@camstack/types 1.2.68 → 1.2.70

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-DxZbWydC.js");
-const require_sleep = require("./sleep-Dh1EJSqF.js");
+const require_sleep = require("./sleep-YuacOD41.js");
 const require_canonical_hash = require("./canonical-hash-DNV8S5ET.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
@@ -12068,7 +12068,16 @@ var NcScheduleSchema = zod.z.object({
 });
 /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
 var NcPlateMatcherSchema = zod.z.object({
-	values: zod.z.array(zod.z.string().min(1)).min(1),
+	/**
+	* Plate texts (or gallery vehicle names) to match. EMPTY = **any plate the
+	* pipeline could read** — the plate half of "no selection = no narrowing",
+	* and the switch that says this rule is about vehicles that were IDENTIFIED
+	* rather than merely seen. A subject carrying no plate still fails.
+	*
+	* The `.min(1)` this used to carry made that state unauthorable; nothing has
+	* ever persisted an empty list, so widening it cannot change an existing rule.
+	*/
+	values: zod.z.array(zod.z.string().min(1)),
 	/** Max Levenshtein distance after normalization (uppercase alphanumeric). */
 	maxDistance: zod.z.number().int().min(0).max(3).default(1)
 });
@@ -12330,18 +12339,47 @@ var NcConditionsSchema = zod.z.object({
 	*/
 	labelEquals: zod.z.array(zod.z.string().min(1)).optional(),
 	/**
-	* Identity matcher. P1 boundary: matched against the record's collapsed
-	* `label` (the identity display name propagated by the face pipeline) —
-	* identity-ID matching rides in P2 when identity ids reach the record.
+	* KNOWN FACES — the rule's identity scope, and the switch that says the rule
+	* is about recognised people at all.
+	*
+	* Three states, and the empty one is the point:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the rule does not care who it is; an unrecognised person matches |
+	* | `[]` | **only known faces** — any identity in the gallery, nobody in particular |
+	* | a list | only these identities |
+	*
+	* `[]` is the repo-wide "no selection = no narrowing" reading (an absent
+	* `devices` list is every device), applied one level down: the operator has
+	* turned the face scope ON and narrowed it to nothing, which is every known
+	* face. No second field states the same thing — a switch that can disagree
+	* with the list under it is worse than no switch (D62).
+	*
+	* MEMBERS ARE FACE-GALLERY `Identity.id`s (uuid), not display names. A name is
+	* renameable, and a rule authored on "Gianluca" went silently dark the moment
+	* the operator fixed the spelling. The id reaches the record on
+	* `LabelAttribution.identityId`; the name is what the editor shows and what
+	* `{{label}}` renders.
+	*
+	* Rules written before this carry NAMES, and are resolved to ids lazily at
+	* load (`NcRuleStore.load`) against the live gallery — a name nothing answers
+	* for is left as it stands and reported, never dropped. The engine also
+	* accepts a display-name hit as a compatibility leg, so a rule whose
+	* migration could not resolve keeps matching exactly what it matched before.
 	*/
 	identities: zod.z.array(zod.z.string().min(1)).optional(),
-	/** Fuzzy plate matcher against the record's `label` (plate text). */
+	/**
+	* KNOWN PLATES / VEHICLES — the plate mirror of {@link identities}, including
+	* the empty-list reading: `values: []` is "any plate the OCR could read",
+	* a non-empty list is those plates (fuzzily). See {@link NcPlateMatcherSchema}.
+	*/
 	plates: NcPlateMatcherSchema.optional(),
 	/**
-	* Identity EXCLUDE — mirror of {@link identities} with `notIn` semantics.
-	* Same P1 boundary: matched against the record's collapsed `label` (the
-	* identity display name). A record with NO label passes (nothing to
-	* exclude), unlike the include variant which fails on an absent label.
+	* Identity EXCLUDE — mirror of {@link identities} with `notIn` semantics, and
+	* the same id members and the same lazy name→id migration. A record with NO
+	* identity passes (nothing to exclude), unlike the include variant which
+	* fails on an unrecognised subject. An EMPTY list excludes nobody.
 	*/
 	identitiesExclude: zod.z.array(zod.z.string().min(1)).optional(),
 	/**
@@ -12734,7 +12772,37 @@ var NcRuleInputSchema = zod.z.object({
 	* a rule that predates the gate must keep delivering byte-for-byte as it
 	* did, and absent is the only way to say that without a migration.
 	*/
-	confirm: NcConfirmSchema.optional()
+	confirm: NcConfirmSchema.optional(),
+	/**
+	* WAIT for face/plate recognition before saying anything.
+	*
+	* A notification's TEXT is frozen at enqueue and its media is re-resolved at
+	* send; the identity is neither. A face is confirmed after `confirmFrames`
+	* agreeing observations — p50 **11.4 s** after the track was first seen,
+	* measured on this hub — and an `immediate` rule enqueues on the first object
+	* event, seconds before that. So "Gianluca è arrivato" is unsayable on the
+	* immediate path, and no amount of media re-resolution fixes a sentence.
+	*
+	* Only two honest answers exist, and this flag picks between them. It has
+	* effect ONLY on a rule that declares a recognition scope
+	* ({@link NcConditions.identities} or {@link NcConditions.plates}) — on any
+	* other rule there is nothing to wait for and the flag is inert.
+	*
+	* | value | what happens |
+	* | --- | --- |
+	* | `true` | the rule stops firing on the object event and fires at TRACK CLOSE instead, once, with the name — later, and complete |
+	* | absent / `false` | it fires at once WITHOUT the name, and if recognition lands before the track closes a SECOND, "…is Gianluca" notification follows (one per track, per rule, per target) |
+	*
+	* `.optional()` and deliberately NOT `.default()`: a Zod default does not run
+	* on the addon cap path, and absent has to keep meaning exactly what every
+	* rule authored before this field meant.
+	*
+	* The cost of `true` is stated here because the editor states it too: a rule
+	* that waits also inherits track-close SEMANTICS — its `zones` condition
+	* tests every zone the track visited and a `crossing` condition can no longer
+	* be satisfied, because a closed track carries no crossing.
+	*/
+	waitForEnhancement: zod.z.boolean().optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -13078,32 +13146,32 @@ var NC_CONDITION_CATALOG = [
 	{
 		id: "identities",
 		group: "label",
-		label: "Identities",
+		label: "Known faces",
 		valueType: "stringList",
 		operator: "in",
 		appliesTo: ["immediate", "track-end"],
 		phase: "P1",
-		description: "P1: matched against the identity display name on the record label."
+		description: "Only recognised people. Selecting NOBODY means every identity in the face gallery; selecting some narrows to those. Matched on the gallery id, so renaming a person does not break the rule. On immediate delivery the name is not known yet when the notification is enqueued — see the rule’s \"wait for recognition\" switch."
 	},
 	{
 		id: "plates",
 		group: "label",
-		label: "License plates",
+		label: "Known plates",
 		valueType: "plateMatcher",
 		operator: "fuzzyIn",
 		appliesTo: ["immediate", "track-end"],
 		phase: "P1",
-		description: "Levenshtein-tolerant match against the plate text."
+		description: "Only vehicles whose plate was read. Selecting NO plate means any readable plate; listed plates are matched Levenshtein-tolerantly, because OCR noise makes an exact match useless."
 	},
 	{
 		id: "identitiesExclude",
 		group: "label",
-		label: "Excluded identities",
+		label: "Excluded faces",
 		valueType: "stringList",
 		operator: "notIn",
 		appliesTo: ["immediate", "track-end"],
 		phase: "P1",
-		description: "Veto by identity display name (mirror of Identities; absent label passes)."
+		description: "Veto by identity (mirror of Known faces, same gallery ids). A subject nobody recognised passes — there is nothing to exclude."
 	},
 	{
 		id: "minLabelConfidence",
@@ -13758,7 +13826,87 @@ var MethodAccessSchema = zod.z.enum([
 var AllowedProviderSchema = zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]);
 var AllowedDevicesSchema = zod.z.record(zod.z.string(), zod.z.union([zod.z.literal("*"), zod.z.array(zod.z.string())]));
 var CapScopeSchema = zod.z.enum(["device", "system"]);
-var TokenScopeSchema = zod.z.discriminatedUnion("type", [
+/**
+* DeviceSelector (scope model v3 — 2026-08-12).
+*
+* A `device` grant no longer carries a frozen list of deviceIds. It carries
+* a SELECTOR the matcher resolves against the live fleet, so the grant can be
+* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
+* AFTER the grant was minted — no re-grant, no re-login.
+*
+*   - `all`       — every device in the deployment. The broad viewer/operator
+*     lever without a `category` grant (a `category` grant also covers device
+*     caps that carry no deviceId; `all` is specifically the device set).
+*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
+*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
+*     is NOT covered until the grant is edited.
+*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
+*     DYNAMIC. A device that changes type, or a new device of the type,
+*     re-resolves on the next request.
+*   - `locations` — every device whose operator-assigned `location` label is
+*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
+*     null/unset location matches NO `locations` selector.
+*/
+var DeviceSelectorSchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({ kind: zod.z.literal("all") }),
+	zod.z.object({
+		kind: zod.z.literal("ids"),
+		ids: zod.z.array(zod.z.number().int()).min(1)
+	}),
+	zod.z.object({
+		kind: zod.z.literal("types"),
+		types: zod.z.array(zod.z.enum(require_sleep.DeviceType)).min(1)
+	}),
+	zod.z.object({
+		kind: zod.z.literal("locations"),
+		locations: zod.z.array(zod.z.string().min(1)).min(1)
+	})
+]);
+var DeviceTokenScopeSchema = zod.z.object({
+	type: zod.z.literal("device"),
+	/** The device SET this grant covers — resolved against the live fleet. */
+	selector: DeviceSelectorSchema,
+	access: zod.z.array(MethodAccessSchema).min(1),
+	/**
+	* Whether a grant on a PARENT device transparently covers its accessory
+	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
+	* Direction is parent → children ONLY.
+	*
+	* Absent → the matcher DERIVES it from the access flavour: `view`
+	* inherits (a camera viewer sees the camera's accessories), `create` /
+	* `delete` do NOT (actuating/removing a child is an explicit act the
+	* operator must grant on the child, not inherit from the parent). Set it
+	* explicitly to override that default per grant.
+	*/
+	includeLinked: zod.z.boolean().optional()
+});
+/**
+* v2 → v3 lazy migration. A pre-v3 `device` grant carried
+* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
+* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
+* EVERY parse path — stored records AND the JWT-carried scope arrays
+* normalised at the request boundary ({@link normalizeTokenScopes} in
+* `device-selector.ts`). Chosen over a one-time DB migration because a
+* migration cannot reach a JWT already in a client's hands; parse-time
+* migration covers both without a flag day. No cast — the raw object is read
+* through `Reflect.get` (its static type is `unknown`).
+*/
+function migrateLegacyTokenScope(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
+	if (Reflect.get(raw, "type") !== "device") return raw;
+	if (Reflect.get(raw, "selector") !== void 0) return raw;
+	const targets = Reflect.get(raw, "targets");
+	if (!Array.isArray(targets)) return raw;
+	return {
+		type: "device",
+		selector: {
+			kind: "ids",
+			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
+		},
+		access: Reflect.get(raw, "access")
+	};
+}
+var TokenScopeSchema = zod.z.preprocess(migrateLegacyTokenScope, zod.z.discriminatedUnion("type", [
 	zod.z.object({
 		type: zod.z.literal("category"),
 		target: CapScopeSchema,
@@ -13774,18 +13922,8 @@ var TokenScopeSchema = zod.z.discriminatedUnion("type", [
 		target: zod.z.string(),
 		access: zod.z.array(MethodAccessSchema).min(1)
 	}),
-	zod.z.object({
-		type: zod.z.literal("device"),
-		/**
-		* One or more deviceIds (serialised as strings for wire-format
-		* consistency with the rest of the union). Matcher accepts if
-		* `input.deviceId` ∈ `targets`. Array shape avoids the row-explosion
-		* of one scope-per-device when granting access to a set of cameras.
-		*/
-		targets: zod.z.array(zod.z.string()).min(1),
-		access: zod.z.array(MethodAccessSchema).min(1)
-	})
-]);
+	DeviceTokenScopeSchema
+]));
 var UserRecordSchema = zod.z.object({
 	id: zod.z.string(),
 	username: zod.z.string(),
@@ -14264,7 +14402,21 @@ var LabelTierSchema = zod.z.union([zod.z.literal(1), zod.z.literal(2)]);
 var LabelAttributionSchema = zod.z.object({
 	stepId: zod.z.string(),
 	modelId: zod.z.string().optional(),
-	decidedAt: zod.z.number()
+	decidedAt: zod.z.number(),
+	/**
+	* The GALLERY id behind a recognised tier-2 label — a face-gallery
+	* `Identity.id` or a plate-gallery `Vehicle.id` (both `randomUUID`).
+	*
+	* The text alone is a DISPLAY NAME, and a display name is renameable: a
+	* notification rule authored on "Gianluca" stopped matching the moment the
+	* operator fixed the spelling in the gallery, and nothing said so. The id is
+	* the thing that does not move, so it is what a rule matches on
+	* (`NcConditions.identities`) and the text is what a human is shown.
+	*
+	* Absent when the label names no gallery row — a plate the OCR read but no
+	* vehicle claims, a sub-class, a species, any tier-1 value.
+	*/
+	identityId: zod.z.string().optional()
 });
 /**
 * The TIERED label model (roadmap 4g), spread into `TrackSchema` and
@@ -23387,7 +23539,41 @@ var intercomCapability = {
 	status: {
 		schema: IntercomStatusSchema,
 		kind: "command-driven"
-	}
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel.
+	*
+	* The cap declared `status` and nothing else, so the only two sources an
+	* exporter has for a value — the `device.state-changed` slice event and the
+	* `deviceState.getAllSnapshots` snapshot, both built from runtime state —
+	* carried nothing for `intercom`. A talk-back entity in Home Assistant would
+	* have been published and never received a value, which is the defect the
+	* export's two classification tables exist to prevent (177 of them, once), so
+	* `intercom` was excluded rather than exported.
+	*
+	* The shape is the status shape: there is exactly one truth about talk-back
+	* and duplicating it into a second schema is how two halves of one capability
+	* come to disagree. Providers write it through
+	* `this.runtimeState.setCapState('intercom', …)` at the four points that open
+	* and close a session, and seed it at registration so the slice exists before
+	* the first session rather than after it.
+	*
+	* **Bound, named rather than hidden:** `talking` mirrors the provider's own
+	* session handle, so a session torn down by a transport death that never
+	* reaches `stopSession` / `endTalkSession` leaves it latched until the next
+	* session or the next restart. That is why the slice is `session` and not
+	* `restored` — a restart must never restore "talking".
+	*/
+	runtimeState: IntercomStatusSchema,
+	/**
+	* Runtime-state durability: **session** — `talking` describes a live audio
+	* session, which by definition does not survive the process that held it.
+	* Restoring it would publish a camera as talking to nobody.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/lawn-mower-control.cap.ts
@@ -26651,7 +26837,7 @@ var recordingCapability = {
 			toMs: zod.z.number()
 		}), RecordingAvailabilitySchema, {
 			kind: "query",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Which calendar days in [fromMs,toMs) have ≥1 recorded segment, bucketed by
 		*  the client's local day (`tzOffsetMinutes` = minutes to add to UTC). Drives
@@ -26663,7 +26849,7 @@ var recordingCapability = {
 			tzOffsetMinutes: zod.z.number()
 		}), RecordingDaysSchema, {
 			kind: "query",
-			auth: "admin"
+			auth: "protected"
 		}),
 		getPlaybackManifest: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
@@ -26671,7 +26857,7 @@ var recordingCapability = {
 			toMs: zod.z.number()
 		}), RecordingManifestSchema, {
 			kind: "query",
-			auth: "admin"
+			auth: "protected"
 		}),
 		getStorageUsage: require_sleep.method(zod.z.object({}), RecordingStorageUsageSchema, {
 			kind: "query",
@@ -29648,6 +29834,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	humiditySensor: humiditySensorCapability,
 	image: imageCapability,
 	imageSettings: imageSettingsCapability,
+	intercom: intercomCapability,
 	lawnMowerControl: lawnMowerControlCapability,
 	lockControl: lockControlCapability,
 	mediaPlayer: mediaPlayerCapability,
@@ -38763,6 +38950,1808 @@ var SYSTEM_CAP_NAMES = [
 	"viewer-ui"
 ];
 //#endregion
+//#region src/generated/method-device-selectors.ts
+var METHOD_DEVICE_SELECTORS = Object.freeze({
+	"accessories.setChildHidden": [{
+		name: "childDeviceId",
+		form: "single",
+		optional: false
+	}, {
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"addonSettings.getDeviceSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"addonSettings.updateDeviceSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"alarmPanel.arm": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"alarmPanel.disarm": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"alarmPanel.trigger": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"audioAnalysis.resolveDeviceSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"audioAnalyzer.classify": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"audioMetrics.getCurrentSnapshot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"audioMetrics.getHistory": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"automationControl.disable": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"automationControl.enable": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"automationControl.trigger": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"battery.wakeForStream": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"brightness.setBrightness": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"button.press": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraCredentials.getCredentials": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraStreams.getBrokerStreams": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraStreams.getCameraStreams": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraStreams.getProfileRtspEntries": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraStreams.getRtspEntries": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraStreams.pickStream": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setFanMode": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setMode": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setPreset": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setSwingHorizontal": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setSwingVertical": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setTarget": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setTargetHumidity": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setTargetRange": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"color.setColor": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"consumables.reset": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"control.setValue": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cover.close": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cover.open": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cover.setPosition": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cover.setTiltPosition": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cover.stop": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dayNight.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dayNight.setSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"decoder.createSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"deviceAdoption.release": [{
+		name: "camDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceAdoption.resync": [{
+		name: "camDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceDiscovery.adoptDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceDiscovery.listDiscovered": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceDiscovery.refreshDiscovery": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceDiscovery.releaseDevice": [{
+		name: "childDeviceId",
+		form: "single",
+		optional: false
+	}, {
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.adoptionRelease": [{
+		name: "camDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.adoptionResync": [{
+		name: "camDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.applyInitialMeta": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}, {
+		name: "linkDeviceId",
+		form: "single",
+		optional: true
+	}],
+	"deviceManager.disable": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.enable": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getBindings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getChildren": [{
+		name: "parentDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getConfigSchema": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getDeviceAggregate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getDeviceLiveInfoAggregate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getDeviceSettingsAggregate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getDeviceStatusAggregate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getDeviceStatusAggregateBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"deviceManager.getLinkedDevices": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getSettingsSchema": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getStreamProfileMap": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getStreamSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getWireableFields": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.loadConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.loadMeta": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.loadRuntimeState": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.persistConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.probeStreams": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.registerDevice": [{
+		name: "parentDeviceId",
+		form: "single",
+		optional: true
+	}],
+	"deviceManager.remove": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.removeDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.runDeviceAction": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setChildLayout": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setDisabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setDisplay": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setIntegrationId": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setLinkDeviceId": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}, {
+		name: "linkDeviceId",
+		form: "single",
+		optional: true
+	}],
+	"deviceManager.setLocation": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setMetadata": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setName": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setPrimaryChildEntityId": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setRole": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setStreamProfileMap": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setType": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setWrapperActive": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.testField": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.updateConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.updateDeviceField": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.updateDeviceFieldsBatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.getConfigEntries": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.getRawState": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.getSettingsSchema": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.getStreamSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.removeDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.runAction": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.setConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceState.getCapSlice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceState.getSnapshot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceState.setCapSlice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"events.getEventClipUrl": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"events.getEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"events.getEventThumbnail": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"faceGallery.getFaceByTrack": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"faceGallery.listRecentFaces": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"fanControl.setDirection": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"fanControl.setOscillating": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"fanControl.setPercentage": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"fanControl.setPreset": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"humidifier.setMode": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"humidifier.setOn": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"humidifier.setTargetHumidity": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"imageSettings.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"imageSettings.setSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"intercom.endTalkSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"intercom.handleAnswer": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"intercom.pushTalkAudio": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"intercom.startSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"intercom.startTalkSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"intercom.stopSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"lawnMowerControl.dock": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"lawnMowerControl.pause": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"lawnMowerControl.startMowing": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"lockControl.lock": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"lockControl.open": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"lockControl.unlock": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.next": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.pause": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.play": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.playMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.previous": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.seek": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.selectSource": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.setMute": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.setRepeat": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.setShuffle": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.setVolume": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.stop": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motion.isDetected": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motionDetection.analyze": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motionDetection.removeCamera": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motionTrigger.setMotionTrigger": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motionZones.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motionZones.setZone": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"nativeObjectDetection.setEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"networkQuality.getDeviceStats": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"networkQuality.reportClientStats": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"notificationRules.setDeviceMuted": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"notifier.cancel": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"notifier.send": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osd.setOverlay": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.clearSlotBinding": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.copyDeviceConfiguration": [{
+		name: "sourceDeviceId",
+		form: "single",
+		optional: false
+	}, {
+		name: "targetDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.getDeviceOsd": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.getSourceCatalog": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.previewSlot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.renderDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.setSlotBinding": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.callPet": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.cancelFeed": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.feed": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.markFoodReplenished": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.playSound": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.resetDesiccant": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.setChildLock": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.setFeedSound": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.setIndicatorLight": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.setVolume": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.clearTracks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.completeRetrainTrack": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.deleteDeviceEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.deleteTracks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.deselectRetrainFrame": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getActiveTracks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getAudioEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getEventDensity": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getKeyEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getMotionEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getObjectEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getRetrainExportUrl": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
+	"pipelineAnalytics.getSensorEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getTrack": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getTrainingExportSummary": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
+	"pipelineAnalytics.getTrainingExportUrl": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
+	"pipelineAnalytics.listEventKinds": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.listEventKindsBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"pipelineAnalytics.listOpsLog": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"pipelineAnalytics.listRecentTracks": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"pipelineAnalytics.listRetrainStaging": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
+	"pipelineAnalytics.listTracks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.proposeRetrainAnnotations": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.pruneEventsBefore": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.pruneTracksBefore": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.rebuildObjectEmbeddings": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"pipelineAnalytics.restageRetrainTrack": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.saveRetrainAnnotations": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.searchObjectEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"pipelineAnalytics.selectRetrainFrames": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.setTrackFlags": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.wipeAllAnalytics": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineExecutor.runPipeline": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"pipelineExecutor.runPipelineBatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"pipelineOrchestrator.assignAudio": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.assignPipeline": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getAudioAssignment": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getCameraMetrics": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getCameraSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getCameraStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getCameraStatuses": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
+	"pipelineOrchestrator.getCameraStepOverrides": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getCameraSwitches": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getPipelineAssignment": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getPipelineDevicePin": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.resolvePipeline": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.setCameraPipelineForAgent": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.setCameraStepOverride": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.setCameraStepToggle": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.setCameraSwitch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.setPipelineDevicePin": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.unassignAudio": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.unassignPipeline": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineRunner.attachCamera": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineRunner.detachCamera": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineRunner.getCameraMetrics": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineRunner.reportMotion": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineRunner.runDetailSubtree": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineRunner.runStatelessStep": [{
+		name: "sourceDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"plateGallery.getPlateByTrack": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"plateGallery.listPlates": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"privacyMask.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"privacyMask.setAudioEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"privacyMask.setMask": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.continuousMove": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.deletePreset": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.getPosition": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.getPresets": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.goHome": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.goToPreset": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.move": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.savePreset": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.setAutofocus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.stop": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptzAutotrack.getSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptzAutotrack.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptzAutotrack.setEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptzAutotrack.setSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"reboot.reboot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.deleteFootprint": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.getAvailability": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.getDaysWithRecordings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.getDeviceConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.getPlaybackManifest": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.listOpsLog": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"recording.locateSegment": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.pruneFootage": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.readGopBytes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.readSegmentBytes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.relocateFootage": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"recording.renderClip": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.renderGif": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.rescanStorage": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.setDeviceConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.startStorageMigrationMove": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"recordingExport.createExport": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recordingExport.listExports": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"sceneMonitor.captureReference": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"sceneMonitor.createScene": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"sceneMonitor.deleteReference": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"sceneMonitor.deleteScene": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"sceneMonitor.listScenes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"sceneMonitor.recheckNow": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"sceneMonitor.updateScene": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"scriptRunner.run": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"scriptRunner.stop": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"snapshot.getSnapshot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"snapshot.getSnapshotOverview": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"snapshot.invalidateCache": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.acquireEgressTranscode": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.assignProfile": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.getDeviceAudioMute": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.getStreamWithCodec": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.produceEventMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.publishCameraStream": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.renderPreBufferClip": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.restartProfile": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.retractCameraStream": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.setDeviceAudioMute": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.unassignProfile": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamCatalog.getCatalog": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamParams.getConfigSchema": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamParams.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamParams.setProfile": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"switch.setState": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"vacuumControl.locate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"vacuumControl.pause": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"vacuumControl.returnToBase": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"vacuumControl.setFanSpeed": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"vacuumControl.start": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"vacuumControl.stop": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"valve.close": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"valve.open": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"valve.setPosition": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"valve.stop": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"videoclips.getClipPlayback": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"videoclips.listClips": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"waterHeater.setAway": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"waterHeater.setOperationMode": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"waterHeater.setTargetTemp": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.addIceCandidate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.closeSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.createSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.getIceCandidates": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.getSessionState": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.handleAnswer": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.handleOffer": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.hasAdaptiveBitrate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.listStreams": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zoneAnalytics.getCameraHistory": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zoneAnalytics.getCurrentSnapshot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zoneAnalytics.getUnzonedHistory": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zoneAnalytics.getZoneHistory": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zoneRules.listRules": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zoneRules.setRules": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zones.addZone": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zones.listZones": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zones.removeZone": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zones.updateZone": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}]
+});
+/** Cap-method paths that carry a device reference AND live on a system-scope
+*  cap — the set the v3 device check newly reaches. */
+var SYSTEM_SCOPE_DEVICE_METHODS = [
+	"addonSettings.getDeviceSettings",
+	"addonSettings.updateDeviceSettings",
+	"audioAnalyzer.classify",
+	"decoder.createSession",
+	"deviceAdoption.release",
+	"deviceAdoption.resync",
+	"deviceManager.adoptionRelease",
+	"deviceManager.adoptionResync",
+	"deviceManager.applyInitialMeta",
+	"deviceManager.disable",
+	"deviceManager.enable",
+	"deviceManager.getBindings",
+	"deviceManager.getChildren",
+	"deviceManager.getConfigSchema",
+	"deviceManager.getDevice",
+	"deviceManager.getDeviceAggregate",
+	"deviceManager.getDeviceLiveInfoAggregate",
+	"deviceManager.getDeviceSettingsAggregate",
+	"deviceManager.getDeviceStatusAggregate",
+	"deviceManager.getDeviceStatusAggregateBatch",
+	"deviceManager.getLinkedDevices",
+	"deviceManager.getSettingsSchema",
+	"deviceManager.getStreamProfileMap",
+	"deviceManager.getStreamSources",
+	"deviceManager.getWireableFields",
+	"deviceManager.loadConfig",
+	"deviceManager.loadMeta",
+	"deviceManager.loadRuntimeState",
+	"deviceManager.persistConfig",
+	"deviceManager.probeStreams",
+	"deviceManager.registerDevice",
+	"deviceManager.remove",
+	"deviceManager.removeDevice",
+	"deviceManager.runDeviceAction",
+	"deviceManager.setChildLayout",
+	"deviceManager.setDisabled",
+	"deviceManager.setDisplay",
+	"deviceManager.setIntegrationId",
+	"deviceManager.setLinkDeviceId",
+	"deviceManager.setLocation",
+	"deviceManager.setMetadata",
+	"deviceManager.setName",
+	"deviceManager.setPrimaryChildEntityId",
+	"deviceManager.setRole",
+	"deviceManager.setStreamProfileMap",
+	"deviceManager.setType",
+	"deviceManager.setWrapperActive",
+	"deviceManager.testField",
+	"deviceManager.updateConfig",
+	"deviceManager.updateDeviceField",
+	"deviceManager.updateDeviceFieldsBatch",
+	"deviceState.getCapSlice",
+	"deviceState.getSnapshot",
+	"deviceState.setCapSlice",
+	"faceGallery.getFaceByTrack",
+	"faceGallery.listRecentFaces",
+	"networkQuality.getDeviceStats",
+	"networkQuality.reportClientStats",
+	"notificationRules.setDeviceMuted",
+	"osdManager.clearSlotBinding",
+	"osdManager.copyDeviceConfiguration",
+	"osdManager.getDeviceOsd",
+	"osdManager.getSourceCatalog",
+	"osdManager.previewSlot",
+	"osdManager.renderDevice",
+	"osdManager.setSlotBinding",
+	"pipelineExecutor.runPipeline",
+	"pipelineExecutor.runPipelineBatch",
+	"pipelineOrchestrator.assignAudio",
+	"pipelineOrchestrator.assignPipeline",
+	"pipelineOrchestrator.getAudioAssignment",
+	"pipelineOrchestrator.getCameraMetrics",
+	"pipelineOrchestrator.getCameraSettings",
+	"pipelineOrchestrator.getCameraStatus",
+	"pipelineOrchestrator.getCameraStatuses",
+	"pipelineOrchestrator.getCameraStepOverrides",
+	"pipelineOrchestrator.getCameraSwitches",
+	"pipelineOrchestrator.getPipelineAssignment",
+	"pipelineOrchestrator.getPipelineDevicePin",
+	"pipelineOrchestrator.resolvePipeline",
+	"pipelineOrchestrator.setCameraPipelineForAgent",
+	"pipelineOrchestrator.setCameraStepOverride",
+	"pipelineOrchestrator.setCameraStepToggle",
+	"pipelineOrchestrator.setCameraSwitch",
+	"pipelineOrchestrator.setPipelineDevicePin",
+	"pipelineOrchestrator.unassignAudio",
+	"pipelineOrchestrator.unassignPipeline",
+	"pipelineRunner.attachCamera",
+	"pipelineRunner.detachCamera",
+	"pipelineRunner.getCameraMetrics",
+	"pipelineRunner.reportMotion",
+	"pipelineRunner.runDetailSubtree",
+	"pipelineRunner.runStatelessStep",
+	"plateGallery.getPlateByTrack",
+	"plateGallery.listPlates",
+	"recording.deleteFootprint",
+	"recording.getAvailability",
+	"recording.getDaysWithRecordings",
+	"recording.getDeviceConfig",
+	"recording.getPlaybackManifest",
+	"recording.listOpsLog",
+	"recording.locateSegment",
+	"recording.pruneFootage",
+	"recording.readGopBytes",
+	"recording.readSegmentBytes",
+	"recording.relocateFootage",
+	"recording.renderClip",
+	"recording.renderGif",
+	"recording.rescanStorage",
+	"recording.setDeviceConfig",
+	"recording.startStorageMigrationMove",
+	"recordingExport.createExport",
+	"recordingExport.listExports",
+	"streamBroker.acquireEgressTranscode",
+	"streamBroker.assignProfile",
+	"streamBroker.getDeviceAudioMute",
+	"streamBroker.getStreamWithCodec",
+	"streamBroker.produceEventMedia",
+	"streamBroker.publishCameraStream",
+	"streamBroker.renderPreBufferClip",
+	"streamBroker.restartProfile",
+	"streamBroker.retractCameraStream",
+	"streamBroker.setDeviceAudioMute",
+	"streamBroker.unassignProfile"
+];
+//#endregion
 //#region src/generated/provider-kind-map.ts
 var CAP_PROVIDER_KIND_MAP = Object.freeze({
 	"broker": "broker",
@@ -38796,7 +40785,7 @@ function getCapsByProviderKind(kind) {
 //#region src/generated/runtime-state-durability.ts
 /**
 * Per-cap runtime-state policy, projected from every `*.cap.ts` that declares
-* `runtimeState`. 62 caps: 33 `restored`, 29 `session`.
+* `runtimeState`. 63 caps: 33 `restored`, 30 `session`.
 *
 * A cap absent from this map has no runtime-state slice at all. A cap PRESENT
 * with `durability: 'session'` has one and has decided not to keep it.
@@ -38926,6 +40915,10 @@ var RUNTIME_STATE_POLICY = {
 		durability: "restored",
 		volatileFields: ["lastFetchedAt"]
 	},
+	"intercom": {
+		durability: "session",
+		volatileFields: []
+	},
 	"lawn-mower-control": {
 		durability: "session",
 		volatileFields: []
@@ -39112,7 +41105,7 @@ var SCOPE_PRESETS = [
 	{
 		id: "camera-viewer",
 		label: "Camera viewer",
-		description: "Read-only over every device — live streams, recordings, motion events, battery state. Combine with `allowedDevices` to restrict to specific cameras.",
+		description: "Read-only over every device — live streams, recordings, motion events, battery state. Pair with a `device` grant (an `ids` / `types` / `locations` selector) to restrict to specific cameras.",
 		rows: [{
 			type: "category",
 			target: "device",
@@ -39129,6 +41122,28 @@ var SCOPE_PRESETS = [
 			access: ["view", "create"]
 		}]
 	},
+	{
+		id: "full-management",
+		label: "Full management",
+		description: "Complete device + system control short of admin: view/create/delete on every device and every system capability. Use for a trusted operator who manages the whole deployment but should not hold the admin bypass.",
+		rows: [{
+			type: "category",
+			target: "device",
+			access: [
+				"view",
+				"create",
+				"delete"
+			]
+		}, {
+			type: "category",
+			target: "system",
+			access: [
+				"view",
+				"create",
+				"delete"
+			]
+		}]
+	},
 	{
 		id: "cli-deployer",
 		label: "CLI deployer",
@@ -41125,6 +43140,252 @@ function pickNativeLeaseOverride(view) {
 	return readNativeLeaseOverride(flat);
 }
 //#endregion
+//#region src/schemas/access-roles.ts
+/**
+* Ordered widest-last — the panel renders them top to bottom and the operator
+* reads the list as an escalation.
+*/
+var ACCESS_ROLES = [
+	{
+		id: "viewer",
+		label: "View",
+		description: "Watch live and recorded video, browse events and read device state. Cannot change anything.",
+		deviceAccess: ["view"],
+		systemAccess: ["view"]
+	},
+	{
+		id: "operator",
+		label: "Operate",
+		description: "Everything View does, plus acting on a device: PTZ, lights, sirens, locks, and snoozing notifications. Cannot delete.",
+		deviceAccess: ["view", "create"],
+		systemAccess: ["view", "create"]
+	},
+	{
+		id: "manager",
+		label: "Full management",
+		description: "Everything Operate does, plus deleting devices, recordings and events. Short of admin — no user or cluster administration.",
+		deviceAccess: [
+			"view",
+			"create",
+			"delete"
+		],
+		systemAccess: [
+			"view",
+			"create",
+			"delete"
+		]
+	}
+];
+/** Look a role up by id. Throws on an unknown id — the union makes that
+*  unreachable from typed callers, and a silent fallback would grant the
+*  wrong thing. */
+function roleSpec(id) {
+	const found = ACCESS_ROLES.find((r) => r.id === id);
+	if (!found) throw new Error(`Unknown access role '${id}'`);
+	return found;
+}
+/**
+* Compose an assignment into the grants the matcher reads.
+*
+* `includeLinked` is written explicitly in BOTH directions on purpose. Absent,
+* the matcher derives it from the access flavour (`view` inherits, `create` /
+* `delete` do not), so an omitted `false` would silently re-grant the
+* accessories the operator just excluded, and the panel would be lying about
+* its own toggle.
+*/
+function buildRoleScopes(assignment) {
+	const spec = roleSpec(assignment.roleId);
+	return [{
+		type: "device",
+		selector: assignment.selector,
+		access: [...spec.deviceAccess],
+		includeLinked: assignment.includeLinked
+	}, {
+		type: "category",
+		target: "system",
+		access: [...spec.systemAccess]
+	}];
+}
+/** Set equality over access arrays — grants round-trip through JSON and Zod
+*  with no order guarantee. */
+function sameAccess(a, b) {
+	if (a.length !== b.length) return false;
+	const set = new Set(a);
+	return b.every((x) => set.has(x));
+}
+/**
+* Recover the assignment behind a grant set, or `null` when the grants are
+* not something this panel authored.
+*
+* `null` is not an error — it is the "Advanced" case, and the panel MUST show
+* it as such rather than defaulting the radio to a role the user does not
+* have. Silently rendering an unrecognised grant set as "View" would make the
+* next save a downgrade nobody asked for.
+*
+* Strict by design: exactly the two rows `buildRoleScopes` writes, an
+* explicit `includeLinked`, and device/system access that agree on a single
+* role. Anything else belongs in the raw editor.
+*/
+function detectAccessRole(scopes) {
+	if (scopes.length !== 2) return null;
+	const deviceRows = scopes.filter((s) => s.type === "device");
+	const systemRows = scopes.filter((s) => s.type === "category" && s.target === "system");
+	if (deviceRows.length !== 1 || systemRows.length !== 1) return null;
+	const [deviceRow] = deviceRows;
+	const [systemRow] = systemRows;
+	if (deviceRow === void 0 || systemRow === void 0) return null;
+	if (deviceRow.type !== "device") return null;
+	if (deviceRow.includeLinked === void 0) return null;
+	const spec = ACCESS_ROLES.find((r) => sameAccess(r.deviceAccess, deviceRow.access) && sameAccess(r.systemAccess, systemRow.access));
+	if (!spec) return null;
+	return {
+		roleId: spec.id,
+		selector: deviceRow.selector,
+		includeLinked: deviceRow.includeLinked
+	};
+}
+//#endregion
+//#region src/schemas/device-selector.ts
+/** Ancestor-walk bound — defence-in-depth against a corrupt parentage cycle. */
+var MAX_ANCESTOR_HOPS = 8;
+/**
+* Does `selector` cover `device` DIRECTLY (no inheritance)? Inheritance is
+* layered on by the resolver/matcher, which tests this against a device's
+* ancestors too.
+*/
+function deviceSelectorMatches(selector, device) {
+	switch (selector.kind) {
+		case "all": return true;
+		case "ids": return selector.ids.includes(device.id);
+		case "types": return selector.types.some((t) => String(t) === device.type);
+		case "locations": return device.location !== null && selector.locations.includes(device.location);
+	}
+}
+/** Whether a `category:device` grant covers `access` (the broad lever). */
+function hasBroadDeviceGrant(scopes, access) {
+	return scopes.some((s) => s.type === "category" && s.target === "device" && s.access.includes(access));
+}
+/** The `device`-typed scopes granting `access`. */
+function deviceScopesFor(scopes, access) {
+	return scopes.filter((s) => s.type === "device" && s.access.includes(access));
+}
+/** Whether inheritance applies for a grant at `access` (view inherits, others
+*  don't, unless the grant overrides via `includeLinked`). */
+function scopeInherits(scope, access) {
+	return scope.includeLinked ?? access === "view";
+}
+/** Ancestors (parent, grandparent, …) of `deviceId` within a fleet map. */
+function ancestorsOf(deviceId, byId) {
+	const out = [];
+	let current = deviceId;
+	for (let hop = 0; hop < MAX_ANCESTOR_HOPS; hop++) {
+		const parent = current === null ? null : byId.get(current)?.parentDeviceId ?? null;
+		if (parent === null || parent === current) break;
+		out.push(parent);
+		current = parent;
+	}
+	return out;
+}
+/**
+* Resolve the set of deviceIds the caller may reach at `access`, expanded
+* against the live `fleet`. A `category:device` grant returns the whole
+* fleet. Device selectors are matched per device — directly, or (when the
+* grant inherits) against an ancestor, so a parent grant covers its
+* accessories.
+*/
+function resolveViewableDeviceIds(scopes, fleet, access) {
+	if (hasBroadDeviceGrant(scopes, access)) return new Set(fleet.map((d) => d.id));
+	const byId = /* @__PURE__ */ new Map();
+	for (const d of fleet) byId.set(d.id, d);
+	const grants = deviceScopesFor(scopes, access);
+	const out = /* @__PURE__ */ new Set();
+	for (const d of fleet) for (const grant of grants) {
+		if (deviceSelectorMatches(grant.selector, d)) {
+			out.add(d.id);
+			break;
+		}
+		if (scopeInherits(grant, access)) {
+			if (ancestorsOf(d.id, byId).some((ancestorId) => {
+				const ancestor = byId.get(ancestorId);
+				return ancestor !== void 0 && deviceSelectorMatches(grant.selector, ancestor);
+			})) {
+				out.add(d.id);
+				break;
+			}
+		}
+	}
+	return out;
+}
+/**
+* Normalise a raw scope array read off a JWT payload or a stored record into
+* validated v3 `TokenScope`s, migrating any v2 `device:targets` grant on the
+* way (via {@link TokenScopeSchema}'s preprocess). Applied at the request
+* boundary (`resolveUser`) so the enforcement matcher only ever sees v3.
+*
+* Per-ITEM parse (not whole-array) so a single malformed scope is dropped
+* without discarding the caller's valid grants — losing a good grant reads as
+* a lockout, and a lockout reads as broken. A non-array input yields `[]`
+* (fail closed).
+*/
+function normalizeTokenScopes(raw) {
+	if (!Array.isArray(raw)) return [];
+	const out = [];
+	for (const item of raw) {
+		const parsed = TokenScopeSchema.safeParse(item);
+		if (parsed.success) out.push(parsed.data);
+	}
+	return out;
+}
+var ALL_ACCESS = [
+	"view",
+	"create",
+	"delete"
+];
+function deviceReach(scopes, fleet, access, isAdmin) {
+	if (isAdmin) return {
+		all: true,
+		deviceCount: fleet.length
+	};
+	return {
+		all: hasBroadDeviceGrant(scopes, access) || deviceScopesFor(scopes, access).some((s) => s.selector.kind === "all"),
+		deviceCount: resolveViewableDeviceIds(scopes, fleet, access).size
+	};
+}
+function capabilityGrants(scopes) {
+	const out = [];
+	for (const s of scopes) if (s.type === "capability") out.push({
+		name: s.target,
+		access: s.access
+	});
+	return out;
+}
+function addonGrants(scopes) {
+	const out = [];
+	for (const s of scopes) if (s.type === "addon") out.push({
+		name: s.target,
+		access: s.access
+	});
+	return out;
+}
+/** Build the {@link EffectiveScope} for a caller from their scopes + the fleet. */
+function summarizeEffectiveScope(scopes, fleet, isAdmin) {
+	const device = {
+		view: deviceReach(scopes, fleet, "view", isAdmin),
+		create: deviceReach(scopes, fleet, "create", isAdmin),
+		delete: deviceReach(scopes, fleet, "delete", isAdmin)
+	};
+	const system = isAdmin ? ALL_ACCESS : ALL_ACCESS.filter((a) => scopes.some((s) => s.type === "category" && s.target === "system" && s.access.includes(a)));
+	return {
+		isAdmin,
+		allDevicesViewable: device.view.all,
+		viewableDeviceCount: device.view.deviceCount,
+		device,
+		system,
+		capabilities: capabilityGrants(scopes),
+		addons: addonGrants(scopes)
+	};
+}
+//#endregion
 //#region src/types/device-type.ts
 var DEVICE_TYPE_INFO = { ["camera"]: {
 	type: "camera",
@@ -42436,6 +44697,7 @@ function enumerateInferenceDevices(hw) {
 }
 //#endregion
 exports.ACCESSORY_LABEL = ACCESSORY_LABEL;
+exports.ACCESS_ROLES = ACCESS_ROLES;
 exports.ALEXA_EGRESS_PROFILE = ALEXA_EGRESS_PROFILE;
 exports.ALL_CAPABILITY_DEFINITIONS = ALL_CAPABILITY_DEFINITIONS;
 exports.APPLE_SA_TO_MACRO = APPLE_SA_TO_MACRO;
@@ -42682,6 +44944,7 @@ exports.DeviceInfoSchema = DeviceInfoSchema;
 exports.DeviceNetworkStatsSchema = DeviceNetworkStatsSchema;
 exports.DeviceRole = require_sleep.DeviceRole;
 exports.DeviceRuntimeState = DeviceRuntimeState;
+exports.DeviceSelectorSchema = DeviceSelectorSchema;
 exports.DeviceStatusSchema = DeviceStatusSchema;
 exports.DeviceType = require_sleep.DeviceType;
 exports.DiscoveredChildDeviceSchema = DiscoveredChildDeviceSchema;
@@ -42831,6 +45094,7 @@ exports.MAX_EXPRESSION_CALL_ARGS = MAX_EXPRESSION_CALL_ARGS;
 exports.MAX_EXPRESSION_EVAL_STEPS = MAX_EXPRESSION_EVAL_STEPS;
 exports.MAX_EXPRESSION_SOURCE_LENGTH = MAX_EXPRESSION_SOURCE_LENGTH;
 exports.METHOD_ACCESS_MAP = METHOD_ACCESS_MAP;
+exports.METHOD_DEVICE_SELECTORS = METHOD_DEVICE_SELECTORS;
 exports.MODEL_FORMATS = MODEL_FORMATS;
 exports.MOTION_TRIGGER_FEATURE = MOTION_TRIGGER_FEATURE;
 exports.ManagedModelCatalogEntrySchema = ManagedModelCatalogEntrySchema;
@@ -43129,6 +45393,7 @@ exports.STREAM_PROFILE_META = STREAM_PROFILE_META;
 exports.STREAM_QUALITY_LABELS = STREAM_QUALITY_LABELS;
 exports.SUB_DETECTION_TYPES = SUB_DETECTION_TYPES;
 exports.SYSTEM_CAP_NAMES = SYSTEM_CAP_NAMES;
+exports.SYSTEM_SCOPE_DEVICE_METHODS = SYSTEM_SCOPE_DEVICE_METHODS;
 exports.SceneCheckSchema = SceneCheckSchema;
 exports.SceneConditionSchema = SceneConditionSchema;
 exports.SceneMonitorSchema = SceneMonitorSchema;
@@ -43351,6 +45616,7 @@ exports.buildFfmpegArgs = require_canonical_hash.buildFfmpegArgs;
 exports.buildInputArgs = require_canonical_hash.buildInputArgs;
 exports.buildModelVariantGroups = buildModelVariantGroups;
 exports.buildNcTaxonomy = buildNcTaxonomy;
+exports.buildRoleScopes = buildRoleScopes;
 exports.buildStreamParamsConfigSchema = buildStreamParamsConfigSchema;
 exports.buildVideoArgs = require_canonical_hash.buildVideoArgs;
 exports.buttonCapability = buttonCapability;
@@ -43408,6 +45674,7 @@ exports.deriveCameraSwitches = deriveCameraSwitches;
 exports.deriveDetailCropRect = deriveDetailCropRect;
 exports.deriveRecordingMode = deriveRecordingMode;
 exports.describeModelVariant = describeModelVariant;
+exports.detectAccessRole = detectAccessRole;
 exports.detectionPipelineCapability = detectionPipelineCapability;
 exports.deviceAdoptionCapability = deviceAdoptionCapability;
 exports.deviceBackendToFormat = deviceBackendToFormat;
@@ -43418,6 +45685,7 @@ exports.deviceManagerCapability = deviceManagerCapability;
 exports.deviceMatchesProfile = deviceMatchesProfile;
 exports.deviceOpsCapability = require_sleep.deviceOpsCapability;
 exports.deviceProviderCapability = deviceProviderCapability;
+exports.deviceSelectorMatches = deviceSelectorMatches;
 exports.deviceStateCapability = deviceStateCapability;
 exports.deviceStatusCapability = deviceStatusCapability;
 exports.doorbellCapability = doorbellCapability;
@@ -43530,6 +45798,7 @@ exports.nodePin = require_sleep.nodePin;
 exports.nodesCapability = nodesCapability;
 exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
 exports.normalizeAudioLabel = normalizeAudioLabel;
+exports.normalizeTokenScopes = normalizeTokenScopes;
 exports.normalizeUnit = normalizeUnit;
 exports.notificationOutputCapability = notificationOutputCapability;
 exports.notificationRulesCapability = notificationRulesCapability;
@@ -43597,10 +45866,13 @@ exports.resolveMutate = resolveMutate;
 exports.resolveRunnerId = resolveRunnerId;
 exports.resolveScrubThumbnailGeometry = resolveScrubThumbnailGeometry;
 exports.resolveVariantModelId = resolveVariantModelId;
+exports.resolveViewableDeviceIds = resolveViewableDeviceIds;
+exports.roleSpec = roleSpec;
 exports.runInferenceStep = runInferenceStep;
 exports.runtimeDevices = runtimeDevices;
 exports.runtimeStatePolicyFor = runtimeStatePolicyFor;
 exports.sceneMonitorCapability = sceneMonitorCapability;
+exports.scopeInherits = scopeInherits;
 exports.scopeKey = require_sleep.scopeKey;
 exports.scopesAllowAddon = scopesAllowAddon;
 exports.scopesAllowDeviceCap = scopesAllowDeviceCap;
@@ -43629,6 +45901,7 @@ exports.streamPixels = streamPixels;
 exports.streamQualityLabel = streamQualityLabel;
 exports.subKindsOf = subKindsOf;
 exports.summarisePrivacyAudio = summarisePrivacyAudio;
+exports.summarizeEffectiveScope = summarizeEffectiveScope;
 exports.supportedRuntimes = supportedRuntimes;
 exports.switchCapability = switchCapability;
 exports.switchedOffIds = switchedOffIds;