@camstack/addon-pipeline 1.2.47 → 1.2.48

package/dist/{dist-CfxC7XoI.mjs → dist-DoTw0NM3.mjs}

@@ -7133,7 +7133,7 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/fmp4-box-splitter-B53u9-Nu.mjs
+//#region ../types/dist/canonical-hash-rO1sRmEK.mjs
 var AUDIO_ENCODER_BY_CODEC = {
 	opus: "libopus",
 	aac: "aac",
@@ -7538,37 +7538,6 @@ function invocationFromEncodeProfile(input) {
 		...input.audioSidecar !== void 0 ? { audioSidecar: input.audioSidecar } : {}
 	};
 }
-/**
-* Deterministic SHA-256 hash of an arbitrary serialisable value. The
-* canonical form sorts object keys alphabetically at every depth so two
-* structurally-equal inputs with different key insertion orders produce
-* the same hash. Returns a 64-char lowercase hex digest.
-*
-* Used by export adapters (Alexa, HAP) to short-circuit re-discovery /
-* accessory-rebuild work when the upstream shape is byte-identical to
-* the last applied state — preventing user-visible "re-discovery"
-* notifications on every addon-runner respawn. Each respawn re-fires
-* `DeviceBindingsChanged` for every cap registration, which without
-* this guard would propagate redundant pushes.
-*
-* Note: this is a SYMPTOMATIC fix layered on top of the binding-change
-* subscription. The proper fix is a single "device ready" lifecycle
-* barrier so exports react only when the full cap set has landed —
-* tracked separately for post-HA-integration work.
-*/
-function canonicalHash(value) {
-	const canonical = JSON.stringify(value, replaceWithSortedKeys);
-	return createHash("sha256").update(canonical ?? "").digest("hex");
-}
-function replaceWithSortedKeys(_key, value) {
-	if (value && typeof value === "object" && !Array.isArray(value)) {
-		const obj = value;
-		const out = {};
-		for (const k of Object.keys(obj).toSorted()) out[k] = obj[k];
-		return out;
-	}
-	return value;
-}
 var DEFAULT_MAX_UNIT_BYTES = 16 * 1024 * 1024;
 /** Header size for a normal box, and for one carrying a 64-bit `largesize`. */
 var BOX_HEADER_BYTES = 8;
@@ -7741,6 +7710,37 @@ var Fmp4BoxSplitter = class {
 		return [];
 	}
 };
+/**
+* Deterministic SHA-256 hash of an arbitrary serialisable value. The
+* canonical form sorts object keys alphabetically at every depth so two
+* structurally-equal inputs with different key insertion orders produce
+* the same hash. Returns a 64-char lowercase hex digest.
+*
+* Used by export adapters (Alexa, HAP) to short-circuit re-discovery /
+* accessory-rebuild work when the upstream shape is byte-identical to
+* the last applied state — preventing user-visible "re-discovery"
+* notifications on every addon-runner respawn. Each respawn re-fires
+* `DeviceBindingsChanged` for every cap registration, which without
+* this guard would propagate redundant pushes.
+*
+* Note: this is a SYMPTOMATIC fix layered on top of the binding-change
+* subscription. The proper fix is a single "device ready" lifecycle
+* barrier so exports react only when the full cap set has landed —
+* tracked separately for post-HA-integration work.
+*/
+function canonicalHash(value) {
+	const canonical = JSON.stringify(value, replaceWithSortedKeys);
+	return createHash("sha256").update(canonical ?? "").digest("hex");
+}
+function replaceWithSortedKeys(_key, value) {
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const obj = value;
+		const out = {};
+		for (const k of Object.keys(obj).toSorted()) out[k] = obj[k];
+		return out;
+	}
+	return value;
+}
 //#endregion
 //#region ../types/dist/err-msg-IQTHeDzc.mjs
 /**
@@ -10542,12 +10542,34 @@ var streamBrokerCapability = {
 			kinds: array(EventMediaKindSchema).min(1).default(["mp4"]),
 			/** GIF geometry. The video keeps the source's own. */
 			gifMaxWidth: number().int().min(120).max(1280).default(640),
-			gifFps: number().int().min(1).max(15).default(8),
 			/**
-			* Playback rate, applied to EVERY container so they stay one clip.
-			* `1` is real time and is what allows the copy branch.
+			* The gif's own PLAYBACK rate in frames per second — what the finished
+			* gif runs at, not how many source frames feed it. The decimation that
+			* feeds it samples `gifFps / gifSpeed` source frames per second, so at
+			* the defaults a 12 fps gif is built out of 3 source frames a second.
+			*/
+			gifFps: number().int().min(1).max(15).default(12),
+			/**
+			* How fast the GIF plays against real time, independent of `speed`.
+			*
+			* 4× by default, by operator request: a notification gif is glanced at
+			* on a lock screen, so a ~12 s window has to be over in ~3 s. It stays
+			* a separate knob from `speed` even though both now default to 4 —
+			* a caller wanting a real-time video and a fast gif must not have to
+			* choose.
+			*/
+			gifSpeed: number().min(1).max(8).default(4),
+			/**
+			* Playback rate of the VIDEO. Also 4× by default, by operator decision.
+			*
+			* `1` is real time and is the ONLY value that allows the copy branch —
+			* anything else forces `libx264` over the window. That was priced
+			* before it was chosen: a per-event burst measured at 0.23 s and 254 KB
+			* on a real 615 720p cut, against 922 KB for the copy it replaces. A
+			* re-encode is capped at 720p (`EVENT_CLIP_ENCODE_MAX_WIDTH`), because
+			* once the decode is forced the width stops being free.
 			*/
-			speed: number().min(1).max(8).default(1)
+			speed: number().min(1).max(8).default(4)
 		}), EventMediaProductionSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -10998,25 +11020,6 @@ var cameraStreamsCapability = {
 		lastChangedAt: number()
 	})
 };
-/**
-* core-blocks — user-authored TypeScript, stored in the kernel and executed in
-* its own process.
-*
-* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
-*
-* The first use is **owning devices without being a device provider**: a block
-* declares devices under a system or custom integration and drives their state,
-* with the same `ctx` an addon gets. Automations come later; nothing here
-* models a trigger.
-*
-* **Stated plainly, because it does not change by being true:** a block has an
-* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
-* with no review step. What makes that survivable is not a sandbox, it is
-* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
-* so a block that throws or never returns is marked `failed` and visible
-* instead of taking the hub with it (D6). Every method here is admin-only, and
-* must stay so.
-*/
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
@@ -11088,6 +11091,9 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), object({ block: CoreBlockSchema }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ blockId: string() }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ code: string() }), CoreBlockCompileResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -11819,713 +11825,118 @@ var ExposeInputSchema = object({
 });
 var UnexposeInputSchema = object({ deviceId: string() });
 method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), { kind: "mutation" }), method(UnexposeInputSchema, _void(), { kind: "mutation" });
+var ProviderStatusSchema = object({
+	connected: boolean(),
+	deviceCount: number(),
+	error: string().optional()
+});
+object({
+	externalId: string(),
+	name: string(),
+	type: string(),
+	metadata: record(string(), unknown()).optional()
+});
 /**
-* Resource-bound constants for the safe expression engine.
-*
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
+* Candidate handed back from discovery and accepted by
+* `adoptDiscoveredDevice`. Shape mirrors the in-process
+* `DiscoveredDevice` interface used by `DeviceDiscovery`.
 */
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
+var DiscoveryCandidateSchema = object({
+	stableId: string(),
+	type: _enum(DeviceType),
+	suggestedName: string(),
+	prefilledConfig: record(string(), unknown()),
+	/**
+	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
+	* Discovery pre-populates this for systems that know the upstream
+	* identity ahead of adoption. Rendering metadata (unit, precision)
+	* flows live through the cap STATUS SLICE after adoption.
+	*/
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
+* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
+* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
+* tRPC layer can pass it through without reshaping.
 */
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
+var DeviceSummarySchema = object({
+	id: number(),
+	stableId: string(),
+	addonId: string(),
+	type: string(),
+	name: string(),
+	parentDeviceId: number().nullable(),
+	online: boolean(),
+	features: array(string()),
+	config: record(string(), unknown()),
+	/** Optional upstream-system identity (dispatch key + system tag).
+	*  See `SourceInfo`. Present when the device has a non-synthetic
+	*  source identifier (HA entities, vendor MAC, …); omitted when the
+	*  synthetic backfill is in effect. */
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
+* Result of a live field test (e.g. probing an RTSP URL during device
+* creation). Matches the UI-side `FieldProbeResult` in
+* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
+* returned `labels` as chips next to the input.
+*/
+var FieldProbeResultSchema = object({
+	status: _enum(["ok", "error"]),
+	labels: array(string()).optional(),
+	error: string().optional()
+});
+/**
+* The output of `getChildCreationSchema` is a UI schema tree. We store
+* it as `unknown` at the capability layer — the router just passes it
+* through and the admin UI renders it via `FormBuilder`. The actual
+* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
+* but we deliberately avoid a Zod mirror because the union is large and
+* not meant for runtime validation at this seam.
+*/
+var CreationSchemaOutputSchema = unknown();
+method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), ProviderStatusSchema), method(_void(), array(object({
+	id: string(),
+	name: string(),
+	type: string()
+}))), method(object({}), boolean()), method(object({ params: record(string(), unknown()).optional() }), array(DiscoveryCandidateSchema), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), CreationSchemaOutputSchema), method(object({}), object({ deviceType: _enum(DeviceType).nullable() })), method(object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), boolean()), method(object({ type: _enum(DeviceType) }), CreationSchemaOutputSchema), method(object({
+	type: _enum(DeviceType),
+	config: record(string(), unknown())
+}), DeviceSummarySchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	type: _enum(DeviceType),
+	key: string(),
+	value: unknown(),
+	formValues: record(string(), unknown()).optional()
+}), FieldProbeResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* Device Manager capability — hub-side singleton that unifies device persistence,
+* live registry access, and all management operations into a single tRPC surface.
 *
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
+* Replaces:
+*   - `device-persistence` capability (persistence methods absorbed here)
+*   - `device-management.router.ts` (deleted in Phase 2)
+*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
 *
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
-*/
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
-};
-Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
-/**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
-*/
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
-/**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
-*
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
-*
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
-*/
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
-	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
-/**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
-*
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-Object.freeze({});
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
-*/
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
-var ProviderStatusSchema = object({
-	connected: boolean(),
-	deviceCount: number(),
-	error: string().optional()
-});
-object({
-	externalId: string(),
-	name: string(),
-	type: string(),
-	metadata: record(string(), unknown()).optional()
-});
-/**
-* Candidate handed back from discovery and accepted by
-* `adoptDiscoveredDevice`. Shape mirrors the in-process
-* `DiscoveredDevice` interface used by `DeviceDiscovery`.
-*/
-var DiscoveryCandidateSchema = object({
-	stableId: string(),
-	type: _enum(DeviceType),
-	suggestedName: string(),
-	prefilledConfig: record(string(), unknown()),
-	/**
-	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
-	* Discovery pre-populates this for systems that know the upstream
-	* identity ahead of adoption. Rendering metadata (unit, precision)
-	* flows live through the cap STATUS SLICE after adoption.
-	*/
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
-* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
-* tRPC layer can pass it through without reshaping.
-*/
-var DeviceSummarySchema = object({
-	id: number(),
-	stableId: string(),
-	addonId: string(),
-	type: string(),
-	name: string(),
-	parentDeviceId: number().nullable(),
-	online: boolean(),
-	features: array(string()),
-	config: record(string(), unknown()),
-	/** Optional upstream-system identity (dispatch key + system tag).
-	*  See `SourceInfo`. Present when the device has a non-synthetic
-	*  source identifier (HA entities, vendor MAC, …); omitted when the
-	*  synthetic backfill is in effect. */
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Result of a live field test (e.g. probing an RTSP URL during device
-* creation). Matches the UI-side `FieldProbeResult` in
-* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
-* returned `labels` as chips next to the input.
-*/
-var FieldProbeResultSchema = object({
-	status: _enum(["ok", "error"]),
-	labels: array(string()).optional(),
-	error: string().optional()
-});
-/**
-* The output of `getChildCreationSchema` is a UI schema tree. We store
-* it as `unknown` at the capability layer — the router just passes it
-* through and the admin UI renders it via `FormBuilder`. The actual
-* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
-* but we deliberately avoid a Zod mirror because the union is large and
-* not meant for runtime validation at this seam.
-*/
-var CreationSchemaOutputSchema = unknown();
-method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), ProviderStatusSchema), method(_void(), array(object({
-	id: string(),
-	name: string(),
-	type: string()
-}))), method(object({}), boolean()), method(object({ params: record(string(), unknown()).optional() }), array(DiscoveryCandidateSchema), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), CreationSchemaOutputSchema), method(object({}), object({ deviceType: _enum(DeviceType).nullable() })), method(object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), boolean()), method(object({ type: _enum(DeviceType) }), CreationSchemaOutputSchema), method(object({
-	type: _enum(DeviceType),
-	config: record(string(), unknown())
-}), DeviceSummarySchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	type: _enum(DeviceType),
-	key: string(),
-	value: unknown(),
-	formValues: record(string(), unknown()).optional()
-}), FieldProbeResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
+* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
+* fork into separate processes but never run on remote cluster agents. Therefore:
+*   - No nodeId routing needed — this is a pure hub singleton.
+*   - The hub's DeviceRegistry is the single source of truth for all live devices.
+*   - No shadow registry or cross-node aggregation required.
+*
+* Forked workers register devices back to the hub via `ctx.devices`
+* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
 */
 /** One child-placement directive on a container's `childLayout`. Structurally
 *  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
@@ -12538,92 +11949,6 @@ var ChildLayoutEntrySchema = object({
 	order: number().optional(),
 	collapsed: boolean().optional()
 });
-/** Cap-wire shape of a DeviceLink — structurally mirrors `DeviceLink` in
-*  `device-management.ts`. Source is a union: a FIELD source copies a sibling
-*  accessory's status field (`kind` optional/absent for wire compat); a
-*  LITERAL source carries a per-device constant (no sibling is read); a
-*  GLOBAL source (P2e) copies ANY device's status field, addressed by the
-*  source device's full re-sync-stable `stableId`. */
-var DeviceLinkFieldSourceSchema = object({
-	kind: literal("field").optional(),
-	sourceKey: string(),
-	cap: string(),
-	fieldPath: string()
-});
-var DeviceLinkLiteralSourceSchema = object({
-	kind: literal("literal"),
-	value: union([
-		string(),
-		number(),
-		boolean(),
-		_null()
-	])
-});
-var DeviceLinkGlobalSourceSchema = object({
-	kind: literal("global"),
-	sourceStableId: string(),
-	cap: string(),
-	fieldPath: string()
-});
-/** Expression source (Stage X): compute the target field from N named bindings
-*  via the safe expression engine. Bindings are field | literal | global — never
-*  another expression (no nesting). The `superRefine` runs the SAME author-time
-*  validation as `validateExpressionSource` (compiles the expr, checks binding
-*  names + identifier coverage) so every wire boundary that parses a DeviceLink
-*  (tRPC mount, kernel create pre-seed, projection output) validates-at-write.
-*  Compiles are LRU-cached, so repeated validation of the same expr is a hit. */
-var DeviceLinkExpressionSourceSchema = object({
-	kind: literal("expression"),
-	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema
-	]))
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-var DeviceLinkSchema = object({
-	id: string(),
-	source: union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema,
-		DeviceLinkExpressionSourceSchema
-	]),
-	target: object({
-		cap: string(),
-		fieldPath: string(),
-		itemKey: string().optional()
-	}),
-	transform: discriminatedUnion("kind", [
-		object({ kind: literal("identity") }),
-		object({
-			kind: literal("enum-map"),
-			mapping: record(string(), union([
-				string(),
-				number(),
-				boolean()
-			])),
-			fallback: union([
-				string(),
-				number(),
-				boolean()
-			]).optional()
-		}),
-		object({
-			kind: literal("linear"),
-			scale: number(),
-			offset: number(),
-			clamp: tuple([number(), number()]).readonly().optional()
-		})
-	]).optional()
-});
 /** Cap-wire shape of a per-cap display refinement — mirrors
 *  `DeviceCapDisplayOverride` in `device-management.ts`. */
 var DeviceCapDisplayOverrideSchema = object({
@@ -12703,8 +12028,6 @@ var DeviceInfoSchema = object({
 	*  named accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
 	display: DeviceDisplayOverrideSchema.optional()
 });
@@ -12713,7 +12036,7 @@ var ConfigEntrySchema = object({
 	value: unknown(),
 	description: string().optional()
 });
-var DeviceLinkModeSchema = _enum(["auto", "manual"]);
+var LinkedDevicesModeSchema = _enum(["auto", "manual"]);
 /** One resolved linked device — the compact projection consumers need. */
 var LinkedDeviceSchema = object({
 	deviceId: number(),
@@ -12776,8 +12099,6 @@ var DeviceMetaSchema = object({
 	*  accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Semantic role string (`DeviceRole`) — propagated from the spawn pre-seed.
 	*  Optional: only present for accessory children that carry a known role. */
 	role: string().nullable().optional(),
@@ -12870,12 +12191,6 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	deviceLinks: array(DeviceLinkSchema).readonly()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	display: DeviceDisplayOverrideSchema.nullable()
@@ -12957,7 +12272,7 @@ method(object({
 	*  shipping 293 rows to find 12. */
 	isCamera: boolean().optional()
 }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
-	mode: DeviceLinkModeSchema,
+	mode: LinkedDevicesModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
 	deviceId: number(),
@@ -12990,11 +12305,7 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum([
-			"native",
-			"wrapped",
-			"linked"
-		]),
+		kind: _enum(["native", "wrapped"]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -13003,11 +12314,7 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum([
-			"native",
-			"wrapped",
-			"linked"
-		]),
+		kind: _enum(["native", "wrapped"]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -13816,6 +13123,10 @@ var motionDetectionCapability = {
 	mode: "singleton",
 	kind: "wrapper",
 	defaultActive: true,
+	/** Frame-differencing motion analysis over a video stream — only a camera
+	*  produces the frames. Read by the `defaultActive` auto-bind in
+	*  `device-manager.getBindings` to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
 	exposesDeviceSettings: true,
 	methods: {
 		analyze: method(object({
@@ -16338,6 +15649,18 @@ var OauthIntegrationDescriptorSchema = object({
 	*  redirect_uri that does not start with one of these. Required —
 	*  an empty list means the integration can never complete linking. */
 	allowedRedirectPrefixes: array(string()).min(1),
+	/** Paths accepted as a `redirect_uri` when the host is PRIVATE — loopback,
+	*  RFC1918, CGNAT (100.64/10, Tailscale), link-local, IPv6 ULA, or an
+	*  `.local` / `.internal` / `.ts.net` name. Exists for self-hosted clients
+	*  whose address the hub cannot know in advance (a Home Assistant at
+	*  `http://<lan-ip>:8123/auth/external/callback`). The PATH must match
+	*  exactly; a public host never satisfies this branch, so it is not a
+	*  wildcard prefix by another name. */
+	allowedPrivateHostPaths: array(string()).optional(),
+	/** When true this is a PUBLIC client (source is published, no secret can be
+	*  protected) and PKCE is mandatory: `/authorize` refuses without an S256
+	*  `code_challenge`, `/token` refuses without the matching `code_verifier`. */
+	requiresPkce: boolean().optional(),
 	/** Optional public origin (no trailing slash) that this integration's
 	*  issued codes/tokens should carry as the `hubUrl` claim — typically the
 	*  operator-selected external-access endpoint resolved by the addon. When
@@ -16488,7 +15811,7 @@ var TrackEnvelopeSchema = object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -16725,6 +16048,24 @@ var TrackSchema = object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
+	/**
+	* A face DETECTOR found a face on this track — nothing more. It says the
+	* detail plane produced a `face` detail; it does NOT say the face was
+	* embedded, matched, above `minFacePx`, or that the recognizer was even
+	* enabled. Set once and never cleared.
+	*
+	* **This exists so "face present but not recognised" is expressible.** A
+	* recognised identity lands in `subLabel` (attributed to the face chain via
+	* `subLabelMeta.stepId`), so before this field a track with an unmatched face
+	* and a track with no face at all were byte-identical on the wire and no
+	* surface could tell them apart. The read is `hasFace === true && subLabel
+	* === undefined`.
+	*
+	* **Absent ≠ false.** Every row written before the column existed omits it,
+	* and so does every server that predates the field — a consumer must test
+	* `=== true` and render nothing otherwise, never infer "no face".
+	*/
+	hasFace: boolean().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -19633,6 +18974,10 @@ var SsoBridgeClaimsSchema = object({
 	integrationId: string().optional(),
 	/** JWT ID — unique per issued code; consumed-set enforces single-use. */
 	jti: string().optional(),
+	/** PKCE S256 challenge — set only on `oauth-code` tokens issued to a public
+	*  client. Its PRESENCE is what makes the verifier mandatory at exchange,
+	*  so the requirement travels with the code and not with mutable config. */
+	codeChallenge: string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
 	sessionId: string().optional()
@@ -20200,7 +19545,7 @@ var ClipPlaybackSchema = object({
 	playbackEndpoints: array(string()).optional(),
 	token: string().optional()
 });
-method(object({
+DeviceType.Camera, method(object({
 	deviceId: number(),
 	since: number(),
 	until: number(),
@@ -25456,13 +24801,18 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	username: string(),
 	scopes: array(TokenScopeSchema),
 	redirectUri: string(),
-	hubUrl: string()
+	hubUrl: string(),
+	/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
+	*  that carries one can ONLY be exchanged with the matching verifier. */
+	codeChallenge: string().optional()
 }), object({ code: string() }), {
 	kind: "mutation",
 	access: "create"
 }), method(object({
 	code: string(),
-	redirectUri: string()
+	redirectUri: string(),
+	/** PKCE verifier. REQUIRED when the code carries a challenge. */
+	codeVerifier: string().optional()
 }), object({
 	accessToken: string(),
 	refreshToken: string(),
@@ -25689,190 +25039,819 @@ object({
 });
 DeviceType.Weather;
 /**
-* Per-zone occupancy aggregation produced by the analytics frame
-* processor on every inference result. Covers the full combinatorial
-* matrix the operator UI needs: total objects everywhere, total
-* objects per zone, single class everywhere, single class per zone,
-* objects outside any zone.
+* Per-zone occupancy aggregation produced by the analytics frame
+* processor on every inference result. Covers the full combinatorial
+* matrix the operator UI needs: total objects everywhere, total
+* objects per zone, single class everywhere, single class per zone,
+* objects outside any zone.
+*
+* Counts are derived from the analytics tracker (tracked detections
+* with stable trackIds), not raw detector hits — this filters out
+* one-off detector flickers and gives counts that match what the user
+* sees on the live overlay.
+*
+* Overlap policy: a detection that intersects two zones counts in
+* BOTH zones' `byClass` and `totalObjects` (count-in-each). The
+* `frame` aggregate de-duplicates trivially since it's frame-wide.
+* `unzoned` counts only detections that landed in zero zones.
+*/
+var PerScopeBreakdownSchema = object({
+	/** Total tracked objects in this scope (frame / zone / unzoned). */
+	totalObjects: number().int().nonnegative(),
+	/** Per-class count. Keys are macro class names (e.g. `person`, `car`). */
+	byClass: record(string(), number().int().nonnegative())
+});
+var ZoneScopeBreakdownSchema = PerScopeBreakdownSchema.extend({
+	zoneId: string(),
+	zoneName: string(),
+	/** TrackIds of objects currently inside this zone — for cross-reference
+	*  with the per-track detail panel and live overlay. */
+	trackIds: array(string()).readonly()
+});
+/**
+* A parked ("stationary") object surfaced alongside occupancy — an object that
+* settled and stopped moving. It is NO LONGER a tracked object (the tracker was
+* told to forget it so it stops re-spawning tracks/events), but it IS still
+* physically present, so it keeps counting toward `frame` occupancy and is
+* listed here so the UI can show it in a dedicated "Stationary" section instead
+* of flooding the live event feed.
+*/
+var StationaryObjectSchema = object({
+	id: string(),
+	className: string(),
+	bbox: object({
+		x: number(),
+		y: number(),
+		w: number(),
+		h: number()
+	}),
+	frameWidth: number().int().nonnegative(),
+	frameHeight: number().int().nonnegative(),
+	/** When the source track was first seen. */
+	firstSeenAt: number().int(),
+	/** When the object was recognised as parked (promotion time). */
+	becameStationaryAt: number().int(),
+	/** Last frame a detection confirmed the object is still there. */
+	lastConfirmedAt: number().int(),
+	/** Enrichment label carried from the source track (identity / plate). */
+	label: string().optional(),
+	/** Native-resolution key-frame media key for the parked object's best image. */
+	keyFrameMediaKey: string().optional()
+});
+var CameraOccupancySnapshotSchema = object({
+	/** Frame timestamp of the inference result that produced this snapshot. */
+	ts: number().int(),
+	/** Frame width/height in pixels — let the UI normalize bbox coords. */
+	frameWidth: number().int().nonnegative(),
+	frameHeight: number().int().nonnegative(),
+	/** Per-zone breakdown — one entry per defined zone (user + onboard). */
+	zones: array(ZoneScopeBreakdownSchema).readonly(),
+	/** Frame-wide aggregate (everywhere, regardless of zone membership).
+	*  INCLUDES currently-confirmed stationary objects (they are still present). */
+	frame: PerScopeBreakdownSchema,
+	/** Detections that landed outside every zone. Empty when no zones defined. */
+	unzoned: PerScopeBreakdownSchema,
+	/** Parked objects on this camera (additive — absent on legacy snapshots).
+	*  Surfaced separately so the UI shows them in a dedicated section rather
+	*  than as repeated tracks/events. */
+	stationaryObjects: array(StationaryObjectSchema).readonly().optional()
+});
+/**
+* Time-series resolution. The history methods return one bucket per
+* step over the requested range. Smaller resolutions cost more
+* memory + bandwidth; bound to discrete steps so caller cannot ask
+* for arbitrary fractional buckets.
+*/
+var HistoryResolutionEnum = _enum([
+	"minute",
+	"5min",
+	"hour"
+]);
+var HistoryRangeSchema = object({
+	/** Range start (epoch ms, inclusive). */
+	from: number().int(),
+	/** Range end (epoch ms, inclusive). Defaults to "now" at query time. */
+	to: number().int(),
+	resolution: HistoryResolutionEnum
+});
+var HistoryPointSchema = object({
+	/** Bucket midpoint (epoch ms). */
+	ts: number().int(),
+	/** Object count averaged over the bucket (rounded to nearest integer). */
+	count: number().int().nonnegative()
+});
+DeviceType.Camera, method(object({ deviceId: number() }), CameraOccupancySnapshotSchema.nullable()), method(object({
+	deviceId: number(),
+	zoneId: string(),
+	className: string().optional()
+}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly()), method(object({
+	deviceId: number(),
+	className: string().optional()
+}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly()), method(object({
+	deviceId: number(),
+	className: string().optional()
+}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly());
+/**
+* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
+* cap so a single CRUD surface backs every consumer; each stage has
+* its own dev-state mirror slice (`motion-zone-rules`,
+* `detection-zone-rules`, …) so consumer addons subscribe independently.
+*
+* Extend the enum here when a new gating consumer comes online (audio
+* gating, alert filtering, …) — no other surface needs to change.
+*/
+var ZoneRuleStageEnum = _enum([
+	"motion",
+	"detection",
+	"package"
+]);
+DeviceType.Camera, method(object({
+	deviceId: number(),
+	stage: ZoneRuleStageEnum
+}), array(ZoneRuleSchema).readonly()), method(object({
+	deviceId: number(),
+	stage: ZoneRuleStageEnum,
+	rules: array(ZoneRuleSchema).readonly()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), object({
+	motion: array(ZoneRuleSchema).readonly(),
+	detection: array(ZoneRuleSchema).readonly(),
+	package: array(ZoneRuleSchema).readonly()
+});
+var HF_BASE_URL = `https://huggingface.co/camstack/camstack-models/resolve/main`;
+/**
+* Accessory device helpers — shared across drivers.
+*
+* Many vendor-specific drivers register accessory child devices on
+* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
+* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
+* driver picks the right `DeviceType` + `DeviceRole` explicitly when
+* spawning, builds a name derived from the parent, and produces a
+* stableId tied to the parent so boot-restore can reconstruct the
+* relationship.
+*
+* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
+* drivers may reasonably disagree on the right type for an accessory
+* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
+* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
+* one canonical mapping was over-prescriptive and added a layer of
+* indirection without saving meaningful code at call sites — the
+* driver knows its own hardware best.
+*/
+/**
+* Subset of `DeviceRole` values that drivers register as child
+* accessories of a parent device. Sourced verbatim from `DeviceRole`
+* — `AccessoryKind` is the alias drivers use when building accessory
+* children, so the call site reads as
+* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
+* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
+* any role works, including non-accessory ones like Doorbell).
+*/
+var AccessoryKind = {
+	Siren: DeviceRole.Siren,
+	Floodlight: DeviceRole.Floodlight,
+	Spotlight: DeviceRole.Spotlight,
+	PirSensor: DeviceRole.PirSensor,
+	Chime: DeviceRole.Chime,
+	Autotrack: DeviceRole.Autotrack,
+	Nightvision: DeviceRole.Nightvision,
+	PrivacyMask: DeviceRole.PrivacyMask
+};
+AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+new Set(Object.values(DeviceType));
+DeviceFeature.BatteryOperated;
+/**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+/**
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
 *
-* Counts are derived from the analytics tracker (tracked detections
-* with stable trackIds), not raw detector hits — this filters out
-* one-off detector flickers and gives counts that match what the user
-* sees on the live overlay.
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
 *
-* Overlap policy: a detection that intersects two zones counts in
-* BOTH zones' `byClass` and `totalObjects` (count-in-each). The
-* `frame` aggregate de-duplicates trivially since it's frame-wide.
-* `unzoned` counts only detections that landed in zero zones.
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
 */
-var PerScopeBreakdownSchema = object({
-	/** Total tracked objects in this scope (frame / zone / unzoned). */
-	totalObjects: number().int().nonnegative(),
-	/** Per-class count. Keys are macro class names (e.g. `person`, `car`). */
-	byClass: record(string(), number().int().nonnegative())
-});
-var ZoneScopeBreakdownSchema = PerScopeBreakdownSchema.extend({
-	zoneId: string(),
-	zoneName: string(),
-	/** TrackIds of objects currently inside this zone — for cross-reference
-	*  with the per-track detail panel and live overlay. */
-	trackIds: array(string()).readonly()
-});
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
 /**
-* A parked ("stationary") object surfaced alongside occupancy — an object that
-* settled and stopped moving. It is NO LONGER a tracked object (the tracker was
-* told to forget it so it stops re-spawning tracks/events), but it IS still
-* physically present, so it keeps counting toward `frame` occupancy and is
-* listed here so the UI can show it in a dedicated "Stationary" section instead
-* of flooding the live event feed.
-*/
-var StationaryObjectSchema = object({
-	id: string(),
-	className: string(),
-	bbox: object({
-		x: number(),
-		y: number(),
-		w: number(),
-		h: number()
-	}),
-	frameWidth: number().int().nonnegative(),
-	frameHeight: number().int().nonnegative(),
-	/** When the source track was first seen. */
-	firstSeenAt: number().int(),
-	/** When the object was recognised as parked (promotion time). */
-	becameStationaryAt: number().int(),
-	/** Last frame a detection confirmed the object is still there. */
-	lastConfirmedAt: number().int(),
-	/** Enrichment label carried from the source track (identity / plate). */
-	label: string().optional(),
-	/** Native-resolution key-frame media key for the parked object's best image. */
-	keyFrameMediaKey: string().optional()
-});
-var CameraOccupancySnapshotSchema = object({
-	/** Frame timestamp of the inference result that produced this snapshot. */
-	ts: number().int(),
-	/** Frame width/height in pixels — let the UI normalize bbox coords. */
-	frameWidth: number().int().nonnegative(),
-	frameHeight: number().int().nonnegative(),
-	/** Per-zone breakdown — one entry per defined zone (user + onboard). */
-	zones: array(ZoneScopeBreakdownSchema).readonly(),
-	/** Frame-wide aggregate (everywhere, regardless of zone membership).
-	*  INCLUDES currently-confirmed stationary objects (they are still present). */
-	frame: PerScopeBreakdownSchema,
-	/** Detections that landed outside every zone. Empty when no zones defined. */
-	unzoned: PerScopeBreakdownSchema,
-	/** Parked objects on this camera (additive — absent on legacy snapshots).
-	*  Surfaced separately so the UI shows them in a dedicated section rather
-	*  than as repeated tracks/events. */
-	stationaryObjects: array(StationaryObjectSchema).readonly().optional()
-});
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
 /**
-* Time-series resolution. The history methods return one bucket per
-* step over the requested range. Smaller resolutions cost more
-* memory + bandwidth; bound to discrete steps so caller cannot ask
-* for arbitrary fractional buckets.
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
 */
-var HistoryResolutionEnum = _enum([
-	"minute",
-	"5min",
-	"hour"
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
 ]);
-var HistoryRangeSchema = object({
-	/** Range start (epoch ms, inclusive). */
-	from: number().int(),
-	/** Range end (epoch ms, inclusive). Defaults to "now" at query time. */
-	to: number().int(),
-	resolution: HistoryResolutionEnum
-});
-var HistoryPointSchema = object({
-	/** Bucket midpoint (epoch ms). */
-	ts: number().int(),
-	/** Object count averaged over the bucket (rounded to nearest integer). */
-	count: number().int().nonnegative()
-});
-DeviceType.Camera, method(object({ deviceId: number() }), CameraOccupancySnapshotSchema.nullable()), method(object({
-	deviceId: number(),
-	zoneId: string(),
-	className: string().optional()
-}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly()), method(object({
-	deviceId: number(),
-	className: string().optional()
-}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly()), method(object({
-	deviceId: number(),
-	className: string().optional()
-}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly());
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
 /**
-* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
-* cap so a single CRUD surface backs every consumer; each stage has
-* its own dev-state mirror slice (`motion-zone-rules`,
-* `detection-zone-rules`, …) so consumer addons subscribe independently.
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
 *
-* Extend the enum here when a new gating consumer comes online (audio
-* gating, alert filtering, …) — no other surface needs to change.
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
 */
-var ZoneRuleStageEnum = _enum([
-	"motion",
-	"detection",
-	"package"
-]);
-DeviceType.Camera, method(object({
-	deviceId: number(),
-	stage: ZoneRuleStageEnum
-}), array(ZoneRuleSchema).readonly()), method(object({
-	deviceId: number(),
-	stage: ZoneRuleStageEnum,
-	rules: array(ZoneRuleSchema).readonly()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), object({
-	motion: array(ZoneRuleSchema).readonly(),
-	detection: array(ZoneRuleSchema).readonly(),
-	package: array(ZoneRuleSchema).readonly()
-});
-var HF_BASE_URL = `https://huggingface.co/camstack/camstack-models/resolve/main`;
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
 /**
-* Accessory device helpers — shared across drivers.
-*
-* Many vendor-specific drivers register accessory child devices on
-* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
-* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
-* driver picks the right `DeviceType` + `DeviceRole` explicitly when
-* spawning, builds a name derived from the parent, and produces a
-* stableId tied to the parent so boot-restore can reconstruct the
-* relationship.
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
 *
-* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
-* drivers may reasonably disagree on the right type for an accessory
-* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
-* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
-* one canonical mapping was over-prescriptive and added a layer of
-* indirection without saving meaningful code at call sites — the
-* driver knows its own hardware best.
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
 */
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
 /**
-* Subset of `DeviceRole` values that drivers register as child
-* accessories of a parent device. Sourced verbatim from `DeviceRole`
-* — `AccessoryKind` is the alias drivers use when building accessory
-* children, so the call site reads as
-* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
-* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
-* any role works, including non-accessory ones like Doorbell).
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
 */
-var AccessoryKind = {
-	Siren: DeviceRole.Siren,
-	Floodlight: DeviceRole.Floodlight,
-	Spotlight: DeviceRole.Spotlight,
-	PirSensor: DeviceRole.PirSensor,
-	Chime: DeviceRole.Chime,
-	Autotrack: DeviceRole.Autotrack,
-	Nightvision: DeviceRole.Nightvision,
-	PrivacyMask: DeviceRole.PrivacyMask
-};
-AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
-new Set(Object.values(DeviceType));
-DeviceFeature.BatteryOperated;
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+var ExpressionBindingSourceSchema = union([
+	object({
+		kind: literal("field").optional(),
+		sourceKey: string(),
+		cap: string(),
+		fieldPath: string()
+	}),
+	object({
+		kind: literal("literal"),
+		value: union([
+			string(),
+			number(),
+			boolean(),
+			_null()
+		])
+	}),
+	object({
+		kind: literal("global"),
+		sourceStableId: string(),
+		cap: string(),
+		fieldPath: string()
+	})
+]);
+object({
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
 Object.freeze({
 	"accessories.setChildHidden": {
 		capName: "accessories",
@@ -26696,6 +26675,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.restart": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.setEnabled": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -27332,12 +27317,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.setDeviceLinks": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.setDisabled": {
 		capName: "device-manager",
 		capScope: "system",
@@ -31318,249 +31297,62 @@ var DeviceIdsField = array(number()).min(1);
 var CadenceSecField = number().int().min(2).max(3600);
 var FramerateField = number().int().min(1).max(60);
 var TargetsField = array(NcRuleTargetSchema).min(1);
-var PriorityField = number().int().min(1).max(5);
-/**
-* Client-supplied timelapse-rule fields. The server stamps id / createdBy /
-* createdAt / updatedAt / ownerUserId / lastGeneratedAt — none of them appear
-* here (see the ownership note above).
-*/
-var TimelapseRuleInputSchema = object({
-	name: NameField,
-	enabled: boolean().default(true),
-	/** Cameras sampled by this rule — one scratch dir + one artifact per device. */
-	deviceIds: DeviceIdsField,
-	/**
-	* Activation window(s). REQUIRED (unlike `NcRule`, where an absent schedule
-	* means "always active"): a timelapse is defined by its window boundaries —
-	* open clears the scratch, close assembles and delivers.
-	*/
-	schedule: NcScheduleSchema,
-	/** Force-snapshot cadence inside the window, seconds (predecessor parity). */
-	cadenceSec: CadenceSecField.default(15),
-	/** Output frames per second of the assembled mp4 (predecessor parity). */
-	framerate: FramerateField.default(10),
-	/** `notification-output` targets the finished video/thumbnail is sent to. */
-	targets: TargetsField,
-	template: TimelapseTemplateSchema.optional(),
-	/** Canonical notification priority ordinal (1..5); per-target overridable. */
-	priority: PriorityField.default(3)
-});
-object({
-	name: NameField.optional(),
-	enabled: boolean().optional(),
-	deviceIds: DeviceIdsField.optional(),
-	schedule: NcScheduleSchema.optional(),
-	cadenceSec: CadenceSecField.optional(),
-	framerate: FramerateField.optional(),
-	targets: TargetsField.optional(),
-	template: TimelapseTemplateSchema.nullable().optional(),
-	priority: PriorityField.optional()
-});
-TimelapseRuleInputSchema.extend({
-	id: string(),
-	/**
-	* Ownership/visibility key. Absent = admin/global rule (visible to all).
-	* Present = personal rule owned by this userId. Server-stamped from the
-	* resolved caller; never trusted from a client payload.
-	*/
-	ownerUserId: string().optional(),
-	/**
-	* Epoch-ms of the last successful generation — the 1-hour re-generation
-	* guard's durable state (predecessor parity). Absent = never generated.
-	*/
-	lastGeneratedAt: number().optional(),
-	/** userId of the caller who created the rule (server-stamped). */
-	createdBy: string(),
-	createdAt: number(),
-	updatedAt: number()
-});
-function hfModelUrl(repo, path) {
-	return `https://huggingface.co/${repo}/resolve/main/${path}`;
-}
-/**
-* Names that, when used as URL query parameters, almost certainly carry
-* a secret. Matching is case-insensitive and anchored to the full param
-* name to avoid false positives like `user_id` (an entity reference, not
-* a credential) or `topic=password-reset` (a value happens to contain
-* the substring "password" but the param name is unrelated).
-*
-* Add new patterns here as we encounter cameras/APIs that leak through
-* the existing list.
-*/
-var CREDENTIAL_PARAM_PATTERNS = [
-	/^user$/i,
-	/^usr$/i,
-	/^username$/i,
-	/^password$/i,
-	/^pwd$/i,
-	/^pass$/i,
-	/^passwd$/i,
-	/^secret$/i,
-	/^token$/i,
-	/^auth$/i,
-	/^auth[_-]?token$/i,
-	/^bearer$/i,
-	/^api[_-]?key$/i,
-	/^access[_-]?token$/i,
-	/^refresh[_-]?token$/i
-];
-function isCredentialParam(name) {
-	return CREDENTIAL_PARAM_PATTERNS.some((re) => re.test(name));
-}
-/**
-* Redact secrets we may surface in logs or telemetry:
-*   1. `userinfo` (`user:password@host`) — the classic RTSP shape.
-*   2. Query-string credential params (`?user=...&password=...`) — the
-*      Reolink RTMP shape and several HTTP-pushed-stream APIs.
-*
-* Returns the original string verbatim when the input is not a parseable
-* URL — a log helper must never throw. Param values are replaced with
-* `***` so an operator reading logs still sees WHICH credential was
-* present (useful for debugging "wrong password" issues) without
-* exposing the value.
-*
-* The credential-name match is case-insensitive but anchored to the
-* whole param name; values like `user_id=42` or `topic=password-reset`
-* are NOT masked (those are entity references, not credentials).
-*/
-function maskUrlCredentials(rawUrl) {
-	try {
-		const u = new URL(rawUrl);
-		let touched = false;
-		if (u.username || u.password) {
-			u.username = "";
-			u.password = "";
-			touched = true;
-		}
-		for (const key of Array.from(u.searchParams.keys())) if (isCredentialParam(key)) {
-			u.searchParams.set(key, "***");
-			touched = true;
-		}
-		return touched ? u.toString() : rawUrl;
-	} catch {
-		return rawUrl;
-	}
-}
-/**
-* Fixed-capacity ring buffer. When full, push() overwrites the oldest entry.
-* drain() returns up to maxCount items in FIFO order and removes them.
-*/
-var RingBuffer = class {
-	capacity;
-	items;
-	head = 0;
-	tail = 0;
-	count = 0;
-	constructor(capacity) {
-		this.capacity = capacity;
-		this.items = Array.from({ length: capacity });
-	}
-	get size() {
-		return this.count;
-	}
-	push(item) {
-		this.items[this.tail] = item;
-		this.tail = (this.tail + 1) % this.capacity;
-		if (this.count < this.capacity) this.count++;
-		else this.head = (this.head + 1) % this.capacity;
-	}
-	drain(maxCount) {
-		const result = [];
-		const n = Math.min(maxCount, this.count);
-		for (let i = 0; i < n; i++) {
-			result.push(this.items[this.head]);
-			this.items[this.head] = void 0;
-			this.head = (this.head + 1) % this.capacity;
-		}
-		this.count -= n;
-		return result;
-	}
-};
-/**
-* DEVICE-POOL backend → model format — the SSOT for the multi-device inference
-* DESCRIPTOR path (Python per-device pools), distinct from {@link BACKEND_TO_FORMAT}
-* above which is the legacy NODE runtime map (where `coreml → onnx` because
-* onnxruntime-node's CoreML EP loads `.onnx`). Here a device pool runs the
-* backend NATIVELY, so `coreml → coreml` and `edgetpu → tflite`. Consumed by
-* `resolveDeviceEngine` (addon-pipeline) and the orchestrator's
-* `parseDeviceKey`/`getNodeInferenceDevices` — the previously-duplicated
-* `BACKEND_FORMAT` maps (R3/node-F2). `cpu`/`cuda` floor to onnx.
-*/
-var DEVICE_BACKEND_TO_FORMAT = {
-	openvino: "openvino",
-	edgetpu: "tflite",
-	coreml: "coreml",
-	onnx: "onnx",
-	cpu: "onnx",
-	cuda: "onnx"
-};
-/**
-* Evaluate `rules` against `items`. Returns the items partitioned
-* into `passed` (kept by the gate) and `excluded` (dropped). When
-* `rules` is empty or `zones` is empty everything passes — the gate
-* is "off" without explicit configuration.
-*
-* `getCenter` returns the item's normalised (0–1) center point.
-* `getClassName` is optional — when omitted, every rule's
-* `classFilter` is treated as matching all classes (motion-stage
-* semantics). Provide it for object detections so per-class rules
-* narrow correctly.
-*/
-function evaluateZoneRules(items, zones, rules, getCenter, getClassName) {
-	if (rules.length === 0 || zones.length === 0) return {
-		passed: items,
-		excluded: []
-	};
-	const activeRules = rules.filter((r) => r.enabled !== false);
-	const includeRules = activeRules.filter((r) => r.mode === "include");
-	const excludeRules = activeRules.filter((r) => r.mode === "exclude");
-	const whitelistMode = includeRules.length > 0;
-	const zonesById = new Map(zones.map((z) => [z.id, z]));
-	const passed = [];
-	const excluded = [];
-	for (const item of items) {
-		const center = getCenter(item);
-		const className = getClassName?.(item);
-		const inInclude = includeRules.some((r) => ruleApplies(r, center, className, zonesById));
-		const inExclude = excludeRules.some((r) => ruleApplies(r, center, className, zonesById));
-		if (whitelistMode) if (inInclude && !inExclude) passed.push(item);
-		else excluded.push(item);
-		else if (inExclude) excluded.push(item);
-		else passed.push(item);
-	}
-	return {
-		passed,
-		excluded
-	};
-}
-function ruleApplies(rule, center, className, zonesById) {
-	if (rule.classFilter && rule.classFilter.length > 0) {
-		if (className !== void 0 && !rule.classFilter.includes(className)) return false;
-	}
-	for (const zoneId of rule.zoneIds) {
-		const zone = zonesById.get(zoneId);
-		if (!zone) continue;
-		if (pointInPolygon(center, zone.polygon)) return true;
-	}
-	return false;
-}
+var PriorityField = number().int().min(1).max(5);
 /**
-* Standard ray-casting point-in-polygon. Polygon vertices are
-* normalised (0–1); the test point is too — frame-resolution-
-* agnostic. Boundary points count as inside (treats `<` as `<=` on
-* the y-edge crossing).
+* Client-supplied timelapse-rule fields. The server stamps id / createdBy /
+* createdAt / updatedAt / ownerUserId / lastGeneratedAt — none of them appear
+* here (see the ownership note above).
 */
-function pointInPolygon(point, polygon) {
-	if (polygon.length < 3) return false;
-	let inside = false;
-	const { x, y } = point;
-	for (let i = 0, j = polygon.length - 1; i < polygon.length; j = i++) {
-		const a = polygon[i];
-		const b = polygon[j];
-		if (a.y > y !== b.y > y && x < (b.x - a.x) * (y - a.y) / (b.y - a.y || Number.EPSILON) + a.x) inside = !inside;
-	}
-	return inside;
-}
+var TimelapseRuleInputSchema = object({
+	name: NameField,
+	enabled: boolean().default(true),
+	/** Cameras sampled by this rule — one scratch dir + one artifact per device. */
+	deviceIds: DeviceIdsField,
+	/**
+	* Activation window(s). REQUIRED (unlike `NcRule`, where an absent schedule
+	* means "always active"): a timelapse is defined by its window boundaries —
+	* open clears the scratch, close assembles and delivers.
+	*/
+	schedule: NcScheduleSchema,
+	/** Force-snapshot cadence inside the window, seconds (predecessor parity). */
+	cadenceSec: CadenceSecField.default(15),
+	/** Output frames per second of the assembled mp4 (predecessor parity). */
+	framerate: FramerateField.default(10),
+	/** `notification-output` targets the finished video/thumbnail is sent to. */
+	targets: TargetsField,
+	template: TimelapseTemplateSchema.optional(),
+	/** Canonical notification priority ordinal (1..5); per-target overridable. */
+	priority: PriorityField.default(3)
+});
+object({
+	name: NameField.optional(),
+	enabled: boolean().optional(),
+	deviceIds: DeviceIdsField.optional(),
+	schedule: NcScheduleSchema.optional(),
+	cadenceSec: CadenceSecField.optional(),
+	framerate: FramerateField.optional(),
+	targets: TargetsField.optional(),
+	template: TimelapseTemplateSchema.nullable().optional(),
+	priority: PriorityField.optional()
+});
+TimelapseRuleInputSchema.extend({
+	id: string(),
+	/**
+	* Ownership/visibility key. Absent = admin/global rule (visible to all).
+	* Present = personal rule owned by this userId. Server-stamped from the
+	* resolved caller; never trusted from a client payload.
+	*/
+	ownerUserId: string().optional(),
+	/**
+	* Epoch-ms of the last successful generation — the 1-hour re-generation
+	* guard's durable state (predecessor parity). Absent = never generated.
+	*/
+	lastGeneratedAt: number().optional(),
+	/** userId of the caller who created the rule (server-stamped). */
+	createdBy: string(),
+	createdAt: number(),
+	updatedAt: number()
+});
 var DETAIL_CROP_PADDING_KEY = "detailCropPaddingRatio";
 var DETAIL_CROP_SQUARE_KEY = "detailCropSquare";
 /**
@@ -31879,6 +31671,193 @@ function pickNativeLeaseOverride(view) {
 	}
 	return readNativeLeaseOverride(flat);
 }
+function hfModelUrl(repo, path) {
+	return `https://huggingface.co/${repo}/resolve/main/${path}`;
+}
+/**
+* Names that, when used as URL query parameters, almost certainly carry
+* a secret. Matching is case-insensitive and anchored to the full param
+* name to avoid false positives like `user_id` (an entity reference, not
+* a credential) or `topic=password-reset` (a value happens to contain
+* the substring "password" but the param name is unrelated).
+*
+* Add new patterns here as we encounter cameras/APIs that leak through
+* the existing list.
+*/
+var CREDENTIAL_PARAM_PATTERNS = [
+	/^user$/i,
+	/^usr$/i,
+	/^username$/i,
+	/^password$/i,
+	/^pwd$/i,
+	/^pass$/i,
+	/^passwd$/i,
+	/^secret$/i,
+	/^token$/i,
+	/^auth$/i,
+	/^auth[_-]?token$/i,
+	/^bearer$/i,
+	/^api[_-]?key$/i,
+	/^access[_-]?token$/i,
+	/^refresh[_-]?token$/i
+];
+function isCredentialParam(name) {
+	return CREDENTIAL_PARAM_PATTERNS.some((re) => re.test(name));
+}
+/**
+* Redact secrets we may surface in logs or telemetry:
+*   1. `userinfo` (`user:password@host`) — the classic RTSP shape.
+*   2. Query-string credential params (`?user=...&password=...`) — the
+*      Reolink RTMP shape and several HTTP-pushed-stream APIs.
+*
+* Returns the original string verbatim when the input is not a parseable
+* URL — a log helper must never throw. Param values are replaced with
+* `***` so an operator reading logs still sees WHICH credential was
+* present (useful for debugging "wrong password" issues) without
+* exposing the value.
+*
+* The credential-name match is case-insensitive but anchored to the
+* whole param name; values like `user_id=42` or `topic=password-reset`
+* are NOT masked (those are entity references, not credentials).
+*/
+function maskUrlCredentials(rawUrl) {
+	try {
+		const u = new URL(rawUrl);
+		let touched = false;
+		if (u.username || u.password) {
+			u.username = "";
+			u.password = "";
+			touched = true;
+		}
+		for (const key of Array.from(u.searchParams.keys())) if (isCredentialParam(key)) {
+			u.searchParams.set(key, "***");
+			touched = true;
+		}
+		return touched ? u.toString() : rawUrl;
+	} catch {
+		return rawUrl;
+	}
+}
+/**
+* Fixed-capacity ring buffer. When full, push() overwrites the oldest entry.
+* drain() returns up to maxCount items in FIFO order and removes them.
+*/
+var RingBuffer = class {
+	capacity;
+	items;
+	head = 0;
+	tail = 0;
+	count = 0;
+	constructor(capacity) {
+		this.capacity = capacity;
+		this.items = Array.from({ length: capacity });
+	}
+	get size() {
+		return this.count;
+	}
+	push(item) {
+		this.items[this.tail] = item;
+		this.tail = (this.tail + 1) % this.capacity;
+		if (this.count < this.capacity) this.count++;
+		else this.head = (this.head + 1) % this.capacity;
+	}
+	drain(maxCount) {
+		const result = [];
+		const n = Math.min(maxCount, this.count);
+		for (let i = 0; i < n; i++) {
+			result.push(this.items[this.head]);
+			this.items[this.head] = void 0;
+			this.head = (this.head + 1) % this.capacity;
+		}
+		this.count -= n;
+		return result;
+	}
+};
+/**
+* DEVICE-POOL backend → model format — the SSOT for the multi-device inference
+* DESCRIPTOR path (Python per-device pools), distinct from {@link BACKEND_TO_FORMAT}
+* above which is the legacy NODE runtime map (where `coreml → onnx` because
+* onnxruntime-node's CoreML EP loads `.onnx`). Here a device pool runs the
+* backend NATIVELY, so `coreml → coreml` and `edgetpu → tflite`. Consumed by
+* `resolveDeviceEngine` (addon-pipeline) and the orchestrator's
+* `parseDeviceKey`/`getNodeInferenceDevices` — the previously-duplicated
+* `BACKEND_FORMAT` maps (R3/node-F2). `cpu`/`cuda` floor to onnx.
+*/
+var DEVICE_BACKEND_TO_FORMAT = {
+	openvino: "openvino",
+	edgetpu: "tflite",
+	coreml: "coreml",
+	onnx: "onnx",
+	cpu: "onnx",
+	cuda: "onnx"
+};
+/**
+* Evaluate `rules` against `items`. Returns the items partitioned
+* into `passed` (kept by the gate) and `excluded` (dropped). When
+* `rules` is empty or `zones` is empty everything passes — the gate
+* is "off" without explicit configuration.
+*
+* `getCenter` returns the item's normalised (0–1) center point.
+* `getClassName` is optional — when omitted, every rule's
+* `classFilter` is treated as matching all classes (motion-stage
+* semantics). Provide it for object detections so per-class rules
+* narrow correctly.
+*/
+function evaluateZoneRules(items, zones, rules, getCenter, getClassName) {
+	if (rules.length === 0 || zones.length === 0) return {
+		passed: items,
+		excluded: []
+	};
+	const activeRules = rules.filter((r) => r.enabled !== false);
+	const includeRules = activeRules.filter((r) => r.mode === "include");
+	const excludeRules = activeRules.filter((r) => r.mode === "exclude");
+	const whitelistMode = includeRules.length > 0;
+	const zonesById = new Map(zones.map((z) => [z.id, z]));
+	const passed = [];
+	const excluded = [];
+	for (const item of items) {
+		const center = getCenter(item);
+		const className = getClassName?.(item);
+		const inInclude = includeRules.some((r) => ruleApplies(r, center, className, zonesById));
+		const inExclude = excludeRules.some((r) => ruleApplies(r, center, className, zonesById));
+		if (whitelistMode) if (inInclude && !inExclude) passed.push(item);
+		else excluded.push(item);
+		else if (inExclude) excluded.push(item);
+		else passed.push(item);
+	}
+	return {
+		passed,
+		excluded
+	};
+}
+function ruleApplies(rule, center, className, zonesById) {
+	if (rule.classFilter && rule.classFilter.length > 0) {
+		if (className !== void 0 && !rule.classFilter.includes(className)) return false;
+	}
+	for (const zoneId of rule.zoneIds) {
+		const zone = zonesById.get(zoneId);
+		if (!zone) continue;
+		if (pointInPolygon(center, zone.polygon)) return true;
+	}
+	return false;
+}
+/**
+* Standard ray-casting point-in-polygon. Polygon vertices are
+* normalised (0–1); the test point is too — frame-resolution-
+* agnostic. Boundary points count as inside (treats `<` as `<=` on
+* the y-edge crossing).
+*/
+function pointInPolygon(point, polygon) {
+	if (polygon.length < 3) return false;
+	let inside = false;
+	const { x, y } = point;
+	for (let i = 0, j = polygon.length - 1; i < polygon.length; j = i++) {
+		const a = polygon[i];
+		const b = polygon[j];
+		if (a.y > y !== b.y > y && x < (b.x - a.x) * (y - a.y) / (b.y - a.y || Number.EPSILON) + a.x) inside = !inside;
+	}
+	return inside;
+}
 var AUTO = {
 	value: "auto",
 	label: "Auto"