@camstack/types 1.2.386 → 1.2.388

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-BE7_6UnC.js");
+const require_sleep = require("./sleep-DKtoyk6X.js");
 const require_event_category = require("./event-category-eSqkye-K.js");
 const require_composition = require("./composition-eoYYVfOp.js");
 const require_node_color = require("./node-color.js");
@@ -6616,7 +6616,7 @@ function classifyBearerPrincipal(payload) {
 *    would lock every non-admin viewer out of recorder playback, snapshot media
 *    and the stream-broker embed, which is a worse outcome than the hole.
 *  - **integration** — must hold `addon:<addonId>` at the verb's access. This is
-*    the same rule the `cst_` scoped-token branch has always applied; the JWT
+*    the same rule the scoped-token branch has always applied; the JWT
 *    branch simply never applied it, and closing that divergence IS the fix.
 *    `isAdmin` is ignored: an integration token is minted `isAdmin: false` and a
 *    token claiming otherwise must not talk its way past the grant.
@@ -6660,7 +6660,7 @@ function principalMayReachAddon(input) {
 * `super_admin` — collapsed onto the single boolean because every
 * non-admin caller is governed by the same scope-check rules; the
 * distinction was only ever used to route role-specific procedures
-* which we no longer have. CLI / webhook integrations are `cst_*` tokens
+* which we no longer have. CLI / webhook integrations are tokens (`auth.mintToken`)
 * with `isAdmin: false` + an explicit scope list.
 */
 /** Per-method access flavour. Materialised on every cap method via codegen. */
@@ -6839,13 +6839,13 @@ var ScopedTokenSchema = zod.z.object({
 /**
 * The ONE permission vocabulary every credential is reduced to (D892).
 *
-* A credential — a login session, an account-link token, a legacy `csa_` /
-* `cst_` / `csv_` token, or the unified token `auth.mintToken` issues — is
+* A credential — a login session, an account-link token, or a token
+* `auth.mintToken` issues (there is no other format, D895) — is
 * verified into a principal whose permissions are a `CredentialScope[]`, and
 * nothing else. What KIND of credential it was never decides what it may do:
 *
-*   - `'*'` — everything (the admin bypass). Held by an admin's session, a
-*     legacy admin token, and a unified token minted with it.
+*   - `'*'` — everything (the admin bypass). Held by an admin's session and
+*     a token minted with it.
 *   - a {@link TokenScope} — the v3 capability grants (`category`,
 *     `capability`, `addon`, `device`) the tRPC matcher has always applied.
 *   - `share-view` — one fail-closed embed perimeter (`grid-view` /
@@ -6854,7 +6854,12 @@ var ScopedTokenSchema = zod.z.object({
 *   - `addon-routes` — may reach any addon's own `authenticated` HTTP routes
 *     and data planes (never an `admin` one). A person's session has always
 *     had this; an integration token never had it and must hold
-*     `addon:<id>` instead.
+*     `addon:<id>` instead. Only an admin may mint it into a token.
+*   - `preferences-self` — may read and write the SUBJECT's own account
+*     preferences (D894), never another user's. Every person's session holds
+*     it; a unified token holds it only when minted with it. `'*'` does NOT
+*     imply it: the hub's own mesh principal holds `'*'` and is nobody's
+*     account.
 *
 * Pure: no I/O. It lives in `@camstack/types` so the hub, the kernel and any
 * addon read the same vocabulary.
@@ -6878,10 +6883,14 @@ var AddonRoutesScopeSchema = zod.z.object({
 	type: zod.z.literal("addon-routes"),
 	access: zod.z.array(MethodAccessSchema).min(1)
 });
+var PreferencesSelfScopeSchema = zod.z.object({ type: zod.z.literal("preferences-self") });
+/** The grant every person's session carries for its own account preferences. */
+var PREFERENCES_SELF_SCOPE = { type: "preferences-self" };
 var CredentialScopeSchema = zod.z.union([
 	zod.z.literal("*"),
 	ShareViewScopeSchema,
 	AddonRoutesScopeSchema,
+	PreferencesSelfScopeSchema,
 	TokenScopeSchema
 ]);
 /** Every access flavour — what a person's session holds on addon routes. */
@@ -6891,7 +6900,7 @@ var ALL_METHOD_ACCESS = [
 	"delete"
 ];
 function isTokenScope(scope) {
-	return scope !== "*" && scope.type !== "share-view" && scope.type !== "addon-routes";
+	return scope !== "*" && scope.type !== "share-view" && scope.type !== "addon-routes" && scope.type !== "preferences-self";
 }
 /** True iff the scope set holds `'*'`. */
 function scopesGrantAdmin(scopes) {
@@ -6915,6 +6924,15 @@ function scopesAllowAddonRoutes(scopes, access) {
 	return scopes.some((s) => s !== "*" && s.type === "addon-routes" && s.access.includes(access));
 }
 /**
+* True iff the set may touch its subject's own account preferences: it holds
+* `preferences-self` and no share-view grant restricts it. `'*'` alone is not
+* enough (see the vocabulary above).
+*/
+function scopesAllowOwnPreferences(scopes) {
+	if (shareViewGrantOf(scopes) !== null) return false;
+	return scopes.some((s) => s !== "*" && s.type === "preferences-self");
+}
+/**
 * Parse a scope array from an untrusted source (a JWT claim, a stored row).
 * Any element that does not parse makes the WHOLE set unusable — `null` — so
 * a corrupt grant can never degrade into a partial one.
@@ -6931,6 +6949,22 @@ function parseCredentialScopes(raw) {
 */
 var CREDENTIAL_TOKEN_KIND = "credential";
 /**
+* The `aud` claim every minted token is signed with (D895). The hub's raw JWT
+* verify (`AuthManager.verifyToken`, used by every surface that wants a LOGIN
+* session — the OAuth consent page, the session cookie, health, backups)
+* refuses a token carrying it, so a minted token — a share link above all —
+* can never be replayed as a person's session. Only the credential verifier's
+* own door (`verifyCredentialToken`) accepts it.
+*/
+var CREDENTIAL_TOKEN_AUDIENCE = "camstack:credential";
+/** Does a verified JWT payload belong to the minted-token family? */
+function isCredentialTokenPayload(payload) {
+	if (payload === null || typeof payload !== "object") return false;
+	const kind = Reflect.get(payload, "kind");
+	const aud = Reflect.get(payload, "aud");
+	return kind === "credential" || aud === "camstack:credential" || Array.isArray(aud) && aud.includes("camstack:credential");
+}
+/**
 * The claims of a unified token (`auth.mintToken`). It carries no `exp`: its
 * row (looked up by `jti` on every verify, for revocation) holds the ONE
 * expiry, so a share link can be extended and a JWT clock can never disagree
@@ -6943,6 +6977,80 @@ var CredentialTokenClaimsSchema = zod.z.object({
 	scopes: zod.z.array(CredentialScopeSchema).min(1)
 });
 //#endregion
+//#region src/schemas/user-preferences.ts
+/**
+* Per-user ACCOUNT preferences (D894): the hub-side half of the viewer's two
+* settings levels.
+*
+*   - DEVICE settings never leave the phone.
+*   - ACCOUNT settings live here: one row per `(user, namespace)`, private to
+*     that user, synced across every device signed in as them, last write wins
+*     unless the writer sends the revision it based its edit on.
+*
+* A setting lives in exactly ONE level; there are no overrides. The caller
+* never names a user: the hub stamps the principal's own id, admin included.
+*
+* The contract the client codes against is the `preferences.*` tRPC router
+* (`server/backend/src/api/core/preferences.router.ts`).
+*/
+/** `viewer.app`, `viewer.cameras`, `viewer.grids` … — lowercase, dot/dash separated. */
+var PREFERENCES_NAMESPACE_PATTERN = /^[a-z][a-z0-9.-]{0,63}$/;
+/** One row's value, measured as UTF-8 JSON. */
+var PREFERENCES_MAX_VALUE_BYTES = 256 * 1024;
+/** Namespaces one user may hold. */
+var PREFERENCES_MAX_NAMESPACES = 32;
+/** The opaque client id a writer stamps (`updatedByDevice`). */
+var PREFERENCES_MAX_DEVICE_ID_LENGTH = 64;
+var PreferenceNamespaceSchema = zod.z.string().regex(PREFERENCES_NAMESPACE_PATTERN);
+/** A namespace's value: a JSON object, opaque to the hub. */
+var PreferenceValueSchema = zod.z.record(zod.z.string(), zod.z.unknown());
+var PreferenceDeviceIdSchema = zod.z.string().min(1).max(64);
+/** A stored row, as the owner reads it. */
+var PreferenceRowSchema = zod.z.object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/** Starts at 1, +1 on every write of this namespace. A delete ends the row and its count. */
+	revision: zod.z.number().int().positive(),
+	updatedAt: zod.z.number().int(),
+	/** The client id the last writer sent; `null` when it sent none. */
+	updatedByDevice: PreferenceDeviceIdSchema.nullable()
+});
+var PreferencesGetInputSchema = zod.z.object({ 
+/** Absent: every namespace the caller holds. */
+namespaces: zod.z.array(PreferenceNamespaceSchema).max(32).optional() });
+var PreferencesGetOutputSchema = zod.z.object({ rows: zod.z.array(PreferenceRowSchema) });
+var PreferencesPutInputSchema = zod.z.object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/**
+	* The revision the edit was based on. Absent: last write wins. `0`: the
+	* namespace must not exist yet. Any other value that is not the current
+	* revision answers `conflict` and writes nothing.
+	*/
+	baseRevision: zod.z.number().int().nonnegative().optional(),
+	deviceId: PreferenceDeviceIdSchema.optional()
+});
+var PreferencesPutOutputSchema = zod.z.discriminatedUnion("status", [zod.z.object({
+	status: zod.z.literal("saved"),
+	row: PreferenceRowSchema
+}), zod.z.object({
+	status: zod.z.literal("conflict"),
+	current: PreferenceRowSchema.nullable()
+})]);
+var PreferencesDeleteInputSchema = zod.z.object({ namespace: PreferenceNamespaceSchema });
+var PreferencesDeleteOutputSchema = zod.z.object({ 
+/** `false` when the namespace did not exist. */
+deleted: zod.z.boolean() });
+var PreferencesChangedSinceInputSchema = zod.z.object({ 
+/** The revision the client holds per namespace; a namespace it does not list is new to it. */
+revisionByNamespace: zod.z.record(PreferenceNamespaceSchema, zod.z.number().int().nonnegative()).refine((map) => Object.keys(map).length <= 32, { message: `at most 32 namespaces` }) });
+var PreferencesChangedSinceOutputSchema = zod.z.object({
+	/** Every row whose revision differs from the client's, and every row it did not list. */
+	rows: zod.z.array(PreferenceRowSchema),
+	/** Namespaces the client listed that no longer exist. */
+	deleted: zod.z.array(PreferenceNamespaceSchema)
+});
+//#endregion
 //#region src/auth/app-callback.ts
 /**
 * The viewer app's custom-scheme callback — the ONE list of URLs a hub flow
@@ -14926,11 +15034,30 @@ var DeviceHistorySubjectSchema = zod.z.discriminatedUnion("kind", [zod.z.object(
 	kind: zod.z.literal("node"),
 	nodeId: zod.z.string().min(1)
 })]);
+/**
+* `enum` stores a STATE as the ordinal of its value in the series' value list
+* (`DeviceHistorySeriesInfo.values`, append-only, so an ordinal never changes
+* meaning); a rollup keeps the time spent in each state (`states`).
+*/
 var DeviceHistoryKindSchema = zod.z.enum([
+	"gauge",
+	"counter",
+	"boolean",
+	"enum"
+]);
+/** What a PRODUCER may declare. `enum` is cap-only: its value list is the cap field's. */
+var DeviceHistoryProducerKindSchema = zod.z.enum([
 	"gauge",
 	"counter",
 	"boolean"
 ]);
+/**
+* A key computed at READ time from stored series of the same device, never
+* stored itself. Energy (kWh per bucket) comes from the power meter's
+* `kwhTotal` counter when the device has one, else from integrating its
+* `watts` gauge over time.
+*/
+var DEVICE_HISTORY_ENERGY_KEY = "derived:energy.kwh";
 var DeviceHistoryResolutionSchema = zod.z.enum([
 	"raw",
 	"5m",
@@ -14963,7 +15090,13 @@ var SeriesInfoSchema = zod.z.object({
 	/** `null` is unknown (a `unitFrom` series whose device does not state a unit right now), never a guess. */
 	unit: zod.z.string().nullable(),
 	displayName: zod.z.string(),
-	source: zod.z.enum(["cap", "addon"]),
+	source: zod.z.enum([
+		"cap",
+		"addon",
+		"derived"
+	]),
+	/** `enum`: the value of each ordinal (index = ordinal); `null` for every other kind. */
+	values: zod.z.array(zod.z.string()).readonly().nullable(),
 	firstTs: zod.z.number(),
 	lastTs: zod.z.number()
 });
@@ -14977,17 +15110,31 @@ var QueryPointSchema = zod.z.object({
 	twMean: zod.z.number().nullable(),
 	min: zod.z.number(),
 	max: zod.z.number(),
-	/** `null` is unknown, never zero (D393). */
-	last: zod.z.number().nullable()
+	/** `null` is unknown, never zero (D393). For an `enum` series: the ordinal of {@link state}. */
+	last: zod.z.number().nullable(),
+	/**
+	* The increase over the point: a `counter`'s growth since the previous point
+	* or bucket (a drop is a reset, counted from zero), and for
+	* {@link DEVICE_HISTORY_ENERGY_KEY} the kWh used in the bucket. `null` for
+	* every other kind, and when it cannot be known.
+	*/
+	delta: zod.z.number().nullable(),
+	/** `enum`: the state in force at the end of the point (the name of `last`); `null` otherwise. */
+	state: zod.z.string().nullable(),
+	/** `enum` rollup: milliseconds spent in each state inside the bucket; `null` for raw points and other kinds. */
+	states: zod.z.record(zod.z.string(), zod.z.number()).nullable()
 });
 var QuerySeriesSchema = zod.z.object({
 	scope: zod.z.string(),
 	/** The last point STRICTLY BEFORE `from` in the chosen tier, so a step chart can start at the held value. */
 	before: zod.z.object({
 		t: zod.z.number(),
-		value: zod.z.number().nullable()
+		value: zod.z.number().nullable(),
+		state: zod.z.string().nullable()
 	}).nullable(),
-	points: zod.z.array(QueryPointSchema).readonly()
+	points: zod.z.array(QueryPointSchema).readonly(),
+	/** A derived key: the stored key its points were computed from; `null` for a stored series. */
+	derivedFrom: zod.z.string().nullable()
 });
 /** The window part of a query, shared by the device and node forms. */
 var QueryWindowShape = {
@@ -15003,6 +15150,25 @@ var QueryResultSchema = zod.z.object({
 	series: zod.z.array(QuerySeriesSchema).readonly(),
 	truncated: zod.z.boolean()
 });
+/** Items one `queryMany` may carry: a dashboard's worth, not a scan. */
+var DEVICE_HISTORY_QUERY_MANY_MAX_ITEMS = 24;
+/** One read of a batch: a device's key or a node's key (exactly one subject). */
+var QueryManyItemSchema = zod.z.union([zod.z.object({
+	deviceId: zod.z.number().int(),
+	key: zod.z.string(),
+	scope: zod.z.string().optional()
+}), zod.z.object({
+	forNodeId: zod.z.string().min(1),
+	key: zod.z.string(),
+	scope: zod.z.string().optional()
+})]);
+var QueryManyEntrySchema = zod.z.discriminatedUnion("ok", [zod.z.object({
+	ok: zod.z.literal(true),
+	result: QueryResultSchema
+}), zod.z.object({
+	ok: zod.z.literal(false),
+	error: zod.z.string()
+})]);
 var TierStatusSchema = zod.z.object({
 	tier: DeviceHistoryResolutionSchema,
 	/** `null` until the first background count answered. */
@@ -15071,26 +15237,45 @@ var deviceHistoryCapability = {
 		* `listNodeSeries` / `queryNode`.
 		*/
 		listSeries: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.array(SeriesInfoSchema).readonly()),
-		listNodeSeries: require_sleep.method(zod.z.object({ nodeId: zod.z.string().min(1) }), zod.z.array(SeriesInfoSchema).readonly(), { auth: "admin" }),
+		/**
+		* A NODE's series. The subject is `forNodeId`, never `nodeId`: a top-level
+		* `nodeId` is the cap ROUTING key, and `nodeId: 'little-unraid'` sent the
+		* read to that agent, which hosts no device-history.
+		*/
+		listNodeSeries: require_sleep.method(zod.z.object({ forNodeId: zod.z.string().min(1) }), zod.z.array(SeriesInfoSchema).readonly(), { auth: "admin" }),
 		/**
 		* One series (or every scope of it) at one resolution. `auto` picks the
 		* finest tier whose retention covers `from` and whose point count fits
 		* `maxPoints`; when even the coarsest tier does not fit, the newest
-		* `maxPoints` points are returned and `truncated` is true.
+		* `maxPoints` points are returned and `truncated` is true. A series fed by
+		* closed buckets has no raw rows, so `auto` never answers it from raw; nor
+		* {@link DEVICE_HISTORY_ENERGY_KEY}, which is computed from rollups.
 		*/
 		query: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number().int(),
 			...QueryWindowShape
 		}), QueryResultSchema),
 		queryNode: require_sleep.method(zod.z.object({
-			nodeId: zod.z.string().min(1),
+			forNodeId: zod.z.string().min(1),
 			...QueryWindowShape
 		}), QueryResultSchema, { auth: "admin" }),
+		/**
+		* Several reads over ONE window, answered in order (one entry per item).
+		* Admin-only: its subjects are nested in `items`, where the device scope
+		* gate cannot see them — a principal limited to one device uses `query`.
+		*/
+		queryMany: require_sleep.method(zod.z.object({
+			items: zod.z.array(QueryManyItemSchema).min(1).max(24),
+			from: QueryWindowShape.from,
+			to: QueryWindowShape.to,
+			resolution: QueryWindowShape.resolution,
+			maxPoints: QueryWindowShape.maxPoints
+		}), zod.z.object({ results: zod.z.array(QueryManyEntrySchema).readonly() }), { auth: "admin" }),
 		/** Producer: declare (idempotent) a series key this addon owns: `addon:<callerAddonId>/<name>`. */
 		declareSeries: require_sleep.method(zod.z.object({
 			name: zod.z.string().regex(/^[a-z0-9-]+$/),
 			subjectKind: zod.z.enum(["device", "node"]),
-			kind: DeviceHistoryKindSchema,
+			kind: DeviceHistoryProducerKindSchema,
 			unit: zod.z.string().optional(),
 			displayName: zod.z.string().min(1),
 			ingest: zod.z.enum(["points", "buckets"])
@@ -40118,30 +40303,50 @@ var llmRuntimeCapability = {
 * (hub-placed); the cap stays open for future providers.
 *
 * Profiles are ROWS (data), not addons: one row = one usable model endpoint.
-* `apiKey` is a password field — providers REDACT it on read and merge on
-* write; a stored key NEVER round-trips to a client.
-*/
-var LlmProfileKindSchema = zod.z.enum([
-	"openai-compatible",
-	"openai",
-	"anthropic",
-	"google",
-	"managed-local",
-	"apple-foundation"
-]);
+* A row is common fields plus `providerConfig`, which the provider owning the
+* row's kind declares (`connectionSchema`) and validates. The kind is an open
+* id declared by that provider (D893). A `password` field of the provider's
+* schema is a secret — providers REDACT it on read and merge on write; a
+* stored key NEVER round-trips to a client.
+*/
+/**
+* A profile kind is an OPEN id, declared by the provider that serves it
+* (`listProfileKinds`). The cap names no kind: a new provider ships a new kind
+* without a framework change. Lower-case, digits and dashes, so it stays safe
+* as a URL segment, a record field and a CSS hook.
+*/
+var LLM_PROFILE_KIND_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var LlmProfileKindSchema = zod.z.string().regex(LLM_PROFILE_KIND_PATTERN, "a kind id is lower-case letters, digits and dashes");
+/** What a model (or, by default, every model of a kind) can do. */
+var LlmModelFeaturesSchema = zod.z.object({
+	vision: zod.z.boolean(),
+	tools: zod.z.boolean(),
+	streaming: zod.z.boolean()
+});
+/** One model a provider offers. `features` overrides the kind's defaults, per field. */
+var LlmModelInfoSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string().optional(),
+	contextLength: zod.z.number().int().positive().optional(),
+	features: LlmModelFeaturesSchema.partial().optional()
+});
+/**
+* The provider-specific part of a profile, validated by the provider that owns
+* the kind (`upsertProfile` refuses what it does not accept). A field its
+* `connectionSchema` declares `type: 'password'` is a secret: it is held in the
+* keychain, never in the row, and reads back as the redaction marker.
+*/
+var LlmProviderConfigSchema = zod.z.record(zod.z.string(), zod.z.unknown());
 var LlmProfileSchema = zod.z.object({
 	id: zod.z.string(),
 	name: zod.z.string(),
+	/** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
 	kind: LlmProfileKindSchema,
 	/** Stamped by the provider — keeps the fanned catalog routable. */
 	addonId: zod.z.string(),
 	enabled: zod.z.boolean(),
 	/** Vendor model id, or the managed runtime's loaded model. */
 	model: zod.z.string(),
-	/** Required for openai-compatible; override for cloud kinds. */
-	baseUrl: zod.z.string().optional(),
-	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
-	apiKey: zod.z.string().optional(),
 	/** Vision on/off. A vision call against a `false` profile is REFUSED, never
 	*  degraded to text — that shipped once and produced a confident answer to a
 	*  question about a picture nobody sent. */
@@ -40149,15 +40354,11 @@ var LlmProfileSchema = zod.z.object({
 	temperature: zod.z.number().min(0).max(2).optional(),
 	/** Nucleus sampling. Every wire we speak has it. */
 	topP: zod.z.number().min(0).max(1).optional(),
-	/** Top-k sampling. Carried only by the wires that have it — NEITHER OpenAI
-	*  wire does, and the client drops it there (measured: the request body gets
-	*  `top_p` and no `top_k`). The profile editor hides the field wherever it
-	*  would change nothing; `KINDS_WITH_TOP_K` is the single owner of that list. */
+	/** Top-k sampling. Carried only by the wires that have it — a kind offers the
+	*  field in its editor only when its descriptor lists it in `profileFields`. */
 	topK: zod.z.number().int().positive().optional(),
 	maxTokens: zod.z.number().int().positive().optional(),
-	/** Prompt context window. Advisory for cloud kinds (they enforce their own);
-	*  for `managed-local` it is the llama.cpp `--ctx-size` the runtime starts
-	*  the model with, so it is the one field that changes a PROCESS. */
+	/** Prompt context window. Advisory for cloud kinds (they enforce their own). */
 	contextLength: zod.z.number().int().positive().optional(),
 	/** Default system prompt. A caller's `system` REPLACES it (never appends —
 	*  two system prompts fighting is worse than either alone). */
@@ -40183,16 +40384,37 @@ var LlmProfileSchema = zod.z.object({
 	*  library; the REGISTRY of callable tools is ours and is empty in v1, so a
 	*  `true` here buys the wiring, not behaviour, until tools are registered. */
 	toolsEnabled: zod.z.boolean().default(false),
-	extraHeaders: zod.z.record(zod.z.string(), zod.z.string()).optional(),
-	/** kind === 'managed-local' only (spec §4). */
-	runtime: ManagedRuntimeConfigSchema.optional(),
-	/**
-	* kind === 'apple-foundation' only: WHERE it runs — the only thing there is
-	* to configure (no key, no URL, no download; `model` is `apple-system`).
-	* `supportsVision` on such a row is stamped by the provider from the node's
-	* reported `imageInput`, never taken from the operator (D62).
-	*/
-	appleFoundation: zod.z.object({ nodeId: zod.z.string() }).optional()
+	/** Everything the kind's provider owns (endpoint, key, node, runtime…). */
+	providerConfig: LlmProviderConfigSchema.default({})
+});
+/**
+* The common profile fields a kind's editor offers. The editor owns how each
+* one is drawn; the provider says which of them mean something on its wire.
+*/
+var LlmProfileFieldSchema = zod.z.enum([
+	"temperature",
+	"topP",
+	"topK",
+	"maxTokens",
+	"contextLength",
+	"systemPrompt",
+	"timeoutMs",
+	"connectTimeoutMs",
+	"firstTokenTimeoutMs",
+	"idleTimeoutMs",
+	"retry",
+	"toolsEnabled"
+]);
+/**
+* A provider-drawn part of the editor, by a generic widget id the admin UI
+* registers (`ai/apple-node`). `placement: 'model'` replaces the generic model
+* picker: that widget owns the model choice.
+*/
+var LlmProviderWidgetSchema = zod.z.object({
+	id: zod.z.string(),
+	placement: zod.z.enum(["connection", "model"]),
+	/** `providerConfig` keys this widget must fill before the profile can be saved. */
+	requires: zod.z.array(zod.z.string()).optional()
 });
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
@@ -40201,11 +40423,56 @@ var ConfigSchemaPassthrough$3 = zod.z.unknown();
 var LlmProfileKindDescriptorSchema = zod.z.object({
 	kind: LlmProfileKindSchema,
 	label: zod.z.string(),
+	/** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
 	icon: zod.z.string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: zod.z.string(),
-	configSchema: ConfigSchemaPassthrough$3
+	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
+	connectionSchema: ConfigSchemaPassthrough$3,
+	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
+	advancedSchema: ConfigSchemaPassthrough$3.optional(),
+	/** The kind's defaults; a model from `listModels` may override any of them. */
+	features: LlmModelFeaturesSchema,
+	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
+	visionEditable: zod.z.boolean(),
+	/** Where the model list comes from: `listModels`, `staticModels`, or nowhere. */
+	modelCatalog: zod.z.enum([
+		"fetch",
+		"static",
+		"none"
+	]),
+	staticModels: zod.z.array(LlmModelInfoSchema).optional(),
+	/** The common fields that mean something on this kind's wire. */
+	profileFields: zod.z.array(LlmProfileFieldSchema),
+	providerWidgets: zod.z.array(LlmProviderWidgetSchema).optional()
 });
+/**
+* `listModels` input. `connection` is an UNSAVED draft of `providerConfig`
+* (the editor's form); with `profileId` too, a secret the draft leaves
+* untouched (absent or the redaction marker) is resolved server-side from the
+* stored profile — the browser never receives it.
+*/
+var LlmListModelsInputSchema = zod.z.object({
+	addonId: zod.z.string(),
+	kind: LlmProfileKindSchema,
+	profileId: zod.z.string().optional(),
+	connection: LlmProviderConfigSchema.optional()
+});
+var LlmListModelsErrorCodeSchema = zod.z.enum([
+	"auth",
+	"network",
+	"unsupported",
+	"invalid"
+]);
+/** A RESULT, never a throw: "wrong key" is an answer the editor renders inline. */
+var LlmListModelsResultSchema = zod.z.discriminatedUnion("ok", [zod.z.object({
+	ok: zod.z.literal(true),
+	models: zod.z.array(LlmModelInfoSchema)
+}), zod.z.object({
+	ok: zod.z.literal(false),
+	code: LlmListModelsErrorCodeSchema,
+	message: zod.z.string()
+})]);
 var LlmDefaultSelectorSchema = zod.z.union([zod.z.object({ consumer: zod.z.string() }), zod.z.object({ purpose: zod.z.enum(["text", "vision"]) })]);
 var LlmDefaultSchema = zod.z.object({
 	selector: LlmDefaultSelectorSchema,
@@ -40336,8 +40603,17 @@ var llmCapability = {
 			auth: "admin",
 			timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
 		}),
-		/** Live vendor enumeration (GET /models etc.). */
-		listModels: require_sleep.method(ProfileRefInputSchema, zod.z.array(zod.z.string())),
+		/**
+		* The models a kind offers, for a SAVED profile or an unsaved draft
+		* (`connection`). A mutation, not a query: a draft may carry a key, and a
+		* query's input travels in the URL. Admin: it dials whatever endpoint the
+		* draft names and may resolve a stored key to do it. The answer never
+		* carries a secret — failures are a typed result, never a throw.
+		*/
+		listModels: require_sleep.method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		getDefaults: require_sleep.method(zod.z.object({}), zod.z.array(LlmDefaultSchema)),
 		setDefault: require_sleep.method(zod.z.object({
 			selector: LlmDefaultSelectorSchema,
@@ -40651,6 +40927,103 @@ var LogEntrySchema = zod.z.object({
 	meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
 	tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
 });
+/**
+* A history READ against one destination (D898).
+*
+* Every filter is applied by the PROVIDER, before the limit — a filter the
+* browser applied after the limit is what made a rare device's lines
+* unreachable behind a busy one's. `before` / `after` are cursors the provider
+* minted (opaque to everyone else): a file position for the rotated files, a
+* nanosecond timestamp for Loki.
+*
+* A read is BOUNDED by `budgetMs`: a filter that matches nothing on a 30-day
+* store answers `done: false` with the cursor it reached and the bytes it
+* scanned, and the caller decides whether to go on. That is what makes a long
+* scan show progress and stop when asked — `cancelRead` ends the slice in
+* flight, and not asking for the next slice ends the scan.
+*/
+var LogReadQuerySchema = zod.z.object({
+	/** Correlates `cancelRead`. Caller-chosen, unique per in-flight read. */
+	requestId: zod.z.string().min(1).max(64).optional(),
+	/** The device the line is about (`tags.deviceId`, numeric). */
+	deviceId: zod.z.number().int().optional(),
+	/**
+	* The emitting addon — bare manifest id; `@<version>` / `::<sub>` suffixes
+	* match. Not `addonId`: a cap router reads that name as "which provider".
+	*/
+	fromAddonId: zod.z.string().min(1).max(200).optional(),
+	/**
+	* The emitting node: matches the agent that emitted the line, the node
+	* itself, or a worker under it (`<agent>/<runner>`) — the `agentId`
+	* semantics of `matchesLogTags`. Not `nodeId`: a cap router reads that
+	* name as "which node's provider".
+	*/
+	fromNodeId: zod.z.string().min(1).max(200).optional(),
+	/** Any other tag, exact match (AND). */
+	tags: zod.z.record(zod.z.string(), zod.z.union([zod.z.string(), zod.z.number()])).optional(),
+	/** Severity FLOOR: this level and above. */
+	level: LogLevelSchema.optional(),
+	/** Case-insensitive substring over message, scope, tag values and meta values. */
+	text: zod.z.string().min(1).max(200).optional(),
+	/** Epoch ms, inclusive. */
+	since: zod.z.number().optional(),
+	/** Epoch ms, inclusive. */
+	until: zod.z.number().optional(),
+	/** Older than this cursor (exclusive). Absent with `after` absent ⇒ from the newest. */
+	before: zod.z.string().min(1).max(1024).optional(),
+	/** Newer than this cursor (exclusive). */
+	after: zod.z.string().min(1).max(1024).optional(),
+	limit: zod.z.number().int().min(1).max(1e3).optional(),
+	/** Wall-clock bound of this slice. The provider caps it. */
+	budgetMs: zod.z.number().int().min(50).max(1e4).optional()
+});
+var LogReadEntrySchema = zod.z.object({
+	/** `<bootId>.<seq>` minted by the emitting LogManager — the dedupe key. */
+	id: zod.z.string().optional(),
+	/** Epoch ms. */
+	timestamp: zod.z.number(),
+	level: LogLevelSchema,
+	scope: zod.z.string().optional(),
+	message: zod.z.string(),
+	tags: zod.z.record(zod.z.string(), zod.z.union([zod.z.string(), zod.z.number()])).optional(),
+	meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+});
+var LogReadResultSchema = zod.z.object({
+	/** Newest first. */
+	entries: zod.z.array(LogReadEntrySchema),
+	/** Pass as `before` for the next older page; null when nothing older exists. */
+	nextBefore: zod.z.string().nullable(),
+	/** Pass as `after` to read what arrived since; null when unknown. */
+	nextAfter: zod.z.string().nullable(),
+	/** Bytes this slice read (files) or received (remote). Progress, not a promise. */
+	scannedBytes: zod.z.number().int().nonnegative(),
+	/**
+	* True when the scan in this direction reached the end of the store.
+	* False with fewer than `limit` entries means the budget ran out first —
+	* call again with `nextBefore` to go on.
+	*/
+	done: zod.z.boolean(),
+	/** True when `cancelRead` ended this slice early. */
+	cancelled: zod.z.boolean().optional()
+});
+var LogReadCapabilitiesSchema = zod.z.object({
+	/** False ⇒ this destination only ships lines (console, forwarder, an unconfigured Loki). */
+	readable: zod.z.boolean(),
+	/** Why not, when `readable` is false — rendered next to the source. */
+	reason: zod.z.string().nullable(),
+	/** Filters the provider applies itself. A false one is applied by nobody. */
+	filters: zod.z.object({
+		deviceId: zod.z.boolean(),
+		addonId: zod.z.boolean(),
+		nodeId: zod.z.boolean(),
+		tags: zod.z.boolean(),
+		level: zod.z.boolean(),
+		text: zod.z.boolean(),
+		timeRange: zod.z.boolean()
+	}),
+	/** How far back the store reaches, when the provider knows (days). */
+	retentionDays: zod.z.number().nullable()
+});
 var logDestinationCapability = {
 	name: "log-destination",
 	scope: "system",
@@ -40658,14 +41031,13 @@ var logDestinationCapability = {
 	internal: true,
 	methods: {
 		write: require_sleep.method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
-		query: require_sleep.method(zod.z.object({
-			scope: zod.z.array(zod.z.string()).optional(),
-			level: LogLevelSchema.optional(),
-			since: zod.z.date().optional(),
-			until: zod.z.date().optional(),
-			limit: zod.z.number().optional(),
-			tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-		}), zod.z.array(LogEntrySchema).readonly())
+		/** Absent ⇒ the destination cannot read back (same as `readable: false`). */
+		describeRead: require_sleep.optionalMethod(zod.z.void(), LogReadCapabilitiesSchema, { auth: "admin" }),
+		read: require_sleep.optionalMethod(LogReadQuerySchema, LogReadResultSchema, { auth: "admin" }),
+		cancelRead: require_sleep.optionalMethod(zod.z.object({ requestId: zod.z.string().min(1).max(64) }), zod.z.object({ cancelled: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
 	mount: { kind: "skip" }
@@ -42990,9 +43362,11 @@ var alarmPanelCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — enum state; arm/disarm history belongs in the events ledger.
+	* History (D850): the panel's lifecycle state as an `enum` series —
+	* change-only, no floor, so an `arming -> pending -> triggered` sequence of a
+	* few seconds keeps every step. Who armed it stays in the events ledger.
 	*/
-	history: "none",
+	history: { fields: { state: { kind: "enum" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -43985,6 +44359,33 @@ var NcRuleTargetSchema = zod.z.object({
 	params: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
 });
 /**
+* WHAT THE NOTIFICATION'S PICTURE IS (D897) — the ONE media choice of a rule.
+*
+* Every mode starts from the same CLEAN source frame of the trigger moment
+* (keyFrame → sceneFrame → lastSceneFrame, narrowed to the trigger instant and
+* to the zone that fired the rule) and renders it once at send time:
+*  - `scene-boxes` — the whole scene, the subject outlined thick in the accent
+*    colour and every OTHER track visible at that instant outlined thin, each
+*    labelled with class and confidence ("dog 87%").
+*  - `crop`  — the subject cut out of that frame around its box at that instant.
+*  - `clean` — the whole scene with nothing drawn on it.
+*  - `none`  — no picture.
+*
+* A mode that cannot be honoured (no box at that instant, a photograph with no
+* tracked subject) ships `clean` and names the reason in the log, per camera.
+* It replaces the `attach` × `frame` × `zoneCrop` triple, which let one rule
+* ship a crop on one event and a boxed scene on the next depending on which
+* stored kind had landed.
+*/
+var NcMediaImageSchema = zod.z.enum([
+	"scene-boxes",
+	"crop",
+	"clean",
+	"none"
+]);
+/**
+* @deprecated Read only by `normalizeNcMediaPolicy` (D897) — see {@link NcMediaImageSchema}.
+*
 * Media attachment policy (P1 still-image subset).
 *  - `best` — the best AVAILABLE subject image at dispatch time (D-3).
 *  - `best-matching` — the media that explains WHY the rule fired: a rule
@@ -43998,6 +44399,8 @@ var NcRuleTargetSchema = zod.z.object({
 *  - `none` — no attachment.
 */
 /**
+* @deprecated Read only by `normalizeNcMediaPolicy` (D897) — see {@link NcMediaImageSchema}.
+*
 * WHAT THE PICTURE SHOWS — chosen explicitly, because the implicit ladders
 * conflate it with the selection strategy and betray the request: asking for
 * the clean scene frame on an object-event owner used to start at
@@ -44044,16 +44447,29 @@ var NcLinkedCameraModeSchema = zod.z.enum(["mosaic", "each"]);
 var NC_CLIP_PRE_ROLL_DEFAULT_SEC = 4;
 var NC_CLIP_POST_ROLL_DEFAULT_SEC = 6;
 var NcMediaPolicySchema = zod.z.object({
+	/**
+	* The picture — see {@link NcMediaImageSchema}. Absent on a rule nobody has
+	* saved since D897: `normalizeNcMediaPolicy` derives it from the legacy
+	* triple below, at load and at every write, and the store keeps only this.
+	*/
+	image: NcMediaImageSchema.optional(),
+	/**
+	* Draw the zone that FIRED the rule on the picture (`scene-boxes` / `clean`;
+	* a `crop` never shows it). Valid only on a rule whose trigger is a zone —
+	* `conditions.zones` or an occupancy zone — and refused on save otherwise.
+	* Replaces `zoneCrop`.
+	*/
+	showTriggerZone: zod.z.boolean().optional(),
+	/** @deprecated D897 — accepted from an editor that predates `image`, folded into it on save. */
 	attach: zod.z.enum([
 		"best",
 		"best-matching",
 		"keyFrame",
 		"none"
-	]).default("best"),
-	/** What the still shows. Absent = `cropped` (the historical `best` shape). */
+	]).optional(),
+	/** @deprecated D897 — accepted from an editor that predates `image`, folded into it on save. */
 	frame: NcMediaFrameSchema.optional(),
-	/** Crop the attached still to the rule's condition-zone bbox (padded) —
-	*  "show me the ZONE", not the whole scene or the subject crop. */
+	/** @deprecated D897 — folded into `image: 'clean'` + `showTriggerZone` on save. */
 	zoneCrop: zod.z.boolean().optional(),
 	/**
 	* Also attach a short GIF cut from the stream broker's clip ring around the
@@ -44239,7 +44655,9 @@ var NcRuleInputSchema = zod.z.object({
 	* targets.
 	*/
 	targetUsers: zod.z.array(zod.z.string()).optional(),
-	media: NcMediaPolicySchema.default({ attach: "best" }),
+	/** Absent = the kind's default picture (`resolveNcMediaImage`): the subject crop for a
+	*  detection, the clean scene for a sensor or a sound. Set explicitly on save (D897). */
+	media: NcMediaPolicySchema.default({}),
 	throttle: NcThrottleSchema.default({
 		cooldownSec: 60,
 		scope: "rule-device"
@@ -45811,13 +46229,37 @@ var NcAlarmModeOpeningsSchema = zod.z.object({
 	/** Covered devices whose state could not be read (D49): neither open nor closed. */
 	unknown: zod.z.array(zod.z.number().int())
 });
+/**
+* One alarm INPUT — a (rule, device) pair — the operator bypassed until the
+* next disarm ("Bypass this input until disarm" on a trigger notification, or
+* `nc.bypassAlarmInput`). Reported so an armed alarm with a silenced input
+* never looks fully armed (D62: off must never look like broken).
+*/
+var NcAlarmInputBypassViewSchema = zod.z.object({
+	ruleId: zod.z.string(),
+	/** The rule's current name (its frozen name when the rule is gone). */
+	ruleName: zod.z.string(),
+	/** The input: the sensor of the match, else its camera. */
+	deviceId: zod.z.number().int(),
+	/** The input's current name. */
+	name: zod.z.string(),
+	/** When it was bypassed (ms epoch). */
+	since: zod.z.number(),
+	/** Triggers from this input dropped since. */
+	dropped: zod.z.number().int().min(0)
+});
 var NcAlarmLiveSchema = zod.z.object({
 	state: AlarmStateSchema,
 	/** The mode being armed into (exit delay) or held; null when disarmed. */
 	targetMode: AlarmArmModeSchema.nullable(),
 	availableModes: zod.z.array(AlarmArmModeSchema),
 	openings: zod.z.array(NcAlarmModeOpeningsSchema),
-	exclusions: zod.z.array(NcAlarmExclusionViewSchema)
+	exclusions: zod.z.array(NcAlarmExclusionViewSchema),
+	/**
+	* Inputs bypassed for the rest of this arm session; cleared on disarm.
+	* Defaulted so an older hub answer still parses (as "none known").
+	*/
+	bypassedInputs: zod.z.array(NcAlarmInputBypassViewSchema).default([])
 });
 var NcAlarmConfigSchema = zod.z.object({
 	/**
@@ -60786,9 +61228,11 @@ var connectivityCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — duplicates device-status.online (one authority for availability).
+	* History (D850): `connected` as a boolean series — change-only, no floor. It
+	* is the upstream entity's own link (a HA connectivity sensor), not the
+	* device's reachability, which stays `device-status.online`.
 	*/
-	history: "none",
+	history: { fields: { connected: { kind: "boolean" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -61672,11 +62116,22 @@ var dishwasherCapability = {
 	},
 	runtimeState: DishwasherStatusSchema,
 	durability: "session",
-	history: { fields: { progressPercent: {
-		kind: "gauge",
-		unit: "%",
-		deadband: 2
-	} } }
+	history: { fields: {
+		progressPercent: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		state: { kind: "enum" },
+		operationState: { kind: "enum" },
+		remainingSeconds: {
+			kind: "gauge",
+			unit: "s",
+			minIntervalMs: 6e4
+		},
+		doorOpen: { kind: "boolean" },
+		powerOn: { kind: "boolean" }
+	} }
 };
 //#endregion
 //#region src/capabilities/doorbell.cap.ts
@@ -61797,9 +62252,15 @@ var enumSensorCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — text/enum state has no history (non-goal).
+	* History (D850): the value as an `enum` series (an appliance's program or
+	* operation state, an HVAC action). The option set is per device, so the
+	* value list is LEARNED as values are first seen (bounded). A sensor with a
+	* `format` carries a timestamp, not a state, and is not recorded.
 	*/
-	history: "none",
+	history: { fields: { value: {
+		kind: "enum",
+		skipWhenSet: "format"
+	} } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -64053,9 +64514,10 @@ var lockControlCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — enum state; lock events belong in the events ledger.
+	* History (D850): the lock's state as an `enum` series — change-only, no
+	* floor: a jam or an unlock lasting seconds is the edge an operator looks for.
 	*/
-	history: "none",
+	history: { fields: { state: { kind: "enum" } } },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
@@ -64231,9 +64693,18 @@ var mediaPlayerCapability = {
 	*/
 	durability: "session",
 	/**
-	* History (D850): none — `positionMs` moves continuously while playing; volume is transient.
+	* History (D850): volume (a level an operator or an automation sets; the
+	* default 10 s floor folds a slider drag into its end value) and mute.
+	* `positionMs` is not recorded: it moves continuously while playing.
 	*/
-	history: "none"
+	history: { fields: {
+		volumeLevel: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		isMuted: { kind: "boolean" }
+	} }
 };
 //#endregion
 //#region src/capabilities/mesh-network.cap.ts
@@ -71185,9 +71656,29 @@ var streamParamsCapability = {
 	*/
 	durability: "restored",
 	/**
-	* History (D850): none — encoder configuration.
+	* History (D850): the configured bitrate and frame rate of the main and sub
+	* profiles. Configuration, so change-only on the default floor: a point is an
+	* operator's (or a tuner's) edit, which is exactly what a chart of a stream's
+	* quality over time must show.
 	*/
-	history: "none",
+	history: { fields: {
+		"main.bitrate": {
+			kind: "gauge",
+			unit: "kbps"
+		},
+		"main.framerate": {
+			kind: "gauge",
+			unit: "fps"
+		},
+		"sub.bitrate": {
+			kind: "gauge",
+			unit: "kbps"
+		},
+		"sub.framerate": {
+			kind: "gauge",
+			unit: "fps"
+		}
+	} },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastFetchedAt"]
@@ -72461,26 +72952,6 @@ var ApiKeySummarySchema = zod.z.object({
 	createdAt: zod.z.number(),
 	lastUsedAt: zod.z.number().optional()
 });
-var ScopedTokenSummarySchema = zod.z.object({
-	id: zod.z.string(),
-	userId: zod.z.string(),
-	name: zod.z.string(),
-	tokenPrefix: zod.z.string(),
-	scopes: zod.z.array(TokenScopeSchema),
-	expiresAt: zod.z.number().nullish(),
-	lastUsedAt: zod.z.number().nullish(),
-	createdAt: zod.z.number()
-});
-var CreateScopedTokenInputSchema = zod.z.object({
-	userId: zod.z.string(),
-	name: zod.z.string(),
-	scopes: zod.z.array(TokenScopeSchema),
-	expiresAt: zod.z.number().optional()
-});
-var CreateScopedTokenResultSchema = zod.z.object({
-	token: zod.z.string(),
-	record: ScopedTokenSummarySchema
-});
 var OauthSessionSummarySchema = zod.z.object({
 	id: zod.z.string(),
 	userId: zod.z.string(),
@@ -72502,11 +72973,11 @@ var TotpStatusSchema = zod.z.object({
 	confirmedAt: zod.z.number().nullable()
 });
 /**
-* user-management — singleton capability for user accounts, API keys,
-* and scoped tokens.
+* user-management — singleton capability for user accounts and the
+* legacy API-key rows.
 *
 * v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
-* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* — the subset check on `setUserScopes` is moot
 * because non-admins never reach these. If/when we open non-admin
 * delegation, structural caller-scope subset check goes inside the
 * provider.
@@ -72577,18 +73048,6 @@ var userManagementCapability = {
 			auth: "admin",
 			access: "delete"
 		}),
-		createScopedToken: require_sleep.method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
-		revokeScopedToken: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin",
-			access: "delete"
-		}),
-		validateScopedToken: require_sleep.method(zod.z.object({ token: zod.z.string() }), ScopedTokenSummarySchema.nullable(), { access: "view" }),
-		listScopedTokens: require_sleep.method(zod.z.object({ userId: zod.z.string() }), zod.z.array(ScopedTokenSummarySchema), { auth: "admin" }),
 		setupTotp: require_sleep.method(zod.z.object({ userId: zod.z.string() }), TotpSetupResultSchema, {
 			kind: "mutation",
 			auth: "admin",
@@ -76160,6 +76619,15 @@ var BaseDevice = class {
 	* Drivers can use the `getProbeFlags()` helper to read the flag bag
 	* with a typed cast.
 	*
+	* Answer what you KNOW. A plain array is read as the complete list only
+	* while this device is `online` and probed; return
+	* `accessoryChildrenUnknown(reason)` whenever you cannot know the list right
+	* now (no credentials, parent not connected, a failed or partial read) —
+	* the kernel then deletes nothing. Return `accessoryChildrenComplete(list)`
+	* to say "connected, and this is the complete list" explicitly. A shrink is
+	* deleted only after a second agreeing complete read on a later probe (D49;
+	* `packages/system/src/kernel/moleculer/accessory-prune-gate.ts`).
+	*
 	* Default: no children.
 	*/
 	getAccessoryChildren() {
@@ -76183,6 +76651,22 @@ var BaseDevice = class {
 		return (this.runtimeState.getCapState("feature-probe")?.lastProbedAt ?? 0) > 0;
 	}
 };
+function accessoryChildrenUnknown(reason, known) {
+	return known === void 0 ? {
+		kind: "unknown",
+		reason
+	} : {
+		kind: "unknown",
+		reason,
+		known
+	};
+}
+function accessoryChildrenComplete(children) {
+	return {
+		kind: "complete",
+		children
+	};
+}
 //#endregion
 //#region src/device/device-restore-retry.ts
 /**
@@ -80812,7 +81296,7 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		capName: "llm",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
 	"llm.listNodeModels": {
 		capName: "llm",
@@ -81114,7 +81598,19 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"logDestination.query": {
+	"logDestination.cancelRead": {
+		capName: "log-destination",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"logDestination.describeRead": {
+		capName: "log-destination",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"logDestination.read": {
 		capName: "log-destination",
 		capScope: "system",
 		addonId: null,
@@ -85476,12 +85972,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.createScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.createUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -85530,12 +86020,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.listScopedTokens": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.listUsers": {
 		capName: "user-management",
 		capScope: "system",
@@ -85590,12 +86074,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
-	"userManagement.revokeScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"userManagement.setupTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -85626,12 +86104,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.validateScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.verifyTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -90557,6 +91029,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"logDestination.read": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"mediaPlayer.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -92324,6 +92801,7 @@ var SYSTEM_SCOPE_DEVICE_METHODS = [
 	"faceGallery.getFaceByTrack",
 	"faceGallery.listRecentFaces",
 	"keychain.deleteDeviceScope",
+	"logDestination.read",
 	"networkQuality.getDeviceStats",
 	"networkQuality.reportClientStats",
 	"notificationRules.getAlarmSensors",
@@ -92919,7 +93397,7 @@ var BucketAccumulator = class {
 //#region src/generated/history-catalog.ts
 /**
 * Cap history catalog, projected from every `*.cap.ts` `history` block.
-* 34 caps with series (62 series), 37 caps answered `'none'`.
+* 40 caps with series (77 series), 31 caps answered `'none'`.
 * Field keys are `runtimeState` paths (`a.b` into fixed objects only).
 */
 var HISTORY_CATALOG = {
@@ -92950,6 +93428,21 @@ var HISTORY_CATALOG = {
 			deadband: 1
 		}
 	},
+	"alarm-panel": { "state": {
+		kind: "enum",
+		values: [
+			"disarmed",
+			"armed_home",
+			"armed_away",
+			"armed_night",
+			"armed_vacation",
+			"armed_custom_bypass",
+			"arming",
+			"disarming",
+			"pending",
+			"triggered"
+		]
+	} },
 	"ambient-light-sensor": { "lux": {
 		kind: "gauge",
 		unit: "lx",
@@ -92994,6 +93487,7 @@ var HISTORY_CATALOG = {
 			minIntervalMs: 0
 		}
 	},
+	"connectivity": { "connected": { kind: "boolean" } },
 	"contact": { "entryOpen": { kind: "boolean" } },
 	"cover": { "position": {
 		kind: "gauge",
@@ -93001,10 +93495,48 @@ var HISTORY_CATALOG = {
 		minIntervalMs: 0
 	} },
 	"device-status": { "online": { kind: "boolean" } },
-	"dishwasher": { "progressPercent": {
-		kind: "gauge",
-		unit: "%",
-		deadband: 2
+	"dishwasher": {
+		"progressPercent": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 2
+		},
+		"state": {
+			kind: "enum",
+			values: [
+				"idle",
+				"running",
+				"paused",
+				"finished",
+				"error",
+				"unavailable"
+			]
+		},
+		"operationState": {
+			kind: "enum",
+			values: [
+				"Inactive",
+				"Ready",
+				"DelayedStart",
+				"Run",
+				"Pause",
+				"ActionRequired",
+				"Finished",
+				"Error",
+				"Aborting"
+			]
+		},
+		"remainingSeconds": {
+			kind: "gauge",
+			unit: "s",
+			minIntervalMs: 6e4
+		},
+		"doorOpen": { kind: "boolean" },
+		"powerOn": { kind: "boolean" }
+	},
+	"enum-sensor": { "value": {
+		kind: "enum",
+		skipWhenSet: "format"
 	} },
 	"fan-control": {
 		"percentage": {
@@ -93039,6 +93571,24 @@ var HISTORY_CATALOG = {
 		unit: "%",
 		deadband: 2
 	} },
+	"lock-control": { "state": {
+		kind: "enum",
+		values: [
+			"locked",
+			"unlocked",
+			"locking",
+			"unlocking",
+			"jammed"
+		]
+	} },
+	"media-player": {
+		"volumeLevel": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		"isMuted": { kind: "boolean" }
+	},
 	"motion": { "detected": {
 		kind: "boolean",
 		excludeDeviceTypes: [require_err_msg.DeviceType.Camera]
@@ -93125,6 +93675,24 @@ var HISTORY_CATALOG = {
 		deadband: .1
 	} },
 	"smoke": { "detected": { kind: "boolean" } },
+	"stream-params": {
+		"main.bitrate": {
+			kind: "gauge",
+			unit: "kbps"
+		},
+		"main.framerate": {
+			kind: "gauge",
+			unit: "fps"
+		},
+		"sub.bitrate": {
+			kind: "gauge",
+			unit: "kbps"
+		},
+		"sub.framerate": {
+			kind: "gauge",
+			unit: "fps"
+		}
+	},
 	"switch": { "on": { kind: "boolean" } },
 	"tamper": { "tampered": { kind: "boolean" } },
 	"temperature-sensor": { "celsius": {
@@ -93202,25 +93770,20 @@ var HISTORY_CATALOG = {
 };
 /** Caps that declared `history: 'none'`, sorted. */
 var HISTORY_NONE_CAPS = [
-	"alarm-panel",
 	"audio-metrics",
 	"automation-control",
 	"camera-streams",
 	"color",
-	"connectivity",
 	"consumables",
 	"control",
 	"day-night",
 	"device-discovery",
 	"doorbell",
-	"enum-sensor",
 	"event-emitter",
 	"feature-probe",
 	"image",
 	"image-settings",
 	"intercom",
-	"lock-control",
-	"media-player",
 	"motion-trigger",
 	"motion-zones",
 	"native-object-detection",
@@ -93233,7 +93796,6 @@ var HISTORY_NONE_CAPS = [
 	"scene-monitor",
 	"script-runner",
 	"stream-catalog",
-	"stream-params",
 	"stream-signals",
 	"update",
 	"zone-analytics",
@@ -93506,6 +94068,7 @@ function createSystemProxy(api) {
 		deviceHistory: {
 			listNodeSeries: (input) => dispatch("deviceHistory", "listNodeSeries", "query", input),
 			queryNode: (input) => dispatch("deviceHistory", "queryNode", "query", input),
+			queryMany: (input) => dispatch("deviceHistory", "queryMany", "query", input),
 			declareSeries: (input) => dispatch("deviceHistory", "declareSeries", "mutation", input),
 			record: (input) => dispatch("deviceHistory", "record", "mutation", input),
 			recordBuckets: (input) => dispatch("deviceHistory", "recordBuckets", "mutation", input),
@@ -93639,7 +94202,7 @@ function createSystemProxy(api) {
 			migrateRawSecrets: (input) => dispatch("llm", "migrateRawSecrets", "mutation", input),
 			deleteProfile: (input) => dispatch("llm", "deleteProfile", "mutation", input),
 			testProfile: (input) => dispatch("llm", "testProfile", "mutation", input),
-			listModels: (input) => dispatch("llm", "listModels", "query", input),
+			listModels: (input) => dispatch("llm", "listModels", "mutation", input),
 			getDefaults: (input) => dispatch("llm", "getDefaults", "query", input),
 			setDefault: (input) => dispatch("llm", "setDefault", "mutation", input),
 			getUsage: (input) => dispatch("llm", "getUsage", "query", input),
@@ -94083,10 +94646,6 @@ function createSystemProxy(api) {
 			validateCredentials: (input) => dispatch("userManagement", "validateCredentials", "mutation", input),
 			listApiKeys: (input) => dispatch("userManagement", "listApiKeys", "query", input),
 			revokeApiKey: (input) => dispatch("userManagement", "revokeApiKey", "mutation", input),
-			createScopedToken: (input) => dispatch("userManagement", "createScopedToken", "mutation", input),
-			revokeScopedToken: (input) => dispatch("userManagement", "revokeScopedToken", "mutation", input),
-			validateScopedToken: (input) => dispatch("userManagement", "validateScopedToken", "query", input),
-			listScopedTokens: (input) => dispatch("userManagement", "listScopedTokens", "query", input),
 			setupTotp: (input) => dispatch("userManagement", "setupTotp", "mutation", input),
 			confirmTotp: (input) => dispatch("userManagement", "confirmTotp", "mutation", input),
 			disableTotp: (input) => dispatch("userManagement", "disableTotp", "mutation", input),
@@ -95783,6 +96342,100 @@ function ruleEditorSectionsForKind(kind) {
 	return sections;
 }
 //#endregion
+//#region src/notification/media-image.ts
+/** Every mode, in the order an editor offers them. */
+var NC_MEDIA_IMAGE_MODES = [
+	"scene-boxes",
+	"crop",
+	"clean",
+	"none"
+];
+/**
+* The modes a rule of this kind can honour. A kind that carries no media gets
+* none (its row ships text, or — an alarm — its SOURCE rule's picture); a kind
+* whose subject has no region of the frame (a sound) is never offered `crop`.
+*/
+function imageModesForKind(kind) {
+	const spec = ruleKindSpec(kind);
+	if (!spec.carriesMedia) return [];
+	return spec.carriesSubjectCrop ? NC_MEDIA_IMAGE_MODES : NC_MEDIA_IMAGE_MODES.filter((mode) => mode !== "crop");
+}
+/**
+* The zone ids that FIRE a rule: its `zones` condition, or an occupancy rule's
+* own scoped zone. Empty when the trigger is not a zone — and then
+* `showTriggerZone` has nothing to draw and is refused on save.
+*/
+function ruleTriggerZoneIds(conditions) {
+	if (conditions.zones !== void 0) return conditions.zones.ids;
+	const zoneId = conditions.occupancy?.zoneId;
+	return zoneId !== void 0 ? [zoneId] : [];
+}
+/**
+* What the legacy triple MEANT, as a mode. `zoneCrop` forced the clean
+* keyFrame ladder and dropped `frame`, so it is `clean` whatever else was set;
+* `frame` decided over `attach` when present; `keyFrame` was the clean scene;
+* every other still (`best`, `best-matching`, the default) was the subject.
+*/
+function legacyImageMode(media) {
+	if (media.attach === "none") return "none";
+	if (media.zoneCrop === true) return "clean";
+	if (media.frame === "full") return "clean";
+	if (media.frame === "boxed") return "scene-boxes";
+	if (media.frame === "cropped") return "crop";
+	if (media.attach === "keyFrame") return "clean";
+	return "crop";
+}
+/** A mode the kind cannot honour, mapped to the nearest one it can. */
+function clampToKind(mode, kind) {
+	const offered = imageModesForKind(kind);
+	if (offered.length === 0 || offered.includes(mode)) return mode;
+	return mode === "crop" ? "clean" : mode;
+}
+/**
+* The mode a rule's picture is rendered in. `image` when stored; else what the
+* legacy triple meant — and, for a SENSOR rule written before D897, `clean`
+* whatever it stored (even `attach: 'none'`), because its stored triple was
+* ignored and one plain snapshot always shipped (operator ruling, 2026-10-01):
+* the migration keeps what the rule actually DID. Clamped to what the kind can
+* honour.
+*/
+function resolveNcMediaImage(media, kind) {
+	if (media.image !== void 0) return clampToKind(media.image, kind);
+	if (kind === "sensor") return "clean";
+	return clampToKind(legacyImageMode(media), kind);
+}
+/**
+* The stored shape of a media policy: `image` set, the legacy triple gone.
+* `showTriggerZone` survives only where it can be drawn — a zone trigger and a
+* mode other than `crop`/`none`; a legacy `zoneCrop` on a zone rule becomes it.
+* Every other field (gif, clip, rolls, speed, profile, linked cameras) is
+* carried through untouched. Pure; never throws.
+*/
+function normalizeNcMediaPolicy(media, rule) {
+	const image = resolveNcMediaImage(media, ruleKindOf(rule));
+	const { attach: _attach, frame: _frame, zoneCrop, showTriggerZone, image: _image, ...rest } = media;
+	const drawable = (showTriggerZone === true || media.image === void 0 && zoneCrop === true) && image !== "crop" && image !== "none" && ruleTriggerZoneIds(rule.conditions).length > 0;
+	return {
+		...rest,
+		image,
+		...drawable ? { showTriggerZone: true } : {}
+	};
+}
+/**
+* Why a media policy cannot be SAVED on this rule, or null. Server-side and
+* editor alike: `showTriggerZone` on a rule whose trigger is not a zone, and a
+* mode the rule's kind cannot honour.
+*/
+function ncMediaPolicyError(media, rule) {
+	const kind = ruleKindOf(rule);
+	if (media.image !== void 0) {
+		const offered = imageModesForKind(kind);
+		if (offered.length > 0 && !offered.includes(media.image)) return `media.image '${media.image}' is not available for a ${kind} rule (offered: ${offered.join(", ")})`;
+	}
+	if (media.showTriggerZone === true && ruleTriggerZoneIds(rule.conditions).length === 0) return "media.showTriggerZone needs a rule triggered by a zone (a zones condition or an occupancy zone)";
+	return null;
+}
+//#endregion
 //#region src/notification/schedule.ts
 var WEEKDAY_TO_DAY = {
 	Sun: 0,
@@ -103201,6 +103854,7 @@ exports.CONNECTION_TEST_TIMEOUT_MS = CONNECTION_TEST_TIMEOUT_MS;
 exports.CONTAINER_CHILD_PRIORITY = CONTAINER_CHILD_PRIORITY;
 exports.CORE_BLOCKS_ADDON_ID = CORE_BLOCKS_ADDON_ID;
 exports.CORE_BLOCK_ADDON_PREFIX = CORE_BLOCK_ADDON_PREFIX;
+exports.CREDENTIAL_TOKEN_AUDIENCE = CREDENTIAL_TOKEN_AUDIENCE;
 exports.CREDENTIAL_TOKEN_KIND = CREDENTIAL_TOKEN_KIND;
 exports.CROP_SUPPLY_SOURCES = CROP_SUPPLY_SOURCES;
 exports.CROP_SUPPLY_STEP_IDS = CROP_SUPPLY_STEP_IDS;
@@ -103379,8 +104033,6 @@ exports.CoreBlockStatusSchema = CoreBlockStatusSchema;
 exports.CoverStateSchema = CoverStateSchema;
 exports.CoverStatusSchema = CoverStatusSchema;
 exports.CreateIntegrationInputSchema = CreateIntegrationInputSchema;
-exports.CreateScopedTokenInputSchema = CreateScopedTokenInputSchema;
-exports.CreateScopedTokenResultSchema = CreateScopedTokenResultSchema;
 exports.CreateUserInputSchema = CreateUserInputSchema;
 exports.CredentialScopeSchema = CredentialScopeSchema;
 exports.CredentialTokenClaimsSchema = CredentialTokenClaimsSchema;
@@ -103441,6 +104093,8 @@ exports.DEVICE_CHILDREN_BATCH_MAX = require_sleep.DEVICE_CHILDREN_BATCH_MAX;
 exports.DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE = DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE;
 exports.DEVICE_DO_ACTIONS = DEVICE_DO_ACTIONS;
 exports.DEVICE_ENROLLMENT_TTL_MS = DEVICE_ENROLLMENT_TTL_MS;
+exports.DEVICE_HISTORY_ENERGY_KEY = DEVICE_HISTORY_ENERGY_KEY;
+exports.DEVICE_HISTORY_QUERY_MANY_MAX_ITEMS = DEVICE_HISTORY_QUERY_MANY_MAX_ITEMS;
 exports.DEVICE_NONCE_TTL_MS = DEVICE_NONCE_TTL_MS;
 exports.DEVICE_PROFILES = DEVICE_PROFILES;
 exports.DEVICE_RAMP = DEVICE_RAMP;
@@ -103499,6 +104153,7 @@ exports.DeviceExportStatusSchema = DeviceExportStatusSchema;
 exports.DeviceExportUnexposeInputSchema = UnexposeInputSchema;
 exports.DeviceFeature = require_err_msg.DeviceFeature;
 exports.DeviceHistoryKindSchema = DeviceHistoryKindSchema;
+exports.DeviceHistoryProducerKindSchema = DeviceHistoryProducerKindSchema;
 exports.DeviceHistoryRefusalReasonSchema = DeviceHistoryRefusalReasonSchema;
 exports.DeviceHistoryResolutionSchema = DeviceHistoryResolutionSchema;
 exports.DeviceHistoryStatusSchema = DeviceHistoryStatusSchema;
@@ -103763,6 +104418,7 @@ exports.LABEL_SUPPLY_VOCABULARIES = LABEL_SUPPLY_VOCABULARIES;
 exports.LEGACY_READ_ONLY_CONFIG_KEY = LEGACY_READ_ONLY_CONFIG_KEY;
 exports.LINKED_DEVICES_SLOT = LINKED_DEVICES_SLOT;
 exports.LINKED_LABEL_STEP_PREFIX = LINKED_LABEL_STEP_PREFIX;
+exports.LLM_PROFILE_KIND_PATTERN = LLM_PROFILE_KIND_PATTERN;
 exports.LOAD_CONTRIBUTION_ATTRIBUTIONS = LOAD_CONTRIBUTION_ATTRIBUTIONS;
 exports.LOAD_CONTRIBUTION_ROLES = LOAD_CONTRIBUTION_ROLES;
 exports.LOCATION_DESCRIPTION_MAX = LOCATION_DESCRIPTION_MAX;
@@ -103799,10 +104455,18 @@ exports.LlmGenerateErrSchema = LlmGenerateErrSchema;
 exports.LlmGenerateOkSchema = LlmGenerateOkSchema;
 exports.LlmGenerateResultSchema = LlmGenerateResultSchema;
 exports.LlmImageSchema = LlmImageSchema;
+exports.LlmListModelsErrorCodeSchema = LlmListModelsErrorCodeSchema;
+exports.LlmListModelsInputSchema = LlmListModelsInputSchema;
+exports.LlmListModelsResultSchema = LlmListModelsResultSchema;
+exports.LlmModelFeaturesSchema = LlmModelFeaturesSchema;
+exports.LlmModelInfoSchema = LlmModelInfoSchema;
 exports.LlmNodeModelSchema = LlmNodeModelSchema;
+exports.LlmProfileFieldSchema = LlmProfileFieldSchema;
 exports.LlmProfileKindDescriptorSchema = LlmProfileKindDescriptorSchema;
 exports.LlmProfileKindSchema = LlmProfileKindSchema;
 exports.LlmProfileSchema = LlmProfileSchema;
+exports.LlmProviderConfigSchema = LlmProviderConfigSchema;
+exports.LlmProviderWidgetSchema = LlmProviderWidgetSchema;
 exports.LlmRefusalSourceSchema = LlmRefusalSourceSchema;
 exports.LlmRetryPolicySchema = LlmRetryPolicySchema;
 exports.LlmRuntimeAppleCompleteInputSchema = LlmRuntimeAppleCompleteInputSchema;
@@ -103832,6 +104496,10 @@ exports.LogChannelWindowSchema = LogChannelWindowSchema;
 exports.LogChannelWindowStateSchema = LogChannelWindowStateSchema;
 exports.LogEntrySchema = LogEntrySchema;
 exports.LogLevelSchema = LogLevelSchema;
+exports.LogReadCapabilitiesSchema = LogReadCapabilitiesSchema;
+exports.LogReadEntrySchema = LogReadEntrySchema;
+exports.LogReadQuerySchema = LogReadQuerySchema;
+exports.LogReadResultSchema = LogReadResultSchema;
 exports.LogStreamEntrySchema = LogStreamEntrySchema;
 exports.LoggingEffectiveSchema = LoggingEffectiveSchema;
 exports.LoggingExplicitSchema = LoggingExplicitSchema;
@@ -104013,6 +104681,7 @@ exports.NC_GROUPING_MIN_SEC = NC_GROUPING_MIN_SEC;
 exports.NC_HISTORY_LIMIT_DEFAULT = NC_HISTORY_LIMIT_DEFAULT;
 exports.NC_HISTORY_LIMIT_MAX = NC_HISTORY_LIMIT_MAX;
 exports.NC_MAX_PER_TRACK_IMMEDIATE = NC_MAX_PER_TRACK_IMMEDIATE;
+exports.NC_MEDIA_IMAGE_MODES = NC_MEDIA_IMAGE_MODES;
 exports.NC_OCCUPANCY_DEFAULTS = NC_OCCUPANCY_DEFAULTS;
 exports.NC_RULE_CLEARABLE_KEYS = NC_RULE_CLEARABLE_KEYS;
 exports.NC_RULE_EDITOR_SECTION_ORDER = NC_RULE_EDITOR_SECTION_ORDER;
@@ -104111,6 +104780,7 @@ exports.NcHookBindingsSchema = NcHookBindingsSchema;
 exports.NcLegacyRuleActionSequenceSchema = NcLegacyRuleActionSequenceSchema;
 exports.NcLinkedCameraModeSchema = NcLinkedCameraModeSchema;
 exports.NcMediaFrameSchema = NcMediaFrameSchema;
+exports.NcMediaImageSchema = NcMediaImageSchema;
 exports.NcMediaPolicySchema = NcMediaPolicySchema;
 exports.NcOccupancyConditionSchema = NcOccupancyConditionSchema;
 exports.NcPlateMatcherSchema = NcPlateMatcherSchema;
@@ -104261,6 +104931,11 @@ exports.PIPELINE_ANALYTICS_CAP_NAME = PIPELINE_ANALYTICS_CAP_NAME;
 exports.PIPELINE_FLOW_CAPABILITY_NAMES = PIPELINE_FLOW_CAPABILITY_NAMES;
 exports.PIPELINE_OWNER_CAPABILITY_NAMES = PIPELINE_OWNER_CAPABILITY_NAMES;
 exports.PIPELINE_RAMP = PIPELINE_RAMP;
+exports.PREFERENCES_MAX_DEVICE_ID_LENGTH = PREFERENCES_MAX_DEVICE_ID_LENGTH;
+exports.PREFERENCES_MAX_NAMESPACES = PREFERENCES_MAX_NAMESPACES;
+exports.PREFERENCES_MAX_VALUE_BYTES = PREFERENCES_MAX_VALUE_BYTES;
+exports.PREFERENCES_NAMESPACE_PATTERN = PREFERENCES_NAMESPACE_PATTERN;
+exports.PREFERENCES_SELF_SCOPE = PREFERENCES_SELF_SCOPE;
 exports.PRIVACY_MASK_CAP_NAME = PRIVACY_MASK_CAP_NAME;
 exports.PROVIDER_KIND_CAP_NAMES = PROVIDER_KIND_CAP_NAMES;
 exports.PROVIDER_PIN_FIELD = require_sleep.PROVIDER_PIN_FIELD;
@@ -104300,6 +104975,19 @@ exports.PlaintextSecretError = require_sleep.PlaintextSecretError;
 exports.PolygonPointSchema = PolygonPointSchema;
 exports.PoolMemoryWatchdog = PoolMemoryWatchdog;
 exports.PowerMeterStatusSchema = PowerMeterStatusSchema;
+exports.PreferenceDeviceIdSchema = PreferenceDeviceIdSchema;
+exports.PreferenceNamespaceSchema = PreferenceNamespaceSchema;
+exports.PreferenceRowSchema = PreferenceRowSchema;
+exports.PreferenceValueSchema = PreferenceValueSchema;
+exports.PreferencesChangedSinceInputSchema = PreferencesChangedSinceInputSchema;
+exports.PreferencesChangedSinceOutputSchema = PreferencesChangedSinceOutputSchema;
+exports.PreferencesDeleteInputSchema = PreferencesDeleteInputSchema;
+exports.PreferencesDeleteOutputSchema = PreferencesDeleteOutputSchema;
+exports.PreferencesGetInputSchema = PreferencesGetInputSchema;
+exports.PreferencesGetOutputSchema = PreferencesGetOutputSchema;
+exports.PreferencesPutInputSchema = PreferencesPutInputSchema;
+exports.PreferencesPutOutputSchema = PreferencesPutOutputSchema;
+exports.PreferencesSelfScopeSchema = PreferencesSelfScopeSchema;
 exports.PresenceStatusSchema = PresenceStatusSchema;
 exports.PressureSensorStatusSchema = PressureSensorStatusSchema;
 exports.PrivacyMaskOptionsSchema = PrivacyMaskOptionsSchema;
@@ -104582,7 +105270,6 @@ exports.SceneUnavailableSchema = SceneUnavailableSchema;
 exports.SceneUncoveredPolicySchema = SceneUncoveredPolicySchema;
 exports.SceneVerdictSchema = SceneVerdictSchema;
 exports.ScopedTokenSchema = ScopedTokenSchema;
-exports.ScopedTokenSummarySchema = ScopedTokenSummarySchema;
 exports.ScoredObjectEventSchema = ScoredObjectEventSchema;
 exports.ScriptRunnerStatusSchema = ScriptRunnerStatusSchema;
 exports.SearchResultSchema = SearchResultSchema;
@@ -104868,6 +105555,8 @@ exports.ZoneScopeBreakdownSchema = ZoneScopeBreakdownSchema;
 exports.__resetLogChannelRegistryForTests = __resetLogChannelRegistryForTests;
 exports.acceleratorKindOf = acceleratorKindOf;
 exports.accessoriesCapability = accessoriesCapability;
+exports.accessoryChildrenComplete = accessoryChildrenComplete;
+exports.accessoryChildrenUnknown = accessoryChildrenUnknown;
 exports.accessoryStableId = accessoryStableId;
 exports.actionsForBoundCaps = actionsForBoundCaps;
 exports.actionsForDevice = actionsForDevice;
@@ -105238,6 +105927,7 @@ exports.iconCategoryLabel = iconCategoryLabel;
 exports.iconEntry = iconEntry;
 exports.iconsInCategory = iconsInCategory;
 exports.imageCapability = imageCapability;
+exports.imageModesForKind = imageModesForKind;
 exports.imageSettingsCapability = imageSettingsCapability;
 exports.inferExpressionKinds = inferExpressionKinds;
 exports.inferModelProvider = inferModelProvider;
@@ -105265,6 +105955,7 @@ exports.isBaseConditionKey = isBaseConditionKey;
 exports.isBatteryPresenceFault = isBatteryPresenceFault;
 exports.isClusterScopedStep = isClusterScopedStep;
 exports.isCollectionArrayMethod = isCollectionArrayMethod;
+exports.isCredentialTokenPayload = isCredentialTokenPayload;
 exports.isDefaultAlarmProfileId = isDefaultAlarmProfileId;
 exports.isDefaultAppConnectionEndpoint = isDefaultAppConnectionEndpoint;
 exports.isDefinitiveDeviceRefusal = isDefinitiveDeviceRefusal;
@@ -105329,6 +106020,7 @@ exports.knownSecretCount = require_sleep.knownSecretCount;
 exports.knownValues = knownValues;
 exports.lawnMowerControlCapability = lawnMowerControlCapability;
 exports.legacyAutoLinkIds = legacyAutoLinkIds;
+exports.legacyImageMode = legacyImageMode;
 exports.legacyModeOf = legacyModeOf;
 exports.lifecycleJobSchema = lifecycleJobSchema;
 exports.lifecycleJobScopeSchema = lifecycleJobScopeSchema;
@@ -105391,6 +106083,7 @@ exports.mqttBrokerCapability = mqttBrokerCapability;
 exports.nativeObjectDetectionCapability = nativeObjectDetectionCapability;
 exports.navigationCapability = navigationCapability;
 exports.ncAlarmSystemDefaultSettings = ncAlarmSystemDefaultSettings;
+exports.ncMediaPolicyError = ncMediaPolicyError;
 exports.networkAccessCapability = networkAccessCapability;
 exports.networkLinkCapability = networkLinkCapability;
 exports.networkQualityCapability = networkQualityCapability;
@@ -105402,6 +106095,7 @@ exports.nodesCapability = nodesCapability;
 exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
 exports.normalizeAudioLabel = normalizeAudioLabel;
 exports.normalizeCoreBlockWrite = normalizeCoreBlockWrite;
+exports.normalizeNcMediaPolicy = normalizeNcMediaPolicy;
 exports.normalizeNodeId = require_sleep.normalizeNodeId;
 exports.normalizeOrigin = normalizeOrigin;
 exports.normalizeSecretOwner = require_sleep.normalizeSecretOwner;
@@ -105559,6 +106253,7 @@ exports.resolveModeDelays = resolveModeDelays;
 exports.resolveModeNotifyPolicy = resolveModeNotifyPolicy;
 exports.resolveModelBoundSetting = resolveModelBoundSetting;
 exports.resolveMutate = resolveMutate;
+exports.resolveNcMediaImage = resolveNcMediaImage;
 exports.resolveNotificationTapAddress = resolveNotificationTapAddress;
 exports.resolvePoolMemoryPolicy = resolvePoolMemoryPolicy;
 exports.resolvePublicEndpoint = resolvePublicEndpoint;
@@ -105592,6 +106287,7 @@ exports.ruleMatchesSection = ruleMatchesSection;
 exports.ruleSection = ruleSection;
 exports.ruleSectionOf = ruleSectionOf;
 exports.ruleSeedForSection = ruleSeedForSection;
+exports.ruleTriggerZoneIds = ruleTriggerZoneIds;
 exports.runInferenceStep = runInferenceStep;
 exports.runtimeDevices = runtimeDevices;
 exports.runtimeStatePolicyFor = runtimeStatePolicyFor;
@@ -105604,6 +106300,7 @@ exports.scopeKey = require_sleep.scopeKey;
 exports.scopesAllowAddon = scopesAllowAddon;
 exports.scopesAllowAddonRoutes = scopesAllowAddonRoutes;
 exports.scopesAllowDeviceCap = scopesAllowDeviceCap;
+exports.scopesAllowOwnPreferences = scopesAllowOwnPreferences;
 exports.scopesGrantAdmin = scopesGrantAdmin;
 exports.scoreRuntimes = scoreRuntimes;
 exports.scriptRunnerCapability = scriptRunnerCapability;