@camstack/types 1.2.364 → 1.2.366

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-BBXNq778.js");
+const require_sleep = require("./sleep-NZlEFYGX.js");
 const require_event_category = require("./event-category-T43rdQWR.js");
 const require_composition = require("./composition-DCYnv4I6.js");
 const require_node_color = require("./node-color.js");
@@ -6658,6 +6658,330 @@ var SSO_STATE_COOKIE = "camstack_sso_state";
 /** Seconds the state cookie lives — the pending IdP state lasts 5 minutes, the bridge 5 more. */
 var SSO_STATE_COOKIE_MAX_AGE_SEC = 600;
 //#endregion
+//#region src/auth/device-certificate.ts
+/**
+* Device certificates (D855) — the wire contract shared by the hub, the admin
+* UI and the native viewer.
+*
+* A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+* Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+* key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+* dedicated device CA; the device later proves possession of the key by
+* signing a hub-issued nonce, and the hub answers with the same session a
+* password login opens.
+*
+* Everything on the wire is a small string (a PEM, a base64url signature):
+* D613 is about bulk bytes, and a certificate is ~600 bytes.
+*/
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+var DEVICE_CERT_SIGNATURE = "ecdsa-p256-sha256";
+/** First line of every signed message; a change of format bumps the version. */
+var DEVICE_SIGNATURE_MESSAGE_VERSION = "camstack-device-cert-v1";
+/** What a signature is for. A login signature can never be replayed as a renewal. */
+var DeviceSignaturePurposeSchema = zod.z.enum([
+	"login",
+	"renew",
+	"revoke"
+]);
+/** Leaf lifetime and the window in which the app renews it. */
+var DEVICE_CERT_VALIDITY_DAYS = 365;
+var DEVICE_CERT_RENEW_WINDOW_DAYS = 30;
+/** One-shot enrollment code and login nonce lifetimes. */
+var DEVICE_ENROLLMENT_TTL_MS = 10 * 6e4;
+var DEVICE_NONCE_TTL_MS = 6e4;
+/** SAN URI prefixes of a device leaf. */
+var DEVICE_SAN_CREDENTIAL_PREFIX = "camstack:credential:";
+var DEVICE_SAN_USER_PREFIX = "camstack:user:";
+/**
+* The exact bytes a device signs (UTF-8, `\n` separators, no trailing newline):
+*
+*   camstack-device-cert-v1
+*   <login|renew>
+*   <origin>            the hub origin returned by `getDeviceChallenge`
+*   <nonce>
+*
+* The origin is part of the message so a signature collected by a look-alike
+* hub is worthless on the real one; the hub additionally binds the nonce to
+* the origin it issued it for and refuses any other.
+*/
+function buildDeviceSignatureMessage(input) {
+	return [
+		DEVICE_SIGNATURE_MESSAGE_VERSION,
+		input.purpose,
+		input.origin,
+		input.nonce
+	].join("\n");
+}
+/** The deep link a QR carries: `camstack://enroll?hub=<origin>&code=<code>`. */
+function buildDeviceEnrollmentLink(input) {
+	const query = new URLSearchParams();
+	if (input.hub !== void 0) query.set("hub", input.hub);
+	query.set("code", input.code);
+	return `${input.scheme ?? "camstack"}://enroll?${query.toString()}`;
+}
+/** Parse an enrollment deep link; `null` when it is not one. `hub` is absent when the link names none. */
+function parseDeviceEnrollmentLink(raw) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "camstack:" && url.protocol !== "camstack.dev:") return null;
+	if (url.hostname !== "enroll") return null;
+	const code = url.searchParams.get("code");
+	if (code === null || code === "") return null;
+	const hub = url.searchParams.get("hub");
+	return {
+		hub: hub === null || hub === "" ? null : hub,
+		code
+	};
+}
+var DevicePlatformSchema = zod.z.enum([
+	"ios",
+	"android",
+	"web",
+	"other"
+]);
+var Base64UrlSchema = zod.z.string().min(1).max(4096).regex(/^[A-Za-z0-9_-]+$/);
+var PemSchema = zod.z.string().min(1).max(16384);
+/**
+* Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+* failure: those carry no reason and mean "try again", never "the credential is
+* dead". The viewer switches on this exhaustively.
+*/
+var DeviceRefusalReasonSchema = zod.z.enum([
+	"revoked",
+	"unknown-credential",
+	"expired",
+	"bad-signature",
+	"nonce-invalid",
+	"rate-limited",
+	"invalid-certificate",
+	"superseded",
+	"user-gone",
+	"unavailable",
+	"code-invalid",
+	"self-enrollment-disabled",
+	"step-up-required",
+	"bad-public-key"
+]);
+/** The only answers after which the app may count towards deleting its credential. */
+var DEFINITIVE_DEVICE_REFUSALS = [
+	"revoked",
+	"unknown-credential",
+	"user-gone"
+];
+/** Consecutive DEFINITIVE answers before the app deletes its key and certificate. */
+var DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE = 3;
+function isDefinitiveDeviceRefusal(reason) {
+	return DEFINITIVE_DEVICE_REFUSALS.includes(reason);
+}
+var DeviceRefusalSchema = zod.z.object({
+	ok: zod.z.literal(false),
+	reason: DeviceRefusalReasonSchema,
+	definitive: zod.z.boolean(),
+	retryAfterSeconds: zod.z.number().optional()
+});
+/**
+* A credential-bound session that can no longer refresh answers
+* `auth.refreshSession` with UNAUTHORIZED whose message is this prefix + the
+* reason; {@link deviceRefusalFromMessage} reads it back.
+*/
+var DEVICE_REFRESH_REFUSAL_PREFIX = "device-credential:";
+function deviceRefusalFromMessage(message) {
+	if (!message.startsWith("device-credential:")) return null;
+	const parsed = DeviceRefusalReasonSchema.safeParse(message.slice(18));
+	return parsed.success ? parsed.data : null;
+}
+var CompleteEnrollmentInputSchema = zod.z.object({
+	code: zod.z.string().min(1).max(256),
+	/** SubjectPublicKeyInfo DER of the device's P-256 public key, base64url. */
+	publicKeySpki: Base64UrlSchema,
+	deviceName: zod.z.string().min(1).max(80).optional(),
+	platform: DevicePlatformSchema
+});
+var CompleteEnrollmentOutputSchema = zod.z.object({
+	credentialId: zod.z.string(),
+	certPem: PemSchema,
+	/** The device CA certificate the leaf chains to. */
+	chainPem: PemSchema,
+	notAfter: zod.z.number(),
+	user: zod.z.object({
+		id: zod.z.string(),
+		username: zod.z.string()
+	})
+});
+var CompleteEnrollmentResultSchema = zod.z.discriminatedUnion("ok", [CompleteEnrollmentOutputSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+var EnrollSelfInputSchema = zod.z.object({
+	/** The single-use step-up proof (`auth.deviceEnrollProofFrom…`). */
+	proof: zod.z.string().min(1).max(512),
+	publicKeySpki: Base64UrlSchema,
+	deviceName: zod.z.string().min(1).max(80),
+	platform: DevicePlatformSchema
+});
+var DeviceEnrollProofSchema = zod.z.object({
+	proof: zod.z.string(),
+	expiresAt: zod.z.number()
+});
+var DeviceChallengeSchema = zod.z.object({
+	nonce: zod.z.string(),
+	/** The origin to put in the signed message. The app compares it to the hub it dialled. */
+	origin: zod.z.string(),
+	expiresAt: zod.z.number(),
+	signature: zod.z.literal(DEVICE_CERT_SIGNATURE)
+});
+var DeviceChallengeResultSchema = zod.z.discriminatedUnion("ok", [DeviceChallengeSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+var DeviceProofInputSchema = zod.z.object({
+	certPem: PemSchema,
+	nonce: zod.z.string().min(1).max(256),
+	/** ECDSA P-256 SHA-256 over {@link buildDeviceSignatureMessage}; raw r||s or DER, base64url. */
+	signature: Base64UrlSchema
+});
+var RenewDeviceCertificateOutputSchema = zod.z.object({
+	credentialId: zod.z.string(),
+	certPem: PemSchema,
+	chainPem: PemSchema,
+	notAfter: zod.z.number()
+});
+var RenewDeviceCertificateResultSchema = zod.z.discriminatedUnion("ok", [RenewDeviceCertificateOutputSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+var RevokeOwnDeviceCertificateResultSchema = zod.z.discriminatedUnion("ok", [zod.z.object({
+	ok: zod.z.literal(true),
+	credentialId: zod.z.string(),
+	sessionsEnded: zod.z.number().int()
+}), DeviceRefusalSchema]);
+function formatDeviceRevoker(revoker) {
+	return revoker.kind === "device" ? "device" : `${revoker.kind}:${revoker.userId}`;
+}
+var DeviceCredentialStatusSchema = zod.z.enum([
+	"active",
+	"expired",
+	"revoked"
+]);
+var DeviceCredentialSchema = zod.z.object({
+	id: zod.z.string(),
+	userId: zod.z.string(),
+	username: zod.z.string().nullable(),
+	deviceName: zod.z.string(),
+	platform: DevicePlatformSchema,
+	enrolledVia: zod.z.enum(["qr", "self"]),
+	/** SHA-256 of the leaf certificate DER, colon-hex. */
+	fingerprint: zod.z.string(),
+	issuedAt: zod.z.number(),
+	expiresAt: zod.z.number(),
+	lastUsedAt: zod.z.number().nullable(),
+	lastUsedFrom: zod.z.string().nullable(),
+	revokedAt: zod.z.number().nullable(),
+	/** `admin:<userId>` | `user:<userId>` | `device` | `user-deleted`. */
+	revokedBy: zod.z.string().nullable(),
+	status: DeviceCredentialStatusSchema
+});
+var StartEnrollmentOutputSchema = zod.z.object({
+	/** Shown once; only its hash is kept. */
+	code: zod.z.string(),
+	expiresAt: zod.z.number(),
+	/** `camstack://enroll?hub=…&code=…` — what the QR encodes. */
+	enrollUrl: zod.z.string(),
+	/** The hub origin in the link, or `null` when the hub could not name one (the link then has no `hub`). */
+	hubOrigin: zod.z.string().nullable(),
+	/** Every origin the apps may try (role `appConnections`). */
+	hubOrigins: zod.z.array(zod.z.string())
+});
+/** The `device-certificate` arm of `auth.listLoginMethods`. */
+var DeviceCertificateLoginMethodSchema = zod.z.object({
+	kind: zod.z.literal("device-certificate"),
+	id: zod.z.literal("device-certificate"),
+	label: zod.z.string(),
+	stage: zod.z.literal("primary"),
+	/** tRPC paths under the hub's `auth` router, so a client names no literal. */
+	challengePath: zod.z.literal("auth.getDeviceChallenge"),
+	revokePath: zod.z.literal("auth.revokeOwnDeviceCertificate"),
+	enrollSelfPath: zod.z.literal("auth.enrollSelf"),
+	loginPath: zod.z.literal("auth.loginWithDeviceCertificate"),
+	renewPath: zod.z.literal("auth.renewDeviceCertificate"),
+	signature: zod.z.literal(DEVICE_CERT_SIGNATURE),
+	messageVersion: zod.z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
+	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
+	clients: zod.z.array(zod.z.enum(["native", "web"]))
+});
+//#endregion
+//#region src/auth/request-origin.ts
+/** host[:port] — a DNS name, IPv4 or bracketed IPv6. No userinfo, path or spaces. */
+var AUTHORITY_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
+/** Same grammar as the hub's `parseForwardedPrefix` (spa-mount.ts). */
+var PREFIX_RE = /^\/[A-Za-z0-9_\-.]+(?:\/[A-Za-z0-9_\-.]+)*$/;
+var MAX_PREFIX_LENGTH = 512;
+/** First value of a possibly comma-joined forwarded header (the client-most proxy). */
+function firstValue(value) {
+	if (value === void 0) return null;
+	const first = value.split(",")[0]?.trim() ?? "";
+	return first.length === 0 ? null : first;
+}
+/** `scheme://host[:port]` normalised by WHATWG URL, or `null` if it is not an http(s) origin. */
+function normalizeOrigin(value) {
+	try {
+		const url = new URL(value);
+		if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+		if (url.username !== "" || url.password !== "") return null;
+		return url.origin;
+	} catch {
+		return null;
+	}
+}
+/** The mount prefix the relay named (no trailing slash), or `''`. Invalid = absent. */
+function requestMountPrefix(headers) {
+	const raw = headers["x-forwarded-prefix"];
+	if (raw === void 0 || raw.length === 0 || raw.length > MAX_PREFIX_LENGTH) return "";
+	const trimmed = raw.endsWith("/") ? raw.slice(0, -1) : raw;
+	if (trimmed === "" || !PREFIX_RE.test(trimmed)) return "";
+	if (trimmed.split("/").some((segment) => segment === ".." || segment === ".")) return "";
+	return trimmed;
+}
+/**
+* The origins the request CLAIMS, most specific first: the proxy's
+* `X-Forwarded-Host` over `Host`; the named `X-Forwarded-Proto`, or https
+* then http when none is named (the hub terminates TLS itself on 4443).
+*/
+function claimedRequestOrigins(headers) {
+	const authority = firstValue(headers["x-forwarded-host"]) ?? firstValue(headers["host"]);
+	if (authority === null || !AUTHORITY_RE.test(authority)) return [];
+	const proto = firstValue(headers["x-forwarded-proto"])?.toLowerCase() ?? null;
+	const schemes = proto === "https" || proto === "http" ? [proto] : proto === null ? ["https", "http"] : [];
+	const out = [];
+	for (const scheme of schemes) {
+		const origin = normalizeOrigin(`${scheme}://${authority}`);
+		if (origin !== null) out.push(origin);
+	}
+	return out;
+}
+/** Every origin the hub advertises itself at, normalised. Never the app link, never loopback. */
+function advertisedHubOrigins(book) {
+	const candidates = [];
+	for (const row of book.rows) {
+		if (row.kind === "app-link" || row.kind === "loopback") continue;
+		candidates.push(row.baseUrl);
+	}
+	const { publicEndpoint, internal, appConnections } = book.roles;
+	if (publicEndpoint.resolved !== null) candidates.push(publicEndpoint.resolved);
+	if (internal.resolved !== null) candidates.push(internal.resolved);
+	candidates.push(...appConnections.resolved);
+	candidates.push(...book.listenerOrigins ?? []);
+	const out = /* @__PURE__ */ new Set();
+	for (const candidate of candidates) {
+		const origin = normalizeOrigin(candidate);
+		if (origin !== null) out.add(origin);
+	}
+	return out;
+}
+/**
+* The origin to send the browser back to: the first claimed origin that is in
+* `allowed`, or `null` (the caller then uses its default address).
+*/
+function pickRequestOrigin(headers, allowed) {
+	for (const origin of claimedRequestOrigins(headers)) if (allowed.has(origin)) return origin;
+	return null;
+}
+//#endregion
 //#region src/expression/binding-source.ts
 /**
 * What an expression's named bindings READ from.
@@ -11068,7 +11392,11 @@ var cameraStreamsCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `online` duplicates device-status.online (one authority); slot data is nested enum/string.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/cap-router-predicates.ts
@@ -13549,6 +13877,224 @@ var keychainCapability = {
 	}
 };
 //#endregion
+//#region src/capabilities/device-credentials.cap.ts
+var DeviceCaStatusSchema = zod.z.discriminatedUnion("state", [
+	zod.z.object({ state: zod.z.literal("absent") }),
+	zod.z.object({
+		state: zod.z.literal("ready"),
+		subject: zod.z.string(),
+		fingerprintSha256: zod.z.string(),
+		validTo: zod.z.string()
+	}),
+	zod.z.object({
+		state: zod.z.literal("unavailable"),
+		reason: zod.z.string()
+	})
+]);
+var DeviceCertificateSettingsSchema = zod.z.object({ selfEnrollment: zod.z.enum(["allowed", "disabled"]) });
+/**
+* `device-credentials` — the admin surface of device certificates (D855).
+*
+* Everything a device does ITSELF — completing an enrollment, getting a
+* challenge, signing in, renewing — is a PUBLIC procedure of the hub's `auth`
+* router (`auth.completeEnrollment`, `getDeviceChallenge`,
+* `loginWithDeviceCertificate`, `renewDeviceCertificate`): those legs are
+* proofs of possession, not capability calls, and must not be reachable as
+* cap methods. This cap holds only what an operator does about them.
+*
+* Provider: `local-auth`, which also owns the device CA and the registry.
+* The hub is the only node that persists device credentials.
+*/
+var deviceCredentialsCapability = {
+	name: "device-credentials",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/**
+		* Every enrolled device, newest first; `userId` narrows to one user.
+		* `status` is derived: revoked wins over expired.
+		*/
+		listDeviceCredentials: require_sleep.method(zod.z.object({
+			userId: zod.z.string().min(1).optional(),
+			includeRevoked: zod.z.boolean().default(false)
+		}), zod.z.array(DeviceCredentialSchema).readonly(), { auth: "admin" }),
+		/**
+		* Mint a one-shot enrollment code for `userId` and a device name: 128-bit
+		* random, single use, 10 minutes, kept only as a hash. Returns the code
+		* once, with the `camstack://enroll?hub=…&code=…` link a QR carries.
+		* `caller` (the admin) is recorded in the audit trail.
+		*/
+		startEnrollment: require_sleep.method(zod.z.object({
+			userId: zod.z.string().min(1),
+			deviceName: zod.z.string().min(1).max(80)
+		}), StartEnrollmentOutputSchema, {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Revoke a credential: its certificate stops logging in at once, and every
+		* session it opened ends (an open session also dies at its next refresh
+		* even if this call raced it). Idempotent.
+		*/
+		revokeDeviceCredential: require_sleep.method(zod.z.object({ id: zod.z.string().min(1) }), zod.z.object({
+			revoked: zod.z.boolean(),
+			sessionsEnded: zod.z.number().int(),
+			status: DeviceCredentialStatusSchema
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Hub-wide device-certificate settings. `selfEnrollment`: `allowed`
+		* (default) lets a signed-in user enroll their own device after a step-up
+		* sign-in; `disabled` makes `auth.enrollSelf` refuse. The admin QR path is
+		* unaffected. Hub-wide only (no per-role switch).
+		*/
+		getDeviceCertificateSettings: require_sleep.method(zod.z.object({}), DeviceCertificateSettingsSchema, { auth: "admin" }),
+		setDeviceCertificateSettings: require_sleep.method(DeviceCertificateSettingsSchema, DeviceCertificateSettingsSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Delete the registry row of a REVOKED credential (clean-up; the audit trail
+		* keeps the revocation). Refuses a live credential: revoke it first. After
+		* the row is gone the device's next call answers `unknown-credential`.
+		*/
+		deleteDeviceCredential: require_sleep.method(zod.z.object({ id: zod.z.string().min(1) }), zod.z.object({ result: zod.z.enum([
+			"deleted",
+			"live",
+			"unknown"
+		]) }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* The device CA: `absent` until the first enrollment creates it (lazily,
+		* never rotated on boot), `unavailable` while the keychain cannot answer.
+		*/
+		getDeviceCaStatus: require_sleep.method(zod.z.object({}), DeviceCaStatusSchema, { auth: "admin" }),
+		/** Rename a credential (the label only; the certificate is unchanged). */
+		renameDeviceCredential: require_sleep.method(zod.z.object({
+			id: zod.z.string().min(1),
+			deviceName: zod.z.string().min(1).max(80)
+		}), zod.z.object({ renamed: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+//#endregion
+//#region src/capabilities/node-certificates.cap.ts
+/**
+* `node-certificates` - what a node holds and the two renewals the hub drives
+* (D856): the node's MESH leaf (mutual TLS to the hub) and its HTTPS leaf (issued
+* from the hub's local CA so a device that trusts the hub root trusts the node).
+*
+* Provided by the AGENT RUNTIME (the synthetic `agent-runtime` addon id, like
+* `server-management`): the hub reaches it through the ordinary node-pinned
+* capability call - no new Moleculer action. The hub's own certificates are
+* handled in-process by the hub (`certificates` router), so this cap has no hub
+* provider.
+*
+* No private key ever crosses the mesh: the node generates its key pair, sends a
+* CSR, and the hub returns only the signed certificate.
+*/
+var MeshLeafInfoSchema = zod.z.object({
+	cn: zod.z.string(),
+	serial: zod.z.string(),
+	fingerprintSha256: zod.z.string(),
+	notBefore: zod.z.number(),
+	notAfter: zod.z.number()
+});
+var HttpsLeafInfoSchema = zod.z.object({
+	fingerprintSha256: zod.z.string(),
+	issuer: zod.z.string(),
+	sans: zod.z.array(zod.z.string()),
+	notBefore: zod.z.number(),
+	notAfter: zod.z.number()
+});
+var NodeHttpsStateSchema = zod.z.discriminatedUnion("state", [zod.z.object({
+	state: zod.z.literal("served"),
+	leaf: HttpsLeafInfoSchema
+}), zod.z.object({
+	state: zod.z.literal("not-issued"),
+	reason: zod.z.string()
+})]);
+var nodeCertificatesCapability = {
+	name: "node-certificates",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/** The node's current mesh leaf (`null` when it is not enrolled on mTLS) and HTTPS state. */
+		getCertificates: require_sleep.method(zod.z.object({}), zod.z.object({
+			nodeId: zod.z.string(),
+			mesh: MeshLeafInfoSchema.nullable(),
+			https: NodeHttpsStateSchema
+		}), { auth: "admin" }),
+		/** Generate a NEW mesh key pair on the node; return the CSR (CN = node id). The key stays here. */
+		prepareMeshRenewal: require_sleep.method(zod.z.object({}), zod.z.object({ csrPem: zod.z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Install the hub-signed leaf for the key made by `prepareMeshRenewal`: persist it
+		* (keeping the previous one), then reconnect to the hub with it. The node reverts to
+		* the previous leaf by itself unless `confirmMeshLeaf` arrives within `confirmWithinMs`.
+		*/
+		installMeshLeaf: require_sleep.method(zod.z.object({
+			certPem: zod.z.string().min(1),
+			caCertPem: zod.z.string().min(1),
+			confirmWithinMs: zod.z.number().int().min(1e4).max(6e5)
+		}), zod.z.object({
+			fingerprintSha256: zod.z.string(),
+			serial: zod.z.string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The hub saw the node reconnect with the new leaf: keep it, forget the previous one. */
+		confirmMeshLeaf: require_sleep.method(zod.z.object({ fingerprintSha256: zod.z.string() }), zod.z.object({ confirmed: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Go back to the previous leaf now. `false` when there is none to go back to. */
+		rollbackMeshLeaf: require_sleep.method(zod.z.object({}), zod.z.object({ rolledBack: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** A key pair + CSR for the node's HTTPS leaf, and the names the node reports for itself. */
+		prepareHttpsCertificate: require_sleep.method(zod.z.object({}), zod.z.object({
+			csrPem: zod.z.string(),
+			hostnames: zod.z.array(zod.z.string()),
+			addresses: zod.z.array(zod.z.string()),
+			/** SHA-256 of the hub local CA this node pinned at its first install; `null` before one. */
+			pinnedCaFingerprintSha256: zod.z.string().nullable()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Install the hub-signed HTTPS leaf and hot-swap the serving context (no restart). */
+		installHttpsCertificate: require_sleep.method(zod.z.object({
+			certPem: zod.z.string().min(1),
+			caCertPem: zod.z.string().min(1),
+			/**
+			* The hub signals that its local CA was rotated (D227) and this leaf chains to the NEW
+			* one. Only the hub, over the authenticated mesh, can say so; a leaf with a different CA
+			* and no signal is refused.
+			*/
+			caRotation: zod.z.boolean().optional()
+		}), HttpsLeafInfoSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	mount: { kind: "skip" }
+};
+//#endregion
 //#region src/capabilities/keychain-admin.cap.ts
 /**
 * `keychain-admin` — the operator's view of the keychain (System → Secrets).
@@ -14417,6 +14963,10 @@ var deviceDiscoveryCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "session",
+	/**
+	* History (D850): none — inventory.
+	*/
+	history: "none",
 	methods: {
 		/**
 		* Snapshot of the current `discovered` list. Returns the
@@ -40936,6 +41486,10 @@ var alarmPanelCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — enum state; arm/disarm history belongs in the events ledger.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -49913,7 +50467,11 @@ var zonesCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "restored"
+	durability: "restored",
+	/**
+	* History (D850): none — configuration arrays.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/pipeline-runner.cap.ts
@@ -54033,6 +54591,10 @@ var streamSignalsCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "session",
+	/**
+	* History (D850): none — array state.
+	*/
+	history: "none",
 	methods: { 
 	/**
 	* What this device can emit. Empty is a valid and common answer — most
@@ -57252,6 +57814,36 @@ var airQualitySensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: {
+		co2Ppm: {
+			kind: "gauge",
+			unit: "ppm",
+			deadband: 5
+		},
+		vocPpb: {
+			kind: "gauge",
+			unit: "ppb",
+			deadband: 5
+		},
+		pm25: {
+			kind: "gauge",
+			unit: "ug/m3",
+			deadband: 1
+		},
+		pm10: {
+			kind: "gauge",
+			unit: "ug/m3",
+			deadband: 1
+		},
+		aqi: {
+			kind: "gauge",
+			unit: "count",
+			deadband: 1
+		}
+	} },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -57296,6 +57888,15 @@ var ambientLightSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. Wide range, so a RELATIVE deadband (10 %).
+	*/
+	history: { fields: { lux: {
+		kind: "gauge",
+		unit: "lx",
+		deadbandPct: 10,
+		minIntervalMs: 6e4
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -57434,7 +58035,11 @@ var audioMetricsCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — the level is the addon series `pipeline-analytics/audio-level` (producer `record`); the other numbers move every inference window and duplicate it.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/automation-control.cap.ts
@@ -57505,7 +58110,11 @@ var automationControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — configuration and transient run state.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/battery.cap.ts
@@ -57688,6 +58297,13 @@ onStatusChanged: { data: zod.z.object({
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. The generic capture replaces the `battery` series of `pipeline-analytics:stats-5m`.
+	*/
+	history: { fields: { percentage: {
+		kind: "gauge",
+		unit: "%"
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastUpdated"]
@@ -57729,6 +58345,10 @@ var binaryCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { on: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -57793,7 +58413,15 @@ onBrightnessChanged: { data: zod.z.object({
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Actuator tier: level keeps every change.
+	*/
+	history: { fields: { percentage: {
+		kind: "gauge",
+		unit: "%",
+		minIntervalMs: 0
+	} } }
 };
 //#endregion
 //#region src/capabilities/button.cap.ts
@@ -58270,6 +58898,10 @@ var carbonMonoxideCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { detected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -58441,7 +59073,37 @@ var climateControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Celsius by contract; setpoints keep every change (`minIntervalMs: 0`).
+	*/
+	history: { fields: {
+		currentTemp: {
+			kind: "gauge",
+			unit: "°C",
+			deadband: .1
+		},
+		currentHumidity: {
+			kind: "gauge",
+			unit: "%",
+			deadband: .5
+		},
+		target: {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		},
+		targetHigh: {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		},
+		targetLow: {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		}
+	} }
 };
 //#endregion
 //#region src/capabilities/color.cap.ts
@@ -58560,7 +59222,11 @@ onColorChanged: { data: zod.z.object({
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — nested and cosmetic.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/connection-test.cap.ts
@@ -58692,6 +59358,10 @@ var connectivityCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — duplicates device-status.online (one authority for availability).
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -58818,6 +59488,10 @@ reset: require_sleep.method(zod.z.object({
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — `items` is an array keyed by runtime ids; a history path never enters it.
+	*/
+	history: "none",
 	/** Clocks, not content: a re-read that changed no item costs no commit. */
 	volatileStateFields: ["lastChangedAt", "lastFetchedAt"]
 };
@@ -58860,6 +59534,10 @@ var contactCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { entryOpen: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -59001,7 +59679,11 @@ var controlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `value` is a number/string union; configuration entity.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/cover.cap.ts
@@ -59094,6 +59776,14 @@ var coverCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. Actuator tier: position keeps every tick of a movement.
+	*/
+	history: { fields: { position: {
+		kind: "gauge",
+		unit: "%",
+		minIntervalMs: 0
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -59200,6 +59890,10 @@ var dayNightCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — firmware configuration, not a measurement.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -59259,6 +59953,10 @@ onStatusChanged: { data: zod.z.object({
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. The ONE availability series.
+	*/
+	history: { fields: { online: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -59327,7 +60025,11 @@ onPressed: {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "restored"
+	durability: "restored",
+	/**
+	* History (D850): none — `pressCountSinceStart` resets with the addon, so it is not a monotonic meter; presses live in the events ledger.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/enum-sensor.cap.ts
@@ -59377,6 +60079,10 @@ var enumSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — text/enum state has no history (non-goal).
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -59424,7 +60130,11 @@ var eventEmitterCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `eventCountSinceStart` resets with the addon; events live in ledgers.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/face-gallery.cap.ts
@@ -59924,7 +60634,18 @@ var fanControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Actuator tier: speed keeps every change.
+	*/
+	history: { fields: {
+		percentage: {
+			kind: "gauge",
+			unit: "%",
+			minIntervalMs: 0
+		},
+		oscillating: { kind: "boolean" }
+	} }
 };
 //#endregion
 //#region src/capabilities/feature-probe.cap.ts
@@ -60009,7 +60730,11 @@ onProbeChanged: { data: zod.z.object({
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — static identity and capability probe.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/flood.cap.ts
@@ -60046,6 +60771,10 @@ var floodCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { flooded: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -60081,6 +60810,10 @@ var gasCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { detected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -60168,7 +60901,18 @@ var humidifierCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: {
+		currentHumidity: {
+			kind: "gauge",
+			unit: "%",
+			deadband: .5
+		},
+		on: { kind: "boolean" }
+	} }
 };
 //#endregion
 //#region src/capabilities/humidity-sensor.cap.ts
@@ -60214,6 +60958,14 @@ var humiditySensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { percent: {
+		kind: "gauge",
+		unit: "%",
+		deadband: .5
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -60263,7 +61015,11 @@ var imageCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — not numeric.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/image-settings.cap.ts
@@ -60422,6 +61178,10 @@ var imageSettingsCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — camera image configuration (operator intent), not a trend.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -60829,7 +61589,11 @@ var intercomCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — talk sessions are a ledger concern, not a trend.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/lawn-mower-control.cap.ts
@@ -60912,7 +61676,15 @@ var lawnMowerControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { batteryLevel: {
+		kind: "gauge",
+		unit: "%",
+		deadband: 2
+	} } }
 };
 //#endregion
 //#region src/capabilities/local-network.cap.ts
@@ -61507,6 +62279,10 @@ var lockControlCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — enum state; lock events belong in the events ledger.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -61680,7 +62456,11 @@ var mediaPlayerCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `positionMs` moves continuously while playing; volume is transient.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/mesh-network.cap.ts
@@ -62079,7 +62859,14 @@ onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. A PIR sensor is a series; a camera is not (its motion is an addon series and a ledger).
+	*/
+	history: { fields: { detected: {
+		kind: "boolean",
+		excludeDeviceTypes: [require_err_msg.DeviceType.Camera]
+	} } }
 };
 //#endregion
 //#region src/capabilities/motion-trigger.cap.ts
@@ -62153,7 +62940,11 @@ var motionTriggerCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — configuration switch.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/motion-zones.cap.ts
@@ -62230,6 +63021,10 @@ var motionZonesCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — configuration.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -62361,6 +63156,10 @@ var nativeObjectDetectionCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — event-like and nested per class; detections live in the objects ledger.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -62788,7 +63587,11 @@ var navigationCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — control state of a robotic camera, configuration-like.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/network-link.cap.ts
@@ -62905,6 +63708,23 @@ onStatusChanged: { data: zod.z.object({
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: {
+		signalPercent: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 3,
+			minIntervalMs: 6e4
+		},
+		rssiDbm: {
+			kind: "gauge",
+			unit: "dBm",
+			deadband: 2,
+			minIntervalMs: 6e4
+		}
+	} },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastUpdated"]
@@ -63364,7 +64184,11 @@ onSent: { data: zod.z.object({
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — `queueDepth` is outbox operational state, not a device trend.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/numeric-sensor.cap.ts
@@ -63417,6 +64241,14 @@ var numericSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. The unit is per device, read from the sibling `unit` field.
+	*/
+	history: { fields: { value: {
+		kind: "gauge",
+		unitFrom: "unit",
+		minIntervalMs: 3e4
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -64012,7 +64844,24 @@ var petFeederCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: {
+		foodLevel: { kind: "gauge" },
+		food1: { kind: "gauge" },
+		food2: { kind: "gauge" },
+		batteryPower: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		desiccantLeftDays: {
+			kind: "gauge",
+			unit: "days"
+		}
+	} }
 };
 //#endregion
 //#region src/capabilities/plate-gallery.cap.ts
@@ -64441,6 +65290,47 @@ var powerMeterCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series. Gauges are floored at 30 s; `kwhTotal` is the one monotonic meter (counter).
+	*/
+	history: { fields: {
+		watts: {
+			kind: "gauge",
+			unit: "W",
+			deadband: 1,
+			minIntervalMs: 3e4
+		},
+		kwhTotal: {
+			kind: "counter",
+			unit: "kWh",
+			deadband: .01,
+			minIntervalMs: 6e4
+		},
+		volts: {
+			kind: "gauge",
+			unit: "V",
+			deadband: 1,
+			minIntervalMs: 3e4
+		},
+		amps: {
+			kind: "gauge",
+			unit: "A",
+			deadband: .05,
+			minIntervalMs: 3e4
+		},
+		va: {
+			kind: "gauge",
+			unit: "VA",
+			deadband: 1,
+			minIntervalMs: 3e4
+		},
+		powerFactor: {
+			kind: "gauge",
+			unit: "ratio",
+			deadband: .01,
+			minIntervalMs: 6e4
+		}
+	} },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -64510,6 +65400,14 @@ var presenceCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { batteryPercent: {
+		kind: "gauge",
+		unit: "%",
+		deadband: 1
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -64558,6 +65456,14 @@ var pressureSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { hpa: {
+		kind: "gauge",
+		unit: "hPa",
+		deadband: .1
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -64719,6 +65625,10 @@ var privacyMaskCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — configuration.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -65231,7 +66141,11 @@ var ptzAutotrackCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — configuration and capability.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/reboot.cap.ts
@@ -67264,6 +68178,10 @@ var recordingOnboardCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — SD-card configuration and window inventory; arrays.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -67600,7 +68518,11 @@ getStatus: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), Reco
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — recording intent is already in the recordings ledger.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/reserved-collection-sources.ts
@@ -68025,7 +68947,11 @@ var sceneMonitorCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — nested configuration.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/schemas/zone-rule.ts
@@ -68184,7 +69110,11 @@ var scriptRunnerCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — transient; run results belong in a ledger.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/smoke.cap.ts
@@ -68221,6 +69151,10 @@ var smokeCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { detected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -68322,6 +69256,10 @@ var streamCatalogCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — stream inventory.
+	*/
+	history: "none",
 	/** Clock field: written, but excluded from the compare that decides whether
 	*  persisting is worth a SQLite commit — the descriptors are the value. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -68473,6 +69411,10 @@ var streamParamsCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): none — encoder configuration.
+	*/
+	history: "none",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -68789,6 +69731,10 @@ var switchCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { on: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"],
@@ -69467,6 +70413,10 @@ var tamperCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { tampered: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -69524,6 +70474,14 @@ var temperatureSensorCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { celsius: {
+		kind: "gauge",
+		unit: "°C",
+		deadband: .1
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -69613,7 +70571,11 @@ var updateCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — text and state.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/user-management.cap.ts
@@ -70009,7 +70971,37 @@ var vacuumControlCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Tank levels are fixed-object paths (`cleanWater.level`, ...).
+	*/
+	history: { fields: {
+		batteryLevel: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"cleanWater.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"dirtyWater.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"detergent.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"dustBin.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		}
+	} }
 };
 //#endregion
 //#region src/capabilities/valve.cap.ts
@@ -70088,7 +71080,15 @@ var valveCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Actuator tier: position keeps every change.
+	*/
+	history: { fields: { position: {
+		kind: "gauge",
+		unit: "%",
+		minIntervalMs: 0
+	} } }
 };
 //#endregion
 //#region src/capabilities/vibration.cap.ts
@@ -70120,6 +71120,10 @@ var vibrationCapability = {
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
 	durability: "restored",
+	/**
+	* History (D850): recorded series.
+	*/
+	history: { fields: { detected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -70205,7 +71209,22 @@ var waterHeaterCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. The schema carries no unit; providers publish Celsius. Setpoint keeps every change.
+	*/
+	history: { fields: {
+		currentTemp: {
+			kind: "gauge",
+			unit: "°C",
+			deadband: .5
+		},
+		targetTemp: {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		}
+	} }
 };
 //#endregion
 //#region src/capabilities/weather.cap.ts
@@ -70273,7 +71292,32 @@ var weatherCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): recorded series. Units follow the sibling `*Unit` fields.
+	*/
+	history: { fields: {
+		temperature: {
+			kind: "gauge",
+			unitFrom: "temperatureUnit",
+			deadband: .2
+		},
+		humidity: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		pressure: {
+			kind: "gauge",
+			unitFrom: "pressureUnit",
+			deadband: .5
+		},
+		windSpeed: {
+			kind: "gauge",
+			unitFrom: "windSpeedUnit",
+			deadband: .5
+		}
+	} }
 };
 //#endregion
 //#region src/capabilities/zone-analytics.cap.ts
@@ -70517,7 +71561,11 @@ var zoneAnalyticsCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "session",
+	/**
+	* History (D850): none — occupancy is the addon series `pipeline-analytics/occupancy`; the rest is per-zone arrays keyed by runtime ids.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/zone-rules.cap.ts
@@ -70604,7 +71652,11 @@ var zoneRulesCapability = {
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "restored"
+	durability: "restored",
+	/**
+	* History (D850): none — configuration arrays.
+	*/
+	history: "none"
 };
 //#endregion
 //#region src/capabilities/training-provider.cap.ts
@@ -76263,6 +77315,54 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceCredentials.deleteDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.getDeviceCaStatus": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.getDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.listDeviceCredentials": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.renameDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.revokeDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.setDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.startEnrollment": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceDiscovery.adoptDevice": {
 		capName: "device-discovery",
 		capScope: "device",
@@ -78423,6 +79523,48 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.confirmMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.getCertificates": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"nodeCertificates.installHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.installMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareMeshRenewal": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.rollbackMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"nodes.clusterAddonStatus": {
 		capName: "nodes",
 		capScope: "system",
@@ -82700,6 +83842,7 @@ var KNOWN_CAP_NAMES = [
 	"detection-pipeline",
 	"device-admin-link",
 	"device-adoption",
+	"device-credentials",
 	"device-discovery",
 	"device-export",
 	"device-extension",
@@ -82751,6 +83894,7 @@ var KNOWN_CAP_NAMES = [
 	"network-access",
 	"network-link",
 	"network-quality",
+	"node-certificates",
 	"nodes",
 	"notification-output",
 	"notification-rules",
@@ -82938,6 +84082,7 @@ var SYSTEM_CAP_NAMES = [
 	"database-snapshot",
 	"decoder",
 	"device-adoption",
+	"device-credentials",
 	"device-export",
 	"device-manager",
 	"device-provider",
@@ -82963,6 +84108,7 @@ var SYSTEM_CAP_NAMES = [
 	"mqtt-broker",
 	"network-access",
 	"network-quality",
+	"node-certificates",
 	"nodes",
 	"notification-output",
 	"notification-rules",
@@ -84964,6 +86110,7 @@ var CAPABILITY_NAMES = {
 	detectionPipeline: "detection-pipeline",
 	deviceAdminLink: "device-admin-link",
 	deviceAdoption: "device-adoption",
+	deviceCredentials: "device-credentials",
 	deviceDiscovery: "device-discovery",
 	deviceExport: "device-export",
 	deviceExtension: "device-extension",
@@ -85015,6 +86162,7 @@ var CAPABILITY_NAMES = {
 	networkAccess: "network-access",
 	networkLink: "network-link",
 	networkQuality: "network-quality",
+	nodeCertificates: "node-certificates",
 	nodes: "nodes",
 	notificationOutput: "notification-output",
 	notificationRules: "notification-rules",
@@ -85287,6 +86435,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "deviceAdoption",
 		name: "device-adoption"
 	},
+	{
+		key: "deviceCredentials",
+		name: "device-credentials"
+	},
 	{
 		key: "deviceDiscovery",
 		name: "device-discovery"
@@ -85491,6 +86643,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "networkQuality",
 		name: "network-quality"
 	},
+	{
+		key: "nodeCertificates",
+		name: "node-certificates"
+	},
 	{
 		key: "nodes",
 		name: "nodes"
@@ -85828,6 +86984,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	detectionPipelineCapability,
 	deviceAdminLinkCapability,
 	deviceAdoptionCapability,
+	deviceCredentialsCapability,
 	deviceDiscoveryCapability,
 	deviceExportCapability,
 	deviceExtensionCapability,
@@ -85879,6 +87036,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	networkAccessCapability,
 	networkLinkCapability,
 	networkQualityCapability,
+	nodeCertificatesCapability,
 	nodesCapability,
 	notificationOutputCapability,
 	notificationRulesCapability,
@@ -89131,6 +90289,325 @@ var RESTORED_CAP_NAMES = [
 	"zones"
 ];
 //#endregion
+//#region src/generated/history-catalog.ts
+/**
+* Cap history catalog, projected from every `*.cap.ts` `history` block.
+* 32 caps with series (60 series), 37 caps answered `'none'`.
+* Field keys are `runtimeState` paths (`a.b` into fixed objects only).
+*/
+var HISTORY_CATALOG = {
+	"air-quality-sensor": {
+		"co2Ppm": {
+			kind: "gauge",
+			unit: "ppm",
+			deadband: 5
+		},
+		"vocPpb": {
+			kind: "gauge",
+			unit: "ppb",
+			deadband: 5
+		},
+		"pm25": {
+			kind: "gauge",
+			unit: "ug/m3",
+			deadband: 1
+		},
+		"pm10": {
+			kind: "gauge",
+			unit: "ug/m3",
+			deadband: 1
+		},
+		"aqi": {
+			kind: "gauge",
+			unit: "count",
+			deadband: 1
+		}
+	},
+	"ambient-light-sensor": { "lux": {
+		kind: "gauge",
+		unit: "lx",
+		deadbandPct: 10,
+		minIntervalMs: 6e4
+	} },
+	"battery": { "percentage": {
+		kind: "gauge",
+		unit: "%"
+	} },
+	"binary": { "on": { kind: "boolean" } },
+	"brightness": { "percentage": {
+		kind: "gauge",
+		unit: "%",
+		minIntervalMs: 0
+	} },
+	"carbon-monoxide": { "detected": { kind: "boolean" } },
+	"climate-control": {
+		"currentTemp": {
+			kind: "gauge",
+			unit: "°C",
+			deadband: .1
+		},
+		"currentHumidity": {
+			kind: "gauge",
+			unit: "%",
+			deadband: .5
+		},
+		"target": {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		},
+		"targetHigh": {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		},
+		"targetLow": {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		}
+	},
+	"contact": { "entryOpen": { kind: "boolean" } },
+	"cover": { "position": {
+		kind: "gauge",
+		unit: "%",
+		minIntervalMs: 0
+	} },
+	"device-status": { "online": { kind: "boolean" } },
+	"fan-control": {
+		"percentage": {
+			kind: "gauge",
+			unit: "%",
+			minIntervalMs: 0
+		},
+		"oscillating": { kind: "boolean" }
+	},
+	"flood": { "flooded": { kind: "boolean" } },
+	"gas": { "detected": { kind: "boolean" } },
+	"humidifier": {
+		"currentHumidity": {
+			kind: "gauge",
+			unit: "%",
+			deadband: .5
+		},
+		"on": { kind: "boolean" }
+	},
+	"humidity-sensor": { "percent": {
+		kind: "gauge",
+		unit: "%",
+		deadband: .5
+	} },
+	"lawn-mower-control": { "batteryLevel": {
+		kind: "gauge",
+		unit: "%",
+		deadband: 2
+	} },
+	"motion": { "detected": {
+		kind: "boolean",
+		excludeDeviceTypes: [require_err_msg.DeviceType.Camera]
+	} },
+	"network-link": {
+		"signalPercent": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 3,
+			minIntervalMs: 6e4
+		},
+		"rssiDbm": {
+			kind: "gauge",
+			unit: "dBm",
+			deadband: 2,
+			minIntervalMs: 6e4
+		}
+	},
+	"numeric-sensor": { "value": {
+		kind: "gauge",
+		unitFrom: "unit",
+		minIntervalMs: 3e4
+	} },
+	"pet-feeder": {
+		"foodLevel": { kind: "gauge" },
+		"food1": { kind: "gauge" },
+		"food2": { kind: "gauge" },
+		"batteryPower": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"desiccantLeftDays": {
+			kind: "gauge",
+			unit: "days"
+		}
+	},
+	"power-meter": {
+		"watts": {
+			kind: "gauge",
+			unit: "W",
+			deadband: 1,
+			minIntervalMs: 3e4
+		},
+		"kwhTotal": {
+			kind: "counter",
+			unit: "kWh",
+			deadband: .01,
+			minIntervalMs: 6e4
+		},
+		"volts": {
+			kind: "gauge",
+			unit: "V",
+			deadband: 1,
+			minIntervalMs: 3e4
+		},
+		"amps": {
+			kind: "gauge",
+			unit: "A",
+			deadband: .05,
+			minIntervalMs: 3e4
+		},
+		"va": {
+			kind: "gauge",
+			unit: "VA",
+			deadband: 1,
+			minIntervalMs: 3e4
+		},
+		"powerFactor": {
+			kind: "gauge",
+			unit: "ratio",
+			deadband: .01,
+			minIntervalMs: 6e4
+		}
+	},
+	"presence": { "batteryPercent": {
+		kind: "gauge",
+		unit: "%",
+		deadband: 1
+	} },
+	"pressure-sensor": { "hpa": {
+		kind: "gauge",
+		unit: "hPa",
+		deadband: .1
+	} },
+	"smoke": { "detected": { kind: "boolean" } },
+	"switch": { "on": { kind: "boolean" } },
+	"tamper": { "tampered": { kind: "boolean" } },
+	"temperature-sensor": { "celsius": {
+		kind: "gauge",
+		unit: "°C",
+		deadband: .1
+	} },
+	"vacuum-control": {
+		"batteryLevel": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"cleanWater.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"dirtyWater.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"detergent.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"dustBin.level": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		}
+	},
+	"valve": { "position": {
+		kind: "gauge",
+		unit: "%",
+		minIntervalMs: 0
+	} },
+	"vibration": { "detected": { kind: "boolean" } },
+	"water-heater": {
+		"currentTemp": {
+			kind: "gauge",
+			unit: "°C",
+			deadband: .5
+		},
+		"targetTemp": {
+			kind: "gauge",
+			unit: "°C",
+			minIntervalMs: 0
+		}
+	},
+	"weather": {
+		"temperature": {
+			kind: "gauge",
+			unitFrom: "temperatureUnit",
+			deadband: .2
+		},
+		"humidity": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		"pressure": {
+			kind: "gauge",
+			unitFrom: "pressureUnit",
+			deadband: .5
+		},
+		"windSpeed": {
+			kind: "gauge",
+			unitFrom: "windSpeedUnit",
+			deadband: .5
+		}
+	}
+};
+/** Caps that declared `history: 'none'`, sorted. */
+var HISTORY_NONE_CAPS = [
+	"alarm-panel",
+	"audio-metrics",
+	"automation-control",
+	"camera-streams",
+	"color",
+	"connectivity",
+	"consumables",
+	"control",
+	"day-night",
+	"device-discovery",
+	"doorbell",
+	"enum-sensor",
+	"event-emitter",
+	"feature-probe",
+	"image",
+	"image-settings",
+	"intercom",
+	"lock-control",
+	"media-player",
+	"motion-trigger",
+	"motion-zones",
+	"native-object-detection",
+	"navigation",
+	"notifier",
+	"privacy-mask",
+	"ptz-autotrack",
+	"recording-onboard",
+	"recording-signal",
+	"scene-monitor",
+	"script-runner",
+	"stream-catalog",
+	"stream-params",
+	"stream-signals",
+	"update",
+	"zone-analytics",
+	"zone-rules",
+	"zones"
+];
+/** The series specs of `capName`; empty for a `'none'` cap or an unknown one. */
+function historyFieldsFor(capName) {
+	return HISTORY_CATALOG[capName] ?? {};
+}
+//#endregion
 //#region src/generated/scope-presets.ts
 var SCOPE_PRESETS = [
 	{
@@ -89384,6 +90861,16 @@ function createSystemProxy(api) {
 			release: (input) => dispatch("deviceAdoption", "release", "mutation", input),
 			resync: (input) => dispatch("deviceAdoption", "resync", "mutation", input)
 		},
+		deviceCredentials: {
+			listDeviceCredentials: (input) => dispatch("deviceCredentials", "listDeviceCredentials", "query", input),
+			startEnrollment: (input) => dispatch("deviceCredentials", "startEnrollment", "mutation", input),
+			revokeDeviceCredential: (input) => dispatch("deviceCredentials", "revokeDeviceCredential", "mutation", input),
+			getDeviceCertificateSettings: (input) => dispatch("deviceCredentials", "getDeviceCertificateSettings", "query", input),
+			setDeviceCertificateSettings: (input) => dispatch("deviceCredentials", "setDeviceCertificateSettings", "mutation", input),
+			deleteDeviceCredential: (input) => dispatch("deviceCredentials", "deleteDeviceCredential", "mutation", input),
+			getDeviceCaStatus: (input) => dispatch("deviceCredentials", "getDeviceCaStatus", "query", input),
+			renameDeviceCredential: (input) => dispatch("deviceCredentials", "renameDeviceCredential", "mutation", input)
+		},
 		deviceExport: {
 			getStatus: (input) => dispatch("deviceExport", "getStatus", "query", input),
 			listSupportedDeviceKinds: (input) => dispatch("deviceExport", "listSupportedDeviceKinds", "query", input),
@@ -98718,6 +100205,9 @@ exports.ClusterModelChoiceSchema = ClusterModelChoiceSchema;
 exports.CollectionColumnSchema = CollectionColumnSchema;
 exports.CollectionIndexSchema = CollectionIndexSchema;
 exports.ColorStatusSchema = ColorStatusSchema;
+exports.CompleteEnrollmentInputSchema = CompleteEnrollmentInputSchema;
+exports.CompleteEnrollmentOutputSchema = CompleteEnrollmentOutputSchema;
+exports.CompleteEnrollmentResultSchema = CompleteEnrollmentResultSchema;
 exports.ComposableCapabilitiesSchema = ComposableCapabilitiesSchema;
 exports.ComposableCapabilitySchema = ComposableCapabilitySchema;
 exports.ComposableFieldSchema = ComposableFieldSchema;
@@ -98835,6 +100325,7 @@ exports.DEFAULT_SESSION_PLACEMENT_POLICY = DEFAULT_SESSION_PLACEMENT_POLICY;
 exports.DEFAULT_SHARE_SOURCE = DEFAULT_SHARE_SOURCE;
 exports.DEFAULT_TIMELAPSE_PREVIEW_TEXT = DEFAULT_TIMELAPSE_PREVIEW_TEXT;
 exports.DEFAULT_TOKEN_EXPIRY = require_sleep.DEFAULT_TOKEN_EXPIRY;
+exports.DEFINITIVE_DEVICE_REFUSALS = DEFINITIVE_DEVICE_REFUSALS;
 exports.DERIVED_CAMERA_SILENCED_CAP_NAMES = DERIVED_CAMERA_SILENCED_CAP_NAMES;
 exports.DETAIL_CROP_PADDING_FIELD = DETAIL_CROP_PADDING_FIELD;
 exports.DETAIL_CROP_PADDING_KEY = DETAIL_CROP_PADDING_KEY;
@@ -98846,14 +100337,24 @@ exports.DETECTOR_ACCURACY = DETECTOR_ACCURACY;
 exports.DETECTOR_PERF = DETECTOR_PERF;
 exports.DEVICE_BACKEND_TO_FORMAT = DEVICE_BACKEND_TO_FORMAT;
 exports.DEVICE_CAP_NAMES = DEVICE_CAP_NAMES;
+exports.DEVICE_CERT_RENEW_WINDOW_DAYS = DEVICE_CERT_RENEW_WINDOW_DAYS;
+exports.DEVICE_CERT_SIGNATURE = DEVICE_CERT_SIGNATURE;
+exports.DEVICE_CERT_VALIDITY_DAYS = DEVICE_CERT_VALIDITY_DAYS;
 exports.DEVICE_CHILDREN_BATCH_MAX = require_sleep.DEVICE_CHILDREN_BATCH_MAX;
+exports.DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE = DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE;
 exports.DEVICE_DO_ACTIONS = DEVICE_DO_ACTIONS;
+exports.DEVICE_ENROLLMENT_TTL_MS = DEVICE_ENROLLMENT_TTL_MS;
+exports.DEVICE_NONCE_TTL_MS = DEVICE_NONCE_TTL_MS;
 exports.DEVICE_PROFILES = DEVICE_PROFILES;
 exports.DEVICE_RAMP = DEVICE_RAMP;
+exports.DEVICE_REFRESH_REFUSAL_PREFIX = DEVICE_REFRESH_REFUSAL_PREFIX;
 exports.DEVICE_RESTORE_RETRY_CONCURRENCY = DEVICE_RESTORE_RETRY_CONCURRENCY;
 exports.DEVICE_RESTORE_RETRY_DELAYS_MS = DEVICE_RESTORE_RETRY_DELAYS_MS;
+exports.DEVICE_SAN_CREDENTIAL_PREFIX = DEVICE_SAN_CREDENTIAL_PREFIX;
+exports.DEVICE_SAN_USER_PREFIX = DEVICE_SAN_USER_PREFIX;
 exports.DEVICE_SCOPED_CAPS = require_sleep.DEVICE_SCOPED_CAPS;
 exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_sleep.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
+exports.DEVICE_SIGNATURE_MESSAGE_VERSION = DEVICE_SIGNATURE_MESSAGE_VERSION;
 exports.DEVICE_STATE_READERS = DEVICE_STATE_READERS;
 exports.DEVICE_STATUS_METHOD = require_sleep.DEVICE_STATUS_METHOD;
 exports.DEVICE_TYPE_CONTROL_KIND = DEVICE_TYPE_CONTROL_KIND;
@@ -98881,9 +100382,17 @@ exports.DetectionSourceSchema = DetectionSourceSchema;
 exports.DetectionSourcesSchema = DetectionSourcesSchema;
 exports.DetectorStoreClearSchema = DetectorStoreClearSchema;
 exports.DeviceAdminLinkSchema = DeviceAdminLinkSchema;
+exports.DeviceCaStatusSchema = DeviceCaStatusSchema;
+exports.DeviceCertificateLoginMethodSchema = DeviceCertificateLoginMethodSchema;
+exports.DeviceCertificateSettingsSchema = DeviceCertificateSettingsSchema;
+exports.DeviceChallengeResultSchema = DeviceChallengeResultSchema;
+exports.DeviceChallengeSchema = DeviceChallengeSchema;
 exports.DeviceCodeSeveritySchema = DeviceCodeSeveritySchema;
 exports.DeviceConfig = DeviceConfig;
+exports.DeviceCredentialSchema = DeviceCredentialSchema;
+exports.DeviceCredentialStatusSchema = DeviceCredentialStatusSchema;
 exports.DeviceDiscoveryStatusSchema = DeviceDiscoveryStatusSchema;
+exports.DeviceEnrollProofSchema = DeviceEnrollProofSchema;
 exports.DeviceExportExposeInputSchema = ExposeInputSchema;
 exports.DeviceExportStatusSchema = DeviceExportStatusSchema;
 exports.DeviceExportUnexposeInputSchema = UnexposeInputSchema;
@@ -98891,11 +100400,16 @@ exports.DeviceFeature = require_err_msg.DeviceFeature;
 exports.DeviceInfoSchema = DeviceInfoSchema;
 exports.DeviceModelChoiceSchema = DeviceModelChoiceSchema;
 exports.DeviceNetworkStatsSchema = DeviceNetworkStatsSchema;
+exports.DevicePlatformSchema = DevicePlatformSchema;
+exports.DeviceProofInputSchema = DeviceProofInputSchema;
 exports.DeviceRecommendationSchema = DeviceRecommendationSchema;
+exports.DeviceRefusalReasonSchema = DeviceRefusalReasonSchema;
+exports.DeviceRefusalSchema = DeviceRefusalSchema;
 exports.DeviceRestoreRetryScheduler = DeviceRestoreRetryScheduler;
 exports.DeviceRole = require_err_msg.DeviceRole;
 exports.DeviceRuntimeState = DeviceRuntimeState;
 exports.DeviceSelectorSchema = DeviceSelectorSchema;
+exports.DeviceSignaturePurposeSchema = DeviceSignaturePurposeSchema;
 exports.DeviceStatusSchema = DeviceStatusSchema;
 exports.DeviceType = require_err_msg.DeviceType;
 exports.DiagnosticIdSchema = DiagnosticIdSchema;
@@ -98948,6 +100462,7 @@ exports.EmbeddingResultSchema = EmbeddingResultSchema;
 exports.EmbeddingTowerSchema = EmbeddingTowerSchema;
 exports.EncodeProfileSchema = EncodeProfileSchema;
 exports.EnrichedWidgetMetadataSchema = EnrichedWidgetMetadataSchema;
+exports.EnrollSelfInputSchema = EnrollSelfInputSchema;
 exports.EnumSensorDateTimeFormatSchema = EnumSensorDateTimeFormatSchema;
 exports.EnumSensorStatusSchema = EnumSensorStatusSchema;
 exports.EventCategory = require_event_category.EventCategory;
@@ -99043,6 +100558,10 @@ exports.HAP_AUDIO_VBV_KBITS = HAP_AUDIO_VBV_KBITS;
 exports.HAP_KEYFRAME_INTERVAL_SEC = HAP_KEYFRAME_INTERVAL_SEC;
 exports.HF_BASE_URL = require_sleep.HF_BASE_URL;
 exports.HF_REPO = require_sleep.HF_REPO;
+exports.HISTORY_CATALOG = HISTORY_CATALOG;
+exports.HISTORY_DEFAULT_MIN_INTERVAL_MS = require_sleep.HISTORY_DEFAULT_MIN_INTERVAL_MS;
+exports.HISTORY_NONE_CAPS = HISTORY_NONE_CAPS;
+exports.HISTORY_UNIT_LABELS = require_sleep.HISTORY_UNIT_LABELS;
 exports.HOURS_PER_DAY = HOURS_PER_DAY;
 exports.HUB_ADDRESS_ROLES = HUB_ADDRESS_ROLES;
 exports.HUB_MDNS_QUERY_NAME = HUB_MDNS_QUERY_NAME;
@@ -99056,6 +100575,7 @@ exports.HealthStatusSchema = HealthStatusSchema;
 exports.HfModelResolutionSchema = HfModelResolutionSchema;
 exports.HistoryPointSchema = HistoryPointSchema;
 exports.HistoryResolutionEnum = HistoryResolutionEnum;
+exports.HttpsLeafInfoSchema = HttpsLeafInfoSchema;
 exports.HubAddressRoleSchema = HubAddressRoleSchema;
 exports.HumidifierStatusSchema = HumidifierStatusSchema;
 exports.HumiditySensorStatusSchema = HumiditySensorStatusSchema;
@@ -99251,6 +100771,7 @@ exports.MediaPlayerStateSchema = MediaPlayerStateSchema;
 exports.MediaPlayerStatusSchema = MediaPlayerStatusSchema;
 exports.MediaPresenceOwnerKindSchema = MediaPresenceOwnerKindSchema;
 exports.MediaRelocateModeSchema = MediaRelocateModeSchema;
+exports.MeshLeafInfoSchema = MeshLeafInfoSchema;
 exports.MeshPeerSchema = MeshPeerSchema;
 exports.MeshStatusSchema = MeshStatusSchema;
 exports.MethodAccessSchema = MethodAccessSchema;
@@ -99540,6 +101061,7 @@ exports.NodeColorIdSchema = require_node_color.NodeColorIdSchema;
 exports.NodeDeviceChangeSchema = NodeDeviceChangeSchema;
 exports.NodeDirectoryEntrySchema = NodeDirectoryEntrySchema;
 exports.NodeDirectorySchema = NodeDirectorySchema;
+exports.NodeHttpsStateSchema = NodeHttpsStateSchema;
 exports.NodeRecommendationSchema = NodeRecommendationSchema;
 exports.NotificationActionIconSchema = NotificationActionIconSchema;
 exports.NotificationActionSchema = NotificationActionSchema;
@@ -99758,6 +101280,8 @@ exports.RelocateMediaInputSchema = RelocateMediaInputSchema;
 exports.RelocateResidueInputSchema = RelocateResidueInputSchema;
 exports.RelocateResidueSchema = RelocateResidueSchema;
 exports.RenderedAsSchema = RenderedAsSchema;
+exports.RenewDeviceCertificateOutputSchema = RenewDeviceCertificateOutputSchema;
+exports.RenewDeviceCertificateResultSchema = RenewDeviceCertificateResultSchema;
 exports.ReportMotionInputSchema = ReportMotionInputSchema;
 exports.ReportedFailureContributionSchema = ReportedFailureContributionSchema;
 exports.ReportedLoadContributionSchema = ReportedLoadContributionSchema;
@@ -99809,6 +101333,7 @@ exports.RetrainTrackSchema = RetrainTrackSchema;
 exports.RetrainTrainingCorpusResolveResultSchema = RetrainTrainingCorpusResolveResultSchema;
 exports.RetrainTrainingCorpusSelectionSchema = RetrainTrainingCorpusSelectionSchema;
 exports.RetrainTransitionResultSchema = RetrainTransitionResultSchema;
+exports.RevokeOwnDeviceCertificateResultSchema = RevokeOwnDeviceCertificateResultSchema;
 exports.RingBuffer = RingBuffer;
 exports.RootStepSupplySchema = RootStepSupplySchema;
 exports.RtpSourceSchema = RtpSourceSchema;
@@ -99912,6 +101437,7 @@ exports.SpatialDetectionSchema = SpatialDetectionSchema;
 exports.SsoBridgeClaimsSchema = SsoBridgeClaimsSchema;
 exports.StaleDevicePinSchema = StaleDevicePinSchema;
 exports.StartEmbeddedInputSchema = StartEmbeddedInputSchema;
+exports.StartEnrollmentOutputSchema = StartEnrollmentOutputSchema;
 exports.StationaryObjectSchema = StationaryObjectSchema;
 exports.StorageAbortUploadInputSchema = AbortUploadInputSchema;
 exports.StorageAccessSchema = StorageAccessSchema;
@@ -100160,6 +101686,7 @@ exports.addonWidgetsCapability = addonWidgetsCapability;
 exports.addonWidgetsSourceCapability = addonWidgetsSourceCapability;
 exports.addonsCapability = addonsCapability;
 exports.adminUiCapability = require_sleep.adminUiCapability;
+exports.advertisedHubOrigins = advertisedHubOrigins;
 exports.airQualitySensorCapability = airQualitySensorCapability;
 exports.alarmDeviceBlocksArming = alarmDeviceBlocksArming;
 exports.alarmDeviceSecureOnArm = alarmDeviceSecureOnArm;
@@ -100212,6 +101739,8 @@ exports.buildAudioArgs = require_composition.buildAudioArgs;
 exports.buildBenchStepTree = buildBenchStepTree;
 exports.buildCapabilityLookup = buildCapabilityLookup;
 exports.buildDeviceAdminUrl = buildDeviceAdminUrl;
+exports.buildDeviceEnrollmentLink = buildDeviceEnrollmentLink;
+exports.buildDeviceSignatureMessage = buildDeviceSignatureMessage;
 exports.buildDoorbellCompositionFeature = buildDoorbellCompositionFeature;
 exports.buildEventKindDescriptor = buildEventKindDescriptor;
 exports.buildFfmpegArgs = require_composition.buildFfmpegArgs;
@@ -100244,6 +101773,7 @@ exports.capacitySessionsOf = capacitySessionsOf;
 exports.carbonMonoxideCapability = carbonMonoxideCapability;
 exports.cellsToRects = cellsToRects;
 exports.checkRoleAddress = checkRoleAddress;
+exports.claimedRequestOrigins = claimedRequestOrigins;
 exports.classifyBearerPrincipal = classifyBearerPrincipal;
 exports.classifyCamerasForBenchmark = classifyCamerasForBenchmark;
 exports.classifyInferenceHardware = classifyInferenceHardware;
@@ -100365,6 +101895,7 @@ exports.detectionPipelineCapability = detectionPipelineCapability;
 exports.deviceAdminLinkCapability = deviceAdminLinkCapability;
 exports.deviceAdoptionCapability = deviceAdoptionCapability;
 exports.deviceBackendToFormat = deviceBackendToFormat;
+exports.deviceCredentialsCapability = deviceCredentialsCapability;
 exports.deviceCustomAction = require_sleep.deviceCustomAction;
 exports.deviceDiscoveryCapability = deviceDiscoveryCapability;
 exports.deviceDoFamily = deviceDoFamily;
@@ -100374,6 +101905,7 @@ exports.deviceManagerCapability = deviceManagerCapability;
 exports.deviceMatchesProfile = deviceMatchesProfile;
 exports.deviceOpsCapability = require_sleep.deviceOpsCapability;
 exports.deviceProviderCapability = deviceProviderCapability;
+exports.deviceRefusalFromMessage = deviceRefusalFromMessage;
 exports.deviceSelectorMatches = deviceSelectorMatches;
 exports.deviceStateCapability = deviceStateCapability;
 exports.deviceStatusCapability = deviceStatusCapability;
@@ -100450,6 +101982,7 @@ exports.findTimezone = findTimezone;
 exports.floodCapability = floodCapability;
 exports.foldSnapshotByFunction = foldSnapshotByFunction;
 exports.forgetKnownSecret = require_sleep.forgetKnownSecret;
+exports.formatDeviceRevoker = formatDeviceRevoker;
 exports.formatForRuntime = formatForRuntime;
 exports.formatMediaOwnerKey = formatMediaOwnerKey;
 exports.formatMinutes = formatMinutes;
@@ -100474,6 +102007,7 @@ exports.hasModelBoundOverrides = hasModelBoundOverrides;
 exports.hasMotionTrigger = hasMotionTrigger;
 exports.hasUrlScheme = hasUrlScheme;
 exports.hfModelUrl = require_sleep.hfModelUrl;
+exports.historyFieldsFor = historyFieldsFor;
 exports.htmlToText = htmlToText;
 exports.hubAddressHostname = hubAddressHostname;
 exports.hubMotionNativeProvider = hubMotionNativeProvider;
@@ -100509,6 +102043,7 @@ exports.isClusterScopedStep = isClusterScopedStep;
 exports.isCollectionArrayMethod = isCollectionArrayMethod;
 exports.isDefaultAlarmProfileId = isDefaultAlarmProfileId;
 exports.isDefaultAppConnectionEndpoint = isDefaultAppConnectionEndpoint;
+exports.isDefinitiveDeviceRefusal = isDefinitiveDeviceRefusal;
 exports.isDeployableToAgent = isDeployableToAgent;
 exports.isDetectionMacroClass = isDetectionMacroClass;
 exports.isDeviceConfigCap = require_sleep.isDeviceConfigCap;
@@ -100631,6 +102166,7 @@ exports.networkAccessCapability = networkAccessCapability;
 exports.networkLinkCapability = networkLinkCapability;
 exports.networkQualityCapability = networkQualityCapability;
 exports.nodeBenchmarkRefusals = nodeBenchmarkRefusals;
+exports.nodeCertificatesCapability = nodeCertificatesCapability;
 exports.nodePickerItems = nodePickerItems;
 exports.nodePin = require_sleep.nodePin;
 exports.nodesCapability = nodesCapability;
@@ -100638,6 +102174,7 @@ exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
 exports.normalizeAudioLabel = normalizeAudioLabel;
 exports.normalizeCoreBlockWrite = normalizeCoreBlockWrite;
 exports.normalizeNodeId = require_sleep.normalizeNodeId;
+exports.normalizeOrigin = normalizeOrigin;
 exports.normalizeSecretOwner = require_sleep.normalizeSecretOwner;
 exports.normalizeTokenScopes = normalizeTokenScopes;
 exports.normalizeUnit = normalizeUnit;
@@ -100659,6 +102196,7 @@ exports.packagePickerItems = packagePickerItems;
 exports.parseAdminBase = parseAdminBase;
 exports.parseAppAuthCallback = parseAppAuthCallback;
 exports.parseCameraStreamConfig = parseCameraStreamConfig;
+exports.parseDeviceEnrollmentLink = parseDeviceEnrollmentLink;
 exports.parseExpression = require_composition.parseExpression;
 exports.parseJsonArray = require_sleep.parseJsonArray;
 exports.parseJsonObject = require_sleep.parseJsonObject;
@@ -100685,6 +102223,7 @@ exports.pickDetailCropConvention = pickDetailCropConvention;
 exports.pickInvalidClusterStepModels = pickInvalidClusterStepModels;
 exports.pickNativeLeaseOverride = pickNativeLeaseOverride;
 exports.pickPreferredRtspEntry = pickPreferredRtspEntry;
+exports.pickRequestOrigin = pickRequestOrigin;
 exports.pickRestartCandidate = pickRestartCandidate;
 exports.pickVideoEncoder = require_composition.pickVideoEncoder;
 exports.pickerForCondition = pickerForCondition;
@@ -100738,6 +102277,7 @@ exports.reducePoints = reducePoints;
 exports.registerKnownSecret = require_sleep.registerKnownSecret;
 exports.renameAlarmProfile = renameAlarmProfile;
 exports.replacedFieldKeys = replacedFieldKeys;
+exports.requestMountPrefix = requestMountPrefix;
 exports.requiredTopLevelKeys = requiredTopLevelKeys;
 exports.requiresPython = requiresPython;
 exports.reservedSourceOwner = reservedSourceOwner;