@camstack/types 1.2.386 → 1.2.388

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-BE7_6UnC.js");
+const require_sleep = require("./sleep-DKtoyk6X.js");
 const require_event_category = require("./event-category-eSqkye-K.js");
 const require_err_msg = require("./err-msg-BhVbr0NX.js");
 //#region src/generated/cap-input-defaults.ts
@@ -16,7 +16,7 @@ const require_err_msg = require("./err-msg-BhVbr0NX.js");
 * Plain data, zero Zod: a forked runner must not import the schema barrel
 * (~144MB RSS per runner — D28).
 *
-* Coverage: 29 caps, 71 methods with defaults.
+* Coverage: 29 caps, 72 methods with defaults.
 */
 var CAP_INPUT_DEFAULTS = Object.freeze({
 	"addons": { "getLogs": { "limit": 100 } },
@@ -45,6 +45,10 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"resolution": "auto",
 			"maxPoints": 1e3
 		},
+		"queryMany": {
+			"resolution": "auto",
+			"maxPoints": 1e3
+		},
 		"queryNode": {
 			"resolution": "auto",
 			"maxPoints": 1e3
@@ -63,7 +67,8 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"enabled": false,
 			"maxAttempts": 1
 		},
-		"toolsEnabled": false
+		"toolsEnabled": false,
+		"providerConfig": {}
 	} } } },
 	"llm-runtime": {
 		"complete": { "runtime": { "__nested__": {
@@ -102,7 +107,7 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 		"createRule": { "rule": { "__nested__": {
 			"enabled": true,
 			"conditions": {},
-			"media": { "attach": "best" },
+			"media": {},
 			"throttle": {
 				"cooldownSec": 60,
 				"scope": "rule-device"
@@ -113,7 +118,7 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 		"previewStateSummary": { "rule": { "__nested__": {
 			"enabled": true,
 			"conditions": {},
-			"media": { "attach": "best" },
+			"media": {},
 			"throttle": {
 				"cooldownSec": 60,
 				"scope": "rule-device"
@@ -124,7 +129,7 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"rule": { "__nested__": {
 				"enabled": true,
 				"conditions": {},
-				"media": { "attach": "best" },
+				"media": {},
 				"throttle": {
 					"cooldownSec": 60,
 					"scope": "rule-device"
@@ -357,7 +362,7 @@ function materialise(defaults) {
 * barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
 * forked runner. See docs/decisions/adr-0028.md.
 *
-* Coverage: 27 collection caps, 46 array methods.
+* Coverage: 26 collection caps, 44 array methods.
 */
 var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"addon-pages-source": ["listPages"],
@@ -376,7 +381,6 @@ var COLLECTION_ARRAY_METHODS = Object.freeze({
 		"getDefaults",
 		"getUsage",
 		"listModelCatalog",
-		"listModels",
 		"listNodeModels",
 		"listProfileKinds",
 		"listProfiles",
@@ -384,7 +388,6 @@ var COLLECTION_ARRAY_METHODS = Object.freeze({
 	],
 	"load-contribution": ["list"],
 	"log-channels": ["list"],
-	"log-destination": ["query"],
 	"login-method": ["getLoginMethods"],
 	"mqtt-broker": ["listBrokers"],
 	"network-access": ["listEndpoints"],
@@ -419,14 +422,21 @@ function isCollectionArrayMethodName(capName, method) {
 * Per capability, the methods declared `optionalMethod` — the ones whose
 * ABSENCE on a provider is a fact about that provider, not a bug.
 *
-* Coverage: 1 caps, 4 methods.
+* Coverage: 2 caps, 7 methods.
 */
-var PROVIDER_OPTIONAL_METHODS = Object.freeze({ "videoclips": [
-	"dialClipStream",
-	"getPlaybackOptions",
-	"offerClipBytes",
-	"readClipBytes"
-] });
+var PROVIDER_OPTIONAL_METHODS = Object.freeze({
+	"log-destination": [
+		"cancelRead",
+		"describeRead",
+		"read"
+	],
+	"videoclips": [
+		"dialClipStream",
+		"getPlaybackOptions",
+		"offerClipBytes",
+		"readClipBytes"
+	]
+});
 /**
 * True when `method` on cap `capName` is declared `optionalMethod`.
 *

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { $n as PEER_BYTES_CHUNK_BYTES, $t as REMOVE_LEAF, A as HF_REPO, An as RECORD_BATCH_MAX_BYTES, Ar as emitReadiness, B as describeCustomActions, Bn as RECORD_SECRET_COLLECTION_PREFIX, Br as SECRET_CLEAR, Bt as settingsBrokersAdoptsFrom, C as addonSliceHandleApi, Cn as RecordsError, Cr as globalSecretScope, Dn as asRecordsError, En as UnknownRecordKindError, Er as parseSecretRef, F as DEVICE_CHILDREN_BATCH_MAX, Fn as RECORD_ID_MAX_LENGTH, Ft as SETTINGS_ARRAY_ADOPTS_PREFIX, Gn as createSecretsAccess, Gr as isSecretMarkerLike, Gt as RecordFieldPathSchema, H as adminUiCapability, Hn as RECORD_SWEEP_INTERVAL_MS, Hr as isSecretClear, Ht as entryBody, I as CALLER_STAMPED_CAPABILITIES, In as RECORD_MAX_DATA_BYTES, It as parseSettingsArrayAdoptsFrom, Jn as forgetKnownSecret, Jt as RecordKindNameSchema, Kn as MIN_SCRUBBED_LENGTH, Kr as makeSecretMarker, Kt as RecordIndexSchema, L as withoutCallerStamp, Ln as RECORD_MAX_INDEXES, Lt as settingsArrayAdoptsFrom, Mn as RECORD_DATABASES, N as deviceOpsCapability, Nn as RECORD_DEFAULT_MAX_DATA_BYTES, On as recordsErrorFromMessage, P as viewerUiCapability, Pn as RECORD_DELETE_BATCH, Pt as makeInMemoryRecords, Qn as shortSecretRefHash, Qt as defineRecordKinds, Rn as RECORD_MAX_INDEX_FIELDS, Rt as SETTINGS_BROKERS_ADOPTS_PREFIX, Sn as RecordUniqueViolationError, Sr as formatSecretScope, Tn as UnindexedFilterError, Tr as normalizeSecretOwner, Un as resolveSecretViewsIn, Ur as isSecretFieldView, Ut as createRecordsAccess, Vn as RECORD_SETTINGS_MAX_ROWS, Vr as classifySecretWrite, Vt as defineEntryKind, Wn as REVALIDATE_AFTER_MS, Wr as isSecretMarker, Wt as EntryDescriptorSchema, X as expandCapMethods, Xn as registerKnownSecret, Xt as assertValidDeclaration, Yn as knownSecretCount, Yt as RecordRetentionSchema, Zn as scrubKnownSecrets, Zt as declarationsOf, _ as readErrorI18n, _n as PlaintextSecretError, an as recordSecretRef, b as isDeviceScopedCap, bn as RecordSecretUnavailableError, br as arrayItemFieldPath, c as asString, cn as collectZodSecretPaths, ct as ReadinessTimeoutError, d as parseJsonUnknown, dn as BatchTooLargeError, dt as scopeKey, en as collectSecretLeaves, er as PEER_BYTES_MAX_OUTSTANDING, f as hfModelUrl, fn as DeclarationRefusedError, g as ErrorI18nPayloadSchema, gn as NoCallerError, hn as InvalidRecordError, in as recordSecretCollection, ir as DATAPLANE_SECRET_HEADER, it as readNodePin, jn as RECORD_CLASSES, kn as RECORD_BATCH_MAX, kr as createEvent, ln as isZodSecret, lr as normalizeAddonInitResult, mn as ForeignSecretMarkerError, nn as parseSecretPath, nr as PEER_BYTES_TICKET_TTL_MS, o as asJsonObject, on as secretArrayPrefixes, or as DisposerChain, ot as MODEL_FORMATS, p as BOOT_RECOVERY_BACKOFF_MS, pn as FilterRequiredError, qn as clearKnownSecrets, qr as toSecretFieldView, qt as RecordKindDeclarationSchema, r as maskUrlCredentials, rn as recordArrayItemPath, rt as nodePin, sr as BaseAddon, st as ReadinessRegistry, t as sleep, tn as mapSecretLeaves, tr as PEER_BYTES_STALL_MS, un as AdoptionPendingError, vn as RECORDS_ERROR_CODES, w as createEventBusSliceSource, wn as RevConflictError, wr as isSecretRef, x as createDeviceProxy, xn as RecordTooLargeError, xr as buildSecretRef, y as DEVICE_SCOPED_CAPS, yn as RecordNotFoundError, yr as SECRET_REF_SCHEME, zn as RECORD_QUERY_MAX, zt as parseSettingsBrokersAdoptsFrom } from "./sleep-BxjU_fJM.mjs";
+import { $n as PEER_BYTES_CHUNK_BYTES, $t as REMOVE_LEAF, A as HF_REPO, An as RECORD_BATCH_MAX_BYTES, Ar as emitReadiness, B as describeCustomActions, Bn as RECORD_SECRET_COLLECTION_PREFIX, Br as SECRET_CLEAR, Bt as settingsBrokersAdoptsFrom, C as addonSliceHandleApi, Cn as RecordsError, Cr as globalSecretScope, Dn as asRecordsError, En as UnknownRecordKindError, Er as parseSecretRef, F as DEVICE_CHILDREN_BATCH_MAX, Fn as RECORD_ID_MAX_LENGTH, Ft as SETTINGS_ARRAY_ADOPTS_PREFIX, Gn as createSecretsAccess, Gr as isSecretMarkerLike, Gt as RecordFieldPathSchema, H as adminUiCapability, Hn as RECORD_SWEEP_INTERVAL_MS, Hr as isSecretClear, Ht as entryBody, I as CALLER_STAMPED_CAPABILITIES, In as RECORD_MAX_DATA_BYTES, It as parseSettingsArrayAdoptsFrom, Jn as forgetKnownSecret, Jt as RecordKindNameSchema, Kn as MIN_SCRUBBED_LENGTH, Kr as makeSecretMarker, Kt as RecordIndexSchema, L as withoutCallerStamp, Ln as RECORD_MAX_INDEXES, Lt as settingsArrayAdoptsFrom, Mn as RECORD_DATABASES, N as deviceOpsCapability, Nn as RECORD_DEFAULT_MAX_DATA_BYTES, On as recordsErrorFromMessage, P as viewerUiCapability, Pn as RECORD_DELETE_BATCH, Pt as makeInMemoryRecords, Qn as shortSecretRefHash, Qt as defineRecordKinds, Rn as RECORD_MAX_INDEX_FIELDS, Rt as SETTINGS_BROKERS_ADOPTS_PREFIX, Sn as RecordUniqueViolationError, Sr as formatSecretScope, Tn as UnindexedFilterError, Tr as normalizeSecretOwner, Un as resolveSecretViewsIn, Ur as isSecretFieldView, Ut as createRecordsAccess, Vn as RECORD_SETTINGS_MAX_ROWS, Vr as classifySecretWrite, Vt as defineEntryKind, Wn as REVALIDATE_AFTER_MS, Wr as isSecretMarker, Wt as EntryDescriptorSchema, X as expandCapMethods, Xn as registerKnownSecret, Xt as assertValidDeclaration, Yn as knownSecretCount, Yt as RecordRetentionSchema, Zn as scrubKnownSecrets, Zt as declarationsOf, _ as readErrorI18n, _n as PlaintextSecretError, an as recordSecretRef, b as isDeviceScopedCap, bn as RecordSecretUnavailableError, br as arrayItemFieldPath, c as asString, cn as collectZodSecretPaths, ct as ReadinessTimeoutError, d as parseJsonUnknown, dn as BatchTooLargeError, dt as scopeKey, en as collectSecretLeaves, er as PEER_BYTES_MAX_OUTSTANDING, f as hfModelUrl, fn as DeclarationRefusedError, g as ErrorI18nPayloadSchema, gn as NoCallerError, hn as InvalidRecordError, in as recordSecretCollection, ir as DATAPLANE_SECRET_HEADER, it as readNodePin, jn as RECORD_CLASSES, kn as RECORD_BATCH_MAX, kr as createEvent, ln as isZodSecret, lr as normalizeAddonInitResult, mn as ForeignSecretMarkerError, nn as parseSecretPath, nr as PEER_BYTES_TICKET_TTL_MS, o as asJsonObject, on as secretArrayPrefixes, or as DisposerChain, ot as MODEL_FORMATS, p as BOOT_RECOVERY_BACKOFF_MS, pn as FilterRequiredError, qn as clearKnownSecrets, qr as toSecretFieldView, qt as RecordKindDeclarationSchema, r as maskUrlCredentials, rn as recordArrayItemPath, rt as nodePin, sr as BaseAddon, st as ReadinessRegistry, t as sleep, tn as mapSecretLeaves, tr as PEER_BYTES_STALL_MS, un as AdoptionPendingError, vn as RECORDS_ERROR_CODES, w as createEventBusSliceSource, wn as RevConflictError, wr as isSecretRef, x as createDeviceProxy, xn as RecordTooLargeError, xr as buildSecretRef, y as DEVICE_SCOPED_CAPS, yn as RecordNotFoundError, yr as SECRET_REF_SCHEME, zn as RECORD_QUERY_MAX, zt as parseSettingsBrokersAdoptsFrom } from "./sleep-BSuCCFjf.mjs";
 import { t as EventCategory } from "./event-category-DOl51-Ij.mjs";
 import { a as DeviceType, t as errMsg } from "./err-msg-BXKzRBwg.mjs";
 //#region src/generated/cap-input-defaults.ts
@@ -15,7 +15,7 @@ import { a as DeviceType, t as errMsg } from "./err-msg-BXKzRBwg.mjs";
 * Plain data, zero Zod: a forked runner must not import the schema barrel
 * (~144MB RSS per runner — D28).
 *
-* Coverage: 29 caps, 71 methods with defaults.
+* Coverage: 29 caps, 72 methods with defaults.
 */
 var CAP_INPUT_DEFAULTS = Object.freeze({
 	"addons": { "getLogs": { "limit": 100 } },
@@ -44,6 +44,10 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"resolution": "auto",
 			"maxPoints": 1e3
 		},
+		"queryMany": {
+			"resolution": "auto",
+			"maxPoints": 1e3
+		},
 		"queryNode": {
 			"resolution": "auto",
 			"maxPoints": 1e3
@@ -62,7 +66,8 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"enabled": false,
 			"maxAttempts": 1
 		},
-		"toolsEnabled": false
+		"toolsEnabled": false,
+		"providerConfig": {}
 	} } } },
 	"llm-runtime": {
 		"complete": { "runtime": { "__nested__": {
@@ -101,7 +106,7 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 		"createRule": { "rule": { "__nested__": {
 			"enabled": true,
 			"conditions": {},
-			"media": { "attach": "best" },
+			"media": {},
 			"throttle": {
 				"cooldownSec": 60,
 				"scope": "rule-device"
@@ -112,7 +117,7 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 		"previewStateSummary": { "rule": { "__nested__": {
 			"enabled": true,
 			"conditions": {},
-			"media": { "attach": "best" },
+			"media": {},
 			"throttle": {
 				"cooldownSec": 60,
 				"scope": "rule-device"
@@ -123,7 +128,7 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"rule": { "__nested__": {
 				"enabled": true,
 				"conditions": {},
-				"media": { "attach": "best" },
+				"media": {},
 				"throttle": {
 					"cooldownSec": 60,
 					"scope": "rule-device"
@@ -356,7 +361,7 @@ function materialise(defaults) {
 * barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
 * forked runner. See docs/decisions/adr-0028.md.
 *
-* Coverage: 27 collection caps, 46 array methods.
+* Coverage: 26 collection caps, 44 array methods.
 */
 var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"addon-pages-source": ["listPages"],
@@ -375,7 +380,6 @@ var COLLECTION_ARRAY_METHODS = Object.freeze({
 		"getDefaults",
 		"getUsage",
 		"listModelCatalog",
-		"listModels",
 		"listNodeModels",
 		"listProfileKinds",
 		"listProfiles",
@@ -383,7 +387,6 @@ var COLLECTION_ARRAY_METHODS = Object.freeze({
 	],
 	"load-contribution": ["list"],
 	"log-channels": ["list"],
-	"log-destination": ["query"],
 	"login-method": ["getLoginMethods"],
 	"mqtt-broker": ["listBrokers"],
 	"network-access": ["listEndpoints"],
@@ -418,14 +421,21 @@ function isCollectionArrayMethodName(capName, method) {
 * Per capability, the methods declared `optionalMethod` — the ones whose
 * ABSENCE on a provider is a fact about that provider, not a bug.
 *
-* Coverage: 1 caps, 4 methods.
+* Coverage: 2 caps, 7 methods.
 */
-var PROVIDER_OPTIONAL_METHODS = Object.freeze({ "videoclips": [
-	"dialClipStream",
-	"getPlaybackOptions",
-	"offerClipBytes",
-	"readClipBytes"
-] });
+var PROVIDER_OPTIONAL_METHODS = Object.freeze({
+	"log-destination": [
+		"cancelRead",
+		"describeRead",
+		"read"
+	],
+	"videoclips": [
+		"dialClipStream",
+		"getPlaybackOptions",
+		"offerClipBytes",
+		"readClipBytes"
+	]
+});
 /**
 * True when `method` on cap `capName` is declared `optionalMethod`.
 *

package/dist/auth/credential-scope.d.ts

@@ -1,13 +1,13 @@
 /**
  * The ONE permission vocabulary every credential is reduced to (D892).
  *
- * A credential — a login session, an account-link token, a legacy `csa_` /
- * `cst_` / `csv_` token, or the unified token `auth.mintToken` issues — is
+ * A credential — a login session, an account-link token, or a token
+ * `auth.mintToken` issues (there is no other format, D895) — is
  * verified into a principal whose permissions are a `CredentialScope[]`, and
  * nothing else. What KIND of credential it was never decides what it may do:
  *
- *   - `'*'` — everything (the admin bypass). Held by an admin's session, a
- *     legacy admin token, and a unified token minted with it.
+ *   - `'*'` — everything (the admin bypass). Held by an admin's session and
+ *     a token minted with it.
  *   - a {@link TokenScope} — the v3 capability grants (`category`,
  *     `capability`, `addon`, `device`) the tRPC matcher has always applied.
  *   - `share-view` — one fail-closed embed perimeter (`grid-view` /
@@ -16,7 +16,12 @@
  *   - `addon-routes` — may reach any addon's own `authenticated` HTTP routes
  *     and data planes (never an `admin` one). A person's session has always
  *     had this; an integration token never had it and must hold
- *     `addon:<id>` instead.
+ *     `addon:<id>` instead. Only an admin may mint it into a token.
+ *   - `preferences-self` — may read and write the SUBJECT's own account
+ *     preferences (D894), never another user's. Every person's session holds
+ *     it; a unified token holds it only when minted with it. `'*'` does NOT
+ *     imply it: the hub's own mesh principal holds `'*'` and is nobody's
+ *     account.
  *
  * Pure: no I/O. It lives in `@camstack/types` so the hub, the kernel and any
  * addon read the same vocabulary.
@@ -58,6 +63,12 @@ export declare const AddonRoutesScopeSchema: z.ZodObject<{
     }>>;
 }, z.core.$strip>;
 export type AddonRoutesScope = z.infer<typeof AddonRoutesScopeSchema>;
+export declare const PreferencesSelfScopeSchema: z.ZodObject<{
+    type: z.ZodLiteral<"preferences-self">;
+}, z.core.$strip>;
+export type PreferencesSelfScope = z.infer<typeof PreferencesSelfScopeSchema>;
+/** The grant every person's session carries for its own account preferences. */
+export declare const PREFERENCES_SELF_SCOPE: PreferencesSelfScope;
 export declare const CredentialScopeSchema: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodObject<{
     type: z.ZodLiteral<"share-view">;
     grant: z.ZodObject<{
@@ -75,6 +86,8 @@ export declare const CredentialScopeSchema: z.ZodUnion<readonly [z.ZodLiteral<"*
         delete: "delete";
         view: "view";
     }>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"preferences-self">;
 }, z.core.$strip>, z.ZodPreprocess<z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"category">;
     target: z.ZodEnum<{
@@ -138,6 +151,12 @@ export declare function shareViewGrantOf(scopes: readonly CredentialScope[]): Sh
 export declare function capabilityScopesOf(scopes: readonly CredentialScope[]): readonly TokenScope[];
 /** True iff the set reaches every addon's own routes at `access`. */
 export declare function scopesAllowAddonRoutes(scopes: readonly CredentialScope[], access: z.infer<typeof MethodAccessSchema>): boolean;
+/**
+ * True iff the set may touch its subject's own account preferences: it holds
+ * `preferences-self` and no share-view grant restricts it. `'*'` alone is not
+ * enough (see the vocabulary above).
+ */
+export declare function scopesAllowOwnPreferences(scopes: readonly CredentialScope[]): boolean;
 /**
  * Parse a scope array from an untrusted source (a JWT claim, a stored row).
  * Any element that does not parse makes the WHOLE set unusable — `null` — so
@@ -151,6 +170,17 @@ export declare function parseCredentialScopes(raw: unknown): readonly Credential
  * token may do: that is its `scopes`, and only its `scopes`.
  */
 export declare const CREDENTIAL_TOKEN_KIND = "credential";
+/**
+ * The `aud` claim every minted token is signed with (D895). The hub's raw JWT
+ * verify (`AuthManager.verifyToken`, used by every surface that wants a LOGIN
+ * session — the OAuth consent page, the session cookie, health, backups)
+ * refuses a token carrying it, so a minted token — a share link above all —
+ * can never be replayed as a person's session. Only the credential verifier's
+ * own door (`verifyCredentialToken`) accepts it.
+ */
+export declare const CREDENTIAL_TOKEN_AUDIENCE = "camstack:credential";
+/** Does a verified JWT payload belong to the minted-token family? */
+export declare function isCredentialTokenPayload(payload: unknown): boolean;
 /**
  * The claims of a unified token (`auth.mintToken`). It carries no `exp`: its
  * row (looked up by `jti` on every verify, for revocation) holds the ONE
@@ -178,6 +208,8 @@ export declare const CredentialTokenClaimsSchema: z.ZodObject<{
             delete: "delete";
             view: "view";
         }>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"preferences-self">;
     }, z.core.$strip>, z.ZodPreprocess<z.ZodDiscriminatedUnion<[z.ZodObject<{
         type: z.ZodLiteral<"category">;
         target: z.ZodEnum<{

package/dist/auth/principal-scope.d.ts

@@ -114,7 +114,7 @@ export type PrincipalAddonReachVerdict = {
  *    would lock every non-admin viewer out of recorder playback, snapshot media
  *    and the stream-broker embed, which is a worse outcome than the hole.
  *  - **integration** — must hold `addon:<addonId>` at the verb's access. This is
- *    the same rule the `cst_` scoped-token branch has always applied; the JWT
+ *    the same rule the scoped-token branch has always applied; the JWT
  *    branch simply never applied it, and closing that divergence IS the fix.
  *    `isAdmin` is ignored: an integration token is minted `isAdmin: false` and a
  *    token claiming otherwise must not talk its way past the grant.

package/dist/capabilities/alarm-panel.cap.d.ts

@@ -178,9 +178,17 @@ export declare const alarmPanelCapability: {
      */
     readonly durability: 'restored';
     /**
-     * History (D850): none — enum state; arm/disarm history belongs in the events ledger.
+     * History (D850): the panel's lifecycle state as an `enum` series —
+     * change-only, no floor, so an `arming -> pending -> triggered` sequence of a
+     * few seconds keeps every step. Who armed it stays in the events ledger.
      */
-    readonly history: 'none';
+    readonly history: {
+        readonly fields: {
+            readonly state: {
+                readonly kind: 'enum';
+            };
+        };
+    };
     /** Clock fields: written, but excluded from the compare that decides
      *  whether persisting is worth a SQLite commit. */
     readonly volatileStateFields: readonly ["lastChangedAt"];

package/dist/capabilities/capability-definition.d.ts

@@ -384,7 +384,7 @@ export declare const DEFAULT_RUNTIME_STATE_DURABILITY: RuntimeStateDurability;
  * through {@link HISTORY_UNIT_LABELS}. A series whose unit is a per-device fact
  * names a sibling field with {@link CapabilityHistoryField.unitFrom} instead.
  */
-export type HistoryUnit = '%' | 'dBFS' | 'dBm' | '°C' | 'W' | 'kWh' | 'V' | 'A' | 'VA' | 'lx' | 'ppm' | 'ppb' | 'ug/m3' | 'hPa' | 'count' | 'ratio' | 'ms' | 's' | 'days' | 'bytes';
+export type HistoryUnit = '%' | 'dBFS' | 'dBm' | '°C' | 'W' | 'kWh' | 'V' | 'A' | 'VA' | 'lx' | 'ppm' | 'ppb' | 'ug/m3' | 'hPa' | 'count' | 'ratio' | 'ms' | 's' | 'days' | 'bytes' | 'kbps' | 'fps';
 /** Display label per {@link HistoryUnit} (only `'ug/m3'` differs from its id). */
 export declare const HISTORY_UNIT_LABELS: Readonly<Record<HistoryUnit, string>>;
 /** One `runtimeState` field recorded as a history series. */
@@ -394,8 +394,26 @@ export interface CapabilityHistoryField {
      * meter only (`kwhTotal`); a drop is a reset, never a negative reading. A
      * counter that restarts with the addon (`pressCountSinceStart`) is not one.
      * `boolean` — stored 0/1; a rollup gives the fraction of time true.
+     * `enum` — a STATE (a `z.enum`, or a `z.string` whose values are learned):
+     * stored as the ordinal of its value in the series' append-only value list,
+     * change-only; a rollup keeps the time spent in each state.
      */
-    readonly kind: 'gauge' | 'counter' | 'boolean';
+    readonly kind: 'gauge' | 'counter' | 'boolean' | 'enum';
+    /**
+     * `enum` over a `z.enum` field: its values, in declaration order. WRITTEN BY
+     * CODEGEN from the field's schema (`scripts/generate-history-catalog.ts`) —
+     * never by hand, so the list cannot drift from the schema. Absent for a
+     * `z.string` enum field, whose values are learned as they are first seen.
+     * Ordinals are append-only in the store: reordering the `z.enum` later never
+     * changes what a stored ordinal means.
+     */
+    readonly values?: readonly string[];
+    /**
+     * Path of a SIBLING field: while it is set (not `undefined`, not `null`), the
+     * slice is not a reading of this field and nothing is captured. An
+     * `enum-sensor` with a `format` carries a timestamp, not a state.
+     */
+    readonly skipWhenSet?: string;
     /** Fixed unit of the series. Mutually exclusive with {@link unitFrom}. */
     readonly unit?: HistoryUnit;
     /**
@@ -416,7 +434,7 @@ export interface CapabilityHistoryField {
     readonly deadbandPct?: number;
     /**
      * At most one raw point per this many ms per series. Absent means the capture
-     * floor of the kind: 10 000 for `gauge` and `counter`, none for `boolean`
+     * floor of the kind: 10 000 for `gauge` and `counter`, none for `boolean` and `enum`
      * (change-only). Set it ABOVE the floor to be sparser; the floor is not
      * lowered by a smaller value except `0`, which a field may state to opt out
      * of the floor (a flapping state that must not lose an edge).

package/dist/capabilities/connectivity.cap.d.ts

@@ -40,9 +40,17 @@ export declare const connectivityCapability: {
      */
     readonly durability: 'restored';
     /**
-     * History (D850): none — duplicates device-status.online (one authority for availability).
+     * History (D850): `connected` as a boolean series — change-only, no floor. It
+     * is the upstream entity's own link (a HA connectivity sensor), not the
+     * device's reachability, which stays `device-status.online`.
      */
-    readonly history: 'none';
+    readonly history: {
+        readonly fields: {
+            readonly connected: {
+                readonly kind: 'boolean';
+            };
+        };
+    };
     /** Clock fields: written, but excluded from the compare that decides
      *  whether persisting is worth a SQLite commit. */
     readonly volatileStateFields: readonly ["lastChangedAt"];