@camstack/addon-export-hap 1.2.15 → 1.2.17

package/dist/export-hap.addon.mjs

@@ -7054,7 +7054,7 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 	input: unknown()
 }), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
 //#endregion
-//#region ../types/dist/fmp4-box-splitter-B53u9-Nu.mjs
+//#region ../types/dist/canonical-hash-rO1sRmEK.mjs
 var AUDIO_ENCODER_BY_CODEC = {
 	opus: "libopus",
 	aac: "aac",
@@ -7348,37 +7348,6 @@ function buildFfmpegArgs(inv) {
 		...inv.audioSidecar ? buildAudioSidecarArgs(inv.audioSidecar) : []
 	];
 }
-/**
-* Deterministic SHA-256 hash of an arbitrary serialisable value. The
-* canonical form sorts object keys alphabetically at every depth so two
-* structurally-equal inputs with different key insertion orders produce
-* the same hash. Returns a 64-char lowercase hex digest.
-*
-* Used by export adapters (Alexa, HAP) to short-circuit re-discovery /
-* accessory-rebuild work when the upstream shape is byte-identical to
-* the last applied state — preventing user-visible "re-discovery"
-* notifications on every addon-runner respawn. Each respawn re-fires
-* `DeviceBindingsChanged` for every cap registration, which without
-* this guard would propagate redundant pushes.
-*
-* Note: this is a SYMPTOMATIC fix layered on top of the binding-change
-* subscription. The proper fix is a single "device ready" lifecycle
-* barrier so exports react only when the full cap set has landed —
-* tracked separately for post-HA-integration work.
-*/
-function canonicalHash(value) {
-	const canonical = JSON.stringify(value, replaceWithSortedKeys);
-	return createHash("sha256").update(canonical ?? "").digest("hex");
-}
-function replaceWithSortedKeys(_key, value) {
-	if (value && typeof value === "object" && !Array.isArray(value)) {
-		const obj = value;
-		const out = {};
-		for (const k of Object.keys(obj).toSorted()) out[k] = obj[k];
-		return out;
-	}
-	return value;
-}
 var DEFAULT_MAX_UNIT_BYTES = 16 * 1024 * 1024;
 /** Header size for a normal box, and for one carrying a 64-bit `largesize`. */
 var BOX_HEADER_BYTES = 8;
@@ -7551,6 +7520,37 @@ var Fmp4BoxSplitter = class {
 		return [];
 	}
 };
+/**
+* Deterministic SHA-256 hash of an arbitrary serialisable value. The
+* canonical form sorts object keys alphabetically at every depth so two
+* structurally-equal inputs with different key insertion orders produce
+* the same hash. Returns a 64-char lowercase hex digest.
+*
+* Used by export adapters (Alexa, HAP) to short-circuit re-discovery /
+* accessory-rebuild work when the upstream shape is byte-identical to
+* the last applied state — preventing user-visible "re-discovery"
+* notifications on every addon-runner respawn. Each respawn re-fires
+* `DeviceBindingsChanged` for every cap registration, which without
+* this guard would propagate redundant pushes.
+*
+* Note: this is a SYMPTOMATIC fix layered on top of the binding-change
+* subscription. The proper fix is a single "device ready" lifecycle
+* barrier so exports react only when the full cap set has landed —
+* tracked separately for post-HA-integration work.
+*/
+function canonicalHash(value) {
+	const canonical = JSON.stringify(value, replaceWithSortedKeys);
+	return createHash("sha256").update(canonical ?? "").digest("hex");
+}
+function replaceWithSortedKeys(_key, value) {
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const obj = value;
+		const out = {};
+		for (const k of Object.keys(obj).toSorted()) out[k] = obj[k];
+		return out;
+	}
+	return value;
+}
 //#endregion
 //#region ../types/dist/err-msg-IQTHeDzc.mjs
 /**
@@ -9630,6 +9630,69 @@ var StreamFormatSchema = _enum([
 	"mjpeg",
 	"rtsp"
 ]);
+/** A container `produceEventMedia` can emit. */
+var EventMediaKindSchema = _enum(["mp4", "gif"]);
+/**
+* One produced artifact, referenced by HANDLE.
+*
+* Never inline bytes: a produced clip is 200 KB–5 MB and every consumer of this
+* method is in another runner ([D9](../../../../docs/decisions/adr-0009.md),
+* [D18](../../../../docs/decisions/adr-0018.md) — cross-process media is fetched
+* on demand, compressed, by handle). `bytes` is here so a caller can decide
+* whether it wants the fetch at all.
+*/
+var EventMediaArtifactSchema = object({
+	kind: EventMediaKindSchema,
+	/** Opaque, single-camera, short-lived. Redeem with `fetchEventMedia`. */
+	handle: string(),
+	/**
+	* The node holding the bytes — the ROUTING key for `fetchEventMedia`.
+	*
+	* `stream-broker` is a singleton cap and an unpinned call never leaves the
+	* hub, so a handle produced on an agent's broker would be redeemed against
+	* the hub's store and come back `null`. Same contract, same field name and
+	* the same reason as `FrameHandleSchema.nodeId`: the producer stamps where it
+	* lives and the consumer pins to it.
+	*/
+	nodeId: string(),
+	mime: string(),
+	bytes: number().int(),
+	width: number().int(),
+	height: number().int()
+});
+/**
+* What a production actually covered — the answer to the only question an
+* operator asks about a notification clip.
+*
+* `fromTs`/`toTs` are WALL CLOCK, derived from the ring's own packet timeline,
+* so a caller can state "this clip starts 4.1 s before the event" instead of
+* inferring it from a duration. A production whose `fromTs` is later than the
+* event is a production with no pre-roll, and that is exactly the defect this
+* method exists to make visible rather than plausible.
+*/
+var EventMediaCoverageSchema = object({
+	fromTs: number(),
+	toTs: number(),
+	/** Encoded packets in the muxed window. */
+	packets: number().int()
+});
+/**
+* The result of ONE cut, in every container the caller asked for.
+*
+* Every artifact in `media` came out of the SAME window of the SAME rendition —
+* that is the whole reason this is one method rather than one call per format.
+* A consumer attaching a gif and a video can no longer show two different
+* moments, because it never chose two sources.
+*/
+var EventMediaProductionSchema = object({
+	media: array(EventMediaArtifactSchema).readonly(),
+	coverage: EventMediaCoverageSchema,
+	/** The rendition actually cut from — what the default or the fallback chose. */
+	profile: CamProfileSchema,
+	/** `copy` = the camera's own H.264, untouched. `encode` = re-encoded (H.265
+	*  source, a downscale, or a playback rate other than 1). */
+	video: _enum(["copy", "encode"])
+});
 var RtspRestreamEntrySchema = object({
 	brokerId: string(),
 	url: string(),
@@ -10029,6 +10092,56 @@ method(object({
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	/** Absent = the largest H.264 rendition at or below 1080p, which is
+	*  also the one that can be copied. Falls back to whatever the ring
+	*  actually retained, and the answer says which. */
+	profile: CamProfileSchema.optional(),
+	aroundMs: number(),
+	preSeconds: number().min(0).max(20).default(4),
+	postSeconds: number().min(0).max(20).default(6),
+	kinds: array(EventMediaKindSchema).min(1).default(["mp4"]),
+	/** GIF geometry. The video keeps the source's own. */
+	gifMaxWidth: number().int().min(120).max(1280).default(640),
+	/**
+	* The gif's own PLAYBACK rate in frames per second — what the finished
+	* gif runs at, not how many source frames feed it. The decimation that
+	* feeds it samples `gifFps / gifSpeed` source frames per second, so at
+	* the defaults a 12 fps gif is built out of 3 source frames a second.
+	*/
+	gifFps: number().int().min(1).max(15).default(12),
+	/**
+	* How fast the GIF plays against real time, independent of `speed`.
+	*
+	* 4× by default, by operator request: a notification gif is glanced at
+	* on a lock screen, so a ~12 s window has to be over in ~3 s. It stays
+	* a separate knob from `speed` even though both now default to 4 —
+	* a caller wanting a real-time video and a fast gif must not have to
+	* choose.
+	*/
+	gifSpeed: number().min(1).max(8).default(4),
+	/**
+	* Playback rate of the VIDEO. Also 4× by default, by operator decision.
+	*
+	* `1` is real time and is the ONLY value that allows the copy branch —
+	* anything else forces `libx264` over the window. That was priced
+	* before it was chosen: a per-event burst measured at 0.23 s and 254 KB
+	* on a real 615 720p cut, against 922 KB for the copy it replaces. A
+	* re-encode is capped at 720p (`EVENT_CLIP_ENCODE_MAX_WIDTH`), because
+	* once the decode is forced the width stops being free.
+	*/
+	speed: number().min(1).max(8).default(4)
+}), EventMediaProductionSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ handle: string() }), object({
+	base64: string(),
+	mime: string(),
+	bytes: number().int()
+}).nullable(), {
+	kind: "mutation",
+	auth: "admin"
 }), method(_void(), array(CameraStreamSchema).readonly()), method(_void(), array(ProfileSlotSchema).readonly()), method(object({ brokerId: string() }), BrokerStatsSchema), method(object({ brokerId: string() }), object({
 	probed: boolean(),
 	summary: string()
@@ -10221,25 +10334,6 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	}),
 	lastChangedAt: number()
 });
-/**
-* core-blocks — user-authored TypeScript, stored in the kernel and executed in
-* its own process.
-*
-* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
-*
-* The first use is **owning devices without being a device provider**: a block
-* declares devices under a system or custom integration and drives their state,
-* with the same `ctx` an addon gets. Automations come later; nothing here
-* models a trigger.
-*
-* **Stated plainly, because it does not change by being true:** a block has an
-* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
-* with no review step. What makes that survivable is not a sandbox, it is
-* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
-* so a block that throws or never returns is marked `failed` and visible
-* instead of taking the hub with it (D6). Every method here is admin-only, and
-* must stay so.
-*/
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
@@ -10311,6 +10405,9 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), object({ block: CoreBlockSchema }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ blockId: string() }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ code: string() }), CoreBlockCompileResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -11070,601 +11167,6 @@ var deviceExportCapability = {
 		unexposeDevice: method(UnexposeInputSchema, _void(), { kind: "mutation" })
 	}
 };
-/**
-* Resource-bound constants for the safe expression engine.
-*
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
-*/
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
-/**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
-*/
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
-/**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
-*
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
-*
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
-*/
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
-};
-Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
-/**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
-*/
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
-/**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
-*
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
-*
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
-*/
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
-	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
-/**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
-*
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-Object.freeze({});
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
-*/
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
 var ProviderStatusSchema = object({
 	connected: boolean(),
 	deviceCount: number(),
@@ -11789,92 +11291,6 @@ var ChildLayoutEntrySchema = object({
 	order: number().optional(),
 	collapsed: boolean().optional()
 });
-/** Cap-wire shape of a DeviceLink — structurally mirrors `DeviceLink` in
-*  `device-management.ts`. Source is a union: a FIELD source copies a sibling
-*  accessory's status field (`kind` optional/absent for wire compat); a
-*  LITERAL source carries a per-device constant (no sibling is read); a
-*  GLOBAL source (P2e) copies ANY device's status field, addressed by the
-*  source device's full re-sync-stable `stableId`. */
-var DeviceLinkFieldSourceSchema = object({
-	kind: literal("field").optional(),
-	sourceKey: string(),
-	cap: string(),
-	fieldPath: string()
-});
-var DeviceLinkLiteralSourceSchema = object({
-	kind: literal("literal"),
-	value: union([
-		string(),
-		number(),
-		boolean(),
-		_null()
-	])
-});
-var DeviceLinkGlobalSourceSchema = object({
-	kind: literal("global"),
-	sourceStableId: string(),
-	cap: string(),
-	fieldPath: string()
-});
-/** Expression source (Stage X): compute the target field from N named bindings
-*  via the safe expression engine. Bindings are field | literal | global — never
-*  another expression (no nesting). The `superRefine` runs the SAME author-time
-*  validation as `validateExpressionSource` (compiles the expr, checks binding
-*  names + identifier coverage) so every wire boundary that parses a DeviceLink
-*  (tRPC mount, kernel create pre-seed, projection output) validates-at-write.
-*  Compiles are LRU-cached, so repeated validation of the same expr is a hit. */
-var DeviceLinkExpressionSourceSchema = object({
-	kind: literal("expression"),
-	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema
-	]))
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-var DeviceLinkSchema = object({
-	id: string(),
-	source: union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema,
-		DeviceLinkExpressionSourceSchema
-	]),
-	target: object({
-		cap: string(),
-		fieldPath: string(),
-		itemKey: string().optional()
-	}),
-	transform: discriminatedUnion("kind", [
-		object({ kind: literal("identity") }),
-		object({
-			kind: literal("enum-map"),
-			mapping: record(string(), union([
-				string(),
-				number(),
-				boolean()
-			])),
-			fallback: union([
-				string(),
-				number(),
-				boolean()
-			]).optional()
-		}),
-		object({
-			kind: literal("linear"),
-			scale: number(),
-			offset: number(),
-			clamp: tuple([number(), number()]).readonly().optional()
-		})
-	]).optional()
-});
 /** Cap-wire shape of a per-cap display refinement — mirrors
 *  `DeviceCapDisplayOverride` in `device-management.ts`. */
 var DeviceCapDisplayOverrideSchema = object({
@@ -11954,8 +11370,6 @@ var DeviceInfoSchema = object({
 	*  named accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
 	display: DeviceDisplayOverrideSchema.optional()
 });
@@ -11964,7 +11378,7 @@ var ConfigEntrySchema = object({
 	value: unknown(),
 	description: string().optional()
 });
-var DeviceLinkModeSchema = _enum(["auto", "manual"]);
+var LinkedDevicesModeSchema = _enum(["auto", "manual"]);
 /** One resolved linked device — the compact projection consumers need. */
 var LinkedDeviceSchema = object({
 	deviceId: number(),
@@ -12027,8 +11441,6 @@ var DeviceMetaSchema = object({
 	*  accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Semantic role string (`DeviceRole`) — propagated from the spawn pre-seed.
 	*  Optional: only present for accessory children that carry a known role. */
 	role: string().nullable().optional(),
@@ -12121,12 +11533,6 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	deviceLinks: array(DeviceLinkSchema).readonly()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	display: DeviceDisplayOverrideSchema.nullable()
@@ -12208,7 +11614,7 @@ method(object({
 	*  shipping 293 rows to find 12. */
 	isCamera: boolean().optional()
 }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
-	mode: DeviceLinkModeSchema,
+	mode: LinkedDevicesModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
 	deviceId: number(),
@@ -12241,11 +11647,7 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum([
-			"native",
-			"wrapped",
-			"linked"
-		]),
+		kind: _enum(["native", "wrapped"]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -12254,11 +11656,7 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum([
-			"native",
-			"wrapped",
-			"linked"
-		]),
+		kind: _enum(["native", "wrapped"]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -13061,7 +12459,7 @@ var MotionAnalysisResultSchema = object({
 	frameHeight: number(),
 	analysisMs: number()
 });
-method(object({
+DeviceType.Camera, method(object({
 	deviceId: number(),
 	frame: FrameInputSchema.optional(),
 	frameHandle: FrameHandleSchema.optional()
@@ -15250,6 +14648,18 @@ var OauthIntegrationDescriptorSchema = object({
 	*  redirect_uri that does not start with one of these. Required —
 	*  an empty list means the integration can never complete linking. */
 	allowedRedirectPrefixes: array(string()).min(1),
+	/** Paths accepted as a `redirect_uri` when the host is PRIVATE — loopback,
+	*  RFC1918, CGNAT (100.64/10, Tailscale), link-local, IPv6 ULA, or an
+	*  `.local` / `.internal` / `.ts.net` name. Exists for self-hosted clients
+	*  whose address the hub cannot know in advance (a Home Assistant at
+	*  `http://<lan-ip>:8123/auth/external/callback`). The PATH must match
+	*  exactly; a public host never satisfies this branch, so it is not a
+	*  wildcard prefix by another name. */
+	allowedPrivateHostPaths: array(string()).optional(),
+	/** When true this is a PUBLIC client (source is published, no secret can be
+	*  protected) and PKCE is mandatory: `/authorize` refuses without an S256
+	*  `code_challenge`, `/token` refuses without the matching `code_verifier`. */
+	requiresPkce: boolean().optional(),
 	/** Optional public origin (no trailing slash) that this integration's
 	*  issued codes/tokens should carry as the `hubUrl` claim — typically the
 	*  operator-selected external-access endpoint resolved by the addon. When
@@ -15400,7 +14810,7 @@ var TrackEnvelopeSchema = object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -15520,6 +14930,60 @@ var TrackFlagsSchema = object({
 	*  `trained` without a re-fetch. */
 	retrainStatus: RetrainStatusSchema
 });
+union([literal(1), literal(2)]);
+/**
+* WHO decided a label, and when. Carried per tier so a value can be traced to
+* the step and model that produced it — which is what makes the write rule
+* arguable after the fact ("why is 592's label `dog` and not `Canis lupus`?")
+* and what lets a migrated, UNATTRIBUTED value be told apart from a real one.
+*
+* `stepId` is the pipeline step id (`animal-classifier`, `bird-classifier`,
+* `plate-ocr`, `face-embedding`, `object-detection`), or the sentinel
+* `migration:4g` for a value the 4g migration moved from the single-slot era —
+* that value has no provenance, and the write rule lets ANY properly-attributed
+* write of the same tier replace it regardless of score.
+*/
+var LabelAttributionSchema = object({
+	stepId: string(),
+	modelId: string().optional(),
+	decidedAt: number()
+});
+/**
+* The TIERED label model (roadmap 4g), spread into `TrackSchema` and
+* `ObjectEventSchema` from ONE place so the two surfaces cannot drift — a
+* track and its events always answer the same question the same way.
+*
+* Two scalar columns, not an array: every consumer wants "the coarse one" or
+* "the fine one", and an array made both a scan. `label` is tier 1, `subLabel`
+* is tier 2, and each carries its own score + attribution.
+*
+* **Reading it.** What a human should be shown is `subLabel ?? label` — the
+* finest thing known. Before 4g the single `label` column held the finest
+* value, so a consumer that has not been updated reads the tier-1 slot and
+* shows nothing on a species-only row; that is why the migration puts every
+* pre-4g value in tier 2 (it cannot regress a display that reads the fallback)
+* and why the read surfaces were changed in the same train.
+*
+* **Writing it.** The slots are independent, which is the whole point: a
+* tier-1 write (`bird`) can never overwrite a tier-2 value (`Turdus
+* migratorius`), so fineness cannot regress by construction. Within a tier the
+* higher score wins. One rule, one implementation — see
+* `pipeline/label-tier.ts` in addon-post-analysis.
+*/
+var TieredLabelFields = {
+	/** Tier 1 — the sub-class. See {@link LabelTierSchema}. */
+	label: string().optional(),
+	/** Confidence of the tier-1 value, as reported by the deciding step. */
+	labelScore: number().optional(),
+	/** Provenance of the tier-1 value. See {@link LabelAttributionSchema}. */
+	labelMeta: LabelAttributionSchema.optional(),
+	/** Tier 2 — the instance. See {@link LabelTierSchema}. */
+	subLabel: string().optional(),
+	/** Confidence of the tier-2 value, as reported by the deciding step. */
+	subLabelScore: number().optional(),
+	/** Provenance of the tier-2 value. See {@link LabelAttributionSchema}. */
+	subLabelMeta: LabelAttributionSchema.optional()
+};
 /** Per-camera slice of a training-export estimate. */
 var TrainingExportDeviceTotalsSchema = object({
 	deviceId: number(),
@@ -15544,7 +15008,7 @@ var TrackSchema = object({
 	trackId: string(),
 	deviceId: number(),
 	className: string(),
-	label: string().optional(),
+	...TieredLabelFields,
 	producingDeviceName: string().optional(),
 	/** Track provenance. Absent ⇒ `pipeline` (legacy rows). */
 	source: TrackSourceSchema.optional(),
@@ -15583,6 +15047,24 @@ var TrackSchema = object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
+	/**
+	* A face DETECTOR found a face on this track — nothing more. It says the
+	* detail plane produced a `face` detail; it does NOT say the face was
+	* embedded, matched, above `minFacePx`, or that the recognizer was even
+	* enabled. Set once and never cleared.
+	*
+	* **This exists so "face present but not recognised" is expressible.** A
+	* recognised identity lands in `subLabel` (attributed to the face chain via
+	* `subLabelMeta.stepId`), so before this field a track with an unmatched face
+	* and a track with no face at all were byte-identical on the wire and no
+	* surface could tell them apart. The read is `hasFace === true && subLabel
+	* === undefined`.
+	*
+	* **Absent ≠ false.** Every row written before the column existed omits it,
+	* and so does every server that predates the field — a consumer must test
+	* `=== true` and render nothing otherwise, never infer "no face".
+	*/
+	hasFace: boolean().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -15657,7 +15139,7 @@ var ObjectEventSchema = object({
 	/** Omitted in slim projection. */
 	trackId: string().optional(),
 	className: string(),
-	label: string().optional(),
+	...TieredLabelFields,
 	/** Omitted in slim projection. */
 	confidence: number().optional(),
 	/** Heavy JSON — omitted in slim projection. */
@@ -15738,6 +15220,173 @@ var MediaFileSchema = object({
 * stored blob and a `?variant=thumb` rendering without fetching either.
 */
 var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
+/**
+* The MACRO tier of an annotation — a CLOSED set.
+*
+* This is what the exported detector predicts, so a typo here is a new class
+* with one example in it. `label` and `subLabel` are open strings by contrast:
+* the whole point of the page is teaching the model things it does not know
+* yet, and constraining that vocabulary would make it useless.
+*
+* A macro class is NEVER a label. The provider refuses a write whose `label` or
+* `subLabel` is one of these values, in any casing, because once `person`
+* exists in both tiers "every person box" stops being answerable without
+* knowing every string anyone ever typed — and the damage is retroactive.
+*/
+var RetrainMacroClassSchema = _enum([
+	"person",
+	"vehicle",
+	"animal",
+	"package",
+	"face",
+	"plate"
+]);
+/** A subject to learn, or a phantom to unlearn (taught by OMISSION). */
+var RetrainAnnotationKindSchema = _enum(["subject", "model_error"]);
+/** Did a human draw this box, or did the assist propose it? */
+var RetrainAnnotationSourceSchema = _enum(["operator", "assist"]);
+/** Normalised `[0,1]` rectangle against the FULL frame — the canonical form. */
+var RetrainBboxSchema = object({
+	x: number(),
+	y: number(),
+	w: number(),
+	h: number()
+});
+/**
+* One annotated subject.
+*
+* `bbox` is normalised against the full frame, ALWAYS. The per-model shapes
+* (letterboxed root / zone-cropped package / subject-cropped classifier) are
+* derived from it at export and never stored — storing them is how one feature
+* space ends up holding two crops of the same subject (D52).
+*/
+var RetrainAnnotationSchema = object({
+	id: string(),
+	trackId: string(),
+	deviceId: number(),
+	/** The COPY in retrain storage — never the source track's media key. */
+	mediaKey: string(),
+	bbox: RetrainBboxSchema,
+	macroClass: RetrainMacroClassSchema,
+	label: string().optional(),
+	subLabel: string().optional(),
+	kind: RetrainAnnotationKindSchema,
+	source: RetrainAnnotationSourceSchema,
+	/** Which model proposed this box — or, on a `model_error`, drew the phantom. */
+	assistModelId: string().optional(),
+	assistScore: number().optional(),
+	exportedInBatch: string().optional(),
+	createdAt: number()
+});
+/** The write form — the server owns `id`, `createdAt` and the frame binding. */
+var RetrainAnnotationDraftSchema = RetrainAnnotationSchema.omit({
+	id: true,
+	trackId: true,
+	deviceId: true,
+	mediaKey: true,
+	createdAt: true,
+	exportedInBatch: true
+});
+/** A track sitting in `staging`, with everything the worklist needs to rank it. */
+var RetrainTrackSchema = object({
+	trackId: string(),
+	deviceId: number(),
+	className: string(),
+	label: string().optional(),
+	firstSeen: number(),
+	lastSeen: number(),
+	/** How many frames the dataset already holds from this track. */
+	frameCount: number().int(),
+	/** How many subjects have been annotated on those frames. `0` with
+	*  `frameCount: 0` is exactly "staging, still to work". */
+	annotationCount: number().int()
+});
+/** A frame the picker may offer — an index row, no blob was read to produce it. */
+var RetrainFrameCandidateSchema = object({
+	mediaKey: string(),
+	kind: MediaFileKindEnum,
+	timestamp: number(),
+	sizeBytes: number().int(),
+	/** A copy of this original already exists — selecting it is free and cannot
+	*  fail, whatever became of the original. */
+	copied: boolean()
+});
+/** A frame the dataset OWNS: bytes copied at selection time. */
+var RetrainFrameSchema = object({
+	frameId: string(),
+	deviceId: number(),
+	trackId: string(),
+	/** Provenance only. It may already point at nothing — that is expected. */
+	sourceMediaKey: string(),
+	sourceKind: MediaFileKindEnum,
+	sizeBytes: number().int(),
+	width: number().int(),
+	height: number().int(),
+	copiedAt: number()
+});
+/** Why a copy-on-select could not be honoured — named, never a silent skip. */
+var RetrainCopyRefusalSchema = _enum([
+	"source-missing",
+	"unreadable-image",
+	"write-failed"
+]);
+var RetrainFrameSelectionSchema = object({
+	copied: array(RetrainFrameSchema).readonly(),
+	refused: array(object({
+		sourceMediaKey: string(),
+		reason: RetrainCopyRefusalSchema
+	})).readonly()
+});
+var RetrainFrameListSchema = object({
+	candidates: array(RetrainFrameCandidateSchema).readonly(),
+	copies: array(RetrainFrameSchema).readonly(),
+	/** What the page pre-selects — the native key frame when one survives. */
+	autoPickMediaKey: string().optional()
+});
+/** What the operator asked the assist to look for. */
+var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
+	kind: literal("package"),
+	zone: RetrainBboxSchema.optional()
+}), object({
+	kind: literal("objects"),
+	modelId: string(),
+	minScore: number().optional()
+})]);
+/**
+* The assist's answer — a discriminated union, because "the model saw nothing"
+* and "this node cannot run that model" lead to different next moves and a
+* nullable result cannot tell them apart.
+*/
+var RetrainAssistResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("proposed"),
+	modelId: string(),
+	stepId: string(),
+	minScore: number(),
+	/** Drafts, ready to edit. `source: 'assist'` until the operator touches one. */
+	proposals: array(RetrainAnnotationDraftSchema).readonly(),
+	/** Returned by the runner but removed by the threshold. */
+	belowThreshold: number().int()
+}), object({
+	kind: literal("refused"),
+	/** `no-zone` is ours; the rest are the runner's own refusal vocabulary. */
+	reason: string(),
+	detail: string().optional()
+})]);
+/** The outcome of a lifecycle move owned by the retrain page. */
+var RetrainTransitionResultSchema = object({
+	trackId: string(),
+	/** Where the track ended up, whatever happened. */
+	retrainStatus: RetrainStatusSchema,
+	/** `false` ⇒ the move was refused or was a no-op; `reason` says which. */
+	changed: boolean(),
+	reason: _enum([
+		"unknown-track",
+		"no-frames-copied",
+		"not-staging",
+		"not-trained",
+		"unchanged"
+	]).optional()
+});
 var DEFAULT_EVENT_QUERY_LIMIT = 1e3;
 var MAX_EVENT_QUERY_LIMIT = 5e3;
 var DeviceEventQueryInput = object({
@@ -15792,7 +15441,7 @@ var KeyEventSchema = object({
 	/** Track start time (firstSeen). */
 	timestamp: number(),
 	className: string(),
-	label: string().optional(),
+	...TieredLabelFields,
 	importance: number(),
 	/** Highest-confidence ObjectEvent id for the track (empty when none). */
 	bestEventId: string(),
@@ -16066,6 +15715,79 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	/** Empty ⇒ every camera that has staging tracks. A LIST, not a single
+	*  `deviceId`, deliberately: `deviceId` would make this device-bound and
+	*  route it at one camera's owner, and "every camera" would stop being
+	*  expressible at all. */
+	deviceIds: array(number()).optional(),
+	limit: number().int().min(1).max(500).optional()
+}), array(RetrainTrackSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ trackId: string() }), RetrainFrameListSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	mediaKeys: array(string()).min(1)
+}), RetrainFrameSelectionSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string()
+}), object({
+	removed: boolean(),
+	removedAnnotations: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ frameId: string() }), object({
+	base64: string(),
+	width: number().int(),
+	height: number().int()
+}), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string(),
+	subject: RetrainAssistSubjectSchema,
+	/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
+	nodeId: string().optional()
+}), RetrainAssistResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ trackId: string() }), array(RetrainAnnotationSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string(),
+	annotations: array(RetrainAnnotationDraftSchema)
+}), array(RetrainAnnotationSchema).readonly(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string()
+}), RetrainTransitionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string()
+}), RetrainTransitionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+	kind: "query",
+	auth: "admin"
 }), method(object({
 	eventId: string(),
 	kind: MediaFileKindEnum.optional()
@@ -16645,6 +16367,22 @@ var DetailResultSchema = object({
 	bbox: NativeCropBboxSchema.optional(),
 	embedding: string().optional(),
 	label: string().optional(),
+	/**
+	* The tier `label` occupies, copied VERBATIM from the producing step's
+	* `StepDefinition.labelTier` (roadmap 4g). Present only when `label` is.
+	*
+	* It rides the wire rather than being resolved by the consumer because the
+	* declaration lives with the step definition, which only the executing node
+	* has: post-analysis holds no step registry, and re-deriving the tier from
+	* `className` there would be exactly the inference this model exists to
+	* forbid. A `label` that arrives WITHOUT this field is refused by the write
+	* rule and logged (`label tier undeclared`) — an older runner therefore
+	* stops enriching rather than guessing, which is why addon-pipeline is
+	* deployed BEFORE addon-post-analysis.
+	*/
+	labelTier: union([literal(1), literal(2)]).optional(),
+	/** Model that produced `label` — carried into the tier's attribution. */
+	labelModelId: string().optional(),
 	alignedCropJpeg: string().optional(),
 	/** Face short side (px) measured on the NATIVE crop surface. The `bbox`
 	*  above is detection-frame px (≈6× smaller on a 4K camera) — min-face-size
@@ -17941,6 +17679,10 @@ var SsoBridgeClaimsSchema = object({
 	integrationId: string().optional(),
 	/** JWT ID — unique per issued code; consumed-set enforces single-use. */
 	jti: string().optional(),
+	/** PKCE S256 challenge — set only on `oauth-code` tokens issued to a public
+	*  client. Its PRESENCE is what makes the verifier mandatory at exchange,
+	*  so the requirement travels with the code and not with mutable config. */
+	codeChallenge: string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
 	sessionId: string().optional()
@@ -18493,7 +18235,7 @@ var ClipPlaybackSchema = object({
 	playbackEndpoints: array(string()).optional(),
 	token: string().optional()
 });
-method(object({
+DeviceType.Camera, method(object({
 	deviceId: number(),
 	since: number(),
 	until: number(),
@@ -23569,13 +23311,18 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	username: string(),
 	scopes: array(TokenScopeSchema),
 	redirectUri: string(),
-	hubUrl: string()
+	hubUrl: string(),
+	/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
+	*  that carries one can ONLY be exchanged with the matching verifier. */
+	codeChallenge: string().optional()
 }), object({ code: string() }), {
 	kind: "mutation",
 	access: "create"
 }), method(object({
 	code: string(),
-	redirectUri: string()
+	redirectUri: string(),
+	/** PKCE verifier. REQUIRED when the code carries a challenge. */
+	codeVerifier: string().optional()
 }), object({
 	accessToken: string(),
 	refreshToken: string(),
@@ -23915,76 +23662,705 @@ DeviceType.Camera, method(object({ deviceId: number() }), CameraOccupancySnapsho
 	className: string().optional()
 }).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly());
 /**
-* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
-* cap so a single CRUD surface backs every consumer; each stage has
-* its own dev-state mirror slice (`motion-zone-rules`,
-* `detection-zone-rules`, …) so consumer addons subscribe independently.
+* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
+* cap so a single CRUD surface backs every consumer; each stage has
+* its own dev-state mirror slice (`motion-zone-rules`,
+* `detection-zone-rules`, …) so consumer addons subscribe independently.
+*
+* Extend the enum here when a new gating consumer comes online (audio
+* gating, alert filtering, …) — no other surface needs to change.
+*/
+var ZoneRuleStageEnum = _enum([
+	"motion",
+	"detection",
+	"package"
+]);
+DeviceType.Camera, method(object({
+	deviceId: number(),
+	stage: ZoneRuleStageEnum
+}), array(ZoneRuleSchema).readonly()), method(object({
+	deviceId: number(),
+	stage: ZoneRuleStageEnum,
+	rules: array(ZoneRuleSchema).readonly()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), object({
+	motion: array(ZoneRuleSchema).readonly(),
+	detection: array(ZoneRuleSchema).readonly(),
+	package: array(ZoneRuleSchema).readonly()
+});
+/**
+* Accessory device helpers — shared across drivers.
+*
+* Many vendor-specific drivers register accessory child devices on
+* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
+* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
+* driver picks the right `DeviceType` + `DeviceRole` explicitly when
+* spawning, builds a name derived from the parent, and produces a
+* stableId tied to the parent so boot-restore can reconstruct the
+* relationship.
+*
+* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
+* drivers may reasonably disagree on the right type for an accessory
+* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
+* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
+* one canonical mapping was over-prescriptive and added a layer of
+* indirection without saving meaningful code at call sites — the
+* driver knows its own hardware best.
+*/
+/**
+* Subset of `DeviceRole` values that drivers register as child
+* accessories of a parent device. Sourced verbatim from `DeviceRole`
+* — `AccessoryKind` is the alias drivers use when building accessory
+* children, so the call site reads as
+* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
+* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
+* any role works, including non-accessory ones like Doorbell).
+*/
+var AccessoryKind = {
+	Siren: DeviceRole.Siren,
+	Floodlight: DeviceRole.Floodlight,
+	Spotlight: DeviceRole.Spotlight,
+	PirSensor: DeviceRole.PirSensor,
+	Chime: DeviceRole.Chime,
+	Autotrack: DeviceRole.Autotrack,
+	Nightvision: DeviceRole.Nightvision,
+	PrivacyMask: DeviceRole.PrivacyMask
+};
+AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+new Set(Object.values(DeviceType));
+DeviceFeature.BatteryOperated;
+/**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+/**
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
+*
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
+*
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
+*/
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+/**
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
 *
-* Extend the enum here when a new gating consumer comes online (audio
-* gating, alert filtering, …) — no other surface needs to change.
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
 */
-var ZoneRuleStageEnum = _enum([
-	"motion",
-	"detection",
-	"package"
-]);
-DeviceType.Camera, method(object({
-	deviceId: number(),
-	stage: ZoneRuleStageEnum
-}), array(ZoneRuleSchema).readonly()), method(object({
-	deviceId: number(),
-	stage: ZoneRuleStageEnum,
-	rules: array(ZoneRuleSchema).readonly()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), object({
-	motion: array(ZoneRuleSchema).readonly(),
-	detection: array(ZoneRuleSchema).readonly(),
-	package: array(ZoneRuleSchema).readonly()
-});
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
 /**
-* Accessory device helpers — shared across drivers.
-*
-* Many vendor-specific drivers register accessory child devices on
-* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
-* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
-* driver picks the right `DeviceType` + `DeviceRole` explicitly when
-* spawning, builds a name derived from the parent, and produces a
-* stableId tied to the parent so boot-restore can reconstruct the
-* relationship.
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
 *
-* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
-* drivers may reasonably disagree on the right type for an accessory
-* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
-* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
-* one canonical mapping was over-prescriptive and added a layer of
-* indirection without saving meaningful code at call sites — the
-* driver knows its own hardware best.
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
 */
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
 /**
-* Subset of `DeviceRole` values that drivers register as child
-* accessories of a parent device. Sourced verbatim from `DeviceRole`
-* — `AccessoryKind` is the alias drivers use when building accessory
-* children, so the call site reads as
-* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
-* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
-* any role works, including non-accessory ones like Doorbell).
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
 */
-var AccessoryKind = {
-	Siren: DeviceRole.Siren,
-	Floodlight: DeviceRole.Floodlight,
-	Spotlight: DeviceRole.Spotlight,
-	PirSensor: DeviceRole.PirSensor,
-	Chime: DeviceRole.Chime,
-	Autotrack: DeviceRole.Autotrack,
-	Nightvision: DeviceRole.Nightvision,
-	PrivacyMask: DeviceRole.PrivacyMask
-};
-AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
-new Set(Object.values(DeviceType));
-DeviceFeature.BatteryOperated;
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+var ExpressionBindingSourceSchema = union([
+	object({
+		kind: literal("field").optional(),
+		sourceKey: string(),
+		cap: string(),
+		fieldPath: string()
+	}),
+	object({
+		kind: literal("literal"),
+		value: union([
+			string(),
+			number(),
+			boolean(),
+			_null()
+		])
+	}),
+	object({
+		kind: literal("global"),
+		sourceStableId: string(),
+		cap: string(),
+		fieldPath: string()
+	})
+]);
+object({
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
 Object.freeze({
 	"accessories.setChildHidden": {
 		capName: "accessories",
@@ -24808,6 +25184,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.restart": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.setEnabled": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -25444,12 +25826,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.setDeviceLinks": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.setDisabled": {
 		capName: "device-manager",
 		capScope: "system",
@@ -26962,6 +27338,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.completeRetrainTrack": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -26974,6 +27356,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deselectRetrainFrame": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.getActiveTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -27034,6 +27422,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getRetrainExportUrl": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.getRetrainFrameImage": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getSensorEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -27088,6 +27488,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainAnnotations": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainStaging": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listTrackMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -27100,6 +27518,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.proposeRetrainAnnotations": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.pruneEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -27130,12 +27554,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.restageRetrainTrack": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"pipelineAnalytics.saveRetrainAnnotations": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.searchObjectEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.selectRetrainFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -28528,6 +28970,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.fetchEventMedia": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.getAllRtspEntries": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -28612,6 +29060,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.produceEventMedia": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.publishCameraStream": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -43581,37 +44035,37 @@ function errMsg$8(err) {
 }
 //#endregion
 //#region src/mappers/builders/doorbell-delivery.ts
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null;
 }
 function numberOrNull(value) {
 	return typeof value === "number" ? value : null;
 }
 function isConnectionLike(value) {
-	return isRecord(value) && typeof value["hasEventNotifications"] === "function";
+	return isRecord$1(value) && typeof value["hasEventNotifications"] === "function";
 }
-function isIterable(value) {
-	return isRecord(value) && typeof value[Symbol.iterator] === "function";
+function isIterable$1(value) {
+	return isRecord$1(value) && typeof value[Symbol.iterator] === "function";
 }
 /** `accessory._server.httpServer.connections`, or null at any missing hop. */
-function readConnections(accessory) {
-	if (!isRecord(accessory)) return null;
+function readConnections$1(accessory) {
+	if (!isRecord$1(accessory)) return null;
 	const server = accessory["_server"];
-	if (!isRecord(server)) return null;
+	if (!isRecord$1(server)) return null;
 	const httpServer = server["httpServer"];
-	if (!isRecord(httpServer)) return null;
+	if (!isRecord$1(httpServer)) return null;
 	const connections = httpServer["connections"];
-	return isIterable(connections) ? connections : null;
+	return isIterable$1(connections) ? connections : null;
 }
 /**
 * Probe how far a ring on `characteristic` of `accessory` can travel RIGHT NOW.
 * Pure with respect to HAP state — it only reads. Never throws.
 */
 function describeDoorbellDelivery(accessory, characteristic) {
-	const aid = isRecord(accessory) ? numberOrNull(accessory["aid"]) : null;
-	const iid = isRecord(characteristic) ? numberOrNull(characteristic["iid"]) : null;
-	const serverPublished = isRecord(accessory) && isRecord(accessory["_server"]);
-	const connections = readConnections(accessory);
+	const aid = isRecord$1(accessory) ? numberOrNull(accessory["aid"]) : null;
+	const iid = isRecord$1(characteristic) ? numberOrNull(characteristic["iid"]) : null;
+	const serverPublished = isRecord$1(accessory) && isRecord$1(accessory["_server"]);
+	const connections = readConnections$1(accessory);
 	if (connections === null) return {
 		aid,
 		iid,
@@ -43723,10 +44177,16 @@ async function buildMotionSensor(bctx, existing = null) {
 			resetTimer = null;
 		}, RESET_DEBOUNCE_MS);
 	};
+	const motionLog = ctx.logger.withTags({ deviceId: numericDeviceId });
+	const hksvTrigger = existing !== null;
 	const unsubscribe = ctx.eventBus.subscribe({ category: EventCategory.MotionOnMotionChanged }, (event) => {
 		if (event.data.deviceId !== numericDeviceId) return;
 		const detected = event.data.detected === true;
 		motionService.updateCharacteristic(Characteristic.MotionDetected, detected);
+		motionLog.debug("export-hap: motion pushed to HomeKit", { meta: {
+			detected,
+			hksvTrigger
+		} });
 		if (detected) armReset();
 		else if (resetTimer) {
 			clearTimeout(resetTimer);
@@ -44103,36 +44563,84 @@ async function probe(call, label, log) {
 	}
 }
 //#endregion
-//#region src/hksv/recording-options.ts
+//#region src/hksv/controller-census.ts
+var EMPTY_CENSUS = {
+	serverPublished: false,
+	connections: 0,
+	adminConnections: 0,
+	nonAdminConnections: 0,
+	unverifiedConnections: 0,
+	pairedControllers: 0,
+	pairedAdmins: 0
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function isIterable(value) {
+	return isRecord(value) && typeof value[Symbol.iterator] === "function";
+}
+function isAccessoryInfoLike(value) {
+	return isRecord(value) && isRecord(value["pairedClients"]) && typeof value["hasAdminPermissions"] === "function";
+}
+/** `accessory._server.httpServer.connections`, or null at any missing hop. */
+function readConnections(accessory) {
+	const server = accessory["_server"];
+	if (!isRecord(server)) return null;
+	const httpServer = server["httpServer"];
+	if (!isRecord(httpServer)) return null;
+	const connections = httpServer["connections"];
+	return isIterable(connections) ? connections : null;
+}
 /**
-* The HomeKit Secure Video ADVERTISEMENT — `CameraRecordingOptions`, derived
-* from what the fMP4 sink will actually produce for THIS camera.
-*
-* ## The rule this file exists to enforce
-*
-* Never advertise something we cannot serve. That is not a slogan here: it is
-* the diagnosis of [D50](../../../../docs/decisions/adr-0050.md) — an
-* advertised `recording` whose delegate yielded nothing put every motion-capable
-* camera into a ~12 s timeout loop every 20-60 s, all day. So every number below
-* is derived from the picked source (`recording-source.ts`) or from a measured
-* property of the sink, and none of them is a plausible-looking constant.
-*
-* ## The fragment length is the subtle one
-*
-* HKSV requires every media fragment to be **no longer** than the length the
-* controller selected. On the copy branch the fragment length is the SOURCE's
-* key-frame cadence ([D80](../../../../docs/decisions/adr-0080.md)) — we do not
-* get to choose it, we can only be honest about it. So:
-*
-*  - when the camera reports its GOP (`stream-params`), the advertised length is
-*    the smallest offered value that COVERS it;
-*  - when it does not, we advertise the 4000 ms every HKSV camera uses and the
-*    delegate warns at `warn` with `tags: { deviceId }` if the fragments that
-*    actually arrive are longer.
-*
-* A camera whose GOP exceeds the longest value we offer does not advertise
-* recording at all. See {@link deriveFragmentLengthMs}.
+* Census the accessory's HAP connections. Pure with respect to HAP state — it
+* only reads — and never throws.
 */
+function describeHapControllers(accessory) {
+	if (!isRecord(accessory)) return EMPTY_CENSUS;
+	const info = accessory["_accessoryInfo"];
+	const paired = isAccessoryInfoLike(info) ? Object.keys(info.pairedClients) : [];
+	const pairedAdmins = isAccessoryInfoLike(info) ? paired.filter((username) => info.hasAdminPermissions(username)).length : 0;
+	const connections = readConnections(accessory);
+	if (connections === null) return {
+		...EMPTY_CENSUS,
+		pairedControllers: paired.length,
+		pairedAdmins
+	};
+	let open = 0;
+	let admins = 0;
+	let nonAdmins = 0;
+	let unverified = 0;
+	for (const connection of connections) {
+		open += 1;
+		const username = isRecord(connection) ? connection["username"] : void 0;
+		if (typeof username !== "string" || !isAccessoryInfoLike(info)) {
+			unverified += 1;
+			continue;
+		}
+		if (info.hasAdminPermissions(username)) admins += 1;
+		else nonAdmins += 1;
+	}
+	return {
+		serverPublished: true,
+		connections: open,
+		adminConnections: admins,
+		nonAdminConnections: nonAdmins,
+		unverifiedConnections: unverified,
+		pairedControllers: paired.length,
+		pairedAdmins
+	};
+}
+/**
+* True when NO connected controller may write HKSV state. Every
+* `SelectedCameraRecordingConfiguration` write such a controller sends is
+* refused before it reaches us, so the recording configuration can never
+* arrive and the caller must say so out loud.
+*/
+function noAdminControllerConnected(census) {
+	return census.serverPublished && census.connections > 0 && census.adminConnections === 0;
+}
+//#endregion
+//#region src/hksv/recording-options.ts
 /**
 * The prebuffer we promise. HAP's floor is 4000 ms and its documented sensible
 * range is [4000, 8000]; the plane's ring is sized from this, so the two cannot
@@ -44155,6 +44663,16 @@ var HKSV_FRAGMENT_LENGTHS_MS = [4e3, 8e3];
 */
 var HKSV_AUDIO_SAMPLE_RATE_HZ = 24e3;
 /**
+* The frame rates the advertised {@link Resolution} may carry, and the only
+* ones. See {@link normaliseAdvertisedFps} for why the measured rate does not
+* go in raw.
+*/
+var HKSV_ADVERTISED_FRAME_RATES = [
+	15,
+	24,
+	30
+];
+/**
 * The advertised fragment length for a camera whose key-frame cadence is
 * `sourceGopMs`, or `null` when no offered length covers it.
 *
@@ -44170,6 +44688,46 @@ function deriveFragmentLengthMs(sourceGopMs) {
 	return HKSV_FRAGMENT_LENGTHS_MS.find((ms) => ms >= sourceGopMs) ?? null;
 }
 /**
+* The frame rate to ADVERTISE for a slot that was measured at `measuredFps` —
+* the nearest member of {@link HKSV_ADVERTISED_FRAME_RATES}, ties going to the
+* lower rate.
+*
+* The measured rate does not go into the advertisement raw, for two reasons,
+* and the second one is the serious one.
+*
+* **It is the list the controller chooses from.** `[1280, 720, 10]` — 615's
+* measured 720p slot — is a frame rate no shipping HKSV camera offers, and the
+* controller has to find an acceptable configuration in what we advertise
+* before it will write one back.
+*
+* **A measurement makes the advertisement UNSTABLE, and hap-nodejs punishes
+* that by discarding the controller's selection.** `RecordingManagement`
+* hashes the supported-configuration TLVs and, on restore, keeps the persisted
+* `selectedConfiguration` only while the hash still matches — otherwise
+* `deserialize: discarding saved selectedConfiguration`, after which the
+* accessory answers every HDS `DATA_SEND OPEN` with `INVALID_CONFIGURATION`
+* and records nothing until the controller happens to re-select. The
+* advertised resolution is the one hashed input that came from a probe:
+* camera 590 measured 9 fps on one restart and 10 on the next, on
+* 2026-08-07/08, so this was a self-inflicted outage waiting on a reboot.
+* Quantising gives the probe a wide band to move inside without the
+* advertisement changing at all.
+*/
+function normaliseAdvertisedFps(measuredFps) {
+	const fallback = HKSV_ADVERTISED_FRAME_RATES[0] ?? 15;
+	if (!Number.isFinite(measuredFps) || measuredFps <= 0) return fallback;
+	let best = fallback;
+	let bestDistance = Number.POSITIVE_INFINITY;
+	for (const candidate of HKSV_ADVERTISED_FRAME_RATES) {
+		const distance = Math.abs(candidate - measuredFps);
+		if (distance < bestDistance) {
+			best = candidate;
+			bestDistance = distance;
+		}
+	}
+	return best;
+}
+/**
 * Build the advertisement.
 *
 * ONE resolution is advertised — the one slot the recording child pulls. HAP's
@@ -44182,7 +44740,7 @@ function buildRecordingOptions(input) {
 	const resolution = [
 		input.width,
 		input.height,
-		Math.max(1, Math.round(input.fps))
+		normaliseAdvertisedFps(input.fps)
 	];
 	return {
 		prebufferLength: HKSV_PREBUFFER_MS,
@@ -44505,13 +45063,19 @@ var HksvRecordingDelegate = class {
 	updateRecordingActive(active) {
 		if (active === this.active) return;
 		this.active = active;
+		const census = this.input.describeControllers();
 		this.log.info("hksv: recording active changed", {
 			tags: { deviceId: this.input.deviceId },
 			meta: {
 				active,
-				hasConfiguration: this.configuration !== void 0
+				hasConfiguration: this.configuration !== void 0,
+				...census
 			}
 		});
+		if (active && this.configuration === void 0 && noAdminControllerConnected(census)) this.log.warn("hksv: recording is ON but NO connected controller holds admin — the recording configuration can never arrive", {
+			tags: { deviceId: this.input.deviceId },
+			meta: { ...census }
+		});
 		this.reconcile("recording-active");
 	}
 	updateRecordingConfiguration(configuration) {
@@ -44566,13 +45130,14 @@ var HksvRecordingDelegate = class {
 			streamId,
 			subscription
 		};
-		const startedAt = Date.now();
+		const startedAt = this.input.now();
 		const prebufferSpanMs = source.prebufferSpanMs();
 		let packets = 0;
 		let bytes = 0;
 		let markedLast = false;
 		let longestFragmentGapMs = 0;
-		let lastPacketAt = startedAt;
+		let firstFragmentAt = null;
+		let lastFragmentAt = null;
 		try {
 			for await (const packet of subscription.packets()) {
 				if (signal?.aborted === true) {
@@ -44588,9 +45153,10 @@ var HksvRecordingDelegate = class {
 				packets += 1;
 				bytes += packet.data.length;
 				if (packet.kind === "fragment") {
-					const now = Date.now();
-					longestFragmentGapMs = Math.max(longestFragmentGapMs, now - lastPacketAt);
-					lastPacketAt = now;
+					const now = this.input.now();
+					if (lastFragmentAt === null) firstFragmentAt = now;
+					else longestFragmentGapMs = Math.max(longestFragmentGapMs, now - lastFragmentAt);
+					lastFragmentAt = now;
 				}
 				markedLast = markedLast || packet.isLast;
 				yield {
@@ -44625,9 +45191,10 @@ var HksvRecordingDelegate = class {
 					streamId,
 					packets,
 					bytes,
-					durationMs: Date.now() - startedAt,
+					durationMs: this.input.now() - startedAt,
 					prebufferSpanMs,
 					longestFragmentGapMs,
+					msToFirstFragmentMs: firstFragmentAt === null ? null : firstFragmentAt - startedAt,
 					closedReason: subscription.closedReason,
 					markedLast
 				}
@@ -44844,6 +45411,8 @@ async function buildHksvRecording(input) {
 		deviceId: numericDeviceId,
 		isAudioActive: input.isAudioActive,
 		advertisedFragmentMs: fragmentLengthMs,
+		now: () => Date.now(),
+		describeControllers: () => describeHapControllers(bctx.accessory),
 		createSource: ({ fragmentMs, audioActive }) => new HksvFragmentSource({
 			logger: log,
 			deviceId: numericDeviceId,
@@ -44854,11 +45423,13 @@ async function buildHksvRecording(input) {
 			audioActive
 		})
 	});
+	const advertisedResolution = options.video.resolutions[0];
 	log.info("export-hap: HKSV ADVERTISED — recording is offered for this camera", { meta: {
 		brokerId: source.brokerId,
 		profile: source.profile,
 		resolution: `${source.width}x${source.height}`,
-		fps,
+		measuredFps: fps,
+		advertisedFps: advertisedResolution?.[2] ?? null,
 		fragmentLengthMs,
 		sourceGopMs: gopMs ?? "unknown"
 	} });
@@ -45395,8 +45966,21 @@ function syncStateToJson(map) {
 */
 var DEFAULT_DEVICE_SETTINGS = {
 	streamPreference: "auto",
-	hksvRecording: false
+	hksvRecording: true
 };
+/**
+* ON unless explicitly switched off — operator decision 2026-08-08 (flipped
+* from the launch default of off). ABSENT must resolve to ON or the flip is a
+* lie for every entry persisted before the field existed, so every read goes
+* through this one resolver (`!== false`), never a scattered `=== true`. The
+* cost that made off-by-default look prudent is measured and small on the only
+* branch the recorder accepts (copy: 0.7 % of a core / ~30 MB RSS, D84), and a
+* camera the recorder cannot copy refuses recording with a logged reason
+* rather than paying for a transcode.
+*/
+function resolveHksvRecording(settings) {
+	return settings?.hksvRecording !== false;
+}
 var HAP_STREAM_PREFERENCE_OPTIONS = [
 	{
 		value: "auto",
@@ -45673,7 +46257,7 @@ var ExportHapAddon = class extends BaseAddon {
 				decodeMemos: this.decodeMemos,
 				hapDeviceSettings: {
 					streamPreference: entrySettings.streamPreference ?? "auto",
-					hksvRecording: entrySettings.hksvRecording === true
+					hksvRecording: resolveHksvRecording(entrySettings)
 				}
 			}
 		});
@@ -46024,7 +46608,7 @@ var ExportHapAddon = class extends BaseAddon {
 						label: "HomeKit recording (Secure Video)",
 						description: "Offer “Stream and Allow Recording” in iOS Home. Requires iCloud+ and a home hub. Keeps a continuous 8s prebuffer for this camera (~0.7% of one CPU core, H.264 sources only).",
 						style: "switch",
-						value: settings.hksvRecording === true,
+						value: resolveHksvRecording(settings),
 						showWhen: {
 							field: enabledKey,
 							equals: true
@@ -46058,7 +46642,7 @@ var ExportHapAddon = class extends BaseAddon {
 		const enabledValue = enabledKey in patch ? Boolean(patch[enabledKey]) : wasEnabled;
 		const streamPreferenceRaw = streamPreferenceKey in patch ? patch[streamPreferenceKey] : current?.settings?.streamPreference;
 		const streamPreference = typeof streamPreferenceRaw === "string" && streamPreferenceRaw.trim().length > 0 ? streamPreferenceRaw : "auto";
-		const hksvRecording = hksvKey in patch ? Boolean(patch[hksvKey]) : current?.settings?.hksvRecording === true;
+		const hksvRecording = hksvKey in patch ? Boolean(patch[hksvKey]) : resolveHksvRecording(current?.settings);
 		const nextSettings = {
 			...current?.settings ?? DEFAULT_DEVICE_SETTINGS,
 			streamPreference,
@@ -46074,7 +46658,7 @@ var ExportHapAddon = class extends BaseAddon {
 			return { success: true };
 		}
 		const currentPref = current?.settings?.streamPreference ?? "auto";
-		const currentHksv = current?.settings?.hksvRecording === true;
+		const currentHksv = resolveHksvRecording(current?.settings);
 		await this.updateEntrySettings(deviceIdStr, nextSettings);
 		if (currentPref !== streamPreference || currentHksv !== hksvRecording) {
 			log.info("export-hap: per-camera export settings changed — refreshing accessory", { meta: {
@@ -46129,4 +46713,4 @@ function errMsg(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
-export { ExportHapAddon, ExportHapAddon as default, unpublishAccessory as i, initHapStorage as n, publishStandalone as r, deriveUsername as t };
+export { ExportHapAddon, ExportHapAddon as default, unpublishAccessory as i, initHapStorage as n, publishStandalone as r, resolveHksvRecording, deriveUsername as t };