetworkTunnelStartedDataSchema as Y, isSecretRefOwnedBy as Yi, recordEntriesCapability as Yn, CALLER_STAMPED_CAPABILITIES as Yr, deviceManagerCapability as Yt, RecordingStatusSchema as Z, mapSecretLeaves as Zi, reducePoints as Zn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Zr, deviceStateCapability as Zt, CatalogFileSchema as _, userError as _a, RecordTooLargeError as _i, isCollectionArrayMethod as _n, storageCapability as _r, armRemovalReconcile as _t, ApiKeyRecordSchema as a, parseSettingsBrokersAdoptsFrom as aa, PlaintextSecretError as ai, expressionContainsBuiltinCall as an, resolveMethodAuth as ar, StorageCleanupJobSchema as at, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as b, SECRET_CLEAR as bi, isObjectInput as bn, storageProviderCapability as br, bareAddonId as bt, CAMERA_SWITCH_ORDER as c, resolveCapMount as ca, RECORD_DELETE_BATCH as ci, foldSnapshotByFunction as cn, scopesAllowAddon as cr, StorageMigrationJobSchema as ct, CATALOG_LANGS as d, secretTreeFromPaths as da, REMOVE_LEAF as di, gbToBytes as dn, settingsStoreCapability as dr, addonPagesCapability as dt, normalizeSecretOwner as ea, FilterRequiredError as ei, enumerateItemArrayFields as en, resolveBucketMs as er, STORAGE_ADMIN_SCOPED_BASES as et, COMPOSED_ITEM_FIXED_FIELDS as f, secretTreeFromSchema as fa, RUNTIME_DEFAULTS as fi, interpolate as fn, shortHostname as fr, addonSettingsCapability as ft, CalendarPreferencesSchema as g, transformSecretWrite as ga, RecordNotFoundError as gi, isArrayOutputSchema as gn, storageAdminCapability as gr, alertsCapability as gt, CORE_BLOCK_ADDON_PREFIX as h, toSecretFieldView as ha, RecordKindDeclarationSchema as hi, isAppLinkBase as hn, splitTranslationRef as hr, alertEpisodePayload as ht, AlertSchema as i, parseSettingsArrayAdoptsFrom as ia, NoCallerError as ii, expandContainer as in, resolveLocationMode as ir, SsoBridgeClaimsSchema as it, DataStoreDatabaseSchema as j, collectSecretMarkerRefs as ji, logLevelAtMost as jn, COMPOSER_ADDON_ID as jr, compositionFieldKey as jt, DEVICE_SAN_USER_PREFIX as k, collectSecretConfigKeys as ki, locationIconKey as kn, vectorStoreCapability as kr, checkRoleAddress as kt, CAMSTACK_APP_LINK_ORIGIN as l, resolveSecretMarkers as la, RECORD_SWEEP_INTERVAL_MS as li, formatDeviceRevoker as ln, scopesAllowDeviceCap as lr, TokenScopeSchema as lt, CORE_BLOCKS_ADDON_ID as m, toNodeId as ma, ReadinessTimeoutError as mi, isAlertEpisodeSeverity as mn, snapshotCapability as mr, alertEpisodeId as mt, AGENT_MDNS_TXT_KEYS as n, parseJsonUnknown as na, HISTORY_DEFAULT_MIN_INTERVAL_MS as ni, evaluateCompositionField as nn, resolveCoreBlockFiles as nr, ScopedTokenSchema as nt, BaseDevice as o, readinessKey as oa, RECORD_BATCH_MAX as oi, extractNestedAddonId as on, resolveNotificationTapAddress as or, StorageLocationModeSchema as ot, COMPOSER_RUNNER_ID as p, sleep as pa, ReadinessRegistry as pi, isAlertEpisodeOpen as pn, siteZoneKey as pr, addonWidgetsCapability as pt, MINUTES_PER_DAY as q, isSecretMarker as qi, procedureAuthKey as qn, BaseAddon as qr, deviceExtensionCapability as qt, ALL_CAPABILITY_DEFINITIONS as r, parseSecretRef as ra, InvalidRecordError as ri, evictionPolicyOfLocation as rn, resolveHubAddressRoles as rr, ServerNameSchema as rt, BatteryStatusSchema as s, recordSecretRef as sa, RECORD_BATCH_MAX_BYTES as si, filesystemBrowseCapability as sn, runtimeStatePolicyFor as sr, StorageLocationTypeSchema as st, AGENT_MDNS_SERVICE_TYPE as t, parseJsonObject as ta, ForeignSecretMarkerError as ti, enumerateSchemaFields as tn, resolveCoreBlockEntry as tr, STREAM_PROFILE_META as tt, CAP_NAMES_WITH_STATUS as u, scopeKey as ua, REDACTED_SECRET as ui, formatMinutes as un, scoreRuntimes as ur, UserRecordSchema as ut, CoreBlockSchema as v, withoutCallerStamp as va, RecordUniqueViolationError as vi, isDefaultAppConnectionEndpoint as vn, storageMigrationCapability as vr, authProviderCapability as vt, DAY_NAMES as w, asJsonObject as wi, keychainCapability as wn, userManagementCapability as wr, buildDeviceSignatureMessage as wt, DATABASE_SNAPSHOT_SUFFIX as x, UnindexedFilterError as xi, isVoidInput as xn, streamCatalogCapability as xr, batteryCapability as xt, CredentialTokenClaimsSchema as y, EventCategory as ya, RevConflictError as yi, isLocationEnabled as yn, storageOccupancyCapability as yr, backupCapability as yt, HUB_MDNS_SERVICE_TYPE as z, emitReadiness as zi, normalizeCoreBlockWrite as zn, compositionSourceKey as zr, dataStoreProviderCapability as zt };
+export { PreferenceDeviceIdSchema as $, isEvent as $i, pickAppLinkHub as $n, DeviceRole as $r, describeComposableCaps as $t, DEVICE_SAN_CREDENTIAL_PREFIX as A, UnindexedFilterError as Ai, isVoidInput as An, streamCatalogCapability as Ar, buildCapabilityLookup as At, HISTORY_CATALOG as B, collectSecretMarkerRefs as Bi, logLevelAtMost as Bn, COMPOSER_ADDON_ID as Br, compositionSourceRefs as Bt, DATABASE_SNAPSHOT_TIMEOUT_MS as C, toNodeId as Ca, ReadinessTimeoutError as Ci, isAppLinkBase as Cn, snapshotCapability as Cr, alertEpisodePayload as Ct, DEVICE_ENROLLMENT_TTL_MS as D, withoutCallerStamp as Da, RecordUniqueViolationError as Di, isDefaultAppConnectionEndpoint as Dn, storageMigrationCapability as Dr, backupCapability as Dt, DERIVED_CAMERA_SILENCED_CAP_NAMES as E, userError as Ea, RecordTooLargeError as Ei, isCredentialTokenPayload as En, storageCapability as Er, authProviderCapability as Et, DeviceStatusSchema as F, asString$1 as Fi, legacyModeOf as Fn, validateCustomAddress as Fr, cameraGridLayoutCapability as Ft, KeychainResetRecordSchema as G, defineCustomActions as Gi, metricsProviderCapability as Gn, compositionFeatureEnabled as Gr, coreBlocksCapability as Gt, HUB_MDNS_TXT_KEYS as H, createEvent as Hi, mayReadLocation as Hn, cloneStatefulExpressionMemory as Hr, coreBlockComposition as Ht, DeviceTombstoneSchema as I, assertValidDeclaration as Ii, lifecycleJobSchema as In, vectorDimFromBase64 as Ir, canonicalIconKey as It, METHOD_ACCESS_MAP as J, emitReadiness as Ji, normalizeCoreBlockWrite as Jn, compositionSourceKey as Jr, databaseSnapshotCapability as Jt, LOG_LEVEL_RANK as K, defineRecordKinds as Ki, modeMayWrite as Kn, compositionItemFieldPath as Kr, createDeviceExtensionProvider as Kt, FIRST_LEVEL_MACRO_CLASSES as L, buildSecretRef as Li, localNetworkCapability as Ln, vectorIndexDimConflictError as Lr, checkRoleAddress as Lt, DEVICE_TOMBSTONE_RETENTION_MS as M, WELL_KNOWN_TAB_MAP as Mi, keychainAdminCapability as Mn, supportedRuntimes as Mr, buildDeviceSignatureMessage as Mt, DataStoreDatabaseSchema as N, asJsonObject as Ni, keychainCapability as Nn, userManagementCapability as Nr, buildStreamParamsConfigSchema as Nt, DEVICE_HISTORY_ENERGY_KEY as O, EventCategory as Oa, RevConflictError as Oi, isLocationEnabled as On, storageOccupancyCapability as Or, bareAddonId as Ot, DeclaredDevices as P, asNumber as Pi, legacyAutoLinkIds as Pn, validateComposition as Pr, calendarsCapability as Pt, PREFERENCES_MAX_VALUE_BYTES as Q, isDeviceConfigCap as Qi, parseStreamParamsFormPatch as Qn, DeviceFeature as Qr, deriveBatteryPresence as Qt, FieldClaimModeSchema as R, collectSecretConfigKeys as Ri, locationIconKey as Rn, vectorStoreCapability as Rr, composerCapability as Rt, DATABASE_SNAPSHOT_SUFFIX as S, sleep as Sa, ReadinessRegistry as Si, isAlertEpisodeSeverity as Sn, siteZoneKey as Sr, alertEpisodeId as St, DAY_NAMES as T, transformSecretWrite as Ta, RecordNotFoundError as Ti, isCollectionArrayMethod as Tn, storageAdminCapability as Tr, armRemovalReconcile as Tt, KEYCHAIN_RESET_TRIGGER_ACTOR as U, customAction as Ui, mayWriteToLocation as Un, composedDeviceRef as Ur, coreBlockIdFromAddonId as Ut, HUB_MDNS_SERVICE_TYPE as V, collectZodSecretPaths as Vi, looseSchema as Vn, buildFfmpegArgs as Vr, coreBlockAddonId as Vt, KeychainAuditEntrySchema as W, declarationsOf as Wi, memoizePinnedFfmpeg as Wn, composedDeviceStableId as Wr, coreBlockSourceKind as Wt, MOTION_CLOSE_AFTER_MS as X, formatSecretScope as Xi, objectInputDeclaresAddonId as Xn, disarmRoseMemory as Xr, decodeVectorBase64 as Xt, MINUTES_PER_DAY as Y, expandCapMethods as Yi, normalizeUnit as Yn, createStatefulExpressionMemory as Yr, declarationOwnerNodeId as Yt, NetworkTunnelStartedDataSchema as Z, hydrateSchema as Zi, objectInputDeclaresRequiredDeviceId as Zn, toExpressionValue as Zr, defineExtensionSlotProvider as Zt, CalendarPreferencesSchema as _, resolveCapMount as _a, RECORD_DELETE_BATCH as _i, formatDeviceRevoker as _n, scopesAllowAddon as _r, UNATTRIBUTED_BUCKET_KEY as _t, ApiKeyRecordSchema as a, makeSecretMarker as aa, DATAPLANE_SECRET_HEADER as ai, deviceStateCapability as an, recordsCapability as ar, STORAGE_ACCESS_FALLBACK as at, CredentialTokenClaimsSchema as b, secretTreeFromPaths as ba, REMOVE_LEAF as bi, interpolate as bn, settingsStoreCapability as br, addonSettingsCapability as bt, CAMERA_SWITCH_ORDER as c, normalizeNodeId as ca, DeclarationRefusedError as ci, enumerateItemArrayFields as cn, resolveAppConnections as cr, STREAM_PROFILE_META as ct, CATALOG_LANGS as d, parseJsonUnknown as da, HISTORY_DEFAULT_MIN_INTERVAL_MS as di, evictionPolicyOfLocation as dn, resolveCoreBlockFiles as dr, SsoBridgeClaimsSchema as dt, isKeychainStoredField as ea, DeviceType as ei, deviceCredentialsCapability as en, planComposition as er, PreferenceNamespaceSchema as et, COMPOSED_ITEM_FIXED_FIELDS as f, parseSecretRef as fa, InvalidRecordError as fi, expandContainer as fn, resolveHubAddressRoles as fr, StorageCleanupJobSchema as ft, CREDENTIAL_TOKEN_AUDIENCE as g, recordSecretRef as ga, RECORD_BATCH_MAX_BYTES as gi, foldSnapshotByFunction as gn, runtimeStatePolicyFor as gr, TokenScopeSchema as gt, CORE_BLOCK_ADDON_PREFIX as h, readinessKey as ha, RECORD_BATCH_MAX as hi, filesystemBrowseCapability as hn, resolveNotificationTapAddress as hr, StorageMigrationJobSchema as ht, AlertSchema as i, isSecretRefOwnedBy as ia, CALLER_STAMPED_CAPABILITIES as ii, deviceRemovalHookCapability as in, recordEntriesCapability as ir, RecordingStatusSchema as it, DEVICE_SAN_USER_PREFIX as j, UnknownRecordKindError as ji, kebabToCamel as jn, streamQualityLabel as jr, buildDeviceEnrollmentLink as jt, DEVICE_NONCE_TTL_MS as k, SECRET_CLEAR as ki, isObjectInput as kn, storageProviderCapability as kr, batteryCapability as kt, CAMSTACK_APP_LINK_ORIGIN as l, normalizeSecretOwner as la, FilterRequiredError as li, enumerateSchemaFields as ln, resolveBucketMs as lr, ScopedTokenSchema as lt, CORE_BLOCKS_ADDON_ID as m, parseSettingsBrokersAdoptsFrom as ma, PlaintextSecretError as mi, extractNestedAddonId as mn, resolveMethodAuth as mr, StorageLocationTypeSchema as mt, AGENT_MDNS_TXT_KEYS as n, isSecretMarker as na, BaseAddon as ni, deviceHistoryCapability as nn, procedureAuthKey as nr, RECORDING_SOURCE_CAMSTACK_ADDON as nt, BaseDevice as o, mapSecretLeaves as oa, DEVICE_SETTINGS_CONTRIBUTION_METHODS as oi, deviceStatusCapability as on, reducePoints as or, STORAGE_ADMIN_MOVED_COLLECTIONS as ot, COMPOSER_RUNNER_ID as p, parseSettingsArrayAdoptsFrom as pa, NoCallerError as pi, expressionContainsBuiltinCall as pn, resolveLocationMode as pr, StorageLocationModeSchema as pt, LegacyStorageLocationDefaultSchema as q, emitDownForOwnedCaps as qi, motionCapability as qn, compositionSliceKey as qr, dataStoreProviderCapability as qt, ALL_CAPABILITY_DEFINITIONS as r, isSecretMarkerLike as ra, BatchTooLargeError as ri, deviceManagerCapability as rn, ptzAutotrackCapability as rr, ROOT_BUCKET_KEY as rt, BatteryStatusSchema as s, nodePin as sa, DEVICE_STATUS_METHOD as si, enumerateInferenceDevices as sn, replacedFieldKeys as sr, STORAGE_ADMIN_SCOPED_BASES as st, AGENT_MDNS_SERVICE_TYPE as t, isSecretClear as ta, errMsg as ti, deviceExtensionCapability as tn, platformProbeCapability as tr, PreferenceValueSchema as tt, CAP_NAMES_WITH_STATUS as u, parseJsonObject as ua, ForeignSecretMarkerError as ui, evaluateCompositionField as un, resolveCoreBlockEntry as ur, ServerNameSchema as ut, CatalogFileSchema as v, resolveSecretMarkers as va, RECORD_SWEEP_INTERVAL_MS as vi, formatMinutes as vn, scopesAllowDeviceCap as vr, UserRecordSchema as vt, DATA_STORE_DATABASES as w, toSecretFieldView as wa, RecordKindDeclarationSchema as wi, isArrayOutputSchema as wn, splitTranslationRef as wr, alertsCapability as wt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as x, secretTreeFromSchema as xa, RUNTIME_DEFAULTS as xi, isAlertEpisodeOpen as xn, shortHostname as xr, addonWidgetsCapability as xt, CoreBlockSchema as y, scopeKey as ya, REDACTED_SECRET as yi, gbToBytes as yn, scoreRuntimes as yr, addonPagesCapability as yt, FieldClaimSchema as z, collectSecretLeaves as zi, logDestinationCapability as zn, withLocationMode as zr, compositionFieldKey as zt };