@camstack/addon-admin-ui 1.2.38 → 1.2.40

package/dist/server/addon.js

@@ -7913,1026 +7913,1800 @@ var ConvertResultSchema = object({
 	})).readonly()
 });
 /**
-* `addon-pages` — system-scoped singleton aggregator cap. Public-facing
-* surface that admin-ui consumes through `useAddonPagesListPages()`.
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+/**
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
 *
-* The provider iterates every `addon-pages-source` (collection) provider
-* and emits `AddonPageInfo[]` enriched with versioned `bundleUrl` strings
-* pointing at `/api/addon-pages/<addonId>/<bundle>?v=<mtime>`. The
-* filesystem `mtime` cache-buster lets the browser pick up addon
-* rebuilds without manual reload.
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
 *
-* The hub-local builtin `addon-pages-aggregator` (see
-* `@camstack/system/builtins/addon-pages-aggregator`) registers the
-* provider. Splitting the public aggregator from the raw collection
-* keeps both ends in codegen — there's no hand-written
-* `addon-pages.router.ts` wrapper anymore.
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
 */
-var AddonPageDeclarationSchema$1 = object({
-	id: string(),
-	label: string(),
-	icon: string(),
-	path: string(),
-	remoteName: string(),
-	bundle: string(),
-	section: string().optional(),
-	sectionLabel: string().optional()
-});
-var AddonPageInfoSchema = object({
-	addonId: string(),
-	page: AddonPageDeclarationSchema$1,
-	bundleUrl: string()
-});
-method(_void(), array(AddonPageInfoSchema).readonly());
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
 /**
-* `addon-pages-source` — collection cap exposing per-provider raw page
-* declarations. Every addon that contributes a UI page registers a
-* provider here. The hub-side singleton aggregator (`addon-pages` cap,
-* see `addon-pages.cap.ts`) walks this collection, stamps versioned
-* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
-* that admin-ui consumes.
+* Resource-bound constants for the safe expression engine.
 *
-* The split exists because the public listing has a different output
-* shape than the per-provider raw declarations, and we want both ends
-* to flow through codegen instead of relying on a hand-written wrapper.
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
 */
-var AddonPageDeclarationSchema = object({
-	id: string(),
-	label: string(),
-	icon: string(),
-	path: string(),
-	/**
-	* Module Federation remote name — must match the `name` field on the
-	* page addon's `federation()` plugin config. Used by admin-ui's
-	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
-	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
-	* contain hyphens).
-	*/
-	remoteName: string(),
-	/**
-	* Bundle filename inside the addon's `dist/` dir served at
-	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
-	* is always `'remoteEntry.js'`; the value is kept on the metadata so
-	* the static-file route can compute an mtime-based cache-buster URL
-	* without a separate filesystem stat.
-	*/
-	bundle: string(),
-	/**
-	* Sidebar section this page docks into. Well-known ids: `'detection'`,
-	* `'cluster'`, `'administration'` — the page renders inside that group.
-	* Any OTHER string creates (or joins) a custom section rendered after
-	* the built-in groups; its label comes from `sectionLabel` (first
-	* declaration wins), falling back to the id. Absent → the legacy
-	* "Addon Pages" group.
-	*/
-	section: string().optional(),
-	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
-	sectionLabel: string().optional()
-});
-method(_void(), array(AddonPageDeclarationSchema).readonly());
-var AddonHttpRouteSchema = object({
-	method: _enum([
-		"GET",
-		"POST",
-		"PUT",
-		"DELETE",
-		"PATCH"
-	]),
-	path: string(),
-	access: _enum([
-		"public",
-		"authenticated",
-		"admin"
-	]).optional(),
-	description: string().optional()
-});
-/**
-* Cross-process route invocation envelope. The hub captures the
-* request as plain data, ships it to the worker via Moleculer, and
-* the worker runs the local handler against a capturing reply. The
-* envelope returned describes what the handler intended (status,
-* headers, body, or a redirect) so the hub can translate it back to
-* the Fastify reply that's actually wired to the socket.
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
 */
-var InvokeRequestSchema = object({
-	method: string(),
-	path: string(),
-	params: record(string(), string()),
-	query: record(string(), string()),
-	body: unknown(),
-	headers: record(string(), string()),
-	user: object({
-		id: string(),
-		username: string(),
-		isAdmin: boolean()
-	}).optional(),
-	scopedToken: unknown().optional()
-});
-var InvokeReplyEnvelopeSchema = object({
-	status: number().int(),
-	headers: record(string(), string()),
-	/** When set, the hub MUST `reply.redirect(redirectUrl)` instead of
-	*  sending `body`. Status defaults to 302 when this is set unless
-	*  the handler called `reply.code(...)` explicitly. */
-	redirectUrl: string().nullable(),
-	/** JSON-serializable body. `undefined` is treated as "no body". */
-	body: unknown().optional(),
-	/** Set when the handler called `reply.type(mime)`. */
-	contentType: string().optional()
-});
-method(_void(), array(AddonHttpRouteSchema)), method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" });
-var ConfigTabDeclarationSchema = object({
-	id: string(),
-	label: string(),
-	icon: string(),
-	order: number().optional()
-});
-var ConfigSectionWithValuesSchema = object({
-	id: string(),
-	title: string(),
-	description: string().optional(),
-	style: _enum(["card", "accordion"]).optional(),
-	defaultCollapsed: boolean().optional(),
-	columns: union([
-		literal(1),
-		literal(2),
-		literal(3),
-		literal(4)
-	]).optional(),
-	tab: string().optional(),
-	location: _enum(["settings", "top-tab"]).optional(),
-	order: number().optional(),
-	fields: array(any())
-});
-var SettingsSchemaWithValuesSchema = object({
-	tabs: array(ConfigTabDeclarationSchema).optional(),
-	sections: array(ConfigSectionWithValuesSchema)
-});
-/** Patch object — keys are field names, values are the new field values. */
-var SettingsPatchSchema = record(string(), unknown());
-/** Standard success response for update operations. */
-var SettingsUpdateResultSchema = object({ success: literal(true) });
-method(object({
-	addonId: string(),
-	nodeId: string().optional(),
-	overlay: record(string(), unknown()).optional(),
-	cap: string().optional()
-}), SettingsSchemaWithValuesSchema.nullable()), method(object({
-	addonId: string(),
-	nodeId: string().optional(),
-	patch: SettingsPatchSchema
-}), SettingsUpdateResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	addonId: string(),
-	deviceId: number(),
-	nodeId: string().optional()
-}), SettingsSchemaWithValuesSchema.nullable()), method(object({
-	addonId: string(),
-	deviceId: number(),
-	nodeId: string().optional(),
-	patch: SettingsPatchSchema
-}), SettingsUpdateResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
 /**
-* `addon-widgets-source` — collection cap exposing per-addon raw widget
-* declarations. Mirrors the addon-pages split: every addon shipping
-* widgets registers a provider on this collection cap; the hub-local
-* aggregator (`addon-widgets`, see `addon-widgets.cap.ts`) walks the
-* collection, stamps versioned `bundleUrl`s onto each declaration, and
-* exposes the public listing surface that admin-ui consumes.
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
 *
-* The split exists because the public listing has a different output
-* shape (flat enriched metadata with `addonId` + `bundleUrl`) than the
-* per-provider raw declarations. Both ends flow through codegen.
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
 *
-* Unified UI-contribution model (Task 10): a widget descriptor IS a
-* `UiContribution` with `kind:'remote'`. The host renders it through the
-* same `ContributionRenderer` / Module-Federation path as every other
-* contributed UI surface — no bespoke widget-rendering path. The widget-
-* only metadata (sizing hints, `requires`) lives as extra fields on the
-* descriptor; the `UiContribution` core (`tab` / `label` / `order` /
-* `kind` / `remote`) carries identity + placement + the MF remote.
-*/
-/** Where the widget makes sense to render — maps to a contribution `tab`. */
-var WidgetHostEnum = _enum([
-	"device-tab",
-	"dashboard",
-	"integration-detail"
-]);
-var WidgetSizeEnum = _enum([
-	"xs",
-	"sm",
-	"md",
-	"lg",
-	"xl"
-]);
-/**
-* MF remote descriptor — mirrors `UiContributionRemote` from
-* `capability-definition.ts`. Widget remotes expose a single
-* `'./widgets'` module whose default export is a
-* `Record<componentKey, Component>` map; `componentKey` (the widget
-* `stableId`) picks the entry the host mounts.
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
 */
-var WidgetRemoteSchema = object({
-	remoteName: string(),
-	exposedModule: string(),
-	componentKey: string().optional()
-});
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
 /**
-* One widget declaration — a `UiContribution` (`kind:'remote'`) plus
-* widget-only metadata. The `UiContribution` core fields:
-*
-*  - `tab`     — where the widget hosts. A widget that runs on the
-*                dashboard declares `tab:'dashboard'`; a device-tab
-*                widget declares the target device-detail tab id.
-*  - `subTab`  — optional sub-tab within `tab`.
-*  - `label`   — operator-facing label.
-*  - `order`   — ordering within `(tab, subTab)`.
-*  - `kind`    — always `'remote'` for widgets.
-*  - `remote`  — the MF remote `{ remoteName, exposedModule, componentKey }`.
-*
-* Widget-only fields retained alongside the contribution core:
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
 *
-*  - `stableId`      — stable identity within the addon (the MF
-*                      `componentKey`; kept top-level so consumers have
-*                      a stable key without reaching into `remote`).
-*  - `description` / `icon` — picker metadata.
-*  - `bundle`        — entry filename inside the addon `dist/` dir; the
-*                      aggregator stamps a versioned `bundleUrl` from it.
-*  - `hosts`         — every host the widget supports (a widget can run
-*                      both on the dashboard and a device tab). `tab`
-*                      is the PRIMARY host; `hosts` is the full set the
-*                      picker filters on.
-*  - `requires`      — host-context requirements validated at mount.
-*  - `defaultSize` / `allowedSizes` / `defaultColumns` / `defaultRows`
-*                    — dashboard placement hints.
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
 */
-var WidgetMetadataSchema = object({
-	/** Primary host tab — `'dashboard'`, `'device-tab'`, or a device-detail tab id. */
-	tab: string(),
-	/** Optional sub-tab within `tab`. */
-	subTab: string().optional(),
-	/** Operator-facing label. */
-	label: string(),
-	/** Ordering within `(tab, subTab)`, ascending. */
-	order: number().optional(),
-	/** Always `'remote'` — a widget is a Module Federation remote. */
-	kind: literal("remote"),
-	/** MF remote descriptor. */
-	remote: WidgetRemoteSchema,
-	/** Stable id within the addon — kebab-case. Equals `remote.componentKey`. */
-	stableId: string(),
-	description: string().optional(),
-	icon: string().optional(),
-	/**
-	* Bundle filename inside the addon's `dist/` dir served at
-	* `/api/addon-widgets/<addonId>/<bundle>`. With Module Federation
-	* this is always `'remoteEntry.js'` — the value is kept on the
-	* metadata so the static-file route can compute an mtime-based
-	* cache-buster URL without a separate filesystem stat.
-	*/
-	bundle: string(),
-	/** Every host the widget supports. The picker filters on this set. */
-	hosts: array(WidgetHostEnum).readonly(),
-	/** Required props the host must supply. Validated at `<WidgetSlot>` mount. */
-	requires: object({
-		deviceContext: boolean().default(false),
-		integrationContext: boolean().default(false)
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+var ExpressionBindingSourceSchema = union([
+	object({
+		kind: literal("field").optional(),
+		sourceKey: string(),
+		cap: string(),
+		fieldPath: string()
 	}),
-	/**
-	* Loadable BEFORE authentication. The normal widget registry listing
-	* (`addon-widgets.listWidgets`) is auth-gated, so a pre-auth surface
-	* (the login page) cannot discover a widget through it. A widget that
-	* declares `preAuth: true` marks itself as safe to mount on a pre-auth
-	* screen — it is surfaced through the PUBLIC `auth.listLoginMethods`
-	* login-method contribution channel (see `login-method.cap.ts`) rather
-	* than the authenticated registry, and its bundle is served by the
-	* public `/api/addon-widgets/:addonId/*` static route. Defaults false.
-	*/
-	preAuth: boolean().optional().default(false),
-	/** Dashboard placement HINTS (operator can override per instance). */
-	defaultSize: WidgetSizeEnum.default("md"),
-	allowedSizes: array(WidgetSizeEnum).readonly().default([
-		"sm",
-		"md",
-		"lg"
-	]),
-	defaultColumns: number().int().min(1).max(12).default(6),
-	defaultRows: number().int().min(1).max(12).default(1)
+	object({
+		kind: literal("literal"),
+		value: union([
+			string(),
+			number(),
+			boolean(),
+			_null()
+		])
+	}),
+	object({
+		kind: literal("global"),
+		sourceStableId: string(),
+		cap: string(),
+		fieldPath: string()
+	})
+]);
+object({
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+/** How a leaf compares a device field to a value. Derived from the field's
+*  `kind` in `deviceManager.getWireableFields`, never hand-maintained. */
+var AutomationConditionOperatorSchema = _enum([
+	"eq",
+	"ne",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"contains",
+	"in"
+]);
+var AutomationConditionLeafSchema = object({
+	kind: literal("condition"),
+	deviceId: number().int().nonnegative(),
+	cap: string().min(1),
+	fieldPath: string().min(1),
+	operator: AutomationConditionOperatorSchema,
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		array(union([string(), number()]))
+	])
 });
-method(_void(), array(WidgetMetadataSchema).readonly());
 /**
-* `addon-widgets` — system-scoped singleton aggregator cap. Public-facing
-* surface that admin-ui consumes through `useAddonWidgetsListWidgets()`.
-*
-* The provider iterates every `addon-widgets-source` (collection)
-* provider and emits `EnrichedWidgetMetadata[]` enriched with versioned
-* `bundleUrl` strings pointing at
-* `/api/addon-widgets/<addonId>/<bundle>?v=<mtime>`. The filesystem
-* `mtime` cache-buster lets the browser pick up addon rebuilds without
-* manual reload — same scheme used by `addon-pages`.
-*
-* The hub-local builtin `addon-widgets-aggregator` (see
-* `@camstack/system/builtins/addon-widgets-aggregator`) registers the
-* provider. Splitting the public aggregator from the raw collection
-* keeps both ends in codegen — there's no hand-written wrapper.
+* The expression leaf, declared as a plain object rather than an intersection
+* with {@link ExpressionSourceSchema}: a discriminated union has to be able to
+* read `kind` off each option, and an intersection hides it. The author-time
+* validation is the SAME function `ExpressionSourceSchema` runs, so the two
+* cannot drift — an expression that one accepts, the other accepts.
 */
-var EnrichedWidgetMetadataSchema = WidgetMetadataSchema.extend({
-	addonId: string(),
-	bundleUrl: string()
+var AutomationConditionExpressionSchema = object({
+	kind: literal("expression"),
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
 });
-method(_void(), array(EnrichedWidgetMetadataSchema).readonly());
+var AutomationConditionSchema = lazy(() => discriminatedUnion("kind", [
+	object({
+		kind: literal("all"),
+		children: array(AutomationConditionSchema)
+	}),
+	object({
+		kind: literal("any"),
+		children: array(AutomationConditionSchema)
+	}),
+	object({
+		kind: literal("not"),
+		child: AutomationConditionSchema
+	}),
+	AutomationConditionLeafSchema,
+	AutomationConditionExpressionSchema
+]));
 /**
-* Alerts capability — collection-based internal alert system.
+* What starts a run.
 *
-* Multiple providers can register. Each provider filters by EventBus category
-* and creates/updates alerts. The built-in Alert Center addon persists alerts
-* in the DB and serves them to the admin UI.
+* D8 compliance, and it is the reason `device-state` is not merely an event
+* subscription: the trigger evaluates against the **state mirror**, which is
+* reconciled, and an event only WAKES the evaluation. A dropped event therefore
+* DELAYS a trigger; it does not lose it. `schedule` uses `croner` — the one
+* already in the repo — because `setInterval(24h)` drifts and "at 23:30" does
+* not.
 */
-var AlertSeveritySchema = _enum([
-	"info",
-	"success",
-	"warning",
-	"error"
+var AutomationTriggerSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("device-state"),
+		deviceId: number().int().nonnegative(),
+		cap: string().min(1),
+		fieldPath: string().min(1),
+		/** Fire when the field takes this value. Omit to fire on any change. */
+		becomes: union([
+			string(),
+			number(),
+			boolean()
+		]).optional(),
+		/** Only on a CHANGE of value, not on every re-report. */
+		edge: boolean().optional(),
+		/** The condition must hold this long before the run starts. */
+		forMs: number().int().min(0).max(864e5).optional(),
+		/** Collapse a burst into one run. */
+		debounceMs: number().int().min(0).max(6e5).optional()
+	}),
+	object({
+		kind: literal("device-event"),
+		/** An `EventCategory` value. */
+		category: string().min(1),
+		deviceId: number().int().nonnegative().optional()
+	}),
+	object({
+		kind: literal("schedule"),
+		cron: string().min(1).max(120)
+	}),
+	object({ kind: literal("manual") })
 ]);
-var AlertStatusSchema = _enum([
-	"active",
-	"in-progress",
-	"completed",
-	"failed",
-	"dismissed"
+/**
+* One action step.
+*
+* `wait` and `cap` are `NcRuleActionSchema`'s two members, kept structurally
+* identical so `NcRuleActionRunner` runs them unchanged — its device-scope
+* check, stop-at-first-failure and per-sequence throttle are the whole reason
+* to reuse it, and none of them are re-implemented here.
+*
+* **The one divergence, and it is forced.** `NcRuleActionSchema.cap.deviceId` is
+* a literal `z.number().int()`, and the NC runner's own `RunSequencesInput`
+* documents its subject device as *"for the log tag, never for routing"*. So an
+* NC action can never target the device that triggered it — which is fine for
+* the NC (its rules already scope to a device) and fatal for an automation
+* ("sound the siren of the camera that saw the person"). `deviceId` therefore
+* also accepts `{ $var }`, resolved from the run's `vars` bag BEFORE the runner
+* is called. The runner still receives a number and is untouched; the
+* resolution is the recipe's job, not the runner's.
+*/
+var AutomationActionSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("wait"),
+		seconds: number().min(0).max(300)
+	}),
+	object({
+		kind: literal("cap"),
+		deviceId: union([number().int(), object({ $var: string().min(1) })]),
+		cap: string().min(1),
+		method: string().min(1),
+		/** Values may carry `{{vars.x}}` slots, which SUBSTITUTE and do not
+		*  evaluate (§3.2.3). Anything beyond substitution is the expression leaf. */
+		args: record(string(), unknown()).optional()
+	}),
+	object({
+		kind: literal("code"),
+		/** Compiled into the automation's OWN block by esbuild — not a third
+		*  runtime, not a `vm`, and not dynamically evaluated. */
+		code: string().min(1).max(2e4)
+	})
 ]);
-var AlertSourceSchema = object({
-	type: string(),
-	id: string()
+object({
+	triggers: array(AutomationTriggerSchema),
+	conditions: AutomationConditionSchema.optional(),
+	actions: array(AutomationActionSchema)
 });
-var AlertSchema = object({
+/**
+* `addon-pages` — system-scoped singleton aggregator cap. Public-facing
+* surface that admin-ui consumes through `useAddonPagesListPages()`.
+*
+* The provider iterates every `addon-pages-source` (collection) provider
+* and emits `AddonPageInfo[]` enriched with versioned `bundleUrl` strings
+* pointing at `/api/addon-pages/<addonId>/<bundle>?v=<mtime>`. The
+* filesystem `mtime` cache-buster lets the browser pick up addon
+* rebuilds without manual reload.
+*
+* The hub-local builtin `addon-pages-aggregator` (see
+* `@camstack/system/builtins/addon-pages-aggregator`) registers the
+* provider. Splitting the public aggregator from the raw collection
+* keeps both ends in codegen — there's no hand-written
+* `addon-pages.router.ts` wrapper anymore.
+*/
+var AddonPageDeclarationSchema$1 = object({
 	id: string(),
-	category: string(),
-	severity: AlertSeveritySchema,
-	title: string(),
-	message: string(),
-	status: AlertStatusSchema,
-	progress: number().optional(),
-	read: boolean(),
-	createdAt: number(),
-	updatedAt: number(),
-	source: AlertSourceSchema.optional(),
-	metadata: record(string(), unknown()).optional()
+	label: string(),
+	icon: string(),
+	path: string(),
+	remoteName: string(),
+	bundle: string(),
+	section: string().optional(),
+	sectionLabel: string().optional()
 });
-method(AlertSchema, _void(), { kind: "mutation" }), method(object({
-	alertId: string(),
-	patch: AlertSchema.partial()
-}), _void(), { kind: "mutation" }), method(object({
-	unreadOnly: boolean().optional(),
-	limit: number().optional()
-}).optional(), array(AlertSchema).readonly()), method(_void(), number()), method(object({ alertId: string() }), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(object({ alertId: string() }), _void(), { kind: "mutation" });
-DeviceType.Camera, method(object({ deviceId: number() }), custom()), object({
-	deviceId: number(),
-	rms: number(),
-	dbfs: number()
-});
-/** Shared Zod schemas used across detection capabilities. */
-/**
-* Canonical frame-format enum mirrored on `FrameFormat` in
-* `packages/types/src/types/io.ts`. Kept inline (vs imported) so the
-* Zod runtime schema and TypeScript type stay in sync at the call site
-* — adding a new format requires changing both this enum and the
-* `FrameFormat` type alias together.
-*/
-var FrameFormatSchema = _enum([
-	"jpeg",
-	"rgb",
-	"bgr",
-	"yuv420",
-	"gray"
-]);
-var FrameInputSchema = object({
-	data: custom(),
-	format: FrameFormatSchema,
-	width: number(),
-	height: number(),
-	timestamp: number()
-});
-var BoundingBoxSchema = object({
-	x: number(),
-	y: number(),
-	w: number(),
-	h: number()
-});
-object({
-	class: string(),
-	originalClass: string(),
-	score: number(),
-	bbox: BoundingBoxSchema
+var AddonPageInfoSchema = object({
+	addonId: string(),
+	page: AddonPageDeclarationSchema$1,
+	bundleUrl: string()
 });
+method(_void(), array(AddonPageInfoSchema).readonly());
 /**
-* `data` carries the raw f32le bytes of the PCM samples (4 bytes per
-* sample, little-endian IEEE 754).  `Uint8Array` is the wire-safe choice
-* because `@msgpack/msgpack` serialises it as a MsgPack `bin` type that
-* round-trips losslessly over the UDS transport.  `Float32Array` is NOT
-* preserved — the encoder serialises it as `bin` (its raw bytes) but
-* the decoder returns `Uint8Array`, so treating a `Float32Array` as the
-* wire type causes receivers to read bytes as sample values, producing
-* wildly wrong RMS/dBFS results (~+43 dBFS instead of ≤0).
+* `addon-pages-source` — collection cap exposing per-provider raw page
+* declarations. Every addon that contributes a UI page registers a
+* provider here. The hub-side singleton aggregator (`addon-pages` cap,
+* see `addon-pages.cap.ts`) walks this collection, stamps versioned
+* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
+* that admin-ui consumes.
 *
-* Callers that need float arithmetic reconstruct the view with:
-*   `new Float32Array(chunk.data.buffer, chunk.data.byteOffset, chunk.data.byteLength / 4)`
+* The split exists because the public listing has a different output
+* shape than the per-provider raw declarations, and we want both ends
+* to flow through codegen instead of relying on a hand-written wrapper.
 */
-var AudioChunkInputSchema = object({
-	data: _instanceof(Uint8Array),
-	sampleRate: number(),
-	channels: number(),
-	timestamp: number(),
-	/** Originating device id — used by the classifier for per-camera concurrency tracking. */
-	deviceId: number().optional()
-});
-var AudioLevelSchema = object({
-	rms: number(),
-	dbfs: number()
-});
-var AudioClassificationLabelSchema = object({
+var AddonPageDeclarationSchema = object({
+	id: string(),
+	label: string(),
+	icon: string(),
+	path: string(),
 	/**
-	* Primary display class. Depending on how the label was produced
-	* this is either the macro category (e.g. `dog`) or the raw
-	* backend label (e.g. `Dog bark`). Mirrors `class` on
-	* `SpatialDetection`.
+	* Module Federation remote name — must match the `name` field on the
+	* page addon's `federation()` plugin config. Used by admin-ui's
+	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
+	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
+	* contain hyphens).
 	*/
-	className: string(),
+	remoteName: string(),
 	/**
-	* Raw backend-native label the classifier actually emitted (e.g.
-	* `Dog bark` for YAMNet, `dog_bark` for Apple SoundAnalysis). For
-	* macro-aggregated entries this is the top raw contributor. Mirrors
-	* `originalClass` on `SpatialDetection`.
+	* Bundle filename inside the addon's `dist/` dir served at
+	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
+	* is always `'remoteEntry.js'`; the value is kept on the metadata so
+	* the static-file route can compute an mtime-based cache-buster URL
+	* without a separate filesystem stat.
 	*/
-	originalClass: string().optional(),
-	score: number()
+	bundle: string(),
+	/**
+	* Sidebar section this page docks into. Well-known ids: `'detection'`,
+	* `'cluster'`, `'administration'` — the page renders inside that group.
+	* Any OTHER string creates (or joins) a custom section rendered after
+	* the built-in groups; its label comes from `sectionLabel` (first
+	* declaration wins), falling back to the id. Absent → the legacy
+	* "Addon Pages" group.
+	*/
+	section: string().optional(),
+	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
+	sectionLabel: string().optional()
 });
-var AudioAnalysisResultSchema = object({
-	level: AudioLevelSchema,
-	classification: object({
-		labels: array(AudioClassificationLabelSchema).readonly(),
-		inferenceMs: number()
+method(_void(), array(AddonPageDeclarationSchema).readonly());
+var AddonHttpRouteSchema = object({
+	method: _enum([
+		"GET",
+		"POST",
+		"PUT",
+		"DELETE",
+		"PATCH"
+	]),
+	path: string(),
+	access: _enum([
+		"public",
+		"authenticated",
+		"admin"
+	]).optional(),
+	description: string().optional()
+});
+/**
+* Cross-process route invocation envelope. The hub captures the
+* request as plain data, ships it to the worker via Moleculer, and
+* the worker runs the local handler against a capturing reply. The
+* envelope returned describes what the handler intended (status,
+* headers, body, or a redirect) so the hub can translate it back to
+* the Fastify reply that's actually wired to the socket.
+*/
+var InvokeRequestSchema = object({
+	method: string(),
+	path: string(),
+	params: record(string(), string()),
+	query: record(string(), string()),
+	body: unknown(),
+	headers: record(string(), string()),
+	user: object({
+		id: string(),
+		username: string(),
+		isAdmin: boolean()
 	}).optional(),
-	timestamp: number()
+	scopedToken: unknown().optional()
 });
-var AudioAnalysisSettingsSchema = object({
-	minConfidence: number().min(0).max(1).default(.3),
-	allowedClasses: array(string()).default([])
+var InvokeReplyEnvelopeSchema = object({
+	status: number().int(),
+	headers: record(string(), string()),
+	/** When set, the hub MUST `reply.redirect(redirectUrl)` instead of
+	*  sending `body`. Status defaults to 302 when this is set unless
+	*  the handler called `reply.code(...)` explicitly. */
+	redirectUrl: string().nullable(),
+	/** JSON-serializable body. `undefined` is treated as "no body". */
+	body: unknown().optional(),
+	/** Set when the handler called `reply.type(mime)`. */
+	contentType: string().optional()
 });
-var AudioClassificationResultSchema = object({
-	labels: array(AudioClassificationLabelSchema).readonly(),
-	rawLabels: array(AudioClassificationLabelSchema).readonly().optional(),
-	inferenceMs: number()
+method(_void(), array(AddonHttpRouteSchema)), method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" });
+var ConfigTabDeclarationSchema = object({
+	id: string(),
+	label: string(),
+	icon: string(),
+	order: number().optional()
+});
+var ConfigSectionWithValuesSchema = object({
+	id: string(),
+	title: string(),
+	description: string().optional(),
+	style: _enum(["card", "accordion"]).optional(),
+	defaultCollapsed: boolean().optional(),
+	columns: union([
+		literal(1),
+		literal(2),
+		literal(3),
+		literal(4)
+	]).optional(),
+	tab: string().optional(),
+	location: _enum(["settings", "top-tab"]).optional(),
+	order: number().optional(),
+	fields: array(any())
+});
+var SettingsSchemaWithValuesSchema = object({
+	tabs: array(ConfigTabDeclarationSchema).optional(),
+	sections: array(ConfigSectionWithValuesSchema)
 });
+/** Patch object — keys are field names, values are the new field values. */
+var SettingsPatchSchema = record(string(), unknown());
+/** Standard success response for update operations. */
+var SettingsUpdateResultSchema = object({ success: literal(true) });
 method(object({
-	chunk: AudioChunkInputSchema,
-	settings: AudioAnalysisSettingsSchema
-}), AudioAnalysisResultSchema.nullable(), { kind: "mutation" }), method(AudioChunkInputSchema, AudioClassificationResultSchema, { timeoutMs: 3e4 }), method(_void(), boolean()), method(_void(), _void(), { kind: "mutation" }), method(_void(), object({ backend: string() }), {
+	addonId: string(),
+	nodeId: string().optional(),
+	overlay: record(string(), unknown()).optional(),
+	cap: string().optional()
+}), SettingsSchemaWithValuesSchema.nullable()), method(object({
+	addonId: string(),
+	nodeId: string().optional(),
+	patch: SettingsPatchSchema
+}), SettingsUpdateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	addonId: string(),
+	deviceId: number(),
+	nodeId: string().optional()
+}), SettingsSchemaWithValuesSchema.nullable()), method(object({
+	addonId: string(),
+	deviceId: number(),
+	nodeId: string().optional(),
+	patch: SettingsPatchSchema
+}), SettingsUpdateResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 });
-var PcmSampleFormatSchema = _enum(["f32le", "s16le"]);
-var AudioCodecInfoSchema = object({
-	codec: string(),
-	canDecode: boolean(),
-	canEncode: boolean(),
-	label: string().optional()
-});
-var AudioDecodeSessionConfigSchema = object({
-	codec: string(),
-	sourceSampleRate: number().int().positive(),
-	sourceChannels: number().int().positive(),
-	extraData: _instanceof(Uint8Array).optional(),
-	targetSampleRate: number().int().positive(),
-	targetChannels: number().int().positive(),
-	targetFormat: PcmSampleFormatSchema.optional(),
-	idleMs: number().int().positive().optional(),
-	tag: string().optional()
-});
-var AudioEncodeSessionConfigSchema = object({
-	codec: string(),
-	sourceSampleRate: number().int().positive(),
-	sourceChannels: number().int().positive(),
-	sourceFormat: PcmSampleFormatSchema.optional(),
-	targetSampleRate: number().int().positive(),
-	targetChannels: number().int().positive(),
-	bitrateKbps: number().int().positive().optional(),
-	idleMs: number().int().positive().optional(),
-	tag: string().optional()
-});
-var AudioPcmChunkSchema = object({
-	data: _instanceof(Uint8Array),
-	sampleRate: number().int().positive(),
-	channels: number().int().positive(),
-	format: PcmSampleFormatSchema,
-	pts: number()
-});
-var AudioEncodedChunkSchema = object({
-	data: _instanceof(Uint8Array),
-	codec: string(),
-	pts: number(),
-	frameComplete: boolean()
-});
-var SessionInventoryEntrySchema = object({
-	sessionId: string(),
-	kind: _enum(["decode", "encode"]),
-	codec: string(),
-	sourceSampleRate: number(),
-	sourceChannels: number(),
-	targetSampleRate: number(),
-	targetChannels: number(),
-	format: PcmSampleFormatSchema,
-	tag: string().optional(),
-	createdAtMs: number(),
-	lastActivityMs: number(),
-	framesIn: number(),
-	framesOut: number()
-});
-method(_void(), array(AudioCodecInfoSchema).readonly()), method(object({
-	codec: string(),
-	kind: _enum(["decode", "encode"])
-}), boolean()), method(AudioDecodeSessionConfigSchema, object({
-	sessionId: string(),
-	nodeId: string()
-}), { kind: "mutation" }), method(AudioEncodeSessionConfigSchema, object({
-	sessionId: string(),
-	nodeId: string()
-}), { kind: "mutation" }), method(object({
-	sessionId: string(),
-	nodeId: string().optional()
-}), _void(), { kind: "mutation" }), method(object({
-	sessionId: string(),
-	nodeId: string().optional(),
-	data: _instanceof(Uint8Array),
-	/** Source PTS in milliseconds. Synthesised when omitted. */
-	pts: number().optional()
-}), _void(), { kind: "mutation" }), method(object({
-	sessionId: string(),
-	nodeId: string().optional(),
-	maxCount: number().int().positive().default(8)
-}), array(AudioPcmChunkSchema)), method(object({
-	sessionId: string(),
-	nodeId: string().optional(),
-	data: _instanceof(Uint8Array),
-	/** Source PTS in milliseconds. */
-	pts: number().optional()
-}), _void(), { kind: "mutation" }), method(object({
-	sessionId: string(),
-	nodeId: string().optional(),
-	maxCount: number().int().positive().default(8)
-}), array(AudioEncodedChunkSchema)), method(object({
-	sessionId: string(),
-	nodeId: string().optional()
-}), array(AudioEncodedChunkSchema), { kind: "mutation" }), method(_void(), array(SessionInventoryEntrySchema).readonly());
-var AuthResultSchema = object({
-	userId: string(),
-	username: string(),
-	email: string().optional(),
-	displayName: string().optional(),
-	/**
-	* Whether the authenticating user is an admin. The auth-provider
-	* surface returns this so the server's login flow can mint a JWT
-	* with the correct bypass flag. Non-admin users authenticated via
-	* an external IdP still need their scopes assigned by an admin via
-	* `setUserScopes` — the SSO flow doesn't carry permissions.
-	*/
-	isAdmin: boolean().default(false)
+/**
+* `addon-widgets-source` — collection cap exposing per-addon raw widget
+* declarations. Mirrors the addon-pages split: every addon shipping
+* widgets registers a provider on this collection cap; the hub-local
+* aggregator (`addon-widgets`, see `addon-widgets.cap.ts`) walks the
+* collection, stamps versioned `bundleUrl`s onto each declaration, and
+* exposes the public listing surface that admin-ui consumes.
+*
+* The split exists because the public listing has a different output
+* shape (flat enriched metadata with `addonId` + `bundleUrl`) than the
+* per-provider raw declarations. Both ends flow through codegen.
+*
+* Unified UI-contribution model (Task 10): a widget descriptor IS a
+* `UiContribution` with `kind:'remote'`. The host renders it through the
+* same `ContributionRenderer` / Module-Federation path as every other
+* contributed UI surface — no bespoke widget-rendering path. The widget-
+* only metadata (sizing hints, `requires`) lives as extra fields on the
+* descriptor; the `UiContribution` core (`tab` / `label` / `order` /
+* `kind` / `remote`) carries identity + placement + the MF remote.
+*/
+/** Where the widget makes sense to render — maps to a contribution `tab`. */
+var WidgetHostEnum = _enum([
+	"device-tab",
+	"dashboard",
+	"integration-detail"
+]);
+var WidgetSizeEnum = _enum([
+	"xs",
+	"sm",
+	"md",
+	"lg",
+	"xl"
+]);
+/**
+* MF remote descriptor — mirrors `UiContributionRemote` from
+* `capability-definition.ts`. Widget remotes expose a single
+* `'./widgets'` module whose default export is a
+* `Record<componentKey, Component>` map; `componentKey` (the widget
+* `stableId`) picks the entry the host mounts.
+*/
+var WidgetRemoteSchema = object({
+	remoteName: string(),
+	exposedModule: string(),
+	componentKey: string().optional()
 });
-method(object({
-	username: string(),
-	password: string()
-}), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
-* Orchestrator-side destination metadata. The orchestrator computes
-* `id = <addonId>:<subId>` from its provider lookup so consumers
-* (admin UI, restore flow) see one canonical key.
+* One widget declaration — a `UiContribution` (`kind:'remote'`) plus
+* widget-only metadata. The `UiContribution` core fields:
 *
-* Phase 4 (admin UI redesign) adds the per-destination policy fields
-* (`enabled`, `retentionCount`, `label`) so the destinations table can
-* render the joined view without a follow-up round-trip. The backend
-* already joins these in `listDestinations` — we now surface them on
-* the wire.
+*  - `tab`     — where the widget hosts. A widget that runs on the
+*                dashboard declares `tab:'dashboard'`; a device-tab
+*                widget declares the target device-detail tab id.
+*  - `subTab`  — optional sub-tab within `tab`.
+*  - `label`   — operator-facing label.
+*  - `order`   — ordering within `(tab, subTab)`.
+*  - `kind`    — always `'remote'` for widgets.
+*  - `remote`  — the MF remote `{ remoteName, exposedModule, componentKey }`.
 *
-* `lastSuccessAt` / `lastSuccessSizeBytes` are computed from each
-* location's `manifests.json` (newest archive). Optional — locations
-* with no archives yet leave them undefined.
+* Widget-only fields retained alongside the contribution core:
+*
+*  - `stableId`      — stable identity within the addon (the MF
+*                      `componentKey`; kept top-level so consumers have
+*                      a stable key without reaching into `remote`).
+*  - `description` / `icon` — picker metadata.
+*  - `bundle`        — entry filename inside the addon `dist/` dir; the
+*                      aggregator stamps a versioned `bundleUrl` from it.
+*  - `hosts`         — every host the widget supports (a widget can run
+*                      both on the dashboard and a device tab). `tab`
+*                      is the PRIMARY host; `hosts` is the full set the
+*                      picker filters on.
+*  - `requires`      — host-context requirements validated at mount.
+*  - `defaultSize` / `allowedSizes` / `defaultColumns` / `defaultRows`
+*                    — dashboard placement hints.
 */
-var BackupDestinationInfoSchema = object({
+var WidgetMetadataSchema = object({
+	/** Primary host tab — `'dashboard'`, `'device-tab'`, or a device-detail tab id. */
+	tab: string(),
+	/** Optional sub-tab within `tab`. */
+	subTab: string().optional(),
+	/** Operator-facing label. */
+	label: string(),
+	/** Ordering within `(tab, subTab)`, ascending. */
+	order: number().optional(),
+	/** Always `'remote'` — a widget is a Module Federation remote. */
+	kind: literal("remote"),
+	/** MF remote descriptor. */
+	remote: WidgetRemoteSchema,
+	/** Stable id within the addon — kebab-case. Equals `remote.componentKey`. */
+	stableId: string(),
+	description: string().optional(),
+	icon: string().optional(),
 	/**
-	* Sub-id within this addon. Convention `default` for single-
-	* destination addons; addons that host many (S3 with N buckets)
-	* pick stable per-bucket strings. The orchestrator stitches
-	* `<manifestId>:<subId>` for the wire format.
+	* Bundle filename inside the addon's `dist/` dir served at
+	* `/api/addon-widgets/<addonId>/<bundle>`. With Module Federation
+	* this is always `'remoteEntry.js'` — the value is kept on the
+	* metadata so the static-file route can compute an mtime-based
+	* cache-buster URL without a separate filesystem stat.
 	*/
-	subId: string(),
-	displayName: string(),
-	description: string().optional(),
-	kind: string(),
-	triggerSupported: boolean(),
-	restoreSupported: boolean()
-}).extend({
-	/** `<addonId>:<subId>` — globally-unique dispatch key. */
-	id: string(),
+	bundle: string(),
+	/** Every host the widget supports. The picker filters on this set. */
+	hosts: array(WidgetHostEnum).readonly(),
+	/** Required props the host must supply. Validated at `<WidgetSlot>` mount. */
+	requires: object({
+		deviceContext: boolean().default(false),
+		integrationContext: boolean().default(false)
+	}),
 	/**
-	* Manifest id of the owning addon. The Settings button on the
-	* destination card opens that addon's `globalSettingsSchema` panel.
+	* Loadable BEFORE authentication. The normal widget registry listing
+	* (`addon-widgets.listWidgets`) is auth-gated, so a pre-auth surface
+	* (the login page) cannot discover a widget through it. A widget that
+	* declares `preAuth: true` marks itself as safe to mount on a pre-auth
+	* screen — it is surfaced through the PUBLIC `auth.listLoginMethods`
+	* login-method contribution channel (see `login-method.cap.ts`) rather
+	* than the authenticated registry, and its bundle is served by the
+	* public `/api/addon-widgets/:addonId/*` static route. Defaults false.
 	*/
-	addonId: string(),
-	/** Operator-toggled enable flag from the destination-policy table. */
-	enabled: boolean(),
-	/** Operator-defined retention count (archives kept per destination). */
-	retentionCount: number(),
-	/** Operator-defined display label (overrides storage location displayName). */
-	label: string().optional(),
-	/** Newest-archive timestamp from `manifests.json`, or undefined. */
-	lastSuccessAt: number().optional(),
-	/** Newest-archive size from `manifests.json`, or undefined. */
-	lastSuccessSizeBytes: number().optional(),
-	/** Per-destination cron expression. Empty = manual-only (no schedule). */
-	cron: string().optional(),
-	/** ms-epoch of next computed firing for this destination's cron, if any. */
-	nextRunAt: number().optional(),
-	/** ms-epoch of last successful scheduled run (mirrors policy.lastRunAt). */
-	lastRunAt: number().optional()
+	preAuth: boolean().optional().default(false),
+	/** Dashboard placement HINTS (operator can override per instance). */
+	defaultSize: WidgetSizeEnum.default("md"),
+	allowedSizes: array(WidgetSizeEnum).readonly().default([
+		"sm",
+		"md",
+		"lg"
+	]),
+	defaultColumns: number().int().min(1).max(12).default(6),
+	defaultRows: number().int().min(1).max(12).default(1)
 });
+method(_void(), array(WidgetMetadataSchema).readonly());
 /**
-* Per-archive entry returned by `backup.listArchives({ destinationId })`.
-* Same shape the destination drill-in renders. Sourced from the per-
-* location `manifests.json` (no per-archive tarball read required).
+* `addon-widgets` — system-scoped singleton aggregator cap. Public-facing
+* surface that admin-ui consumes through `useAddonWidgetsListWidgets()`.
+*
+* The provider iterates every `addon-widgets-source` (collection)
+* provider and emits `EnrichedWidgetMetadata[]` enriched with versioned
+* `bundleUrl` strings pointing at
+* `/api/addon-widgets/<addonId>/<bundle>?v=<mtime>`. The filesystem
+* `mtime` cache-buster lets the browser pick up addon rebuilds without
+* manual reload — same scheme used by `addon-pages`.
+*
+* The hub-local builtin `addon-widgets-aggregator` (see
+* `@camstack/system/builtins/addon-widgets-aggregator`) registers the
+* provider. Splitting the public aggregator from the raw collection
+* keeps both ends in codegen — there's no hand-written wrapper.
 */
-var BackupArchiveEntrySchema = object({
-	id: string(),
-	filename: string(),
-	createdAt: number(),
-	sizeBytes: number(),
-	label: string().optional(),
-	/** Top-level locations included in the archive (db, addons, tls, …). */
-	locations: array(string()).readonly()
+var EnrichedWidgetMetadataSchema = WidgetMetadataSchema.extend({
+	addonId: string(),
+	bundleUrl: string()
 });
-var BackupEntrySchema = object({
+method(_void(), array(EnrichedWidgetMetadataSchema).readonly());
+/**
+* Alerts capability — collection-based internal alert system.
+*
+* Multiple providers can register. Each provider filters by EventBus category
+* and creates/updates alerts. The built-in Alert Center addon persists alerts
+* in the DB and serves them to the admin UI.
+*/
+var AlertSeveritySchema = _enum([
+	"info",
+	"success",
+	"warning",
+	"error"
+]);
+var AlertStatusSchema = _enum([
+	"active",
+	"in-progress",
+	"completed",
+	"failed",
+	"dismissed"
+]);
+var AlertSourceSchema = object({
+	type: string(),
+	id: string()
+});
+var AlertSchema = object({
 	id: string(),
-	/** Addon id of the destination that owns this backup (e.g. `local-backup`, `s3-backup`). */
-	destinationId: string().optional(),
-	label: string().optional(),
+	category: string(),
+	severity: AlertSeveritySchema,
+	title: string(),
+	message: string(),
+	status: AlertStatusSchema,
+	progress: number().optional(),
+	read: boolean(),
 	createdAt: number(),
-	sizeBytes: number(),
-	locations: array(string()).optional()
+	updatedAt: number(),
+	source: AlertSourceSchema.optional(),
+	metadata: record(string(), unknown()).optional()
 });
-var ArchiveEntrySchema = object({
-	path: string(),
-	kind: _enum([
-		"file",
-		"dir",
-		"symlink"
-	]),
-	sizeBytes: number(),
-	mtime: number()
+method(AlertSchema, _void(), { kind: "mutation" }), method(object({
+	alertId: string(),
+	patch: AlertSchema.partial()
+}), _void(), { kind: "mutation" }), method(object({
+	unreadOnly: boolean().optional(),
+	limit: number().optional()
+}).optional(), array(AlertSchema).readonly()), method(_void(), number()), method(object({ alertId: string() }), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(object({ alertId: string() }), _void(), { kind: "mutation" });
+DeviceType.Camera, method(object({ deviceId: number() }), custom()), object({
+	deviceId: number(),
+	rms: number(),
+	dbfs: number()
 });
-var ArchiveManifestSchema = object({
-	archiveVersion: literal(1),
-	createdAt: number(),
-	dataDir: string(),
-	locations: array(string()),
-	entries: array(ArchiveEntrySchema),
-	totalBytes: number(),
-	totalFiles: number()
+/** Shared Zod schemas used across detection capabilities. */
+/**
+* Canonical frame-format enum mirrored on `FrameFormat` in
+* `packages/types/src/types/io.ts`. Kept inline (vs imported) so the
+* Zod runtime schema and TypeScript type stay in sync at the call site
+* — adding a new format requires changing both this enum and the
+* `FrameFormat` type alias together.
+*/
+var FrameFormatSchema = _enum([
+	"jpeg",
+	"rgb",
+	"bgr",
+	"yuv420",
+	"gray"
+]);
+var FrameInputSchema = object({
+	data: custom(),
+	format: FrameFormatSchema,
+	width: number(),
+	height: number(),
+	timestamp: number()
 });
-var LocationStatSchema = object({
-	name: string(),
-	sizeBytes: number(),
-	fileCount: number(),
-	present: boolean()
+var BoundingBoxSchema = object({
+	x: number(),
+	y: number(),
+	w: number(),
+	h: number()
+});
+object({
+	class: string(),
+	originalClass: string(),
+	score: number(),
+	bbox: BoundingBoxSchema
 });
 /**
-* A backup schedule — the N:M "entry" that binds one cron cadence to a
-* SET of destination locations. Supersedes the per-location cron on
-* `BackupDestinationPolicy`: an operator creates a schedule, picks the
-* `backups` locations it should write to, and the orchestrator fans a
-* single archive out to all of them when the cron fires.
-*
-* `retentionCount` is per-schedule (D-decision 2026-07-28): every
-* location targeted by this schedule keeps this many archives from
-* this schedule's runs.
+* `data` carries the raw f32le bytes of the PCM samples (4 bytes per
+* sample, little-endian IEEE 754).  `Uint8Array` is the wire-safe choice
+* because `@msgpack/msgpack` serialises it as a MsgPack `bin` type that
+* round-trips losslessly over the UDS transport.  `Float32Array` is NOT
+* preserved — the encoder serialises it as `bin` (its raw bytes) but
+* the decoder returns `Uint8Array`, so treating a `Float32Array` as the
+* wire type causes receivers to read bytes as sample values, producing
+* wildly wrong RMS/dBFS results (~+43 dBFS instead of ≤0).
 *
-* `dataSources` optionally narrows which top-level state locations
-* (db, addons, tls, …) are archived; omitted = the orchestrator's
-* default full set.
+* Callers that need float arithmetic reconstruct the view with:
+*   `new Float32Array(chunk.data.buffer, chunk.data.byteOffset, chunk.data.byteLength / 4)`
 */
-var BackupScheduleSchema = object({
-	/** Stable id. Generated by the orchestrator on first upsert if absent. */
-	id: string(),
-	/** Operator-facing display name. */
-	label: string(),
-	/** 5-field POSIX cron. Empty = disabled cadence (kept for editing). */
-	cron: string(),
-	/** Master on/off toggle for the whole schedule. */
-	enabled: boolean(),
-	/** `backups`-location ids this schedule writes to (fan-out set). */
-	locationIds: array(string()).readonly(),
-	/** Archives kept per targeted location for this schedule. */
-	retentionCount: number().int().min(1).max(1e3),
-	/** Optional subset of source locations to include; omitted = all. */
-	dataSources: array(string()).readonly().optional(),
-	/** ms-epoch of last successful run. */
-	lastRunAt: number().optional(),
-	/** ms-epoch of next computed firing (read-only, filled on list). */
-	nextRunAt: number().optional()
+var AudioChunkInputSchema = object({
+	data: _instanceof(Uint8Array),
+	sampleRate: number(),
+	channels: number(),
+	timestamp: number(),
+	/** Originating device id — used by the classifier for per-camera concurrency tracking. */
+	deviceId: number().optional()
 });
-method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }), method(object({
-	/** Subset of registered `backup-destination` addon ids to write to. */
-	destinations: array(string()).optional(),
-	locations: array(string()).optional(),
-	label: string().optional(),
+var AudioLevelSchema = object({
+	rms: number(),
+	dbfs: number()
+});
+var AudioClassificationLabelSchema = object({
 	/**
-	* Per-run retention override applied to every targeted
-	* destination. Used by schedule-driven runs (per-entry
-	* retention). Omitted = each destination's own policy
-	* retention (manual runs).
+	* Primary display class. Depending on how the label was produced
+	* this is either the macro category (e.g. `dog`) or the raw
+	* backend label (e.g. `Dog bark`). Mirrors `class` on
+	* `SpatialDetection`.
 	*/
-	retentionCount: number().int().min(1).max(1e3).optional()
-}).optional(), array(BackupEntrySchema).readonly(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(BackupEntrySchema).readonly(), { auth: "admin" }), method(_void(), array(LocationStatSchema).readonly(), { auth: "admin" }), method(object({
-	destinationId: string(),
-	backupId: string()
-}), ArchiveManifestSchema.nullable(), { auth: "admin" }), method(object({
-	destinationId: string(),
-	backupId: string(),
+	className: string(),
 	/**
-	* Optional whitelist — only restore these top-level locations
-	* from the archive. Default = every location the archive
-	* carries (full restore). The boot-time apply hook reads
-	* this list and skips entries whose path doesn't start with
-	* any of them.
+	* Raw backend-native label the classifier actually emitted (e.g.
+	* `Dog bark` for YAMNet, `dog_bark` for Apple SoundAnalysis). For
+	* macro-aggregated entries this is the top raw contributor. Mirrors
+	* `originalClass` on `SpatialDetection`.
 	*/
-	locations: array(string()).optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	destinationId: string(),
-	backupId: string()
-}), _void(), {
+	originalClass: string().optional(),
+	score: number()
+});
+var AudioAnalysisResultSchema = object({
+	level: AudioLevelSchema,
+	classification: object({
+		labels: array(AudioClassificationLabelSchema).readonly(),
+		inferenceMs: number()
+	}).optional(),
+	timestamp: number()
+});
+var AudioAnalysisSettingsSchema = object({
+	minConfidence: number().min(0).max(1).default(.3),
+	allowedClasses: array(string()).default([])
+});
+var AudioClassificationResultSchema = object({
+	labels: array(AudioClassificationLabelSchema).readonly(),
+	rawLabels: array(AudioClassificationLabelSchema).readonly().optional(),
+	inferenceMs: number()
+});
+method(object({
+	chunk: AudioChunkInputSchema,
+	settings: AudioAnalysisSettingsSchema
+}), AudioAnalysisResultSchema.nullable(), { kind: "mutation" }), method(AudioChunkInputSchema, AudioClassificationResultSchema, { timeoutMs: 3e4 }), method(_void(), boolean()), method(_void(), _void(), { kind: "mutation" }), method(_void(), object({ backend: string() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ destinationId: string() }), array(BackupArchiveEntrySchema).readonly(), { auth: "admin" }), method(object({
-	locationId: string(),
-	enabled: boolean(),
-	retentionCount: number().int().min(1).max(1e3),
-	label: string().optional(),
-	/**
-	* Per-destination cron expression. Empty string clears the
-	* schedule (manual-only). Validated server-side via croner;
-	* malformed expressions reject the upsert with an actionable
-	* message.
+});
+var PcmSampleFormatSchema = _enum(["f32le", "s16le"]);
+var AudioCodecInfoSchema = object({
+	codec: string(),
+	canDecode: boolean(),
+	canEncode: boolean(),
+	label: string().optional()
+});
+var AudioDecodeSessionConfigSchema = object({
+	codec: string(),
+	sourceSampleRate: number().int().positive(),
+	sourceChannels: number().int().positive(),
+	extraData: _instanceof(Uint8Array).optional(),
+	targetSampleRate: number().int().positive(),
+	targetChannels: number().int().positive(),
+	targetFormat: PcmSampleFormatSchema.optional(),
+	idleMs: number().int().positive().optional(),
+	tag: string().optional()
+});
+var AudioEncodeSessionConfigSchema = object({
+	codec: string(),
+	sourceSampleRate: number().int().positive(),
+	sourceChannels: number().int().positive(),
+	sourceFormat: PcmSampleFormatSchema.optional(),
+	targetSampleRate: number().int().positive(),
+	targetChannels: number().int().positive(),
+	bitrateKbps: number().int().positive().optional(),
+	idleMs: number().int().positive().optional(),
+	tag: string().optional()
+});
+var AudioPcmChunkSchema = object({
+	data: _instanceof(Uint8Array),
+	sampleRate: number().int().positive(),
+	channels: number().int().positive(),
+	format: PcmSampleFormatSchema,
+	pts: number()
+});
+var AudioEncodedChunkSchema = object({
+	data: _instanceof(Uint8Array),
+	codec: string(),
+	pts: number(),
+	frameComplete: boolean()
+});
+var SessionInventoryEntrySchema = object({
+	sessionId: string(),
+	kind: _enum(["decode", "encode"]),
+	codec: string(),
+	sourceSampleRate: number(),
+	sourceChannels: number(),
+	targetSampleRate: number(),
+	targetChannels: number(),
+	format: PcmSampleFormatSchema,
+	tag: string().optional(),
+	createdAtMs: number(),
+	lastActivityMs: number(),
+	framesIn: number(),
+	framesOut: number()
+});
+method(_void(), array(AudioCodecInfoSchema).readonly()), method(object({
+	codec: string(),
+	kind: _enum(["decode", "encode"])
+}), boolean()), method(AudioDecodeSessionConfigSchema, object({
+	sessionId: string(),
+	nodeId: string()
+}), { kind: "mutation" }), method(AudioEncodeSessionConfigSchema, object({
+	sessionId: string(),
+	nodeId: string()
+}), { kind: "mutation" }), method(object({
+	sessionId: string(),
+	nodeId: string().optional()
+}), _void(), { kind: "mutation" }), method(object({
+	sessionId: string(),
+	nodeId: string().optional(),
+	data: _instanceof(Uint8Array),
+	/** Source PTS in milliseconds. Synthesised when omitted. */
+	pts: number().optional()
+}), _void(), { kind: "mutation" }), method(object({
+	sessionId: string(),
+	nodeId: string().optional(),
+	maxCount: number().int().positive().default(8)
+}), array(AudioPcmChunkSchema)), method(object({
+	sessionId: string(),
+	nodeId: string().optional(),
+	data: _instanceof(Uint8Array),
+	/** Source PTS in milliseconds. */
+	pts: number().optional()
+}), _void(), { kind: "mutation" }), method(object({
+	sessionId: string(),
+	nodeId: string().optional(),
+	maxCount: number().int().positive().default(8)
+}), array(AudioEncodedChunkSchema)), method(object({
+	sessionId: string(),
+	nodeId: string().optional()
+}), array(AudioEncodedChunkSchema), { kind: "mutation" }), method(_void(), array(SessionInventoryEntrySchema).readonly());
+var AuthResultSchema = object({
+	userId: string(),
+	username: string(),
+	email: string().optional(),
+	displayName: string().optional(),
+	/**
+	* Whether the authenticating user is an admin. The auth-provider
+	* surface returns this so the server's login flow can mint a JWT
+	* with the correct bypass flag. Non-admin users authenticated via
+	* an external IdP still need their scopes assigned by an admin via
+	* `setUserScopes` — the SSO flow doesn't carry permissions.
 	*/
-	cron: string().optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	cron: string(),
-	count: number().int().min(1).max(20).optional()
-}), object({
-	ok: boolean(),
-	error: string().optional(),
-	nextRuns: array(number()).readonly()
-})), method(_void(), array(BackupScheduleSchema).readonly(), { auth: "admin" }), method(object({
-	id: string().optional(),
-	label: string(),
-	cron: string(),
-	enabled: boolean(),
-	locationIds: array(string()).readonly(),
-	retentionCount: number().int().min(1).max(1e3),
-	dataSources: array(string()).readonly().optional()
-}), BackupScheduleSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
+	isAdmin: boolean().default(false)
 });
+method(object({
+	username: string(),
+	password: string()
+}), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
-* `broker` — unified pub/sub broker registry, system-scoped collection.
-*
-* The cap models any kind-tagged message broker the user wants to
-* register and that other addons might consume. The first two kinds
-* are MQTT (mosquitto / aedes embedded / cloud bridge) and
-* Home Assistant (HA WebSocket — subscribe_entities + call_service).
-* Future kinds (Zigbee2MQTT bridge, ZHA, KNX, Telegram, …) plug in
-* the same surface.
-*
-* Why one cap, not one cap per kind:
-*   - The integrations page wants a single table of "every broker"
-*     across kinds; a unified cap drives it without join logic.
-*   - Generic admin operations (add / remove / test / status) are
-*     identical across kinds — duplicating them per cap was busywork.
-*   - The `network-access` cap precedent: same interface, many
-*     `providerKind: 'ingress'` implementations (Tailscale, ngrok, …).
-*
-* What stays kind-specific:
-*   - `getBrokerConfig` payload (kind decides whether it returns
-*     mqtt URL+creds, HA baseUrl+token, …) — typed as
-*     `Record<string, unknown>` at the wire; consumers narrow.
-*   - `publish` / `subscribe` / `getState` arguments (target / filter /
-*     key) — also typed as `Record<string, unknown>` so each kind can
-*     evolve its surface (MQTT topic+qos vs HA entity_id+domain)
-*     without rebreaking the cap signature.
-*   - `add` `settings` payload (different fields per kind, validated by
-*     the kind-specific provider).
+* Orchestrator-side destination metadata. The orchestrator computes
+* `id = <addonId>:<subId>` from its provider lookup so consumers
+* (admin UI, restore flow) see one canonical key.
 *
-* Bidirectionality:
-*   - `publish` is RPC — synchronous result (provider-defined).
-*   - `subscribe` returns a subscription handle; the actual message
-*     stream flows over the typed event-bus as `broker.message` events
-*     keyed by `(brokerId, subscriptionId)`. Consumers filter in their
-*     event handler. Subscriptions persist across reconnects — the
-*     provider re-subscribes upstream after a transport drop.
+* Phase 4 (admin UI redesign) adds the per-destination policy fields
+* (`enabled`, `retentionCount`, `label`) so the destinations table can
+* render the joined view without a follow-up round-trip. The backend
+* already joins these in `listDestinations` — we now surface them on
+* the wire.
 *
-* Why event-bus push (not a subscription RPC stream):
-*   - Matches the rest of CamStack's D8 contract — events for telemetry,
-*     RPC for loss-is-a-bug. Broker messages are telemetry (a single
-*     drop is recoverable via `getState({key})`).
-*   - Frees `broker.subscribe` from holding a long-lived RPC channel.
-*   - Cross-process: events already route through `$event-bus`; no
-*     per-broker wire-shaping needed.
+* `lastSuccessAt` / `lastSuccessSizeBytes` are computed from each
+* location's `manifests.json` (newest archive). Optional — locations
+* with no archives yet leave them undefined.
 */
-var BrokerStatusEnum = _enum([
-	"connected",
-	"disconnected",
-	"connecting",
-	"auth-failed",
-	"unreachable",
-	"error"
-]);
-var BrokerInfoSchema$1 = object({
-	/** Stable broker id. Persisted; survives addon restarts. */
+var BackupDestinationInfoSchema = object({
+	/**
+	* Sub-id within this addon. Convention `default` for single-
+	* destination addons; addons that host many (S3 with N buckets)
+	* pick stable per-bucket strings. The orchestrator stitches
+	* `<manifestId>:<subId>` for the wire format.
+	*/
+	subId: string(),
+	displayName: string(),
+	description: string().optional(),
+	kind: string(),
+	triggerSupported: boolean(),
+	restoreSupported: boolean()
+}).extend({
+	/** `<addonId>:<subId>` — globally-unique dispatch key. */
 	id: string(),
-	/** Addon id of the provider that OWNS this broker.
-	*
-	*  The `broker` cap is a system-scoped collection: several addons
-	*  register a `broker` provider, each owning a DISJOINT set of
-	*  brokers (mqtt-broker owns `mqtt_*`, provider-homeassistant owns
-	*  `ha_*`). A broker therefore belongs to exactly one addon — like a
-	*  device belongs to one integration. The admin UI threads this id
-	*  back as the `{ addonId }` system-collection selector on every
-	*  id-keyed call (`get` / `getSettings` / `setSettings` / `remove` /
-	*  `testConnection`), so the call routes to the OWNING provider
-	*  instead of defaulting to the first-registered one. */
+	/**
+	* Manifest id of the owning addon. The Settings button on the
+	* destination card opens that addon's `globalSettingsSchema` panel.
+	*/
 	addonId: string(),
-	/** Human-readable name (operator-chosen at add-time). */
-	name: string(),
-	/** Provider-defined kind tag — `mqtt` / `home-assistant` / future. */
-	kind: string(),
-	status: BrokerStatusEnum,
-	/** Free-form provider-specific info (HA version, MQTT broker
-	*  flavour, latency, mTLS active, …). */
-	info: record(string(), unknown()),
-	/** Ms epoch of the last connection probe / status update. */
-	lastCheckedAt: number().nullable(),
-	/** Last error message, when `status` indicates failure. */
-	error: string().nullable()
-});
-var RegistryStatusSchema = object({
-	brokerCount: number().int().nonnegative(),
-	connectedCount: number().int().nonnegative()
-});
-/**
-* One entry per `broker` provider — which addon provides which broker
-* kind(s). The unified create picker reads this to know, for each
-* (addonId, kind) pair the operator can pick, where to route the
-* follow-up `getSettingsSchema` / `testSettings` / `add` calls (via the
-* `{ addonId }` selector). A provider only advertises a kind here when
-* it implements `getSettingsSchema` for that kind (so the picker never
-* offers a kind whose creation form can't be rendered).
-*/
-var BrokerProviderInfoSchema = object({
-	/** Addon id of the `broker` provider this entry describes. */
-	addonId: string(),
-	/** Broker kinds this provider can create, with a display label. */
-	kinds: array(object({
-		kind: string(),
-		label: string()
-	}))
+	/** Operator-toggled enable flag from the destination-policy table. */
+	enabled: boolean(),
+	/** Operator-defined retention count (archives kept per destination). */
+	retentionCount: number(),
+	/** Operator-defined display label (overrides storage location displayName). */
+	label: string().optional(),
+	/** Newest-archive timestamp from `manifests.json`, or undefined. */
+	lastSuccessAt: number().optional(),
+	/** Newest-archive size from `manifests.json`, or undefined. */
+	lastSuccessSizeBytes: number().optional(),
+	/** Per-destination cron expression. Empty = manual-only (no schedule). */
+	cron: string().optional(),
+	/** ms-epoch of next computed firing for this destination's cron, if any. */
+	nextRunAt: number().optional(),
+	/** ms-epoch of last successful scheduled run (mirrors policy.lastRunAt). */
+	lastRunAt: number().optional()
 });
-var ListInputSchema = object({ 
-/** Optional kind filter — `list({kind:'home-assistant'})` returns
-*  only HA brokers. Omit to list every broker. */
-kind: string().optional() });
-var GetInputSchema = object({ id: string() });
-var AddInputSchema = object({
-	kind: string().min(1),
-	name: string().min(1),
-	/**
-	* ADOPT an existing id instead of minting a new one.
-	*
-	* Written the day this cost an outage. A broker's id is not a detail: HA
-	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
-	* lost from config and re-added as `ha_001` leaves every one of its devices
-	* bound to a broker that no longer exists. Re-entering the password under the
-	* ORIGINAL id turns a multi-step device migration back into re-entering a
-	* password.
-	*
-	* A provider MUST refuse an id that is already in use — adopting a live
-	* broker's id would silently take it over.
-	*/
-	id: string().min(1).optional(),
-	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
-	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
-	*  branch on receipt — invalid shape rejects the add. */
-	settings: record(string(), unknown())
+/**
+* Per-archive entry returned by `backup.listArchives({ destinationId })`.
+* Same shape the destination drill-in renders. Sourced from the per-
+* location `manifests.json` (no per-archive tarball read required).
+*/
+var BackupArchiveEntrySchema = object({
+	id: string(),
+	filename: string(),
+	createdAt: number(),
+	sizeBytes: number(),
+	label: string().optional(),
+	/** Top-level locations included in the archive (db, addons, tls, …). */
+	locations: array(string()).readonly()
 });
-var AddResultSchema = object({ id: string() });
-var RemoveInputSchema = object({ id: string() });
-var TestConnectionResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number().nonnegative()
-}), object({
-	ok: literal(false),
-	error: string()
-})]);
-var SettingsRecordSchema$1 = record(string(), unknown());
-var SettingsSchemaInputSchema = object({ kind: string() });
-var TestSettingsInputSchema = object({
-	kind: string(),
-	settings: SettingsRecordSchema$1
+var BackupEntrySchema = object({
+	id: string(),
+	/** Addon id of the destination that owns this backup (e.g. `local-backup`, `s3-backup`). */
+	destinationId: string().optional(),
+	label: string().optional(),
+	createdAt: number(),
+	sizeBytes: number(),
+	locations: array(string()).optional()
 });
-var TestSettingsResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number().nonnegative().optional()
-}).strict(), object({
-	ok: literal(false),
-	error: string()
-})]);
-var SettingsSchemaResultSchema = unknown().nullable();
-var PublishInputSchema = object({
-	brokerId: string(),
-	/** Kind-specific routing target.
-	*  MQTT: `{ topic: string, qos?: 0|1|2, retain?: boolean }`.
-	*  HA:   `{ domain: string, service: string, entityId?: string, area?: string }`. */
-	target: record(string(), unknown()),
-	/** Kind-specific payload.
-	*  MQTT: raw string / number / object (provider serialises).
-	*  HA:   service-call `data` object (transition, brightness, …). */
-	payload: unknown().optional()
+var ArchiveEntrySchema = object({
+	path: string(),
+	kind: _enum([
+		"file",
+		"dir",
+		"symlink"
+	]),
+	sizeBytes: number(),
+	mtime: number()
 });
-var SubscribeInputSchema = object({
-	brokerId: string(),
-	/** Kind-specific filter.
-	*  MQTT: `{ topic: string, qos?: 0|1|2 }` — topic can include wildcards.
-	*  HA:   `{ entityIds: string[] }` or `{ domain: string }`. */
-	filter: record(string(), unknown())
+var ArchiveManifestSchema = object({
+	archiveVersion: literal(1),
+	createdAt: number(),
+	dataDir: string(),
+	locations: array(string()),
+	entries: array(ArchiveEntrySchema),
+	totalBytes: number(),
+	totalFiles: number()
 });
-var SubscribeResultSchema = object({ 
-/** Stable subscription id. Used to unsubscribe and to filter the
-*  matching `broker.message` events on the bus. */
-subscriptionId: string() });
-var UnsubscribeInputSchema = object({
-	brokerId: string(),
-	subscriptionId: string()
+var LocationStatSchema = object({
+	name: string(),
+	sizeBytes: number(),
+	fileCount: number(),
+	present: boolean()
 });
-var GetStateInputSchema = object({
-	brokerId: string(),
-	/** Kind-specific lookup key.
-	*  MQTT: topic string (returns the last retained message).
-	*  HA:   entity_id (returns the cached entity state). */
-	key: string()
+/**
+* A backup schedule — the N:M "entry" that binds one cron cadence to a
+* SET of destination locations. Supersedes the per-location cron on
+* `BackupDestinationPolicy`: an operator creates a schedule, picks the
+* `backups` locations it should write to, and the orchestrator fans a
+* single archive out to all of them when the cron fires.
+*
+* `retentionCount` is per-schedule (D-decision 2026-07-28): every
+* location targeted by this schedule keeps this many archives from
+* this schedule's runs.
+*
+* `dataSources` optionally narrows which top-level state locations
+* (db, addons, tls, …) are archived; omitted = the orchestrator's
+* default full set.
+*/
+var BackupScheduleSchema = object({
+	/** Stable id. Generated by the orchestrator on first upsert if absent. */
+	id: string(),
+	/** Operator-facing display name. */
+	label: string(),
+	/** 5-field POSIX cron. Empty = disabled cadence (kept for editing). */
+	cron: string(),
+	/** Master on/off toggle for the whole schedule. */
+	enabled: boolean(),
+	/** `backups`-location ids this schedule writes to (fan-out set). */
+	locationIds: array(string()).readonly(),
+	/** Archives kept per targeted location for this schedule. */
+	retentionCount: number().int().min(1).max(1e3),
+	/** Optional subset of source locations to include; omitted = all. */
+	dataSources: array(string()).readonly().optional(),
+	/** ms-epoch of last successful run. */
+	lastRunAt: number().optional(),
+	/** ms-epoch of next computed firing (read-only, filled on list). */
+	nextRunAt: number().optional()
 });
-method(ListInputSchema, array(BrokerInfoSchema$1)), method(GetInputSchema, BrokerInfoSchema$1.nullable()), method(_void(), array(BrokerProviderInfoSchema), { auth: "admin" }), method(AddInputSchema, AddResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(RemoveInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(GetInputSchema, TestConnectionResultSchema, {
+method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }), method(object({
+	/** Subset of registered `backup-destination` addon ids to write to. */
+	destinations: array(string()).optional(),
+	locations: array(string()).optional(),
+	label: string().optional(),
+	/**
+	* Per-run retention override applied to every targeted
+	* destination. Used by schedule-driven runs (per-entry
+	* retention). Omitted = each destination's own policy
+	* retention (manual runs).
+	*/
+	retentionCount: number().int().min(1).max(1e3).optional()
+}).optional(), array(BackupEntrySchema).readonly(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }), method(object({
-	id: string(),
-	settings: SettingsRecordSchema$1
+}), method(_void(), array(BackupEntrySchema).readonly(), { auth: "admin" }), method(_void(), array(LocationStatSchema).readonly(), { auth: "admin" }), method(object({
+	destinationId: string(),
+	backupId: string()
+}), ArchiveManifestSchema.nullable(), { auth: "admin" }), method(object({
+	destinationId: string(),
+	backupId: string(),
+	/**
+	* Optional whitelist — only restore these top-level locations
+	* from the archive. Default = every location the archive
+	* carries (full restore). The boot-time apply hook reads
+	* this list and skips entries whose path doesn't start with
+	* any of them.
+	*/
+	locations: array(string()).optional()
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }), method(SettingsSchemaInputSchema, SettingsSchemaResultSchema, { auth: "admin" }), method(TestSettingsInputSchema, TestSettingsResultSchema, {
+}), method(object({
+	destinationId: string(),
+	backupId: string()
+}), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(PublishInputSchema, unknown(), {
+}), method(object({ destinationId: string() }), array(BackupArchiveEntrySchema).readonly(), { auth: "admin" }), method(object({
+	locationId: string(),
+	enabled: boolean(),
+	retentionCount: number().int().min(1).max(1e3),
+	label: string().optional(),
+	/**
+	* Per-destination cron expression. Empty string clears the
+	* schedule (manual-only). Validated server-side via croner;
+	* malformed expressions reject the upsert with an actionable
+	* message.
+	*/
+	cron: string().optional()
+}), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(SubscribeInputSchema, SubscribeResultSchema, {
+}), method(object({
+	cron: string(),
+	count: number().int().min(1).max(20).optional()
+}), object({
+	ok: boolean(),
+	error: string().optional(),
+	nextRuns: array(number()).readonly()
+})), method(_void(), array(BackupScheduleSchema).readonly(), { auth: "admin" }), method(object({
+	id: string().optional(),
+	label: string(),
+	cron: string(),
+	enabled: boolean(),
+	locationIds: array(string()).readonly(),
+	retentionCount: number().int().min(1).max(1e3),
+	dataSources: array(string()).readonly().optional()
+}), BackupScheduleSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(UnsubscribeInputSchema, _void(), {
+}), method(object({ id: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(GetStateInputSchema, unknown().nullable()), method(_void(), RegistryStatusSchema);
-DeviceType.Camera;
+});
+/**
+* `broker` — unified pub/sub broker registry, system-scoped collection.
+*
+* The cap models any kind-tagged message broker the user wants to
+* register and that other addons might consume. The first two kinds
+* are MQTT (mosquitto / aedes embedded / cloud bridge) and
+* Home Assistant (HA WebSocket — subscribe_entities + call_service).
+* Future kinds (Zigbee2MQTT bridge, ZHA, KNX, Telegram, …) plug in
+* the same surface.
+*
+* Why one cap, not one cap per kind:
+*   - The integrations page wants a single table of "every broker"
+*     across kinds; a unified cap drives it without join logic.
+*   - Generic admin operations (add / remove / test / status) are
+*     identical across kinds — duplicating them per cap was busywork.
+*   - The `network-access` cap precedent: same interface, many
+*     `providerKind: 'ingress'` implementations (Tailscale, ngrok, …).
+*
+* What stays kind-specific:
+*   - `getBrokerConfig` payload (kind decides whether it returns
+*     mqtt URL+creds, HA baseUrl+token, …) — typed as
+*     `Record<string, unknown>` at the wire; consumers narrow.
+*   - `publish` / `subscribe` / `getState` arguments (target / filter /
+*     key) — also typed as `Record<string, unknown>` so each kind can
+*     evolve its surface (MQTT topic+qos vs HA entity_id+domain)
+*     without rebreaking the cap signature.
+*   - `add` `settings` payload (different fields per kind, validated by
+*     the kind-specific provider).
+*
+* Bidirectionality:
+*   - `publish` is RPC — synchronous result (provider-defined).
+*   - `subscribe` returns a subscription handle; the actual message
+*     stream flows over the typed event-bus as `broker.message` events
+*     keyed by `(brokerId, subscriptionId)`. Consumers filter in their
+*     event handler. Subscriptions persist across reconnects — the
+*     provider re-subscribes upstream after a transport drop.
+*
+* Why event-bus push (not a subscription RPC stream):
+*   - Matches the rest of CamStack's D8 contract — events for telemetry,
+*     RPC for loss-is-a-bug. Broker messages are telemetry (a single
+*     drop is recoverable via `getState({key})`).
+*   - Frees `broker.subscribe` from holding a long-lived RPC channel.
+*   - Cross-process: events already route through `$event-bus`; no
+*     per-broker wire-shaping needed.
+*/
+var BrokerStatusEnum = _enum([
+	"connected",
+	"disconnected",
+	"connecting",
+	"auth-failed",
+	"unreachable",
+	"error"
+]);
+var BrokerInfoSchema$1 = object({
+	/** Stable broker id. Persisted; survives addon restarts. */
+	id: string(),
+	/** Addon id of the provider that OWNS this broker.
+	*
+	*  The `broker` cap is a system-scoped collection: several addons
+	*  register a `broker` provider, each owning a DISJOINT set of
+	*  brokers (mqtt-broker owns `mqtt_*`, provider-homeassistant owns
+	*  `ha_*`). A broker therefore belongs to exactly one addon — like a
+	*  device belongs to one integration. The admin UI threads this id
+	*  back as the `{ addonId }` system-collection selector on every
+	*  id-keyed call (`get` / `getSettings` / `setSettings` / `remove` /
+	*  `testConnection`), so the call routes to the OWNING provider
+	*  instead of defaulting to the first-registered one. */
+	addonId: string(),
+	/** Human-readable name (operator-chosen at add-time). */
+	name: string(),
+	/** Provider-defined kind tag — `mqtt` / `home-assistant` / future. */
+	kind: string(),
+	status: BrokerStatusEnum,
+	/** Free-form provider-specific info (HA version, MQTT broker
+	*  flavour, latency, mTLS active, …). */
+	info: record(string(), unknown()),
+	/** Ms epoch of the last connection probe / status update. */
+	lastCheckedAt: number().nullable(),
+	/** Last error message, when `status` indicates failure. */
+	error: string().nullable()
+});
+var RegistryStatusSchema = object({
+	brokerCount: number().int().nonnegative(),
+	connectedCount: number().int().nonnegative()
+});
+/**
+* One entry per `broker` provider — which addon provides which broker
+* kind(s). The unified create picker reads this to know, for each
+* (addonId, kind) pair the operator can pick, where to route the
+* follow-up `getSettingsSchema` / `testSettings` / `add` calls (via the
+* `{ addonId }` selector). A provider only advertises a kind here when
+* it implements `getSettingsSchema` for that kind (so the picker never
+* offers a kind whose creation form can't be rendered).
+*/
+var BrokerProviderInfoSchema = object({
+	/** Addon id of the `broker` provider this entry describes. */
+	addonId: string(),
+	/** Broker kinds this provider can create, with a display label. */
+	kinds: array(object({
+		kind: string(),
+		label: string()
+	}))
+});
+var ListInputSchema = object({ 
+/** Optional kind filter — `list({kind:'home-assistant'})` returns
+*  only HA brokers. Omit to list every broker. */
+kind: string().optional() });
+var GetInputSchema = object({ id: string() });
+var AddInputSchema = object({
+	kind: string().min(1),
+	name: string().min(1),
+	/**
+	* ADOPT an existing id instead of minting a new one.
+	*
+	* Written the day this cost an outage. A broker's id is not a detail: HA
+	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
+	* lost from config and re-added as `ha_001` leaves every one of its devices
+	* bound to a broker that no longer exists. Re-entering the password under the
+	* ORIGINAL id turns a multi-step device migration back into re-entering a
+	* password.
+	*
+	* A provider MUST refuse an id that is already in use — adopting a live
+	* broker's id would silently take it over.
+	*/
+	id: string().min(1).optional(),
+	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
+	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
+	*  branch on receipt — invalid shape rejects the add. */
+	settings: record(string(), unknown())
+});
+var AddResultSchema = object({ id: string() });
+var RemoveInputSchema = object({ id: string() });
+var TestConnectionResultSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	latencyMs: number().nonnegative()
+}), object({
+	ok: literal(false),
+	error: string()
+})]);
+var SettingsRecordSchema$1 = record(string(), unknown());
+var SettingsSchemaInputSchema = object({ kind: string() });
+var TestSettingsInputSchema = object({
+	kind: string(),
+	settings: SettingsRecordSchema$1
+});
+var TestSettingsResultSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	latencyMs: number().nonnegative().optional()
+}).strict(), object({
+	ok: literal(false),
+	error: string()
+})]);
+var SettingsSchemaResultSchema = unknown().nullable();
+var PublishInputSchema = object({
+	brokerId: string(),
+	/** Kind-specific routing target.
+	*  MQTT: `{ topic: string, qos?: 0|1|2, retain?: boolean }`.
+	*  HA:   `{ domain: string, service: string, entityId?: string, area?: string }`. */
+	target: record(string(), unknown()),
+	/** Kind-specific payload.
+	*  MQTT: raw string / number / object (provider serialises).
+	*  HA:   service-call `data` object (transition, brightness, …). */
+	payload: unknown().optional()
+});
+var SubscribeInputSchema = object({
+	brokerId: string(),
+	/** Kind-specific filter.
+	*  MQTT: `{ topic: string, qos?: 0|1|2 }` — topic can include wildcards.
+	*  HA:   `{ entityIds: string[] }` or `{ domain: string }`. */
+	filter: record(string(), unknown())
+});
+var SubscribeResultSchema = object({ 
+/** Stable subscription id. Used to unsubscribe and to filter the
+*  matching `broker.message` events on the bus. */
+subscriptionId: string() });
+var UnsubscribeInputSchema = object({
+	brokerId: string(),
+	subscriptionId: string()
+});
+var GetStateInputSchema = object({
+	brokerId: string(),
+	/** Kind-specific lookup key.
+	*  MQTT: topic string (returns the last retained message).
+	*  HA:   entity_id (returns the cached entity state). */
+	key: string()
+});
+method(ListInputSchema, array(BrokerInfoSchema$1)), method(GetInputSchema, BrokerInfoSchema$1.nullable()), method(_void(), array(BrokerProviderInfoSchema), { auth: "admin" }), method(AddInputSchema, AddResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(RemoveInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(GetInputSchema, TestConnectionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }), method(object({
+	id: string(),
+	settings: SettingsRecordSchema$1
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }), method(SettingsSchemaInputSchema, SettingsSchemaResultSchema, { auth: "admin" }), method(TestSettingsInputSchema, TestSettingsResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(PublishInputSchema, unknown(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(SubscribeInputSchema, SubscribeResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(UnsubscribeInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(GetStateInputSchema, unknown().nullable()), method(_void(), RegistryStatusSchema);
+DeviceType.Camera;
 /** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = _enum([
 	"webrtc",
@@ -11708,7 +12482,7 @@ DeviceType.Camera, method(object({
 * Why: pub/sub routing over the system event-bus loses fidelity
 * (callback shape, QoS guarantees, will/retain semantics) and adds
 * refcount bookkeeping that addons would rather own themselves. The
-* canonical consumer (`addon-export-ha-mqtt`) needs raw `mqtt.js`
+* canonical consumer needs raw `mqtt.js`
 * features anyway — give it the connection config, get out of the way.
 *
 * Consumer flow:
@@ -14248,8 +15022,26 @@ var TrackSchema = object({
 	/** Periodic snapshots at snapshotIntervalMs cadence (subject to
 	*  saveThumbnails policy). */
 	snapshots: array(TrackSnapshotSchema).readonly(),
-	/** Deduplicated zones the track has entered at least once. */
+	/** Deduplicated zones the track has entered at least once. Zone IDS. */
 	zonesVisited: array(string()).readonly(),
+	/**
+	* Human NAMES for {@link zonesVisited}, resolved at READ time against the
+	* `zones` capability.
+	*
+	* `zonesVisited` persists ids (`cfeec78c-8d69-…`), which no operator can type
+	* and no card can render — so every free-text search surface was structurally
+	* unable to answer "show me the tracks in Uscio", and did not fail loudly, it
+	* just returned nothing. Resolving here rather than in each client keeps ONE
+	* derivation and costs the clients no extra call (the `zones` cap is
+	* per-device, so a client-side resolve would be a per-camera fan-out on a
+	* surface built to avoid exactly that).
+	*
+	* Resolved, never invented: a zone deleted since the track was written has no
+	* name and is DROPPED, so this array can be shorter than `zonesVisited` — the
+	* two are not positionally aligned. Absent when the track visited no zone, or
+	* when the zone catalogue could not be read.
+	*/
+	zoneNames: array(string()).readonly().optional(),
 	/** Deduplicated set of detector classes observed for this track over its
 	*  life (a track may be reclassified, e.g. person→vehicle). Absent on
 	*  legacy rows written before class accumulation shipped. */
@@ -16319,6 +17111,23 @@ var CameraRecordingStatusSchema = object({
 	active: boolean(),
 	storageBytes: number()
 });
+/** One stage of the fan-out that could NOT be read, and how long it cost. */
+var CameraStatusDegradationSchema = object({
+	stage: _enum([
+		"source",
+		"broker",
+		"detection",
+		"recording",
+		"switches"
+	]),
+	reason: _enum([
+		"timeout",
+		"error",
+		"partial"
+	]),
+	/** Wall-clock ms spent on the stage before it was abandoned. */
+	elapsedMs: number()
+});
 /**
 * Aggregated per-camera pipeline status — server-composed, single call.
 *
@@ -16349,9 +17158,28 @@ var CameraStatusSchema = object({
 	* differently — a quiet camera that looks identical to a dead one is the
 	* silence-reads-as-never-happened trap this repo keeps paying for.
 	*
-	* Empty when nothing is off. Never contains a switch no provider offers.
+	* Empty when nothing is off, and never contains a switch no provider offers
+	* — but an empty list is only a POSITIVE claim when `degraded` does not name
+	* `'switches'`. When it does, the switch set could not be read and nothing
+	* here may be rendered as "the operator turned nothing off": that is the
+	* D62 failure (a camera we could not read painted as broken) in the very
+	* field that exists to prevent it.
 	*/
 	switchedOff: array(CameraSwitchIdSchema).readonly(),
+	/**
+	* Stages of the bounded fan-out that were CUT SHORT — a timeout or a
+	* rejection — and whose block is therefore `null` because we could not
+	* READ it, not because there is nothing there.
+	*
+	* Without this, three different facts arrive as the same `null`: "the stage
+	* timed out", "the stage failed", and "this camera legitimately has no
+	* decoder / no recording". Every surface that draws a conclusion from a null
+	* block (or from an empty `switchedOff`) must consult this first; a stage
+	* named here supports no conclusion at all, only "unknown".
+	*
+	* Empty on a clean read — the overwhelmingly common case.
+	*/
+	degraded: array(CameraStatusDegradationSchema).readonly(),
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: number()
 });
@@ -22825,809 +23653,180 @@ DeviceType.Weather;
 * Counts are derived from the analytics tracker (tracked detections
 * with stable trackIds), not raw detector hits — this filters out
 * one-off detector flickers and gives counts that match what the user
-* sees on the live overlay.
-*
-* Overlap policy: a detection that intersects two zones counts in
-* BOTH zones' `byClass` and `totalObjects` (count-in-each). The
-* `frame` aggregate de-duplicates trivially since it's frame-wide.
-* `unzoned` counts only detections that landed in zero zones.
-*/
-var PerScopeBreakdownSchema = object({
-	/** Total tracked objects in this scope (frame / zone / unzoned). */
-	totalObjects: number().int().nonnegative(),
-	/** Per-class count. Keys are macro class names (e.g. `person`, `car`). */
-	byClass: record(string(), number().int().nonnegative())
-});
-var ZoneScopeBreakdownSchema = PerScopeBreakdownSchema.extend({
-	zoneId: string(),
-	zoneName: string(),
-	/** TrackIds of objects currently inside this zone — for cross-reference
-	*  with the per-track detail panel and live overlay. */
-	trackIds: array(string()).readonly()
-});
-/**
-* A parked ("stationary") object surfaced alongside occupancy — an object that
-* settled and stopped moving. It is NO LONGER a tracked object (the tracker was
-* told to forget it so it stops re-spawning tracks/events), but it IS still
-* physically present, so it keeps counting toward `frame` occupancy and is
-* listed here so the UI can show it in a dedicated "Stationary" section instead
-* of flooding the live event feed.
-*/
-var StationaryObjectSchema = object({
-	id: string(),
-	className: string(),
-	bbox: object({
-		x: number(),
-		y: number(),
-		w: number(),
-		h: number()
-	}),
-	frameWidth: number().int().nonnegative(),
-	frameHeight: number().int().nonnegative(),
-	/** When the source track was first seen. */
-	firstSeenAt: number().int(),
-	/** When the object was recognised as parked (promotion time). */
-	becameStationaryAt: number().int(),
-	/** Last frame a detection confirmed the object is still there. */
-	lastConfirmedAt: number().int(),
-	/** Enrichment label carried from the source track (identity / plate). */
-	label: string().optional(),
-	/** Native-resolution key-frame media key for the parked object's best image. */
-	keyFrameMediaKey: string().optional()
-});
-var CameraOccupancySnapshotSchema = object({
-	/** Frame timestamp of the inference result that produced this snapshot. */
-	ts: number().int(),
-	/** Frame width/height in pixels — let the UI normalize bbox coords. */
-	frameWidth: number().int().nonnegative(),
-	frameHeight: number().int().nonnegative(),
-	/** Per-zone breakdown — one entry per defined zone (user + onboard). */
-	zones: array(ZoneScopeBreakdownSchema).readonly(),
-	/** Frame-wide aggregate (everywhere, regardless of zone membership).
-	*  INCLUDES currently-confirmed stationary objects (they are still present). */
-	frame: PerScopeBreakdownSchema,
-	/** Detections that landed outside every zone. Empty when no zones defined. */
-	unzoned: PerScopeBreakdownSchema,
-	/** Parked objects on this camera (additive — absent on legacy snapshots).
-	*  Surfaced separately so the UI shows them in a dedicated section rather
-	*  than as repeated tracks/events. */
-	stationaryObjects: array(StationaryObjectSchema).readonly().optional()
-});
-/**
-* Time-series resolution. The history methods return one bucket per
-* step over the requested range. Smaller resolutions cost more
-* memory + bandwidth; bound to discrete steps so caller cannot ask
-* for arbitrary fractional buckets.
-*/
-var HistoryResolutionEnum = _enum([
-	"minute",
-	"5min",
-	"hour"
-]);
-var HistoryRangeSchema = object({
-	/** Range start (epoch ms, inclusive). */
-	from: number().int(),
-	/** Range end (epoch ms, inclusive). Defaults to "now" at query time. */
-	to: number().int(),
-	resolution: HistoryResolutionEnum
-});
-var HistoryPointSchema = object({
-	/** Bucket midpoint (epoch ms). */
-	ts: number().int(),
-	/** Object count averaged over the bucket (rounded to nearest integer). */
-	count: number().int().nonnegative()
-});
-DeviceType.Camera, method(object({ deviceId: number() }), CameraOccupancySnapshotSchema.nullable()), method(object({
-	deviceId: number(),
-	zoneId: string(),
-	className: string().optional()
-}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly()), method(object({
-	deviceId: number(),
-	className: string().optional()
-}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly()), method(object({
-	deviceId: number(),
-	className: string().optional()
-}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly());
-/**
-* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
-* cap so a single CRUD surface backs every consumer; each stage has
-* its own dev-state mirror slice (`motion-zone-rules`,
-* `detection-zone-rules`, …) so consumer addons subscribe independently.
-*
-* Extend the enum here when a new gating consumer comes online (audio
-* gating, alert filtering, …) — no other surface needs to change.
-*/
-var ZoneRuleStageEnum = _enum([
-	"motion",
-	"detection",
-	"package"
-]);
-DeviceType.Camera, method(object({
-	deviceId: number(),
-	stage: ZoneRuleStageEnum
-}), array(ZoneRuleSchema).readonly()), method(object({
-	deviceId: number(),
-	stage: ZoneRuleStageEnum,
-	rules: array(ZoneRuleSchema).readonly()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), object({
-	motion: array(ZoneRuleSchema).readonly(),
-	detection: array(ZoneRuleSchema).readonly(),
-	package: array(ZoneRuleSchema).readonly()
-});
-/**
-* Accessory device helpers — shared across drivers.
-*
-* Many vendor-specific drivers register accessory child devices on
-* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
-* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
-* driver picks the right `DeviceType` + `DeviceRole` explicitly when
-* spawning, builds a name derived from the parent, and produces a
-* stableId tied to the parent so boot-restore can reconstruct the
-* relationship.
-*
-* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
-* drivers may reasonably disagree on the right type for an accessory
-* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
-* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
-* one canonical mapping was over-prescriptive and added a layer of
-* indirection without saving meaningful code at call sites — the
-* driver knows its own hardware best.
-*/
-/**
-* Subset of `DeviceRole` values that drivers register as child
-* accessories of a parent device. Sourced verbatim from `DeviceRole`
-* — `AccessoryKind` is the alias drivers use when building accessory
-* children, so the call site reads as
-* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
-* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
-* any role works, including non-accessory ones like Doorbell).
-*/
-var AccessoryKind = {
-	Siren: DeviceRole.Siren,
-	Floodlight: DeviceRole.Floodlight,
-	Spotlight: DeviceRole.Spotlight,
-	PirSensor: DeviceRole.PirSensor,
-	Chime: DeviceRole.Chime,
-	Autotrack: DeviceRole.Autotrack,
-	Nightvision: DeviceRole.Nightvision,
-	PrivacyMask: DeviceRole.PrivacyMask
-};
-AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
-new Set(Object.values(DeviceType));
-DeviceFeature.BatteryOperated;
-/**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
-*/
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
-/**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
-*
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
-*
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
-*/
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
-};
-Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
-/**
-* Resource-bound constants for the safe expression engine.
-*
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
-*/
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
-/**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
-*/
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
-/**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
-*
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
-*
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
-*/
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
-	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
-/**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
+* sees on the live overlay.
 *
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
+* Overlap policy: a detection that intersects two zones counts in
+* BOTH zones' `byClass` and `totalObjects` (count-in-each). The
+* `frame` aggregate de-duplicates trivially since it's frame-wide.
+* `unzoned` counts only detections that landed in zero zones.
 */
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-Object.freeze({});
+var PerScopeBreakdownSchema = object({
+	/** Total tracked objects in this scope (frame / zone / unzoned). */
+	totalObjects: number().int().nonnegative(),
+	/** Per-class count. Keys are macro class names (e.g. `person`, `car`). */
+	byClass: record(string(), number().int().nonnegative())
+});
+var ZoneScopeBreakdownSchema = PerScopeBreakdownSchema.extend({
+	zoneId: string(),
+	zoneName: string(),
+	/** TrackIds of objects currently inside this zone — for cross-reference
+	*  with the per-track detail panel and live overlay. */
+	trackIds: array(string()).readonly()
+});
 /**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
+* A parked ("stationary") object surfaced alongside occupancy — an object that
+* settled and stopped moving. It is NO LONGER a tracked object (the tracker was
+* told to forget it so it stops re-spawning tracks/events), but it IS still
+* physically present, so it keeps counting toward `frame` occupancy and is
+* listed here so the UI can show it in a dedicated "Stationary" section instead
+* of flooding the live event feed.
 */
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
-var ExpressionBindingSourceSchema = union([
-	object({
-		kind: literal("field").optional(),
-		sourceKey: string(),
-		cap: string(),
-		fieldPath: string()
-	}),
-	object({
-		kind: literal("literal"),
-		value: union([
-			string(),
-			number(),
-			boolean(),
-			_null()
-		])
+var StationaryObjectSchema = object({
+	id: string(),
+	className: string(),
+	bbox: object({
+		x: number(),
+		y: number(),
+		w: number(),
+		h: number()
 	}),
-	object({
-		kind: literal("global"),
-		sourceStableId: string(),
-		cap: string(),
-		fieldPath: string()
-	})
+	frameWidth: number().int().nonnegative(),
+	frameHeight: number().int().nonnegative(),
+	/** When the source track was first seen. */
+	firstSeenAt: number().int(),
+	/** When the object was recognised as parked (promotion time). */
+	becameStationaryAt: number().int(),
+	/** Last frame a detection confirmed the object is still there. */
+	lastConfirmedAt: number().int(),
+	/** Enrichment label carried from the source track (identity / plate). */
+	label: string().optional(),
+	/** Native-resolution key-frame media key for the parked object's best image. */
+	keyFrameMediaKey: string().optional()
+});
+var CameraOccupancySnapshotSchema = object({
+	/** Frame timestamp of the inference result that produced this snapshot. */
+	ts: number().int(),
+	/** Frame width/height in pixels — let the UI normalize bbox coords. */
+	frameWidth: number().int().nonnegative(),
+	frameHeight: number().int().nonnegative(),
+	/** Per-zone breakdown — one entry per defined zone (user + onboard). */
+	zones: array(ZoneScopeBreakdownSchema).readonly(),
+	/** Frame-wide aggregate (everywhere, regardless of zone membership).
+	*  INCLUDES currently-confirmed stationary objects (they are still present). */
+	frame: PerScopeBreakdownSchema,
+	/** Detections that landed outside every zone. Empty when no zones defined. */
+	unzoned: PerScopeBreakdownSchema,
+	/** Parked objects on this camera (additive — absent on legacy snapshots).
+	*  Surfaced separately so the UI shows them in a dedicated section rather
+	*  than as repeated tracks/events. */
+	stationaryObjects: array(StationaryObjectSchema).readonly().optional()
+});
+/**
+* Time-series resolution. The history methods return one bucket per
+* step over the requested range. Smaller resolutions cost more
+* memory + bandwidth; bound to discrete steps so caller cannot ask
+* for arbitrary fractional buckets.
+*/
+var HistoryResolutionEnum = _enum([
+	"minute",
+	"5min",
+	"hour"
 ]);
-object({
-	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
+var HistoryRangeSchema = object({
+	/** Range start (epoch ms, inclusive). */
+	from: number().int(),
+	/** Range end (epoch ms, inclusive). Defaults to "now" at query time. */
+	to: number().int(),
+	resolution: HistoryResolutionEnum
+});
+var HistoryPointSchema = object({
+	/** Bucket midpoint (epoch ms). */
+	ts: number().int(),
+	/** Object count averaged over the bucket (rounded to nearest integer). */
+	count: number().int().nonnegative()
+});
+DeviceType.Camera, method(object({ deviceId: number() }), CameraOccupancySnapshotSchema.nullable()), method(object({
+	deviceId: number(),
+	zoneId: string(),
+	className: string().optional()
+}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly()), method(object({
+	deviceId: number(),
+	className: string().optional()
+}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly()), method(object({
+	deviceId: number(),
+	className: string().optional()
+}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly());
+/**
+* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
+* cap so a single CRUD surface backs every consumer; each stage has
+* its own dev-state mirror slice (`motion-zone-rules`,
+* `detection-zone-rules`, …) so consumer addons subscribe independently.
+*
+* Extend the enum here when a new gating consumer comes online (audio
+* gating, alert filtering, …) — no other surface needs to change.
+*/
+var ZoneRuleStageEnum = _enum([
+	"motion",
+	"detection",
+	"package"
+]);
+DeviceType.Camera, method(object({
+	deviceId: number(),
+	stage: ZoneRuleStageEnum
+}), array(ZoneRuleSchema).readonly()), method(object({
+	deviceId: number(),
+	stage: ZoneRuleStageEnum,
+	rules: array(ZoneRuleSchema).readonly()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), object({
+	motion: array(ZoneRuleSchema).readonly(),
+	detection: array(ZoneRuleSchema).readonly(),
+	package: array(ZoneRuleSchema).readonly()
 });
+/**
+* Accessory device helpers — shared across drivers.
+*
+* Many vendor-specific drivers register accessory child devices on
+* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
+* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
+* driver picks the right `DeviceType` + `DeviceRole` explicitly when
+* spawning, builds a name derived from the parent, and produces a
+* stableId tied to the parent so boot-restore can reconstruct the
+* relationship.
+*
+* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
+* drivers may reasonably disagree on the right type for an accessory
+* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
+* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
+* one canonical mapping was over-prescriptive and added a layer of
+* indirection without saving meaningful code at call sites — the
+* driver knows its own hardware best.
+*/
+/**
+* Subset of `DeviceRole` values that drivers register as child
+* accessories of a parent device. Sourced verbatim from `DeviceRole`
+* — `AccessoryKind` is the alias drivers use when building accessory
+* children, so the call site reads as
+* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
+* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
+* any role works, including non-accessory ones like Doorbell).
+*/
+var AccessoryKind = {
+	Siren: DeviceRole.Siren,
+	Floodlight: DeviceRole.Floodlight,
+	Spotlight: DeviceRole.Spotlight,
+	PirSensor: DeviceRole.PirSensor,
+	Chime: DeviceRole.Chime,
+	Autotrack: DeviceRole.Autotrack,
+	Nightvision: DeviceRole.Nightvision,
+	PrivacyMask: DeviceRole.PrivacyMask
+};
+AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+new Set(Object.values(DeviceType));
+DeviceFeature.BatteryOperated;
 Object.freeze({
 	"accessories.setChildHidden": {
 		capName: "accessories",
@@ -29254,7 +29453,7 @@ var AdminUIAddon = class extends BaseAddon {
 			capability: adminUiCapability,
 			provider: {
 				getStaticDir: async () => ({ staticDir: resolveAdminUiDistDir() }),
-				getVersion: async () => ({ version: "1.2.38" })
+				getVersion: async () => ({ version: "1.2.40" })
 			}
 		}];
 	}