@camstack/types 1.2.385 → 1.2.387

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-BE7_6UnC.js");
+const require_sleep = require("./sleep-6sOPE0EV.js");
 const require_event_category = require("./event-category-eSqkye-K.js");
 const require_composition = require("./composition-eoYYVfOp.js");
 const require_node_color = require("./node-color.js");
@@ -6616,7 +6616,7 @@ function classifyBearerPrincipal(payload) {
 *    would lock every non-admin viewer out of recorder playback, snapshot media
 *    and the stream-broker embed, which is a worse outcome than the hole.
 *  - **integration** — must hold `addon:<addonId>` at the verb's access. This is
-*    the same rule the `cst_` scoped-token branch has always applied; the JWT
+*    the same rule the scoped-token branch has always applied; the JWT
 *    branch simply never applied it, and closing that divergence IS the fix.
 *    `isAdmin` is ignored: an integration token is minted `isAdmin: false` and a
 *    token claiming otherwise must not talk its way past the grant.
@@ -6637,6 +6637,420 @@ function principalMayReachAddon(input) {
 	};
 }
 //#endregion
+//#region src/schemas/auth-records.ts
+/**
+* Zod schemas for persisted record types.
+*
+* These schemas serve as the single source of truth for types that are
+* stored in the settings-store backend and retrieved via tRPC. They
+* replace the manual TypeScript interfaces with schema-derived types,
+* enabling runtime validation when reading from the backend.
+*
+* Convention: each schema is named `<Type>Schema`, the inferred TS type
+* keeps the original name for backward compatibility.
+*/
+/**
+* Auth model (v2 — 2026-05-12 caps-only):
+*
+* Two principals:
+*   - `isAdmin: true`  — full bypass. Admin scope set is ignored.
+*   - `isAdmin: false` — every call gated by `scopes` (see TokenScope).
+*
+* No role enum. There used to be `viewer / agent / scoped` and earlier
+* `super_admin` — collapsed onto the single boolean because every
+* non-admin caller is governed by the same scope-check rules; the
+* distinction was only ever used to route role-specific procedures
+* which we no longer have. CLI / webhook integrations are tokens (`auth.mintToken`)
+* with `isAdmin: false` + an explicit scope list.
+*/
+/** Per-method access flavour. Materialised on every cap method via codegen. */
+var MethodAccessSchema = zod.z.enum([
+	"view",
+	"create",
+	"delete"
+]);
+/**
+* A single scope grant. Three forms — checked in matcher with OR
+* semantics; the first match decides whether the call passes:
+*
+*   - `category` — broadest. `target: 'device' | 'system'` selects every
+*     cap with the matching `scope` declaration. New caps inherit grants
+*     automatically — adding a device cap to the codebase makes it
+*     reachable to every user with `category:device [...]` without a
+*     re-grant. Use this for "family viewer" / "operator" tiers.
+*
+*   - `addon` — every cap that ships inside a given addon id. Niche;
+*     useful when an integration needs to interact with one specific
+*     addon's surface regardless of how many caps it exports.
+*
+*   - `capability` — the most precise form. Single cap name. Use for
+*     integration tokens where you want to grant `addons.installPackage`
+*     and nothing else.
+*
+* `access` is REQUIRED with min 1 element. `admin` bypass is the
+* "give me everything" escape; there is no wildcard scope.
+*/
+var AllowedProviderSchema = zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]);
+var AllowedDevicesSchema = zod.z.record(zod.z.string(), zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]));
+var CapScopeSchema = zod.z.enum(["device", "system"]);
+/**
+* DeviceSelector (scope model v3 — 2026-08-12).
+*
+* A `device` grant no longer carries a frozen list of deviceIds. It carries
+* a SELECTOR the matcher resolves against the live fleet, so the grant can be
+* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
+* AFTER the grant was minted — no re-grant, no re-login.
+*
+*   - `all`       — every device in the deployment. The broad viewer/operator
+*     lever without a `category` grant (a `category` grant also covers device
+*     caps that carry no deviceId; `all` is specifically the device set).
+*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
+*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
+*     is NOT covered until the grant is edited.
+*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
+*     DYNAMIC. A device that changes type, or a new device of the type,
+*     re-resolves on the next request.
+*   - `locations` — every device whose operator-assigned `location` label is
+*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
+*     null/unset location matches NO `locations` selector.
+*/
+var DeviceSelectorSchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({ kind: zod.z.literal("all") }),
+	zod.z.object({
+		kind: zod.z.literal("ids"),
+		ids: zod.z.array(zod.z.number().int()).min(1)
+	}),
+	zod.z.object({
+		kind: zod.z.literal("types"),
+		types: zod.z.array(zod.z.enum(require_err_msg.DeviceType)).min(1)
+	}),
+	zod.z.object({
+		kind: zod.z.literal("locations"),
+		locations: zod.z.array(zod.z.string().min(1)).min(1)
+	})
+]);
+var DeviceTokenScopeSchema = zod.z.object({
+	type: zod.z.literal("device"),
+	/** The device SET this grant covers — resolved against the live fleet. */
+	selector: DeviceSelectorSchema,
+	access: zod.z.array(MethodAccessSchema).min(1),
+	/**
+	* Whether a grant on a PARENT device transparently covers its accessory
+	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
+	* Direction is parent → children ONLY.
+	*
+	* Absent → the matcher DERIVES it from the access flavour: `view`
+	* inherits (a camera viewer sees the camera's accessories), `create` /
+	* `delete` do NOT (actuating/removing a child is an explicit act the
+	* operator must grant on the child, not inherit from the parent). Set it
+	* explicitly to override that default per grant.
+	*/
+	includeLinked: zod.z.boolean().optional()
+});
+/**
+* v2 → v3 lazy migration. A pre-v3 `device` grant carried
+* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
+* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
+* EVERY parse path — stored records AND the JWT-carried scope arrays
+* normalised at the request boundary ({@link normalizeTokenScopes} in
+* `device-selector.ts`). Chosen over a one-time DB migration because a
+* migration cannot reach a JWT already in a client's hands; parse-time
+* migration covers both without a flag day. No cast — the raw object is read
+* through `Reflect.get` (its static type is `unknown`).
+*/
+function migrateLegacyTokenScope(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
+	if (Reflect.get(raw, "type") !== "device") return raw;
+	if (Reflect.get(raw, "selector") !== void 0) return raw;
+	const targets = Reflect.get(raw, "targets");
+	if (!Array.isArray(targets)) return raw;
+	return {
+		type: "device",
+		selector: {
+			kind: "ids",
+			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
+		},
+		access: Reflect.get(raw, "access")
+	};
+}
+var TokenScopeSchema = zod.z.preprocess(migrateLegacyTokenScope, zod.z.discriminatedUnion("type", [
+	zod.z.object({
+		type: zod.z.literal("category"),
+		target: CapScopeSchema,
+		access: zod.z.array(MethodAccessSchema).min(1)
+	}),
+	zod.z.object({
+		type: zod.z.literal("capability"),
+		target: zod.z.string(),
+		access: zod.z.array(MethodAccessSchema).min(1)
+	}),
+	zod.z.object({
+		type: zod.z.literal("addon"),
+		target: zod.z.string(),
+		access: zod.z.array(MethodAccessSchema).min(1)
+	}),
+	DeviceTokenScopeSchema
+]));
+var UserRecordSchema = zod.z.object({
+	id: zod.z.string(),
+	username: zod.z.string(),
+	passwordHash: zod.z.string(),
+	/**
+	* Admin bypass. When true, the middleware skips the scope-access
+	* check entirely. There is no other axis of privilege; the legacy
+	* role enum collapsed onto this boolean in v2.
+	*/
+	isAdmin: zod.z.boolean().default(false),
+	allowedProviders: AllowedProviderSchema,
+	allowedDevices: AllowedDevicesSchema,
+	/**
+	* Scopes granted to this user. Admins bypass; their `scopes` is
+	* ignored. Non-admins without scopes are locked out of every
+	* protected call.
+	*/
+	scopes: zod.z.array(TokenScopeSchema).default([]),
+	createdAt: zod.z.number(),
+	updatedAt: zod.z.number()
+});
+var ApiKeyRecordSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	isAdmin: zod.z.boolean().default(false),
+	allowedProviders: AllowedProviderSchema,
+	allowedDevices: AllowedDevicesSchema,
+	tokenHash: zod.z.string(),
+	tokenPrefix: zod.z.string(),
+	createdAt: zod.z.number(),
+	lastUsedAt: zod.z.number().optional()
+});
+var ScopedTokenSchema = zod.z.object({
+	id: zod.z.string(),
+	userId: zod.z.string(),
+	name: zod.z.string(),
+	tokenHash: zod.z.string(),
+	tokenPrefix: zod.z.string(),
+	scopes: zod.z.array(TokenScopeSchema),
+	expiresAt: zod.z.number().nullish(),
+	lastUsedAt: zod.z.number().nullish(),
+	createdAt: zod.z.number()
+});
+//#endregion
+//#region src/auth/credential-scope.ts
+/**
+* The ONE permission vocabulary every credential is reduced to (D892).
+*
+* A credential — a login session, an account-link token, or a token
+* `auth.mintToken` issues (there is no other format, D895) — is
+* verified into a principal whose permissions are a `CredentialScope[]`, and
+* nothing else. What KIND of credential it was never decides what it may do:
+*
+*   - `'*'` — everything (the admin bypass). Held by an admin's session and
+*     a token minted with it.
+*   - a {@link TokenScope} — the v3 capability grants (`category`,
+*     `capability`, `addon`, `device`) the tRPC matcher has always applied.
+*   - `share-view` — one fail-closed embed perimeter (`grid-view` /
+*     `events-view`) over a few devices. A principal that holds one is
+*     RESTRICTED to it: the matcher honours nothing else it holds.
+*   - `addon-routes` — may reach any addon's own `authenticated` HTTP routes
+*     and data planes (never an `admin` one). A person's session has always
+*     had this; an integration token never had it and must hold
+*     `addon:<id>` instead. Only an admin may mint it into a token.
+*   - `preferences-self` — may read and write the SUBJECT's own account
+*     preferences (D894), never another user's. Every person's session holds
+*     it; a unified token holds it only when minted with it. `'*'` does NOT
+*     imply it: the hub's own mesh principal holds `'*'` and is nobody's
+*     account.
+*
+* Pure: no I/O. It lives in `@camstack/types` so the hub, the kernel and any
+* addon read the same vocabulary.
+*/
+/** The admin scope: every permission. */
+var ADMIN_SCOPE = "*";
+/** At most this many devices in one share-view grant (the share-link bound). */
+var SHARE_VIEW_MAX_DEVICES = 64;
+/** What a share-view grant lets its holder see. */
+var ShareViewGrantSchema = zod.z.object({
+	kind: zod.z.enum(require_sleep.SHARE_VIEW_KINDS),
+	deviceIds: zod.z.array(zod.z.number().int().nonnegative()).min(1).max(64),
+	/** Talk-back, opt-in at mint time; absent means off. */
+	talk: zod.z.boolean().optional()
+});
+var ShareViewScopeSchema = zod.z.object({
+	type: zod.z.literal("share-view"),
+	grant: ShareViewGrantSchema
+});
+var AddonRoutesScopeSchema = zod.z.object({
+	type: zod.z.literal("addon-routes"),
+	access: zod.z.array(MethodAccessSchema).min(1)
+});
+var PreferencesSelfScopeSchema = zod.z.object({ type: zod.z.literal("preferences-self") });
+/** The grant every person's session carries for its own account preferences. */
+var PREFERENCES_SELF_SCOPE = { type: "preferences-self" };
+var CredentialScopeSchema = zod.z.union([
+	zod.z.literal("*"),
+	ShareViewScopeSchema,
+	AddonRoutesScopeSchema,
+	PreferencesSelfScopeSchema,
+	TokenScopeSchema
+]);
+/** Every access flavour — what a person's session holds on addon routes. */
+var ALL_METHOD_ACCESS = [
+	"view",
+	"create",
+	"delete"
+];
+function isTokenScope(scope) {
+	return scope !== "*" && scope.type !== "share-view" && scope.type !== "addon-routes" && scope.type !== "preferences-self";
+}
+/** True iff the scope set holds `'*'`. */
+function scopesGrantAdmin(scopes) {
+	return scopes.includes("*");
+}
+/**
+* The share-view grant that RESTRICTS this principal, or `null` when it holds
+* none. Fail closed: a set that mixes a share-view grant with anything else
+* is still restricted to its FIRST share-view grant, never widened by the rest.
+*/
+function shareViewGrantOf(scopes) {
+	for (const scope of scopes) if (scope !== "*" && scope.type === "share-view") return scope.grant;
+	return null;
+}
+/** The capability grants the tRPC scope matcher reads. */
+function capabilityScopesOf(scopes) {
+	return scopes.filter(isTokenScope);
+}
+/** True iff the set reaches every addon's own routes at `access`. */
+function scopesAllowAddonRoutes(scopes, access) {
+	return scopes.some((s) => s !== "*" && s.type === "addon-routes" && s.access.includes(access));
+}
+/**
+* True iff the set may touch its subject's own account preferences: it holds
+* `preferences-self` and no share-view grant restricts it. `'*'` alone is not
+* enough (see the vocabulary above).
+*/
+function scopesAllowOwnPreferences(scopes) {
+	if (shareViewGrantOf(scopes) !== null) return false;
+	return scopes.some((s) => s !== "*" && s.type === "preferences-self");
+}
+/**
+* Parse a scope array from an untrusted source (a JWT claim, a stored row).
+* Any element that does not parse makes the WHOLE set unusable — `null` — so
+* a corrupt grant can never degrade into a partial one.
+*/
+function parseCredentialScopes(raw) {
+	const parsed = zod.z.array(CredentialScopeSchema).safeParse(raw);
+	return parsed.success ? parsed.data : null;
+}
+/**
+* The `kind` claim of a unified token. It names the TOKEN FAMILY (so every
+* older gate that classifies a hub JWT refuses it — `classifyBearerPrincipal`
+* treats any `kind` it does not know as not-a-credential), never what the
+* token may do: that is its `scopes`, and only its `scopes`.
+*/
+var CREDENTIAL_TOKEN_KIND = "credential";
+/**
+* The `aud` claim every minted token is signed with (D895). The hub's raw JWT
+* verify (`AuthManager.verifyToken`, used by every surface that wants a LOGIN
+* session — the OAuth consent page, the session cookie, health, backups)
+* refuses a token carrying it, so a minted token — a share link above all —
+* can never be replayed as a person's session. Only the credential verifier's
+* own door (`verifyCredentialToken`) accepts it.
+*/
+var CREDENTIAL_TOKEN_AUDIENCE = "camstack:credential";
+/** Does a verified JWT payload belong to the minted-token family? */
+function isCredentialTokenPayload(payload) {
+	if (payload === null || typeof payload !== "object") return false;
+	const kind = Reflect.get(payload, "kind");
+	const aud = Reflect.get(payload, "aud");
+	return kind === "credential" || aud === "camstack:credential" || Array.isArray(aud) && aud.includes("camstack:credential");
+}
+/**
+* The claims of a unified token (`auth.mintToken`). It carries no `exp`: its
+* row (looked up by `jti` on every verify, for revocation) holds the ONE
+* expiry, so a share link can be extended and a JWT clock can never disagree
+* with the row.
+*/
+var CredentialTokenClaimsSchema = zod.z.object({
+	kind: zod.z.literal(CREDENTIAL_TOKEN_KIND),
+	sub: zod.z.string().min(1),
+	jti: zod.z.string().min(16),
+	scopes: zod.z.array(CredentialScopeSchema).min(1)
+});
+//#endregion
+//#region src/schemas/user-preferences.ts
+/**
+* Per-user ACCOUNT preferences (D894): the hub-side half of the viewer's two
+* settings levels.
+*
+*   - DEVICE settings never leave the phone.
+*   - ACCOUNT settings live here: one row per `(user, namespace)`, private to
+*     that user, synced across every device signed in as them, last write wins
+*     unless the writer sends the revision it based its edit on.
+*
+* A setting lives in exactly ONE level; there are no overrides. The caller
+* never names a user: the hub stamps the principal's own id, admin included.
+*
+* The contract the client codes against is the `preferences.*` tRPC router
+* (`server/backend/src/api/core/preferences.router.ts`).
+*/
+/** `viewer.app`, `viewer.cameras`, `viewer.grids` … — lowercase, dot/dash separated. */
+var PREFERENCES_NAMESPACE_PATTERN = /^[a-z][a-z0-9.-]{0,63}$/;
+/** One row's value, measured as UTF-8 JSON. */
+var PREFERENCES_MAX_VALUE_BYTES = 256 * 1024;
+/** Namespaces one user may hold. */
+var PREFERENCES_MAX_NAMESPACES = 32;
+/** The opaque client id a writer stamps (`updatedByDevice`). */
+var PREFERENCES_MAX_DEVICE_ID_LENGTH = 64;
+var PreferenceNamespaceSchema = zod.z.string().regex(PREFERENCES_NAMESPACE_PATTERN);
+/** A namespace's value: a JSON object, opaque to the hub. */
+var PreferenceValueSchema = zod.z.record(zod.z.string(), zod.z.unknown());
+var PreferenceDeviceIdSchema = zod.z.string().min(1).max(64);
+/** A stored row, as the owner reads it. */
+var PreferenceRowSchema = zod.z.object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/** Starts at 1, +1 on every write of this namespace. A delete ends the row and its count. */
+	revision: zod.z.number().int().positive(),
+	updatedAt: zod.z.number().int(),
+	/** The client id the last writer sent; `null` when it sent none. */
+	updatedByDevice: PreferenceDeviceIdSchema.nullable()
+});
+var PreferencesGetInputSchema = zod.z.object({ 
+/** Absent: every namespace the caller holds. */
+namespaces: zod.z.array(PreferenceNamespaceSchema).max(32).optional() });
+var PreferencesGetOutputSchema = zod.z.object({ rows: zod.z.array(PreferenceRowSchema) });
+var PreferencesPutInputSchema = zod.z.object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/**
+	* The revision the edit was based on. Absent: last write wins. `0`: the
+	* namespace must not exist yet. Any other value that is not the current
+	* revision answers `conflict` and writes nothing.
+	*/
+	baseRevision: zod.z.number().int().nonnegative().optional(),
+	deviceId: PreferenceDeviceIdSchema.optional()
+});
+var PreferencesPutOutputSchema = zod.z.discriminatedUnion("status", [zod.z.object({
+	status: zod.z.literal("saved"),
+	row: PreferenceRowSchema
+}), zod.z.object({
+	status: zod.z.literal("conflict"),
+	current: PreferenceRowSchema.nullable()
+})]);
+var PreferencesDeleteInputSchema = zod.z.object({ namespace: PreferenceNamespaceSchema });
+var PreferencesDeleteOutputSchema = zod.z.object({ 
+/** `false` when the namespace did not exist. */
+deleted: zod.z.boolean() });
+var PreferencesChangedSinceInputSchema = zod.z.object({ 
+/** The revision the client holds per namespace; a namespace it does not list is new to it. */
+revisionByNamespace: zod.z.record(PreferenceNamespaceSchema, zod.z.number().int().nonnegative()).refine((map) => Object.keys(map).length <= 32, { message: `at most 32 namespaces` }) });
+var PreferencesChangedSinceOutputSchema = zod.z.object({
+	/** Every row whose revision differs from the client's, and every row it did not list. */
+	rows: zod.z.array(PreferenceRowSchema),
+	/** Namespaces the client listed that no longer exist. */
+	deleted: zod.z.array(PreferenceNamespaceSchema)
+});
+//#endregion
 //#region src/auth/app-callback.ts
 /**
 * The viewer app's custom-scheme callback — the ONE list of URLs a hub flow
@@ -39812,30 +40226,50 @@ var llmRuntimeCapability = {
 * (hub-placed); the cap stays open for future providers.
 *
 * Profiles are ROWS (data), not addons: one row = one usable model endpoint.
-* `apiKey` is a password field — providers REDACT it on read and merge on
-* write; a stored key NEVER round-trips to a client.
-*/
-var LlmProfileKindSchema = zod.z.enum([
-	"openai-compatible",
-	"openai",
-	"anthropic",
-	"google",
-	"managed-local",
-	"apple-foundation"
-]);
+* A row is common fields plus `providerConfig`, which the provider owning the
+* row's kind declares (`connectionSchema`) and validates. The kind is an open
+* id declared by that provider (D893). A `password` field of the provider's
+* schema is a secret — providers REDACT it on read and merge on write; a
+* stored key NEVER round-trips to a client.
+*/
+/**
+* A profile kind is an OPEN id, declared by the provider that serves it
+* (`listProfileKinds`). The cap names no kind: a new provider ships a new kind
+* without a framework change. Lower-case, digits and dashes, so it stays safe
+* as a URL segment, a record field and a CSS hook.
+*/
+var LLM_PROFILE_KIND_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var LlmProfileKindSchema = zod.z.string().regex(LLM_PROFILE_KIND_PATTERN, "a kind id is lower-case letters, digits and dashes");
+/** What a model (or, by default, every model of a kind) can do. */
+var LlmModelFeaturesSchema = zod.z.object({
+	vision: zod.z.boolean(),
+	tools: zod.z.boolean(),
+	streaming: zod.z.boolean()
+});
+/** One model a provider offers. `features` overrides the kind's defaults, per field. */
+var LlmModelInfoSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string().optional(),
+	contextLength: zod.z.number().int().positive().optional(),
+	features: LlmModelFeaturesSchema.partial().optional()
+});
+/**
+* The provider-specific part of a profile, validated by the provider that owns
+* the kind (`upsertProfile` refuses what it does not accept). A field its
+* `connectionSchema` declares `type: 'password'` is a secret: it is held in the
+* keychain, never in the row, and reads back as the redaction marker.
+*/
+var LlmProviderConfigSchema = zod.z.record(zod.z.string(), zod.z.unknown());
 var LlmProfileSchema = zod.z.object({
 	id: zod.z.string(),
 	name: zod.z.string(),
+	/** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
 	kind: LlmProfileKindSchema,
 	/** Stamped by the provider — keeps the fanned catalog routable. */
 	addonId: zod.z.string(),
 	enabled: zod.z.boolean(),
 	/** Vendor model id, or the managed runtime's loaded model. */
 	model: zod.z.string(),
-	/** Required for openai-compatible; override for cloud kinds. */
-	baseUrl: zod.z.string().optional(),
-	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
-	apiKey: zod.z.string().optional(),
 	/** Vision on/off. A vision call against a `false` profile is REFUSED, never
 	*  degraded to text — that shipped once and produced a confident answer to a
 	*  question about a picture nobody sent. */
@@ -39843,15 +40277,11 @@ var LlmProfileSchema = zod.z.object({
 	temperature: zod.z.number().min(0).max(2).optional(),
 	/** Nucleus sampling. Every wire we speak has it. */
 	topP: zod.z.number().min(0).max(1).optional(),
-	/** Top-k sampling. Carried only by the wires that have it — NEITHER OpenAI
-	*  wire does, and the client drops it there (measured: the request body gets
-	*  `top_p` and no `top_k`). The profile editor hides the field wherever it
-	*  would change nothing; `KINDS_WITH_TOP_K` is the single owner of that list. */
+	/** Top-k sampling. Carried only by the wires that have it — a kind offers the
+	*  field in its editor only when its descriptor lists it in `profileFields`. */
 	topK: zod.z.number().int().positive().optional(),
 	maxTokens: zod.z.number().int().positive().optional(),
-	/** Prompt context window. Advisory for cloud kinds (they enforce their own);
-	*  for `managed-local` it is the llama.cpp `--ctx-size` the runtime starts
-	*  the model with, so it is the one field that changes a PROCESS. */
+	/** Prompt context window. Advisory for cloud kinds (they enforce their own). */
 	contextLength: zod.z.number().int().positive().optional(),
 	/** Default system prompt. A caller's `system` REPLACES it (never appends —
 	*  two system prompts fighting is worse than either alone). */
@@ -39877,16 +40307,37 @@ var LlmProfileSchema = zod.z.object({
 	*  library; the REGISTRY of callable tools is ours and is empty in v1, so a
 	*  `true` here buys the wiring, not behaviour, until tools are registered. */
 	toolsEnabled: zod.z.boolean().default(false),
-	extraHeaders: zod.z.record(zod.z.string(), zod.z.string()).optional(),
-	/** kind === 'managed-local' only (spec §4). */
-	runtime: ManagedRuntimeConfigSchema.optional(),
-	/**
-	* kind === 'apple-foundation' only: WHERE it runs — the only thing there is
-	* to configure (no key, no URL, no download; `model` is `apple-system`).
-	* `supportsVision` on such a row is stamped by the provider from the node's
-	* reported `imageInput`, never taken from the operator (D62).
-	*/
-	appleFoundation: zod.z.object({ nodeId: zod.z.string() }).optional()
+	/** Everything the kind's provider owns (endpoint, key, node, runtime…). */
+	providerConfig: LlmProviderConfigSchema.default({})
+});
+/**
+* The common profile fields a kind's editor offers. The editor owns how each
+* one is drawn; the provider says which of them mean something on its wire.
+*/
+var LlmProfileFieldSchema = zod.z.enum([
+	"temperature",
+	"topP",
+	"topK",
+	"maxTokens",
+	"contextLength",
+	"systemPrompt",
+	"timeoutMs",
+	"connectTimeoutMs",
+	"firstTokenTimeoutMs",
+	"idleTimeoutMs",
+	"retry",
+	"toolsEnabled"
+]);
+/**
+* A provider-drawn part of the editor, by a generic widget id the admin UI
+* registers (`ai/apple-node`). `placement: 'model'` replaces the generic model
+* picker: that widget owns the model choice.
+*/
+var LlmProviderWidgetSchema = zod.z.object({
+	id: zod.z.string(),
+	placement: zod.z.enum(["connection", "model"]),
+	/** `providerConfig` keys this widget must fill before the profile can be saved. */
+	requires: zod.z.array(zod.z.string()).optional()
 });
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
@@ -39895,11 +40346,56 @@ var ConfigSchemaPassthrough$3 = zod.z.unknown();
 var LlmProfileKindDescriptorSchema = zod.z.object({
 	kind: LlmProfileKindSchema,
 	label: zod.z.string(),
+	/** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
 	icon: zod.z.string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: zod.z.string(),
-	configSchema: ConfigSchemaPassthrough$3
+	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
+	connectionSchema: ConfigSchemaPassthrough$3,
+	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
+	advancedSchema: ConfigSchemaPassthrough$3.optional(),
+	/** The kind's defaults; a model from `listModels` may override any of them. */
+	features: LlmModelFeaturesSchema,
+	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
+	visionEditable: zod.z.boolean(),
+	/** Where the model list comes from: `listModels`, `staticModels`, or nowhere. */
+	modelCatalog: zod.z.enum([
+		"fetch",
+		"static",
+		"none"
+	]),
+	staticModels: zod.z.array(LlmModelInfoSchema).optional(),
+	/** The common fields that mean something on this kind's wire. */
+	profileFields: zod.z.array(LlmProfileFieldSchema),
+	providerWidgets: zod.z.array(LlmProviderWidgetSchema).optional()
 });
+/**
+* `listModels` input. `connection` is an UNSAVED draft of `providerConfig`
+* (the editor's form); with `profileId` too, a secret the draft leaves
+* untouched (absent or the redaction marker) is resolved server-side from the
+* stored profile — the browser never receives it.
+*/
+var LlmListModelsInputSchema = zod.z.object({
+	addonId: zod.z.string(),
+	kind: LlmProfileKindSchema,
+	profileId: zod.z.string().optional(),
+	connection: LlmProviderConfigSchema.optional()
+});
+var LlmListModelsErrorCodeSchema = zod.z.enum([
+	"auth",
+	"network",
+	"unsupported",
+	"invalid"
+]);
+/** A RESULT, never a throw: "wrong key" is an answer the editor renders inline. */
+var LlmListModelsResultSchema = zod.z.discriminatedUnion("ok", [zod.z.object({
+	ok: zod.z.literal(true),
+	models: zod.z.array(LlmModelInfoSchema)
+}), zod.z.object({
+	ok: zod.z.literal(false),
+	code: LlmListModelsErrorCodeSchema,
+	message: zod.z.string()
+})]);
 var LlmDefaultSelectorSchema = zod.z.union([zod.z.object({ consumer: zod.z.string() }), zod.z.object({ purpose: zod.z.enum(["text", "vision"]) })]);
 var LlmDefaultSchema = zod.z.object({
 	selector: LlmDefaultSelectorSchema,
@@ -40030,8 +40526,17 @@ var llmCapability = {
 			auth: "admin",
 			timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
 		}),
-		/** Live vendor enumeration (GET /models etc.). */
-		listModels: require_sleep.method(ProfileRefInputSchema, zod.z.array(zod.z.string())),
+		/**
+		* The models a kind offers, for a SAVED profile or an unsaved draft
+		* (`connection`). A mutation, not a query: a draft may carry a key, and a
+		* query's input travels in the URL. Admin: it dials whatever endpoint the
+		* draft names and may resolve a stored key to do it. The answer never
+		* carries a secret — failures are a typed result, never a throw.
+		*/
+		listModels: require_sleep.method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		getDefaults: require_sleep.method(zod.z.object({}), zod.z.array(LlmDefaultSchema)),
 		setDefault: require_sleep.method(zod.z.object({
 			selector: LlmDefaultSelectorSchema,
@@ -45899,204 +46404,6 @@ var notificationRulesCapability = {
 	}
 };
 //#endregion
-//#region src/schemas/auth-records.ts
-/**
-* Zod schemas for persisted record types.
-*
-* These schemas serve as the single source of truth for types that are
-* stored in the settings-store backend and retrieved via tRPC. They
-* replace the manual TypeScript interfaces with schema-derived types,
-* enabling runtime validation when reading from the backend.
-*
-* Convention: each schema is named `<Type>Schema`, the inferred TS type
-* keeps the original name for backward compatibility.
-*/
-/**
-* Auth model (v2 — 2026-05-12 caps-only):
-*
-* Two principals:
-*   - `isAdmin: true`  — full bypass. Admin scope set is ignored.
-*   - `isAdmin: false` — every call gated by `scopes` (see TokenScope).
-*
-* No role enum. There used to be `viewer / agent / scoped` and earlier
-* `super_admin` — collapsed onto the single boolean because every
-* non-admin caller is governed by the same scope-check rules; the
-* distinction was only ever used to route role-specific procedures
-* which we no longer have. CLI / webhook integrations are `cst_*` tokens
-* with `isAdmin: false` + an explicit scope list.
-*/
-/** Per-method access flavour. Materialised on every cap method via codegen. */
-var MethodAccessSchema = zod.z.enum([
-	"view",
-	"create",
-	"delete"
-]);
-/**
-* A single scope grant. Three forms — checked in matcher with OR
-* semantics; the first match decides whether the call passes:
-*
-*   - `category` — broadest. `target: 'device' | 'system'` selects every
-*     cap with the matching `scope` declaration. New caps inherit grants
-*     automatically — adding a device cap to the codebase makes it
-*     reachable to every user with `category:device [...]` without a
-*     re-grant. Use this for "family viewer" / "operator" tiers.
-*
-*   - `addon` — every cap that ships inside a given addon id. Niche;
-*     useful when an integration needs to interact with one specific
-*     addon's surface regardless of how many caps it exports.
-*
-*   - `capability` — the most precise form. Single cap name. Use for
-*     integration tokens where you want to grant `addons.installPackage`
-*     and nothing else.
-*
-* `access` is REQUIRED with min 1 element. `admin` bypass is the
-* "give me everything" escape; there is no wildcard scope.
-*/
-var AllowedProviderSchema = zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]);
-var AllowedDevicesSchema = zod.z.record(zod.z.string(), zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]));
-var CapScopeSchema = zod.z.enum(["device", "system"]);
-/**
-* DeviceSelector (scope model v3 — 2026-08-12).
-*
-* A `device` grant no longer carries a frozen list of deviceIds. It carries
-* a SELECTOR the matcher resolves against the live fleet, so the grant can be
-* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
-* AFTER the grant was minted — no re-grant, no re-login.
-*
-*   - `all`       — every device in the deployment. The broad viewer/operator
-*     lever without a `category` grant (a `category` grant also covers device
-*     caps that carry no deviceId; `all` is specifically the device set).
-*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
-*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
-*     is NOT covered until the grant is edited.
-*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
-*     DYNAMIC. A device that changes type, or a new device of the type,
-*     re-resolves on the next request.
-*   - `locations` — every device whose operator-assigned `location` label is
-*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
-*     null/unset location matches NO `locations` selector.
-*/
-var DeviceSelectorSchema = zod.z.discriminatedUnion("kind", [
-	zod.z.object({ kind: zod.z.literal("all") }),
-	zod.z.object({
-		kind: zod.z.literal("ids"),
-		ids: zod.z.array(zod.z.number().int()).min(1)
-	}),
-	zod.z.object({
-		kind: zod.z.literal("types"),
-		types: zod.z.array(zod.z.enum(require_err_msg.DeviceType)).min(1)
-	}),
-	zod.z.object({
-		kind: zod.z.literal("locations"),
-		locations: zod.z.array(zod.z.string().min(1)).min(1)
-	})
-]);
-var DeviceTokenScopeSchema = zod.z.object({
-	type: zod.z.literal("device"),
-	/** The device SET this grant covers — resolved against the live fleet. */
-	selector: DeviceSelectorSchema,
-	access: zod.z.array(MethodAccessSchema).min(1),
-	/**
-	* Whether a grant on a PARENT device transparently covers its accessory
-	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
-	* Direction is parent → children ONLY.
-	*
-	* Absent → the matcher DERIVES it from the access flavour: `view`
-	* inherits (a camera viewer sees the camera's accessories), `create` /
-	* `delete` do NOT (actuating/removing a child is an explicit act the
-	* operator must grant on the child, not inherit from the parent). Set it
-	* explicitly to override that default per grant.
-	*/
-	includeLinked: zod.z.boolean().optional()
-});
-/**
-* v2 → v3 lazy migration. A pre-v3 `device` grant carried
-* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
-* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
-* EVERY parse path — stored records AND the JWT-carried scope arrays
-* normalised at the request boundary ({@link normalizeTokenScopes} in
-* `device-selector.ts`). Chosen over a one-time DB migration because a
-* migration cannot reach a JWT already in a client's hands; parse-time
-* migration covers both without a flag day. No cast — the raw object is read
-* through `Reflect.get` (its static type is `unknown`).
-*/
-function migrateLegacyTokenScope(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
-	if (Reflect.get(raw, "type") !== "device") return raw;
-	if (Reflect.get(raw, "selector") !== void 0) return raw;
-	const targets = Reflect.get(raw, "targets");
-	if (!Array.isArray(targets)) return raw;
-	return {
-		type: "device",
-		selector: {
-			kind: "ids",
-			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
-		},
-		access: Reflect.get(raw, "access")
-	};
-}
-var TokenScopeSchema = zod.z.preprocess(migrateLegacyTokenScope, zod.z.discriminatedUnion("type", [
-	zod.z.object({
-		type: zod.z.literal("category"),
-		target: CapScopeSchema,
-		access: zod.z.array(MethodAccessSchema).min(1)
-	}),
-	zod.z.object({
-		type: zod.z.literal("capability"),
-		target: zod.z.string(),
-		access: zod.z.array(MethodAccessSchema).min(1)
-	}),
-	zod.z.object({
-		type: zod.z.literal("addon"),
-		target: zod.z.string(),
-		access: zod.z.array(MethodAccessSchema).min(1)
-	}),
-	DeviceTokenScopeSchema
-]));
-var UserRecordSchema = zod.z.object({
-	id: zod.z.string(),
-	username: zod.z.string(),
-	passwordHash: zod.z.string(),
-	/**
-	* Admin bypass. When true, the middleware skips the scope-access
-	* check entirely. There is no other axis of privilege; the legacy
-	* role enum collapsed onto this boolean in v2.
-	*/
-	isAdmin: zod.z.boolean().default(false),
-	allowedProviders: AllowedProviderSchema,
-	allowedDevices: AllowedDevicesSchema,
-	/**
-	* Scopes granted to this user. Admins bypass; their `scopes` is
-	* ignored. Non-admins without scopes are locked out of every
-	* protected call.
-	*/
-	scopes: zod.z.array(TokenScopeSchema).default([]),
-	createdAt: zod.z.number(),
-	updatedAt: zod.z.number()
-});
-var ApiKeyRecordSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	isAdmin: zod.z.boolean().default(false),
-	allowedProviders: AllowedProviderSchema,
-	allowedDevices: AllowedDevicesSchema,
-	tokenHash: zod.z.string(),
-	tokenPrefix: zod.z.string(),
-	createdAt: zod.z.number(),
-	lastUsedAt: zod.z.number().optional()
-});
-var ScopedTokenSchema = zod.z.object({
-	id: zod.z.string(),
-	userId: zod.z.string(),
-	name: zod.z.string(),
-	tokenHash: zod.z.string(),
-	tokenPrefix: zod.z.string(),
-	scopes: zod.z.array(TokenScopeSchema),
-	expiresAt: zod.z.number().nullish(),
-	lastUsedAt: zod.z.number().nullish(),
-	createdAt: zod.z.number()
-});
-//#endregion
 //#region src/capabilities/oauth-integration.cap.ts
 /**
 * `oauth-integration` — a collection cap by which an addon declares
@@ -72353,26 +72660,6 @@ var ApiKeySummarySchema = zod.z.object({
 	createdAt: zod.z.number(),
 	lastUsedAt: zod.z.number().optional()
 });
-var ScopedTokenSummarySchema = zod.z.object({
-	id: zod.z.string(),
-	userId: zod.z.string(),
-	name: zod.z.string(),
-	tokenPrefix: zod.z.string(),
-	scopes: zod.z.array(TokenScopeSchema),
-	expiresAt: zod.z.number().nullish(),
-	lastUsedAt: zod.z.number().nullish(),
-	createdAt: zod.z.number()
-});
-var CreateScopedTokenInputSchema = zod.z.object({
-	userId: zod.z.string(),
-	name: zod.z.string(),
-	scopes: zod.z.array(TokenScopeSchema),
-	expiresAt: zod.z.number().optional()
-});
-var CreateScopedTokenResultSchema = zod.z.object({
-	token: zod.z.string(),
-	record: ScopedTokenSummarySchema
-});
 var OauthSessionSummarySchema = zod.z.object({
 	id: zod.z.string(),
 	userId: zod.z.string(),
@@ -72394,11 +72681,11 @@ var TotpStatusSchema = zod.z.object({
 	confirmedAt: zod.z.number().nullable()
 });
 /**
-* user-management — singleton capability for user accounts, API keys,
-* and scoped tokens.
+* user-management — singleton capability for user accounts and the
+* legacy API-key rows.
 *
 * v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
-* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* — the subset check on `setUserScopes` is moot
 * because non-admins never reach these. If/when we open non-admin
 * delegation, structural caller-scope subset check goes inside the
 * provider.
@@ -72469,18 +72756,6 @@ var userManagementCapability = {
 			auth: "admin",
 			access: "delete"
 		}),
-		createScopedToken: require_sleep.method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
-		revokeScopedToken: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin",
-			access: "delete"
-		}),
-		validateScopedToken: require_sleep.method(zod.z.object({ token: zod.z.string() }), ScopedTokenSummarySchema.nullable(), { access: "view" }),
-		listScopedTokens: require_sleep.method(zod.z.object({ userId: zod.z.string() }), zod.z.array(ScopedTokenSummarySchema), { auth: "admin" }),
 		setupTotp: require_sleep.method(zod.z.object({ userId: zod.z.string() }), TotpSetupResultSchema, {
 			kind: "mutation",
 			auth: "admin",
@@ -80704,7 +80979,7 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		capName: "llm",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
 	"llm.listNodeModels": {
 		capName: "llm",
@@ -85368,12 +85643,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.createScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.createUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -85422,12 +85691,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.listScopedTokens": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.listUsers": {
 		capName: "user-management",
 		capScope: "system",
@@ -85482,12 +85745,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
-	"userManagement.revokeScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"userManagement.setupTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -85518,12 +85775,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.validateScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.verifyTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -93531,7 +93782,7 @@ function createSystemProxy(api) {
 			migrateRawSecrets: (input) => dispatch("llm", "migrateRawSecrets", "mutation", input),
 			deleteProfile: (input) => dispatch("llm", "deleteProfile", "mutation", input),
 			testProfile: (input) => dispatch("llm", "testProfile", "mutation", input),
-			listModels: (input) => dispatch("llm", "listModels", "query", input),
+			listModels: (input) => dispatch("llm", "listModels", "mutation", input),
 			getDefaults: (input) => dispatch("llm", "getDefaults", "query", input),
 			setDefault: (input) => dispatch("llm", "setDefault", "mutation", input),
 			getUsage: (input) => dispatch("llm", "getUsage", "query", input),
@@ -93975,10 +94226,6 @@ function createSystemProxy(api) {
 			validateCredentials: (input) => dispatch("userManagement", "validateCredentials", "mutation", input),
 			listApiKeys: (input) => dispatch("userManagement", "listApiKeys", "query", input),
 			revokeApiKey: (input) => dispatch("userManagement", "revokeApiKey", "mutation", input),
-			createScopedToken: (input) => dispatch("userManagement", "createScopedToken", "mutation", input),
-			revokeScopedToken: (input) => dispatch("userManagement", "revokeScopedToken", "mutation", input),
-			validateScopedToken: (input) => dispatch("userManagement", "validateScopedToken", "query", input),
-			listScopedTokens: (input) => dispatch("userManagement", "listScopedTokens", "query", input),
 			setupTotp: (input) => dispatch("userManagement", "setupTotp", "mutation", input),
 			confirmTotp: (input) => dispatch("userManagement", "confirmTotp", "mutation", input),
 			disableTotp: (input) => dispatch("userManagement", "disableTotp", "mutation", input),
@@ -102878,11 +103125,13 @@ function armRemovalReconcile(opts) {
 //#endregion
 exports.ACCESSORY_LABEL = ACCESSORY_LABEL;
 exports.ACCESS_ROLES = ACCESS_ROLES;
+exports.ADMIN_SCOPE = ADMIN_SCOPE;
 exports.AGENT_MDNS_QUERY_NAME = AGENT_MDNS_QUERY_NAME;
 exports.AGENT_MDNS_SERVICE_TYPE = AGENT_MDNS_SERVICE_TYPE;
 exports.AGENT_MDNS_TXT_KEYS = AGENT_MDNS_TXT_KEYS;
 exports.ALEXA_EGRESS_PROFILE = ALEXA_EGRESS_PROFILE;
 exports.ALL_CAPABILITY_DEFINITIONS = ALL_CAPABILITY_DEFINITIONS;
+exports.ALL_METHOD_ACCESS = ALL_METHOD_ACCESS;
 exports.APPEARANCE_BIN_COUNT = APPEARANCE_BIN_COUNT;
 exports.APPEARANCE_BLOCKS = APPEARANCE_BLOCKS;
 exports.APPEARANCE_DESCRIPTOR_VERSION = APPEARANCE_DESCRIPTOR_VERSION;
@@ -102916,6 +103165,7 @@ exports.AddonAutoUpdateSchema = AddonAutoUpdateSchema;
 exports.AddonListItemSchema = AddonListItemSchema;
 exports.AddonPageDeclarationSchema = AddonPageDeclarationSchema;
 exports.AddonPageInfoSchema = AddonPageInfoSchema;
+exports.AddonRoutesScopeSchema = AddonRoutesScopeSchema;
 exports.AdminLinkTargetEnum = AdminLinkTargetEnum;
 exports.AdoptionAdoptInputSchema = AdoptInputSchema;
 exports.AdoptionAdoptResultSchema = AdoptResultSchema;
@@ -103090,6 +103340,8 @@ exports.CONNECTION_TEST_TIMEOUT_MS = CONNECTION_TEST_TIMEOUT_MS;
 exports.CONTAINER_CHILD_PRIORITY = CONTAINER_CHILD_PRIORITY;
 exports.CORE_BLOCKS_ADDON_ID = CORE_BLOCKS_ADDON_ID;
 exports.CORE_BLOCK_ADDON_PREFIX = CORE_BLOCK_ADDON_PREFIX;
+exports.CREDENTIAL_TOKEN_AUDIENCE = CREDENTIAL_TOKEN_AUDIENCE;
+exports.CREDENTIAL_TOKEN_KIND = CREDENTIAL_TOKEN_KIND;
 exports.CROP_SUPPLY_SOURCES = CROP_SUPPLY_SOURCES;
 exports.CROP_SUPPLY_STEP_IDS = CROP_SUPPLY_STEP_IDS;
 exports.CUSTOMIZATION_BLOCK_NAME_PREFIX = require_composition.CUSTOMIZATION_BLOCK_NAME_PREFIX;
@@ -103267,9 +103519,9 @@ exports.CoreBlockStatusSchema = CoreBlockStatusSchema;
 exports.CoverStateSchema = CoverStateSchema;
 exports.CoverStatusSchema = CoverStatusSchema;
 exports.CreateIntegrationInputSchema = CreateIntegrationInputSchema;
-exports.CreateScopedTokenInputSchema = CreateScopedTokenInputSchema;
-exports.CreateScopedTokenResultSchema = CreateScopedTokenResultSchema;
 exports.CreateUserInputSchema = CreateUserInputSchema;
+exports.CredentialScopeSchema = CredentialScopeSchema;
+exports.CredentialTokenClaimsSchema = CredentialTokenClaimsSchema;
 exports.CustomActionInputSchema = CustomActionInputSchema;
 exports.CustomModelDescriptorSchema = CustomModelDescriptorSchema;
 exports.DATABASE_SNAPSHOT_PARTIAL_SUFFIX = DATABASE_SNAPSHOT_PARTIAL_SUFFIX;
@@ -103649,6 +103901,7 @@ exports.LABEL_SUPPLY_VOCABULARIES = LABEL_SUPPLY_VOCABULARIES;
 exports.LEGACY_READ_ONLY_CONFIG_KEY = LEGACY_READ_ONLY_CONFIG_KEY;
 exports.LINKED_DEVICES_SLOT = LINKED_DEVICES_SLOT;
 exports.LINKED_LABEL_STEP_PREFIX = LINKED_LABEL_STEP_PREFIX;
+exports.LLM_PROFILE_KIND_PATTERN = LLM_PROFILE_KIND_PATTERN;
 exports.LOAD_CONTRIBUTION_ATTRIBUTIONS = LOAD_CONTRIBUTION_ATTRIBUTIONS;
 exports.LOAD_CONTRIBUTION_ROLES = LOAD_CONTRIBUTION_ROLES;
 exports.LOCATION_DESCRIPTION_MAX = LOCATION_DESCRIPTION_MAX;
@@ -103685,10 +103938,18 @@ exports.LlmGenerateErrSchema = LlmGenerateErrSchema;
 exports.LlmGenerateOkSchema = LlmGenerateOkSchema;
 exports.LlmGenerateResultSchema = LlmGenerateResultSchema;
 exports.LlmImageSchema = LlmImageSchema;
+exports.LlmListModelsErrorCodeSchema = LlmListModelsErrorCodeSchema;
+exports.LlmListModelsInputSchema = LlmListModelsInputSchema;
+exports.LlmListModelsResultSchema = LlmListModelsResultSchema;
+exports.LlmModelFeaturesSchema = LlmModelFeaturesSchema;
+exports.LlmModelInfoSchema = LlmModelInfoSchema;
 exports.LlmNodeModelSchema = LlmNodeModelSchema;
+exports.LlmProfileFieldSchema = LlmProfileFieldSchema;
 exports.LlmProfileKindDescriptorSchema = LlmProfileKindDescriptorSchema;
 exports.LlmProfileKindSchema = LlmProfileKindSchema;
 exports.LlmProfileSchema = LlmProfileSchema;
+exports.LlmProviderConfigSchema = LlmProviderConfigSchema;
+exports.LlmProviderWidgetSchema = LlmProviderWidgetSchema;
 exports.LlmRefusalSourceSchema = LlmRefusalSourceSchema;
 exports.LlmRetryPolicySchema = LlmRetryPolicySchema;
 exports.LlmRuntimeAppleCompleteInputSchema = LlmRuntimeAppleCompleteInputSchema;
@@ -104147,6 +104408,11 @@ exports.PIPELINE_ANALYTICS_CAP_NAME = PIPELINE_ANALYTICS_CAP_NAME;
 exports.PIPELINE_FLOW_CAPABILITY_NAMES = PIPELINE_FLOW_CAPABILITY_NAMES;
 exports.PIPELINE_OWNER_CAPABILITY_NAMES = PIPELINE_OWNER_CAPABILITY_NAMES;
 exports.PIPELINE_RAMP = PIPELINE_RAMP;
+exports.PREFERENCES_MAX_DEVICE_ID_LENGTH = PREFERENCES_MAX_DEVICE_ID_LENGTH;
+exports.PREFERENCES_MAX_NAMESPACES = PREFERENCES_MAX_NAMESPACES;
+exports.PREFERENCES_MAX_VALUE_BYTES = PREFERENCES_MAX_VALUE_BYTES;
+exports.PREFERENCES_NAMESPACE_PATTERN = PREFERENCES_NAMESPACE_PATTERN;
+exports.PREFERENCES_SELF_SCOPE = PREFERENCES_SELF_SCOPE;
 exports.PRIVACY_MASK_CAP_NAME = PRIVACY_MASK_CAP_NAME;
 exports.PROVIDER_KIND_CAP_NAMES = PROVIDER_KIND_CAP_NAMES;
 exports.PROVIDER_PIN_FIELD = require_sleep.PROVIDER_PIN_FIELD;
@@ -104186,6 +104452,19 @@ exports.PlaintextSecretError = require_sleep.PlaintextSecretError;
 exports.PolygonPointSchema = PolygonPointSchema;
 exports.PoolMemoryWatchdog = PoolMemoryWatchdog;
 exports.PowerMeterStatusSchema = PowerMeterStatusSchema;
+exports.PreferenceDeviceIdSchema = PreferenceDeviceIdSchema;
+exports.PreferenceNamespaceSchema = PreferenceNamespaceSchema;
+exports.PreferenceRowSchema = PreferenceRowSchema;
+exports.PreferenceValueSchema = PreferenceValueSchema;
+exports.PreferencesChangedSinceInputSchema = PreferencesChangedSinceInputSchema;
+exports.PreferencesChangedSinceOutputSchema = PreferencesChangedSinceOutputSchema;
+exports.PreferencesDeleteInputSchema = PreferencesDeleteInputSchema;
+exports.PreferencesDeleteOutputSchema = PreferencesDeleteOutputSchema;
+exports.PreferencesGetInputSchema = PreferencesGetInputSchema;
+exports.PreferencesGetOutputSchema = PreferencesGetOutputSchema;
+exports.PreferencesPutInputSchema = PreferencesPutInputSchema;
+exports.PreferencesPutOutputSchema = PreferencesPutOutputSchema;
+exports.PreferencesSelfScopeSchema = PreferencesSelfScopeSchema;
 exports.PresenceStatusSchema = PresenceStatusSchema;
 exports.PressureSensorStatusSchema = PressureSensorStatusSchema;
 exports.PrivacyMaskOptionsSchema = PrivacyMaskOptionsSchema;
@@ -104434,6 +104713,7 @@ exports.SETTINGS_ARRAY_ADOPTS_PREFIX = require_sleep.SETTINGS_ARRAY_ADOPTS_PREFI
 exports.SETTINGS_BROKERS_ADOPTS_PREFIX = require_sleep.SETTINGS_BROKERS_ADOPTS_PREFIX;
 exports.SHARE_SOURCE_SETTING_KEY = SHARE_SOURCE_SETTING_KEY;
 exports.SHARE_VIEW_KINDS = require_sleep.SHARE_VIEW_KINDS;
+exports.SHARE_VIEW_MAX_DEVICES = SHARE_VIEW_MAX_DEVICES;
 exports.SINGLE_HUB_ADDRESS_ROLES = SINGLE_HUB_ADDRESS_ROLES;
 exports.SOURCE_CAPS = require_composition.SOURCE_CAPS;
 exports.SOURCE_CAP_ACTIVE_FIELD = require_composition.SOURCE_CAP_ACTIVE_FIELD;
@@ -104467,7 +104747,6 @@ exports.SceneUnavailableSchema = SceneUnavailableSchema;
 exports.SceneUncoveredPolicySchema = SceneUncoveredPolicySchema;
 exports.SceneVerdictSchema = SceneVerdictSchema;
 exports.ScopedTokenSchema = ScopedTokenSchema;
-exports.ScopedTokenSummarySchema = ScopedTokenSummarySchema;
 exports.ScoredObjectEventSchema = ScoredObjectEventSchema;
 exports.ScriptRunnerStatusSchema = ScriptRunnerStatusSchema;
 exports.SearchResultSchema = SearchResultSchema;
@@ -104498,6 +104777,8 @@ exports.SettingsRecordSchema = SettingsRecordSchema;
 exports.SettingsSchemaWithValuesSchema = SettingsSchemaWithValuesSchema;
 exports.SettingsUpdateResultSchema = SettingsUpdateResultSchema;
 exports.ShareSourceSchema = ShareSourceSchema;
+exports.ShareViewGrantSchema = ShareViewGrantSchema;
+exports.ShareViewScopeSchema = ShareViewScopeSchema;
 exports.ShareWeightsSchema = ShareWeightsSchema;
 exports.SiteLocationSchema = SiteLocationSchema;
 exports.SiteLocationSourceSchema = SiteLocationSourceSchema;
@@ -104858,6 +105139,7 @@ exports.canConvertUnit = canConvertUnit;
 exports.canonicalEgressPlan = canonicalEgressPlan;
 exports.canonicalIconKey = canonicalIconKey;
 exports.canonicalizeAppCallback = canonicalizeAppCallback;
+exports.capabilityScopesOf = capabilityScopesOf;
 exports.capacitySessionsOf = capacitySessionsOf;
 exports.carbonMonoxideCapability = carbonMonoxideCapability;
 exports.cellsToRects = cellsToRects;
@@ -105147,6 +105429,7 @@ exports.isBaseConditionKey = isBaseConditionKey;
 exports.isBatteryPresenceFault = isBatteryPresenceFault;
 exports.isClusterScopedStep = isClusterScopedStep;
 exports.isCollectionArrayMethod = isCollectionArrayMethod;
+exports.isCredentialTokenPayload = isCredentialTokenPayload;
 exports.isDefaultAlarmProfileId = isDefaultAlarmProfileId;
 exports.isDefaultAppConnectionEndpoint = isDefaultAppConnectionEndpoint;
 exports.isDefinitiveDeviceRefusal = isDefinitiveDeviceRefusal;
@@ -105312,6 +105595,7 @@ exports.parseAppAuthCallback = parseAppAuthCallback;
 exports.parseAppFlowRequest = parseAppFlowRequest;
 exports.parseAppPageLang = parseAppPageLang;
 exports.parseCameraStreamConfig = parseCameraStreamConfig;
+exports.parseCredentialScopes = parseCredentialScopes;
 exports.parseDeviceEnrollmentLink = parseDeviceEnrollmentLink;
 exports.parseExpression = require_composition.parseExpression;
 exports.parseJsonArray = require_sleep.parseJsonArray;
@@ -105483,7 +105767,10 @@ exports.schemaDeclaresAnyField = require_sleep.schemaDeclaresAnyField;
 exports.scopeInherits = scopeInherits;
 exports.scopeKey = require_sleep.scopeKey;
 exports.scopesAllowAddon = scopesAllowAddon;
+exports.scopesAllowAddonRoutes = scopesAllowAddonRoutes;
 exports.scopesAllowDeviceCap = scopesAllowDeviceCap;
+exports.scopesAllowOwnPreferences = scopesAllowOwnPreferences;
+exports.scopesGrantAdmin = scopesGrantAdmin;
 exports.scoreRuntimes = scoreRuntimes;
 exports.scriptRunnerCapability = scriptRunnerCapability;
 exports.scrubKnownSecrets = require_sleep.scrubKnownSecrets;
@@ -105507,6 +105794,7 @@ exports.settingsArrayAdoptsFrom = require_sleep.settingsArrayAdoptsFrom;
 exports.settingsBelow = settingsBelow;
 exports.settingsBrokersAdoptsFrom = require_sleep.settingsBrokersAdoptsFrom;
 exports.settingsStoreCapability = settingsStoreCapability;
+exports.shareViewGrantOf = shareViewGrantOf;
 exports.shortHostname = shortHostname;
 exports.shortSecretRefHash = require_sleep.shortSecretRefHash;
 exports.signalPercentFromBars = signalPercentFromBars;